Cisco SSL-VPN License Pricing Question

Posted on 2007-04-04
Last Modified: 2011-09-20
Hello Experts,

We are looking for client-less VPN solutions, likely SSL-VPN to provide web access to our application.  These are some backgrounds:

1. We already have several PIXes in place for security control and site-to-site VPN, as well as a few software VPN clients.

2. We have absolutely no need for Anti-whatever protection on the device - anti-virus, anti-spam, etc.

That being said, I have looked at both the ASA and VPN Concentrator from Cisco since we have traditionally been a Cisco shop.  To my understanding both of them have native SSL-VPN support, but what I needed some advise is pricing.

For example, if I understand correctly the ASA only comes with certain number of SSL-VPN license.  So, say if I buy a ASA 5520 at $6k (CDW), even though it supports "up to 750 SSL-VPN clients", I will still have to pony up $5k or so to buy license packs for every 100 concurrent SSL-VPN connection, right?  So in reality if I want an ASA 5520 to support 300 concurrent SSL-VPN connection, I will be paying $6k for the unit plus $5k x 3 for SSL-VPN licnese, which puts me at $21k?

Now, if the above assumption is correct, is it also true that Cisco Concentrators comes with all the SSL-VPN licenses when you buy the box?  For example, the CVPN3030 ($19k, CDW) is rated for up to 500 SSL-VPN connections, and to my understanding as long as I buy a CVPN3030 device, I can let 500 users connect to it via SSL-VPN immediately?  Is there anything else I needed to add for that to happen?

Basically, I wanted to find out what is the cheaper way to get this done, making sure I understand their licensing policies correctly.  I was under the impression that for 300 SSL-VPN users, since we don't need the other security features of the ASA, it would be cheaper for us to just buy a Concentrator 3030 at $19k (not to mention if we need to go to 400 or 500 users, the ASA would be another $10k in the hole).  Also there are 3030s on eBay for much less...

Any advise regarding these two devices (or third party alternatives that performs well at a good price point) would be greatly appreciated.  Please feel free to share your experience, tips, catches, etc.  I am open to idea, and all are welcome!


Question by:WallaceLau
1 Comment
LVL 28

Accepted Solution

batry_boy earned 500 total points
ID: 18855674
My experience reflects what you have posted in regards to the different licensing models offered between the ASA and VPN 3000 series concentrators...SSL VPN licensing costs extra on the ASA and it doesn't cost extra on the VPN 3000.  The only limitation on the VPN 3000 series is the hardware limitation that Cisco has put into each model of concentrator for the number of simultaneous WebVPN sessions allowed.

So, it is cheaper to implement clientless VPN on the VPN 3000 concentrators, you just won't get as much performance out of them since they are limited in RAM, processor, etc., but it is definitely cheaper.

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Port forwarding 14 173
Palo Alto Networks - find the sec zone 3 65
VLAN Question 13 45
AnyConnect VPN endpoint authentication/validation 4 18
Overview Often, we set up VPN appliances where the connected clients are on a separate subnet and the company will have alternate internet connections and do not use this particular device as the gateway for certain servers or clients. In this case…
If you use NetMotion Mobility on your PC and plan to upgrade to Windows 10, it may not work unless you take these steps.
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question