Configure Flexible PLR Licensing for ASAv

Introduction

This document describes Flexible Permanent License Reservation (PLR) which is designed for highly secure environment.

Prerequisites

Requirements

• Adaptive Security Virtual Appliance (ASAv).
• Smart Account must be enabled for Permanent License Reservation (PLR).
• Virtual Account needs to have the Permanent License Reservation (PLR) License which you want to use.
  
  

Components Used

The information in this document is based on these software and hardware versions:

• Adaptive Security Virtual Appliance (ASAv) running version 9.23.1 or higher.
• Cisco Smart Software Manager Release 9-202502.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

• Currently, the PLR entitlement is determined based on the RAM with which the device boots.
• The Flexible PLR Licensing Model feature enables users to select any entitlement based on their requirements, starting from ASA release 9.23.1 onwards.
• In ASA version 9.22 and earlier, the PLR entitlement depends on the allocated memory. From ASA version 9.23.1 onwards, users can choose the PLR entitlement regardless of memory.

Configure

PLR feature is supported for ASAv on all virtual supported Public Cloud Platforms including Azure, AWS, GCP and OCI.

It is supported on Private Cloud Platforms as well including VMware, KVM, Hyper-V ,Nutanix, and OpenStack.

Note: It is recommended to take configuration backups before doing any license modifications.

Steps to Register Flexible Permanent License Reservation (PLR):

1. Open the Command Line interface on ASAv and enter the configuration mode by typing configure terminal.

2. On the ASAv CLI, enter flexible PLR command to select the entitlement of your choice. In this example, asav50_plr is chosen.
     license smart flex-model asav50_plr

In the previous command asav50_plr is the Entitlement for a device with 10GB of RAM.

This String varies depending upon the desired Entitlement and all the available Entitlements are listed in the Smart Account on CSSM.

For other models of the ASA hardware, licensing information is written in this link.

CLI Book 1: Cisco Secure Firewall ASA Series General Operations CLI Configuration Guide, 9.23

3. To enter the PLR mode, type command license smart reservation.



4. Get a request code from the ASAv CLI by entering the command license smart reservation request universal. Copy the reservation request code to enter it in the Cisco Smart Software Manager Portal (CSSM). 

ciscoasa(config)# license smart reservation request universal
Enter this request code in the Cisco Smart Software Manager portal:
UDI: PID:ASAv,SN:9B6ST9ACC24
Request code: DB-ZASAv:9A6ST9ABC24-Bk2XuYYa9-90

5. Log in to CSSM, click Licenses tab and then click License Reservation  and an alert pops up. Click Proceed. 

Cisco Smart Software Manager





6. Paste the Request code in the dialog box and click Next.



7. Verify the PLR Entitlement that is displayed. In this example, it is ASAv50. Select the License and click Next.



8. Review the details and click Generate Authorization Code.



9. Copy the displayed Authorization Code and click Close.



10. Install the Authorization Code in ASAv .

ciscoasa(config)# license smart reservation install DAGabc-
ABCD6E-fgHiJk-lMnOPQ-RStuVr-sTUvWx-YzAbcd-eFGhij-kL
INFO: ASAv platform license state is Licensed.

11. Verify the License registration using show license features command and check the Active entitlement. It must show our selected entitlement.



12. Verify the License commands saved in running configuration.
    show run license



13. Save the config to the startup config to avoid losing any config during reboot.
     write memory

Warning: When modifying or removing the PLR, ensure it is done during a maintenance window. Modifying or removing the PLR can affect the device throughput, concurrent sessions and much more.

In ASAv cluster and High availability setup, it is recommended to license each unit with the licensing server before you enable clustering.
When ASA is configured in multi-context mode, the license is still managed at the system (admin) context level, not per individual context.

Deregister PLR 

1. Open the command line interface on ASAv and enter the configuration mode by typing configure terminal.

2. Enter the command license smart reservation return to get the reservation return code and copy the serial number.

ciscoasa(config)# license smart reservation return
WARNING: ASAv platform license state is Limited functionality.
Enter this return code in Cisco Smart Software Manager portal:
UDI: PID:ASAv,SN:9A6ST9AXQ24
Return code: DrT1pZ-8cRT2N-jhC8fj-64ABCD-xXYZeM-qD1

Limited functionality means ASAv is currently running with a trial License.

3. Log in to CSSM and click Product Instances tab.



4. Click the Actions dropdown and select Remove.



5. Paste the reservation request code in the dialog box and click Remove Reservation.




6. The License can be removed from CSSM and in the ASAv.



7. Come out of PLR mode by typing this command in the ASAv CLI.
    no license smart reservation

8. Disable the Flexible PLR command.
   no license smart flex-model asav50_plr

9. Verify the license commands are removed from the running configuration:
    Show running-config license 



10. Verify the output of show license features to confirm the license is deregistered.

11. Save the configuration to the startup configuration to avoid losing any configuration during reboot.
     write memory

Note: Re-use of the entitlement can be done and license can also be transferred after de-registering.

Verify

1. Show License all command can show the status as Registered and Authorized for successful Registration.





2. The Smart agent logs are present in disk0:/smart-log/agentlog

    Look for License Registration Successful message in the agentlog to verify if the License has registered successfully.

more disk0:/smart-log/agentlog
2024-09-17 05:28:27.658: Received reservation install message type 19
2024-09-17 05:28:27.658: Received auth_code = DArT1p-f7dLoA-gx4RLa-mHiWEf-3cJAaa-kJe5Ji-EzfdSP-rC6hp5-vH
2024-09-17 05:28:27.658: >> PIError: Tue Sep 17 05:28:27.658 UTC-SAResInstall_v2-OPLR Parse Error: Incorrect
OPLR auth length
2024-09-17 05:28:27.658: >> PIError: Tue Sep 17 05:28:27.658 UTC-SAResInstall_v2-OPLR Parse Error: Incorrect
OPLR auth length
2024-09-17 05:28:27.671: >> PISyslog: Info - %SMART_LIC-6-AGENT_REG_SUCCESS:Smart Agent for Licensing
Registration successful. udi PID:ASAv,SN9A9ABC24
2024-09-17 05:28:27.671: >> PISyslog: Notice - %SMART_LIC-5-IN_COMPLIANCE:All entitlements and licenses in use
on this device are authorized
2024-09-17 05:28:27.671: >> PISyslog: Info - %SMART_LIC-6-AUTH_RENEW_SUCCESS:Authorization renewal successful.
State=authorized for udi PID:ASAv,SN9A9ABC24
2024-09-17 05:28:27.671: >> PISyslog: Info - %SMART_LIC-6-RESERVED_INSTALLED:Universal License Reservation
Authorization code installed for udi PID:ASAv,SN9A9ABC24
2024-09-17 05:28:27.671: >> PISyslog: Info - %SMART_LIC-6-EXPORT_CONTROLLED:Usage of export controlled features
is allowed
2024-09-17 05:28:27.671: >> PISyslog: Info - %SMART_LIC-6-RESERVED_INSTALLED:Universal License
Reservation Authorization code installed for udi P:ASAv,S:9A6ST9SMQ24
2024-09-17 05:28:27.673: Received SmartAgentNotifyRegisterSuccess
2024-09-17 05:28:27.673: Processing registration result 1

Troubleshoot ASA Smart License on FXOS Firepower Appliances

Related Information

CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.8
Cisco Secure Firewall ASA Series Feature Licenses
Release Notes for the Cisco Secure Firewall ASA, 9.23(x)
Smart Software Manager On-Prem User Guide