4

I need to configure BGP on an ASA 5505, according to certain sources it isn't supported, yet I can find resources on the internet giving information on how to configure BGP.

I'd really like an expert to answer some queries for me.

  1. Can you configure BGP on the ASA 5505?

    1b. if you can't, what can you use in its place?

Improve this question

5 Answers 5

Reset to default
5

I see that this question was asked in April 2010. Good news is that four years later (April 2014) Cisco released ASA software version 9.2(x) with new BGP support! See the ASA 9.2(x) release notes for details. If you're using the ASA 5505, you should review the 5505 RAM requirements listed in the release notes.

ASA users have been asking for this feature for a long time - it's good to finally see it delivered :-).

Improve this answer
1
  • One unfortunate change from release notes: "ASA 5510, ASA 5520, ASA 5540, ASA 5550, and ASA 5580 are not supported in this release or later. ASA Version 9.1 was the final release for these models."
    – Mister_Tom
    Jul 10, 2014 at 21:37
5

ASA doesn't support BGP whatever the model.
This information is in the documentation, see http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/glossary.html#wp1027964

Update

BGP is supported on ASA from v9.2 (release notes).

Configuration examples are available. The keywords are similar to IOS.

router bgp 100
 bgp log-neighbor-changes
 bgp bestpath compare-routerid
 address-family ipv4 unicast
  neighbor 203.0.113.2 remote-as 200
  neighbor 203.0.113.2 activate
  network 192.168.10.0 mask 255.255.255.0
  network 172.16.20.0 mask 255.255.255.0
  network 10.106.44.0 mask 255.255.255.0
  no auto-summary
  no synchronization
 exit-address-family
!
Improve this answer
5
  • So if you need BGP what do you use? Cisco ASA just completely lacks any options for it?? I find this rather strange as a linux server can support BGP yet this expensive router that is supposed to do everything cannot?
    – sorrrydoctorforlove
    Apr 27, 2010 at 5:56
  • 4
    @sorrydoctorforlove: ASA stands for (Adapated Security Device). Basically they are VPN/Firewall devices with some extras like NAT so they are not routers. Cisco also makes routers, which of course support BGP.
    – Kyle Brandt
    Apr 27, 2010 at 11:56
  • I think that BGP is not available on ASA because if you do BGP it's probably because you're connected to internet. This would mean that your routing protocol is running directly on a device in front of internet. And doing a denial of service of a device in front of internet is quite easy, if the ASA get it's CPU to 100% because of an attack, BGP process could not run correctly and you could lost your routing process. So BGP is done on a router behing the firewall.
    – radius
    Apr 28, 2010 at 5:26
  • Em, why would you put a BGP router behind a firewall?!? It's a lot easier to DOS a firewall than it is a router as the firewall has to keep state. Routers only care about source and destination, they don't have to keep track of state, so they can handle a far far higher amount of traffic than any firewall. Yes, put put the management ports behind firewalls and a VPN if possible, but putting the BGP talking ports behind a firewall is a recipe for disaster.
    – Niall Donegan
    Feb 7, 2011 at 18:01
  • 1
    As of April 2014, ASA software versions 9.2(x) now supports BGP. Finally! See my answer to this question for details.
    – Mister_Tom
    Jul 10, 2014 at 19:15
0

According to this document, the dynamic routing protocols supported by the ASA 5500 Series are:

  • OPSF
  • EIGRP
  • RIP

Which may be a substitute for whatever you are trying to do with BGP. You likely want EIGRP if your network isn't too big, it is all cisco, as it is simple to set up.

Improve this answer
0

Cisco considers its firewalls—the ASA models—to be a separate product line from its routers. While the ASAs do basic routing, they do not have all the capabilities of a dedicated router. They support RIP, OSPF, and EIGRP, but not BGP. (In the same way, Cisco routers have firewall capabilities, but nothing like what the ASAs can do.)

As you know, they have a huge selection of routers. Most can do BGP. Find the one that meets your needs (here’s a starting point) and put it in front of your ASA.

Improve this answer
-2

Juniper SRX, Checkpoint, or Fortigate firewalls. Don't let people tell you firewalls can't do routing. It's nonsense. Cisco can't do it, because ASA's are poor firewalls.

Improve this answer
1
  • 3
    The ASA's do route, they just aren't sold as ROUTERS.
    – Mark
    Nov 30, 2012 at 15:42

You must log in to answer this question.