Cisco ASA Series Cli Configuration Manual page 182

Supported Feature Licenses Per Model
Table 1-16 License Notes (continued)
License
Intercompany Media
Engine
Interfaces of all types,
Max.
IPS module
Cisco ASA Series CLI Configuration Guide
1-20
Notes
When you enable the Intercompany Media Engine (IME) license, you can use TLS proxy sessions
up to the configured TLS proxy limit. If you also have a Unified Communications (UC) license
installed that is higher than the default TLS proxy limit, then the ASA sets the limit to be the UC
license limit plus an additional number of sessions depending on your model. You can manually
configure the TLS proxy limit using the tls-proxy maximum-sessions command or in ASDM,
using the Configuration > Firewall > Unified Communications > TLS Proxy pane. To view the
limits of your model, enter the tls-proxy maximum-sessions ? command. If you also install the
UC license, then the TLS proxy sessions available for UC are also available for IME sessions. For
example, if the configured limit is 1000 TLS proxy sessions, and you purchase a 750-session UC
license, then the first 250 IME sessions do not affect the sessions available for UC. If you need
more than 250 sessions for IME, then the remaining 750 sessions of the platform limit are used
on a first-come, first-served basis by UC and IME.
•
For a license part number ending in "K8", TLS proxy sessions are limited to 1000.
•
For a license part number ending in "K9", the TLS proxy limit depends on your configuration
and the platform model.
Note
K8 and K9 refer to whether the license is restricted for export: K8 is unrestricted, and K9
is restricted.
You might also use SRTP encryption sessions for your connections:
•
For a K8 license, SRTP sessions are limited to 250.
•
For a K9 license, there is no limit.
Note
Only calls that require encryption/decryption for media are counted toward the SRTP
limit; if passthrough is set for the call, even if both legs are SRTP, they do not count toward
the limit.
The maximum number of combined interfaces; for example, VLANs, physical, redundant, bridge
group, and EtherChannel interfaces. Every interface command defined in the configuration
counts against this limit. For example, both of the following interfaces count even if the
GigabitEthernet 0/0 interface is defined as part of port-channel 1:
interface gigabitethernet 0/0
and
interface port-channel 1
The IPS module license lets you run the IPS software module on the ASA.
You must also purchase a separate IPS signature subscription; for failover, purchase a
subscription for each unit. To obtain IPS signature support, you must purchase the ASA with IPS
pre-installed (the part number must include "IPS").
The combined failover cluster license does not let you pair non-IPS and IPS units. For example,
if you buy the IPS version of the ASA 5515-X (part number ASA5515-IPS-K9) and try to make
a failover pair with a non-IPS version (part number ASA5515-K9), then Cisco will not let you
obtain IPS signature updates for the ASA5515-K9 unit, even though it has an IPS module license
inherited from the other unit.
Chapter 1 Managing Feature Licenses