June 15, 2009 at 22:44Request-tell: ASA 8.2 SSLVPN Shared Licenses
I hope to
start a series of publications at your request :) I will start briefly with a new feature of ASA 8.2 (let me again be accused of advertising :))
In large companies, a situation often arises when there are several connection points for encrypted tunnels. The user connects to the piece of hardware that is closer to him (configured by default, dynamically selected). Previously, I had to buy quite a lot of licenses for every piece of iron. This would be a small problem if licenses were inexpensive. But the convenient SSLVPN technology for tsiska is expensive.
In addition, the tsiska officially announced a tendency to transfer everyone to SSLVPN, instead of IPSec VPN.
In OS version 8.2, this problem was resolved.
A feature such as shared licenses has appeared. Their essence is that one pack of licenses is bought; the license server (ASashka) knows about it. The rest of the connection points (so far only ASashki, but subsequently routers) climb to the license server if necessary and ask themselves to expand the quota.
So, what did we have: scattered ASAShKs on every N SSLVPN licenses.
What we get when buying shared licenses: a common license bundle shared by all connection points. At the same time, the purchased old licenses are not lost anywhere: if there are separate licenses, they are first used, and only then a request is made to the license server for an additional quota (50 units are requested immediately).
Thus, the piece of iron will allow you to connect as many clients to yourself as there is enough stock of licenses on the license server, but no more than the maximum number of SSLVPN tunnels for which this platform is designed.
The limitations are:
ASA 5505 25
ASA 5510 250
ASA 5520 750
ASA 5540 2500
ASA 5550 5000
ASA 5580 10000 In
addition, for reliability, you can select one ASashka as backup for the license server. It will synchronize the license database with the server and, in the event of a server crash, will take over its functions (but no longer than 5 days)
How to configure it.
First, you need to buy the necessary license for all ASachek in order to activate the feature shared licenses. New activation-keys will be sent to you and after their activation the feature itself will become available.
Secondly, you need to buy the required number of licenses (sold in packages of 500 pieces with a number of 500-50000 licenses, and then up to 545,000 inclusively in packages of 5000 licenses).
Thirdly, you need to configure the asa license server
(config) # license-server secret [secret key]
Fourth, you need to configure clients (so-called stand-alone ASA)
asa (config) # license-server [address] secret [secret key] port [#]
Where address is the IP address of the license server, port is the TCP port ( by default - 50544) It
remains to enable the feature:
asa (config) # license-server enable [interface]
Additionally, you can configure one of standalone ASA as a backup server
On the server itself:
asa (config) # license-server backup address [address] backup- id [serial-num] ha-backup-id [ha-serial-num]
Where backup-id is the serial number of the spare ASA,
hw-bachup-id is the serial number of the active piece of iron in the failover pair if Active / is used as backup stanby failover
to an alternate ASAshke need to include proslushi Maintenance at the interface
asa (config) # license-server backup enable [interface] You can
see what happened with the commands
asa # show shared license [backup | client | detail]
Example:
5510-P (config) # show shared license
Shared license utilization:
SSLVPN:
Total for network: 200000
Available: 200000
Utilized: 0
This device:
Platform limit: 250
Current usage: 0
High usage: 0
Client ID Usage Hostname
XXXXXXXXXXX 0 5540-A
It will work like this:
1. When connecting a new SSLVPN, ASashka will check the connection, Does she have her own free licenses and will allow connection, if any.
2. If there are no licenses, but a license-server is configured, ASA will send a request for a new quota (50 pieces). It will send the same request if there are less than 10 licenses taken earlier from the server.
3. If she has accumulated more than 60 free licenses, then she will send 50 pieces back to the server, so that others can take advantage.
start a series of publications at your request :) I will start briefly with a new feature of ASA 8.2 (let me again be accused of advertising :))
In large companies, a situation often arises when there are several connection points for encrypted tunnels. The user connects to the piece of hardware that is closer to him (configured by default, dynamically selected). Previously, I had to buy quite a lot of licenses for every piece of iron. This would be a small problem if licenses were inexpensive. But the convenient SSLVPN technology for tsiska is expensive.
In addition, the tsiska officially announced a tendency to transfer everyone to SSLVPN, instead of IPSec VPN.
In OS version 8.2, this problem was resolved.
A feature such as shared licenses has appeared. Their essence is that one pack of licenses is bought; the license server (ASashka) knows about it. The rest of the connection points (so far only ASashki, but subsequently routers) climb to the license server if necessary and ask themselves to expand the quota.
Read more under the cut
So, what did we have: scattered ASAShKs on every N SSLVPN licenses.
What we get when buying shared licenses: a common license bundle shared by all connection points. At the same time, the purchased old licenses are not lost anywhere: if there are separate licenses, they are first used, and only then a request is made to the license server for an additional quota (50 units are requested immediately).
Thus, the piece of iron will allow you to connect as many clients to yourself as there is enough stock of licenses on the license server, but no more than the maximum number of SSLVPN tunnels for which this platform is designed.
The limitations are:
ASA 5505 25
ASA 5510 250
ASA 5520 750
ASA 5540 2500
ASA 5550 5000
ASA 5580 10000 In
addition, for reliability, you can select one ASashka as backup for the license server. It will synchronize the license database with the server and, in the event of a server crash, will take over its functions (but no longer than 5 days)
How to configure it.
First, you need to buy the necessary license for all ASachek in order to activate the feature shared licenses. New activation-keys will be sent to you and after their activation the feature itself will become available.
Secondly, you need to buy the required number of licenses (sold in packages of 500 pieces with a number of 500-50000 licenses, and then up to 545,000 inclusively in packages of 5000 licenses).
Thirdly, you need to configure the asa license server
(config) # license-server secret [secret key]
Fourth, you need to configure clients (so-called stand-alone ASA)
asa (config) # license-server [address] secret [secret key] port [#]
Where address is the IP address of the license server, port is the TCP port ( by default - 50544) It
remains to enable the feature:
asa (config) # license-server enable [interface]
Additionally, you can configure one of standalone ASA as a backup server
On the server itself:
asa (config) # license-server backup address [address] backup- id [serial-num] ha-backup-id [ha-serial-num]
Where backup-id is the serial number of the spare ASA,
hw-bachup-id is the serial number of the active piece of iron in the failover pair if Active / is used as backup stanby failover
to an alternate ASAshke need to include proslushi Maintenance at the interface
asa (config) # license-server backup enable [interface] You can
see what happened with the commands
asa # show shared license [backup | client | detail]
Example:
5510-P (config) # show shared license
Shared license utilization:
SSLVPN:
Total for network: 200000
Available: 200000
Utilized: 0
This device:
Platform limit: 250
Current usage: 0
High usage: 0
Client ID Usage Hostname
XXXXXXXXXXX 0 5540-A
It will work like this:
1. When connecting a new SSLVPN, ASashka will check the connection, Does she have her own free licenses and will allow connection, if any.
2. If there are no licenses, but a license-server is configured, ASA will send a request for a new quota (50 pieces). It will send the same request if there are less than 10 licenses taken earlier from the server.
3. If she has accumulated more than 60 free licenses, then she will send 50 pieces back to the server, so that others can take advantage.
