In short
Cisco Secure Firewall features (Threat, Malware Defense, URL Filtering) are licensed per appliance or per virtual instance on 1, 3 or 5-year terms. Virtual firewalls use FTDV-SEC-SUB with a Base and feature licence per performance tier, or the monthly MSLA. Forever Systems, a Cisco Partner, quotes the right codes, with terms confirmed at quote.
Get a quote for Cisco Secure Firewall licences
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What you order for Cisco Secure Firewall
Cisco Secure Firewall runs Firewall Threat Defense software on Cisco's firewall appliances, as a virtual firewall on your own hypervisor, and in public clouds. Whichever form it takes, the security features are sold as subscriptions on top of the firewall itself, and Cisco's part numbers use short letters for each one:
| Letters in the code | Feature | What it adds |
|---|---|---|
| T | Threat | Security Intelligence and intrusion prevention (IPS) |
| M or AMP | Malware Defense | File and traffic analysis against malware |
| C or URL | URL Filtering | Web access rules by category and reputation |
| TC, TM, TMC | Bundles | Threat with URL Filtering, Threat with Malware Defense, or all three |
Cisco notes that the Threat licence is needed before Malware Defense or URL Filtering can be used, which is why most orders take a bundle. Subscription terms are 1, 3 or 5 years, and the term subscriptions carry -1Y, -3Y or -5Y on the end of the code.
For what the firewall does and how the range fits together, see Cisco Secure Firewall (opens in a new tab) on our Cisco security site. This page covers the part numbers and the routes to buy them.
Not sure which licence fits? Ask us
Tell us what you need and we will recommend the right licence for your organisation, with a quote.
How Cisco Secure Firewall licensing works
There are two ways the licence attaches, depending on the firewall:
- Appliances: feature licences are bought per appliance, and each code names the appliance model it belongs to. Cisco publishes a separate set of Threat, URL Filtering, Malware Defense and bundle codes for every model, so we confirm the exact codes for your firewalls at quote rather than listing hundreds of them here. On Cisco's current appliance ranges the Essentials (base) licence is included automatically with the hardware; you add the feature subscriptions you want on top.
- Threat Defense Virtual (FTDv): from version 7.0 the virtual firewall uses performance-tiered subscriptions. You order the top-line FTDV-SEC-SUB, add a Base licence for each instance at one of six tiers (FTDv 5s, 10s, 20s, 30s, 50s or 100s) and then, optionally, the feature licences for the same tier. Cisco's ordering guide shows the term defaulting to 3 years, with 1 and 5 years available.
The table below lists the Base and full Threat, Malware and URL Filtering (TMC) codes for each virtual tier. Cisco also publishes single-feature and two-feature virtual codes on the same pattern (FTD-V-<tier>-T, -TC, -TM, -URL and -AMP), which we can quote if you only need part of the bundle.
In AWS and Microsoft Azure, Threat Defense Virtual can be licensed either by bringing your own licence (the codes on this page) or by hourly billing through the cloud marketplace. Google Cloud and Oracle Cloud Infrastructure use bring-your-own-licence, as do private clouds and hyperconverged platforms such as Nutanix AHV. For sizing a virtual firewall and choosing a tier, see Threat Defense Virtual (opens in a new tab); for how appliance licences drive cost, see Cisco Secure Firewall licensing (opens in a new tab).
Cisco Secure Firewall part numbers
Threat Defense Virtual, logging and MSLA codes from Cisco's own guides. For a virtual firewall, order one FTDV-SEC-SUB, a Base licence per instance at its tier and, if you want the full feature set, the TMC licence for the same tier and quantity. Appliance feature licences name the firewall model, so we confirm those codes at quote.
