Cisco ASA 5520 (ASA5520-K8) Replacement & Migration Guide

If you still have a Cisco ASA 5520 (PID ASA5520-K8) inspecting traffic at a perimeter or terminating site-to-site tunnels, it is well past time to plan its retirement. This was a capable enterprise firewall in its day, but it predates the entire modern threat-defense era, and Cisco closed the book on it years ago. This guide explains exactly where the 5520 stands in its lifecycle, why running it today is a measurable risk rather than a deferred one, what the ASA 5545-X gives you in its place, and how to execute a clean migration that survives an audit.

Where the ASA 5520 sits in its lifecycle

The ASA 5520 is fully end-of-life. Cisco announced End of Sale on September 16, 2013, and the appliance reached its Last Day of Support (LDoS) on September 30, 2018. Every milestone in Cisco's published lifecycle has now passed, which means there is no path to a supported configuration without replacing the hardware. You can review the full milestone breakdown on our ASA 5520 EoL detail page.

What each milestone actually means in practice

• End of Sale (2013-09-16): Cisco stopped selling new ASA 5520 units. Any 5520 acquired after this date came from secondary-market or used channels, with no manufacturer warranty.
• Last Day of Support / LDoS (2018-09-30): the hard stop. After this date Cisco provides no software maintenance, no PSIRT security fixes, no TAC engagement, and no hardware RMA. A failed power supply or a newly disclosed CVE has no vendor remedy.
• Today (2026): the appliance is roughly eight years past LDoS. The ASA software train it runs (8.x/9.0-era code) has long since stopped receiving fixes, so any vulnerability disclosed in that codebase since 2018 remains unpatched on your device.

The recommended replacement: ASA 5545-X

Cisco's migration bulletin pointed ASA 5520 owners to the ASA 5500-X Series, and the direct enterprise-class successor is the Cisco ASA 5545-X (PID ASA5545-X). It is not a refreshed 5520; it is a different generation of platform built on a multi-core x86 architecture, and the performance and feature gap is large.

Concretely what is better

• Throughput: the 5520 topped out near 450 Mbps stateful firewall throughput; the 5545-X delivers up to roughly 3 Gbps firewall throughput and about 1.5 Gbps with services running. For most sites that means the firewall stops being the bottleneck on a gigabit or multi-gig WAN.
• VPN scale: the 5520 supported 750 IPsec peers and a default of only 2 SSL VPN sessions; the 5545-X scales to 2,500 AnyConnect/clientless SSL VPN sessions and far higher IPsec capacity, with hardware crypto acceleration for AES-256/SHA-2.
• Interfaces: the 5520 offered four 10/100/1000 copper ports; the 5545-X ships with eight built-in GE interfaces plus a network module slot for additional copper or fiber (SFP) connectivity, giving you room for redundant uplinks and DMZ segmentation without an external switch.
• Next-gen services: this is the headline. The 5520 was a stateful/IPsec firewall with no integrated IPS or application visibility. The 5545-X can run FirePOWER Services (NGIPS, Application Visibility and Control, URL filtering, and Advanced Malware Protection), bringing genuine next-generation firewall capability to the same rack slot.
• Software direction: the 5545-X can run classic ASA software OR be re-imaged to Firepower Threat Defense (FTD), Cisco's unified NGFW image managed by Firepower Management Center (FMC) or Firewall Device Manager (FDM). This decision shapes your whole migration (see below).

ASA software vs. FTD: the one decision that drives everything

Before you touch a cable, decide whether the 5545-X will run classic ASA software or Firepower Threat Defense (FTD). The two paths have very different migration efforts. Staying on ASA software preserves your familiar CLI, ASDM, and existing config logic, making this a near-lift-and-shift, but it forgoes the unified NGFW management model. Moving to FTD unlocks centralized policy in FMC, deeper application/threat inspection, and aligns you with where Cisco's roadmap actually went, but your old ASA config does not port directly. Cisco's Firepower Migration Tool can convert an ASA configuration into an FTD policy, and it handles interfaces, NAT, ACLs, and objects well, while flagging unsupported constructs for manual review.

