Cisco Cisco Catalyst 6500 Series 7600 Series ASA Services Module Guía De Información
© 2011 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information.
Page 2 of 6
Q. When would I buy Cisco ASA 5585-X Adaptive Security Appliance instead of a Cisco Catalyst 6500 Series
ASA Services Module?
A. It depends on your deployment. If you have a Cisco Nexus
®
7000 Series deployment, an ASA 5585-X is a
perfect fit. But if you are using a Cisco Catalyst 6500 Series switch, the ASA Services Module is more
appropriate. In the end, it comes down to personal preference - some customers prefer that their firewall be
integrated into the switch, while others want it as a separate appliance. That’s the main advantage of having
the same code base in multiple form factors. In addition, if intrusion prevention is a requirement, the ASA
5585-X appliance is a better choice, since it combines a full-featured firewall and a comprehensive IPS in a
single 2-RU chassis.
Q. How does the ASA Services Module compare with the Firewall Services Module?
A. The Firewall Services Module is based on an older Cisco PIX
®
technology-based architecture. The ASA
Services Module is based on the architecture of the ASA 5585-X; in fact, it runs the same code base. And
while the ASA Services Module is expected to replace the Firewall Services Module over time, the ASA
Services Module is really a new form factor of the ASA 5585-X. The ASA Services Module represents a
dramatic step forward, reaping the performance and feature benefits of the ASA code base and achieving five
times the performance of the Firewall Services Module.
Metric
ASA Services Module
Firewall Services Module
Maximum firewall throughput
20 Gbps
5 Gbps
Multiprotocol firewall throughput
16 Gbps
3 Gbps
Concurrent connections
10,000,000
1,000,000
Connections per second
300,000
100,000
Security contexts
250
250
VLANs
1000
1000
In addition, the major Firewall Services Module capabilities have been ported to the ASA Services Module.
Capability
ASA Services Module
Firewall Services Module
Real-IP ACLs/Global ACLs
Yes
No
Bridge groups
8 bridge groups
4 interfaces each
8 bridge groups
2 interfaces each
Virtual contexts
250 maximum
250 maximum
Mixed-mode
Yes
Yes
Auto-state
Yes
Yes
Route health injection
No
Yes
VPNs
Management only
Management only
Q. Which Cisco Catalyst chassis can run the ASA Services Module?
A. Any Cisco Catalyst 6500-E Series chassis can support the ASA Services Module. Switches older than these
will not work with the ASA Services Module, due to power and cooling limitations. The following switches have
been tested and are supported:
●
WS-C6503-E: 3-slot chassis
●
WS-C6504-E: 4-slot chassis