| Part number | Description | Unit | Term | Route | Basket |
|---|---|---|---|---|---|
| FTDV-SEC-SUB | Threat Defense Virtual subscription (top line) | One per subscription | 1, 3 or 5 years | Annual | |
| FTD-V-5S-BSE-K9 | Threat Defense Virtual 5s tier, Base licence | Per virtual firewall instance | 1, 3 or 5 years | Annual | |
| FTD-V-10S-BSE-K9 | Threat Defense Virtual 10s tier, Base licence | Per virtual firewall instance | 1, 3 or 5 years | Annual | |
| FTD-V-20S-BSE-K9 | Threat Defense Virtual 20s tier, Base licence | Per virtual firewall instance | 1, 3 or 5 years | Annual | |
| FTD-V-30S-BSE-K9 | Threat Defense Virtual 30s tier, Base licence | Per virtual firewall instance | 1, 3 or 5 years | Annual | |
| FTD-V-50S-BSE-K9 | Threat Defense Virtual 50s tier, Base licence | Per virtual firewall instance | 1, 3 or 5 years | Annual | |
| FTD-V-100S-BSE-K9 | Threat Defense Virtual 100s tier, Base licence | Per virtual firewall instance | 1, 3 or 5 years | Annual | |
| FTD-V-5S-TMC | Threat Defense Virtual 5s tier, Threat, Malware and URL Filtering | Per instance (same quantity as Base) | 1, 3 or 5 years | Annual | |
| FTD-V-10S-TMC | Threat Defense Virtual 10s tier, Threat, Malware and URL Filtering | Per instance (same quantity as Base) | 1, 3 or 5 years | Annual | |
| FTD-V-20S-TMC | Threat Defense Virtual 20s tier, Threat, Malware and URL Filtering | Per instance (same quantity as Base) | 1, 3 or 5 years | Annual | |
| FTD-V-30S-TMC | Threat Defense Virtual 30s tier, Threat, Malware and URL Filtering | Per instance (same quantity as Base) | 1, 3 or 5 years | Annual | |
| FTD-V-50S-TMC | Threat Defense Virtual 50s tier, Threat, Malware and URL Filtering | Per instance (same quantity as Base) | 1, 3 or 5 years | Annual | |
| FTD-V-100S-TMC | Threat Defense Virtual 100s tier, Threat, Malware and URL Filtering | Per instance (same quantity as Base) | 1, 3 or 5 years | Annual | |
| SEC-LOG-CL | Security Analytics and Logging (SaaS), Logging licence | Per firewall, by daily log volume | Confirmed at quote | Annual | |
| SEC-ANYL-CL | Security Analytics and Logging (SaaS), Logging Analytics licence | Per firewall, by daily log volume | Confirmed at quote | Annual | |
| SEC-LOG-OP | Security Analytics and Logging (on-premises), Logging and Troubleshooting | Per firewall | Confirmed at quote | Annual | |
| MSLA-FTDVSEC-SUB | Threat Defense Virtual under the MSLA (version 7.0 or later) | Per instance, monthly usage | Monthly usage | MSLA | |
| SPLA-NGFWV-PKG-M | Next Generation Firewall Virtual under the MSLA (version 6.3 or later) | Per instance, monthly usage | Monthly usage | MSLA |
Is Cisco Secure Firewall licences the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Threat Defense Virtual: annual and MSLA codes compared
The same virtual firewall bought on an annual term or monthly under Cisco's Managed Services License Agreement. The monthly MSP programme code, where one applies, is confirmed at quote.
| Product | Unit | Monthly MSP part number | Annual part number | MSLA part number |
|---|---|---|---|---|
| Threat Defense Virtual subscription | Per Threat Defense Virtual deployment | Not listed | FTDV-SEC-SUB | MSLA-FTDVSEC-SUB |
Part numbers from Cisco Network Security Ordering Guide (updated 15 October 2026) (opens in a new tab); Cisco MSLA Product Terms, Secure Firewall Threat Defense Virtual (opens in a new tab), checked 2026-11-08. Add the licences you need to your basket and request a quote: we confirm the right part numbers, quantities and terms when we quote.
Monthly billing for virtual firewalls: the MSLA
Threat Defense Virtual is one of the Cisco products with published codes under the Managed Services License Agreement (MSLA), Cisco's programme for service providers billed monthly on usage:
- MSLA-FTDVSEC-SUB: Secure Firewall Threat Defense Virtual MSLA software, for version 7.0 or later
- SPLA-NGFWV-PKG-M: the earlier Next Generation Firewall Virtual MSLA software, for version 6.3 or later
Cisco's MSLA product terms (opens in a new tab) describe the same building blocks as the annual subscription: a Base subscription with application visibility and control, plus optional Threat, Malware and URL Filtering subscriptions.
| Route | How it is billed | Firewalls | Part numbers |
|---|---|---|---|
| Annual subscription | Annually or prepaid over a 1, 3 or 5-year term | Appliances and virtual | Virtual codes listed above; appliance codes confirmed at quote |
| MSLA | Monthly, on usage | Threat Defense Virtual | MSLA-FTDVSEC-SUB or SPLA-NGFWV-PKG-M |
Forever Systems buys Cisco security mainly through Cisco's MSP programme (Secure MSP Center) and the MSLA, so a virtual firewall can sit on the same monthly bill as your other Cisco services, with terms confirmed at quote. An annual term suits a fixed estate and a budget set once a year. We can quote both so you can compare.
