I'm working with a new client who has an existing Cisco ASA 5512-X firewall in their environment (model: ASA5512-K7). They're interested in establishing a routine site-to-site VPN to my co-location facility.
I went in to configure this and realized that the system appears to be missing all VPN functionality. The crypto command set is abbreviated:
# crypto ? configure mode commands/options: ca Certification authority key Long term key operations�
The "Remote Access" and "Site-to-Site" menus are missing in the ASDM.
And the output of
sh version makes no mention of VPN peers.
Cisco Adaptive Security Appliance Software Version 9.0(3) Device Manager Version 7.1(3) Compiled on Fri 19-Jul-13 17:16 PDT by builders System image file is "disk0:/asa903-smp-k8.bin" Config file at boot was "startup-config" Ambro-ASA-01 up 21 days 2 hours Hardware: ASA5512-K7, 4096 MB RAM, CPU Clarkdale 2793 MHz, 1 CPU (2 cores) ASA: 2048 MB RAM, 1 CPU (1 core) Internal ATA Compact Flash, 4096MB BIOS Flash MX25L6445E @ 0xffbb0000, 8192KB Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x1) Boot microcode : CNPx-MC-BOOT-2.00 Management microcode : CNPx-MC-SSL-PLUS-T020 Number of accelerators: 1 Baseboard Management Controller (revision 0x1) Firmware Version: 2.4 Licensed features for this platform: Maximum Physical Interfaces : Unlimited perpetual Maximum VLANs : 50 perpetual Inside Hosts : Unlimited perpetual Failover : Disabled perpetual DES : Enabled perpetual 3DES-AES : Enabled perpetual Security Contexts : 0 perpetual GTP/GPRS : Disabled perpetual Botnet Traffic Filter : Disabled perpetual IPS Module : Disabled perpetual Cluster : Disabled perpetual This platform has a Base license. Serial Number: FCH1727J1WN Running Permanent Activation Key: 0xe81ac966 0x18d906cc 0x8d629524 0xf75824f8 0x8815f292 Configuration register is 0x1 Configuration last modified by enable_15 at 10:12:14.570 EDT Tue Jul 14 2015
What's going on with this unit? The 5512-K7 should have 250 VPN peers. Is there something wrong with how this ASA was deployed?
So I called Cisco to inquire if there's a method to enable VPN on a No Payload Encryption (NPE) platform. They couldn't/wouldn't answer.
Unfortunately, TAC is unable to assist in any way without the device being under contract. I recommend contacting a Cisco partner and seeing if they’re able to answer the question. Would you like this case to be closed?
So, since VPN is a customer requirement here, we are going to trash this ASA 5512-X, since it doesn't appear to have a path to the necessary functionality.