Cisco SSL-VPN License Pricing Question

Posted on 2007-04-04
Last Modified: 2011-09-20
Hello Experts,

We are looking for client-less VPN solutions, likely SSL-VPN to provide web access to our application.  These are some backgrounds:

1. We already have several PIXes in place for security control and site-to-site VPN, as well as a few software VPN clients.

2. We have absolutely no need for Anti-whatever protection on the device - anti-virus, anti-spam, etc.

That being said, I have looked at both the ASA and VPN Concentrator from Cisco since we have traditionally been a Cisco shop.  To my understanding both of them have native SSL-VPN support, but what I needed some advise is pricing.

For example, if I understand correctly the ASA only comes with certain number of SSL-VPN license.  So, say if I buy a ASA 5520 at $6k (CDW), even though it supports "up to 750 SSL-VPN clients", I will still have to pony up $5k or so to buy license packs for every 100 concurrent SSL-VPN connection, right?  So in reality if I want an ASA 5520 to support 300 concurrent SSL-VPN connection, I will be paying $6k for the unit plus $5k x 3 for SSL-VPN licnese, which puts me at $21k?

Now, if the above assumption is correct, is it also true that Cisco Concentrators comes with all the SSL-VPN licenses when you buy the box?  For example, the CVPN3030 ($19k, CDW) is rated for up to 500 SSL-VPN connections, and to my understanding as long as I buy a CVPN3030 device, I can let 500 users connect to it via SSL-VPN immediately?  Is there anything else I needed to add for that to happen?

Basically, I wanted to find out what is the cheaper way to get this done, making sure I understand their licensing policies correctly.  I was under the impression that for 300 SSL-VPN users, since we don't need the other security features of the ASA, it would be cheaper for us to just buy a Concentrator 3030 at $19k (not to mention if we need to go to 400 or 500 users, the ASA would be another $10k in the hole).  Also there are 3030s on eBay for much less...

Any advise regarding these two devices (or third party alternatives that performs well at a good price point) would be greatly appreciated.  Please feel free to share your experience, tips, catches, etc.  I am open to idea, and all are welcome!


Question by:WallaceLau
1 Comment
LVL 28

Accepted Solution

batry_boy earned 500 total points
Comment Utility
My experience reflects what you have posted in regards to the different licensing models offered between the ASA and VPN 3000 series concentrators...SSL VPN licensing costs extra on the ASA and it doesn't cost extra on the VPN 3000.  The only limitation on the VPN 3000 series is the hardware limitation that Cisco has put into each model of concentrator for the number of simultaneous WebVPN sessions allowed.

So, it is cheaper to implement clientless VPN on the VPN 3000 concentrators, you just won't get as much performance out of them since they are limited in RAM, processor, etc., but it is definitely cheaper.

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

When you connect to your workplace's VPN, you may not notice that you are using your workplace's servers to serve up webpages.  This might be undesirable since the workplace can log all the places you've been.  It also might be very slow to load pag…
Let’s list some of the technologies that enable smooth teleworking. 
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now