Security Analytics and Logging for Secure Firewall
Security Analytics and Logging (SAL) stores firewall events for longer than the firewall or its manager keeps them, for troubleshooting, investigations and compliance. It is usually added to the firewall order, with either the same term as the firewall subscription or a different one, and comes in two forms:
- SaaS, with a Cloud Data Store: choose SEC-LOG-CL (Logging) or SEC-ANYL-CL (Logging Analytics). Logging is included within Logging Analytics, so you only need one of the two. Both include a Security Cloud Control tenant for viewing logs. Cisco attaches a default daily log volume for each firewall, based on its logging estimator, with 90 days of rolling storage; optional retention extensions take that to 1, 2 or 3 years.
- On-premises Data Store: SEC-LOG-OP, the Logging and Troubleshooting licence, hosted on Cisco Secure Network Analytics appliances and queried remotely from the Firewall Management Center.
Only one data store option is chosen per firewall. If your firewalls are managed from Security Cloud Control, its unlimited-logging device licence or a stand-alone SAL subscription may suit you better: see Security Cloud Control part numbers.
Remote access, management and related Cisco licences
A Secure Firewall order often needs a few related licences:
- Remote access VPN: users connecting to the firewall need Cisco Secure Client licences, ordered separately. See Cisco Secure Client part numbers.
- Cloud management: Security Cloud Control manages Threat Defense and ASA firewalls from the cloud, with a base tenant and a per-firewall licence. See Security Cloud Control part numbers.
- Public cloud workloads: Multicloud Defense protects traffic across AWS, Azure, Google Cloud and Oracle Cloud and can orchestrate Threat Defense Virtual gateways. See Cisco Multicloud Defense part numbers.
- Incident response: a Talos Incident Response retainer can be attached to a firewall order. See Cisco Talos part numbers.
If you would rather have a cloud-managed Meraki MX security appliance, its licences are on our Meraki store: Meraki MX security appliances (opens in a new tab). To compare Cisco with other vendors, see firewall software.
How we help
Tell us which firewalls you run or plan to buy, whether any are virtual or in a public cloud, which features you need, how long you want to keep logs, and when any existing subscriptions end. We work out the right feature licences for each appliance, the tier for each virtual firewall and the logging option, and line up the terms so renewals fall together where Cisco's terms allow it.
Add the codes you need to your basket and send it to us, or simply describe your estate. We reply with a quote showing each part number, quantity and term, and the monthly MSLA alternative for virtual firewalls. Contact us to get started.
How Forever Systems supplies your software licences
Forever Systems supplies business software subscriptions to UK organisations from one account, with one invoice and a team who know the products.
- Help choosing the right edition: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from our engineers, not just a reseller account
- Consolidated billing and renewal reminders to help stop subscriptions lapsing unexpectedly
We can supply businesses, schools, charities and public sector organisations of all sizes.
Frequently asked questions
Which licence does my Cisco firewall need?
At least the Threat licence, which adds intrusion prevention and Security Intelligence, because Malware Defense and URL Filtering both depend on it. Most organisations take the TMC bundle (Threat, Malware and URL Filtering). On appliances the code names the model, so we confirm it at quote; virtual firewalls use the tiered codes on this page.
What does TMC mean in a Cisco firewall part number?
T is Threat (IPS and Security Intelligence), M is Malware Defense and C is URL Filtering, so TMC is the bundle of all three. TC and TM are the two-feature bundles, and -1Y, -3Y or -5Y on the end of an appliance code sets the term.
What is FTDV-SEC-SUB?
It is the top-line subscription for Cisco Secure Firewall Threat Defense Virtual. Under it you add a Base licence for each virtual firewall at one of six performance tiers, from FTDv 5s to FTDv 100s, and optional feature licences for the same tier, on a 1, 3 or 5-year term.
Can a Cisco virtual firewall be billed monthly?
Yes. Threat Defense Virtual has published MSLA codes, MSLA-FTDVSEC-SUB for version 7.0 or later and SPLA-NGFWV-PKG-M for version 6.3 or later, billed monthly on usage. Forever Systems buys Cisco security mainly through Cisco's MSP programme and the MSLA; terms are confirmed at quote.
Are Cisco firewall licences per appliance?
Yes. Appliance feature licences are tied to one firewall and its model, and virtual licences are per instance at a chosen performance tier. A high-availability pair or a cluster can change the count, so we confirm quantities at quote.
Still have a question about Cisco Secure Firewall licences?
Ask us and a member of our team will get back to you.
More software and licensing guides
CiscoDuo, Umbrella, Secure Access, ISE, Secure Client, Secure Endpoint and more by part number.Security Cloud ControlCloud firewall management tenant, per-device and logging codes.Multicloud DefenseGateway-hour subscription for AWS, Azure and Google Cloud, with support.Secure ClientAdvantage, Premier and VPN Only licence codes, formerly AnyConnect.