Tech 21 Century » Cisco ASA Hardware

Upgrading Memory of Cisco ASA Firewall

BlogAdmin — Tue, 01 Mar 2011 08:36:58 +0000

After the introduction of Cisco ASA software version 8.3 last year, the device’s memory requirements for low-end models have been doubled. Many firewall administrators have been discouraged from this move from Cisco because they had to upgrade their firewalls RAM memory in order to upgrade to the newest versions. Upgrading the memory not only costs money but it imposes an operational hassle as well (network downtime, need to open-up the chassis etc). I get many questions from my readers about memory upgrade guides, so the links below might be helpful for some of you.

The following table shows the new memory requirements for all Cisco ASA 5500 models for software version 8.3 and later:

Cisco ASA Memory Requirements

The following video from Cisco shows you how to upgrade the memory chip on a Cisco ASA 5510 Firewall.

Upgrade Memory on Cisco ASA 5510 – Video

The following post from ccsplab shows some information for upgrading both the RAM and Flash memory on a Cisco ASA 5505 model.

Upgrade RAM and Flash on Cisco ASA 5505

Cisco ASA 5505 User License Explained

BlogAdmin — Mon, 05 Oct 2009 17:23:03 +0000

I get a lot of questions regarding the meaning of user license numbers for the Cisco ASA 5505. This model is offered in three User License options. 10 users, 50 users and UL (unrestricted license). The meaning of user license basically refers to concurrent IP addresses that can communicate between Internal (inside) network and Internet (outside) interface. So, for 10 user license, only 10 concurrent internal hosts (IP addresses) can access the internet. The same applies for 50 users (only 50 concurrent IP addresses can access the Internet). For UL license, there is no such restriction.

The user licensing has also an effect on the maximum number of IP addresses that can be assigned by the DHCP server of the ASA5505 to the internal hosts. For a 10-user license, the max number of DHCP clients on the internal network is 32. For 50-user license, the max number of DHCP clients is 128.

The official explanation from Cisco regarding the Cisco ASA5505 user licensing is as follows:

“In routed mode, hosts on the inside (Business and Home VLANs) count towards the limit only when they communicate with the outside (Internet VLAN). Internet hosts are not counted towards the limit. Hosts that initiate traffic between Business and Home are also not counted towards the limit. The interface associated with the default route is considered to be the Internet interface. If there is no default route, hosts on all interfaces are counted toward the limit. In transparent mode, the interface with the lowest number of hosts is counted towards the host limit. See the show local-host command to view host limits. “

The terms “Business” and “Home” VLANs above refer to the Internal and DMZ network zones.

Cisco ASA 5580

BlogAdmin — Sun, 24 May 2009 16:58:22 +0000

Cisco ASA 5580 Features

The 5580 is the Flag-Ship Cisco ASA model. It comes as two versions, the ASA 5580-20 and the ASA 5580-40, which differ in the performance parameters. The ASA 5580 is basically an HP Server Chassis with 6 slots on the back for inserting interface card modules. The 5580 is designed for the largest and most traffic demanding network topologies. It is ideal for high-speed data centers and large campus networks. It supports the largest firewall throughput in the hardware firewall market, with 5 Gbps (5580-20) and 10 Gbps (5580-40) capacity. It is also the only model supporting 10Gbps interfaces. Like the 5550, it does not support an embedded Security Services Module (SSM), so you cannot integrate an IDS/IPS functionality inside the same chassis.
Let’s see the features of the ASA 5580 in more detail below:

