The support for Smart Licensing started with Cisco IOS XE 16.10.1. In the Cisco IOS XE 17.3.2 and 17.4.1, support to a simplified method for Smart Licensing with the use of Policies mode only License was started.
IOS XE Release
Platform Requirements
CUBE Licensing
16.6.1 to 16.9.x
Smart Licensing mode is optional
RTU licensing only
16.10.x
Smart Licensing mode only
RTU licensing only
16.11.1a to 17.1.x
Smart Licensing mode only
Continued registration is required to enable CUBE features
Smart Licensing only*
Trunk license requests are set by manual configuration
No license policing if out of compliance
SIP processing disabled in the 'Eval-Expired' state
17.2.1r to 17.3.1a
Smart Licensing mode only
Continued registration is required in order to enable CUBE features
Smart Licensing only*
Trunk license requests are set dynamically by usage
No license policing if out of compliance
SIP processing disabled in the 'Eval-Expired' state
17.3.2 onwards
Smart Licensing with the use of Policy mode only
License use must be reported within the account policy to enable CUBE features
Smart Licensing only*
Trunk license use is measured periodically and reported as per the Smart Account policy
In accordance with policy, license policing reports are not acknowledged (SIP processing is disabled otherwise)
Username : kevin Index : 62470 Assigned IP : 192.168.200.100 Public IP : 192.168.10.102 Protocol : AnyConnect-Parent SSL-Tunnel DTLS-Tunnel License : AnyConnect Premium Encryption : AnyConnect-Parent: (1)none SSL-Tunnel: (1)AES-GCM-256 DTLS-Tunnel: (1)AES256 Hashing : AnyConnect-Parent: (1)none SSL-Tunnel: (1)SHA384 DTLS-Tunnel: (1)SHA1 Bytes Tx : 58544 Bytes Rx : 54607 Group Policy : ANYCONNECT_POLICY Tunnel Group : MY_TUNNEL Login Time : 12:24:54 UTC Sun Feb 2 2025 Duration : 0h:12m:24s Inactivity : 0h:00m:00s VLAN Mapping : N/A VLAN : none Audt Sess ID : 0a0101fe0f406000679f6416 Security Grp : none ASAv#
아래 명령어를 통해서 라이센스 남은 갯수도 확인 가능 합니다.
ASAv# show vpn-sessiondb license-summary --------------------------------------------------------------------------- VPN Licenses and Configured Limits Summary --------------------------------------------------------------------------- Status : Capacity : Installed : Limit ----------------------------------------- AnyConnect Premium : ENABLED : 250 : 2 : NONE AnyConnect Essentials : DISABLED : 250 : 0 : NONE Other VPN (Available by Default) : ENABLED : 250 : 250 : NONE Shared License Server : DISABLED Shared License Participant : DISABLED AnyConnect for Mobile : DISABLED(Requires Premium or Essentials) Advanced Endpoint Assessment : DISABLED(Requires Premium) AnyConnect for Cisco VPN Phone : DISABLED VPN-3DES-AES : ENABLED VPN-DES : ENABLED ---------------------------------------------------------------------------
--------------------------------------------------------------------------- VPN Licenses Usage Summary --------------------------------------------------------------------------- Local : Shared : All : Peak : Eff. : In Use : In Use : In Use : In Use : Limit : Usage ---------------------------------------------------- AnyConnect Premium : 1 : 0 : 1 : 2 : 2 : 50% AnyConnect Client : : 1 : 1 : 50% AnyConnect Mobile : : 0 : 0 : 0% Clientless VPN : : 0 : 1 : 0% Generic IKEv2 Client : : 0 : 0 : 0% Other VPN : : 0 : 0 : 250 : 0% Cisco VPN Client : : 0 : 0 : 0% L2TP Clients Site-to-Site VPN : : 0 : 0 : 0% ---------------------------------------------------------------------------
ASAv#
anyconnect Permium 라이센스가 2개 이고, 현재 PC에서 접속 해서 한개를 사용하고 있고, Usage에 50% 표시 되었습니다.
