Cisco ASA 5510 replacment

[atlanticjeff]

I have Cisco ASA 5510 that we are looking to replace.  We would like to replace it with another Cisco Appliance. 

My Question is 2 parts.

Part 1 I am not extremely familiar with the Cisco line of products. The main requirements are VPN and we have 2 internet circuits used for failover only not load balancing. What current appliance would be a suitable replacement to fit those requirements?

Part 2 Going back to not knowing to much about Cisco firwealls. Can a config file be saved from this ASA 5510 and then be dropped into a new device? Allowing it to apply all the current configuration of the old device. I know this device is really old and I would have a really hard time re-building all the port forwards, routing rules, ect. 

Any help that anyone can suggest is appreciated

Thanks..

[Rob Ingram]

Hi,
You could go with an ASA 5515-X, it depends on your throughput requirements etc. The lower models (5506-X and 5512-X) don't support the latest FTD code 6.3, so you may not wish to purchase that model if you wished to run the FTD image. The FTD image supports the latest NGFW features.

Instead of using the FTD image you could run the traditional ASA image that you are familar with. If you on your ASA 5510 you are runnning ASA pre v.8.3 then the newer code change the configuration of ACL and NAT, so you might need to amend the configuration.

Reference links, which may be helpful if you current ASA is runnning ASA v8.2 or lower:-

ASA 8.3 NAT Changes

ASA 8.3 Changes

HTH

[atlanticjeff]

Forgive me but I don't know what FTD code or NGFW features are. Cisco is very new to me and im trying to learn my way through this. 

The ASA version is 7.2(1)

The main ISP circuit is about 100 Mbps up and down.

[Rob Ingram]

NGFW features included Application Visibility Control, SSL Decryption, Anti-Malware, URL Filtering etc. Datasheet here

Datasheet for ASA models here. If you are just planning to terminate VPNs, then running the legacy ASA code might suffice. If you ran the FTD code this might be a learning curve, however the FTD code is the future.

HTH

[Francesco Molino]

Yes you're right it's an old version.
This link will allow you to convert your 7.2 config into new version config format:
https://fwm.cisco.com/

What throughput do you need?
I believe you can go with either 5508 or 5515-x.

If you purchase a NGFW to add extra security layers, you will be able to download FTD migration tool to convert new format config to FTD format.
https://www.cisco.com/c/en/us/products/security/firewalls/firepower-migration-tool.html

FTD will be managed over a dedicated GUI different as ASDM.
You have 2 choices here:
- FMC: firepower management center. This is a VM that manages all your firewalls centrally with lot of features (vpn authentication over radius for example. 1 of many others)
- FDM: firepower device manager. This is the embedded box gui with limited features (no radius authentication for vpn for example)

Or you can still purchase the box with ASA code and keep doing what you're doing today.

If you have a public certificate for vpn access, don't forget to export it because it won't be part of the config. Then you'll be able to reimport it into new asa.

[atlanticjeff]

Would either the 5508 or 5515-x be able to push 100 Mbps up and down?

Also the GUI for managing the device is something I would need. Currently there is a application that we run on one of our server that looks to run in Java.  Firepower Management Center sounds like what we need as we do use radius for VPN authentication. 

[Francesco Molino · Accepted solution]

First of all i said 5515 and today is 5516 (sorry replying few posts and misspelled the correct model for you)

You can compare them both in this link:
https://www.cisco.com/c/en_ca/products/security/asa-firepower-services/compare-models.html?columnsToShow=4+3

Yes they can do 100Mbps both.

If you purchase one of them and use the gui tool, it'll be the same as today using java. Its name is ASDM.

FMC is useful if you buy one of these firewalls with FTD code. List Price for this FMC for 2 firewalls (your case with failover), It's not very expensive. It runs on esxi or kvm.
In addition to FTD, you can add different set of licences like malware protection, threat protection, url filtering. Obviously you will still need to add anyconnect licenses.