Cisco ASA 5580-20 Firewall

Cisco ASA 5580-20 Series Adaptive Security Appliances are easy-to-deploy solutions that integrate world-class firewall, Unified Communications (voice/video) security, SSL and IPsec VPN, intrusion prevention (IPS), and content security services in a flexible, modular product family. Designed as a key component of the Cisco Self-Defending Network, the Cisco ASA 5580-20 Series provides intelligent threat defense and secure communications services that stop attacks before they impact business continuity. Designed to protect networks of all sizes, the Cisco ASA 5580-20 Series enables organizations to lower their overall deployment and operations costs while delivering comprehensive multilayer security.

cisco asa 5580-20 ips firewall

Overview
Features & Benefits
Model Comparison
Data Sheets

The Cisco ASA 5500 Series Firewall Edition enables businesses to securely deploy mission-critical applications and networks in a highly reliable manner, while providing significant investment protection and lower operational costs through its unique, modular design. Businesses can protect their networks from unauthorized access using the Cisco ASA 5500 Series Firewall Edition's robust policy enforcement services. These services combine with market-leading VPN services to enable businesses to securely extend their networks across low-cost Internet connections to business partners, remote sites, and mobile workers. This flexible solution can adapt as an organization's needs evolve along with the ever-changing security threat landscape, giving businesses the ability to easily integrate market-leading intrusion prevention, antivirus, antispam, antispyware, URL filtering, and other advanced content security services for additional layers of protection. Combined with Cisco management and monitoring application solutions, the Cisco ASA 5500 Series Firewall Edition provides world-class security with lower operational costs.

The Challenge:

The information assets and applications traveling on today's networks are the lifeblood of the modern enterprise. As businesses continue to optimize their processes and streamline their operations for improved profitability and competitiveness, their networks become increasingly more complex and interconnected. Now, as businesses depend on these networks as mission-critical infrastructure, the security and reliability challenges businesses face continue to grow.

Examples of threats to today's business networks include:

Unauthorized network or information access-As businesses increase internal network connectivity and collaboration with new customers and business partners, they need to effectively maintain control of their vital assets to preserve their competitive edge and limit corporate liability. New applications can increase business automation and collaboration, but can also open dangerous security holes, if not secured properly.
Decreased employee productivity and wasted bandwidth-Businesses need to effectively control the use of applications, such as peer-to-peer file sharing and instant messaging, which plague many unsuspecting businesses, to improve employee productivity and reduce the costs associated with Internet connectivity.
Unplanned network downtime-Businesses need highly reliable networks that help ensure continuous operations for maximum productivity, including support for planned and unplanned maintenance upgrades. These networks must be able to defend against threats such as Internet-based denial of service attacks or internal sabotage from disgruntled employees or contractors.

Capabilities of the Cisco ASA 5500 Series Firewall Edition include:

Most trusted and deployed firewall technology-Building upon the market-proven capabilities of the Cisco PIX® Family of security appliances, the Cisco ASA 5500 Series provides a wide range of services to secure modern network environments. Flexible policy capabilities prevent unauthorized access to network resources or vital corporate information. Advanced application control capabilities help businesses effectively control the use of peer-to-peer file sharing, instant messaging, and other non-corporate applications-thus improving employee productivity and reducing wasted Internet bandwidth.
Threat-protected VPN-Building upon the market-proven VPN capabilities of the Cisco VPN 3000 Series Concentrator, the Cisco ASA 5500 Series Firewall Edition provides secure site-to-site and remote-user access to corporate networks and services. This solution offers businesses maximum flexibility for secure connectivity by combining support for Secure Sockets Layer (SSL) and IP Security (IPsec) VPN capabilities into a single, best-in-class solution. Using the services offered by the Cisco ASA 5500 Series Firewall Edition, businesses can enforce identity-based security and networking policies to all network traffic, thus enabling businesses to tailor-fit access privileges for every group of employees, contractors, and business partners.
Adaptive design provides superior investment protection and extensibility to address future threats-The Cisco ASA 5500 Series Firewall Edition can adapt as businesses needs change through its unique, modular design. Businesses can easily expand the number of security services offered by adding a high-performance, purpose-built Cisco ASA 5500 Series security services module, such as the Advanced Inspection and Prevention Security Services Module (AIP SSM) for advanced intrusion prevention services, or the Content Security and Control Security Services Module (CSC SSM) for advanced antivirus, antispam, and other content security services.
Intelligent network integration and enterprise-class resiliency-Building on more than 20 years of Cisco networking leadership and innovation, the Cisco ASA 5500 Series Firewall Edition delivers a wide range of intelligent networking services for seamless integration into today's diverse network environments. Businesses can maximize network uptime and throughput by taking advantage of the many resiliency and scalability services this solution has to offer, such Active/Active high availability, "zero-downtime software upgrades," and integrated VPN clustering and load balancing.
Easy deployment and management-The Cisco management and monitoring suite enables large-scale deployment and operation of the Cisco ASA 5500 Series Firewall Edition. Cisco provides a complete solution, covering management and monitoring. Also included with the solution is Cisco Adaptive Security Device Manager (ASDM), which provides a powerful, yet easy-to-use browser-based management and monitoring interface for individual security appliances.

