cisco anyconnect ordering guide - cisco networking, vpn

© 2015 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. of 14

Cisco AnyConnect

Ordering Guide

July 2015

For further information, questions, and comments please contact [email protected].

Ordering Guide

mailto:[email protected]


Contents

1. Introduction .......................................................................................................................................................... 3 1.1 Purpose, Audience and Scope ........................................................................................................................ 3 1.2 Orderability ...................................................................................................................................................... 3

2. Cisco AnyConnect Secure Mobility Client ........................................................................................................ 3 2.1 Servers/Platforms ........................................................................................................................................... 4

3. Licenses ............................................................................................................................................................... 4

4. Ordering Information ........................................................................................................................................... 5 4.0.1 Export Classification ................................................................................................................................ 6

4.1 Plus Licenses (5-, 3-, 1-Year Term or Perpetual) ............................................................................................ 6 4.2 Apex Licenses (5-, 3-, or 1-Year Term) ........................................................................................................... 8 4.3 Cisco AnyConnect Plus Migration Licenses .................................................................................................. 10 4.4 Cisco AnyConnect Apex Migration Licenses ................................................................................................. 12

5. Service Offerings ............................................................................................................................................... 12

6. License Management ........................................................................................................................................ 13 6.1 Contract Entitlement (Support and Software Center Access) ....................................................................... 13 6.2 Evaluation Licenses ...................................................................................................................................... 14

7. Product Licensing Terms and Conditions ....................................................................................................... 14


1. Introduction

1.1 Purpose, Audience and Scope

This document describes the packaging structure and ordering information for the Cisco AnyConnect® Secure

Mobility Client.

Audience: This guide is for Cisco sales, partners, distributors, and customers.

Scope: This ordering guide covers the following products:

● AnyConnect®

Secure Mobility Client

For more detailed information, go to http://www.cisco.com/go/anyconnect.

1.2 Orderability

Orderability for the following AnyConnect licenses are available:

● Plus Subscription licenses

● Plus Perpetual licenses

● Apex Subscription licenses

2. Cisco AnyConnect Secure Mobility Client

The Cisco AnyConnect® Secure Mobility Client consistently raises the bar by making the experience easy for end

users but with the security required by IT. It provides a highly secure connectivity experience across a broad set of

PC and mobile devices. As mobile workers roam to different locations, an always-on intelligent VPN enables the

client to automatically resume connectivity and adapt its tunneling protocol to the most efficient method, such as

Datagram Transport Layer Security (DTLS) protocol for latency-sensitive VoIP traffic or TCP-based application

access. Tunneling support is also available for IP security/Internet Key Exchange version 2 (IPsec/IKEv2).

Release 4.x goes well beyond traditional secure access, offering a wide range of endpoint security services and

streamlined IT operations from a single unified agent. AnyConnect offers customers the ability to achieve tighter

security controls while helping to enable direct, highly secure, per-application access to corporate resources

through mobile per-application VPN services. This reduces the potential of other unapproved applications from

compromising enterprise network and data.

Cisco AnyConnect also provides robust unified compliance capabilities so that an endpoint’s compromised state

does not impact the integrity of the corporate network.

Release 4.1 now assists with the deployment of Cisco® Advanced Malware Protection (AMP) for Endpoints with its

AMP Enabler capability. This significantly expands endpoint threat protection to VPN-enabled endpoints or

wherever AnyConnect services are in use (802.1X network access, posture, etc.). This further reduces the

potential of an attack from enterprise connected hosts. Cisco AMP for Endpoints is licensed separately from Cisco

AnyConnect.

Support for endpoint posture assessment and remediation for wired, wireless, and VPN environments was

introduced in Cisco AnyConnect 4.0 and is available in conjunction with Cisco Identity Services Engine 1.3 (with

Apex licenses for those solutions). This support replaces functionality of the Cisco Network Access Control (NAC)

agent. Endpoints can be validated for compliance checking status of various antivirus, personal firewall, or

antispyware products. Out-of-compliance endpoints undergo additional system checks or remediation actions.

http://www.cisco.com/go/anyconnect


Apex licenses for the Identity Services Engine are required in addition to AnyConnect Apex licenses to enable

posture capabilities in the identity services engine.

