What replaces the ASA5506?
The FPR1010 and FPR1010E are direct replacements for the ASA5506-X.
Cisco Support for the ASA5506 Adaptive Security Appliance will cease in August 2026 and Cisco recommends that Customers with ASA5506-X products migrate to the Firepower 1000 series firewalls.
The direct replacement for the ASA5506 would be the FPR1010 / FPR1010E which can be configured as an ASA initially and reimaged as an FPR NGFW as required.
Assuming your ASA5506 is running as an ASA then the transition to the FPR1010-ASA should be straightforward.
If, however, you would like to upgrade from the Layer 4 ASA Firewall to a Layer 7 NGFW then Cisco recommend the FPR1010-NGFW-K9.
Layer 4 is the OSI Transport Layer, where TCP and UDP function.
Layer 7 is the OSI Application Layer, where Apps such as Facebook and Linkdin function – if you want to manage these then you need NGFW.
Table of Contents
Replace your ASA5506 with an FPR1010 ASA
| ASA5500-X | Max Performance | FRP1010 Models | Max Performance |
|---|---|---|---|
|
ASA5506-X |
FW 750Mbs |
FPR1010-ASA-K9 |
Statefull FW 2Gbps |
|
|
|
FPR1010E-ASA-K9 (No PoE) |
Statefull FW 2Gbps |
Correct as at July 2023 – latest specifications are available on cisco.com
Note that the ASA5506-X refers to the following Cisco ASA 5506 models running the ASA image without any Firepower FTD enabled or installed.
- ASA5506
- ASA5506-K8
- ASA5506-K9
The FPR1010-ASA-K9 and the FPR1010-NGFW-K9 are the same device, the only difference is the image that is shipped from the factory. So an FPR1010-ASA-K9 can become an FPR1010-NGFW-K9 (and vice versa) simply by re-imaging the device.
The move from ASA5506 to FPR1010-ASA-K9 provides increased performance and support life, plus the option to upgrade to NGFW at some point.
The FPR1010E is an FPR1010 but without Power over Ethernet (PoE) which is available on ports 7 and 8 on the 1010 version.
The Firepower 1010E does not support ASDM 7.19(1) or ASA 9.19(1).
Soure Cisco Secure ASA Compatibility
The FPR1010-ASA is a direct replacement for the ASA5506 and will provide improved performance plus a path to upgrade beyond access control and traffic filtering.
With very few changes, the configuration from your ASA5506 can be pasted directly into your ASA imaged FPR1010, and the only requirement is for the essential license be available in your Smart Account.
Cisco has published a guide for transferring your ASA5500 configuration to the FPR1010 here.
ASA5506 to FPR1010-ASA Requirements
As a minimum the FPR1010 requires an essentials feature license to function with the ASA image, additional licenses can be purchased to enable 3DES, failover, and Cisco Secure Client (AnyConnect).
Replace your ASA5506 with an FPR1010-ASA-K9
Buy FPR1010-ASA-K9 or FPR1010-ASA-K9-RF
The FPR1010-ASA-K9 is a direct replacement for your ASA5506-X.
Offering up to 2Gbps Firewall performance and running the ASA Firewall image it will (mostly) accept your existing ASA Config for a minimum downtime hardware upgrade.
Our FPR1010-ASA-K9 is delivered direct from Cisco, will be fully licensed and eligible for Smart Net support should you require it.
We also offer the FPR1010-ASA-K9-RF from Cisco Refresh and FPR1010-ASA-K9-WS from Cisco Excess, these models will be cheaper but can be in short supply.
FPR1000-ASA FPR1010 Essentials License - required
Your FPR1010 needs to have an essentials license available in your Cisco Smart Account to register against the device. We include this with our FPR1010-ASA-K9 products but FPR devices from other suppliers may not have this license so we can obtain it for you and provision it to your Smart Account.
Don’t have a Smart Account? Sign up for one here.
Cisco Smart Net for FPR1010-ASA-K9
CON-SW-FPR1010 FPR1010 Cisco Software Support - optional
Cisco Smart Net is Cisco’s award winning support service.
By adding a support contract to your FPR you will gain access to the latest versions of both the ASA and FTD software images, as well as obtaining direct access to Cisco Engineers to assist in the setup and migration of your ASA.
Note that to be eligible for Smart Net your FPR needs to be purchased from an authorized source.
CON-SNT-FPR1010 FPR1010 Cisco Smart Net - recommended
All FPR1010 Smart Net contracts include Software Support which is required to obtain the latest ASA or FTD Images.
The SNT version of Smart Net includes Next Business Day hardware replacement should your FPR1010 develop a fault.
FPR1K-ENC-K9 Strong Encryption (3DES/AES) License
Insufficient Cisco Firepower 1K Series ASA Strong Encryption (3DES/AES) Licenses
When the Cisco Firepower 1K Series ASA Strong Encryption (3DES/AES) has been applied you may received an “insufficient licenses” message, this denotes that your Smart Account does not have enough FPR1K-ENC-K9 Licenses and they need to be provisioned. The licenses are free but we charge for the admin required to obtain them.
FPR1K-ENC-K9 Strong Encryption (3DES/AES) License
Once the above Essentials License has been registered the Smart Software Manager will also apply the Strong Encryption License – but only if your Smart Account has permission.
If your Smart Account is not authorized for strong encryption you can (subject to Cisco approval) manually add a strong encryption license to your Smart account to enable the 3DES/AES.
FPR1010-ASA-K9 High Availability Failover
FPR1010-SEC-PL 1010 ASA - Security Plus License
When running with an ASA image the FPR1010 requires a security plus license to enable high availability (HA) failover.
Each FPR1010-ASA needs this license applied before failover can be configured.
Replace your ASA5506 with an FPR1010 NGFW
| ASA5500-X | Max Performance | FRP1010 Models | Max Performance |
|---|---|---|---|
|
ASA5506-X |
FW + AVC + IPS 125Mbs |
FPR1010-NGFW-K9 |
FW + AVC + IPS 880Mpbs |
|
|
|
FPR1010E-NGFW-K9 (No PoE) |
FW + AVC + IPS 880Mpbs |
Correct as at July 2023 – latest specifications are available on cisco.com
Note that the ASA5506-X refers to the following Cisco ASA 5506 models with Firepower Services.
- ASA5506-SEC-BUN-K8
- ASA5506-SEC-BUN-K9
- ASA5506H-SP-BUN-K8
- ASA5506H-SP-BUN-K9
- ASA5506-K8
- ASA5506-K9
- ASA5506-FTD-K9
- ASA5506-FPWR-BUN
- ASA5506H-FPWR-BUN
The FPR1010E is an FPR1010 but without Power over Ethernet (PoE) which is available on ports 7 and 8 on the 1010 version.
The FPR1010-ASA and the FPR1010-NGFW are essentially the same device, the only difference being the image that the device is currently running.
Loading the NGFW image adds application visibility and control and can be licensed to also provide:
- Next Gen IPS (NGIPS)
- Malware Protection
- URL Filtering
FPR1000 Rack Mounted Models
| Features | FPR1120 | FPR1140 | FPR1150 |
|---|---|---|---|
|
Throughput |
4.5Gbps |
6Gbps |
7.5Gbs |
|
Connections |
200k |
400k |
600k |