The Cisco ASA 5500-X is at the end of the line. The 5506-X, 5508-X and 5516-X lose all support on 31 August 2026, and the ArcaneDoor campaign has already shown a firmware implant that survives patching, reboots and re-imaging. Cisco’s route is a hardware refresh to Firepower, but that keeps the same implicit-trust VPN model and adds fresh licensing cost and management complexity. Moving remote access to a cloud-native, sovereign SASE and ZTNA platform is the stronger move, and for a European mid-market team Jimber is the best fit: no hardware, Zero Trust access, agentless coverage for OT, and EU data sovereignty in one console.
Key takeaways
- Support for the ASA 5506-X, 5508-X, 5515-X and 5516-X ends 31 August 2026; the 5525/45/55-X models already passed end of support on 30 September 2025.
- AnyConnect 4.x reached end of life on 31 March 2024. Cisco Secure Client 5 is a rebrand, and against an ASA or Firepower gateway it is still a full-tunnel VPN.
- ArcaneDoor’s lina_cs implant nests in FXOS and stays active after upgrading to the September 2025 patches, so Cisco tells affected customers to re-image the device or force a cold restart by pulling the power cables.
- An ASA-to-Firepower refresh means new CapEx, the ASA-versus-FTD feature-parity dilemma, and the FMC management overhead, without changing the underlying trust model.
- Running an unsupported ASA past August 2026 is treated as gross negligence under Belgium’s NIS2 law, exposing the board to personal liability and fines.
Where the ASA 5500-X lifecycle stands
Cisco announced end of life for the popular mid-market models back on 1 February 2021. The final Last Date of Support is fixed, and after it all support, hardware replacement and security updates stop.
| Model | Last Date of Support (EOSL) | Cisco successor |
|---|---|---|
| ASA 5506-X | 31 August 2026 | Firepower 1010 |
| ASA 5508-X | 31 August 2026 | Firepower 1010 / 1120 |
| ASA 5515-X | 31 August 2026 | Firepower 1120 / 2110 |
| ASA 5516-X | 31 August 2026 | Firepower 1140 |
| ASA 5525/45/55-X | 30 September 2025 (passed) | Firepower 2100 series |
| ASA 5508/5516 FirePOWER subscriptions | 31 August 2026 | Firepower Threat Defense subscription |
Cisco also reorganised its remote-access software. AnyConnect 4.x reached end of life on 31 March 2024, pushing organisations to Cisco Secure Client 5. That is not just a rename. Secure Client 5 adds a unified agent, but when it connects to a classic ASA or Firepower gateway the model underneath is still a full-tunnel VPN. Upgrading the endpoint software without changing the network architecture leaves the inherent weaknesses of traditional VPN access fully intact.
The edge threat: ArcaneDoor and an implant that survives patching
Perimeter firewalls are a static, internet-exposed target, and state-linked actors have hit Cisco ASA and Firepower repeatedly between 2024 and 2026.
| CVE | CVSS / KEV | Impact |
|---|---|---|
| CVE-2024-20353 | 8.6 / Apr 2024 | Part of ArcaneDoor; denial of service via the stateful-inspection engine |
| CVE-2024-20359 | 6.0 / Apr 2024 | Part of ArcaneDoor; local authorised attacker runs code as root |
| CVE-2025-20333 | 9.9 / Sep 2025 | Buffer copy without size check in the VPN web server; authenticated remote RCE as root |
| CVE-2025-20362 | 6.5 / Sep 2025 | Missing authorization in the VPN web server; unauthenticated access to restricted URLs |
| CVE-2025-20363 | 9.0 / mid-2025 | Heap-based buffer overflow leading to remote code execution |
The operational sting came on 23 April 2026, when CISA and Cisco Talos updated Emergency Directive 25-03. Investigators found that the ArcaneDoor actor had planted a persistent implant, running under the process name lina_cs, inside the underlying Firepower eXtensible Operating System. The implant stays active even after the device is upgraded to the patched September 2025 software. Standard commands like shutdown or reboot do not remove it, so Cisco tells affected customers to fully re-image the device or force a cold restart by physically pulling the power cables, which itself risks database and filesystem corruption. A patched ASA can still be a compromised ASA, which is why an upgrade alone does not close this out.
