topic Re: Contexts and VPN in Network Security

Contexts and VPN

tahequivoice — Mon, 11 Mar 2019 22:22:35 GMT

In the latest code, is VPN still disabled when using contexts? If you use a 5520 as an ISP based firewall for customers, then what would be used for VPN access? Also how many contexts does a 5520 support, and would putting 2 interfaces into an etherchannel for inside, and 2 for outside work? Reason I ask about that, the inside and outside would connect to 2 different core routers. I would be for an MPLS setup.

Re: Contexts and VPN

Marvin Rhoads — Wed, 01 Feb 2012 20:37:01 GMT

Mulitple contexts (still) do not support VPN features. Reference here.

Per an entry just above that one (direct link), a base 5520 license supports 2 contexts and you can license upgrade to 5, 10 or 20.

Re the Etherchannel question, that could work. the advantages (vice just using separate individual physical interfaces per context) could be arguable depending on your use case.

Re: Contexts and VPN

tiwang — Wed, 01 Feb 2012 20:42:54 GMT

but please remember that even though the newer ASA OS'er supports adding the licenses togheter you have to buy some upgrade license for upgrade your 5 to 15 contexts - if you have a 5 context license and buy a 10 context you have 10 and not 15...

Re: Contexts and VPN

tahequivoice — Wed, 01 Feb 2012 20:53:27 GMT

Oh I understand Cisco licenses quite well. Several years of head banging when the wrong one is ordered has finaly paid off. They all see me when ordering licenses! I have a print out of all the SKU's for the licensing.

If you start with 5, L-ASA-SC-5=, then to go to 10, L-ASA-SC-5-10=, next step up 10 to 20, L-ASA-SC-10-20=

Same with SSL licenses. Gets to be really annoying when renewing the CSC licenses.

SO the 5520 max is 20 contexts. VPN's are still unsupported, and I can group interfaces together for increased throughput to avoid bottlenecks. What would be used to VPN access then, a router behind the ASA running ipsecurity plus IOS?

Re: Contexts and VPN

tiwang — Wed, 01 Feb 2012 21:13:34 GMT

yes - these licenses can be a pain 😉

regarding the vpns - I think that I would do the endpoint in front of the ASA on a router so that I could inspect the un-encrypted traffic...

best regards /ti

Re: Contexts and VPN

Marvin Rhoads — Wed, 01 Feb 2012 21:18:50 GMT

tahequivoice wrote:

... What would be used to VPN access then, a router behind the ASA running ipsecurity plus IOS?

A Juniper SRX.

Seriously - the usual answer: it depends. I've seen separate ASAs, routers running IPsec and even - yes - other vendors' firewalls. That's what keeps guys like us fully employed - figuring out the right set of solutions given the customer's requirements and equipment's capabilities.