Maximum firewall connections:1,000,000 (5580-20), 2,000,000 (5580-40)
Maximum firewall throughput (Gbps): 5 Gbps (5580-20), 10 Gbps (5580-40)
Max Packets per second (64 byte): 2,500,000 (5580-20), 4,000,000 (5580-40)
Maximum firewall connections/second: 90,000 (5580-20), 150,000 (5580-40)
Maximum 3DES/AES VPN throughput: 1 Gbps
Maximum site-to-site and remote access VPN sessions: 10,000
Maximum SSL VPN user sessions: 10,000
Memory: 8 GB (5580-20), 12 GB (5580-40)
System Flash: 1 GB
Integrated ports: 2-10/100/1000 + 4-10/100/1000 (with ASA5580-4GE-CU) + 4 GE SR LC (with ASA5580-4GE-FI), +2 10GE SR LC (with ASA5580-2X10GE-SR)
Maximum VLANs: 250
SSM Expansion Slots: Not Available
Intrusion Prevention: Not Supported (need external box)
Content Security (anti-virus, anti-spyware, file blocking): Not Supported
IC Expansion Slots 6 Interface Cards Supported
Latest Software version:8.2 (as of April 2009)
Application-layer firewall services: Supported
Layer 2 transparent firewall: Supported
Security contexts: 2 (Included), 20 (Maximum, with license)
GTP/GPRS inspection: Supported (needs license)
High availability support: Active/Active, Active/Standby
SSL and IPsec VPN services: Supported

Cisco ASA 5550

BlogAdmin — Sat, 16 May 2009 17:25:02 +0000

Cisco ASA 5550 Features

Now let us see the next ASA model in the series which is the Cisco ASA 5550. With over one gigabit firewall performance (1.2 Gbps) this appliance can be easily used on ISP public services segments or on medium data rate campuses and data centers. From this model and up, there is no support for Security Services Module (SSM), so basically you can not include an IDS/IPS or Content Inspection functionality integrated inside the box. However, with this model you get the advantage of having eight gigabit integrated copper ports (8-10/100/100) PLUS four optical gigabit ports (4 SFPs), which means you will not run out of network port capacity easily.

Let’s see the features of the ASA 5550 in more detail below:

Maximum firewall connections:650,000
Maximum firewall throughput (Gbps): 1.2 Gbps
Max Packets per second (64 byte): 600,000
Maximum firewall connections/second: 36,000
Maximum 3DES/AES VPN throughput: 425 Mbps
Maximum site-to-site and remote access VPN sessions: 5000
Maximum SSL VPN user sessions: 5000
Memory: 4 GB
System Flash: 64MB
Integrated ports: 8-10/100/1000 + 1-10/100 + 4-SFP Gigabit
Maximum VLANs: 250
SSM Expansion Slots: Not Available
Intrusion Prevention: Not Supported (need external box)
Content Security (anti-virus, anti-spyware, file blocking): Not Supported
Latest Software version:8.2 (as of April 2009)
Application-layer firewall services: Supported
Layer 2 transparent firewall: Supported
Security contexts: 2 (Included), 20 (Maximum, with license)
GTP/GPRS inspection: Supported (needs license)
High availability support: Active/Active, Active/Standby
SSL and IPsec VPN services: Supported

Cisco ASA 5540

BlogAdmin — Tue, 05 May 2009 09:31:29 +0000

Cisco ASA 5540 Features

Next in the line is the Cisco ASA 5540 Firewall appliance. This device is geared towards large enterprises which need firewall throughput of 650Mbps. The ASA 5540 is the highest model that supports a Security Services Module (SSM) in order to offer Content Inspection or Intrusion Prevention IPS services to the network. The SSM module can host also a four-port Gigabit Ethernet card, in addition to the Content Inspection or IPS modules. The higher-end models 5550 and 5580 DO NOT support the SSM module. Note also the greatly enhanced number of supported VPN sessions (5000 or 2500 for SSL VPN) compared with smaller models. This enhancement makes the 5540 ideal for replacing the older VPN 3000 Concentrator device.

Let’s see the features of the ASA 5540 in more detail below:

Maximum firewall connections:400,000
Maximum firewall throughput (Mbps): 650 Mbps
Max Packets per second (64 byte): 500,000
Maximum firewall connections/second: 25,000
Maximum 3DES/AES VPN throughput: 325 Mbps
Maximum site-to-site and remote access VPN sessions: 5000
Maximum SSL VPN user sessions: 2500
Memory: 1 GB
System Flash: 64MB
Integrated ports: 4-10/100/1000 + 1-10/100
Maximum VLANs: 200
SSM Expansion Slots: 1 SSM module
Intrusion Prevention: Supported (with AIP SSM)
Content Security (anti-virus, anti-spyware, file blocking): Supported (with CSC SSM)
Latest Software version:8.2 (as of April 2009)
Application-layer firewall services: Supported
Layer 2 transparent firewall: Supported
Security contexts: 2 (Included), 20 (Maximum, with license)
GTP/GPRS inspection: Supported (needs license)
High availability support: Active/Active, Active/Standby
SSL and IPsec VPN services: Supported

