Solved

Cisco ASA 5505 Licensing Question

Posted on 2014-04-30
4
588 Views
Last Modified: 2014-05-06
Hi folks!

We are looking to purchase a Cisco ASA 5505 unit to replace our outdated Cisco PIX 515E firewall. I have a question concerning the licensing.

I see that there are different license levels based on the number of users -- 10, 50, unlimited. However, our situation is that we'll only have a handful of users inside the network making connections out through the firewall. The vast majority of our traffic is incoming to our servers from the outside (e.g. web traffic, FTP traffic, etc.).

Does that mean that we could get by with a lower number of licensed users, such as 10, or are incoming connections counted and we, therefore, need an unlimited user license?

Thanks,
Ithizar
0
Comment
Question by:Ithizar
  • 3
4 Comments
 
LVL 35

Accepted Solution

by:
Ernie Beek earned 500 total points
Comment Utility
Host limits shouldn't apply to the outside interface.

Keep in mind though that the number of hosts on the inside is counted, not the number of users.
So even if you only have eight users, you might have 15 devices connection to the internet which might give you issues then.
0
 
LVL 35

Expert Comment

by:Ernie Beek
Comment Utility
Also have a look at:
http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/license_standalone/license_management/license.html#wp1450337

Quote:
In routed mode, hosts on the inside (Business and Home VLANs) count towards the limit when they communicate with the outside (Internet VLAN), including when the inside initiates a connection to the outside as well as when the outside initiates a connection to the inside. Note that even when the outside initiates a connection to the inside, outside hosts are not counted towards the limit; only the inside hosts count. Hosts that initiate traffic between Business and Home are also not counted towards the limit. The interface associated with the default route is considered to be the outside Internet interface. If there is no default route, hosts on all interfaces are counted toward the limit. In transparent mode, the interface with the lowest number of hosts is counted towards the host limit. See the show local-host command to view host limits.
0
 

Author Comment

by:Ithizar
Comment Utility
Thank you! That makes a lot of sense. My only other question is this:

Do you know how it treats virtual devices?

For example, if we have a VMware ESXi server that is running 3 virtual servers does that count as one device? Three devices? Four devices?

Thanks again.
0
 
LVL 35

Expert Comment

by:Ernie Beek
Comment Utility
Everything that connects through the ASA is counted,  so four in worst case.
If a machine doesn't need an Internet connection,  remove the default gateway.  That should take care of it.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
SonicWall blocking WOL 11 47
NEXUS3524 - SFP validation failed 3 28
Cisco NBAR 6 13
RDP Sonicwall 8 22
This article is a how to to configure a UCS Ethernet-uplink portchannel via the console. It is easy to do and can be done quite quickly. In certain versions of the UCS manager the portchannel has issues coming up and this is a workaround. I am…
Before I go to far, let's explain HA (High Availability) and why you should consider it.  High availability is the mechanism used to provide redundancy to any service at the same site and appears as a single service to the users of that service.  As…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now