topic Aniba is correct.Connections, in Network Security

ASA 5515 capability

NInja Black — Tue, 12 Mar 2019 04:05:34 GMT

Hi,

For our new office (call center) we are planning to use the ASA5515 in between the ISP router and the inside LAN switch.

My concern is, can the ASA5515 support 150 users using softphones and avg internet use. For how many users can it support to.

From the description below seems it can support 250,000 concurrent connections. What does it mean by 'connection'.

http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/data_sheet_c78-701253.html

"With up to 1.2 Gbps of firewall throughput, 250,000 concurrent firewall connections, 15,000 connections per second, and 6 integrated Gigabit Ethernet interfaces, the ASA 5512-X and 5515-X are excellent choices for businesses requiring a high-performance, cost-effective, and extensible security solution with exceptional application visibility and control that can grow with their changing needs. "

Any insight is highly appreciated. It is imperative for me to understand its capacity.

Thanks.

As Cisco ASA are statefull

aniba.souza — Wed, 16 Apr 2014 20:17:22 GMT

As Cisco ASA are statefull Firewalls, they keep a record for each active connection (tcp for example) on the ASA.

The concurrent connections limit can be seen as the capacity of this connection recording table.

Aniba is correct.Connections,

Marvin Rhoads — Wed, 16 Apr 2014 21:03:32 GMT

Aniba is correct.

Connections, connections/second overall thoughput and whether or not you want to use VPN in any significant way are considerations when choosing an ASA firewall model. Those metrics are all covered in the data sheet you referenced.

I've seen that model used successfully in settings the size you describe.

Thanks so much guys!!!

NInja Black — Thu, 17 Apr 2014 17:23:35 GMT

Thanks so much guys!!!

Hey Marvin, To add to the

NInja Black — Tue, 29 Apr 2014 17:00:48 GMT

Hey Marvin,

To add to the 150 softphone users the firewall will be doing dynamic routing (EIGRP), site-site VPN with 4 other branch offices.

Currently there is a router (3925) between the ISP router and the ASA (ISP>Router3925>asa5515>LAN switches). it takes care of EIGRP and NATing

We want to eliminate the router as it would simplify the network but I want to understand if the firewall will be able to handle the extra load. Will it hold without the router?

It may simplify the layout

Marvin Rhoads — Tue, 29 Apr 2014 18:21:02 GMT

It may simplify the layout but I'm always a fan of doing routing on a router vs. on a firewall.

As far as performance, adding the EIGRP and NAT onto your 5515-X should not contribute in any significant way.

Thanks again Marvin.

NInja Black — Thu, 01 May 2014 16:04:57 GMT

Thanks again Marvin.