Cisco ASA 5520

BlogAdmin — Thu, 30 Apr 2009 08:46:44 +0000

Cisco ASA 5520 Features

Continuing our series of posts about the hardware and software features of ASA firewalls, this article focuses on the Cisco ASA 5520 model. This model is suitable as Internet Edge device for medium size enterprises but can be used also for internal LAN segmentation. From this model and up there are no Base License or Security Plus License options, like the 5505 and 5510 models. Also, the four integrated Network Interfaces by default support gigabit 10/100/1000 speed. There is an additional Management Interface which supports Fast Ethernet speed (10/100 Mbps). This Interface can be used as normal firewall interface by issuing the “no management-only” interface configuration command. So there are essentially five network interfaces integrated on the appliance.

In more detail, the Cisco ASA 5520 firewall features are the following:

Maximum firewall connections:280,000
Maximum firewall throughput (Mbps): 450 Mbps
Max Packets per second (64 byte): 320,000
Maximum firewall connections/second: 12,000
Maximum 3DES/AES VPN throughput: 225 Mbps
Maximum site-to-site and remote access VPN sessions: 750
Maximum SSL VPN user sessions: 750
Memory: 512 MB
System Flash: 64MB
Integrated ports: 4-10/100/1000 + 1-10/100
Maximum VLANs: 150
SSM Expansion Slots: 1 SSM module
Intrusion Prevention: Supported (with AIP SSM)
Content Security (anti-virus, anti-spyware, file blocking): Supported (with CSC SSM)
Latest Software version:8.2 (as of April 2009)
Application-layer firewall services: Supported
Layer 2 transparent firewall: Supported
Security contexts: 2 (Included), 20 (Maximum, with license)
GTP/GPRS inspection: Supported (needs license)
High availability support: Active/Active, Active/Standby
SSL and IPsec VPN services: Supported

Cisco ASA 5510

BlogAdmin — Fri, 24 Apr 2009 17:24:32 +0000

Cisco ASA 5510 Features

Continuing our series of posts about the hardware and software features of ASA firewalls, this article focuses on the Cisco ASA 5510 model which is a very popular appliance for small to medium enterprises. Unlike the ASA 5505, this is a rack-mountable model (1U size) which supports also an add-on module (SSM – Security Services Module). Similarly with the 5505, the ASA 5510 comes also with two types of software licenses: Base License and Security Plus License, with the later offering advanced hardware and performance features.

In more detail, the Cisco ASA 5510 firewall features are the following:

Maximum firewall connections: 50,000 (Base License), 130,000 (Security Plus License)
Maximum firewall throughput (Mbps): 300 Mbps
Max Packets per second (64 byte): 190,000
Maximum firewall connections/second: 9,000
Maximum 3DES/AES VPN throughput: 170 Mbps
Maximum site-to-site and remote access VPN sessions: 250
Maximum SSL VPN user sessions: 250
Memory: 256 MB
System Flash: 64MB
Integrated ports: 5- 10/100 (Base License), 2-10/100/1000 + 3-10/100 (Security Plus)
Maximum VLANs: 50 (Base License), 100 (Security Plus License)
SSM Expansion Slots: 1 SSM module
Intrusion Prevention: Supported (with AIP SSM)
Content Security (anti-virus, anti-spyware, file blocking): Supported (with CSC SSM)
Latest Software version: 8.2 (as of April 2009)
Application-layer firewall services: Supported
Layer 2 transparent firewall: Supported
Security contexts: 0 (Base License), up to 5 (Security Plus License)
GTP/GPRS inspection: Not Available
High availability support: Not Available (Base License), Active/Standby and Active/Active (Security Plus)
SSL and IPsec VPN services: Supported

Cisco ASA 5505

BlogAdmin — Sun, 19 Apr 2009 20:27:57 +0000

Cisco ASA 5505 Features

In this post I’ll describe the software and hardware features of the Cisco ASA 5505 model. The ASA 5505 is the smallest model in the 5500 series and is suitable for small businesses or small branch offices and teleworkers. As it is a smaller size compared with the other models, it is not rack-mountable. It is the only model also that comes with an 8-port switch (with 2 power over Ethernet ports). The Cisco ASA 5505 ports are Layer 2 ports and not normal Layer 3 ports like the other models. To configure its Layer 2 ports you need to create VLANs and assign each port to a certain VLAN number. All interface parameters are configured under the “Interface VLAN [number]” command.