ASAv# show version
Cisco Adaptive Security Appliance Software Version 9.8(1) Firepower Extensible Operating System Version 2.2(1.47) Device Manager Version 7.22(1)
Compiled on Wed 10-May-17 15:38 PDT by builders System image file is "boot:/asa981-smp-k8.bin" Config file at boot was "startup-config"
ASAv up 6 hours 21 mins
Hardware: ASAv, 2048 MB RAM, CPU Xeon E5 series 2394 MHz, Model Id: ASAv10 Internal ATA Compact Flash, 8192MB Slot 1: ATA Compact Flash, 8192MB BIOS Flash Firmware Hub @ 0x0, 0KB
0: Ext: Management0/0 : address is 50fd.e000.3500, irq 11 1: Ext: GigabitEthernet0/0 : address is 50fd.e000.3501, irq 11 2: Ext: GigabitEthernet0/1 : address is 50fd.e000.3502, irq 10 3: Ext: GigabitEthernet0/2 : address is 50fd.e000.3503, irq 10 4: Ext: GigabitEthernet0/3 : address is 50fd.e000.3504, irq 11 5: Ext: GigabitEthernet0/4 : address is 50fd.e000.3505, irq 11 6: Ext: GigabitEthernet0/5 : address is 50fd.e000.3506, irq 10 7: Ext: GigabitEthernet0/6 : address is 50fd.e000.3507, irq 10
License mode: Smart Licensing ASAv Platform License State: Unlicensed No active entitlement: no feature tier and no throughput level configured *Memory resource allocation is more than the permitted limit.
Licensed features for this platform: Maximum VLANs : 50 Inside Hosts : Unlimited Failover : Active/Standby Encryption-DES : Enabled Encryption-3DES-AES : Enabled Security Contexts : 0 Carrier : Disabled AnyConnect Premium Peers : 2 AnyConnect Essentials : Disabled Other VPN Peers : 250 Total VPN Peers : 250
지금까지 [ASA #06] - Remote Access VPN current user check 글을 읽어주셔서 감사합니다.
Cisco Adaptive Security Appliance Software Version 9.8(1) Firepower Extensible Operating System Version 2.2(1.47) Device Manager Version 7.22(1)
Compiled on Wed 10-May-17 15:38 PDT by builders System image file is "boot:/asa981-smp-k8.bin" Config file at boot was "startup-config"
ASAv up 6 hours 4 mins
Hardware: ASAv, 2048 MB RAM, CPU Xeon E5 series 2394 MHz, Model Id: ASAv10 Internal ATA Compact Flash, 8192MB Slot 1: ATA Compact Flash, 8192MB BIOS Flash Firmware Hub @ 0x0, 0KB
0: Ext: Management0/0 : address is 50fd.e000.3500, irq 11 1: Ext: GigabitEthernet0/0 : address is 50fd.e000.3501, irq 11 2: Ext: GigabitEthernet0/1 : address is 50fd.e000.3502, irq 10 3: Ext: GigabitEthernet0/2 : address is 50fd.e000.3503, irq 10 4: Ext: GigabitEthernet0/3 : address is 50fd.e000.3504, irq 11 5: Ext: GigabitEthernet0/4 : address is 50fd.e000.3505, irq 11 6: Ext: GigabitEthernet0/5 : address is 50fd.e000.3506, irq 10 7: Ext: GigabitEthernet0/6 : address is 50fd.e000.3507, irq 10
License mode: Smart Licensing ASAv Platform License State: Unlicensed No active entitlement: no feature tier and no throughput level configured *Memory resource allocation is more than the permitted limit.
Licensed features for this platform: Maximum VLANs : 50 Inside Hosts : Unlimited Failover : Active/Standby Encryption-DES : Enabled Encryption-3DES-AES : Enabled Security Contexts : 0 Carrier : Disabled AnyConnect Premium Peers : 2 AnyConnect Essentials : Disabled Other VPN Peers : 250 Total VPN Peers : 250 AnyConnect for Mobile : Disabled AnyConnect for Cisco VPN Phone : Disabled Advanced Endpoint Assessment : Disabled Shared License : Disabled Total TLS Proxy Sessions : 2 Botnet Traffic Filter : Enabled Cluster : Disabled
Serial Number: 9A2U9VPUTQH
Image type : Release Key version : A
Configuration last modified by enable_15 at 12:15:07.479 UTC Sun Feb 2 2025 ASAv#
ASAv# show vpn-sessiondb license-summary
ASAv는 Anyconnect Capacity는 250개 까지 가능하고 License 기본제공 2개 까지만 가능 합니다.
아래 정보를 보시면 현재 라이센스 사용수, 최대치 사용수까지 확인 가능 합니다.
