Cisco Catalyst Switches – Adding Licenses

Posted on 17/11/2015 by Migrated

KB ID 0001012

Problem

I had a load of Cisco Catalyst 3560 switches that needed ‘ipbase’ licenses adding to them today. I’ve messed about with plenty of ASA license upgrades before, but not switches.

Solution

1. First thing you need is a Cisco PAK, this may be in an email or turn up in a cardboard envelope.

2. Go to http://www.cisco.com/go/license and log in (if you don’t already have a Cisco CCO account you can create one for free). Enter your PAK and select ‘fulfil’.

3. Select ‘All Quantities’ > Next.

4. Enter your product ID and serial number (see below).

To locate your Product ID (PID), and serial number (SN), on the switch issue a ‘show license udi’ command.

[box]

Petes-Switch#show license udi
Device#   PID                   SN              UDI
-----------------------------------------------------------------------------
*0        WS-C3560X-24T-L       FDO1818X123     WS-C3560X-24T-L:FDO1818X123

Petes-Switch#

[/box]

5. Accept the agreement > ensure your email address is correct > Submit.

6. Select ‘Download’ to get the license straight away (it will get emailed to you shortly).

Note: If it does not turn up in your email, check your junk email folder, I’m sure Microsoft Outlook does this on purpose!

7. You will have a file with a big long name and a .lic extension. If you want you can copy this onto the switch via TFTP, but let’s keep things simple and use a FAT32 formatted USB drive.

8. Before we start let’s check the license on the switch. I’m running my ipbase license on an evaluation, this is what we are going to add a permanent license for.

[box]

Petes-Switch#show license
Index 1 Feature: ipservices
        Period left: 8  weeks 4  days
        License Type: Evaluation
        License State: Active, Not in Use, EULA not accepted
        License Priority: None
        License Count: Non-Counted

Index 2 Feature: ipbase
        Period left: 7  weeks 5  days
        License Type: Evaluation
        License State: Active, In Use
        License Priority: Low
        License Count: Non-Counted

Index 3 Feature: lanbase
        Period left: Life time
        License Type: Permanent
        License State: Active, Not in Use
        License Priority: Medium
        License Count: Non-Counted


Petes-Switch#

[/box]

9. Pop in the USB key with our .lic file on it.

10. Then copy the .lic file to the switches flash memory.

[box]

Mar 30 04:13:18.466: %USBFLASH-5-CHANGE: usbflash0 has been inserted!
Petes-Switch#copy usbflash0: flash:
Source filename []? FDO1818X123_201410200338212345.lic
Destination filename [FDO1818X123_201410200338212345.lic]? {Enter}
Copy in progress...C
1152 bytes copied in 0.041 secs (28098 bytes/sec)
Petes-Switch#

[/box]

11. Install the new license.

[box]

Petes-Switch#license install flash:/FDO1818X123_2014102003382212345.lic
Installing licenses from "flash:/FDO1818X123_2014102003382212345.lic"
Installing...Feature:ipbase...Successful:Supported
1/1 licenses were successfully installed
0/1 licenses were existing licenses
0/1 licenses were failed to install

Petes-Switch#
Mar 30 04:19:35.643: %IOS_LICENSE_IMAGE_APPLICATION-6-LICENSE_LEVEL: Module name = c3560x 
Next reboot level = ipbase and

License = ipbase
Mar 30 04:19:36.146: %LICENSE-6-INSTALL: Feature ipbase 1.0 was installed in this device. 
UDI=WS-C3560X-24T-L:FDO1818X123;

StoreIndex=1:Primary License Storage
Petes-Switch#

[/box]

12. The license wont take effect until you reload the switch.

[box]

Petes-Switch#write mem
Building configuration...
[OK]
Petes-Switch#reload
Proceed with reload? [confirm]{Enter}

Mar 30 04:20:43.104: %SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload command.

[/box]

13.Post reboot, check and the license should now be permanent.

[box]

Petes-Switch#show license
Index 1 Feature: ipservices
        Period left: 8  weeks 4  days
        License Type: Evaluation
        License State: Active, Not in Use, EULA not accepted
        License Priority: None
        License Count: Non-Counted

Index 2 Feature: ipbase
        Period left: Life time
        License Type: Permanent
        License State: Active, In Use
        License Priority: Medium
        License Count: Non-Counted

Index 3 Feature: lanbase
        Period left: Life time
        License Type: Permanent
        License State: Active, Not in Use
        License Priority: Medium
        License Count: Non-Counted


Petes-Switch#

[/box]

Cisco ASA 5500 – Install and Configure a CSC Module

Posted on 17/11/2015 by Migrated

KB ID 0000731

Problem

The Cisco CSC module provides ‘in line’ scanning of POP3, SMTP, HTTP and FTP traffic, to protect against viruses but also for anti spam and anti phish (with the correct licensing).

