Cisco SNA License

Reviewed by GoLicense Technical Team ·
Last updated: October 2026

Cisco Secure Network Analytics (SNA), formerly Cisco Stealthwatch Enterprise, turns NetFlow and other network telemetry into behavioral threat detection. Its Encrypted Traffic Analytics (ETA) capabilities help identify threats in encrypted traffic without decrypting the sessions. Cisco Secure Network Analytics licensing is primarily based on flow rate: the flows per second (FPS) sent to the Flow Collectors, measured using a daily 95th-percentile calculation.

Start with the selection guide below to identify your Manager, Flow Collectors, required flow-rate capacity, and optional components. If you already have a deployment or bill of materials, include its details in your quote request so existing entitlements can be considered.

• Core components: Manager and Flow Collector, available as hardware appliances or virtual editions.
• Main license: Flow Rate, supplied in 100-FPS packs to build the required capacity.
• Additional components: Threat Feed, Flow Sensor, UDP Director, Data Store, and Telemetry Broker where applicable.
• Subscription terms: 1, 3, or 5 years for on-premises deployments.
• Delivery: To your own Cisco Smart Account, with SSM On-Prem available for supported local licensing workflows.
• Quotation basis: Required FPS, hardware or virtual components, collector quantities, retention, subscription term, and support.
• Typical order value: Approximately US$… to US$200,000, depending on licensed flow rate (FPS), appliances or virtual components, and term

Request Cisco Secure Network Analytics Pricing: Send your expected flow rate, the number and type of devices exporting telemetry, your hardware or virtual preference, and the required subscription term. If you do not know your FPS, share your network details so the initial sizing requirements can be assessed.

Which Cisco Secure Network Analytics License Do You Need?

Every deployment needs a Manager, at least one Flow Collector, and sufficient licensed flow-rate capacity. Additional components depend on the telemetry sources, detection requirements, retention needs, and deployment design.

Encrypted Traffic Analytics depends on telemetry from supported Cisco switches and routers. Confirm that the exporting devices, software versions, and their own licenses support the required ETA capabilities before ordering.

How Cisco Secure Network Analytics Licensing Works

The Flow Rate license is the core entitlement. Each day, the Manager evaluates per-minute FPS across the exporters for the preceding 24 hours, discards the highest 5% of samples, and reports the resulting 95th-percentile value.

Flow Rate and License Consumption

NetFlow and IPFIX from switches, routers, and Flow Sensors count toward flow rate, alongside applicable NVM and Zeek telemetry. Firewall logs converted to flows do not count against the FPS entitlement and have separate licensing considerations.

If usage exceeds the licensed capacity, the account reports Out of Compliance and the Manager displays a warning, while flow processing continues. Review unnecessary telemetry, applicable Ignore List settings, and additional capacity requirements before expanding the deployment.

Virtual Editions and Evaluation

Manager and Flow Collector Virtual Edition entitlements are provisioned automatically when the Manager registers. Flow Sensor Virtual Edition and UDP Director require their own licensing.

The evaluation period provides 90 days of Manager use, counted while the Manager is running. If the evaluation ends without registration, flow collection stops.

Main Cisco Secure Network Analytics SKUs

Use these part numbers as a starting point for your bill of materials. Confirm the applicable software release, deployment platform, flow-rate capacity, and optional components before placing an order.

Review the available SKUs and pricing on our Cisco Secure Network Analytics part numbers page.

Example: Licensing a 15,000-FPS Virtual Deployment

Scenario: A campus and data center generate approximately 15,000 FPS at the daily 95th percentile. The organization expects 20% growth, prefers VMware deployment, and requires a three-year subscription.

A typical starting bill of materials would include:

• 1 × Manager Virtual Edition (L-ST-SMC-VE-K9), accounting for the automatically provisioned entitlement.
• 1 × Flow Collector Virtual Edition (L-ST-FC-VE-K9), sized to support at least 18,000 FPS.
• 180 × Flow Rate 100-FPS packs (ST-FR-100-LIC) for 36 months, providing 18,000 FPS of licensed capacity.
• 1 × Threat Feed license matched to the Flow Collector.
• Optional: 1 × Flow Sensor Virtual Edition (L-ST-FS-VE-K9) for a segment without NetFlow export.

A second Flow Collector without a Data Store requires its own licensing. Final quantities depend on the measured FPS baseline, redundancy design, retention requirements, and existing entitlements.

Prepare These Details for SKU Selection

Provide your Secure Network Analytics version, measured or estimated FPS, telemetry sources, hardware or virtual preference, collector quantities, redundancy plans, and preferred subscription term.

