We have been asking for this for years! Even on my home network I’ve not been able to allocate an ASADHCP reservation for my laptop and my MyCloud drive. I’ve been in discussions in forums with people who are convinced that putting a static ARP entry into the ASA would solve the problem (it doesn’t – I tested it extensively!)
But finally in version 9.13(1) we can now add a static DHCP reservation (MAC address to IP address).
Then simply add the reservation, you need to specify the MAC address as xxxx.xxxx.xxxx (that’s with full stops not colons), if in doubt, ping the existing IP address then execute a ‘show arp’ command to show you all the MAC addresses the firewall can see, so you can copy/paste it into the following command;
Both licenses are available as 1, 2 and 5 (not 3 as listed on the Cisco website) year subscription, or you can buy Plus licenses with a perpetual license option.
Note: For PLUS Licences looks at SKUs starting L-AC-PLS, for APEX Licences look SKUs starting at L-AC-APX
(Note: if you have a Plus Perpetual license you still need to purchase a software applications support plus upgrades (SASU) contract.
Regardless of which you buy, the SASU for AnyConnect is NOT included in the support contract for the parent device e.g. the SmartNet on your Cisco ASA Firewall.
To purchase support you order the parent license (SKU: L-AC-PLS-P-G) which has no cost, then you add in the relevant license for the amount of clients you have e.g. AC-PLS-P-500-S for 500 users, AC-PLS-P-2000-S for 2000 users etc.
BE AWARE: AnyConnect 4 Licenses will display as AnyConnect Premium licenses when you issue a ‘show version’ command. When adding an AnyConnect 4 License (regardless of the quantity of licenses added), will license to the maximum permitted AnyConnect Premium license count for the ASA hardware platform, those being;
New AnyConnect VPN Only Licences (Perpetual)
You can now purchase VPN Only perpetual licences, they are sold by ‘Concurrent VPN Connection‘. You order them like so;
L-AC-VPNO-25 (for 25 concurrent VPN connections) you can also buy in 50, 100, 250, 500, 1K, 2500, 5K ,and 10K versions. Depending on what you device will physically support (see below)
I get asked this at least once a month, “What’s the score with this DNA Licensing?” It took long enough for everyone to get used to Lan Base, IP Base, and IP Services!
The cynic in me would say, Cisco have learned from Meraki that selling subscription licences is much better than selling products that you don’t get any recurring revenue from. But I’ll try an give you the short answer so you can get the correct license.
Solution: Buying Cisco Catalyst 9K Switches
Firstly: Not sure who decided that Cisco would release 9000 series Catalyst switches, when they had 9000 series Nexus switches? (Thanks for that!)
Catalyst 9200 or 9300?
As a rule of thumb 9200 series are typically used as access switches i.e. replacements for things like the Catalyst 2960, 2960-X, and 2960-XR). And the 9300 series are a replacement for things like Cisco Catalyst 3750G, 3750-X, and 3850.
Note: There’s also a Catalyst 9400 switch, which is a modular (line card) based chassis switch to replace the Catalyst 4500 and 6000 series. Note2: There’s also a Catalyst 9500 switch that replaced the 10Gbps catalyst 3850 models (traditional 1U size). Note3: There’s also a Catalyst 9600 switch which is modular (line card) based chassis switch to replace the Catalyst 6000 Series. Note4: There’s also a Catalyst 9800 series which, just to confuse everyone further, is a range of wireless controllers?
So which switch to buy? Cisco keep adding models to both ranges so the first thing to do is decide 9200 or 9300, then look at the current Cisco Data Sheet for that range.
What uplink ports do you need? (Some models have fixed (built in) uplinks, others need a network module (modular) uplink. Remember modular uplinks have their own part number (SKU), and will need to be ordered separately. (Note:9200L and 9300L have fixed uplinks)
Do you need additional (redundant) power supplies?
Do you need to ‘Stack’ your switches, if so don’t forget to get a stack cable (theres no separate stacking modules).
They were cheaper than you expected right?
That’s because now we need to add on a DNA licence as well.
DNA Licensing
Cisco DNA (Digital Network Architecture) is the name given collectively to a suite of products that are aimed towards being software driven, automated, with built in security.
There’s three types;
DNA Essentials: (Lan Base in old money) Basically Layer 2 functionality and static routing.
DNA Advantage: (Combines IP Base and IP Services in old money) Basically full Layer 3 functionality, (and all the functionality of DNA Essentials).
DNA Premier: Combines all the functionality of DNA Essentials and DNA Advantage, and adds on ISE integration and Cisco Secure Network Analytics (formerly Stealthwatch) support.
Each licence comes in either a 3 Year, 5 Year, or 7 Year subscription model.
Example DNA Licensing SKU: C9200- DNA-E-24-3Y
C9200 – for a Cisco Catalyst 9200 series switch.
DNA – Digital Network Architecture licence.
E – Essentials (A would be advantage, and P would be premier).
24 – For a 24 port switch
3Y – 3 Year Subscription
Related Articles, References, Credits, or External Links
