This Q&A provides answers to the most frequently asked questions about the Cisco PIX products that have reached end-of-sale announcement status.
Q. What products are covered by this end-of-sale (EOS) announcement?
A. This EOS announcement covers all Cisco PIX security appliances, software, accessories, and licenses. Products include Cisco PIX 501, PIX 506E, PIX 515E, PIX 525, and PIX 535 systems and spares; Cisco PIX Software Releases 6.2, 6.3, 7.0, 7.1, 7.2, and 8.0; and all accessory items such as power supplies, I/O cards, memory upgrade kits, VPN Accelerator Card Plus (VAC+) cards, and software licenses.
Q. What are the key EOS dates for the Cisco PIX products?
A. Table 1 shows the key EOS dates for the Cisco PIX products.
Table 1. EOS Dates for Cisco PIX Products
The date when the end of sale and end of life of a product is announced to the general public.
January 28, 2008
End-of-sale date for platforms/bundles
The last date to order the platform and bundles.
July 28, 2008
End-of-sale date for accessories
The last date to order the accessories.
January 27, 2009
End of software maintenance releases
The last date that Cisco Engineering may release any final software maintenance releases or bug fixes. After this date, Cisco Engineering will no longer develop, repair, maintain, or test the product software.
July 28, 2009
End of new service attachment date
For equipment and software that is not covered by a service-and-support contract, this is the last date to order a new service-and-support contract or add the equipment and/or software to an existing service-and-support contract.
July 28, 2009
End of service contract renewals
The last date to extend or renew a service contract for the product. The extension or renewal period cannot extend beyond the last date of support.
October 23, 2012
End of support/end of life
The last date to receive service and support for the product. After this date, all support services for the product are unavailable, and the product becomes obsolete.
July 27, 2013
Q. What is the last Cisco PIX Software release train supported on the Cisco PIX security appliances?
A. The last software release train supported is Cisco PIX Software Release 8.0. Maintenance releases for Cisco PIX Software will continue to be released through July 29, 2009.
Q. When is the last date of support for Cisco PIX security appliances?
A. The Cisco TAC will continue to support Cisco PIX security appliances until July 28, 2013.
Q. Why is Cisco providing a 6-month EOS notice for systems, but a 12-month EOS notice for accessory items and licensing?
A. The 12-month EOS notice for accessory items and licenses is intended to give customers with existing Cisco PIX appliances adequate time to purchase additional licenses or accessories.
Q. What about customers who bought Cisco PIX security appliances just prior to this announcement?
A. Cisco is fully committed to supporting the Cisco PIX security appliances. These products will continue to be supported until July 28, 2013.
Q. Why announce the end of sale now?
A. With an increase in the frequency and sophistication of network attacks, enterprise security needs have evolved. In addition, many governmental compliance regulations such as the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA), and the Sarbanes Oxley Act mandate that network security be assured as part of the day-to-day operations of a business. And demands on the network have changed: New applications such as unified communications, video, and collaboration require the next generation of networks and security.
The Cisco ASA 5500 Series is designed to handle the dynamic and ever-changing security landscape, providing high-performance, highly available services such as application firewalls, intrusion prevention, content security, secure connectivity (SSL/IPsec VPN), and secure unified communications. The Cisco ASA 5500 Series is built upon more than a decade of Cisco innovation in multiple security and networking disciplines, and uses the technology from Cisco PIX Security Appliances, Cisco VPN 3000 Concentrators, and Cisco IPS 4200 Series Appliances, as well as many Cisco IP networking innovations. As a result, the Cisco ASA 5500 Series has already been widely adopted by Cisco PIX customers in its more than two years of sales. The Cisco ASA 5500 platforms offer greater performance, adaptive protection, and better scalability for business of all sizes. Customers are encouraged to migrate to this next-generation product family.