The Cisco ASA 5505 features depend on which software license is installed. There are two license options available: Base License and Security Plus License. The Security Plus license enables the Cisco ASA 5505 Appliance to support higher connection capacity and a higher number of IPsec VPN users, add full DMZ support, and integrate into switched network environments through VLAN trunking support. Moreover, the upgrade security plus license enables redundant ISP connections and stateless Active/Standby high-availability services.

In more detail, the Cisco ASA 5505 features are the following:

Maximum firewall connections: 10,000 (Base License), 25,000 (Security Plus License)
Maximum firewall throughput (Mbps): 150 Mbps
Max Packets per second (64 byte): 85,000
Maximum firewall connections/second: 4,000
Maximum 3DES/AES VPN throughput: 100 Mbps
Maximum site-to-site and remote access VPN sessions: 10 (Base License), 25 (Security Plus)
Maximum SSL VPN user sessions: 25
Memory: 256 MB
System Flash: 64MB
Integrated ports: 8 port 10/100 switch with 2 power over Ethernet
Maximum VLANs: 3 (Base License), 20 (Security Plus License)
Expansion Modules: 1-SSC (Security Services Card)
Intrusion Prevention: Yes (with AIP SSC)
Content Security (anti-virus, anti-spyware, file blocking): Not Available
Latest Software version: 8.2 (as of April 2009)
Application-layer firewall services: Supported
Layer 2 transparent firewall: Supported
Security contexts: Not Available
GTP/GPRS inspection: Not Available
High availability support: Not Available (Base License), Stateless Active/Standby (Security Plus)
SSL and IPsec VPN services: Supported

Cisco ASA Redundant Interface Configuration

BlogAdmin — Tue, 10 Mar 2009 14:34:33 +0000

In addition to device-level failover, you can also configure interface redundancy on the same chassis of a Cisco ASA firewall. Basically you create a logical interface pair bundle (called “interface redundant“) in which you include two physical interfaces. If one of the interfaces fail, the second one in the redundancy pair takes over and starts passing traffic. You can configure up to 8 redundant interface pairs. After you configure the redundant interface pair, all security appliance configuration refers to this logical redundant pair instead of the member physical interfaces.

The following guidelines should be followed for redundant interface and its members:

You must first remove the name of the physical interface (using the no nameif command) before adding it to the logical redundant interface.
Both member interfaces must be of the same physical type. That is they must be both GigabitEthernet or both Ethernet.
The only configuration available to physical interfaces that are part of a redundant interface pair are physical parameters (i.e the shutdown command and the description command).

Configuration Example:

ASA(config)# interface redundant 1
ASA(config-if)# member-interface gigabitethernet 0/0
ASA(config-if)# member-interface gigabitethernet 0/1

From now on, all interface related commands must refer to “interface redundant 1“.

Cisco Firewall Service Module – FWSM

BlogAdmin — Mon, 23 Feb 2009 09:13:03 +0000

The Cisco Firewall Service Module (FWSM) is a module card installed on 6500 switches or 7600 routers and is based on the Cisco PIX/ASA security software. It integrates security services in the popular 6500/7600 network devices, providing one of the fastest firewall data rates in the industry. With 5 Gbps firewall throughput per module, and four modules per chassis, you can scale your firewall performance to a maximum 20 Gbps throughput in a single chassis. This is an excellent choice for service providers or for large data center environments, since you can integrate firewall security inside your network infrastructure without loosing performance.

As it is installed as a module inside the 6500/7600 platforms, it basically works on the backplane of the switch/router allowing any port of the network device to operate as a firewall port. VLANs of the switch can be assigned as “interface legs” of the FWSM, thus forcing traffic between VLANs to pass through the firewall which applies statefull inspection and control in the traffic flow. Having also an integrated firewall box inside your network infrastructure makes administration easier and lowers your total cost of ownership.