[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

What is 10-user/3DES bundle ?

Posted on 2008-09-29
3
Medium Priority
?
534 Views
Last Modified: 2008-10-07
Forgive my ignorance, but i have a network integration to do, and have some questions on what type of firewall appliance to install.

Does the 10 user mean? 10 total concurrent users? inbound or outbound?10 hosts? to connections to the internet? 10 VPN connection or tunnels?

Perhaps a better question would be if i have an organization with 30+ user that all use the internet would a 10-user/3DES bundle device suffice, or should i plan to purchase a 50- user bundle. I have search for a straight answer on this, but have several differnet answers. I just need to know if the 10 user will work for an organization this size , or i should invest in the 50-user bundle?
0
Comment
Question by:AC-IS
  • 2
3 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
ID: 22597572
If you have 30 users, you will not be able to use the 10 user bundle. That will limit you to the first 10 internal hosts that hit the firewall trying to go out.
You need the 50 user bundle, but the 501 is no longer for sale. It has been replaced by the much-more-capable Cisco ASA5505
ASA5505-50-BUN-K9  
ASA 5505 Appliance with SW, 50 Users, 8 ports, 3DES/AES  
You will be much much happier with a new ASA instead of an old obsolete PIX501

End-of-Life Milestones and Dates for the Cisco PIX 501 Security Appliance:
End-of-Sale Date
 The last date to order the product through Cisco point-of-sale mechanisms. The product is no longer for sale after this date.
 July 28, 2008
 
0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22598086
That covers the part about the users (aka internal hosts, in Cisco licensing terminology), but it doesn't cover the 3DES part.
3DES simply means that the device has a strong cryptography license and has advanced encryption such as 3DES, and AES 128-256 enabled. In some countries this is illegal, so be sure to check. It is legal in the U.S. and most 1st world countries.
Another way to make sure your device has a 3DES/strong crypto license is if the part number contains "K9". If it only has "K8" then you don't have a strong crypto license.
Strong crypto is important because it is nearly impossible to crack - it is imperative you use this on mission critical or confidential data being sent over VPN.
a "K8" or DES license is considered weak crypto, and while the information being transferred is still encrypted, the encryption can be broken quite easily and is thus not considered secure anymore.
I hope this helps!
And yes, the ASAs are wonderful. They're so much better than PIXes and even cheaper.
Just make sure you get the correct license at first or you can expect to dish out another $500 USD to $2000 USD down the road to correct the licensing oversight. I recommend you consult with Cisco before purchasing.
Basically if you want to have servers in the DMZ and have more than 10 users, you should just get part number:

ASA5505-SEC-BUN-K9
This gives you unlimited users and an Security Plus license which means you have strong crypto and an unrestriced DMZ, as well as failover options for redundancy.
:-) Cheers!
0
 
LVL 12

Expert Comment

by:Pugglewuggle
ID: 22598100
And here is Cisco's product datasheet page for the ASA 5500 series devices.
You can find throughput specs and capabilites, and also part numbers and related information near the bottom of the page.
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_data_sheet0900aecd802930c5.html 
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses

872 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question