19 March 2015

Cisco IronPort (WSA/WSAV) - Licensing/Feature Key Enablement

The process to enable feature keys provided by Cisco is vague. As of right now (19/03/2015) I've noted the following as a general guide to the experience:

  • You need to go through the standard Cisco licensing process and get your license, associated with your device.
    • If you are migrating from one device to another you can "try" re-host the license yourself on the licensing website or you can email licensing@cisco.com and let them do it for you.
  • The Cisco Licensing site/team will send you a zip file (or you can download it from the Cisco licensing page). In that zip file a ".bin" file is located as well as a generic "instructions" HTML file. The instructions file should be similar to the below (I've been provided variations to the below throughout my experience):
    To apply the key(s), please follow the instructions below:
    
        In the Web Interface, use the System Administration > Feature Keys page.
        In the Command Line Interface, issue the command 'featurekey'.
    
    Virtual Appliance License Installation Instructions:
    1. From the console, note the IP address of the appliance (e.g. enter interfaceconfig)
    2. From SSH or telnet, login to the virtual appliance with admin/ironport
    
    3. Enter loadlicense, then
        a. Use option <1> to input the license file by pasting its contents and pressing Ctrl-D, or
        b. Use option <2> to load the license file that has been uploaded to the virtual appliance via FTP:
                   i. Using FTP to transfer license file to appliance: ftp to appliance with admin/Ironport, cd into directory configuration, put license.xml, exit
                   ii. Using SCP to copy license file to appliance: scp license.xml admin@:configuration
    
    4. Read and agree to the End User License Agreement
    5. Enter showlicense to view the license details
    6. Log on to the web UI (http://:8080) and run the system setup wizard
      • The first section is the part you are concerned with if you just have a physical appliance.
      • The "Virtual Appliance License Installation Instructions" are aimed at WSAV devices and has to do with defining a shared "serial number" across all virtual appliances.
    • Open the ".bin" file in a text editor. You'll note that a single/series of features, dates and keys are listed similar to the below:
    Type: McAfee Anti-Malware, apply by: 2015/04/17, expires: 2015/10/09(12 months, 0 days)
    Key : aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaa=-=

    Type: Sophos Anti-Virus, apply by: 2015/04/15, expires: 2015/10/09(12 months, 0 days)
    Key : aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaa=-=

    Type: IronPort Web Reputation Filters, apply by: 2015/04/15, expires: 2015/10/09(12 months, 0 days)
    Key : aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaa=-=

    Type: Webroot, apply by: 2015/04/15, expires: 2015/10/09(12 months, 0 days)
    Key : aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaa=-=

    Type: Cisco IronPort Web Usage Controls, apply by: 2015/04/15, expires: 2015/10/09(12 months, 0 days)
    Key : aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaa=-=
    • What you need to do is copy each key which in the above would be "aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaa=-=" to web GUI or featurekey command as instructed in the instructions.
    • DO NOT COPY THE ENTIRE DOCUMENT INTO THE GUI/FEATUREKEY COMMAND. It doesn't work...

    Provided you follow this you should be ok until next time Cisco change the process. The above was tested on 8.0.6 code on WSAv and WSA appliances.

    If you have multiple physical appliances just email the licensing team and they'll sort it out for you.