Item: Cisco ASA 5500-X with FirePOWER Services
Rating: 7
Author: Simon Watkins

Use Cases and Deployment Scope

The Cisco ASA 5500-X with FirePOWER Services can be deployed in a number of different scenarios which can vary from the protection of important business data to or separation of different user groups. I have personally deployed these devices on the perimeter of the network to delimit to internal network from the internet.

Pros and Cons

Application visibility and control
IPS
AMP

Local administration
Complex policies - you need training
Not as slick as the FTD
It's not FTD, its an ASA with FIrepower, therefore two areas of configuration

Key Insights

Do you think Cisco ASA 5500-X with FirePOWER Services delivers good value for the price?

Yes

Are you happy with Cisco ASA 5500-X with FirePOWER Services's feature set?

Yes

Did Cisco ASA 5500-X with FirePOWER Services live up to sales and marketing promises?

Yes

Did implementation of Cisco ASA 5500-X with FirePOWER Services go as expected?

Yes

Would you buy Cisco ASA 5500-X with FirePOWER Services again?

Return on Investment

Visibility of next generation threats that a normal ASA would stop
IPS
AMP
URL Filtering
Pay as you grow

Systems Integrated With

ISR Routers
Cisco Switches

I've utilised Cisco ISR router on the outside and switches on the inside - I find having one vendor eases the integration.

Performance

The Cisco ASA 5500X with Firepower performance needs consideration before deploying. Although the solution is Pay as you grow, adding additional features to the system has a negative impact on overall throughput. I would more like now only to deploy the Cisco FPR units as they have better performance and will last the test of time.

Support Rating

Cisco support is generally excellent and we always ensure that any customers deploy a support contract that aligns with their business needs. From a hardware perspective, the ASA firewall supports High Availability and therefore you know that your overall uptime SLA is excellent. I know with Cisco that you get great support.

Alternatives Considered

Cisco 1000 Series Integrated Services Routers (ISR 1000)

The Cisco ASA 5500-X with FirePOWER Services is a full-blown firewall whereas the security feature license on the ISR 1K router is a lot easy to configure. To be honest I'm not a great fan of Zone-based firewalls but I guess familiarity develops with how much you use a product.

Other Software Used

PRTG Network Monitor, ManageEngine NetFlow Analyzer

Likelihood to Recommend

The ASA with Firepower services is well suited for deployment on the edge of the network. It should be noted however that if you had the choice that the FTD image is deployed on the ASA however I appreciate that many IT departments can run ASA but there is less experience with the FTD image. I would not try and run an ASA with FPR without an FMC as you lose functionality.

Cisco ASA 5500-X with FirePOWER Services

Overall Satisfaction with Cisco ASA 5500-X with FirePOWER Services