Q. Are any exceptional provisions needed for converting from Shared licensing?

A. Please ensure that you replace licenses on all of the member devices and deactivate shared licensing on these devices prior to replacing the license on the ASA device presently acting as the shared license server.

Q. Are any exceptional steps needed for converting from Essentials licensing?

A. Your new Cisco Plus, Apex or VPN Only license key does not make use of the Essentials option.  In order to use your new license key, you have to disable the Cisco Anyconnect Essentials feature on the ASA device by issuing a “no anyconnect-essentials” command under “webvpn“.  At the time of installation of your new license key you will get a warning message which needs to be agreed to instructing you that the Cisco Essentials key will not be in the new license you are about to install.  As long as you have correctly disabled Cisco Anyconnect Essentials on your ASA device, you will be fine to proceed. Certain ASA versions might need a reboot at the time of installing a new license key to make sure it has been correctly activated.

Q. Is there some proactive contract renewal notification message? How can I check when my contract will expire?

A. Proactive renewal notices are not presently in place. Therefore, it is your obligation to keep a track of the contract expiration date. This can be checked in the Cisco Sales Order Subscription field or SWSS line item and at any given time by logging in to your Cisco.com account linked to your contract (CSCC), which will display the start and end dates for your contract. For banding Plus/Apex SKUs (L-AC-PLS-LIC= and L-AC-APX-LIC=), you will also get your license expiration dates in the license registration emails and the expiration dates can be seen in your Cisco license portal when you are viewing your registered licenses.  You cannot determine your Cisco AnyConnect license tier, authorized user count or expiration date using the ‘show version’ command of your head-end.

Q. Will Cisco be making any changes to proactive contract renewal notifications?

A. Cisco is currently investigating improvements in this area.

Q. What will happen to my previous Cisco AnyConnect licenses when I deploy the new licenses?

A. All previous Cisco AnyConnect licenses will be removed and replaced by the new licensing model if you deploy a new PAK Key.

Q. Which part should I purchase for renewals? How will the license be handled on my ASA?

A. Renewals should be handled by using the L-AC-PLS-LIC= (AnyConnect Plus) and L-AC-APX-LIC= (AnyConnect Apex) SKUs irrespective of what SKU the original order was placed. For both your early purchases and renewals, you have to complete your ASA device registration and share the functions with all your ASAs.For renewals you don’t have to do anything with the license key which will be emailed to you thereafter (there is no obligation to re-install a different license key on your ASA at renewal time).

To learn more, please speak to our licensing specialists today.

Q. Do I have to upgrade to Cisco AnyConnect 4.x?

A. You do not have to upgrade to Cisco AnyConnect 4.x while moving to the new licensing. Nevertheless, AnyConnect 3.x is already End-Of-Life (no additional fixes will be available from Cisco). If you don’t upgrade to a Cisco AnyConnect Plus/Apex license, you won’t get access to newer AnyConnect versions. The Plus or Apex licensing does not necessitate you to upgrade your Cisco AnyConnect software at the same time.

Q. What does “PAK/s or Token/s xxxxxxx is / are either Invalid or Inactive” mean while I am trying to register a license on www.cisco.com/go/license?

A. Once a license Product Activation Key is generated, it can take up to one day after the eDelivery license is delivered before the PAK Key is able to be registered on the Cisco licensing portal. This error message will be displayed if you are trying to register a PAK Key which is not yet able to be registered. If more than one day has passed since your license was eDelivered but you are still getting this error, you will need to open up a case with Cisco Global Licensing (GLO).

Q. When did the new Cisco AnyConnect licenses become available for purchase?

A. Fall 2014.  The Cisco AnyConnect Plus and Apex banding SKUs and VPN Only SKUs are available for purchase since April 2016.

Q. When were the previous Cisco AnyConnect/VPN SKUs phased out?

A. The phase out started in January 2015 and was completed on August 31, 2015. These older licenses are no longer able to be purchased.

