Introduction

This document describes how to configure and remove Time-based activation-key on Cisco Adaptive Security Appliance (ASA) for AnyConnect Premium Peers. Time-based activation-key is used to activate features for a specific time period.

Background Information

AnyConnect Premium and AnyConnect Essential were used in old licensing models and are obsolete now. As per the new licensing model, AnyConnect Apex corresponds to AnyConnect Premium and AnyConnect Plus corresponds to AnyConnect Essential. AnyConnect Apex is not compatible with old licenses. So, if you enable Apex, the Premium would not be used, however, the license consumed would be in the form of Premium licenses. Essentials are disabled, as they are not compatible. The command to check if Apex license is enabled or disabled is debug menu license 23

AnyConnect Plus license includes these VPN types:

- SSL VPN

- IPsec remote access VPN using IKEv2

AnyConnect Apex license includes these VPN types:

- SSL VPN

- Clientless SSL VPN

- IPsec remote access VPN using IKEv2

The detailed feature difference between the 2 licenses can be found in this licensing guide:

https://www.cisco.com/c/en/us/products/collateral/security/anyconnect-og.html

Note: The new AnyConnect Plus, Apex, or VPN Only license key no more uses the Essentials option. In order to make use of a new license, the anyconnect-essentials feature must be disabled on your ASA by issuing a no anyconnect-essentials under webvpn. While a new license key is installed,  a warning shows that the Essentials key is not used when the new license is being installed. As long as anyconnect-essentials on your ASA is properly disabled, you are OK to proceed.

Configuration

Step 1. You need to get your Product Activation Key (PAK) for the device. Cisco Licensing team can help with getting time-based activation-key for the required time period.

Note: The Serial Number (SN) of the ASA to fulfill this requirement has to be fetched from show version output from your ASA and not from show inventory.

ciscoasa# show version

Cisco Adaptive Security Appliance Software Version 9.12(2)

Firepower Extensible Operating System Version 2.6(1.141)

Device Manager Version 7.12(2)

---omitted for brevity---

Licensed features for this platform:

Maximum VLANs :                       50                        perpetual

Inside Hosts :                        Unlimited                 perpetual

Failover :                            Active/Active             perpetual

Encryption-DES :                      Enabled                   perpetual

Encryption-3DES-AES :                 Enabled                   perpetual

Security Contexts :                   2                         perpetual

Carrier :                             Disabled                  perpetual

AnyConnect Premium Peers :            2                         perpetual

AnyConnect Essentials :               Disabled                  perpetual

Other VPN Peers :                     100                       perpetual

Total VPN Peers :                     100                       perpetual

AnyConnect for Mobile :               Disabled                  perpetual

AnyConnect for Cisco VPN Phone :      Disabled                  perpetual

Advanced Endpoint Assessment :        Enabled                   perpetual

Shared License :                      Disabled                  perpetual

Total TLS Proxy Sessions :            320                       perpetual

Botnet Traffic Filter :               Disabled                  perpetual

Cluster :                             Disabled                  perpetual

Serial Number: 9A5KG6HTQSB

Running Permanent Activation Key: 0xa339d567 0xa8df641f 0x9193bd58 0xc6344cb4 0x031bfbaa

Step 2. You shall receive two activation-key for the same SN of your ASA platform from the licensing team.

An Example of PAK received from licensing:

-------------------------------------------------------------

THE FOLLOWING ACTIVATION KEY IS VALID FOR:

ASA SOFTWARE RELEASE 8.2+ ONLY

Platform = asa

9A5KG6HTQSB: 0x5376dfc2 0x99806c06 0x9d8c5acf 0xc0a4da97 0x8512c481

--------------------------------------------------------------

THE FOLLOWING ACTIVATION KEY IS VALID FOR:

ALL ASA SOFTWARE RELEASES, BUT EXCLUDES ANY

8.2+ FEATURES FOR BACKWARDS COMPATIBILITY.

Platform = asa

9A5KG6HTQSB: 0x2722ea6c 0x6041d059 0xc930c908 0xcfe8c498 0x463cc092

---------------------------------------------------------------

Step 3. Copy the activation-key and apply the copied key on ASA.

ASA(config)# activation-key 0x5376dfc2 0x99806c06 0x9d8c5acf 0xc0a4da97 0x8512c481

Step 4. Once the license is applied you need to save the configuration (write memory).

This completes the process to temporarily apply the license feature on your ASA platform.

Verify

The new license can be verified as shown here:

ciscoasa# show version

Cisco Adaptive Security Appliance Software Version 9.12(2)

Firepower Extensible Operating System Version 2.6(1.141)

Device Manager Version 7.12(2)

---omitted for brevity---

Licensed features for this platform:

Maximum VLANs :                       50                      perpetual

Inside Hosts :                       Unlimited                perpetual

Failover :                           Active/Active            perpetual

Encryption-DES :                     Enabled                  perpetual

Encryption-3DES-AES :                Enabled                  perpetual

Security Contexts :                  2                        perpetual

Carrier :                            Disabled                 perpetual

AnyConnect Premium Peers :           500                      14 days

AnyConnect Essentials :              Disabled                 perpetual

Other VPN Peers :                    100                      perpetual

Total VPN Peers :                    100                      perpetual

AnyConnect for Mobile :              Disabled                 perpetual

AnyConnect for Cisco VPN Phone :     Disabled                 perpetual

Advanced Endpoint Assessment :       Enabled                  perpetual

Shared License :                     Disabled                 perpetual

Total TLS Proxy Sessions :           320                      perpetual

Botnet Traffic Filter :              Disabled                 perpetual

Cluster :                            Disabled                 perpetual

Serial Number: 9A5KG6HTQSB

Running Permanent Activation Key: 0xa339d567 0xa8df641f 0x9193bd58 0xc6344cb4 0x031bfbaa

Running Timebased Activation Key: 0x5376dfc2 0x99806c06 0x9d8c5acf 0xc0a4da97 0x8512c481

In the above output, we have the new time-based license valid for 2 weeks (14 days). After completion of 14 days, AnyConnect Premium license would be overwritten with the permanent activation-key on the ASA.

Note: If your ASA is running only on time-based activation-key then after that specific time period device would revert back to the default license feature.

In order to remove time-based activation-key within 14 days and to apply back the pre-existing perpetual license, deactivate running time-based key as shown here:

ASA(config)# activation-key 0x5376dfc2 0x99806c06 0x9d8c5acf 0xc0a4da97 0x8512c481 deactivate