Cisco AnyConnect Licensing Frequently Asked Questions (FAQ)

FAQCisco PublicQ. What are the available authorized (user)counts for the new AnyConnect licenses?Q. What factors contributed to changing theAnyConnect license models?A. We have taken in to account feedback fromcustomers over many years requesting a simplifiedlicensing model. As such, the new license modeleliminates all of the add-on licenses complexity whilealso allowing for co-existence of license types. Thenew model provides shared licensing across all optionswithout the need to have hardware in place to enforcelicenses and eliminates the requirement to purchaseAnyConnect licenses on a per ASA basis (assisting withHW migrations). Moreover, the new model has built-inpandemic support. Please note that all term licensesinclude support and software entitlement, so purchasingthese licenses will always grant you access to thecurrent software releases. 2020 Cisco and/or its affiliates. All rights reserved.A. The Plus and Apex licenses are available viabanding-based licenses (L-AC-PLS-LIC and L-ACAPX-LIC ) that allow you to select a specific user count(e.g. 873), a specific term length (e.g. 30 months) andstart date (e.g. term starts on date X, up to 60 days inthe future). The price per user per month decreasesas the user count increases and/or the term lengthincreases. Whenever possible, this method should beused to order Plus and Apex term licenses instead ofthe LAC-PLS-xYR-G/L-AC-APX-xYR-G method. TheL-AC-PLS-LIC and L-AC-APX-LIC ordering methodwill provide more flexibility for user counts,term duration and simpler renewals.Q. How is the 4.x conversion being handledfor the mobile versions of AnyConnect?A. Use of AnyConnect on iOS & Android without anactive Plus, Apex or VPN Only license (term or contract)expired on April 30, 2016. AnyConnect customers withEssentials/Premium and Mobile (discontinued) licensesmay no longer use this software. Newer platforms suchas Windows Phone 8.1, Windows 10 Mobile, BlackBerry10 and Google Chrome OS have always required activePlus, Apex or VPN Only licensing.Q. Can I buy a perpetual AnyConnectlicense? Can you tell me more aboutAnyConnect Only and AnyConnect PlusPerpetual?A. Yes. AnyConnect Plus is offered as a perpetuallicense in addition to the 1, 3 or 5 year terms.Cisco also offers a perpetual VPN-only license.This provides the equivalent functionality of priorAnyConnect Premium plus Advanced EndpointAssessment plus Mobile plus Phone VPN.The VPN-only Licenses are designed for VPN onlyenvironments that have a large number of potentialend users but very infrequent use (e.g. university with10,000 students but with only 100 active users atany one time). With either the Plus Perpetual or VPNonly licenses, you must separately purchase supportservices or you will not be eligible to access software ortech support.AnyConnect Licensing FAQ 6

FAQCisco PublicAnyConnect Only is licensed based on a single headenddevice and simultaneous connections (not authorizedusers). For active/standby pairs, only the primaryheadend is required to have a VPN Only license. VPNOnly licenses are an alternative to the AnyConnect Plusand Apex model. No other AnyConnect function orservice (Web Security Module, Identity Services EnginePosture, Network Visibility, ASA Multi-context VPN, etc)is available with the AnyConnect Only licenses. VPNOnly licenses do support Clientless SSL VPN, third partyIPsec IKEv2, Suite B and VPN HostScan with an ASA.The VPN Only licenses cannot be transferred, rehosted,shared, combined, split, or directly upgraded to anotherVPN Only license size. These licenses do not coexistwith Plus or Apex licensing or any retiredAnyConnect licenses.Plus and Apex. The VPN-only are applied per individualASA and there is no sharing of licenses between ASAs,unlike AnyConnect Plus and Apex, which provide thiscapability. For active/standby pairs, only the primaryheadend is required to have a VPN Only license. TheVPN-only licenses are not portable, which means thatwhen a new ASA is purchased additional licensesalso need to be purchased. VPN-only license are notadditive meaning that you can’t start with a set numberof licenses (e.g. 500 at time x) and then increasecapacity over time (e.g. add 100 more at time x y). Nor can they be bought to service burst capacityrequirements. And as mentioned previously, VPN-onlylicenses require the purchasing of support serviceswhereas support is built into the term contracts forAnyConnect Plus and Apex.Both VPN Only and Plus Perpetual licenses require aSWSS contract on all head-ends in order to be eligiblefor SW access, updates, and techical support.Q. How do I determine how many licensesto purchase?Q. Are there any additional limitations of theAnyConnect-only licenses?A. Yes. The AnyConnect-only licenses are concurrentendpoint based vs total active user with AnyConnect 2020 Cisco and/or its affiliates. All rights reserved.A. The AnyConnect Plus and Apex model is basedon total authorized users that will make use of anyAnyConnect service, not simultaneous connections(either on a per-ASA or shared basis) and not totalactive remote access users. As such, a user canconnect with as many devices as he / she wants as longas the you have available hardware capacity and havenot exceeded your purchased authorized user count. Itis your responsibility to purchase additional authorizeduser licenses if their usage needs increase. If youcurrently support 30K simultaneous user connectionsbut have 50K users who need AnyConnect services,you would be required to buy a 50K license. If you have100K users who need AnyConnect services, you wouldbe required to buy a 100K license. For unattendedenvironments where there are not really individual userson the other side of a connection, each unattendeddevice is considered a unique user.Q. How do I know if I need AnyConnect Plusor Apex license?A. The Plus license provides similar connectivity as wasavailable with the original Essentials license while theApex license provides many of the same capabilitiesfrom the Premium or Shared license. A full breakdownof features is noted in the AnyConnect Ordering guide.AnyConnect Licensing FAQ 7