Q. How can I get a trial Cisco AnyConnect Apex license for an ASA?

A. Cisco offers Four-week Apex evaluation licenses which integrate all the Plus license functionality. To get an evaluation license, please go to: https://www.cisco.com/go/license. Choose the following: Get Other Licenses -> Demo and Evaluation -> Security Products -> AnyConnect Plus/Apex (ASA) Demo License. The trial license unlocks the ASA functions, but will not give access to the Cisco AnyConnect Windows/Mac OS X/Linux software. Mobile versions of Cisco AnyConnect can be accessed by using the Application store for the Operating System and can be trialed in tandem with an evaluation license.

Q. I just installed a new license on my ASA device and got a warning that some features will be disabled?

A. As long as the license features you have been emailed are accurately displayed, this message can be safely overlooked. Just say yes, write the key to memory and restart your ASA device to finish the license installation.  The ASA will not be able to suitably validate the features available in the key in certain cases prior to its rebooting. In case the correct features are not showing in the Cisco licensing email, you will have to open a case with Cisco Global Licensing (GLO) to fix this before installing the key.

Q. Where can I find the Cisco AnyConnect Supplemental End User License and Privacy Policy?

A. The Cisco license terms & conditions are available in the Supplemental End User Agreement (SEULA). The AnyConnect privacy policy can be seen at: http://www.cisco.com/web/siteassets/legal/privacy.html

Q. What is the U.S. export classification for Cisco AnyConnect?

A. Commodity Classification Automated Tracking System (CCATS): Self-classified / Mass Market

   USA Export Control Classification Number (ECCN): 5D992

   USA Encryption Registration Number  (ERN): R104011

   French ANSSI declaration approval #: 1211725

   Details available at: http://tools.cisco.com/legal/export/pepd/Search.do

To learn more, please speak to our licensing specialists today.

Cisco AnyConnect 4.0 is not licensed based on concurrent connections (like the old AnyConnect 3.x), instead it is now based on users. This implies that a user connecting using his phone and laptop concurrently will only require a single license.

As the newer Cisco AnyConnect licenses are subscription-based, when the subscription expires and has not been renewed, they will not work any longer.
 
Cisco AnyConnect Secure Mobility Client 4.0 provides support for the below operating systems:

• Windows 8.1 – (32bit & 64Bit)
• Windows 8 – (32bit & 64Bit)
• Windows 7 – (32bit & 64Bit)
• Linux Ubuntu 12.X – 64Bit
• Linux RedHat 6 – 64Bit
• Mac OS X 10.10 to 10.8

Please note that Windows XP is no longer supported.

Cisco AnyConnect Plus License (Replacement for the previous Essentials License) 1, 3 or 5-Year Terms

The AnyConnect Plus License is a subscription-based license with the choices of a 1, 3 or 5-year renewable subscription and provides support for the below features:

• VPN Support for devices including workstations & laptops.
• Secure Mobility Client support (Cisco AnyConnect Mobile). This includes phones, tablets etc.
• SSL VPN – Client-based
• Per-application VPN Support. Approve particular apps to access the VPN.  Supports particular devices and software.
• Basic endpoint circumstance gathering
• IEEE 802.1X Windows suppliant
• Cisco Cloud Web Security agent for Microsoft Windows and Macintosh OS X platforms
• Cloud Web Security & Web Security Appliance
• Advanced Malware Protection for Endpoints Enabler. AMP for Endpoints is licensed separately
• Network Access Manager
• Federal Information Processing Standards (FIPS) Compliance

Cisco AnyConnect 3.x necessitated the buying of an Essentials or Premium license + AnyConnect Mobile (L-ASA-AC-M-55xx) to support mobile devices (Smartphones & Tablets etc.).  Cisco AnyConnect Mobile is now assimilated into the new Cisco AnyConnect Plus license.

