ASA

[Ivan Adji - Krstev]

Hi all, 

I need an info as i can find out on the cisco page. As i know there is an Cisco ASA 5500 and are end of life. That means that the new ones are 5500-X something ??? 

And what will be the replacement for ASA 5505 with the new one one ? 

[vivek srivastava]

Yes correct. 5500 will be EOL and replacement is 5500X. Refer below links for different ASA55xx EOL products and their replacement product model information:

http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/eol_C51-727283.html

http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/eol_C51-727279.html

http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/eol_C51-727354.html

http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/eol_C51-727352.html

[Ivan Adji - Krstev]

Hi Vivek,

Thanks for answering, so what will be the best replacement for the old ASA 5505 ? 

[vivek srivastava]

As per Cisco website, EOL is not announced as on date.

http://www.cisco.com/c/en/us/products/security/asa-5500-series-next-generation-firewalls/eos-eol-notice-listing.html

[Ivan Adji - Krstev]

OK so for the 5506-X with FirePower, as i know FirePower is additional security for applications filtering for malware etc.( em i right ? )?  But i don't like the FirePower options is it possible to buy 5506-X without this Options and just a licence for Failover ?

[vivek srivastava]

I guess that option is not avaiable. You need to go with 5505 then.

[Karsten Iwen]

You don't need to use FirePOWER. You can use the 5506-X in a "traditional" way as before with the 5505. The 5506-X is again available as Base- and SecurityPlus versions.

[Ivan Adji - Krstev]

OK One more question, WAN Failover and VPN Failover, this are two separate things so do i need two special licencing or are both included in one licence ? 

[Karsten Iwen]

For the old 5505 you needed the SecPlus license for WAN-failover. For the 5506-X I assume that this restriction is lifted, but I don't have a Base-version to confirm this. For HA you need the SecPlus license on both units. With that the active role fails over to the standby unit if the first one has a problem. The VPNs always terminate on the active ASA, so this gives you also a VPN-failover for the event of a device failure.

VPN-failover for an outage of the primary WAN is handled in the same way as "normal" WAN-failover with route-tracking.