Which ASA5505?

[SamirD]

So after working with smb-level products for a couple of decades, I've gotten to a point where I can finally justify enterprise class equipment.

Now, the problem is which one?  In the ASA 5505 data sheet there's at least 9 different part numbers with slightly different specs.   How do you make sure you've got exactly what you need since there aren't individual spec sheets?

Also, how does support and warranties work on enterprise equipment?  Do I have to buy a license/subscription each year?  Or will it still work after the current/included/trial subscription runs out.

Thank you in advance for any replies.           

Huntsville's Premiere Car and Bike e-magazine: www.huntsvillecarscene.com      

[nickhesson]

Hello,

I believe the reason why you have no answer to this thread, is because you have mistaking a model number for the series number.  ASA hardware series is 5500.  The 5505 is the low-end SMB model of the 5500 series.   

5505 is not intended to be a enterprise level firewall. But more of a SOHO.  The 5505 only has two options, a higher license option (Security Plus) and an IPS module (SSC-AIP-5).   

The main difference between all models is performance.  Connection throughputs and the # available physical ports.  Take a look at this link:

http://www.cisco.com/en/US/products/ps6120/prod_models_comparison.html

[SamirD]

Thank you for the reply.  I know that the 5505 is part of the 5500 series.  I knew Security Plus was an option, but not the IPS module.  I really don't need either of those.

The problem is the part number for a plain-jane 5505.  If you look at the datasheet, there's actually different part numbers for models that support DES or 3DES/AES as well as other options.  And then every vendor I've looked at has a wide variety of pricing based on the part number, so purchasing is quite confusing.  And then there's the whole idea of support and warranties.  Enterprise products seems to sell this separately, so understanding what is included/not is a point of confusion in itself.

It's as clear as mud for me right now.  I still don't know what part number would actually do what I want and no more.

Huntsville's Premiere Car and Bike e-magazine: www.huntsvillecarscene.com

[Richard Burts]

I appreciate your confusion about the numerous choices when you look into the 5505, do you want the firewall edition, or the vpn edition, or the IPS edition, or the Content Security edition, or the UC Security edition? The choices are many and the differences are not clear. The good news is that the hardware is the same in all the choices and the software is pretty much the same. The main differences are in how it optimizes for various purposes and in the licensing that is part of some of them (especially the IPS and Content Security bundles).

In general the ASA (and other Enterprise class equipment) will continue to run after your initial support contract/warranty expires. Without the support contract you lose the ability to ask for help if you run into a problem with the hardware or the software and you lose the ability to upgrade the software to a newer version. And with IPS you lose the ability to get updated signatures. But basically the box will still run and do what it has been doing.

HTH

Rick

[SamirD]

Yep, you nailed it on the head, and I didn't even know there were that many.

My main purpose would be for dual-wan and vpn, or just vpn if this is only single wan (I forgot).  What's the part number you recommend?  Then I can go and research it.

Huntsville's Premiere Car and Bike e-magazine: www.huntsvillecarscene.com

[Richard Burts]

Based on what you have posted I believe that the VPN edition is the best fit for you. I do not have the part number where I can access it easily. But you should not have too much difficulty in identifying it as you look for VPN edition.

Good luck to you in implementing this.

HTH

Rick

[nickhesson]

Sorry guys, but you're incorrect.  If we are talking 5505?  There is no such thing as a VPN edition.  Although I (we all) agree Cisco Licensing is very hard to understand.  But there is no such thing as a VPN, UC, Etc. "editions" when talking about the ASA 5500 series firewalls. From the base model you purchase AIP or CCS modules, or licensing (Link).

When it comes to the 5505, there are only the two options.  Securty Plus and the AIP (IPS) module.

In order to use Dual ISP (aka IPSLA) on the 5505.  You must purchase the ASA with a Security Plus license. The last one in the list above.

Nick

[Richard Burts]

Nick

Look in this link from the Cisco web site and tell me again that there is no firewall edition, or vpn edition for the 5505.

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/prod_brochure0900aecd8053258b.pdf

HTH

Rick

[nickhesson]

Rick

EASY!  "There is no firewall edition" to ASA firewalls...  Sorry, but can you buy an ASA without the "firewall edition"?  Point is there is only 4 active Part numbers to the ASA 5505.  Just because you found a 5 year old doc listing the "description" for a part number as such.  Does not mean Cisco or their selling partners refer to the ASA as "VPN edition" and "Firewall edition"  in today's market.

Simply because even at the base model of any ASA model, offers both VPN/firewall/UC Proxy up to a number of connections.  Purchasing more licenses would only just increase the number of connections.  Making every ASA a "VPN edition" as they all support VPN out of the box.

My last word.  Please look at the latest ASA overview.  You will not see anything in there regarding "Edition".  But yet you will see the four available part numbers for the 5505.

ASA5505-BUN-K9 - Cisco ASA 5505 Appliance with 10-User Firewall License

ASA5505-50-BUN-K9 - Cisco ASA 5505 Appliance with 50-User Firewall License

ASA5505-UL-BUN-K9 - Cisco ASA 5505 Appliance with SW, Unlimited Users

ASA5505-SEC-BUN-K9 - Cisco ASA 5505 Appliance with Unrestricted Firewall License, Security Plus

All these part numbers allow some # of VPN connections.  But only the Security Plus allows for Dual ISP.

Now Rick, where you maybe correct.  Is the models over the 5505.  Where you can purchase 5510 and above with an IPS or a CSC module pre-installed and packaged.  But again like i said all support VPN out of the box, making no such thing as a VPN or firewall edition, since all ASA support this function.

Take care,

Nick

[SamirD]

Lol.  I think the Zyxel USG50 is going to be a better fit.  I'd rather spend a few hours reading the manual for the product vs just finding the appropriate product number for my application.

Huntsville's Premiere Car and Bike e-magazine: www.huntsvillecarscene.com

[nickhesson]

Since we are in a joking mode.  Then i sure hope this thread gets deleted.  Because reality it's not that complicated.  4 different options, clearly identified.  If you find complication in that, then maybe your right.  You should go with something more inferior.  LOL

[SamirD]

I'm not an idiot.  It is not exactly as simple as you make it out to be.  If I didn't believe in Cisco products, I wouldn't be a stockholder.

That being said, I will be going with another company.  Your arrogant posts convinced me of that.

Huntsville's Premiere Car and Bike e-magazine: www.huntsvillecarscene.com