2/12/2008 -- Late last month, Cisco Systems Inc. announced its highest-performance security appliance offering to date, the new ASA 5580 Series.

The ASA 5580 is a high-performance security platform that Cisco says is suitable for use as either a scalable firewall (with up to 20 Gbps of overall throughput) or as a 10,000-user remote-access concentrator for secure sockets layer (SSL) and IP security (IPsec)-based virtual private networks (VPNs).

Industry talking-heads give Cisco's newest -- and highest-performance -- security appliance generally favorable marks. "[T]he new products will significantly extend Cisco's ability to address the high end of the firewall and VPN markets. The new ASA 5580-40 will deliver an order of magnitude improvement in firewall throughput compared to the existing top-end ASA 5550 appliance," said Andrew Braunberg, an analyst with consultancy Current Analysis.

Cisco first introduced its ASA family in 2005, as successors to its workhorse PIX and VPN 3000 Series Concentrator products, Braunberg said. It bills the ASA products as more adaptive because they support security service modules (SSM) that provide additional security functionality (such as anti-X or IPS capabilities), according to Braunberg. In most cases, he stressed, ASA family products support a maximum of one SSM expansion slot; the new 5580s devices -- which comes in two flavors (the 5580-40 and the 5580-20) support more.

The 5580-40 is rated at 10 Gbps of (small packet) firewall protection, while the 5580-20 is rated for 5 Gbps of (small packet) firewall protection; with Cisco's remote-access VPN bundle, it can support up to 10,000 SSL VPN users. Overall, Cisco claims sub-30 microsecond latency for the 5580s and support for up to 150,000 connections per second. In terms of flexibility and raw performance, the new 5580 devices look like smash hit winners.

But in this case -- as in so many others -- they're by no means a complete triumph. "[T]he 5580s do not support Cisco's security service modules...therefore, these products cannot perform broader unified threat management functions," Braunberg said. "This is not a huge issue given that UTM functionality tends to gain more traction in SMB and branch applications, but part of the reason for that -- as Crossbeam loves to point out -- is the performance hit most appliances take when they add this additional functionality to a box."

In fact, he stressed, Cisco isn't even giving 5580 users a UTM option. There's more, too. Because while the new 5580 deliverables boast significantly improved performance (relative to their predecessors, at any rate), they're "only helping Cisco keep pace with competitors" in the security appliance segment. --Stephen Swoyer