FAQCisco PublicQ. What ASA versions are the AnyConnectPlus/Apex licenses compatible with? Canthese licenses be used with both the originalASA 5500s and 5550-Xs?A. There are no restrictions on ASA versions for thePlus/Apex licenses. Any ASA capable of supportingAnyConnect will support the new license model.Certain features, i.e. per application VPN will requirenewer ASA versions/HW. The licenses are compatiblewith both original and current ASA models. PAKregistration is specific to the ASA 5500/5500-X anddoes not happen for the ASAv, Firepower or CiscoISR / ASR / CSR 1000V VPN head-ends, however thecontract registration still needs to be completed inorder to enable software download access and receivetech support.Q. What license is needed to enable IKEv2VPN from 3rd party VPN clients to the ASA?A. The AnyConnect Plus license is required for thirdparty IKEv2 VPN client support. This is similar to howAnyConnect Apex is required for clientless support.AnyConnect Apex which includes all Plus functionalitycan also be used to enable IKEv2 VPN from 3rd partyVPN clients. 2020 Cisco and/or its affiliates. All rights reserved.Q. How many AnyConnect Plus licensesare needed when standards-based IKEv2Remote Access VPN access is utilized onthe ASA or Apex licenses when access tothe ASA is clientless?A. The AnyConnect Plus or Apex users license countneeds to service the total unique users utilizingAnyConnect, Third party IKEv2 access, or clientlessservices (be they active on the network or not).Q. How many ASAs can I use with myAnyConnect Plus or Apex license?A. You are eligible to use a Plus or Apex license with asmany ASAs as you own during your license term as longas you do not need exceed your purchased authorizeduser license. Upon purchasing either license option, aProduct Activation Key (PAK) will be provided which isused to unlock these services on multiple ASAs. Plus/ Apex licenses are not locked to a single ASA as theEssentials or Premium / Shared licenses were.Q. How do I order AnyConnect Plus or Apexwith the ASA as the headend?A. AnyConnect Plus or Apex license(s) are orderedseparately from the head-end. AnyConnect Plus orApex licenses are not tied to a specific ASA / headend but rather to your overall deployment. The mostcost effective way to purchase a license is to coveryour entire deployment. That being said, AnyConnectPlus and Apex will eventually be an optional itemunder certain ASA bundles along side other securitysubscriptions. Please refer to the AnyConnect orderingguide for additional details.Q. How do I order AnyConnect licenses formultiple independent customers?A. It is important to order each license for a separatecustomer as its own line item, preferably as its ownunique Sales Order so that the end user customerinformation is correctly recorded and that that supportservices can be entitled correctly. If you ordermultiple quantities for either the top or second levelAnyConnect PIDs during the ordering process, youwill receive entitlement for what you purchased but itwill not generate additional Product Activation Keys.If your intenention is to order for different customers,you should be ordering for each customer as theirown separate order. Minimally you must order eachlicense as its own unique top level line item, not byincreasing the quantity for one single shared line item.AnyConnect Licensing FAQ 8

