ASA-5520 Scansafe Session limits

[moody]

We have an ASA-5520 - and we connect to scansafe via the connector.  at times we've had issues w/ slow internet response times. i was told that there may be a limit on how many users can simultaneously go to the internet via our ASA.  Has anyone had this issue - or come across this?  I haven't found anything yet that mentions a user limit when using scansafe - if that's the case, any ideas on overcoming this issue w/o upgrading our firewall?

[Marvin Rhoads · Accepted solution]

Coincidentally this was covered in the Ask the Expert webcast earlier today. You can download the slides from the link here.

The documented recommended limit for Scansafe / CWS via the ASA 5520 is 300 users. Exceeding that will likely result in increased latency for web browsing.

Unfortunately an upgrade is likely the only solution if you're up against that limit. The number goes way up for the equivalent 5500-X series (e.g. 3,000 for the 5515-X and 4,000 for the 5525-X).

[moody]

oh wow - 300.  that information would've been helpful when we purchased CWS.  ok - so if there's no $ for an upgrade - is the recommendation to revert back to doing a re-direct NAT statement similar to what we did prior to version-9 until we can upgrade the f/w to support 2000+ users?

[Marvin Rhoads]

Yes - if it worked with the older method before Version 9, you can continue to use that.

Sorry your reseller did you a disservice by not advising you on the CWS scalability limitations. that information is also available in partner collateral and in Cisco Live presentations.