ASA 5516-X Intermittent Downtime
-
I think in a lot of cases people don't have HA where they need it. And then have it where they don't need it.
If you connect branch offices in a hub spoke architecture that suggest immediately that you probably need HA at the hub. Because if the hub fails everything fails.
-
@Dashrender said in ASA 5516-X Intermittent Downtime:
@travisdh1 said in ASA 5516-X Intermittent Downtime:
Better to replace the thing so soon as the current support agreement runs out.
Not sure I agree with even that - replace with UBNT now, toss a spare on the shelf, and have less worries, concerns going forward.. no waiting on the cisco repair crew.
I think you can afford 10 spares on the shelf not just one.
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
I think in a lot of cases people don't have HA where they need it. And then have it where they don't need it.
And not just for networking. It's like this for everything.
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
If you connect branch offices in a hub spoke architecture that suggest immediately that you probably need HA at the hub. Because if the hub fails everything fails.
Only if the hub brings down functionality at the sites and the cost of site downtime is large over a very short period of time.
-
@Emad-R said in ASA 5516-X Intermittent Downtime:
@Dashrender said in ASA 5516-X Intermittent Downtime:
@travisdh1 said in ASA 5516-X Intermittent Downtime:
Better to replace the thing so soon as the current support agreement runs out.
Not sure I agree with even that - replace with UBNT now, toss a spare on the shelf, and have less worries, concerns going forward.. no waiting on the cisco repair crew.
I think you can afford 10 spares on the shelf not just one.
That's what we do where needed. A spare is SO cheap, and so much faster than any support contract.
-
@Jimmy9008 said in ASA 5516-X Intermittent Downtime:
I've contacted Cisco already, but that response could be slow, so just asking for troubleshooting tips...
If this is a concern, that alone should rule out keeping it. If you don't trust Cisco 100%, the ASA is worthless as the entire value of an ASA is in the organization's perceived value of Cisco support.
-
@Jimmy9008 said in ASA 5516-X Intermittent Downtime:
Its under support until July 2020. Just trying to make sure I have done all I can before Cisco call back. Would I be right to say the SSD light should be solid green?
That's pretty soon. Is the value of your time and the company's downtime so trivial to make keeping the ASA make sense? Basically you have to work for free and the company has to have zero loss from downtime to make that ASA worth keeping. Even with the sunk cost of support, it has a negative value to the business.
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
Now you are paying the price for not having the right setup in the first place.
With the big mistake being that it is a Cisco ASA. The cost of "support" on that ASA, and the cost of the ASA itself, are really high. That same money could have been cut by like 90%, better gear purchased, and backup gear purchased. Then if something went wrong, you could replace in minutes and have no questions like this. Both the quality of the gear and the useless support make the ASA one of the worst choices out there. Every aspect of it is a problem. Even if you "already own it" and are "under support" it's a bad deal. If you handed me a brand new ASA and a new ten year support contract, I'd just dump it straight in the trash. It has literally zero value because it is too costly to operate compared to better gear.
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
I would go up the food chain and ask how important this connection is. If it's important, have a new one shipped out immediately.
Agreed. But where a "new one" is something you can really support and get back up and running quickly, not another ASA.
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
And if they want HA, which it sounds like they should, Edgerouter is a no-go.
It can do VRRP but it can't sync connections or configuration so it's basically useless for anything mission-critical.They bought Cisco, so HA and mission critical are the polar opposite of their decision making so far. So nothing looks like HA is needed. EdgeRouter isn't HA, that's totally correct, but given that Cisco was chosen, HA can't be even the most remote need or else their previous decision making was absolutely backwards (looking at their decisions and perceiving HA needs would be like looking at a Mazda Miata and assuming that they need big rig hauling.)
EdgeRouters don't do full HA, but can be swapped out in minutes with a spare on the shelf. So unless their needs are wildly different than they are acting like they are, the only question is if one EdgeRouter is enough because waiting on Amazon to ship the second $150 unit is fast enough or if having a spare ready to go makes sense.
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
From this: "Overnight around 3am, all office locations globally lose access to London".
And from this: "I get a call at about 4am"How does that suggest HA? It suggests that they have a VPN that lost connectivity, it tells us nothing of the value of that connection.
That he got a call only an hour later tells us that for an hour, it wasn't deemed important enough to mention.
So while HA isn't ruled out by any of this, it certainly isn't suggested.
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
5516-X is a midrange device. I've mostly used the older series but there is nothing wrong with the ASA. If it's fast enough for the WAN link, it will get the job done.
I think calling it midrange is pushing it. Maybe midrange for an ASA. But if I see an ASA, I classify that as a high end consumer device (sub-entry level for business.) The support problems and costs from Cisco make it unable to compete with entry level devices (or higher.) Assuming that the EdgeRouter is the more bare bones, entry level business device, and the ASA falls wildly below it, that's the industry bar at this point.
We support a lot of ASA and they are slow, flaky, and require a fortune to be able to get "nearly" to the level of a cheap EdgeRouter. That's pretty awful.
I wouldn't say that there is nothing wrong with it. Everything is wrong with it. It costs too much, and support isn't good enough to overcome the problems caused by the cost (like lacking a spare.) The ASA is down, so at this point, literally not getting the job done. It doesn't meet the basic need of functional connectivity at this point, nor the IT/business need of being a good tool for the job (which always takes cost and performance into consideration.) So I'd say it isn't doing the job.
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
@travisdh1 said in ASA 5516-X Intermittent Downtime:
If you can't afford 5 minutes of downtime, you shouldn't be using an ASA in the first place.
You mean it takes 5 minutes from the time something stops working until the users have noticed and told their manager, who then managed to get hold of the right people, and then in turn had to call the guy who could get the job done, who would be immediately available to commute or drive or take a cab to work and do the troubleshooting and finally replace the firewall?
He means that by using an ASA, you are accepting that five (or more) minutes of downtime are part and parcel with the decision. LIkely way more downtime.
Similar to an EdgeRouter. By choosing Ubiquiti gear you are accepting that a few minutes of downtime are acceptable versus the cost of avoiding more downtime (by using more expensive true HA gear.)
-
@Pete-S said in ASA 5516-X Intermittent Downtime:
On the contrary, it tells us a lot about the business needs. Since the business decided to call him in the middle of the night, someone decided the firewall was important enough for them to do that, instead of waiting until the morning.
Maybe nobody brought up the HA option when the firewall was put in place or the need wasn't there at the time.That someone was willing to call to report an issue truly tells us nothing. I get called off hours about truly worthless things all the time. Just because one person thinks that they should call and knows how to call doesn't mean that someone has assessed value. But that someone didn't buy HA tells us that at least at some point, someone decided HA wasn't worth it. That might have changed, and maybe they were wrong even at the time, but that decision of HA or no HA was made and a design built around that.
The business isn't who necessarily called him, that denotes a key decision maker representing the company. All we really know is that someone working at a site decided to notify him. Fall all we know that was an intern who just happened to find his phone number. Or it was the CEO, we just don't know. That someone decided to call because they noticed something has to be taken with a grain of salt as we don't know who they were, or what they expected. Maybe they thought support was 24x7 and that it was their job to report things by phone whenever they happen. That's not uncommon and wouldn't give us any insight into the business' evaluation of the need.
