3

We have a project where we need to terminate a large number of IPSec VPN peers. At the moment we are using Cisco ASA 5555-X appliances with VPN Premium license.

We terminate at the moment about 2000 IPSec VPN connection but we are in full deployment and we get about 2000 new peers per year. The maximum amount of VPN peers is 5000 with this platform, according to Cisco website.

All connections are very low bandwidth and we don't use any kind of fancy features on the ASA. CPU usage is less than 2% and memory usage less than 25%. Technically I am pretty sure we can easily support 6000 connections, resource-wise. The license is another issue.

Is there any way to extend the license of the ASA 5555-X to support more than 5000 IPSec VPN peers ?

The alternative would be to go to the next level, ASA 5585-X which supports up to 10000 VPN peers but that's quite more expensive. Adding another ASA 5555-X would also work but that's not very scalable and would make the whole setup more complex.

What other choices to I have for terminating 5000+ IPSec VPN peers ? What do other people use in such large scale projects while keeping things scalable ?

Best regards, Stefan

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 15:04
3

You can ask Your partner for CTMP, and get better pricing (deeper discount) for 5585-X in exchange for your 5555-X. The other option (as clustering doesn't support remote VPNs) is to have some load-balancer in front of set of ASAs doing the hard job of splitting the load.

3

Is there any way to extend the license of the ASA 5555-X to support more than 5000 IPSec VPN peers?

No. That is the licensed limit for the 5555-X platform. Only Cisco can change that "hard" limit. (and why would they when there's a more expensive "upgrade")

What other choices to I have...

Non-Cisco technology. (Checkpoint, pfsense, etc.) It's hard to ask this without it being a shopping question. (What VPN concentrator / firewall can handle more than 5000 peers?)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.