Solved

What is 10-user/3DES bundle ?

Posted on 2008-09-29
3
507 Views
Last Modified: 2008-10-07
Forgive my ignorance, but i have a network integration to do, and have some questions on what type of firewall appliance to install.

Does the 10 user mean? 10 total concurrent users? inbound or outbound?10 hosts? to connections to the internet? 10 VPN connection or tunnels?

Perhaps a better question would be if i have an organization with 30+ user that all use the internet would a 10-user/3DES bundle device suffice, or should i plan to purchase a 50- user bundle. I have search for a straight answer on this, but have several differnet answers. I just need to know if the 10 user will work for an organization this size , or i should invest in the 50-user bundle?
0
Comment
Question by:AC-IS
  • 2
3 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 125 total points
ID: 22597572
If you have 30 users, you will not be able to use the 10 user bundle. That will limit you to the first 10 internal hosts that hit the firewall trying to go out.
You need the 50 user bundle, but the 501 is no longer for sale. It has been replaced by the much-more-capable Cisco ASA5505
ASA5505-50-BUN-K9  
ASA 5505 Appliance with SW, 50 Users, 8 ports, 3DES/AES  
You will be much much happier with a new ASA instead of an old obsolete PIX501

End-of-Life Milestones and Dates for the Cisco PIX 501 Security Appliance:
End-of-Sale Date
 The last date to order the product through Cisco point-of-sale mechanisms. The product is no longer for sale after this date.
 July 28, 2008
 
0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22598086
That covers the part about the users (aka internal hosts, in Cisco licensing terminology), but it doesn't cover the 3DES part.
3DES simply means that the device has a strong cryptography license and has advanced encryption such as 3DES, and AES 128-256 enabled. In some countries this is illegal, so be sure to check. It is legal in the U.S. and most 1st world countries.
Another way to make sure your device has a 3DES/strong crypto license is if the part number contains "K9". If it only has "K8" then you don't have a strong crypto license.
Strong crypto is important because it is nearly impossible to crack - it is imperative you use this on mission critical or confidential data being sent over VPN.
a "K8" or DES license is considered weak crypto, and while the information being transferred is still encrypted, the encryption can be broken quite easily and is thus not considered secure anymore.
I hope this helps!
And yes, the ASAs are wonderful. They're so much better than PIXes and even cheaper.
Just make sure you get the correct license at first or you can expect to dish out another $500 USD to $2000 USD down the road to correct the licensing oversight. I recommend you consult with Cisco before purchasing.
Basically if you want to have servers in the DMZ and have more than 10 users, you should just get part number:

ASA5505-SEC-BUN-K9
This gives you unlimited users and an Security Plus license which means you have strong crypto and an unrestriced DMZ, as well as failover options for redundancy.
:-) Cheers!
0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22598100
And here is Cisco's product datasheet page for the ASA 5500 series devices.
You can find throughput specs and capabilites, and also part numbers and related information near the bottom of the page.
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_data_sheet0900aecd802930c5.html 
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

When I upgraded my ASA 8.2 to 8.3, I realized that my nonat statement was failing!   The log showed the following error:     %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows It was caused by the config upgrade, because t…
Overview The Cisco PIX 501, PIX 506e, ASA 5505 and ASA 5510 (most if not all of this information will be relevant to the PIX 515e but I do not have a working configuration handy to verify the validity) are primarily used within small to medium busi…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

832 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question