Cisco ASA 5500-X end of life: replacement options, prices and support
Every ASA 5500-X model has now passed its Last Date of Support. The 5512-X and 5515-X ended in August 2022, the 5585-X in May 2023, the 5525-X, 5545-X and 5555-X on September 30, 2025, and the 5506-X, 5508-X and 5516-X on August 31, 2026. Cisco's attack advisory lists six of these models as successfully compromised in a campaign against out-of-support firewalls. Cisco named the Firepower 2100 and 1000 series as replacements; the 2100 is itself past end of sale. Cisco's Secure Firewall 1200 series, released in 2024 and 2025, is the current alternative in this class.
Lifecycle dates by model
| Models | End of Sale | Last Date of Support | Cisco-named migration |
|---|---|---|---|
| ASA 5512-X, 5515-X | August 25, 2017 | August 31, 2022 (ended) | none usable in the bulletin |
| ASA 5585-X | 2018-06 | May 31, 2023 (ended) | see the bulletin |
| ASA 5525-X, 5545-X, 5555-X (incl. -FPWR-K9, -FTD-K9) | September 4, 2020 | September 30, 2025 (ended) | Firepower 2100 |
| ASA 5506-X, 5506H-X, 5506W-X, 5508-X, 5516-X | August 2, 2021 | August 31, 2026 (ended) | Firepower 1000 |
Sources: Cisco end-of-life bulletins for the 5512-X/5515-X, 5585-X, 5525-X/5545-X/5555-X (EOL13130), 5506-X and 5508-X/5516-X (EOL13762). Every part number is on the ASA 5500-X page, re-verified weekly.
The named replacements have aged too. Cisco's 5525-X bulletin says the "migration solution for the ASA5525, ASA5545 & ASA5555 is the Cisco Firepower 2100 Series Appliances". Cisco's Threat Defense compatibility guide lists the Firepower 2110, 2120, 2130 and 2140 with end of sale on May 27, 2025 and end of support on May 31, 2030.
The security position
Cisco's advisory Continued Attacks Against Cisco Firewalls (version 2.3, April 2026) says ASA 5500-X models running releases 9.12 or 9.14 with VPN web services enabled, "which do not support Secure Boot and Trust Anchor technologies, have been observed to be successfully compromised". It lists the 5512-X, 5515-X, 5525-X, 5545-X, 5555-X and 5585-X. The 5506-X, 5508-X and 5516-X support Secure Boot, and for those Cisco states "No successful exploitation of these vulnerabilities and no modifications of ROMMON have been observed". Cisco also states that "no CVE will be assigned to the lack of Secure Boot and Trust Anchor technology support on these platforms".
Final software for each model
| Models | Last ASA release | Last ASA FirePOWER module | Last Threat Defense (FTD) |
|---|---|---|---|
| 5512-X | 9.12 | 6.2.3 | 6.2.3 |
| 5515-X | 9.12 | 6.4.0 | 6.4 |
| 5585-X | 9.12 | see Cisco's classic guide | not listed |
| 5525-X, 5545-X, 5555-X | 9.14 | 6.6 | 6.6 |
| 5506-X, 5506H-X, 5506W-X | 9.16 | 6.2.3 | 6.2.3 |
| 5508-X, 5516-X | 9.16 | 7.0 | 7.0 |
Sources: Cisco ASA compatibility ("ASA 9.14(x) was the final version for the ASA 5525-X, 5545-X, and 5555-X"), the Firepower Classic device compatibility guide and the Threat Defense compatibility guide, Table 30. Cisco states that version 7.0.0 "is the last major release that supports ASA FirePOWER".
What the ASA 5500-X is
A family of desktop and 1RU firewalls that run either classic ASA software or, on the same hardware, Firepower Threat Defense. All have eight integrated Gigabit ports; the 5506-X is a fanless desktop unit, and the 5525-X and up add an expansion slot.
| 5506-X | 5508-X | 5516-X | 5525-X | 5545-X | 5555-X | |
|---|---|---|---|---|---|---|
| Stateful firewall | 750 Mbps | 1 Gbps | 1.8 Gbps | 2 Gbps | 3 Gbps | 4 Gbps |
| FW + AVC (1024B) | 250 Mbps | 450 Mbps | 850 Mbps | 1.1 Gbps | 1.5 Gbps | 1.7 Gbps |
| FW + AVC + IPS (1024B) | 125 Mbps | 250 Mbps | 450 Mbps | 650 Mbps | 1 Gbps | 1.2 Gbps |
| Max concurrent sessions | 50,000 | 100,000 | 250,000 | 500,000 | 750,000 | 1 million |
| IPsec VPN | 100 Mbps | 175 Mbps | 250 Mbps | 300 Mbps | 400 Mbps | 700 Mbps |
Source: Cisco ASA 5500 Series data sheet. The FW + AVC + IPS rows are Firepower Threat Defense figures; the 5506-X was tested with FTD 6.2.3.
Options
| Your situation | Practical path |
|---|---|
| Staying with Cisco, small branch (5506-X to 5516-X class) | Secure Firewall 1210CE, 1210CP or 1220CX |
| Staying with Cisco, larger site (5525-X to 5555-X class) | Secure Firewall 1240 for a 5525-X or 5545-X (600,000 sessions), 1250 for a 5555-X (1 million); every 1200 model inspects far more traffic than the ASA it replaces |
| Want to keep ASA software | The 1200 series is sold with ASA software (part numbers ending -ASA-K9) as well as Threat Defense (-TD-K9) |
| Changing vendor | FortiGate 120G or Palo Alto PA-450; the configuration is rebuilt, not converted |
Avoid as a replacement: the Firepower 2100, Cisco's named successor for the 5525-X class, reached end of sale on May 27, 2025.