The AnyConnect client has built-in web security and malware threat defense, giving you a choice of using either

the premises-based Cisco Web Security Appliance or cloud-based Cisco Cloud Web Security for reliable and

highly secure employee access to corporate resources. Secure mobility combines web security, malware threat

defense, and remote access for a comprehensive and highly secure enterprise mobility solution. Consistent,

context-aware security policies help ensure a protected and productive work environment.

In addition to industry-leading VPN capabilities, the AnyConnect client supports IEEE 802.1X capabilities, providing

a single authentication framework to manage user and device identity along with the network access protocols

required to move smoothly from wired to wireless networks. Consistent with its VPN functionality, the client

supports IEEE 802.1AE Media Access Control security (MACsec) for data confidentiality, data integrity, and data

origin authentication on wired networks, safeguarding communication between trusted components of the network.

2.1 Servers/Platforms

AnyConnect services are used in conjunction with numerous Cisco head server platforms, including but not limited

to the Cisco Adaptive Security Appliance (physical and virtual), Identity Services Engine, Cisco IOS® Software on

the Integrated Services Routers, Cisco Aggregation Services Routers, and Cisco Cloud Web Security. Headend

termination devices and cloud services and associated service costs and support contracts are purchased

separately.

3. Licenses

AnyConnect 4.x offers simplified licensing to meet the needs of the broad enterprise IT community as it adapts to

growing end-user mobility demands. Two licensing tiers offer a clear choice based on an enterprise’s requirements.

The Cisco AnyConnect Plus license provides an array of VPN and security features while the Apex license delivers

these features plus compliance and posture, clientless VPN, next-generation encryption, and more.

Plus License Apex License

Device or system VPN

(including Cisco phone VPN)

All Plus features plus

Per-app VPN

(new in AnyConnect 4.0)

Unified Endpoint Compliance and Remediation (Posture) (new in 4.0)

Identity Services Engine Apex licenses are required in addition to AnyConnect Apex licenses to enable posture capabilities in the Identity Services Engine

Cloud Web Security and Web Security Appliance

Suite B or Next-Generation Encryption

Network Access Manager Clientless (browser-based) VPN connectivity

Cisco AMP for Endpoints Enabler

(new in AnyConnect 4.1)

AMP for Endpoints is licensed separately

The new Cisco AnyConnect licensing eliminates the need to purchase per headend simultaneous-connections

licenses and dedicated license servers. It allows mixing of license tiers across a single environment, and it shifts

licensing from simultaneous connections to a user-based approach.


Plus and Apex licenses are available as 1-, 3-, and 5-year subscriptions, while Plus licenses are also available as

Perpetual licenses. A Software Application Support plus Upgrades subscription is included during the duration of

the subscription licenses and must be purchased separately for Plus Perpetual licenses. An active contract is

required for all software access and technical support. Support contracts for the headend termination devices must

be purchased separately.

Migration license options are available for existing eligible AnyConnect Premium or Shared Premium and

Essentials customers. The last day to purchase AnyConnect Migration licenses is December 31, 2015.

AnyConnect 4.x licensed customers are also entitled to earlier AnyConnect releases.

4. Ordering Information

All AnyConnect licenses are orderable in the Cisco Commerce Workspace (CCW) and are listed on the global

price list (GPL).

To order a Plus or Apex subscription license, start by choosing the service tier and length of term (L-AC-PLS-xYR-

G or L-AC-APX-xYR-G with “x” being 5, 3 or 1). To order a Plus perpetual license, start by choosing L-AC-PLS-P-

G. Next choose “Select Options” and select the count based license option(s) based on the total number of

possible unique users that will use that tier of service. For example, AC-PLS-5YR-1500-S, AC-APX-3YR-10K-S,

or AC-PLS-P-100-S. For the term-based licenses, the pricing will populate after selecting the user count. After

selecting your user count(s), a high-quantity expansion SKU in the format of L-AC-yyy-S-xY-zzzz is added at no

cost. This SKU enables a multiuse product activation key (PAK), which can be used to enable Adaptive Security

Appliance VPN services throughout the enterprise. For term-based licenses, a SKU in the format AC-PLS-xYR-

zzzz/AC-APX-xYR-zzzz is automatically added to entitle software and support services and will contain the pricing

for your selected term.

Note: Selecting Plus or Apex license-count-based options will automatically map to the actual license and

associated cost.