Two migration paths, one obvious weakness
You can refresh the hardware inside the Cisco line, or you can move to a cloud-native, software-defined architecture. Both retire the old box; only one retires the old model.
| Criterion | Hardware refresh to Cisco Firepower (FTD) | Cloud-native SASE & ZTNA (Jimber) |
|---|---|---|
| Cost model | High CapEx per appliance (roughly $2,500 to $10,000+ per unit) plus recurring NGFW licences | Predictable per-user OpEx, no hidden bandwidth surcharges |
| Hardware dependency | Physical appliance per site; throughput sizing for 3 to 5 years ahead | Zero-hardware footprint for user access; optional NIAC for legacy and OT segments |
| Access & trust | Rebranded VPN (Secure Client 5); network routing and one-time auth; lateral movement risk | ZTNA with outbound-only connectors; continuous, per-application authorisation |
| Management | Firepower Device Manager or the central FMC; deep product expertise and training | One cloud console for ZTNA, SWG, SD-WAN and WAF |
| Sovereignty | US vendor under the CLOUD Act and FISA Section 702; data and logs reachable by foreign authorities | EU-owned, Belgian-based; all data and metadata processed and stored in the EU |
| Agentless & OT | Complex segmentation via switch config, VLANs and ACLs | Direct hardware isolation of legacy and OT devices via the NIAC |
What the Firepower path actually costs a lean team
Staying in the Cisco line brings real friction. The first is the feature-parity dilemma: on new hardware you choose between the classic ASA OS code, which keeps the familiar CLI and ASDM but rules out Layer 7 NGFW features like intrusion prevention and URL filtering, or the FTD code, which enables those features but comes with a steep learning curve and a different management philosophy. The second is FMC: to manage FTD centrally you need a Firepower Management Center licence and server, and administrators on Reddit’s r/networking and r/Cisco consistently report that FMC and FDM feel slow and over-complex for smaller teams, with policy changes requiring a formal deployment that can take minutes and often errors on complex NAT or VPN configurations. The third is cost fragmentation: the chassis is only the start, NGFW features need ongoing licences, and Secure Client is a separate per-user licence, averaging $90 to $120 per user over a three-year term. For the cost side of a modern platform instead, see our SASE pricing models guide.
Why the Jimber path is the stronger fit for the EU mid-market
Jimber breaks the cycle of hardware refreshes, licence sprawl and perimeter exposure by consolidating network security into one sovereign, cloud-native platform. Three points matter most for a mid-market team:
- EU sovereignty by design. Unlike US SASE vendors bound by the CLOUD Act, Jimber is based in Belgium, so all processing, administration and logs stay under EU jurisdiction, which removes the extraterritorial data risk that NIS2 asks you to assess.
- Integrated Remote Browser Isolation, without the add-on tax. Web pages load in an isolated cloud container and the user only sees a safe visual stream, so active code never reaches the endpoint. Where US mega-vendors sell RBI as a pricey add-on with data caps, Jimber includes it without a surcharge.
- OT and IoT via the NIAC. Printers, IP cameras and PLCs cannot run an agent, and standard SASE leaves them exposed on a flat network. The Network Isolation Access Client places a physical zero-trust barrier in front of those assets and permits only pre-authorised traffic.
Two migration traps worth planning around
The VPNaaS gap. Cisco’s own move from AnyConnect to its Cisco Secure Access SASE introduces a compromise. Because many environments run legacy apps, thick clients or non-web protocols that do not fit standard proxy-based ZTNA, Cisco offers VPN-as-a-Service for them. The result is that you pay full SASE licence rates while still keeping the vulnerable, traditional VPN tunnel alive for a meaningful slice of applications. Jimber avoids this by using the NIAC to isolate legacy protocols locally in a zero-trust overlay, so there is no fallback VPN tunnel to maintain.
