Cisco Secure Firewall licensing and Duo licensing are two of the most widely deployed metrics in Cisco’s security portfolio, and they count in different ways. Secure Firewall Threat Defense (FTD), the software on Cisco’s Firepower and Secure Firewall appliances and on the virtual Threat Defense Virtual (FTDv), is licensed per managed device and per feature. Every device carries a base Essentials license, and optional term licenses unlock intrusion prevention, malware defense, URL filtering and mobile-network inspection.[1] Duo, Cisco’s multi-factor authentication and access service, is licensed per user in four editions.[5][3]
Both are delivered through Cisco Smart Licensing (see Cisco Smart Licensing, Smart Accounts and Smart Licensing Using Policy). Umbrella, Secure Access, Secure Connect and the User Protection and Breach Protection suites are sold per Covered User and are covered in Cisco software subscription and Flex Plan licensing.
Editions
Secure Firewall Threat Defense licenses
Cisco stresses that “the license type depends on the software components, not the hardware”.[1] The Secure Firewall Smart Licensing guidance and the Firewall Device Manager guide list the following licenses:[1][2]
| License | Previously known as | Duration | Grants |
|---|---|---|---|
| Essentials | Base | Perpetual on hardware; term-based on FTDv | All features not covered by optional licenses; user and application control |
| IPS | Threat | Term-based | Intrusion, file and Security Intelligence policies |
| Malware Defense | Malware | Term-based | File policies (IPS also required) |
| URL Filtering | URL | Term-based | Category- and reputation-based URL filtering |
| Carrier | Term-based | GTP/GPRS, Diameter, SCTP and M3UA inspection | |
| Secure Client (Advantage, Premier, VPN Only) | AnyConnect | Term-based or perpetual | Remote access VPN |
| Export-controlled features | Perpetual, no subscription | Strong encryption, subject to export regulations |
Licenses can be bought separately (for example T, M or C) or bundled (TM, TC or TMC).[1] A Firewall Threat Defense purchase automatically includes an Essentials license. On the Secure Firewall 3100 the Base license is obtained with the firewall and managed like any other license in the Smart Account, so it has to be in the correct Virtual Account when the device is registered.[2] The Firewall Management Center Virtual has its own platform license, perpetual or term-based under Specific License Reservation, which sets how many devices it can manage.[1]
Duo editions
Duo is sold in four editions: Duo Free for up to 10 users, Duo Essentials, Duo Advantage and Duo Premier. Each adds features to the one below. Essentials adds single sign-on, passwordless and Trusted Endpoints. Advantage adds Cisco Identity Intelligence, Duo Passport and risk-based authentication. Premier adds VPN-less remote access and complete device trust.[3] Duo publishes per-user monthly list prices for self-service purchases. The catalog does not record them as license facts.
Metrics
Secure Firewall
Firewall licenses are counted per managed device and per feature. The Secure Firewall guidance states that “each managed device requires a license for each feature used for deployments managed by the FMC” (rule).[1] The catalog holds the feature licenses as separate metric rows (FTD Essentials, IPS, Malware Defense, URL Filtering and FTD Carrier) because each is counted separately.
For Threat Defense Virtual, the performance tier is also an entitlement. Essentials licenses on FTDv are “subscription-based and mapped to performance tiers”. Each tier sets a throughput rate limit and a remote access VPN session limit:[2]
| Tier | Rate limit | RA VPN sessions | Device specification |
|---|---|---|---|
| FTDv5 | 100 Mbps | 50 | 4 core / 8 GB |
| FTDv10 | 1 Gbps | 250 | 4 core / 8 GB |
| FTDv20 | 3 Gbps | 250 | 4 core / 8 GB |
| FTDv30 | 5 Gbps | 250 | 8 core / 16 GB |
| FTDv50 | 10 Gbps | 750 | 12 core / 24 GB |
| FTDv100 | 16 Gbps | 10,000 | 16 core / 32 GB |
FTDv50 is the default tier for a new deployment. A device upgraded to version 7.0 moves to an “FTDv Variable” state and keeps consuming non-tiered entitlements until a tier is chosen.[2]
Duo
Duo’s metric is the Duo user license. Under the Offer Description, each Advantage or Premier user license allocates up to five identities in Cisco Identity Intelligence, and extra identities may require buying more user licenses. Advantage licenses also allocate up to five non-human identities.[5] A person counts once even when they log in under different username formats. Up to eight username aliases can be added to a Duo user so that the same person can authenticate to, for example, a VPN with an Active Directory name and a SAML application with an email address “without consuming additional Duo licenses” (rule).[4]
Counting / floors
Secure Firewall
- HA and clustering. No extra license enables high availability or clustering, but “each device or security module in the cluster or HA-pair must have the same number of feature licenses”. Subscriptions have 1-, 3- or 5-year terms (rule).[1] On FTDv, each HA peer consumes one entitlement and the entitlements, including Essentials, must match (rule).[2] A two-node HA pair with IPS and URL therefore needs two IPS and two URL licenses.