Note: Selecting more than one (1) of the initial service tier and term or of a particular user count will not result in

the generation of additional product activation key contracts. We recommend leaving this value at 1. If you are

ordering for different customers, each order must be completed separately.

Note: You are allowed to stack user count licenses and terms. Doing so will result in the generation of multiple

product activation keys, which should be registered to your Adaptive Security Appliance. PAK registration does not

apply to the Cisco Adaptive Security Virtual Appliance (ASAv). Additional user licenses can be purchased at a later

time. The remaining term lengths will differ between the user-count licenses when purchased at different times.

To order Plus or Apex licenses from a Cisco partner, please refer to their Cisco AnyConnect-specific SKU

structures for a Plus license (AC-PLS…) and Apex license (AC-APX…).

The number of licenses needed is based on all the possible unique users that may use any Cisco AnyConnect

service. The exact number of Plus or Apex licenses should be based on the total number of unique users that

require the specific services associated with each license type.

Apex licenses include all Plus license functionality, so only one type of license is required for each user.

Apex and Plus licenses can be mixed in the same environment.

The number of Plus licenses can be smaller or greater than the number of Apex licenses.


Additional information on ordering and a full list of available SKUs are listed below.

4.0.1 Export Classification

Cisco AnyConnect U.S. Export Classification: ECCN: 5D992/Mass Market/Self-classified

4.1 Plus Licenses (5-, 3-, 1-Year Term or Perpetual)

The Plus license tier provides the following services:

● VPN functionality for PC and mobile platforms, including per-app VPN on mobile platforms and Cisco phone

VPN

● Basic endpoint context collection

● IEEE 802.1X Windows supplicant

● Cisco Cloud Web Security agent for Windows and Mac OS X platforms

● Cisco Advanced Malware Protection for Endpoints Enabler

AMP for Endpoints is licensed separately

● Federal Information Processing Standards (FIPS) compliance

Plus licenses are most applicable in environments previous served by the Cisco AnyConnect Essentials and

Mobile solutions, including Network Access Manager, Web Security, and Cisco IOS and Adaptive Security

Appliance VPN headends. (See Tables 1 through 4 for Plus license part numbers.)

Term License: L-AC-PLS-xYR-G

Term Subscription: AC-PLS-xYR-zzzz-S

(x = 5, 3, 1) year term

(zzzz = 25, 50, 100, 250, 500, 1K, 1500, 2500, 3500, 5K, 10K, 25K, 50K, 100K, 250K) unique users

Perpetual License: L-AC-PLS-P-G

User License: AC-PLS-P-zzzz-S

Perpetual license (SASU contract required for SW access and support)


Table 1. AnyConnect 5-Year Term Plus Subscription Licenses

Term License Term Subscription Description

L-AC-PLS-5YR-G AC-PLS-5YR-25-S Cisco AnyConnect® Plus - 5 Year Subscription License/25 users





L-AC-PLS-5YR-G AC-PLS-5YR-1K-S Cisco AnyConnect® Plus - 5 Year Subscription License/1,000 users

L-AC-PLS-5YR-G AC-PLS-5YR-1500-S Cisco AnyConnect® Plus - 5 Year Subscription License/1,500 users










Table 4. AnyConnect Plus Perpetual Licenses

Perpetual License User License Description Cisco SASU SKU

L-AC-PLS-P-G AC-PLS-P-25-S Cisco AnyConnect® Plus - Perpetual License/25 users CON-SAU-ACPL25





L-AC-PLS-P-G AC-PLS-P-1K-S Cisco AnyConnect® Plus - Perpetual License/1,000 users CON-SAU-ACPL1K

L-AC-PLS-P-G AC-PLS-P-1500-S Cisco AnyConnect® Plus - Perpetual License/1,500 users CON-SAU-ACPL1500









Note: Perpetual licenses require an active Software Application Support plus Upgrades (SASU) contract for

software access and technical support.

4.2 Apex Licenses (5-, 3-, or 1-Year Term)

The Apex license tier provides the following services:

● Clientless (browser-based) VPN termination on the Cisco Adaptive Security Appliance

● VPN compliance and posture agent in conjunction with the Cisco Adaptive Security Appliance

● Unified compliance and posture agent in conjunction with the Cisco Identity Services Engine 1.3 or later

● Next-generation encryption (Suite B)

● All Plus services described above

Apex licenses are most applicable to environments previously served by the Cisco AnyConnect Premium, Shared,

Flex and Advanced Endpoint Assessment solutions. (See Tables 5 through 7 for Apex license part numbers.)

