Item: Cisco Adaptive Security Appliance (ASA) Software
Rating: 8
Author: Verified User

Use Cases and Deployment Scope

Cisco ASA is being used across the whole organization. Even
we deploy Cisco to other companies. Its main usage is for Site to Site and
Client to Side Vpn services. We had used Cisco ASAs for data center server and
client segmentation. It solves the connectivity of external 3rd parties and
supplies chain customers to access internal resources securely. Thousands of
clients are accessing the internal applications through Cisco ASAs. Its unique
capabilities fit our Disaster Recovery and multi-sites connectivity scenarios.

Pros and Cons

Stability
True performance values with the datasheets
Easy to deploy
Easy to manage and operate
Smooth integrations with other Cisco products like ISE
Very high uptime values compared to other solutions.
Global support from Cisco
Easy to find Cisco expertise in the market
Extensive CLI usage
Automation support
Stable and monitored S2S Vpn functionality
Anyconnect Vpn client is great
Great HA funtionality with no downtime or service interruption
Fast RMA timeline
Upgrades are very easy without ant downtime

Layer 7 next generation firewall capabilities
Cloud deployment option
Central management capabilities are lacking
Java usage on webui
SSL inspection support
Geoloc related rules are missing
No builtin SDN in the product
No builtin IOT based rule capabilities in the ASA SW

Return on Investment

Very high MTBF/MTTF values of the product are directly increasing our digital services uptime values.
Especially at the beginning of the pandemic, we easily deploy hundreds of clients with and connect and easily connect them to our internal networks securely.
Hundreds of external companies are directly connected through S2S with Cisco ASAs to access the frontend sites for transactions whereas we don’t need to maintain private lines.

Alternatives Considered

Palo Alto Networks Next-Generation Firewalls - PA Series, Check Point 13000 Appliances and Fortinet FortiGate

We have been using and deploying different vendor-based firewalls.
Our main considerations for selection; use case, functionalities, and the price
of the product. When there’s a Vpn or detailed routing scenarios Cisco ASA is the
primary candidate. It’s cheap compared to other vendors. Cisco support is best
compared to other vendors' support. Local partners and Cisco teams assist with any
kind of problem. Problem resolution times are significantly lower. Smooth
integration with Cisco ISE is the primary decision factor for C2S deployments. Vpn
functionality is bundled with the product. We have quarterly audits for the
solutions and products used for external services, Cisco ASAs don’t have any
defects or findings. Setup and deployment time is low compared to other
vendors. It perfectly integrates with monitoring tools. Vpn monitoring can be
accomplished by 3rd party monitoring tools extensively. CLI usage is
a plus especially when you deploy through automation tools.

Key Insights

Do you think Cisco Adaptive Security Appliance (ASA) Software delivers good value for the price?

Yes

Are you happy with Cisco Adaptive Security Appliance (ASA) Software's feature set?

Yes

Did Cisco Adaptive Security Appliance (ASA) Software live up to sales and marketing promises?

Yes

Did implementation of Cisco Adaptive Security Appliance (ASA) Software go as expected?

Yes

Would you buy Cisco Adaptive Security Appliance (ASA) Software again?

Yes

Other Software Used

Check Point 13000 Appliances, Palo Alto Networks Next-Generation Firewalls - PA Series, Fortinet FortiGate

Likelihood to Recommend

If you have the Cisco backbone and need to deploy a fast firewall
or VPN services go with the Cisco ASA product. Vpn functionality is great and
very easy to deploy and monitor. Cisco Anyconnect is a great tool. Complex
routing and Vpn scenarios are very easy to conduct. Hub and spoke connectivity scenarios
for the branches and central HQs are well fit for Cisco ASA deployment.
Moreover, if you’ve got the Cisco ISE being deployed, ASA is perfect for user-based ACLs
with custom compliance checks on the endpoints.

ASA is being referred to as legacy firewalls if you will user
classic L4 firewall sets with IPs and ports on the rules,; ASA is the right
choice. However, when you want to use full L7 with NG capabilities, you should
go with firepower or deploy additional solutions with Cisco ASA for L7 security
enhancements.

Trusted Firewall solution with exact datasheet values

Overall Satisfaction with Cisco ASA