Cisco AnyConnect Plus Perpetual License (Permanent)

The Cisco AnyConnect Plus Perpetual license provides support for the same features as the Plus license detailed above, but with the difference that it is a perpetual term license.
 
The client buys it once and does not get any subscription services, though it is still necessary to buy a Software Application Support plus Upgrades (SASU) contract. Customers thinking about buying the Plus Perpetual license may want to compare costs with the subscription-based license to see whether it is worth going down this path in the long run.

Cisco AnyConnect Apex License (Replacement for the previous Premium License)

The Cisco AnyConnect Apex License comprises all the features of the AnyConnect Plus license along with the below:

• All Cisco AnyConnect Plus features
• Clientless/browser-based VPN Termination on the ASA Firewall
• VPN compliance and posture agent in tandem with the Cisco ASA Firewall
• Incorporated compliance and posture agent in tandem with the Identity Services Engine (ISE) 1.3 or later
• Support for better next-gen encryption (Suite B)

The Cisco AnyConnect Apex license is only obtainable as a subscription-based license. There is no permanent license obtainable.
 
The next-gen suite B encryption provides support for the below mentioned improvd encryption standards:

• Advanced Encryption Standard (AES) having key sizes of 128 & 256 bits.
• Elliptic Curve Digital Signature Algorithm (ECDSA) – digital signatures
• Elliptic Curve Diffie–Hellman (ECDH) – key exchange agreement
• Secure Hash Algorithm 2 (SHA-256 and SHA-384) – message digest

To learn more, please speak to our licensing specialists today.

Q. Is there a limitation to the number of ASAs I can use with my AnyConnect Plus or Apex license?

A. You will be able to use a Plus or Apex license with as many ASAs as you want during your license term so long as you don’t go over your purchased authorized user license. Upon buying either of these license options, a Product Activation Key (PAK) will be shared which is then utilized to enable these services on numerous ASAs. Plus / Apex licenses will not be locked to a single ASA like the previous Essentials or Premium / Shared licenses were.

Q. How can I order Cisco AnyConnect Plus/Apex with the ASA device as the headend?

A. Cisco AnyConnect Plus or Apex license(s) are orderable apart from the head-end. Cisco AnyConnect Plus/Apex licenses are not bound to a definite ASA device / head-end but rather to your global arrangement. The best cost effective method to buy a license is to get your entire deployment covered. Cisco AnyConnect Plus and Apex will ultimately be an elective item with some ASA bundles alongside other security subscriptions. Kindly refer to Cisco’s AnyConnect ordering guide for more details.

Q. How can I place an order for AnyConnect licenses for more than one independent clients?

A. It is imperative that you order each license for a separate customer as its own line item, preferably having its exclusive Sales Order Number so the end user information is appropriately recorded and that support services are entitled accurately. In case you order several quantities for the top or second level Cisco AnyConnect Product IDs during your order process, you will get entitlement for what you have bought but it will not produce more Product Activation Keys. If your intention is to order for various customers, you should be ordering for each client separately. At the bare minimum you have to order each license as its own unique top level line item, not by raising the quantity for one single shared line item. While ordering an AnyConnect Plus Perpetual License, you would not order: L-AC-PLS-P-G Qty:2 or mention quantity of 2 on the next level down, rather you can place 2 separate line orders, both for L-AC-PLS-G with Qty: 1 for each order.

Q. How many ISE deployments can be used with an AnyConnect Plus or Apex license?

A. Cisco AnyConnect Plus or Apex license(s) can be utilized across any amount of Cisco ISE devices or deployments as long as you don’t go over the authorized users license count. Buying either license option along with ISE does not need any PAK file registration or loading into Cisco ISE (AnyConnect’s PAK files are only applied to the ASA). Therefore, in any Cisco ISE deployment, AnyConnect Plus and Apex licenses are simply right to use licenses.

To learn more, please speak to our licensing specialists today.