Term License: L-AC-APX-xYR-G

Term Subscription: AC-APX-xYR-zzzz-S

(x = 5, 3, 1) year term



Table 5. AnyConnect 5-Year Term Apex Subscription Licenses


L-AC-APX-5YR-G AC-APX-5YR-25-S Cisco AnyConnect® Apex - 5 Year Subscription License/25 users





L-AC-APX-5YR-G AC-APX-5YR-1K-S Cisco AnyConnect® Apex - 5 Year Subscription License/1,000 users

L-AC-APX-5YR-G AC-APX-5YR-1500-S Cisco AnyConnect® Apex - 5 Year Subscription License/1,500 users












































4.3 Cisco AnyConnect Plus Migration Licenses

The last day to purchase AnyConnect Migration licenses is December 31, 2015.

AnyConnect Plus Migration licenses are available for customers who purchased AnyConnect Essentials

licenses prior to March 2, 2015. Purchases of any AnyConnect Essentials license subsequent to March 1, 2015,

are not eligible to purchase AnyConnect Plus Migration licenses to migrate to AnyConnect 4.x. Customers are

responsible for purchasing standard Plus and/or Apex Licenses at renewal time.

Given the transition from a per-headend, concurrent endpoint licensing model to a user-based enterprise

deployment licensing model with AnyConnect 4.x, eligible AnyConnect customers are entitled to pick whatever

user count is needed for their deployment (see Tables 8 through 10). For additional questions regarding migrations

please reach out to your Cisco or partner sales representative.

Term License: L-AC-PLS-M-xYR-G

Term Subscription: AC-PLSM-xYR-zzzz-S

(x= 5, 3, 1) year term

(zzzz= 25, 50, 100, 250, 500, 1K, 1500, 2500, 3500, 5K, 10K, 25K, 50K, 100K, 250K) unique users

Table 8. AnyConnect 5-Year Term Plus Migration Subscription Licenses


L-AC-PLS-M-5YR-G AC-PLSM-5YR-25-S Cisco AnyConnect® Plus Migration - 5 Year Subscription License/25 users





L-AC-PLS-M-5YR-G AC-PLSM-5YR-1K-S Cisco AnyConnect® Plus Migration - 5 Year Subscription License/1,000 users

L-AC-PLS-M-5YR-G AC-PLSM-5YR-1500-S Cisco AnyConnect® Plus Migration - 5 Year Subscription License/1,500 users




4.4 Cisco AnyConnect Apex Migration Licenses

The last day to purchase AnyConnect Migration licenses is December 31, 2015.

AnyConnect®

Apex Migration Licenses are available for customers who purchased Premium and Shared

Premium licenses prior to March 2, 2015. Purchases of any AnyConnect Premium or Shared Premium license

subsequent to March 1, 2015, are not eligible to purchase AnyConnect Apex Migration licenses to migrate to

AnyConnect 4.x. Customers are responsible for purchasing standard Plus and/or Apex Licenses at renewal time.

Given the transition from a per-headend, concurrent endpoint licensing model to a user-based enterprise

deployment licensing model with AnyConnect 4.x, eligible AnyConnect Premium and Shared Premium customers

are entitled to pick whatever user count is needed for their deployment (see Table 11). For additional questions

regarding migrations please reach out to your Cisco or partner sales representative.

Term License: L-AC-APX-M-3YR-G

Term Subscription: AC-APXM-3YR-zzzz-S

3- year term


Table 11. AnyConnect 3-Year Apex Migration Subscription Licenses


L-AC-APX-M-3YR-G AC-APXM-3YR-25-S Cisco AnyConnect® Apex Migration - 3 Year Subscription License/25 users





L-AC-APX-M-3YR-G AC-APXM-3YR-1K-S Cisco AnyConnect® Apex Migration - 3 Year Subscription License/1,000 users

L-AC-APX-M-3YR-G AC-APXM-3YR-1500-S Cisco AnyConnect® Apex Migration - 3 Year Subscription License/1,500 users









5. Service Offerings

Support and software updates are included for the duration of all AnyConnect subscription licenses. Plus perpetual

licenses require the additional purchase of a Software Application Support plus Upgrades contract. SMARTnet®

support contracts for the headend termination devices must be purchased separately.

