Ordering Cisco ASR 1000 Series Router Feature Licenses
In order to turn on services on Cisco ASR 1000 Series Routers, software feature licenses are required, in addition to the appropriate Cisco IOS XE Software. Currently two types of feature licenses are available: right-to-use (RTU) licenses and number-of-session licenses. Certain services require only RTU license, whereas other services require both RTU license and number-of-session licenses. In the future Cisco will introduce additional feature licenses for other value-added services (for example, intrusion prevention, etc.)

Firewall service: The Cisco ASR 1000 Series Router Firewall application requires a RTU license (FLASR1-FW-RTU(=)), which allows you to enable Layer 4-through-Layer 7 firewalling. To enable per subscriber/user firewall in broadband and enterprise deployments, the firewall RTU license, as well as the number-of-session licenses listed in the "Broadband service" section, is required. Please refer to the "Per subscriber/user firewall service" section.