If you are familiar with Trend products, you will like it, (because that’s what it runs), and the interface is much the same as Trend IWSS.

It is a hardware device that plugs into the back of the ASA, and comes in two flavours.

1. CSC-SSM-10 (50 to 500 users, depending on licenses) for ASA 5510 and 5520.

2. CSC-SSM-20 (500 to 100 users, depending on licenses) for ASA 5510, 5520, and 5540.

In addition to licensing the amount of users, you can also buy a Plus License, this enables anti-spam, anti-phish, URL filtering, and blocking control. Note: This license expires and must be renewed annually).

Solution

Some licenses on the CSC are time specific, I would consider setting the ASA’s internal clock before you start.

Set the ASA to get time from an External NTP Server

Step 1: License the Cisco CSC Module

1. Connect to the ASA via command line, go to enable mode and issue the following command;

From the output you should be able to get the serial number of the CSC module (write it down).

2. In the box with the CSC/ASA should be an envelope containing the PAK for the CSC module, write that number down as well.

3. Go to the Cisco license portal here, Note: If you do not have a Cisco CCO account you may need to create one. Enter your PAK code > Fulfill Single PAK.

Note: If you have multiple PAK codes, you can do them at once with the ‘Load more PAK’s’ button, this may be the case if you also have a ‘plus’ license to add.

4. Enter the serial number of your CSC module and the person/company from whom you bought it > Next.

5. It should display your valid email address (from your CCO account). Tick the box to accept the terms and conditions > Get License.

6. Scroll down and accept, then select DOWNLOAD, (that way you wont have to wait for it to be emailed to you).

7. Open the license file (will have a .lic extension) with notepad and you should see two keys.

Step 2: Setup the CSC Module

Note: Here I’m going to simply set up inspection of everything on all interfaces, this might not be what you want, i.e. if theres no mail server in the DMZ why would you want to inspect all DMZ traffic for SMTP.

1. Connect to the firewall’s ASDM console > Trend Micro Content Security > It should point you straight to the setup wizard.

9. Enter the base and plus license codes. Note: The plus license code that comes with the CSC is just an evaluation one, if you have purchased a plus license separately, then paste THAT code in instead.

10. Enter the network settings you require for the CSC (it requires its own network connection). it has a single RJ45 network socket on the CSC modules back plane, connect that to your LAN > Next.

11. Supply a name for the CSC module and details of your email server (if you require email notification) > Next > enter the IP addresses that will be allowed access to the CSC web console > Next > Change the password Note: The original password will be cisco > Next.

12. Select what traffic you want to inspect, here I’ve selected all traffic all interfaces > Ive set the CSC to fail open (if theres a problem it simply passes traffic, if you have it on fail close and the CSC encounters a problem all http, smtp, ftp, and pop traffic will be blocked until the problem is resolved) > OK > Next.

13. Review the settings > Finish.

Note: You may get a warning if you set ‘fail open’ above that’s OK.

Connecting to and Managing the Cisco CSC Module

Although you can access the CSC settings via the ASDM, the easiest way is via its web interface, you set the IP address in step 2 number 10 above, navigate to
https://{ip-address}:8443

Note: You should now set the CSC module so that is DOES NOT scan its own update traffic, see the following article.

Cisco CSC Module – Stop it scanning its own update traffic

Adding a ‘PLUS’ License to a Cisco CSC

If you add the plus license later, you will obtain the code in the same manner as you did above (put the PAK and the CSC Serial number into the licensing portal and have it sent to you.

1. Once you have the code, open a web session to the CSC management interface https://{ip-address}:8443 > Administration > Licensing > Enter a new code.

2. Paste in the new code > Activate.

3. It may look like it has hung, wait a minuter or so, and check the licensing tab again.

Cisco ASA 5500 – Adding Licenses

Posted on 17/11/2015 by Migrated

KB ID 0000531

Problem

Each model in the Cisco ASA 5500 range comes with a range of licences and features, to add these features you can purchase them from a Cisco reseller. You will then need to apply the licence to the device.

Solution

1. Your first step is to purchase the Licence you require from an authorised cisco reseller.

2. When your licence arrives you need to locate the PAK that is on the certificate.

3. You need the Serial number of the ASA 5500, to get this either look on the chassis of the device or issue a “show version” command.