Side-by-side: ASA 5500-X and the Secure Firewall 1200
| 1210CE / 1210CP | 1220CX | 1230 | 1240 | 1250 | |
|---|---|---|---|---|---|
| FW + AVC (1024B) | 6.0 Gbps | 9.0 Gbps | 13 Gbps | 18 Gbps | 24 Gbps |
| FW + AVC + IPS (1024B) | 6.0 Gbps | 9.0 Gbps | 9.0 Gbps | 12 Gbps | 18 Gbps |
| Max concurrent sessions | 200,000 | 300,000 | 400,000 | 600,000 | 1 million |
| Max VPN peers | 200 | 300 | 500 | 1,000 | 1,500 |
| Form factor | Desktop | Desktop | 1RU | 1RU | 1RU |
Source: Cisco Secure Firewall 1200 Series data sheet, whose revision history dates the compact models to September 2024 and the 1RU models to March 2025. The FW + AVC and FW + AVC + IPS rows are measured the same way as the ASA rows above, so they compare directly: the smallest 1210CE inspects about 13 times what a 5516-X does (6.0 Gbps against 450 Mbps).
From another vendor, the FortiGate 120G (2.8 Gbps threat protection, 3 million sessions) and Palo Alto PA-450 (2.1 Gbps threat prevention, 300,000 sessions) sit in the same class; both vendors measure differently, so compare within a vendor. Figures are from the FortiGate 120G and PA-400 Series data sheets.
Migrating from an ASA 5500-X
- To Threat Defense: Cisco's Secure Firewall Migration Tool lists every 5500-X model as a source, "from a device that is running ASA software version 8.4 and later". It "supports migration of standalone ASA devices to a standalone threat defense device only". Its compatibility guide (June 2025) lists Firepower 1000, 2100, 3100, 4100, 4200 and 9300 as targets and does not list the Secure Firewall 1200; check the current release notes before relying on it for a 1200.
- Staying on ASA: a 1200 ordered with ASA software keeps the team on ASA, so policies are re-entered in the same command set rather than translated to Threat Defense. Check the interface naming on the new model before re-entering them.
- FirePOWER module policies: for the 5585-X, Cisco notes the tool "does not migrate the configuration from the ASA FirePOWER module".
- Licensing changes: Threat Defense uses Smart Licensing with Threat, URL Filtering and Malware subscriptions, and "A Smart Account is required for Smart Licenses" (Cisco licensing guide). Budget subscriptions with the hardware.
Where to buy, with prices
Snapshot taken 2026-10-09. Prices change; follow the link for today's figure.
| Item | Seller | Price | Notes |
|---|---|---|---|
| Secure Firewall 1210CE with ASA software (CSF1210CE-ASA-K9) | CDW | USD 3,815.99 (list USD 5,361.25) | 4 to 6+ weeks |
| ASA 5516-X with FirePOWER (ASA5516-FPWR-K9), used | eBay US | USD 63.24 to 615.84 across 9 listings | Pre-owned, US sellers, before shipping |
| ASA 5525-X with FirePOWER (ASA5525-FPWR-K9), used | eBay US | USD 122.76 to 499.99 across 7 listings | Pre-owned, US sellers, before shipping |
| ASA 5508-X (ASA5508-K9), used | eBay US | USD 13.50 to 799 across 17 listings | Pre-owned, US sellers, before shipping |
A used 5500-X is a spare, not a supported firewall: every model is past its Last Date of Support, so no further software or signatures are due from Cisco.
Third-party maintenance
Park Place Technologies lists hardware support for the ASA 5506 through 5585, "for years after the Cisco ASA firewall end of life date". Its page describes hardware support and says nothing about software fixes or threat signatures (checked 2026-10-09). For a firewall facing the internet, that leaves the security position above unchanged.
Questions
Is the Cisco ASA 5500-X end of life?
Yes. Every model is past its Last Date of Support: the 5512-X and 5515-X in August 2022, the 5585-X in May 2023, the 5525-X, 5545-X and 5555-X on September 30, 2025, and the 5506-X, 5508-X and 5516-X on August 31, 2026.
When did support end for the ASA5525-FPWR-K9?
The ASA 5525-X, including the FirePOWER bundle ASA5525-FPWR-K9, reached End of Sale on September 4, 2020 and its Last Date of Support on September 30, 2025. Its final software is ASA 9.14 and FirePOWER/FTD 6.6.
What replaces the Cisco ASA 5500-X?
Cisco named the Firepower 2100 for the 5525-X class and the Firepower 1000 for the 5506-X to 5516-X. The Firepower 2100 is itself past end of sale; Cisco's newer Secure Firewall 1200 series is available with ASA software or Threat Defense.
What is the last ASA version for the 5516-X?
ASA 9.16. Cisco states that "ASA 9.16(x) was the final version for the ASA 5506-X, 5506H-X, 5506W-X, 5508-X, and 5516-X".
Sources
- Cisco end-of-life bulletins: 5512-X/5515-X, 5585-X, 5525-X/5545-X/5555-X, 5506-X, 5508-X/5516-X
- Cisco: Continued Attacks Against Cisco Firewalls
- Cisco compatibility guides: ASA, Firepower Classic, Threat Defense, Migration Tool
- Data sheets: ASA 5500 Series, Secure Firewall 1200, FortiGate 120G, PA-400 Series
Researched by EOSL.ai; specifications, prices and third-party pages checked Oct 9, 2026. Lifecycle dates come from the Cisco ASA 5500-X Series Firewalls record, which is re-verified against the vendor source every week. Prices change daily; follow each price's link for the current figure.