In short: Cisco Secure Firewall licensing starts with Essentials, the base licence for firewall, routing, NAT and application control. Term subscriptions add IPS (formerly Threat), Malware Defense and URL Filtering, and both Malware Defense and URL Filtering need IPS. Carrier adds mobile-network inspection. Secure Client VPN licences are separate. Everything is managed through Cisco Smart Licensing.
How Secure Firewall licensing works
Threat Defense licensing is modular: a base licence for the firewall itself, then optional subscriptions for each layer of threat inspection. The names have changed over the years, which causes confusion on old quotes:
- Essentials was the Base licence
- IPS was the Threat licence
- Malware Defense was the Malware licence
- URL Filtering is still URL Filtering
- Secure Client Advantage, Premier and VPN Only were AnyConnect Plus, Apex and VPN Only
Cisco standardised these names in Management Center 7.3.
Licences are held in a Cisco Smart Account and its virtual accounts, and the Management Center (or Device Manager for a single device) registers with Cisco Smart Software Manager and assigns licences to each firewall. Devices do not register on their own when managed centrally.
The licences compared
| Licence | What it enables | Type | Requires |
|---|---|---|---|
| Essentials | Firewall, routing, switching, NAT, and user and application control | Perpetual (or subscription) on hardware; subscription only on Threat Defense Virtual | None |
| IPS (formerly Threat) | Snort 3 intrusion detection and prevention, file control, Security Intelligence filtering | Term subscription | Essentials |
| Malware Defense (formerly Malware) | Malware detection and blocking, dynamic analysis with Secure Malware Analytics, file storage | Term subscription | IPS |
| URL Filtering | Category and reputation-based URL filtering (manual allow and block lists work without it) | Term subscription | IPS |
| Carrier | Inspection of Diameter, GTP/GPRS, M3UA and SCTP for mobile and telecom networks (enabled with a FlexConfig policy) | Term subscription, on selected larger platforms and Threat Defense Virtual | Essentials |
| Secure Client (Advantage, Premier or VPN Only) | Remote access VPN for users | Subscription or perpetual, bought separately | Export-controlled (strong encryption) functionality |
IPS can be bought on its own or bundled with Malware Defense, URL Filtering or both for each device. Both units of a high-availability pair need the same licences, and in a cluster each node consumes a licence for each feature.
Terms, evaluation and offline licensing
- Subscription terms: threat subscriptions are bought for a fixed term, and are best co-terminated across your estate to simplify renewals
- Evaluation: a Management Center can run in evaluation mode for 90 days before registration, but strong encryption cannot be evaluated
- Export-controlled features: remote access VPN and strong encryption need the export-controlled functionality enabled on your Smart Account
- Staying in touch with Cisco: a registered Management Center checks in for licence authorisation every 30 days and can run for up to 90 days without contact
- Air-gapped networks: Specific License Reservation or Smart Software Manager On-Prem let you license devices without direct contact with Cisco
Management and VPN licences
Don't forget the licences around the firewall:
- Management Center hardware needs no platform licence; Management Center Virtual is licensed by the number of devices it manages (doubled for a high-availability pair)
- Cloud-delivered Management Center and cloud logging in Security Cloud Control are subscriptions
- Remote access VPN needs Cisco Secure Client licences: Advantage, Premier (the two can be used together) or VPN Only, which cannot be combined with the other two
- Threat Defense Virtual is licensed in performance tiers; see virtual and cloud firewalls
Firewalls can also be bought within the Cloud Protection Suite for Hybrid Mesh Firewall deployments, or through a Cisco Enterprise Agreement; our Cisco security licensing guide covers those models across the portfolio.
Which licences do you need?
| If you need | Buy |
|---|---|
| A stateful firewall and VPN with application control | Essentials (plus Secure Client for remote users) |
| Intrusion prevention and Talos Security Intelligence | Essentials + IPS |
| Protection against malicious downloads and attachments | Essentials + IPS + Malware Defense |
| Web category filtering for staff browsing | Essentials + IPS + URL Filtering |
| Full next-generation protection | Essentials + IPS + Malware Defense + URL Filtering |
Pricing depends on platform, term and quantity: ask us for a quote and we will lay out the options side by side.
How we help
We audit your Smart Account, find unused or expiring licences, co-terminate renewals, map old Base/Threat/Malware licences to current ones during a refresh, and quote new hardware and subscriptions. Contact us with your current licence summary.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What licences does Cisco Firepower need?
Every Threat Defense device has the Essentials base licence. Most organisations add the IPS subscription, and often Malware Defense and URL Filtering, which both require IPS. Remote access VPN needs Secure Client licences on top.
What happened to the Cisco Firepower Threat licence?
Cisco renamed it IPS in Management Center 7.3. It still covers intrusion prevention, file control and Security Intelligence, and it is a prerequisite for Malware Defense and URL Filtering.
Is Cisco Secure Firewall licensing perpetual or subscription?
Both. The Essentials licence can be perpetual on hardware but is subscription-only on Threat Defense Virtual. IPS, Malware Defense, URL Filtering and Carrier are term subscriptions.
Are AnyConnect or Secure Client licences included with the firewall?
No. Remote access VPN needs Cisco Secure Client licences (Advantage, Premier or VPN Only), bought separately. See Secure Client licensing.
How much does a Cisco Secure Firewall licence cost?
It depends on the platform, the subscriptions you choose and the term. We do not publish prices; ask us for a quote and we will compare options for your estate.