A practical migration plan

1. Assessment and inventory

Pull show running-config, show version, and show interface from the live 5520. Document every interface and security level, all NAT rules, every access-list and object-group, your VPN topology (site-to-site peers, crypto maps, transform sets, and any remote-access/WebVPN profiles), routing (static and any OSPF/EIGRP), and AAA/management settings. Note throughput and peak connection counts so you size the 5545-X (or 1100/3100) correctly rather than guessing.

2. License transition

This is where old and new diverge most. The 5520 used PAK activation keys tied to the chassis serial; those licenses do not migrate. The 5545-X uses Cisco Smart Licensing, with capabilities provisioned through your Smart Account: a base license plus optional Security Plus, AnyConnect (Plus/Apex/VPN Only) for remote access, and term subscriptions for FirePOWER services (Threat, Malware, URL Filtering). Set up or confirm your Smart Account before delivery so the appliance registers cleanly and entitlements are visible day one.

3. Config and feature parity

On the ASA-software path, port your config in stages: interfaces and security levels first, then objects and ACLs, then NAT, then VPN. Watch for deprecated syntax (newer ASA trains rewrote NAT and removed some legacy commands), and re-verify crypto: retire weak transforms (DES/3DES, MD5) and standardize on AES-256/SHA-256 now that you have hardware acceleration for it. On the FTD path, run the Firepower Migration Tool, then manually reconcile anything it flags, especially complex NAT and identity-based rules. Either way, treat the migration as a chance to remove years of stale rules rather than copying them forward.

4. Physical: rack, power, and uplinks

• Both the 5520 and 5545-X are 1RU appliances, so the rack footprint is unchanged; confirm rail kit compatibility for your cabinet.
• The 5545-X draws more power and benefits from its dual-PSU option for redundancy. Verify your PDU capacity and consider redundant power if the old box ran single-supply.
• Plan uplinks for eight GE ports plus the module slot. If you need fiber to a distribution switch, order the correct SFP optics with the appliance; the 5520's fixed copper ports gave you no optic choice, so this is new procurement.
• If you run an active/standby HA pair today, you will need two 5545-X units and a dedicated failover/state link, just as with the 5520, but verify interface mapping so the failover config lines up.

5. Phased cutover

Stage and fully configure the 5545-X offline, then validate against a test segment or in a lab before it sees production traffic. For HA environments, the cleanest cutover is to build the new pair, replicate config, and swing traffic during a maintenance window with the old 5520 kept powered and cabled as an immediate rollback for 24-72 hours. Validate in order: link/interface state, routing, NAT, then VPN tunnels (re-key site-to-site peers and confirm Phase 1/Phase 2), then remote-access logins, then logging/SNMP to your SIEM. Only decommission once a full business cycle has passed clean.

6. Secure decommission

The retired 5520 still holds sensitive material: PSK and certificate keying, AAA secrets, ACL topology, and VPN peer addresses. Erase configuration with write erase, clear any stored crypto material, and for high-assurance or classified environments follow your NIST 800-88 media sanitization procedure for the device's flash. Record the chassis serial against your asset register and dispose through a certified e-waste or partner trade-in channel rather than general surplus.

Procurement notes for government and enterprise

• TAA compliance: request TAA-compliant configurations and country-of-origin documentation up front for federal, DoD, and SLED orders; confirm the exact PID on the quote.
• Authorized partner sourcing: buy through an authorized Cisco partner so warranty, SmartNet/Success Tracks support, and Smart Licensing entitlements register to your account correctly, and so you avoid grey-market hardware that Cisco will refuse to support.
• GPC and payment: in-threshold orders can be placed on Government Purchase Card; larger refreshes can run through standard PO terms or contract vehicles.
• Lead times: plan ahead. NGFW appliances and matching optics can carry multi-week lead times, and you do not want an unsupported firewall in production longer than necessary while you wait on stock.

Browse the replacement hardware and current Secure Firewall equivalents in our catalog, see the full lifecycle detail on the EoL hub, and when you are ready to size and price a one-for-one refresh, get a quote and we will spec the right ASA 5545-X or Secure Firewall configuration, license tier, and optics for your environment.