Comments on: Cisco ASA 5505 User License Explained

By: BlogAdmin

BlogAdmin — Wed, 24 Oct 2012 17:42:41 +0000

Jordan,

Since the license limit take into account concurrent IP addresses rather than number of connections, one Exchange server will not max out the connection count. One Exchange server will be considered one host and take up one license no matter how many connections are used.

By: Jordan

Jordan — Tue, 23 Oct 2012 21:17:07 +0000

So theoretically, one Exchange server could max out a connection count if it is hosting outlook web access, correct?

By: BlogAdmin

BlogAdmin — Fri, 31 Aug 2012 19:47:57 +0000

Bill,

I don’t know the exact algorithm used my cisco to determine the maximum host count, but from their description of the host limit it seems that if you execute “show local-host”, the number of active hosts of this command is the host limit. The active hosts are influenced by the “xlate” (nat translation) timeout.

By: Bill

Bill — Fri, 31 Aug 2012 18:53:43 +0000

We’re using the 5505 in a site-to-site VPN. We are hitting the host limit of 10. My question is: What causes the host count to be reduced? In other words, when does an IP address let go of its connection? Is there a timeout of inactivity? If so, is there a configuration option or setting that will free up a session/connection faster?

By: BlogAdmin

BlogAdmin — Wed, 25 Apr 2012 16:07:46 +0000

Yes that will probably work

By: Muhammad

Muhammad — Wed, 25 Apr 2012 11:26:40 +0000

Thank you, and if i do PAT from Router behind the ASA. will ASA entertain it 1 inside host ? or it will do deep inspection and count it more than 10??

actually i have sent 5505 10 user ASA on client end, and i have to nat 100 Inside host to 1 PAT IP. so i think i should do it on Router that is connected behind ASA. will that work?

By: BlogAdmin

BlogAdmin — Fri, 20 Apr 2012 19:24:16 +0000

No, you are still restricted to 10 concurrent sessions

By: Muhammad

Muhammad — Fri, 20 Apr 2012 14:03:30 +0000

Hi, if i dont create Outside interface and no default route.
just inside and client interface.

Then can i open more than 10 concurrent sessions from inside to client side?

By: KK

KK — Thu, 17 Nov 2011 17:10:03 +0000

Thanks. That is pretty much the way I was leaning just based on the total randomness of the problem. It is interesting though that the ASDM graphs for CPU and memory never went very high. I was expecting to see something “pegged”.

By: BlogAdmin

BlogAdmin — Thu, 17 Nov 2011 08:21:34 +0000

KK,

If the websites do not initiate any traffic towards the Internet, then they do not count towards the host limit.

However, in your case it seems that your problem of no-access maybe due to limitations of the performance of the ASA5505. Having 40 websites behind a 5505 is too much. Maybe the theoretical performance specs given by Cisco seem enough but these specs are measured for a device with minimal configuration and requirements. After adding ACLs and other config these specs drop significantly.