This support entitles customers to the services listed here for the full term of the purchased software subscription:

● Software updates and major upgrades to keep AnyConnect performing optimally with the most current

feature set

● Access to the Cisco Technical Assistance Center, which provides fast, specialized support

● Registered access to Cisco.com


Please refer to the following link for more detailed information regarding Cisco Software Application Support plus

Upgrades: http://www.cisco.com/en/US/services/ps2827/ps2993/services_at_a_glance_sas_sasu.pdf.

6. License Management

Cisco offers a variety of license management tools at the License Management portal. A valid Cisco.com user

name and password are required to use the portal.

When a Cisco Adaptive Security Appliance is used with AnyConnect, your production activation key(s) (PAKs) for

Plus or Apex must be registered to the serial number of each individual appliance through the license management

portal. The PAK registration process should not be completed for the Cisco Adaptive Security Virtual Appliance

(ASAv) or Cisco IOS headends.

You cannot associate more than one Adaptive Security Appliance serial number with your PAK on a single license

registration page. The same product activation key (PAK) can be applied to multiple appliances by repeating this

process.

If you have purchased multiple license tiers or user counts, register each activation key individually to all of your

appliance serial numbers.

When registering a license to your Adaptive Security Appliance, it is important that you confirm the serial number

for your appliance by using the “show version” command or in the appliance’s device manager.

You do not need to open up a case with Cisco Global Licensing in order to register your product activation key to

your other appliances. Complete the process by following the same steps described above.

The Adaptive Security Appliance license emailed to you after activating your key will only display the simultaneous

hardware user capacity of your appliance, not your authorized user license count or AnyConnect license tier (Plus

or Apex). To look up the user license purchased or term remaining, please access your support contract through

the Cisco Service Contract Center.

6.1 Contract Entitlement (Support and Software Center Access)

Support and Software Center access is included for the duration of subscription licenses. Plus perpetual licenses

require the additional purchase of a support contract in order to receive support or access software. Support for the

headend Adaptive Security Appliance or other Cisco product requires an active SMARTnet support contract.

In order to enable your Cisco.com ID for support and Software Center access, you must first locate the contract

number generated with your order. The contract number is not the same as your product activation key or Cisco

sales order. You must obtain your contract number directly from your Cisco reseller. A contract number is usually

generated a few days after your product activation key eDelivery.

If your reseller is unable to link your contract number to your Cisco.com ID, you can request that the contract be

linked to your Cisco.com ID directly by mailing [email protected] with your contract number and Cisco.com

ID and a short note requesting the linking to be completed for full access (support and Software Center

downloads). In order for your linking request to be processed, your Cisco.com ID profile details (company, address,

etc.) must match the details on the order.

http://www.cisco.com/en/US/services/ps2827/ps2993/services_at_a_glance_sas_sasu.pdf

http://www.cisco.com/go/license

mailto:[email protected]


Main features of the license management portal include:

● Simplified asset management: Identifies product activation keys registered to a customer and the devices

with installed licenses

● Automated software activation: Quickly processes activation key registration and license file distribution

● Strong encryption licenses (free of charge). To utilize, select the following:

Get Other Licenses -> IPS, Crypto, Other -> Security Products -> Cisco ASA 3DES/AES License

6.2 Evaluation Licenses

Cisco offers 4-week Apex evaluation licenses that incorporate all Plus license functionality. To obtain an evaluation

license, please visit: https://www.cisco.com/go/license.

Select the following: Get Other Licenses -> Demo and Evaluation -> Security Products -> AnyConnect Plus/Apex

(ASA) Demo license.

7. Product Licensing Terms and Conditions

The licensing terms and conditions are listed in the Supplemental End User Agreement (SEULA). The Cisco

AnyConnect privacy policy can be found at: http://www.cisco.com/web/siteassets/legal/privacy.html.

Printed in USA C07-732790-07 07/15

https://www.cisco.com/go/license

http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/license/end_user/AnyConnect-SEULA-v4-x.html

http://www.cisco.com/web/siteassets/legal/privacy.html

cisco anyconnect ordering guide - cisco networking, vpn

Documents