Include retention requirements and the current license inventory for renewals or expansions. Also identify the Cisco Smart Account and Virtual Account where licenses should be deposited, or explain whether you use SSM On-Prem.

Cisco Secure Network Analytics Pricing & Quote

Cisco Secure Network Analytics pricing depends primarily on licensed flow rate, the deployment platform, and the number of collectors and optional components. Calculate the required 100-FPS packs using the daily 95th-percentile baseline, with additional capacity for expected growth.

Hardware appliances, Threat Feed licenses for each collector, Flow Sensors, Data Store, UDP Director, and Telemetry Broker can affect the total. Subscription length, redundant collectors, and support contracts should also be included in the quotation.

Your quotation should state the confirmed SKUs, quantities, subscription term, price, validity period, and delivery terms. When comparing offers, check whether flow-rate growth, Threat Feed coverage, appliance support, taxes, and deployment services are included.

Buying, Delivery and Activation with GoLicense

GoLicense delivers Cisco Secure Network Analytics licenses to your own Cisco Smart Account, so the licenses are registered to your organization and visible in Cisco Smart Software Manager.

For networks without direct internet access, supported licensing workflows can use Smart Software Manager (SSM) On-Prem, formerly known as SSM Satellite.

1. Confirm the Licensing Scope

   Share your Secure Network Analytics version, planned hardware or virtual appliances, FPS baseline, and growth requirements. Confirm coverage, price, delivery timeframe, and activation assistance in your quotation.

2. Share Your Smart Account Details

   Send your Smart Account domain and the Virtual Account where the licenses should be deposited. If you use SSM On-Prem, confirm the Smart Account it synchronizes with.

3. Licenses Are Deposited in Your Account

   After the order is processed, the licenses appear in your Virtual Account. Threat Feed licenses may require a provisioning request before becoming active. Verify the delivered license types, quantities, and subscription term against the approved order.

4. Register the Manager and Verify

   In the Manager, go to Configure > Global > Central Management > Smart Licensing. Set the applicable transport, such as direct connectivity, HTTP proxy, or Transport Gateway for SSM On-Prem. Click Register and enter a registration token from your Virtual Account.

   Manager and Flow Collector Virtual Edition entitlements are added automatically. Check Smart License Usage the following day and confirm that the reported 95th-percentile FPS is within your licensed capacity.

   If additional licenses are added later, use Actions > Renew Authorization Now and verify the updated licensing status.

Offline Options: SSM On-Prem, SLR and PLR

For networks without direct internet access, SSM On-Prem provides a local licensing server. The Manager reports usage to that server, which synchronizes with Cisco periodically.

Fully offline licensing using manual check-in and check-out requires coordination with Cisco Support. Cisco supports it but does not recommend it.

Where Cisco has approved a permanent or specific reservation for your account, see our Cisco Stealthwatch PLR license page and the Stealthwatch Smart Licensing guide.

Before You Order: Prerequisites and Common Mistakes

Pre-Order Checklist

• Confirm the installed or planned Secure Network Analytics version.
• Measure or estimate daily 95th-percentile FPS, ideally through a proof of value.
• List the switches, routers, firewalls, and other sources exporting telemetry.
• Decide on hardware or virtual Manager and Flow Collectors, including redundancy requirements.
• Calculate storage and retention requirements for the selected architecture.
• Confirm access to your Cisco Smart Account and Virtual Account, or to your SSM On-Prem server.
• Review existing entitlements, including any older Endpoint licenses.
• Confirm the supported licensing workflow for your release and connectivity restrictions.

Common Buying and Activation Issues

Sizing FPS from averages: Licensing uses the daily 95th percentile rather than the average. Establish a representative baseline and allow capacity for growth.

Forgetting Threat Feed per collector: Each Flow Collector requires its own Threat Feed license matched to its model.

Assuming redundant collectors are free: A second Flow Collector without a Data Store requires its own licensing. Include redundancy in the initial design and quotation.

Buying Endpoint licenses for NVM on version 7.5.1 or later: From version 7.5.1, NVM telemetry counts toward licensed flow rate instead.

Letting the evaluation lapse: After 90 days of Manager use without registration, flow collection stops. Plan registration before the evaluation expires.

Counting converted firewall logs as FPS: Firewall logs converted to flows do not count against the Flow Rate license. Assess their separate Security Analytics and Logging requirements.

Related Cisco Licensing Resources

• What is Cisco Encrypted Traffic Analytics?
• Cisco Stealthwatch Smart Licensing overview
• Cisco Secure Network Analytics part numbers
• Cisco ISE licenses
• Cisco Secure Firewall Management Center licenses
• Cisco Talos threat intelligence