- Evaluation. An unregistered device runs on a 90-day evaluation license. Evaluation mode counts as a non-export-compliant registration, so remote access VPN and strong encryption are unavailable. The RA VPN and Carrier licenses cannot be enabled during evaluation (rule).[2]
- Expiry. When an optional license expires, features that need it keep working, but the license is marked out of compliance until it is bought again (rule). Disabling a license has a direct effect. Without IPS, intrusion and file policies stop applying. Without URL, category-based URL rules stop filtering. Without Malware Defense, the device stops querying the Secure Malware Analytics cloud.[2]
- Communication. A registered device normally contacts the License Authority every 12 hours and can go up to 90 days without doing so. After 90 days it is shown as “Authorization Expired” while licensed features continue (rule). If its ID certificate expires, usually after nine months to a year without communication, the device de-registers and licensed features are suspended.[2]
Duo
- Minimums and increments. Duo Free covers up to 10 users (rule). Self-service licenses are bought in increments of 10 below 100 users and increments of 25 above (rule).[3]
- Removed users. Removing a user from the Duo Admin Panel is a two-step process: the account goes to the Trash and is permanently deleted after a configurable 1 to 30 days (7 by default). Accounts removed by directory sync can be restored only by a sync.[4]
- Telephony. SMS and phone-callback authentication use telephony credits. The Order shows an initial allotment, and more are bought separately through the Duo admin panel or a sales representative (rule).[5]
- Limited-use Duo Essentials. Customers with a Cisco Secure Access or Cisco XDR entitlement accessed through Security Cloud Control can use Duo Essentials at no cost, subject to feature and quantity limits.[5]
Virtualization & partitioning
“Any Firewall Threat Defense Virtual license can be used on any supported Firewall Threat Defense Virtual vCPU/memory configuration”, up to 16 vCPUs and 32 GB of RAM (rule).[2] The throughput tier, not the VM size, is the licensed quantity. The selected tier should not exceed the device specification, and tiers cannot be changed on AWS.[2]
In multi-instance mode, several FTD instances run on one device or security module. No special license is needed. Each device or module has a base license and needs feature licenses for the features enabled, and “all instances on the device/security module share the feature licenses assigned to the device/security module” (rule). When different Management Centers manage instances on the same device, each must hold enough licenses for that device.[1]
Cloud / BYOL
Threat Defense Virtual licenses can be used on public clouds; the Device Manager guide notes that tier-independent licensing widens the range of supported AWS and Azure instance types.[2] Duo is a Cisco cloud service with no customer-hosted licensing option. Its Offer Description forms part of the Cisco General Terms.[5]
For air-gapped firewalls, Cisco documents Universal Permanent License Reservation. Cisco must enable it for the Smart Account, it is applied to each HA peer separately, and a device cannot return to evaluation mode after switching to it.[2]
Programs
- Duo self-service subscription. Credit card purchases in which customers manage their own edition and user limit.[3]
- Cisco Enterprise Agreement. Duo and firewall subscriptions can be bought under the Security portfolio of the Enterprise Agreement. The growth allowance and true-forward rules are covered in Cisco software subscription and Flex Plan licensing.
Out of scope
- Firewall appliances, hardware tokens and their warranties (hardware asset management).
- List prices for Duo editions and firewall subscriptions.
- ASA software licensing, Firewall Management Center hardware, and the Security Cloud Control management plane.
- Umbrella, Secure Access and suite Covered User counting. See Cisco software subscription and Flex Plan licensing.