In short: The Cisco ASA firewall lives on as Cisco Secure Firewall ASA, Cisco's long-standing firewall and VPN software. It runs on current Secure Firewall hardware and as ASA virtual on hypervisors and public clouds, but the classic ASA appliances have reached last date of support. Owners must refresh and choose between ASA software and Threat Defense.
What is Cisco ASA today?
For years "Cisco ASA" meant a physical box. Today Secure Firewall ASA is a software image. Cisco continues to publish new releases (ASA 9.24, with ASDM 7.24 as the graphical manager, is the newest in Cisco's compatibility matrix at the time of writing). It runs on:
- Current Cisco Secure Firewall hardware, from small branch appliances through mid-range and data centre platforms to the industrial appliance
- ASA virtual on VMware, KVM, Hyper-V, Nutanix and OpenStack
- ASA virtual in public cloud: AWS, Microsoft Azure, Google Cloud, Oracle Cloud and Alibaba Cloud
The same hardware can instead run Secure Firewall Threat Defense, Cisco's full next-generation firewall image. Which one you run is a choice made at deployment (re-imaging between them wipes the configuration).
End of support for older ASA hardware
The classic ASA appliance generations that many UK organisations bought in the 2010s have been retired in stages. Cisco's support listings show the larger appliances in the last generation reaching their last date of support on 30 September 2025, and the listing for the remaining appliances with FirePOWER Services showing 31 August 2026. After the last date of support there are no software fixes, security patches or hardware replacements from Cisco.
If you are still running one of these appliances, the practical consequences are:
- No fixes for newly discovered vulnerabilities, which matters for internet-facing VPN headends in particular
- Difficulty evidencing supported software for Cyber Essentials, cyber insurance and supply-chain questionnaires
- No hardware replacement if the unit fails
Our Cisco security end-of-life guide lists the dates and replacement paths across the portfolio.
ASA vs Threat Defense
| Secure Firewall ASA | Secure Firewall Threat Defense | |
|---|---|---|
| Core strength | Stateful firewall and mature VPN headend | Next-generation firewall with full threat inspection |
| IPS, application and URL control | Not included | Snort 3 IPS, SnortML, application control, URL filtering |
| Malware defence | No | Yes, with the Malware Defense licence |
| Multiple contexts | Multi-context mode | Multi-instance on some hardware; virtual routing (VRF) |
| Remote access | Secure Client VPN | Secure Client VPN and universal ZTNA |
| Management | ASDM, command line, Security Cloud Control | Management Center, Device Manager, Security Cloud Control |
| Ongoing development | New releases continue, without next-generation inspection features | Receives Cisco's next-generation features, such as SnortML and universal ZTNA |
Should you stay on ASA software or move to Threat Defense?
Staying on ASA software (on new hardware) can be sensible when:
- The device is mainly a remote access or site-to-site VPN headend, and threat inspection is done elsewhere
- You depend on ASA features or multi-context designs that need redesign on Threat Defense
- Your team's skills and automation are built around the ASA command line, and you need a like-for-like hardware refresh first
Moving to Threat Defense usually makes sense when you want IPS, application control, URL filtering and malware defence on the same box, central management of many sites, zero trust access, or alignment with Cisco's Hybrid Mesh Firewall direction. A common route is to refresh hardware first, then migrate configuration with Cisco's free migration tool, as described in our ASA to Threat Defense migration guide.
Licensing and management
ASA on current hardware uses Cisco Smart Licensing. Remote access VPN needs Cisco Secure Client licences (Advantage, Premier or VPN Only), which are bought separately from the firewall; see Secure Client licensing. Security Cloud Control can manage ASA policy, run bulk upgrades and push Secure Client packages to ASA headends. If you still run AnyConnect 4.x, plan the move to Secure Client 5 at the same time: see AnyConnect end of life.
How we help
We audit existing ASA estates, replace end-of-support hardware, and either rebuild on ASA software or migrate to Threat Defense with a tested cut-over. Contact us with your current models and versions and we will tell you the options; ask us for a quote.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Cisco ASA end of life?
The classic ASA appliances are: Cisco's listings show the last of them reaching last date of support in September 2025 and August 2026. ASA software itself is still released and supported on current Secure Firewall hardware and as ASA virtual.
Can I run ASA software on new Cisco Secure Firewall hardware?
Yes. Cisco's compatibility matrix lists ASA software on current Secure Firewall platforms from small branch to data centre and industrial, as well as ASA virtual on hypervisors and public clouds.
What replaced the Cisco ASA firewall?
Cisco Secure Firewall hardware replaced the ASA appliances. It can run ASA software or Secure Firewall Threat Defense, Cisco's next-generation firewall image.
How do I migrate from ASA to FTD?
Cisco provides the free Secure Firewall Migration Tool, which converts objects, access rules, NAT, routes, interfaces and VPN settings and pushes them to Management Center. Some items need manual work. See our migration guide.
Does ASA virtual run in Azure and AWS?
Yes. Cisco lists ASA virtual for AWS, Microsoft Azure, Google Cloud, Oracle Cloud and Alibaba Cloud, as well as the main private cloud hypervisors.