Secure Firewall Smart Licensing Overview

Hello, welcome to Cisco Secure Firewall smart licensing. My name is Johanna Kanya and I am a customer success specialist at Cisco. In this video, we will start with a quick overview of smart licensing, and then we'll do.00:04Describe the options that we have for communicating with your smart account. Next, we will discuss the licenses available for secure firewall and finally, we will demonstrate how to register your secure firewall with your smart account.00:20The highest level component of the Cisco smart licensing model is the smart account. Cisco smart accounts can be thought of as a container which acts as a central repository where you can view, store, and manage licenses for your organization.00:35It offers a simple to use, organized and centralized solution to manage your software entitlements. It also contains all your license administration users and provides them with role based access to the licenses across your organization. You can access and manage your hardware and software license subscriptions all through your smart account.00:50We also have virtual accounts. A virtual account is a stood account underneath the main smart account container which also contains its own collection of licenses, products, and users. Virtual accounts allow you to control the access and the way the licenses are distributed throughout your organization.01:11You can also move licenses between the virtual accounts whenever it is needed. However, please note that you cannot move licenses between two different smart accounts. In order to use smart licensing, you will need to be able to communicate with the Cisco backend servers to apply and move licenses and validate your use.01:31There are a few different options that we can use to deploy smart licenses. These options are listed in order from the easiest to use to the most secure. The 1st option is if you have direct access to cisco.com from your network devices. It can be directly connected to the smart license cloud server, and this is the easiest and most common way to get connected to the.01:51Cisco Spark software Manager tool. This will transfer license usage over the internet to the cloud service directly from your devices via HTTPS. In more secure environments where your products do not communicate directly with the internet, there are a couple other options available.02:112nd option uses a customer internal collection device called the Smart Software on prem, which is a server platform created at Cisco. The on prem server periodically transmits the license information into the cloud using a periodic or manual network synchronization.02:28In this setup, you have a Cisco on prem server directly communicating with Cisco.com while your products are communicating with that on prem. It synchronizes the information with the Cisco backend. In the 3rd option, you can copy and paste your license usage information with the service instead.02:46This is used with customers who require an air gap between their networks and the internet. It is essential to understand that the license type depends on the software components used and not on the hardware. Table on this slide shows the licenses available and the capabilities each one provides.03:05Firepower devices include a standard based firewall license and advanced subscription for different features. The base license allows you to configure your FTD devices to perform switching and routing, including DHCP relay and NAT.03:26You can also configure FTD devices as a high availability pair or clusters, and you can also implement user and application control by adding user and application conditions to the access control rules. The malware license for firepower tree defense device.03:40Allows you to perform Cisco advanced malware protection with AMP for networks and the cisco threat grid. With this feature you can use firepower treat defense devices to detect and block malware in files transmitted over your network. A threat license allows you to perform intrusion detection and prevention.03:58File control and for networks and security intelligence filtering. The URL filtering license allows you to grade access control rules that determine the traffic that can traverse your network based on URLs requested by monitor host.04:18Which are correlated with information about those URLs. Any of the anyconnect licenses is needed for remote access VPN configuration. These licenses are treated the same for FTD devices, even though they are designed to allow different feature sets.04:35And used with ASA software based head ends. There are options to purchase licenses individually or bundled together to provide greater functionality. Let's see the steps of registering your FMC with your smart account.04:52Please note that this licensing method makes a direct connection between the FMC and license service. So let's start in the FMC CLI. License usage will be checked using the system clock, so you should also make sure that you have the MTP service configured and running as well as the connectivity to the servers.05:09The ping and telnet connection to tools.cisco.com should be successful. Alright, so now let's get to the Cisco software center page. We have to log in using our account, and if you don't have one yet, you can create one with your Cisco ID.05:27Go to Smart Software Manager and click Manage licenses. Now, let's go to your inventory and select the virtual account that you're gonna be working with. All right, if you click the licenses tab, you can see it listed all the exact amount of license.05:48This is that you have available. Let's go back to the general tab as we need to create a token for the FMC.06:07This token ties new hardware and virtual devices to the virtual account that has generated the token. It expires after 30 days as it is intended to be short life and the allow export control functionality option controls your use of advanced encryption and the features that require advanced description.06:12We recommend to keep that enabled, copy the token and go to the FMC GUI. If you go to system licenses and smart licensing, it will take you to the page where we are right now. Click register and paste the token to tie the FMC to the virtual account.06:29Apply the changes and just wait for it to finish. The registration was successful. Let's click on edit licenses so that we can start assigning licenses to our registered ftds.06:46I'm going to assign the malware thread URL filtering and Apex licenses to my three firewalls. For that, I'm going to move all of them to the box on the right that says devices with license. Once that I'm done, I'm gonna click apply and it will show each of the device names.07:04Under each of the license types in here. A common issue with the smart licensing is out of compliance, which means that I am attempting to use a higher amount of licenses than the ones that are available in my smart account. In this case, I am trying to use three anyconnect Apex licenses for my ftds.07:24But if I go to my smart account, we can confirm that I don't have enough anyconnect Apex licenses, which means they are insufficient, and that leads to a lot of compliance issue.07:43Finally performance tiers have been added per virtual FTD. When talking about virtual FTD licensing, there are some guidelines and limitations that we should keep in mind. The virtual FTD supports performance tier licensing that provides different levels and VPN connection limits based on deployment requirements.07:58Just as described in this slide, starting with version seven.o, virtual ftds require a performance tiered license that should be defined by the time that you register your FTD into your FMC. So make sure that your smart licensing account contains all the available licenses that you need.08:16This concludes the video hoping that you enjoyed it and found it useful. Thank you.08:37