Q. What are the benefits that the Cisco ASA 5500 Series offers?
A. There are many compelling reasons for migrating to the Cisco ASA 5500 Series:
• Adaptive, flexible protection:
– Equal or better pricing provides lower total cost of ownership
– Better performance and scalability of up to 10 Gbps of real-world firewall throughput or up to 20 Gbps of datacenter application throughput (using jumbo frames)
– Superior network protection from ever-changing threats through advanced application firewall, intrusion prevention, content security, and secure unified communications services
– Robust, secure connectivity through IPsec and SSL VPN services
– Innovative security that protects the unified communications infrastructure, call control, phones, and applications
– Highly available, redundant features for active-active and active-standby options
• Mature, next-generation security solution:
– Built upon more than 10 years of innovation in Cisco PIX, Cisco VPN 3000 Series, and Cisco IPS 4200 Series solutions
– Hundreds of thousands of Cisco ASA 5500 Series appliances deployed worldwide
– General Deployment (GD)-quality software
– Multiple industry certifications, including Common Criteria, FIPS, and NEBS
• Enables customers to use their existing Cisco PIX investment:
– Cisco PIX knowledge is directly transferable to the Cisco ASA 5500 Series
– Cisco ASA management and monitoring interfaces are consistent with Cisco PIX interfaces
– Can be managed by Cisco Security Manager; Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS); and many third-party products
Q. Do I need a new management suite to manage the Cisco ASA 5500 Series appliances?
A. No. For single device management, Cisco ASA 5500 Series appliances offer the same integrated Web-based device manager, Cisco Adaptive Security Device Manager (ASDM), and CLI interface. For multi-device management, Cisco Security Manager and Cisco Security MARS, which are used to manage the Cisco PIX appliances, also support managing and monitoring Cisco ASA 5500 Series appliances.
Services and Support
Q. I have an existing Cisco SMARTnet® contract. How do I change the contract to cover a Cisco ASA 5500 Series Adaptive Security Appliance?
A. Contact your contract sales representative at Cisco, or the Cisco partner that arranged the Cisco PIX contract. The representative or partner can arrange to remove coverage for the Cisco PIX appliance and establish coverage for the Cisco ASA 5500 Series Adaptive Security Appliance.
Q. What services are available for Cisco ASA 5500 Series Adaptive Security Appliances?
A. Cisco takes a lifecycle approach to services and offers planning, design, implementation, operation and optimization services for Cisco PIX security appliances and Cisco ASA 5500 Series Adaptive Security Appliances. For the operation phase, Cisco SMARTnet support and Cisco Services for IPS are available, depending on the ASA edition. For the planning, design, and implementation phases, Cisco ASA Migration Services are available from Cisco and from Cisco Security Specialized Partners, and are designed to support your migration from Cisco PIX security appliances to Cisco ASA 5500 Series Adaptive Security Appliances.
Q. What Cisco ASA Migration Services are available?
A. Cisco ASA Remote Migration Service and Cisco ASA Large-Scale Migration Service provide expert guidance and support for aspects of the migration process such as converting configurations, performing a successful cutover, and helping to improve the accuracy and completeness of migration. Table 2 describes the different services.
Table 2. Cisco ASA Migration Services
Cisco ASA Remote Migration Service
This remote service is suitable for a network with a limited Cisco PIX deployment. The service can also be used to augment the capabilities of an operations team with advanced security skills.
• Reviews your configurations and recommends improvements
• Supports the migration process by providing remote knowledge-transfer sessions
• Provides focused escalation support for critical migration change windows
Cisco ASA Large-Scale Migration Service
This remote or onsite services is suitable for a network with an extensive Cisco PIX deployment. The service can also be used to augment the security capabilities of your operations team.
• Reviews your migration plan and recommends improvements
• Reviews your plans for testing, rollback, failure recovery, and risk mitigation, and recommends improvements
• Supports conversion of your Cisco PIX and IPsec VPN configurations to Cisco ASA configurations, providing best practices
• Guides you through firewall cutovers
Q. Will the services ordering process be the same?
A. Yes. The ordering process will be the same. There is no difference in ordering services for Cisco PIX or Cisco ASA appliances.
Q. Where can I get more information about migrating from Cisco PIX to Cisco ASA appliances?