ASAv# show vpn-sessiondb license-summary --------------------------------------------------------------------------- VPN Licenses and Configured Limits Summary --------------------------------------------------------------------------- Status : Capacity : Installed : Limit ----------------------------------------- AnyConnect Premium : ENABLED : 250 : 2 : NONE AnyConnect Essentials : DISABLED : 250 : 0 : NONE Other VPN (Available by Default) : ENABLED : 250 : 250 : NONE Shared License Server : DISABLED Shared License Participant : DISABLED AnyConnect for Mobile : DISABLED(Requires Premium or Essentials) Advanced Endpoint Assessment : DISABLED(Requires Premium) AnyConnect for Cisco VPN Phone : DISABLED VPN-3DES-AES : ENABLED VPN-DES : ENABLED ---------------------------------------------------------------------------
--------------------------------------------------------------------------- VPN Licenses Usage Summary --------------------------------------------------------------------------- Local : Shared : All : Peak : Eff. : In Use : In Use : In Use : In Use : Limit : Usage ---------------------------------------------------- AnyConnect Premium : 0 : 0 : 0 : 2 : 2 : 0% AnyConnect Client : : 0 : 1 : 0% AnyConnect Mobile : : 0 : 0 : 0% Clientless VPN : : 0 : 1 : 0% Generic IKEv2 Client : : 0 : 0 : 0% Other VPN : : 0 : 0 : 250 : 0% Cisco VPN Client : : 0 : 0 : 0% L2TP Clients Site-to-Site VPN : : 0 : 0 : 0% ---------------------------------------------------------------------------
ASAv# show nameif Interface Name Security GigabitEthernet0/0 outside 0 GigabitEthernet0/1 inside 100 Management0/0 MGMT 0 ASAv# show int ASAv# show interface ip brie Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.10.78 YES manual up up GigabitEthernet0/1 10.1.1.254 YES manual up up GigabitEthernet0/2 unassigned YES unset administratively down down GigabitEthernet0/3 unassigned YES unset administratively down down GigabitEthernet0/4 unassigned YES unset administratively down down GigabitEthernet0/5 unassigned YES unset administratively down down GigabitEthernet0/6 unassigned YES unset administratively down down Management0/0 192.168.100.250 YES manual up up ASAv#
Remote Access User가 VPN통해서 내부에 있는 자원에 통신 할려고 방화벽 정책이 필요 합니다.
G0/0 outside - ACL name - outsideacl
G0/1 inside - ACL name - insideacl
G0/2 DMZ - ACL name -dmzacl
ASAv# show interface ip brie Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.10.78 YES manual up up GigabitEthernet0/1 10.1.1.254 YES manual up up GigabitEthernet0/2 10.10.10.254 YES manual up up GigabitEthernet0/3 unassigned YES unset administratively down down GigabitEthernet0/4 unassigned YES unset administratively down down GigabitEthernet0/5 unassigned YES unset administratively down down GigabitEthernet0/6 unassigned YES unset administratively down down Management0/0 192.168.100.250 YES manual up up ASAv#
SW 설정
interface GigabitEthernet0/1 no switchport ip address 10.10.10.10 255.255.255.0 negotiation auto ip route 0.0.0.0 0.0.0.0 10.10.10.254
방화벽 정책 설정
ASAv(config)# access-list outsideacl extended permit ip 192.168.200.0 255.255.255.0 10.10.10.0 255.255.255.0 ASAv(config)# access-group outsideacl in interface outside
Secure Client 접속후 Ping 10.10.10.10 하면 아래처럼 성공 합니다.
ASAv# show access-list access-list cached ACL log flows: total 1, denied 1 (deny-flow-max 4096) alert-interval 300 access-list SPLIT_TUNNEL; 2 elements; name hash: 0x63aa8f22 access-list SPLIT_TUNNEL line 1 standard permit 10.1.1.0 255.255.255.0 (hitcnt=0) 0x96d75e6a access-list SPLIT_TUNNEL line 2 standard permit 10.10.10.0 255.255.255.0 (hitcnt=0) 0x23138585 access-list outsideacl; 1 elements; name hash: 0x945119d1 access-list outsideacl line 1 extended permit ip 192.168.200.0 255.255.255.0 10.10.10.0 255.255.255.0 (hitcnt=1) 0xb46d0730 ASAv#
만약에 Remote Access VPN USER들은 outbound access-list 없이 그냥 BYpass하고 싶으면 아래 명령어를 입력합니다.
ASA1(config)# sysopt connection permit-vpn
지금까지 [ASA #04] - Remote Access VPN 글을 읽어주셔서 감사합니다.
204561552 bytes copied in 628.840 secs (325734 bytes/sec) ASAv#
7. dir flash:를 통해서 asdm 이미지 파일을 확인 합니다.
ASAv# dir flash:
Directory of disk0:/
7 -rwx 0 11:39:22 May 21 2017 use_ttyS0 11 drwx 4096 03:12:34 Feb 02 2025 smart-log 8 drwx 4096 03:10:50 Feb 02 2025 log 12 drwx 4096 03:12:40 Feb 02 2025 coredumpinfo 84 -rwx 204561552 07:24:47 Feb 02 2025 asdm-openjre-7221.bin
8. ASDM를 사용하기 위해서 아래처럼 설정 합니다.
ASAv# conf t ASAv(config)# asdm image disk0:/asdm-openjre-7221.bin ASAv(config)# http server enable ASAv(config)# http 0.0.0.0 0.0.0.0 inside ASAv(config)# username kevin password XXXXXXX privilege 15 ASAv(config)#
9. inside interface는 Gi0/1이고 IP주소는 10.1.1.254입니다.