FAQCisco PublicFor example, if ordering an AnyConnect Plus PerpetualLicense, you would not order: L-AC-PLS-P-G Qty:2 orspecify quantity 2 on the next level down, instead youwould place two separate line orders, both for L-AC-Q. Can AnyConnect Hostscan/Posturebe used without Cisco Identity ServicesEngine?PLSG with Qty: 1.A. Yes. AnyConnect 4.x still supports Hostscanfunctionality for VPN only posture with the Cisco ASA.AnyConect 4.x also has a unified posture agent thatworks across wired, wireless and VPN but this requiresIdentity Services Engine 1.3 or greater. A AnyConnectApex license is required for both options.Q. How many Identity Services Enginedeployments can I use with my AnyConnectPlus or Apex license?A. An AnyConnect Plus or Apex license(s) can beused across any number of Identity Services Engineappliances or deployments as long as you do not needexceed the authorized user license count. Pleasenote that purchasing either license option along sideIdentity Services Engine does not require any PAK fileregistration or loading into Identity Services Engine(AnyConnect’s PAK files only get applied to theASA). So in an Identity Services Engine deployment,AnyConnect Plus and Apex licenses are just a right touse license. 2020 Cisco and/or its affiliates. All rights reserved.Q. Is a Cisco AnyConnect Plus licenserequired with a Cisco Identity ServicesEngine Plus license?A. No. However, using a Cisco AnyConnect Plus licensewith Cisco Identity Services Engine Plus enables thecollecting and sharing of endpoint context for VPN usescases. Please note that the Cisco AnyConnect Pluslicense will work with the Identity Services Engine Baselicense, but the detailed endpoint information will not becollected.Q. What are the different services enabledby Cisco Identity Services Engine Apex asopposed to Cisco Identity Services EngineApex with Cisco AnyConnect Apex?A. Identity Services Engine Apex is the license tierto enable compliance context collection and the useof that information as authorization attributes withinIdentity Services Engine policies. For example, using athird-party MDM/EMM platform to detect and controlaccess based on “PIN lock status” and “jailbreak status”requires an Identity Services Engine Apex license. TheIdentity Services Engine Apex license count requiredin this use case is the maximum number of potentialconcurrent MDM/EMM enrolled mobile endpoints activeon the network and controlled by Identity ServicesEngine, and not every MDM/EMM enrolled endpoint.Identity Services Engine Apex with AnyConnect Apexenables AnyConnect as the unified agent for PCcompliance along with all the additional value-add CiscoAnyConnect services such as “always on,” trustednetwork detection, etc. As in the previous example,the Identity Services Engine Apex license count wouldbe for the maximum number of concurrent sessionsAnyConnect Licensing FAQ 9

FAQCisco Publicwhere Cisco AnyConnect acts as the unified agent inthe Identity Services Engine deployment for posture,etc., and not, necessarily, every endpoint that will berunning AnyConnect. The number of Cisco AnyConnectApex licenses needed is based on all the possibleunique users that may use Cisco AnyConnect Apexservices and not each and every device running CiscoAnyConnect. Please note that AnyConnect Plus andApex fall under a separate user-based license structure,which is different from the Identity Services Engineendpoint session-based license structure.Q. I am using AnyConnect for a non-VPNservice or a Cisco IOS head-end. Whatlicenses do I need to purchase?A. License requirements are determined by headend used and the services available in that head end.For example, AnyConnect Plus is required for VPNservice to Cisco IOS head-ends though you couldalso use AnyConnect Apex. To use AnyConnect’sposture capabilities with Cisco Identity Services Engine1.3 you must order AnyConnect Apex as well asIdentity Services Engine Apex. For other use casesincluding Network Access Manager, Cisco Secure 2020 Cisco and/or its affiliates. All rights reserved.Web Appliance, etc. you must have AnyConnect Plusbut again they could also use AnyConnect Apex.IOShead-ends must also have a Security License beforeAnyConnect services can be used. AnyConnect iscompatible with ISR G2, CSR 1000V and ASR 1000platforms. Available features varies by platform. Pleasenote that the physical Product Activation Key (PAK)registration on the Cisco licensing portal is onlyapplicable to the ASA. For ASAv and IOS head-endsas well as non-VPN use cases, please store the PAKin a safe place as proof or purchase. You will stillneed to complete Contract registration for SW Centeraccess andTAC support.Q. Can AnyConnect Plus or Apex licensesbe shared between ASA and IOS VPNenvironments?A. Yes, as long as the authorized user count is notexceeded and the license is only used during thepurchased term, the license may be used with anyheadend covered by the license. PAK registration doesnot apply to non-ASA headends.Q. I am only using Network AccessManager. What licenses are required?A. Network Access Manager capabilities require a Plusor Apex license per authorized (unique) user.Q. What is the minimum OS version requiredfor the ISR G2 or CSR 1000v to supportAnyConnect?A. ISR G2 – IOS 15.0(1)M, CSR1000v – IOS XE 3.12 S.AnyConnect Licensing FAQ 10

