Please enable JavaScript.

Coggle requires JavaScript to display documents.

ASA - Coggle Diagram

- - - - This model is suitable for small office and home office (SOHO) and small business.
    - - These models that are intended for the Internet edge of medium to large businesses.
    - - This figure displays a 4100 series ASA that is intended for large campus and data center use.
    - - Designed for service providers and high-performance data centers, the 9300 appliance delivers carrier-grade performance in a modular chassis. It creates separate logical firewalls for deployment flexibility, quickly inspects encrypted traffic, gains application visibility, detects and blocks network intrusions, deploys scalable VPNs, and provides integrated protection against DDoS attacks. Devices can be clustered for performance and high availability.
  - - - As illustrated, a single ASA can be partitioned into multiple virtual devices. Each virtual device is called a security context. Each context is an independent device, with its own security policy, interfaces, and administrators. Multiple contexts are similar to having multiple standalone devices. Many features are supported in multiple context modes, including routing tables, firewall features, IPS, and management. Some features are not supported, including VPN and dynamic routing protocols.
    - - As shown here, two identical ASAs can be paired into an active / standby failover configuration to provide device redundancy. Both platforms must be identical in software, licensing, memory, and interfaces, including the Security Services Module (SSM). In the example, ASA-1 is the primary/active forwarding device and traffic leaving PC-1 takes the preferred path using ASA-1. ASA-1 and ASA-2 monitor each other using the LAN failover link. If ASA-1 fails, then ASA-2 would immediately assume the primary role and become active.
    - - The ASA provides optional, granular access control based on an association of IP addresses to Windows Active Directory login information. For example, in the figure, when a client attempts to access the server resources, it must first be authenticated using the Microsoft Active Directory Identity-based firewall services. These services enhance the existing access control and security policy mechanisms by allowing users, or groups, to be specified in place of source IP addresses. Identity-based security policies can be interleaved without restriction between traditional IP address-based rules.