The Active Directory dependency. Local AD-joined Windows endpoints expect direct connectivity to a domain controller at boot to process Group Policy and refresh Kerberos tickets. A pure agentless ZTNA flow can break that. The clean path is a hybrid identity bridge: sync identities with Microsoft Entra Connect, use Hybrid Entra Join, and secure access to local file shares and printers through Cloud Kerberos Trust, which removes the need for unprotected LDAP and Kerberos tunnels over a legacy VPN.
The Belgian NIS2 stakes
Belgium’s NIS2 law of 26 April 2024 has been in force since 18 October 2024, with the CCB as supervisor. Essential entities had to show CyberFundamentals (CyFun) Basic or Important verification, or a credible ISO 27001 path, by 18 April 2026, and must reach full certification by April 2027. Running End-of-Support hardware such as an ASA that receives no updates after August 2026 is classed as gross negligence, and NIS2 Article 20 puts the ultimate responsibility on the board: directors can be held personally liable for damage from incidents they failed to mitigate, and in serious cases regulators can suspend them from management functions. Fines reach €10 million or 2% of global turnover for essential entities, and €7 million or 1.4% for important entities. For the audit view, see our NIS2 compliance checklist, and for the wider picture the enterprise VPN end-of-life watchlist.
Frequently asked questions
Why is Cisco FTD management complexity such a common complaint on IT forums?
FTD combines two historically separate engines under the hood, the LINA code for firewalling and the Snort engine for intrusion prevention. That makes changes through the Firepower Device Manager or the central FMC slow, because each edit needs a formal deployment that can take minutes and often errors on complex NAT or VPN configurations. Cloud-native platforms apply policy changes in real time by comparison.
What are the limits of the Cisco Firewall Migration Tool for an ASA-to-FTD move?
The tool converts static objects, IP addresses and simple access rules well, but it regularly fails on dynamic routing protocols, advanced VPN tunnels and remote-access profiles. Teams usually have to rebuild and verify those parts by hand, often with Cisco TAC, to avoid outages.
Why is keeping a physical ASA past August 2026 a direct NIS2 risk for directors?
Under Belgium’s law of 26 April 2024, directors must take appropriate and proportionate technical measures. After the 31 August 2026 End-of-Support date Cisco issues no more patches for the ASA 5508-X and 5516-X, so a firewall without security updates loses its effectiveness. Directors who know this and choose not to replace the hardware are acting negligently and risk personal liability and heavy fines.
Is moving from AnyConnect to Cisco Secure Client 5 enough for a zero-trust model?
No. Secure Client 5 is essentially a rebrand of AnyConnect. Connected to a classic ASA or Firepower firewall, the architecture stays a full-tunnel or split-tunnel VPN, and the user still receives an IP on the internal subnet, which is the opposite of least-privilege. A real zero-trust move means leaving the network-routed VPN model behind.
What is the VPNaaS gap, and how does Jimber avoid it?
Many larger SASE vendors deliver ZTNA for modern web apps but fall back to VPN-as-a-Service for older, non-web enterprise applications, which keeps the vulnerable VPN tunnel and its lateral-movement risk in place. Jimber avoids this with the NIAC, which isolates and encrypts legacy communication locally at the application level, so there is no need for network-wide VPN tunnels.
How does Jimber compare with US SASE vendors on privacy?
US SASE providers fall under the CLOUD Act and FISA Section 702, which let US agencies demand data from US companies regardless of where it is physically stored. Jimber is a fully Belgian company with no US parent, and all processing and storage happen inside the EU, so the data is protected from foreign interception orders.
Retire the model, not just the box
An ASA refresh to Firepower buys new hardware and inherits the old risk. Map your remote-access and firewall dependencies, plan the hybrid-identity bridge, and pilot a ZTNA cutover for one site or user group before the August 2026 deadline. Book a Jimber demo to see an agentless, EU-sovereign path off the ASA, or compare pricing against a Firepower refresh and its licences.
