License Requirements for Cloud-Delivered Firewall Management Center High Availability Configurations

Each device requires the same licenses whether managed by a single Cloud-Delivered Firewall Management Center or by Cloud-Delivered Firewall Management Centers in a high availability pair (hardware or virtual).

Example: If you want to enable advanced malware protection for two devices managed by a Cloud-Delivered Firewall Management Center pair, buy two Malware Defense licenses and two TM subscriptions, register the active Cloud-Delivered Firewall Management Center with the Smart Software Manager, then assign the licenses to the two devices on the active Cloud-Delivered Firewall Management Center.

Only the active Cloud-Delivered Firewall Management Center is registered with the Smart Software Manager. When failover occurs, the system communicates with Smart Software Manager to release the license entitlements from the originally-active Cloud-Delivered Firewall Management Center and assign them to the newly-active Cloud-Delivered Firewall Management Center.

In Specific License Reservation deployments, only the primary Cloud-Delivered Firewall Management Center requires a Specific License Reservation.

Hardware Cloud-Delivered Firewall Management Center

No special license is required for hardware Cloud-Delivered Firewall Management Centers in a high availability pair.

Firewall Management Center Virtual

You will need two identically licensed Firewall Management Center Virtuals. Firewall Management Center Virtual needs an individual license for each device it manages.

Each registered device in a Firewall Management Center Virtual high-availability pair must have its own license. Although only the active FMC registers with Smart Software Manager at any time, entitlement usage accounts for both Firewall Management Center Virtuals in the high availability pair.

Entitlement calculation for Firewall Management Center Virtual high availability pairs:

Firewall Management Center Virtual entitlement = Number of Firewall Management Center Virtual peers in the high availability pair x Number of managed devices

Example:

For the Firewall Management Center Virtual high availability pair managing 2 devices, you can use:

  • Two (2) Firewall Management Center Virtual entitlements

  • 2 device licenses

  • Firepower MCv Device Licenses seen on Smart Software Manager is 4

For two Firewall Management Center Virtual high availability pair managing 2 devices each, you can use:

  • Four (4) Firewall Management Center Virtual entitlements

  • 4 device licenses

  • Firepower MCv Device Licenses seen on Smart Software Manager is 8

If you break the high availability pair, the Firewall Management Center Virtual entitlements associated with the secondary Firewall Management Center Virtual are released. (In the example, you would then have two standalone Firewall Management Center Virtual devices.)