	Cisco ASA 5505 Base / Security Plus	Cisco ASA 5510 Base / Security Plus	Cisco ASA 5520	Cisco ASA 5540	Cisco ASA 5550
Network Location	Small Business, Branch Office, Enterprise Teleworker	Internet Edge	Internet Edge	Internet Edge	Internet Edge, Campus
Performance Summary
Maximum Firewall throughput	150 Mbps	300 Mbps	450 Mbps	650 Mbps	1.2 Gbps
Maximum Firewall Connections	10,000 / 25,000	50,000 / 130,000	280000	400000	650000
Maximum Firewall Connections/Second	4000	9000	12000	25000	36000
Packets Per Second (64 byte)	85000	190000	320000	500000	600000
Maximum 3DES/AES VPN Throughput	100 Mbps	170 Mbps	225 Mbps	325 Mbps	425 Mbps
Maximum Site-to-Site and IPsec IKEv1 Client VPN User Sessions	40841	250	750	5000	5000
Maximum AnyConnect or Clientless VPN User Sessions	25	250	750	2500	5000
Bundled SSL VPN User Session	2	2	2	2	2
Technical Summary
Memory	512 MB	1 GB	2 GB	2 GB	4 GB
Minimum System Flash	128 MB	256 MB	256 MB	256 MB	256 MB
Integrated Ports	8 port 10/100 switch with 2 Power over Ethernet (PoE) ports	5-10/100 / 2-10/100/1000, 3-10/100 +4-10/100/1000, 4 SFP (with 4GE SSM)	4-10/100/1000, 1-10/100 +4-10/100/1000, 4 SFP (with 4GE SSM)	4-10/100/1000, 1-10/100 +4-10/100/1000, 4 SFP (with 4GE SSM)	8-10/100/1000, 4-SFP, 1-10/100
Maximum Virtual Interfaces (VLANs)	3 (trunking disabled) / 20 (trunking enabled)	50 / 100	150	200	400
Expansion Capabilities
SSC/SSM/ICs Expansion	1-SSC	1-SSM	1-SSM	1-SSM	Not available
SSC/SSM/ICs Supported	AIP, SSC	CSC SSM, AIP SSM, 4GE SSM	CSC SSM, AIP SSM, 4GE SSM	CSC SSM, AIP SSM, 4GE SSM	Not available
Intrusion Prevention	Yes (with AIP SSC)	Yes (with AIP SSM)	Yes (with AIP SSM)	Yes (with AIP SSM)	Not available
Concurrent Threat Mitigation Throughput (Mbps) (Firewall + IPS Services)	75 (with AIP SSC-5)	150 (with AIP SSM-10) 300 (with AIP SSM-20)	225 (with AIP SSM-10) 375 (with AIP SSM-20) 450 (with AIP SSM-40)	500 (wth AIP SSM-20) 650 (with AIP SSM-40)	Not available
Content Security (Anti-virus, Anti-Spyware, File Blocking)	Not available	Yes (with CSC SSM)	Yes (with CSC SSM)	Yes (with CSC SSM)	Not available
Maximum Number of Users for Anti-virus, Anti-spyware, File Blocking (CSC SSM only)	Not available	500 (CSC-SSM-10) 1000 (CSC-SSM-20)	500 (CSC-SSM-10) 1000 (CSC-SSM-20)	500 (CSC-SSM-10) 1000 (CSC-SSM-20)	Not available
Content Security Plus License features	Not available	Anti-spam, anti-phishing, URL filtering	Anti-spam, anti-phishing, URL filtering	Anti-spam, anti-phishing, URL filtering	Not available
Features
Cisco Adaptive Security Appliance Software Version (latest)	8.4	8.4	8.4	8.4	8.4
Application-layer Firewall Services	Yes	Yes	Yes	Yes	Yes
Layer 2 Transparent Firewalling	Yes	Yes	Yes	Yes	Yes
Security Contexts (included/maximum)1	0/0	0/0 / 2/5	40594	18295	-657405
GTP/GPRS Inspection1	Not available	Not available	Yes	Yes	Yes
High-availability Support2	Not supported Stateless A/S	Not supported A/A and A/S	A/A and A/S	A/A and A/S	A/A and A/S
SSL and IPsec VPN Services	Yes	Yes	Yes	Yes	Yes
VPN Clustering and Load Balancing	Not available	Not available / Yes	Yes	Yes	Yes
Advanced Endpoint Assessment1	Yes	Yes	Yes	Yes	Yes