FAQCisco PublicQ. How do I order AnyConnect Plus orApex licenses with any other headendor service?A. AnyConnect Plus or Apex license(s) should beordered separately for other headend or servicesoutside of the ASA.Q. Can I order the AnyConnect NetworkVisibility Module standalone?A. No. The Network Visibility Module is only availablein the AnyConnect Apex licenses. Please note that theNetwork Visibility modules makes use of AnyConnect’strusted network detection function in the VPN modulebut excluding this capability, it can function withoutother AnyConnect modules.Q. Can I mix and match AnyConnect Plusand Apex or is it one or the other. Anddoes Plus and Apex remove need forShared and Flex licenses?A. Yes. AnyConnect Plus and Apex licenses can bemixed within the same deployment. AnyConnect Plus 2020 Cisco and/or its affiliates. All rights reserved.and Apex both provide the same cross deploymentcapabiltiies as the discontinued Shared licenses.AnyConnect Plus and Apex are licensed based on thetotal users for the specific AnyConnect service beingused so no matter how often they connect nor howmany devices they use, the new AnyConnect Plus andApex licenses remove the need for Flex (Businesscontinuity) licenses.Q. Can I mix and match AnyConnect Plus,VPN or VPN Only licenses with olderEssentials or Premium licenses?A. No. Discontinued Essentials or Premium licenses donot co-exist on the same hardware as newer Plus, Apexor VPN Only licenses. Additionally, VPN Only licensesdo not co-exist on the same hardware with Plus orApex licenses.Q. Does ASAv support remote accessutilizing AnyConnect Plus andApex licenses?A. Yes. But please note that ASAv, which utilizes CiscoSmart Licensing, doesn’t require any AnyConnectlicense to be physically applied to the actual platform.The same licenses must still be purchased and youmust still link the Contract number to your Cisco.com IDfor SW Center access and tech support.Q. What licensing does a AnyConnectconnection from a Cisco IP phone require?A. AnyConnect Plus (or Apex). Previously Phone VPNrequired both a Premium license AND a Phone VPNlicense. Please note that this is for VPN Phone andNOT UC Proxy. UC Proxy licenses are not related toAnyConnect licenses.Q. Why does a part expand 99999 timeswhen I buy an AnyConnect Plus perpetual ornon-banding AnyConnect Plus orApex license?A. This is normal. These parts expand to allow you toregister your AnyConnect Plus or Apex license to all ofyour ASA serial numbers. This expansion SKU is notapplicable to the newer banding-based Plus (L-ACPLS-LIC ) or Apex (L-ACAPX-LIC ) SKUs or the VPNOnly SKUs (L-AC-VPNO-xxxx ). See the AnyConnectOrdering guide for details on license registration perSKU type.AnyConnect Licensing FAQ 11

FAQCisco PublicQ. How do the new licenses work withthe ASA?Q. What happens if I lose my ProductActivation Key (PAK)?A. You will receive a multi-use product activation keyper Plus or Apex license purchased. This multi-useproduct activation key gets activated on each ASAat www.cisco.com/go/license. After activating thekey, the ASA is unlocked for its maximum hardwarec

Cisco AnyConnect Apex? . 9 Q. I am using AnyConnect for a non-VPN service or a Cisco IOS head-end. What licenses do I need to purchase?. 10 Cisco ndor its ilites All rigts resered. FAQ Cisco Public . How do I receive a trial AnyConnect Apex license for my ASA? .15 Q. I installed my new