[box]

PetesASA# show version
 
 Cisco Adaptive Security Appliance Software Version 8.0(3)
 Device Manager Version 6.1(3)
 
 Compiled on Tue 06-Nov-07 22:59 by builders
 System image file is "disk0:/asa803-k8.bin"
 Config file at boot was "startup-config"
 
 PetesASA up 5 days 17 hours
 
 Hardware: ASA5510, 256 MB RAM, CPU Pentium 4 Celeron 1600 MHz
 Internal ATA Compact Flash, 256MB
 BIOS Flash M50FW080 @ 0xffe00000, 1024KB
 
 Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
 Boot microcode : CN1000-MC-BOOT-2.00
 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.01
 IPSec microcode : Cnlite-MC-IPSECm-MAIN-2.04
 0: Ext: Ethernet0/0 : address is 001d.70df.3e28, irq 9
 1: Ext: Ethernet0/1 : address is 001d.70df.3e29, irq 9
 2: Ext: Ethernet0/2 : address is 001d.70df.3e2a, irq 9
 3: Ext: Ethernet0/3 : address is 001d.70df.3e2b, irq 9
 4: Ext: Management0/0 : address is 001d.70df.3e27, irq 11
 5: Int: Not used : irq 11
 6: Int: Not used : irq 5
 
 Licensed features for this platform:
 Maximum Physical Interfaces  : Unlimited
 Maximum VLANs                : 100
 Inside Hosts                 : Unlimited
 Failover                     : Active/Active
 VPN-DES                      : Enabled
 VPN-3DES-AES                 : Enabled
 Security Contexts            : 2
 GTP/GPRS                     : Disabled
 VPN Peers                    : 250
 WebVPN Peers                 : 25
 AnyConnect for Mobile        : Disabled
 AnyConnect for Linksys phone : Disabled
 Advanced Endpoint Assessment : Disabled
 
 This platform has an ASA 5510 Security Plus license.
 
 Serial Number: JMX1234ABCD
 Running Activation Key: 0x5c385c4d 0xf8344dbb 0xac3161c8 0xaf983c24 0x88888888
 Configuration register is 0x1
 Configuration has not been modified since last system restart.

[/box]

4. So the one above has a serial Number of JMX1234ABCD.

5. Now you have the PAK and the serial number, you need to register them with Cisco Go there, login with a Cisco CCO account name. Enter the PAK Code > Submit.

6. Check the PAK details, and add more as required > Click “All Done”.

7. Enter the Serial Number of the ASA and tick “I Agree..” > Enter/Check your details > Enter the Licensee details (If Different) > Continue.

8. Read the Summary > Submit > Wait for it to stop saying “Processing” > When complete it should “Go Green” and say Registration Complete.

9. If can take a little while for the licence to be emailed to you and USUALLY goes straight to Junk Mail (Thanks Microsoft, that’s not funny!)

10. When the Licence comes in, the detail that you need is the activation key, it will look like….

dd12eb50 9e16d5bb 45b2a92c 78901838 44999999

11. You add this licence to the ASA with an “activation-key” command:

[box]

PetesASA> enable
 Password: ***********
 PetesASA# configure terminal
 PetesASA(config)# activation-key dd12eb50 9e16d5bb 45b2a92c 78901838 44999999
 
 Licensed features for this platform:
 Maximum Physical Interfaces   : Unlimited
 Maximum VLANs                 : 100
 Inside Hosts                  : Unlimited
 Failover                      : Active/Active
 VPN-DES                       : Enabled
 VPN-3DES-AES                  : Enabled
 Security Contexts             : 2
 GTP/GPRS                      : Disabled
 VPN Peers                     : 250
 WebVPN Peers                  : 50
 AnyConnect for Mobile         : Disabled
 AnyConnect for Linksys phone  : Disabled
 Advanced Endpoint Assessment  : Disabled
 
 This platform has an ASA 5510 Security Plus license.
 
 Both running and flash activation keys were updated with the requested key.
 PetesASA(config)#

[/box]

12. That’s the licence added.

Note: In the example above I added a licence to increase the web VPN peers from 25 to 50 (Which you can see if you compare the two pieces of code).

To add a Licence from the ASDM

1. Connect via ASDM.

2. Navigate to > Configuration > Device Management > Licensing > Activation Key > Paste in the new activation key > Update Activation Key.

PeteNetLive

Technology that 'Just Works'

Tag Archives: PAK

Cisco Catalyst Switches – Adding Licenses

Problem

Solution

Related Articles, References, Credits, or External Links

Cisco ASA 5500 – Install and Configure a CSC Module

Problem

Solution

Step 1: License the Cisco CSC Module

Step 2: Setup the CSC Module

Connecting to and Managing the Cisco CSC Module

Adding a ‘PLUS’ License to a Cisco CSC

Related Articles, References, Credits, or External Links

Cisco ASA 5500 – Adding Licenses

Problem

Solution

To add a Licence from the ASDM

Related Articles, References, Credits, or External Links