Is 36 Hours of Labor Reasonable for Replacing an ASA-5516 with a Meraki MX95 HA Pair?

The estimate isn’t automatically unreasonable if the consultant is carefully auditing the existing ASA configuration and rebuilding a complicated design. Internal NAT, multiple WANs, dynamic routing, large Layer 2 domains, unusual firewall rules, and several VPN authentication methods can add significant time. The planning, testing, documentation, and change-management work can also be legitimate, especially if this is a fixed-price project. Ask for a detailed list of deliverables and assumptions rather than judging only by the appliance count.

For two MX95s configured as a warm-spare or HA pair, the basic appliance setup itself should not take very long. The real question is how much complexity is behind the ASA. If the provider cannot explain exactly what the 12 deployment hours and 8 VPN-related hours cover, I’d push back. A fixed-fee quote can be fair, but it should include clear acceptance criteria and not charge enterprise-level migration effort for a simple configuration.

The workstation portion is worth questioning. Installing a VPN client on each computer is often a simple MSI or scripted deployment, so you may be able to handle that internally or have the provider supply an installer. Fifteen minutes per machine may simply be the provider’s minimum billing increment, not the actual technical effort.

I’ve done similar firewall replacements in a day when the existing configuration was well understood and there were only a few rules and VPNs. Other migrations have taken several days because discovery, testing, documentation, and troubleshooting were included. The best way to evaluate this quote is to request a breakdown of the current ASA objects, routing, NAT, VPNs, failover testing, workstation deployment, rollback plan, and documentation. If those items are simple, get a second quote; if they’re complex, 36 hours may be defensible.

It depends heavily on what the ASA is actually doing. A basic Meraki deployment with straightforward NAT, firewall rules, routing, and a site-to-site VPN could probably be completed in a day. Meraki is largely configured through the dashboard, and much of the work can be scripted through the API. For a simple environment, 20 hours for the technical work sounds high, and eight hours just to configure the VPN would be difficult to justify.