Table 2-1 displays the list of the Standard and Professional base licenses available for Cisco Security Manager 4.26.

Table 2-2 provides a comparison of Professional base versions with Standard base versions.

To obtain a base license, you must have (or obtain) a Cisco.com user ID, and you must register your copy of the software on Cisco.com. When registering, you must provide the Product Authorization Key (PAK) that is attached to the Software License Claim Certificate inside the shipped software package:

• If you are a registered Cisco.com user, start at http://www.cisco.com/go/license.

• If you are not a registered Cisco.com user, start at http://tools.cisco.com/RPF/register/register.do.

You must register Security Manager as soon as you can within the first 90 days and for the number of devices that you need to ensure uninterrupted use of the product. Each time you start the application, you are reminded of how many days remain on your evaluation license and you are prompted to upgrade during the evaluation period. At the end of the evaluation period, you cannot log in until you upgrade your license.

After registration, the base software license is sent to the email address that you provided during registration. Keep the license in a secure location.

When your needs have outgrown the capabilities of the Standard license, such as, to manage Catalyst security blades or when deployment grows beyond 25 devices, you need to upgrade to Cisco Security Manager Professional. You can purchase the Standard-to-Professional upgrade license. However, this upgrade license can be applied only if the base license is a Standard-25 (“ST25”) license. The orderable part ID (PID) for the Standard-to-Professional upgrade license is L-CSMSTPR-U-K9.

If your base license is a Professional version (not a Standard version or the evaluation version), you can purchase incremental (“add-on”) licenses to increase the number of devices that you are allowed to manage. You can purchase as many incremental licenses as you wish.

Incremental (“add-on”) licenses for previous versions are valid for the current version. For example, if you have a Professional-50 license for Security Manager 4.27, you can use a 4.22 incremental device license.

Incremental licenses are available in increments of 50, 100, and 250 devices.

Cisco Partners who want to use the API need to have an API license. They need to have a base PRO license in order to purchase a API license. There are two kinds of API licenses:

• A developer license. This is a 90-day license that is to be used by developers to integrate their products with Security Manager.

• A production license. This license is required by the end customers who use certain third-party products.

Note	There is no API evaluation license. Both the developer license and the production license need to be ordered explicitly by Cisco Partners who want to use the API.

The orderable part ID (PID) for the Northbound API license is L-CSMPR-API.

You are required to purchase two licenses of Cisco Security Manager in Active/Active setup.

A Cisco Security Manager license allows the use of Cisco Security Manager on a single server. A standby Cisco Security Manager server, such as one used in a high-availability or disaster recovery configuration, does not require a separate license if only one server is active at any one time. This is true even when high availability (HA) configuration is being used.

Note	Users who use a standby server are responsible for manually restoring the database from their active server on a regular basis.

This subsection gives an example of context that will be useful in understanding device count.

The following command was run in system context on a firewall with two security contexts—admin and ctx1:

r41-appinfra-arsenal# sh context
Context Name Class Interfaces Mode URL
*admin default GigabitEthernet3/2, Routed disk0:/admin.cfg
Management0/0 
ctx1 default Routed disk0:/ctx1.cfg
Total active Security Contexts: 2
r41-appinfra-arsenal# sh context count
Total active Security Contexts: 2 

This subsection gives an example of the device count for an ASA load balancing cluster in multi-context mode.

3 Nodes with 4 security contexts each: License Count = 3 * 5 = 15. 

A new installation of Cisco Security Manager 4.27 requires the purchase of the appropriate Cisco Security Manager license.

• If you have a valid SAS contract, you can upgrade to any latest version of Cisco Security Manager at no additional cost. The current license will be recognized and retained by the Security Manager installation program, so you are not required to apply for license during upgrade.

• Users without SAS contracts must either purchase a SAS contract or purchase a valid Security Manager 4.27 license.

Note	With a SAS contract, users can upgrade to the latest version for free.

If you provide no license during installation, the resulting installation will be an evaluation version. You can also select Evaluation Only during installation. Refer to Installing Security Manager Server and Common Services.

The evaluation license is limited to 50 devices.

The evaluation license provides the same privileges as the Professional Edition licenses, except that you cannot apply incremental licenses to the evaluation version.

A typical scenario for a new 4.x Cisco Security Manager customer and the licensing options are explained as follows:

1. [BASE] Selection of CSM Base Product Version

   1. Based on the number of devices you need to manage using Cisco Security Manager (after accounting for future growth prospects), obtain

2. L-CSMST5-K9/L-CSMST10-K9/ L-CSMST25-K9 for networks of 5, 10, 25 or less devices respectively.

3. L-CSMPR-50-K9/L-CSMPR-100-K9/L-CSMPR-250-K9 for larger networks. In addition, consider [INCREMENTAL] licenses.

   1. If you need to manage Catalyst 6500 or FWSM/IDSM switch blades, choose L-CSMPR-50-K9.

   2. If you obtained a standard license, but later needed to manage Catalyst switches or switch blades, or needed to manage more than 25 devices, obtain L-CSMSTPR-U-K9 to upgrade to the PRO version of the product.

   3. If you already purchased a PRO license, but later needed to manage more than 50 devices, obtain the incremental license of 4.x.

4. [INCREMENTAL] Incremental licenses allow you to manage more devices. Based on the size of the network you need to manage, obtain:

   1. L-CSMPR-LIC-50/L-CSMPR-LIC-100/L-CSMPR-LIC-250 to add management of 50, 100, or 250 additional devices respectively.

   2. For larger networks,

5. Purchase multiple units of [INCREMENTAL] licenses if you are looking for installing these on the same Cisco Security Manager server

6. Purchase [BASE] licenses and/or [INCREMENTAL] licenses if you are looking for installing multiple Cisco Security Manager servers to obtain better performance.

7. [SUPPORT] In addition to the [BASE] and [INCREMENTAL] licenses, you will have to purchase equivalent SAS contracts. Having a SAS contract will enable you to upgrade to any latest version of Cisco Security Manager without any additional cost.

A typical scenario for an existing 4.x Cisco Security Manager customer and the licensing options are explained as follows:

1. [BASE] To upgrade from CSM 4.x Standard to CSM 4.x PRO, purchase the L-CSMSTPR-U-K9 and then add incremental as you grow.

2. [INCREMENTAL] Any existing incremental licenses you already own will also be applicable for the latest Cisco Security Manager version. You do not need to obtain new incremental licenses to manage same number of devices. If you intend to enable event management for larger networks, you may need to consider deploying multiple Cisco Security Manager servers. This involves obtaining additional [BASE] product licenses.

3. [SUPPORT] CSM 4.x support contracts will continue to support CSM 4.27.