Top Qs
Timeline
Chat
Perspective
Cisco ASA
Line of computer network security devices From Wikipedia, the free encyclopedia
Remove ads
In computer networking, Cisco ASA 5500 Series Adaptive Security Appliances, or simply Cisco ASA, is Cisco's line of network security devices introduced in May 2005.[1] It succeeded three existing lines of Cisco products:
- Cisco PIX, which provided firewall and network address translation (NAT) functions, ended its sale on July 28, 2008.[2]
- Cisco's IPS 4200 Series, which worked as an intrusion prevention system (IPS).
- Cisco VPN 3000 Series Concentrators, which provided virtual private networking (VPN).
 | This article contains promotional content. (July 2024) |
The Cisco ASA is a unified threat management device which combines several network security functions.[3]
Remove ads
Reception and criticism
Summarize
Perspective
Cisco ASA has become one of the most widely used firewall/VPN solutions for small to medium-sized businesses. Early reviews indicated the Cisco GUI tools for managing the device were lacking.[4]
A security flaw was identified when users customized the Clientless SSL VPN option of their ASA's but was rectified in 2015.[5] Another flaw in a WebVPN feature was fixed in 2018.[6]
In 2017 The Shadow Brokers revealed the existence of two privilege escalation exploits against the ASA called EPICBANANA[7] and EXTRABACON.[8][9] A code insertion implant called BANANAGLEE, was made persistent by JETPLOW.[10]
Features
The Cisco Adaptive Security Appliance (ASA) integrates multiple advanced security features in one platform:
- Firewall and packet inspection: Supports both stateless and stateful firewalling, reflexive and time-based ACLs, and Context-Based Access Control (CBAC) for maintaining session state and preventing spoofing.[11]
- Intrusion Prevention System (IPS): Built‑in next-generation IPS engine offers inline detection and prevention of threats.[12]
- Virtual Private Network (VPN): Provides IPsec, SSL VPN, AnyConnect, and clientless VPN capabilities. Supports posture assessment, clustering, and high scalability.[13]
- Antivirus, anti‑spam, and content inspection: Offers deep packet inspection for HTTP, FTP, and email traffic to block malware and spam.[12]
- High availability & clustering: Supports active/standby and active/active failover, stateful failover, and multi-node clustering for redundancy and throughput scaling.[14]
- Advanced routing: Supports static and dynamic routing (OSPF, EIGRP, RIP), and deployable in routed (Layer 3) or transparent (Layer 2) firewall modes.[11]
- Context-aware and identity‑based security: Integrates with Cisco TrustSec and identity-based firewall policies for user/device-level control.[12]
- Hardware/software acceleration: Features hardware-assisted encryption (Suite B), ASA Virtual supports Intel QuickAssist (QAT), and application visibility and control services.[11]
- Certificate enrollment and EST / EdDSA support: Supports EST for automated certificate enrollment and key types including EdDSA in ASA 9.16+ releases.[15]
- Logging and telemetry: NetFlow Security Event Logging, syslog export, and management via ASDM/CSM for centralized visibility.[13]
- Virtual security contexts & licensing: Supports multiple virtual contexts (up to 10+ in mid-range models; more on high-end); licensing controls features like VPN peers, IPS, GTP inspection, clustering, and posture assessment.[14]
- Integration within Cisco Secure ecosystem: Works alongside SecureX, Cloud Web Security, AMP, Firepower Threat Defense, and Cisco Security Intelligence Operations.[12]
Remove ads
Architecture
Summarize
Perspective
The ASA software is based on Linux. It runs a single Executable and Linkable Format program called lina. This schedules processes internally rather than using the Linux facilities.[16] In the boot sequence a boot loader called ROMMON (ROM monitor) starts, loads a Linux kernel, which then loads the lina_monitor, which then loads lina. The ROMMON also has a command line that can be used to load or select other software images and configurations. The names of firmware files includes a version indicator, -smp means it is for a symmetrical multiprocessor (and 64 bit architecture), and different parts also indicate if 3DES or AES is supported or not.[16]
The ASA software has a similar interface to the Cisco IOS software on routers. There is a command line interface (CLI) that can be used to query operate or configure the device. In config mode the configuration statements are entered. The configuration is initially in memory as a running-config but would normally be saved to flash memory.[16]
Remove ads
Options
The 5512-X, 5515-X, 5525-X, 5545-X and 5555-X can have an extra interface card added.[18]
The 5585-X has options for SSP. SSP stands for security services processor.[19] These range in processing power by a factor of 10, from SSP-10 SSP-20, SSP-40 and SSP-60. The ASA 5585-X has a slot for an I/O module. This slot can be subdivided into two half width modules.[20]
On the low end models, some features are limited, and uncrippling happens with installation of a Security Plus License. This enables more VLANs, or VPN peers, and also high availability.[18] Cisco AnyConnect is an extra licensable feature which operates IPSec or SSL tunnels to clients on PCs, iPhones or iPads.[21]
Models
Summarize
Perspective
The 5505 introduced in 2010 was a desktop unit designed for small enterprises or branch offices. It included features to reduce the need for other equipment, such as an inbuilt switch, and power over Ethernet ports.[22] The 5585-X is a higher powered unit for datacenters introduced in 2010.[23] It runs in 32-bit mode on an Intel architecture Atom chip.[16]
Cisco determined that most of the low end devices had too little capacity to include the features needed, such as anti-virus, or sandboxing, and so introduced a new line of next-generation firewalls called Firepower. These run in 64-bit mode.[16]
- Models as of 2018[18]
Remove ads
References
External links
Wikiwand - on
Seamless Wikipedia browsing. On steroids.
Remove ads