Q. How do I determine how many licenses to purchase?

A. The AnyConnect Plus and Apex model is based on total authorized users that will make use of any AnyConnect service, not simultaneous connections (either on a per-ASA or shared basis) and not total active remote access users. As such, a user can connect with as many devices as he / she wants as long as the you have available hardware capacity and have not exceeded your purchased authorized user count. It is your responsibility to purchase additional authorized user licenses if their usage needs increase. If you currently support 30K simultaneous user connections but have 50K users who need AnyConnect services, you would be required to buy a 50K license. If you have 100K users who need AnyConnect services, you would be required to buy a 100K license. For unattended environments where there are not really individual users on the other side of a connection, each unattended device is considered a unique user.

Q. How can I choose whether I need a Cisco AnyConnect Plus or Apex license?

A. The Plus license gives the same connectivity as was previously available via the original Essentials license whereas the Cisco Apex license gives many of the same features as the Premium or Shared license. A complete itemization of available features is available in the Cisco AnyConnect Ordering guide.

Q. Which Cisco ASA versions are the AnyConnect Plus/Apex licenses compatible with? Can we use these licenses with the original ASA 5500s and 5550-Xs?

A. There are no limitations on ASA versions required for the Plus/Apex licenses. Any Cisco ASA device able to support Cisco AnyConnect can support the new license model. Some features, like per app VPN will need newer ASA versions or hardware. These licenses are compatible with the original and new ASA models. PAK registration is particular to the ASA 5500/5500-X and cannot occur for the ASAv, Firepower or Cisco ISR / ASR / CSR 1000V VPN head-ends, but the contract registration still has to be done in order to allow software downloads access and get technical support.

Q. Which AnyConnect license is required to allow IKEv2 VPN from third party VPN clients to the ASA?

A. The Cisco AnyConnect Plus license is needed for 3rd party IKEv2 VPN client support. This is the same as how Cisco AnyConnect Apex is needed for clientless support. Cisco AnyConnect Apex has all Plus functionality and can be used to allow IKEv2 VPN from third party VPN clients.

To learn more, please speak to our licensing specialists today.