SSL licenses break into two general types: Essentials and Premium. SSL VPN debuted on the ASA when it was first released but has evolved more than any other licensed based feature on the ASA. By default the 5505 ships with a 10 user license but can be upgraded to 50 or unlimited users. A user is considered an internal device which communicates with the external VLAN. The 5505 is the only ASA which has a restriction on the number of “users” behind a firewall. Update: As Stojan pointed out in the comments, the 5585X series does have Security Plus licenses which enables the 10GB SFP+ slots.

They come with the Base license and need nothing more to get the most performance out of the unit. The 5520 and up do not have Security Plus licensing.

Enables VPN clustering and load balancing.

Enables optional active/active and active/standby failover.

Enables security contexts and allows for 2.

Increases the number of VLANs from 50 to 100.

Moves 2 of the 5 FastEthernet ports to 10/100/1000.

Upgrades the maximum connections from 50,000 to 130,000.

On the 5510 it has slightly different set of features it enables:

Enables optional stateless active/standby failover.

Increases the number of VLANs from 3 to 20 and enables trunking.

Upgrades the maximum connections from 10,000 to 25,000.

Upgrades the maximum VPN sessions from 10 to 25.

On the 5505 it has the following effects: Security Plus licensing exists only on 55. Make sure you work with your reseller if you are looking to deploy these features. This document will help you make sense of ASA licensing, but is not intended to be used as a design guide. The matters are further complicated since different appliances and versions change the rules. Cisco ASA firewall licensing used to be pretty simple, but as features were rolled out as licenses, the scheme became quite complex.

Cisco asa 5505 security plus license