Background: A client has been hitting the host limit for his license on a Cisco ASA 5505. The license has a max of 50 clients that can access the internet, the 51st connection gets dropped. He has been wanting to get rid of this firewall and this issue put him over the edge.

The new firewall has come in and we want to get it up and running fairly quick, but the ASA manages a few site-to-site VPN tunnels. We don't have the info for those tunnels, and we expect it to be a pain.

Question: Is it possible to setup the new firewall and have the ASA still manager these VPN connections until we have more info?

I've been running into wall after wall with this client trying other workarounds to buy more time.

  • Continuing to use it just for L2L VPN will still run into the 50 host limit. (unless you NAT your entire internal LAN to a single address.)
    – Ricky
    Commented Aug 22, 2014 at 4:14
  • There are only a few connections over vpn and it won't be inline with the new FW and clients but on the side instead.
    – N10
    Commented Aug 22, 2014 at 6:41
  • It appears that simply migrating over these VPN connection details is not very simple. That or they support different capabilities. Many of the options do not match up. (Much more to configure on the ASA).
    – N10
    Commented Aug 25, 2014 at 16:52

1 Answer 1


If you want to keep the ASA for the L2L tunnels you could assign a second public IP to the new firewall and not modify the ASA. Then set your default route to the new firewall and add routes for the L2L traffic to go to the ASA.

Though the easiest way would be to recover the VPN config off the ASA and use a single device. You can view the pre shared keys with:

more system://running-config


  • 1
    Or save the config to "net" (tftp, scp, etc.)
    – Ricky
    Commented Aug 22, 2014 at 4:12
  • I think I will stick with having both online for now. It doesn't appear to be a simple operation. Thank you.
    – N10
    Commented Aug 25, 2014 at 16:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.