topic Re: ASA5506X Performance Capabilities in Network Security

ASA5506X Performance Capabilities

northtexasnetworks — Fri, 21 Feb 2020 16:48:25 GMT

Hello,

We have an ASA5506X running 9.6.1.

We are currently running a VPN tunnel using: Ikev1 with AES-256, SHA1, and DH 2, and it runs very well.

We are considering changing the config to use: ikev2 with AES-256, SHA256, and DH20.

Can anyone tell me if the CPU has enough performance to support this?

Your help is appreciated.

Re: ASA5506X Performance Capabilities

Rob Ingram — Tue, 12 Feb 2019 22:59:36 GMT

Hi,
Yes, it should be fine, if you have the same number of VPN tunnels you currently have when using IKEv1....but if you plan on terminating additional tunnels on the 5506, that may have an impact at somepoint.

HTH

Re: ASA5506X Performance Capabilities

balaji.bandi — Tue, 12 Feb 2019 23:01:46 GMT

I do not see issue here..how many tunnel we are considering here ?

here is the reference :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/vpn_ike.html

Re: ASA5506X Performance Capabilities

northtexasnetworks — Tue, 12 Feb 2019 23:50:57 GMT

We only have 2 active VPN tunnels running. Someone told me DH20 is very CPU intensive may cause a slow down on the lower end ASA like the 5506. Thanks for your help.

Re: ASA5506X Performance Capabilities

balaji.bandi — Wed, 13 Feb 2019 08:14:28 GMT

X series is the new model, so you expected to be higher performance.

Re: ASA5506X Performance Capabilities

Rob Ingram — Wed, 13 Feb 2019 16:33:41 GMT

DH (diffe hellman) is only run a couple of times a day (depending on the lifetime timers) and with only 2 tunnels that's probably not going to cause you an issue. I assume you are not currently experiencing performance issues...so I would imagine you will be fine.

This cisco doc, albeit it is discussing IOS IKEv2, I assume this still applies on ASA, recommended DH19 as the preferred DH group when using IKEv2, it's efficient and secure.

HTH