Cisco ASA 5500-X Series Firewalls

Cisco ASA or Cisco Adaptive Security Appliances provide deep network visibility and superior threat and advanced malware protection, and greater automation to reduce cost and complexity. Cisco ASA with Firepower services is the industry’s first threat-focused NGFW. They combine Cisco’s proven ASA firewall together with Sourcefire’s industry leading NGIPS and advanced malware protection in a single device. By integrating these defense layers, it can deliver robust visibility for threat protection for both known and unknown threats. It also enables dynamic controls to respond the real-time changing IT landscape and threat environment.  

The Cisco ASA with FPR services with visibility driven and threat focused platform-based approach can prevent advanced zero-day attacks that modern organization are being faced. These powerful products deliver solutions in each of the areas for before, during and after the attack and combines those on a common platform of visibility and security automaton that drives what is more rapid detection and greater visibility and ability to remediate faster. Cisco ASA with Cisco Firepower services combines best-in-class security intelligence, application visibility and control (AVC), and URL filtering.  

Cisco offers the industry’s first threat-focused next-generation firewall: Cisco ASA with Firepower Services available on the Cisco ASA 5500-X Series and ASA 5585-X Adaptive Security Appliances.

Cisco Security Licenses

Cisco ASA Benefits and Features of Cisco A

Cisco ASA with Firepower module consists of the following features:  

• Site-to-site and remote access VPN and advanced clustering
• supports more than 3,000 application-layer and risk-based controls by Granular Application Visibility and Control (AVC)
• Next-generation IPS (NGIPS)
• Reputation- and category-based URL filtering
• AMP provides industry-leading breach detection effectiveness
• Support Cisco Smart License included ASA-X PLR license
• Integration with other essential network security technologies
• Enhanced user ID awareness from Cisco TrustSec security group tags, and Identity-Based Firewall
• Up to 640 Gbps of throughput by clustering up to 16 ASA 5585-X appliances
• High availability for high-resiliency applications

Cisco ASA Multi-Context 

ASA Multi-Context virtualizes single hardware and transforms it into multiple individual firewalls which can help the enterprises to segment their networks efficiently and manage effectively. Similarly, service providers leverage this to provide firewall services to various customers in a cost-effective manner. 

Contexts allow you to use a single physical ASA, while running several virtual ASA’s on top. As long as there are enough physical resources, this works well. Along with Cisco ASA 5500 series models, ASA 5506 and ASAv does not support this robust feature. Contexts are not available on this platform.

Also, on ASA 5512, you can have contexts, but you will need the security plus license. If you have a 5515 or larger, there is two contexts available out of the box, but any more will require extra licenses. Please be aware that there are also some feature limitations. For example, a lot of inspections and VPN topologies are not available. Check out the Cisco site for a supported feature list.  

Cisco ASA-X with FTD 

If your ASA is currently running Firepower Services as a separate module and you want to deploy Firepower Threat Defense (FTD), you must reimage your ASA with the unified FTD image. To reimage ASA hardware with FTD, you need to use more than one type of image on the same hardware. The images listed below will be required and can be downloaded from the Cisco website.

• FTD Boot Image (ftd-boot-X.X.X.X.cdisk) 

• FTD System Image (ftd-X.X.X-X.pkg) 

In order to download the images to the ASA a TFTP, FTP or HTTP server will be required. After, download, you need to upgrade the image within ROMMON mode. 

Note: Cisco FTD on ASA-X series does not support Multi-context nor multi instance features. Moreover, time-based ACLs no longer supported within FTD image.  

Cisco ASA Models and Specifications of 

Cisco ASA-X with Firepower services varies in the following models and specifications:  

ASA 5506-X with Firepower Services desktop device which supports Up to 300 Mbps FW and it is Multiservice capable. Also, it provides 8 x 1 GE ports. 

ASA 5508-X with Firepower Services 1 Rack-Unit device which supports Up to 500 Mbps FW and it is Multiservice capable. Also, it provides 8 x 1 GE ports. 

ASA 5516-X with Firepower Services 1 Rack-Unit device which supports Up to 900 Mbps FW and it is Multiservice capable. Also, it provides 8 x 1 GE ports. 

ASA 5525-X with Firepower Services desktop device which supports Up to 1Gbps FW and it is Multiservice capable. Also, it provides 8 x 1 GE ports. 

ASA 5545-X with Firepower Services desktop device which supports Up to 1.5Gbps FW and it is Multiservice capable. Also, it provides 8 x 1 GE ports. 

ASA 5555-X with Firepower Services desktop device which supports Up to 2Gbps FW and it is Multiservice capable. Also, it provides 8 x 1 GE ports. 

Cisco ASA License 

Cisco ASA license can register the product in hybrid ways. Different product instances could be activated either with traditional or smart licenses. 

We can have only URL filtering capabilities, or we can have only IPS capabilities. If we wanted more than just two of those, we could do that, but in that case the IPS license is required. For example, to have the IPS and AMP (Advanced Malware Protection) enabled, we have to have the TAM license. For all available functionalities, we need the TAMC license package. 

Cisco ASA Smart License 

By introducing Cisco’s modern way for licensing its devices, Cisco ASA-X firewall smart license is available for purchasing and assigning to product. All product instances would be registered after connecting to CSSM through the Internet. Although, for highly secure network architectures which no outside connection is permitted, Cisco ASA PLR license is useful which can activate all instances permanently. 

FAQ