topic Hi Marvin, in Network Security

What is "Maximum Concurrent Sessions" in Cisco ASA 5585-X SSP-10 w/ FirePOWER Services?

Arie -- — Tue, 12 Mar 2019 08:11:59 GMT

Hi,

I'm new with Cisco ASA and FirePower. From the datasheet provided by Cisco.com, there is said that maximum concurrent sessions in Cisco ASA 5585-X SSP-10 w/ FirePOWER Services is 500,000. What does the maximum concurrent sessions mean? And how to do check the concurrent sessions in Cisco ASA?

Thank you

Arie

Actually it's 1,000,000

Marvin Rhoads — Mon, 29 Aug 2016 03:40:51 GMT

Actually it's 1,000,000 concurrent connections

http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/datasheet-c78-730903.html

As a stateful firewall, the ASA series keeps track of open TCP connections (and UDP flows). that way it can allow return traffic associated with those connections back in through the firewall.

The command "show connections" will show you all of those, with the first line being the total current count and the highest count observed (since last boot):

asa-5512# sh conn | i use
279 in use, 2265 most used

Hi,

Arie -- — Mon, 29 Aug 2016 05:14:05 GMT

Hi,

What is term of 'stateful firewall'?

The 1,000,000 concurrent connections is for ASA firewall, isn't it?

For Firepower Module, why does the concurrent connections only 500,000 for Cisco ASA 5585-X
SSP-10 w/ FirePOWER Services?

http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/datasheet-c78-733916.html

Thank you

Arie

Ari,

Marvin Rhoads — Mon, 29 Aug 2016 13:04:56 GMT

Ari,

Wikipedia has a good definition and explanation of stateful firewall:

https://en.wikipedia.org/wiki/Stateful_firewall

You're right - the FirePOWER module (F10 version) in the ASA 5585X does limit you to 500,000 concurrent connections.

We are increasingly steering customer to the more scalable (and less expensive) FirePOWER 4100 series for high end requirements. The "entry level" FirePOWER 4110 supports 4.5 million concurrent sessions at about half the price of an ASA 5585-X.

Hi Marvin,

Arie -- — Tue, 30 Aug 2016 01:50:54 GMT

Hi Marvin,

So, with the FirePower module in the ASA 5585X does limit to 500,000 concurrent connections, then we can't reach the maximum of 1,000,000 concurrent connections in the Cisco ASA?

Does the maximum concurrent connections in FirePower module and in the Cisco ASA treated differently or same?

Thank you

Arie

They are different.

Marvin Rhoads — Tue, 30 Aug 2016 02:40:53 GMT

They are different.

Whether or not they are effectively the same depends on whether your service-policy sends all ASA traffic through the FirePOWER module.

You may choose to only inspect a subset of your traffic with the FirePOWER module. In that case, you can still reach a higher concurrent connection limit with the base ASA.

You could also have multiple contexts on an ASA 5585 - some using the FirePOWER module and others not.

Hi Marvin,

Arie -- — Tue, 30 Aug 2016 11:12:21 GMT

Hi Marvin,

Thank you for your answer. Appreciate it.

Arie