Q. Which licenses are required for Network Access Manager?

A. Network Access Manager features need a Plus or Apex license per authorized/unique user.

Q. How can I order Cisco AnyConnect Plus or Apex licenses with other headends or services?

A. Cisco AnyConnect Plus or Apex license(s) must be ordered apart from any other headend or services outside of the ASA device.

Q. Can the Cisco AnyConnect Network Visibility Module be ordered as a standalone?

A. No. The Cisco Network Visibility Module is only obtainable in the Cisco AnyConnect Apex licenses. The Network Visibility modules employ AnyConnect’s dependable network discovery feature in the VPN module but exclusive of this ability, it can work without other Cisco AnyConnect modules.

Q. Is it possible to mix and match Cisco AnyConnect Plus and Apex or is it just one or the other? And do Plus and Apex eliminate the requirement for Shared and Flex licenses?

A. Yes. Cisco AnyConnect Plus and Apex licenses are able to be mixed within one deployment. Cisco AnyConnect Plus and Apex both give identical cross deployment features as the obsolete Shared licenses. Cisco AnyConnect Plus and Apex are licensed based on the total number of users for the particular Cisco AnyConnect service being utilized so that no matter how frequently they connect or how many devices they utilize, the new Cisco AnyConnect Plus and Apex licenses eliminate the requirement for Flex (Business continuity) licenses.

Q. Is it possible to mix and match Cisco AnyConnect Plus, VPN or VPN Only licenses with previous Essentials or Premium licenses?

A. No. Obsolete Essentials or Premium licenses cannot co-exist on the same hardware as the newer Plus, Apex or VPN Only licenses. Also, VPN Only licenses cannot co-exist on the same hardware with Plus or Apex licenses.

Q. Does ASAv provide support for remote access using AnyConnect Plus and Apex licenses?

A. Yes. However, ASAv, which uses Cisco Smart Licensing, does not need a Cisco AnyConnect license to be physically applied to the platform. The identical licenses must still be bought and you have to still link the Contract number to your Cisco.com ID for Software Center access and TAC support.

Q. Which licenses are required for an AnyConnect VPN connection with a Cisco IP phone?

A. Cisco AnyConnect Plus (or Apex). Hitherto Phone VPN needed a Premium license AND a Phone VPN license. This is for VPN Phones and NOT UC Proxies. UC Proxy licenses are not associated with AnyConnect licenses.

Q. Why does a part increase 99999 times when buying an AnyConnect Plus perpetual or non-banding AnyConnect Plus or Apex license?

A. This is standard. These parts increase to enable you to register your Cisco AnyConnect Plus or Apex license to all your ASA serial numbers. The expansion SKU is not applicable to the new banding-based Plus (L-AC-PLS-LIC=) or Apex (L-AC-APX-LIC=) SKUs or the VPN Only SKUs (L-AC-VPNO-xxxx=).  You can check the Cisco AnyConnect Ordering guide for details on license registration per SKU type.

To learn more, please speak to our licensing specialists today.

Q. What if I lose my Product Activation Key (PAK)?

A. The Product Activation Key (PAK) must be treated like money. In case you misplace your PAK key before using it, the only other way Cisco locate it is via the Cisco Sales Order #. In case you have used this PAK key in the past to register an ASA, the PAK can be found on the Cisco.com license portal for the user who completed the license registration. Cisco is able to look up this information based on a serial number utilized for a previous registration.

Q. I just made a purchase for Plus/Apex licenses 5 minutes back and want to start using it immediately.

A. The Cisco Plus/Apex model needs a PAK key to activate an ASA and enable support/Software access. Therefore, it is not possible to get the ASA license before the PAK key has been generated. However it is possible to obtain a one-month provisional ASA license. Licenses cannot be utilized the second you get the eDelivery notification. It can take up to one day for your license PAK key to be activated on the License portal.

