topic There are many UTMs with a in Network Security

ASA 5506-X - Switchports?

danplacek — Tue, 12 Mar 2019 05:40:12 GMT

Just got my hands on a new ASA 5506-X and immediately ran into an odd issue:

There are eight layer 3 ports that seemingly cannot be used as switch ports.

There is no bridge-group capability available either. (which, if present, could be used to resolve this issue)

Why does this device even have 8 ports if they cannot be used as switchports?

Is this going to be fixed in future software? (By adding bridge groups?)

Can anyone think of any other "clever" workarounds?

Between this issue and the lack of POE, this device seems to be significantly less useful than the ASA5505.

Thank you.

Based on my experience with

JohnUrbanek — Thu, 19 Mar 2015 23:13:56 GMT

Based on my experience with the ASA5506-X (which was just released, I understand) Cisco spent more resources ensuring the Ferrari designer responsible for the physical shell was able to get Ferrari red included somewhere on the shell instead of focusing on the real-life deployment scenarios for a lot of ASA5505's.

I have 500+ deployments of the 5505 little green goblin and the built-in switchports (even at 100Mb/s) and two PoE ports provided an amazing all-in-one device when paired with an access point (powered by the PoE).

I understand that the 5506-X is available with integrated access point -- but the removal of the switchports -- or at least the ability to create bridge-groups out of routed ports is inexcusable on the successor to the 5505.

I don't know at what level of product development this failed, but it is a failure. At the very least now the ASA OS could add bridge-group support to routed mode (it exists only in transparent mode to facilitate the mode itself).

-John

I couldn't agree more. I

wsmith8 — Wed, 08 Apr 2015 17:30:57 GMT

I couldn't agree more. I don't understand how Cisco can say this is the successor to the 5505 when it can't perform the same basic functions. We use 5505's in our small sub-branche offices and plug each device into the FW. Now I need to buy and additional switch as well? Having 8 ports and not provide switching or bridge-groups is totally ridiculous. What could I possibly need with 8 layer 3 ports on such a small device? I hope they address this very soon.

Same here. We waited for a

HendrikD. — Wed, 29 Apr 2015 13:50:42 GMT

Same here. We waited for a year with a project to replace the old 5505 with a new model and now this! We are just extremely lucky that we only bought one for initial testing and not the whole 3xx+

The lack of Switchports really wipes out any arguments we had for a Cisco ASA VPN Solution…

Really hope they will announce a model with Switchports soon, otherwise it looks bad for our central Cisco Firewall replacement too.

-

Barboosh — Sun, 02 Aug 2020 05:11:56 GMT

yes - and when they build

tiwang — Tue, 05 May 2015 08:18:08 GMT

yes - and when they build that beast why didn't they also give us the possibility to use these 8 1GB ports as a switch - not all customers wan't more "stuff" laying around and f.ex for Windows networking it is needed with a switch to permit the discovery of services

The 5506 is positioned as a replacement for the 5505 and I really don't want to place a switch in front of it if I can awoid it...

I don't need clustering for a homeoffice - small branch office - nor routemaps or zone based firewalling - but I need a switch

br /ti

Cannot agree more.Just to

Mariusz00001 — Tue, 05 May 2015 18:21:04 GMT

Cannot agree more.

Just to remind you it is 2015 so what's so special about 4GB of RAM... come on... Cisco could do things like this 20 years ago and tell people: OH YES!!!! GIGABIT PORTS in ALL ASAs!!! YEah!!!! It is a BEAST now... come on!

I do not get it how you could 'forget' about a switch and PoE...

-

Barboosh — Sun, 02 Aug 2020 05:29:26 GMT

There are many UTMs with a

Mariusz00001 — Tue, 05 May 2015 20:45:03 GMT

There are many UTMs with a HDD and 2-8GB of RAM that can run IPS, AV and so on.

What we are trying to say is that Cisco added all these awesome features, AMP, mSata, wireless... and 'forgot' about basic features like a switch and PoE?

It is like giving you ESP, ABS, 8xASR, Park Assistant in a new car but no radio 😉

Most companies will NOT go for IPS and additional features on this box. It is nice to have an option but we just needed a nice UPGRADE of a really old 5505. I expected gigabit ports and PBR - two really important new features for SOHO.

They are there but where is my switch and PoE? 🙂

-

Barboosh — Sun, 02 Aug 2020 05:28:17 GMT

The key issue here is that

danplacek — Tue, 05 May 2015 20:59:36 GMT

The key issue here is that the ASA5506 is being positioned as the replacement for the ASA5505 by Cisco. While the 5506 is certainly an impressive piece of hardware -- it lacks features that the 5505 has -- features that make it unusable in *many* of the places that 5505's have been deployed.

I have seen many 5505 deployments that make use of the both the switchports and the POE. It is very common to see an ASA5505 with a standalone access point or two at someones home or a small branch office.

Just to emphasize - the lack of these features would not be an issue if this wasn't for the fact that this is the intended replacement for the ASA5505 - it simply doesn't fit the same role that the 5505 does.

- Dan

Akram, If you have a way

danplacek — Tue, 05 May 2015 21:04:59 GMT

Akram,

If you have a way around the lack of switch ports -- short of buying an entire separate switch -- we would love to hear about it.

In regards to the POE - as I said in my post above, it is VERY common for a standalone Access Point or two to be deployed alongside an ASA5505. While the ASA5506 version that has an integrated AP partially addresses this concern it has some limitations - namely that you cannot locate the access point at a different location than the firewall. In addition to that of course you only get a single AP - not two.

You noted above that for home use people should "go to best buy" -- this ignores the fact that many enterprises put their own hardware in employee or executive homes to support work-from-home. This can often include wireless or an IP phone.