Notes:

SSC: Security Services Card
SSM: Security Services Module
IC: Interface Card
AIP SSM: Advanced Inspection and Prevention Security Services Module
CSC SSM: Content Security and Control Security Services Module
4GE SSM: 4 Gigabit Ethernet Security Services Module

1 Licensed features
2 A/S = Active/Standby; A/A = Active/Active
3 Two regular zones and one restricted zone that can only communicate with one other zone.

	Cisco ASA 5580-20	Cisco ASA 5580-40
Network Location	Data Center, Campus	Data Center, Campus
Performance Summary
Firewall Throughput1	5 Gbps (real-world HTTP), 10 Gbps (max)	10 Gbps (real-world HTTP), 20 Gbps (max)
Maximum Firewall Connections	1000000	2000000
Maximum Firewall Connections/Second	90000	150000
Packets per second (64 byte)	2500000	4000000
Maximum 3DES/AES VPN Throughput2	1 Gbps	1 Gbps
Maximum Site-to-Site and IPsec IKEv1 Client VPN User Sessions	10000	10000
Maximum AnyConnect or Clientless VPN User Sessions	10000	10000
Bundled SSL VPN User Sessions	2	2
Technical Summary
Memory	8 GB	12 GB
Minimum System Flash	1 GB	1 GB
Integrated Ports	2-10/100/1000 management+4-10/100/1000 (with ASA5580-4 GE-CU)+4 GE SR (with ASA5580-4 GE-FI)+2 10 GE SR (with ASA5580-2X10 GE-SR)	2-10/100/1000 management+4-10/100/1000 (with ASA5580-4 GE-CU)+4 GE SR (with ASA5580-4 GE-FI)+2 10 GE SR (with ASA5580-2X10 GE-SR)
Maximum Virtual Interfaces (VLANs)	1024	1024
Expansion Capabilities
SSP Expansion	Not available	Not available
SSP Supported	Not available	Not available
Intrusion Prevention	Not available	Not available
Concurrent Threat Mitigation Throughput (Mbps) (Firewall + IPS Services)	Not available	Not available
Features
Cisco Adaptive Security Appliance Software Version (latest)	8.4	8.4
Application-Layer Firewall Services	Yes	Yes
Layer 2 Transparent Firewalling	Yes	Yes
Security Contexts (included/maximum3)	02/01/50	02/01/50
GTP/GPRS Inspection3	Yes	Yes
High-Availability Support4	A/A and A/S	A/A and A/S
SSL and IPsec VPN Services	Yes	Yes
VPN Clustering and Load Balancing	Yes	Yes
Advanced Endpoint Assessment3	Yes	Yes

Notes:

Maximum throughput measured under ideal test conditions
VPN throughput and sessions count depend on the ASA device configuration and VPN traffic patterns. These elements should be taken in to consideration as part of your capacity planning.
Licensed features
A/S = Active/Standby; A/A = Active/Active