Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running website with a good traffic per day.

  • I have two scenarios:

Data Center 1

50 servers currently they are protected with APF(iptables) I'm looking to put a centralized Cisco ASA 5520 firewall in transparent mode.

600K visitors per day with 70 CPS(connections per second) in peak time. with approximately (and 5 million http requests)

Data Center 2 :

15 Servers, Looking at Cisco ASA 5510 firewall 150K visitors per day ( and 1 million http requests )

  • Firewalls option available :

Cisco ASA 5505, 5510, 5520, 5550

Looking for experienced person's opinion.

Thank you.

share|improve this question

I think you will do fine with the ASA5510 on both locations, based on the current load. You don't mention amount of bandwidth, but the ASA5510 can handle about 300 Mbps and roughly 9000 connections/s.

If you feel a 5510 will do the work even with future loads, consider getting a pair of ASA5510 (with security plus license) and run HA with active/passive.

did you take a look at the Cisco ASA comparison chart?

share|improve this answer
What is security plus license ? and bandwidth requirement is not much. 300 Mbps is enough. Does ASA 5520 model support Active/Passive mode for high availability? – Linux Geek May 10 '11 at 7:34
According to the chart, ASA5520 do support A/A and A/S as is, while ASA5510 needs the "security plus" license. Can I ask why you want to do transparent firewall mode?' – 3molo May 10 '11 at 7:44
SecPlus enables the HA features and also enables the first two ports to run in Gigabit mode (four ports in total + management). Looking at the very small price difference between 5510SecPlus and a 5520 I tend to always buy 5520's as you get full Gig ports and higher throughput. But if budgets are tight, as 3molo said, 5510 will do the job (For now). – HampusLi May 10 '11 at 8:12
HampusLi: It seems that 2 GE are included in the standard ASA5510, as per the comparison chart. Iirc, the "2 10/100/1000" was in red text before, indicating that they are available only with proper license.. – 3molo May 10 '11 at 8:25… the mid-range section. Interfaces listed with and without secplus. – HampusLi May 10 '11 at 15:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.