Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Replace Cisco 2911-SEC/K9 with ASA5512-X

Dear Members,

 

I have received a query from one of our clients and they are insterested in replacing CISCO2911-SEC/K9 with ASA5512-X.

They are not running any voice services on the exisitng router. Please suggest me if this replacement will be possible?

Below is the current configuration of both Router and Firewall.

Router

 

Line
Number
Item NameDescriptionQuantity
    
1.0CISCO2911-SEC/K9Cisco 2911 Security Bundle w/SEC license PAK2
1.1PWR-2911-ACCisco 2911 AC Power Supply2
1.2CAB-ACUAC Power Cord (UK) C13 BS 1363 2.5m2
1.3PI-MSE-PRMO-INSRTInsert Packout - PI-MSE2
1.4S29UK9-15204MCisco 2901-2921 IOS UNIVERSAL2
1.5HWIC-2FETwo 10/100 routed port HWIC4
1.6EHWIC-4ESGFour port 10/100/1000 Ethernet switch interface card2
1.7SL-29-IPB-K9IP Base License  for Cisco 2901-29512
1.8HWIC-BLANKBlank faceplate for HWIC slot on Cisco ISR2
1.9ISR-CCP-EXPCisco Config Pro Express on Router Flash2
1.10MEM-2900-512MB-DEF512MB DRAM for Cisco 2901-2921 ISR (Default)2
1.11MEM-CF-256MB256MB Compact Flash for Cisco 1900 2900 3900 ISR2
1.12SL-29-SEC-K9Security License  for Cisco 2901-29512
1.13SM-S-BLANKRemovable faceplate for SM slot on Cisco 290039004400 ISR2

 

Firewall

 

Line
Number
Item NameDescriptionQuantity
Products   
5.0ASA5512-SSD120-K9NGFW ASA 5512-X w/ SW 6GE Data 1GE Mgmt AC 3DES/AES SSD 120G2
5.1ASA-IC-6GE-CU-AASA 5512-X/5515-X Interface Card 6-port 10/100/1000 RJ-452
5.2SF-ASA-X-9.1.3-K8ASA 9.1.3 Software image for ASA 5500-X Series5585-XASA-SM2
5.3SF-ASA-CX-9.2-K8ASA 5500 Series CX Software v9.2.12
5.4ASA5512AWI1YASA 5512-X AVCWSE IPS 1Year2
5.5ASA-RAILSASA 5512-X -- ASA 5555-X Rail Kit2
5.6CAB-ACUAC Power Cord (UK) C13 BS 1363 2.5m2
5.7ASA-VPN-CLNT-K9Cisco VPN Client Software (Windows Solaris Linux Mac)2
5.8ASA5500-ENCR-K9ASA 5500 Strong Encryption License (3DES/AES)2
5.9ASA-ANYCONN-CSD-K9ASA 5500 AnyConnect Client + Cisco Security Desktop Software2
5.10ASA5500X-SSD120INCASA 5512-X through 5555-X 120GB MLC SED SSD (Incl.)2
5.11ASA5512-MBASA 5512 IPS Part Number with which PCB Serial is associated2
6.0L-ASA5512-SEC-PL=ASA 5512-X Sec. Plus Lic. w/ HA  Sec Ctxt  more VLAN + Conns1

 

Your immediate response would be highly appreciated.

 

Regards,

Farhan.

2 ACCEPTED SOLUTIONS

Accepted Solutions
Hall of Fame Super Silver

It mostly depends on what

It mostly depends on what features they're using on the 2911. There's a fair amount of feature overlap in the basics but there are also dozens of things you can do with an ASA that you can't do with a router (and vice versa).

The ASA is a poor router and the 2911 is not primarily a firewall. If they're doing DMVPN with their 2911, the ASA cannot do that. If they're doing BGP routing that too cannot be done by the ASA.

By the way this is a volunteer community forum, the only currrency exchanged is goodwill and the points we give each other for useful answers. "immediate response" is a service you get from paid support like the Cisco TAC. 

New Member

Hi Farhan,Above all the other

Hi Farhan,

Above all the other comments ASA will work perfectly where web and application filtering is required. I implemented some of those boxes and they have this new CX module desgnated for all the web filtering, works like a charm. VPN wise also good of course however not as many VPN technology option as with the router, WAN failing over from the primary ISP to the secondary and backwards also works great, even with the VPN switching between the ISPs. Not sure why you need an extra 6xGE card for ASA, it has already 6xGE ports built in. Also would suggest to buy the web and apps filtering license for 3 years, is much cheaper. You don't really need Sec Plus license unless you will be running multi-context environment, be aware some limitations with that.

If you won't be running any voice services or any VPN and routing protocols on the router that aren't supported on ASA, ASA is the right choice. Be aware that for any dynamic routing or ip sla features on the router you will also need a DATA license which I don;t see on your BOM.

Good luck!

5 REPLIES
Hall of Fame Super Silver

It mostly depends on what

It mostly depends on what features they're using on the 2911. There's a fair amount of feature overlap in the basics but there are also dozens of things you can do with an ASA that you can't do with a router (and vice versa).

The ASA is a poor router and the 2911 is not primarily a firewall. If they're doing DMVPN with their 2911, the ASA cannot do that. If they're doing BGP routing that too cannot be done by the ASA.

By the way this is a volunteer community forum, the only currrency exchanged is goodwill and the points we give each other for useful answers. "immediate response" is a service you get from paid support like the Cisco TAC. 

New Member

Thanks Marvin. I really

Thanks Marvin. I really appreciate the efforts you have put in towards this service. I am sorry for the request for immediate response since I had to submit a response to our client and wanted to get the answers asap.

Regards,

Farhan.

New Member

Hi Farhan,Above all the other

Hi Farhan,

Above all the other comments ASA will work perfectly where web and application filtering is required. I implemented some of those boxes and they have this new CX module desgnated for all the web filtering, works like a charm. VPN wise also good of course however not as many VPN technology option as with the router, WAN failing over from the primary ISP to the secondary and backwards also works great, even with the VPN switching between the ISPs. Not sure why you need an extra 6xGE card for ASA, it has already 6xGE ports built in. Also would suggest to buy the web and apps filtering license for 3 years, is much cheaper. You don't really need Sec Plus license unless you will be running multi-context environment, be aware some limitations with that.

If you won't be running any voice services or any VPN and routing protocols on the router that aren't supported on ASA, ASA is the right choice. Be aware that for any dynamic routing or ip sla features on the router you will also need a DATA license which I don;t see on your BOM.

Good luck!

VIP Purple

The first question you have

The first question you have to ask yourself is if you can transfer all used features of the router to the ASA.

For example if you are having multiple ISPs connected with some fancy routing, or if you are running protocols not supported on the ASA. Also if your VPNs use DMVPN, FlexVPN, VTIs/DVTIs, then you can't migrate that to the ASA as these features are not supported there.

For basic internet-connectivity and security, the ASA-X could be really the better choice then a router.

But instead of using the 5512-X with SecPlus license you should also evaluate to buy the 5515-X which has the same list price as 5512+SecPlus but is a little bit faster.


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

Thanks Karsten for your

Thanks Karsten for your feedback. I will get these thoughts transferred to the client and will get back to you if required.

1521
Views
10
Helpful
5
Replies