I recently puchased an ASA 5505 that came with the base license only to have to randomly pick devices to not allow internet access to. I found out that the base license only allows 10 inside hosts, so I upgraded to the Security Plus license. According to the link below, the Security Plus license includes:
if the reload doesn't help, please send an email to lice...@cisco.com with the PAK number of the license what you bought and they will generate a new activation key for you. Send them the link and show version output.
I am just trying not to buy an overkill hardware if i am unable to use it due to a different license based engagement. Will the 5505 with Security Plus license be equal to a 5506-x with the same license, or does it provide a tad more protection.
Licensing on the 5506 is different. The restrictions of the Base-License are very likely not relevant for a home setup. But the 5506 gives NextGen firewalling with Firepower. Here you find the best protection for your network, but this is the subscription and it's quite complex to configure.
I think it's not only Cisco. For up-to-date protection, you need permanent feedback from the vendor for malware-info, IPS-signatures, CnC-info and so on. All vendors of NextGeneration Firewalls sell that as a subscription.
It's more the personal choice. Also with open-source you can build a great home-firewall. If you consider using pfSense (which is great, I run it myself too), you should also evaluate OPNsense if that fits your needs better than pfSense.
OpenDNS knows much about malicious systems on the internet and when a user asks for something malicious, openDNS returns a modified answer for this request. But there are no signatures as it's not an IPS. A NGFW like FirePower will give you more control and security, but with openDNS you can increase the security of your setup in an easy and cheap way. OpenDNS is also independent of the firewall, you can use it with an ASA or any other firewall.
UTM9 is free but is limited to 50 IP's (a bit like the old PIX license) and something like 32000 connections. Sophos' next iteration, Sophos XG is a mashup of UTM9 and Cyberoam. It has most of the IPS/Web protection of UTM9 but a much more sensible home licensing option where it is limited to 4 cores and 6GB of RAM. It's still free (for home use) by the way.
It would be great if Cisco would or could do something similar for ASA and Firepower. One of the best ways to learn in my experience is with practical hands on every day use and we don't all have access to firewalls with these license options at work.
They can be ordered either with a Base License or a Security Plus License. Many customers of mine are always asking me what the difference is between the two licenses (except from the price of course), so I thought it would be useful to summarize below the differences between the two license types:
Integrated Network Interfaces50 Maximum VLANs100 Maximum VLANsNo High Availability (failover) supportedSupports Active/Active andActive/Standby failoverNo Security Contexts (Virtual Firewalls)Supports 2 Virtual Firewalls (included) and 5 maximum.No Support for VPN Clustering and VPN Load BalancingSupports VPN Clustering and VPN Load BalancingCisco ASA 5505 User License ExplainedI get a lot of questions regarding the meaning of user license numbers for the Cisco ASA 5505. This model is offered in three User License options.
The official explanation from Cisco regarding the Cisco ASA5505 user licensing is as follows:
In routed mode, hosts on the inside (Business and Home VLANs) count towards the limit only when they communicate with the outside (Internet VLAN).
Includes: Unlimited users, 8-port Fast Ethernet switch with 2 Power over Ethernet ports, 25 IPsec VPN peers, 2 SSL VPN peers, DMZ support, Stateless Active/Standby high availability, Dual ISP support, 3DES/AES license.
For example, when a switch port on VLAN1 is communicating with a switch port on VLAN2, the adaptive security appliance applies configured security policies to the traffic and routes or bridges the traffic between the two VLANs.
The basic license allows only 3 active VLANs which you can use as Inside, Outside and DMZ. However, there is a restriction here that many people do not know about: The DMZ VLAN can access ONLY the Outside VLAN but can not access the Inside VLAN. The other two VLANs (Inside and Outside) can access all the other VLANs with no problems.
The Security Plus license, removes all limitations and allows up to 20 active VLANs to be configured. Since there are only 8 physical ports, you can create several vlan subinterfaces on each physical port to segment your network into different security zones (e.g Inside, Outside, DMZ1, DMZ2, Sales, Engineering etc).
To upgrade the current license of your cisco ASA firewall, you need to order a new license key from Cisco at www.cisco.com/go/license. You will receive a new license key in your email after a couple of hours. This license key is a five element hexadecimal string in the form 0xffd8624e (as an example).
Harris Andrea is an Engineer with more than two decades of professional experience in the fields of TCP/IP Networks, Information Security and I.T. Over the years he has acquired several professional certifications such as CCNA, CCNP, CEH, ECSA etc.
Yes absolutely. When you purchase the new license, Cisco will send you a new license code which you can configure it in the ASA 5510 (with command line configuration) and it will enable you all Sec Plus features.
7fc3f7cf58