ASAv# show int ip brie Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.10.78 YES manual up up GigabitEthernet0/1 10.1.1.254 YES manual up up GigabitEthernet0/2 unassigned YES unset administratively down down GigabitEthernet0/3 unassigned YES unset administratively down down GigabitEthernet0/4 unassigned YES unset administratively down down GigabitEthernet0/5 unassigned YES unset administratively down down GigabitEthernet0/6 unassigned YES unset administratively down down Management0/0 192.168.100.250 YES manual up up ASAv#
ASAv# show nameif Interface Name Security GigabitEthernet0/0 outside 0 GigabitEthernet0/1 inside 100 Management0/0 MGMT 0 ASAv#
아래처럼 접속을 시도 합니다. 그리고 Install ASDM Launcher를 클릭 합니다.
ciscoasa# conf t ciscoasa# hostname asa ASA# ASA(config)# int e0 ASA(config-if)# nameif outside INFO: Security level for "outside" set to 0 by default. ASA(config-if)# ip add 192.168.10.77 255.255.255.0 ASA(config-if)# no sh ASA(config)# int e1 ASA(config-if)# nameif inside ASA(config-if)# ip add 10.1.1.254 255.255.255.0 ASA(config-if)# no sh ASA(config-if)#
ASAv# show nameif Interface Name Security GigabitEthernet0/0 outside 0 GigabitEthernet0/1 inside 100 ASAv#
Interface 확인
ASAv# show interface ip brie Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 192.168.10.78 YES manual up up GigabitEthernet0/1 10.1.1.254 YES manual up up GigabitEthernet0/2 unassigned YES unset administratively down down GigabitEthernet0/3 unassigned YES unset administratively down down GigabitEthernet0/4 unassigned YES unset administratively down down GigabitEthernet0/5 unassigned YES unset administratively down down GigabitEthernet0/6 unassigned YES unset administratively down down Management0/0 unassigned YES unset administratively down up ASAv#
Default Gateway 확인
ASAv# show route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, + - replicated route Gateway of last resort is 192.168.10.253 to network 0.0.0.0
S* 0.0.0.0 0.0.0.0 [1/0] via 192.168.10.253, outside C 10.1.1.0 255.255.255.0 is directly connected, inside L 10.1.1.254 255.255.255.255 is directly connected, inside C 192.168.10.0 255.255.255.0 is directly connected, outside L 192.168.10.78 255.255.255.255 is directly connected, outside
그룹 정책 프로필(읽기 전용) --------------------------------- <없음>
사용자 프로필 ------------- 모든 사용자 프로필 : Pham Mang 모든 사용자 프로필 : 31994 모든 사용자 프로필 : testtest 모든 사용자 프로필 : TP-Link_Extender 모든 사용자 프로필 : AirportWiFi(Free FAST) 모든 사용자 프로필 : AirportWiFi(2.4G SLOW) 모든 사용자 프로필 : SO070VOIP2EC9 모든 사용자 프로필 : SO070VOIP2EC9_EXT 모든 사용자 프로필 : #WiFi@Changi
C:\Users\USER>
저는 31994라는 SSID를 사용 중에 있습니다.
2.
C:\Users\USER>netsh wlan show profile name="31994" key=clear
프로필 정보 ------------------- 버전 : 1 유형 : 무선 LAN 이름 : 31994 제어 옵션 : 연결 모드 : 자동 연결 네트워크 브로드캐스트: 이 네트워크가 브로드캐스트 중인 경우에만 연결 자동 전환 : 다른 네트워크로 전환 안 함 MAC 임의 지정 : 사용 안 함
연결 설정 --------------------- SSID 개수 : 1 SSID 이름 : "31994" 네트워크 종류 : 인프라 Radio 유형 : [ 모든 무선 유형 ] 공급업체 확장 : 없음
보안 설정 ----------------- 인증 : WPA2-개인 암호 : CCMP 인증 : WPA2-개인 암호 : GCMP 보안 키 : 있음 키 콘텐츠 : YYXXXXX --------------------> 패스워드를 확인 가능 합니다.
비용 설정 ------------- 비용 : 제한 없음 정체됨 : 아니요 데이터 제한에 근접: 아니요 데이터 제한 초과 : 아니요 로밍 : 아니요 비용 출처 : 기본값
C:\Users\USER>
지금까지 [IT TECH TIP-#2] - 접속된 WIFI 패스워드 확인 - cmd 글을 읽어주셔서 감사합니다.