- Dan

This is what makes NO sense

Mariusz00001 — Tue, 05 May 2015 21:08:04 GMT

This is what makes NO sense to me... An AP indicates a SOHO device... and no switch?

Most companies love an easy upgrade. I know 2-3 places with around 50-200 ASA5505s with the following set-up:

ASA5505---Cisco Aironet1141

1-2 PC, 1 printer, 2-3 laptops

Now... pls tell me... HOW can I easily upgrade my network using 5506?

ASA with a built-in AP is great but you realize most ASAs are in a basement next to a VDSL line, right?

Couldn't agree more. I wonder

mikaelbje — Sat, 09 May 2015 08:52:54 GMT

Couldn't agree more. I wonder what a small location/SOHO office needs eight different FW zones for.

It's simply not a successor to the 5505 if it can't provide one of the most popular features of the 5505. Plugging in a switch is doable, but makes little sense. Most sites would have five or six unused 5506 ports just sitting there.

It's almost as if Cisco acknowledges that the 5505 provided too much functionality at that price point by replacing it with the 5506 which lacks the most important feature. The argument about the CPU, RAM etc of the 5506 vs 5505 is not a good one. The 5505 is usually not used to its max FW wise in most sites. It's there to provide internet service, simple FW and potentially also a VPN connection to a central site, for a small number of users.

It's great seeing IPS functionality in the 5506, but the basic features need to be there first. I don't need to put my girlfriend and kid in separate FW zones at home.

This is a very simple

Abid Abdul Latif — Fri, 15 May 2015 15:51:14 GMT

This is a very simple accomplishment that will group all the ports into a logical switch and assign each port to a group.. We will be using a concept of etherchannels or port-channels as Cisco defines them... Here is the example.

NOT GROUPED	GROUPED
interface GigabitEthernet1/1	interface GigabitEthernet1/1
nameif outside	nameif outside
security-level 0	security-level 0
ip address 1.1.1.1 255.255.255.0	ip address 1.1.1.1 255.255.255.0
!	!
interface GigabitEthernet1/2	interface GigabitEthernet1/2
nameif inside	no nameif
security-level 100	no security-level
ip address 192.168.1.1 255.255.255.0	no ip address
!	!
interface GigabitEthernet1/3	interface GigabitEthernet1/3
no nameif	channel-group 1 mode active
no security-level	no nameif
no ip address	no security-level
!	no ip address
interface GigabitEthernet1/4	!
no nameif	interface GigabitEthernet1/4
no security-level	channel-group 1 mode active
no ip address	no nameif
!	no security-level
interface GigabitEthernet1/5	no ip address
no nameif	!
no security-level	interface GigabitEthernet1/5
no ip address	channel-group 1 mode active
!	no nameif
interface GigabitEthernet1/6	no security-level
no nameif	no ip address
no security-level	!
no ip address	interface GigabitEthernet1/6
!	channel-group 1 mode passive
interface GigabitEthernet1/7	no nameif
no nameif	no security-level
no security-level	no ip address
no ip address	!
!	interface GigabitEthernet1/7
interface GigabitEthernet1/8	channel-group 1 mode passive
no nameif	no nameif
no security-level	no security-level
no ip address	no ip address
!	!
interface Management1/1	interface GigabitEthernet1/8
management-only	no nameif
nameif management	no security-level
security-level 100	no ip address
ip address 192.168.15.13 255.255.255.0	!
	interface Management1/1
	management-only
	nameif management
	security-level 0
	ip address 192.168.15.13 255.255.255.0
	!
	interface Port-channel1
	lacp max-bundle 8
	nameif inside
	security-level 100
	ip address 192.168.1.1 255.255.255.0

Hehe, this is not what I'd

mikaelbje — Fri, 15 May 2015 16:56:07 GMT

Hehe, this is not what I'd call correct use of port channels, but nevertheless an interesting workaround. Thanks for sharing. My creativity is apparently limited since I would never think of this 🙂

I wonder if we'll get an official answer from Cisco anytime soon.

hi againReally good idea -

tiwang — Sat, 16 May 2015 18:28:05 GMT

hi again

Really good idea - can just say as Bjerkeland that this didn't came into my mind because - well - using portchannels wasnt what I expected was possibly - but there are also some minor restrictions was probably wont make it useable in real life:

channel-group 1 mode on
INFO: security-level, delay, IP address and cts manual are cleared on GigabitEthernet1/3.
WARNING: GigabitEthernet1/3 is not compatible with GigabitEthernet1/2 and will be suspended (speed of GigabitEthernet1/3 is 100 Mbps, GigabitEthernet1/2 is 1000 Mbps)
ti5506(config-if)# WARNING: GigabitEthernet1/3 is not compatible with GigabitEthernet1/2 and will be suspended (speed of GigabitEthernet1/3 is 100 Mbps, GigabitEthernet1/2 is 1000 Mbps)

this is a very annoying restriction but ok - it is the best guess until now on how to circumwent that stupid limitation from Cisco

br /ti

I agree this is a problem.

atadams77 — Mon, 25 May 2015 02:01:31 GMT

I agree this is a problem. This may force some loyal cisco customer to switch to alternate platforms. Such as say..the Juniper SRX220.

If I were Cisco, I'd be

Mariusz00001 — Mon, 25 May 2015 15:11:54 GMT

If I were Cisco, I'd be ashamed to suggest anything like this. What's next? Using a paper-clip to remove a cable because we will get a port 'very similar to RJ45' in ASA5507? 😉

A new platform should be a step forward especially if you release sth to replace a very old and slow device. The truth is that if Cisco does not fix it, it will cost them a lot of money...

I have a TAC Case open : SR

stownsend — Thu, 28 May 2015 21:32:04 GMT

I have a TAC Case open : SR 635080803

I'll let you know what they say...