Q. Why am I getting a Serial number cannot be blank error notification while registering a license?

A. You probably accidentally pasted in a trailing space at the end of your serial number. Also eliminate any extra spaces after your serial number and then resubmit your request. The other reason for this error is that you may have clicked the Add Device button which is there to add more than one Serial Number at the initial registration instance, but you did not add any further Serial Numbers. For this situation, you need to click the Delete Device button and submit it again without the blank spacing which is intended only for addition of an additional serial number.

Q. How can I access the Cisco AnyConnect v4.x Software Center on Cisco.com and get TAC support?

A. When you buy any term Plus or Apex license (or SWSS for Plus perpetual or VPN Only), a contract number will be produced for your purchase, this normally takes a few days from the time the license PAK is electronically delivered to you. You need to speak with your Cisco Authorized Reseller if you have not received this contract number. The contract number has to be linked to your Cisco.com ID in order to allow Software Center access and the capability to open TAC cases. We recommend that you associate your contract to their Cisco.com ID by sending an email to web-help-sr@cisco.com with the Contract # and their Cisco.com ID. It is imperative that your customer profile address data matches the address data on the contract before trying to associate a contract or sending any email. The contract number is not identical to your PAK key.

Q. In case of an RMA, what happens to my ASA License Key?

A. All ASA license keys get uncovered during an ongoing RMA, this is a regular stage of the RMA process at Cisco and is not particular to this license. As the PAK Key is for multi-use, you do not require an RMA case to start a transfer, you can simply just re-register your PAK key to your new ASA Serial Number.

Q. How does license expiration work? Does the initiation time begin counting down as soon as I install a license to my ASA device?

A. The countdown is based on the same manner that all Cisco term-based licenses work, there is not anything AnyConnect particular as part of this. The contract is set to become active one day after shipment (these are electronically delivered licenses also called eDelivery). So if an order ships on October 25 2014, the service initiation date will be October 26th.

To learn more, please speak to our licensing specialists today.

Q. How do I determine how many licenses to purchase?

A. The AnyConnect Plus and Apex model is based on total authorized users that will make use of any AnyConnect service, not simultaneous connections (either on a per-ASA or shared basis) and not total active remote access users. As such, a user can connect with as many devices as he / she wants as long as the you have available hardware capacity and have not exceeded your purchased authorized user count. It is your responsibility to purchase additional authorized user licenses if their usage needs increase. If you currently support 30K simultaneous user connections but have 50K users who need AnyConnect services, you would be required to buy a 50K license. If you have 100K users who need AnyConnect services, you would be required to buy a 100K license. For unattended environments where there are not really individual users on the other side of a connection, each unattended device is considered a unique user.

Q. How can I choose whether I need a Cisco AnyConnect Plus or Apex license?

A. The Plus license gives the same connectivity as was previously available via the original Essentials license whereas the Cisco Apex license gives many of the same features as the Premium or Shared license. A complete itemization of available features is available in the Cisco AnyConnect Ordering guide.

Q. Which Cisco ASA versions are the AnyConnect Plus/Apex licenses compatible with? Can we use these licenses with the original ASA 5500s and 5550-Xs?

A. There are no limitations on ASA versions required for the Plus/Apex licenses. Any Cisco ASA device able to support Cisco AnyConnect can support the new license model. Some features, like per app VPN will need newer ASA versions or hardware. These licenses are compatible with the original and new ASA models. PAK registration is particular to the ASA 5500/5500-X and cannot occur for the ASAv, Firepower or Cisco ISR / ASR / CSR 1000V VPN head-ends, but the contract registration still has to be done in order to allow software downloads access and get technical support.

Q. Which AnyConnect license is required to allow IKEv2 VPN from third party VPN clients to the ASA?

A. The Cisco AnyConnect Plus license is needed for 3rd party IKEv2 VPN client support. This is the same as how Cisco AnyConnect Apex is needed for clientless support. Cisco AnyConnect Apex has all Plus functionality and can be used to allow IKEv2 VPN from third party VPN clients.

To learn more, please speak to our licensing specialists today.