1

I'm working with a new client who has an existing Cisco ASA 5512-X firewall in their environment (model: ASA5512-K7). They're interested in establishing a routine site-to-site VPN to my co-location facility.

I went in to configure this and realized that the system appears to be missing all VPN functionality. The crypto command set is abbreviated:

# crypto ?

configure mode commands/options:
  ca   Certification authority
  key  Long term key operations�

The "Remote Access" and "Site-to-Site" menus are missing in the ASDM.

And the output of sh version makes no mention of VPN peers.

Cisco Adaptive Security Appliance Software Version 9.0(3) 
Device Manager Version 7.1(3)

Compiled on Fri 19-Jul-13 17:16 PDT by builders
System image file is "disk0:/asa903-smp-k8.bin"
Config file at boot was "startup-config"

Ambro-ASA-01 up 21 days 2 hours

Hardware:   ASA5512-K7, 4096 MB RAM, CPU Clarkdale 2793 MHz, 1 CPU (2 cores)
            ASA: 2048 MB RAM, 1 CPU (1 core)
Internal ATA Compact Flash, 4096MB
BIOS Flash MX25L6445E @ 0xffbb0000, 8192KB

Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x1)
                             Boot microcode        : CNPx-MC-BOOT-2.00
                             Management microcode  : CNPx-MC-SSL-PLUS-T020
                             Number of accelerators: 1
Baseboard Management Controller (revision 0x1) Firmware Version: 2.4

Licensed features for this platform:
Maximum Physical Interfaces       : Unlimited      perpetual
Maximum VLANs                     : 50             perpetual
Inside Hosts                      : Unlimited      perpetual
Failover                          : Disabled       perpetual
DES                               : Enabled        perpetual
3DES-AES                          : Enabled        perpetual
Security Contexts                 : 0              perpetual
GTP/GPRS                          : Disabled       perpetual
Botnet Traffic Filter             : Disabled       perpetual
IPS Module                        : Disabled       perpetual
Cluster                           : Disabled       perpetual

This platform has a Base license.

Serial Number: FCH1727J1WN
Running Permanent Activation Key: 0xe81ac966 0x18d906cc 0x8d629524 0xf75824f8 0x8815f292 
Configuration register is 0x1
Configuration last modified by enable_15 at 10:12:14.570 EDT Tue Jul 14 2015

What's going on with this unit? The 5512-K7 should have 250 VPN peers. Is there something wrong with how this ASA was deployed?


So I called Cisco to inquire if there's a method to enable VPN on a No Payload Encryption (NPE) platform. They couldn't/wouldn't answer.

Unfortunately, TAC is unable to assist in any way without the device being under contract. I recommend contacting a Cisco partner and seeing if they’re able to answer the question. Would you like this case to be closed?

So, since VPN is a customer requirement here, we are going to trash this ASA 5512-X, since it doesn't appear to have a path to the necessary functionality.

5

Cisco ASA 5512-X Firewall Edition; includes firewall services, 250 IPsec VPN peers, 2 SSL VPN peers, 6 copper GE data ports, 1 copper GE management port, 1 AC power supply, no payload encryption (ASA5512-K7)

Cisco ASA 5500-X Series Next Generation Firewalls Data Sheet


No Payload Encryption Models

You can purchase some models with No Payload Encryption. For export to some countries, payload encryption cannot be enabled on the Cisco ASA 5500 series. The ASA software senses a No Payload Encryption model, and disables the following features:

  • Unified Communications
  • VPN

You can still install the Strong Encryption (3DES/AES) license for use with management connections. For example, you can use ASDM HTTPS/SSL, SSHv2, Telnet and SNMPv3. You can also download the dynamic database for the Botnet Traffic Filer (which uses SSL).

When you view the license (see the "Monitoring Licenses" section), VPN and Unified Communications licenses will not be listed.

Managing Feature Licenses


Is there something wrong with how this ASA was deployed?

I would say the problem is in how it was ordered. The "-K7" has no crypto capability. You'll have to contact Cisco to correct that. (i.e. buy a crypto license.)

  • Or perhaps it was ordered correctly? Since it wasn't mentioned where the ASA is located, make sure the location is known before trying to buy additional licensing, just in case it is located in a country where these features cannot be enabled legally. – YLearn Jul 15 '15 at 3:28
  • Well, this is the United States. I'm not certain why the firewall was ordered this way. Is there any good use case for people buying a K7 product? – ewwhite Jul 15 '15 at 6:13
  • 1
    @ewwhite, if it is located in the U.S. and the organization isn't limited, then the most likely cause is the person who ordered it didn't have the knowledge or take the time for due diligence to order the correct part number. Perhaps this unit was cheaper and they thought they were getting a bargain and didn't realize the difference? Only real use case to buy this product is if it is being exported to a country or sold to an organization where it is illegal to do so with "advanced encryption" capabilities enabled. – YLearn Jul 15 '15 at 15:49
  • I'm betting it's ignorance on the part of the purchaser. Thank you for the clarification. – ewwhite Jul 15 '15 at 15:53
  • 1
    The most likely explanation is whoever ordered it saw the -K7 was cheaper than a -K8 and didn't bother to learn why. The Managing Feature Licenses document suggests this cannot be changed by the customer -- you cannot change the model number with a license. – Ricky Beam Jul 15 '15 at 19:37
0

You just need to download the correct software. Once you do that, the features will be there. The price is no different.


enter image description here

  • Just FYI: You want to get the FirePOWER features. Without that, the box is neutered, in my opinion. See expandable firepower screenshots here and here. – Ron Royston Jul 16 '15 at 3:11
  • The FirePOWER features look interesting. It seems like it's more of an analysis and drill-down reporting. Does it also handle content filtering in the way that something like a Barracuda Web Filter would? – ewwhite Jul 24 '15 at 14:06
  • 2
    Those are model numbers. There's only one version of the software. It will know by the model number that it's an NPE. The difference between -k8 and -k9 models is the installed license. There are reports that there are physical differences as well (i.e. the cavium crypto hardware isn't there.) – Ricky Beam Aug 31 '15 at 0:21
  • I'm thinking this is a physical difference. I downloaded the K8 and K9 software, and the NPE detection still disabled the VPN features. I'll pursue with Cisco, though. – ewwhite Sep 19 '15 at 22:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.