ASA 5540 (ASA5540-K8) End of Life: Migrate to ASA 5545-X

If you still have a Cisco ASA 5540 (PID ASA5540-K8) terminating VPNs or guarding a perimeter, this is the appliance to replace first. It went end-of-sale on September 16, 2013, and crossed its Last Day of Support on September 30, 2018 — meaning it has now run for years with no patches, no TAC, and no RMA path. This guide explains what those milestones mean operationally and walks through a concrete migration to the Cisco ASA 5545-X, the ASA 5500-X Series model Cisco named as the successor, with notes on the current Secure Firewall line for net-new buys.

Why the ASA 5540's end of life is a now problem, not a later problem

The ASA 5540 was a capable mid-2000s firewall: a single-core appliance rated at roughly 650 Mbps real-world to 1.65 Gbps maximum stateful firewall throughput, four 10/100/1000 copper data interfaces plus a management port, up to 5,000 IPsec and 2,500 WebVPN/SSL peers, and an expansion slot that took an AIP-SSM module for IPS. Its final supported software was ASA 9.1. What it never had was native next-generation firewall capability — no application visibility, no integrated IPS in software, no URL filtering, no Advanced Malware Protection. It inspects by port and protocol, which is no longer a defensible posture at an internet edge.

The harder issue is support. Once a platform passes LDoS, three things stop at once, and all three are quiet until the day you need them.

• No security patches: Cisco PSIRT no longer produces fixed software for the 5540. When a new CVE lands against the ASA codebase, your only mitigations are configuration workarounds or pulling the box — there is no patched image to install.
• No TAC support: Cisco engineers will not open a case. A 2 a.m. crash or a VPN that stops negotiating is yours to solve alone.
• No hardware replacement: RMA coverage ends, so a failed power supply or chassis means sourcing used parts off the secondary market with no warranty.

What each milestone date actually means

• End of Sale — September 16, 2013: Cisco stopped selling the ASA5540-K8. Any unit acquired after this is refurbished or used, not new.
• End of Software Maintenance: not separately published for this model; in practice maintenance ended with the ASA 9.1 train it tops out at, so it has had no feature or maintenance updates for years.
• Last Day of Support — September 30, 2018: the hard cutoff. After this date no TAC, no RMA, no PSIRT fixes, no contract renewals. Everything after this date is unsupported operation.

The ASA 5545-X — and what it actually gets you

Cisco's bulletin steered 5540 owners to the ASA 5500-X Series, with the ASA 5545-X as the performance-comparable model. It is a meaningful jump, not a like-for-like swap.

• Throughput: ~3 Gbps stateful firewall and roughly 1 Gbps with next-generation (FirePOWER) services enabled — comfortably above the 5540's 1.65 Gbps ceiling, with headroom for inspection the 5540 could never do in software.
• Multicore performance: the 5545-X runs a multi-core Intel platform with 8 GB RAM and an SSD, versus the single-core, RAM-constrained 5540 — the difference shows up under VPN load and deep inspection.
• Interfaces: eight built-in 10/100/1000 ports plus an expansion slot for a 6-port SFP/SFP+ module, giving real fiber uplink options the 5540 lacked.
• VPN scale: up to 2,500 AnyConnect/IPsec peers, with modern TLS 1.2/1.3 and IKEv2 instead of the 5540-era client.
• Next-generation services: the headline change — the 5545-X runs FirePOWER Services / FTD for application control, Snort-based IPS, URL filtering, and AMP, turning a port-based firewall into an NGFW.

The management and licensing model changes too. The 5540 used PAK activation keys glued to the chassis serial; the 5545-X uses Smart Licensing through a Cisco Smart Account, and if you run FTD you manage it through Firepower/Secure Firewall Management Center (FMC) or cloud-delivered FMC rather than ASDM alone. For brand-new procurement in 2026, the current shipping family is the Cisco Secure Firewall 1000/3100 — a 1140 or 3105 is the modern equivalent of a 5545-X and avoids buying into a series that is itself aging. We can quote both so you can weigh refurbished-5545-X cost against new-Secure-Firewall longevity. Browse options in our catalog, and see the full milestone record on the ASA 5540 EoL detail page.

A practical migration plan

1. Assess and inventory

Pull the running config (show running-config), the version and serial (show version), and the active licenses (show activation-key). Document interface roles, NAT statements, ACL counts, VPN peers, and any AIP-SSM IPS policy. Confirm peak throughput from interface counters so you size the replacement correctly rather than over- or under-buying.

2. License transition

Create or confirm your Cisco Smart Account and Virtual Account before hardware arrives. Map old PAK entitlements to new SKUs: AnyConnect/Secure Client user licensing (Plus/Apex or the current Secure Client tiers) and, if adopting FTD, a Threat + Malware + URL subscription. PAK keys from the 5540 do not migrate — plan this as net-new licensing in the budget.

3. Config and feature parity

Because the 5545-X also runs ASA software, most of the 5540 config ports directly: interfaces, object groups, NAT, ACLs, and IKE/IPsec policies need only minor syntax adjustment. Rebuild the VPN remote-access piece on AnyConnect/Secure Client instead of the legacy client. Treat any new NGFW inspection (IPS, URL, AMP) as fresh configuration in FTD/FMC — there is nothing to port because the 5540 never had it. Validate the migrated rule set in a lab against the production config before cutover.

4. Physical and environmental

Both are 1RU. The 5545-X draws more power and runs front-to-back airflow — confirm rack airflow direction and PDU capacity. Plan uplinks: if you are moving from copper GbE to fiber, order the correct SFP optics for the 6-port module ahead of time. Stage the new unit in the rack alongside the 5540 so cutover is a cable move, not a re-rack.

5. Phased cutover

Pre-stage the 5545-X with the migrated config on a management network. Cut over during a maintenance window: move interface cabling, re-establish site-to-site tunnels one peer at a time, then verify remote-access VPN with a pilot user group before opening it to all. Keep the 5540 racked and powered off but reachable for 1-2 weeks as an instant rollback, then decommission.

6. Secure decommission

Wipe configuration and keys before the box leaves the rack. For DoD/federal, follow NIST 800-88 media sanitization — clear flash, remove and destroy or sanitize the storage, and capture a certificate of data destruction for the audit trail. Do not resell or scrap a perimeter firewall with its config or VPN secrets intact.

Procurement notes for government and enterprise buyers

• TAA compliance: confirm country-of-origin documentation for federal contracts. We supply TAA-compliant ASA 5545-X and Secure Firewall units with the paperwork your contracting officer needs.
• Buy from an authorized partner: edge firewalls are a prime target for counterfeits and gray-market hardware with no valid Smart Licensing entitlement. Sourcing through an authorized Cisco partner keeps your warranty, support contract, and license registration clean.
• Payment and contracting: we accept Government Purchase Card (GPC) for in-threshold orders and support standard federal/SLED purchasing vehicles and quote-to-PO workflows.
• Lead times: validate current availability early — pair the hardware quote with the right SmartNet/Success Tracks coverage and Smart Licensing so the replacement lands fully supported on day one.

The ASA 5540 has been unsupported since 2018; every additional month is unpatched edge risk and a standing audit finding. Compare your migration options on the Cisco EoL hub, then get a refresh quote and we will scope an ASA 5545-X or current Secure Firewall replacement — TAA-compliant, correctly licensed, and matched to your throughput and VPN scale.