Symptom

After a reload and the unit to getting back in HA where it was previously active unit the ASA requests and gets authorization for the license entitlements in the ASA config but at the same time it caches the licenses requested by the active unit. In the end it is standby after joining back in HA so it is only supposed to cache the licenses that active unit has authorized and never to request them unless it becomes active. ASA/sec/stby# debug menu license 13 Name Count Handle Mode PrevMode Compliant Cached Transient ASA-SSP3RU-STD 0 0 Invalid Invalid Not Compliant True False ASA-SSP3RU-STRONG-ENCRYPTION 1 35 Authorized Authorized Compliant True False ASA-SSP3RU-CARRIER 0 0 Invalid Invalid Not Compliant False False ASA-SSP3RU-CONTEXT 80 34 Authorized Authorized Compliant True False ASA-SSP3RU-STRONG-ENCRYPTION-EC 1 0 Authorized Authorized Compliant False False ASA/sec/stby# show license all Smart licensing enabled: Yes Compliance status: In compliance Overall licensed status: Authorized (3) Entitlement(s): Strong encryption: Tag: regid.2015-01.com.cisco.ASA-SSP-STRONG-ENCRYPTION,1.0_555507e9-85f8-4e41-96de-860b59f10bbe Version: 1.0 Enforcement mode: Authorized Handle: 35 Requested time: Thu, 03 Oct 2019 14:04:44 PDT Requested count: 1 Request status: Complete Context: Tag: regid.2015-01.com.cisco.ASA-SSP-CONTEXT,1.0_6aa49e12-d37e-4b22-8a9c-e32854789b10 Version: 1.0 Enforcement mode: Authorized Handle: 34 Requested time: Thu, 03 Oct 2019 14:04:44 PDT Requested count: 80 Request status: Complete Serial Number: FLM221701UU License mode: Smart Licensing Licensed features for this platform: Maximum Physical Interfaces : Unlimited Maximum VLANs : 1024 Inside Hosts : Unlimited Failover : Active/Active Encryption-DES : Enabled Encryption-3DES-AES : Enabled Security Contexts : 90 Carrier : Disabled AnyConnect Premium Peers : 20000 AnyConnect Essentials : Disabled Other VPN Peers : 20000 Total VPN Peers : 20000 AnyConnect for Mobile : Enabled AnyConnect for Cisco VPN Phone : Enabled Advanced Endpoint Assessment : Enabled Shared License : Disabled Total TLS Proxy Sessions : 15000 Cluster : Enabled Failover cluster licensed features for this platform: Maximum Physical Interfaces : Unlimited Maximum VLANs : 1024 Inside Hosts : Unlimited Failover : Active/Active Encryption-DES : Enabled Encryption-3DES-AES : Enabled Security Contexts : 100 Carrier : Disabled AnyConnect Premium Peers : 20000 AnyConnect Essentials : Disabled Other VPN Peers : 20000 Total VPN Peers : 20000 AnyConnect for Mobile : Enabled AnyConnect for Cisco VPN Phone : Enabled Advanced Endpoint Assessment : Enabled Shared License : Disabled Total TLS Proxy Sessions : 15000 Cluster : Enabled

Conditions

Reproduced so far in ASA in multi-context mode running code 9.8.3.18, where PLR is set in both chassis but it might be possible to trigger the same with regular smart licensing. Reloading the unit that is active and after joining the pair getting in standby.

Workaround

Reload the unit back again once it is standby and after it syncs again the unit will not request any licenses just cache the ones from the active FW.

Further Problem Description