| 8.2 |  | The Cisco PIX Security Appliance |
| 8.2.9 |  | License types and VPN capabilities |

| License types The PIX Security Appliance license determines the level of service it provides, its functions in a network, the maximum number of interfaces, and memory it can support. For all PIX Security Appliance models, except the PIX 506E, license options are available. This firewall model is provided in a single and unlimited user license mode. The PIX Security Appliance 501 comes with either a ten-user license or 50-user license, which is upgradeable to an unlimited license. For all other models, the following three basic license types are available:

1. Unrestricted—PIX Security Appliance platforms in an Unrestricted (UR) license mode allow installation and use of the maximum number of interfaces and RAM supported by the platform. The UR license supports failover.
2. Restricted—PIX Security Appliance platforms in a Restricted (R) license mode limit the number of interfaces supported and the amount of RAM available within the system. A Restricted licensed firewall does not support a redundant system for failover configurations.
3. Failover—The failover (FO) software license places the PIX Security Appliance in a failover mode for use alongside another PIX Security Appliance with an unrestricted license.

It is important to know that the cost of the licenses varies greatly, so the network administrator should identify the network needs prior to determining which license is appropriate.

VPN capabilities
In addition to upgrading the PIX Security Appliance license, the network administrator may wish to add data encryption services or increase the level of data encryption provided by the PIX Security Appliance. An online form at the PIX Firewall Software homepage on Cisco Connection Online (CCO) can be completed to obtain a free 56-bit DES key . There is a separate form and a minimal charge to install or upgrade to 168-bit 3DES encryption. For failover configurations, the unrestricted and failover firewalls each require their own unique corresponding DES or 3DES license for failover functionality.

Adding cryptographic services, which are discussed in-depth in another module, and upgrading the PIX Firewall license both require obtaining and installing an activation key. Log on to CCO for current information on obtaining activation keys. Installation of activation keys is discussed in another module.

The PIX Security Appliance is interoperable and scalable with IPSec, which includes an umbrella of security and authentication protocols, such as Internet Key Exchange (IKE) and Public Key Infrastructure (PKI). The PIX Security Appliance offers an IPSec based virtual private network (VPN) that allows remote clients to securely access corporate networks through their Internet service providers (ISPs). PIX Security Appliance IPSec and VPN support will be explained in greater detail in a later module.

| Web Links PIX Security Appliance Software: (A valid CCO account is required to access this web link) http://www.cisco.com/kobayashi/ sw-center/ciscosecure/pix.shtml