Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I need to configure BGP on an ASA 5505, according to certain sources it isn't supported, yet I can find resources on the internet giving information on how to configure BGP.

I'd really like an expert to answer some queries for me.

  1. Can you configure BGP on the ASA 5505?

    1b. if you can't, what can you use in its place?

share|improve this question

5 Answers 5

ASA doesn't support BGP whatever the model.
This information is in the documentation, see http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/glossary.html#wp1027964

share|improve this answer
    
So if you need BGP what do you use? Cisco ASA just completely lacks any options for it?? I find this rather strange as a linux server can support BGP yet this expensive router that is supposed to do everything cannot? –  sorrrydoctorforlove Apr 27 '10 at 5:56
4  
@sorrydoctorforlove: ASA stands for (Adapated Security Device). Basically they are VPN/Firewall devices with some extras like NAT so they are not routers. Cisco also makes routers, which of course support BGP. –  Kyle Brandt Apr 27 '10 at 11:56
    
I think that BGP is not available on ASA because if you do BGP it's probably because you're connected to internet. This would mean that your routing protocol is running directly on a device in front of internet. And doing a denial of service of a device in front of internet is quite easy, if the ASA get it's CPU to 100% because of an attack, BGP process could not run correctly and you could lost your routing process. So BGP is done on a router behing the firewall. –  radius Apr 28 '10 at 5:26
    
Em, why would you put a BGP router behind a firewall?!? It's a lot easier to DOS a firewall than it is a router as the firewall has to keep state. Routers only care about source and destination, they don't have to keep track of state, so they can handle a far far higher amount of traffic than any firewall. Yes, put put the management ports behind firewalls and a VPN if possible, but putting the BGP talking ports behind a firewall is a recipe for disaster. –  Niall Donegan Feb 7 '11 at 18:01
1  
As of April 2014, ASA software versions 9.2(x) now supports BGP. Finally! See my answer to this question for details. –  Mister_Tom Jul 10 at 19:15

I see that this question was asked in April 2010. Good news is that four years later (April 2014) Cisco released ASA software version 9.2(x) with new BGP support! See the ASA 9.2(x) release notes for details. If you're using the ASA 5505, you should review the 5505 RAM requirements listed in the release notes.

ASA users have been asking for this feature for a long time - it's good to finally see it delivered :-).

share|improve this answer
    
One unfortunate change from release notes: "ASA 5510, ASA 5520, ASA 5540, ASA 5550, and ASA 5580 are not supported in this release or later. ASA Version 9.1 was the final release for these models." –  Mister_Tom Jul 10 at 21:37

According to this document, the dynamic routing protocols supported by the ASA 5500 Series are:

  • OPSF
  • EIGRP
  • RIP

Which may be a substitute for whatever you are trying to do with BGP. You likely want EIGRP if your network isn't too big, it is all cisco, as it is simple to set up.

share|improve this answer

Cisco considers its firewalls—the ASA models—to be a separate product line from its routers. While the ASAs do basic routing, they do not have all the capabilities of a dedicated router. They support RIP, OSPF, and EIGRP, but not BGP. (In the same way, Cisco routers have firewall capabilities, but nothing like what the ASAs can do.)

As you know, they have a huge selection of routers. Most can do BGP. Find the one that meets your needs (here’s a starting point) and put it in front of your ASA.

share|improve this answer

Juniper SRX, Checkpoint, or Fortigate firewalls. Don't let people tell you firewalls can't do routing. It's nonsense. Cisco can't do it, because ASA's are poor firewalls.

share|improve this answer
1  
The ASA's do route, they just aren't sold as ROUTERS. –  Mark Nov 30 '12 at 15:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.