Item: Cisco ASA 5500-X with FirePOWER Services
Rating: 9
Author: Vinayak Mishra

Use Cases and Deployment Scope

Cisco ASA 5500-X with FirePOWER Services is being used at edge of the network and inside the network to block and limit the traffic. These devices are very good with NAT and allow the access to the internal servers with the only allowed ports for security. Apart from that the device is handling the VPN, both IPSec and Remote access VPN for the production infrastructure. ASAs are deployed with Anyconnect premium licensing feature to help the remote access or work from home users to connect to the data centre and perform their day to day task with the inhouse applications.

Pros and Cons

Traffic handling is fast, i.e. with least latency
VPNs are stable and doesn't creates much issues
Efficiently handles the forwarded and NATed traffic
Management is easy
Packet tracer feature is up to the mark

Enhance the GUI, i.e. make the device management more user friendly
Troubleshoot part should be more efficient
There should be an option to initiate VPN tunnels without the real traffic
More customised notification options for audit should be available
Resource utilization should be optimized

Key Insights

Do you think Cisco ASA 5500-X with FirePOWER Services delivers good value for the price?

Yes

Are you happy with Cisco ASA 5500-X with FirePOWER Services's feature set?

Yes

Did Cisco ASA 5500-X with FirePOWER Services live up to sales and marketing promises?

I wasn't involved with the selection/purchase process

Did implementation of Cisco ASA 5500-X with FirePOWER Services go as expected?

Yes

Would you buy Cisco ASA 5500-X with FirePOWER Services again?

Yes

Return on Investment

Working of remote workforce made easy
Security was enhanced on the data traffic shared with the vendors due to the use of VPNs
Inbound attacks were mostly blocked on the edge and saved a lot of resources (which could had been used in case of attacks getting successful on the application servers)

Systems Integrated With

Cisco Identity Services Engine
Cisco Defence Orchestrator
Cisco Catalyst Switches for SGT
Cisco Anyconnect

Integration of Identity services engine and Defence Orchestrator allowed the swift authentication, authorization and management of the firewalls to provide the day to day functionality and Visibility of the network devices and traffic. AnyConnect on the other hand, provided the secure connectivity for the remotely working people and their integration with Cisco Umbrella is adding a layer of DNS security on the top.

Performance

To date after the deployment, we haven't heard of any anomaly in user authentication/authorization or connectivity issue unless it is due to some incorrect configuration. The network latency is minimal to the WAN and packets are filtered as expected. The only downside seems sometimes is due to the delay in fetching the logs for the traffic, especially when the filtered log quantity is on the higher side.

Support Rating

Cisco TAC support is very nice. Even on a very low severity case, I got immediate email support and the support engineer was assigned for a call very next day. I got the response for the issue as a bug and the patch was available in just 15 days. I was also provided with a workaround which somehow fixed the issue and once the patch was available, TAC supported in getting all the firewalls upgraded.

Alternatives Considered

Palo Alto Networks Next-Generation Firewalls - PA Series, Fortinet FortiGate and Sophos UTM

The network is homogenous to Cisco and the integration with Cisco products is very easy (e.g. Identity Services Engine). As I am a certified engineer in Cisco Security, it feels very easy to handle Cisco products especially as more and more support docs are available across the internet and Cisco portal. The support from Cisco is also on the very next level. Even the community support for issues on the Cisco community is better than the support provided by the different vendor firewalls.

Other Software Used

Cisco Identity Services Engine (ISE), Fortinet FortiGate, Palo Alto Networks Next-Generation Firewalls - PA Series

Likelihood to Recommend

This firewall is best suited for the network edge/perimeter deployment. The next gen features works very well and the remote access VPN is also very much suitable for the organizations which have a huge user base working remotely. The Remote Access VPN is very much customizable and the authentication integration option like LDAP and RADIUS provides and addon.

Cisco ASA 5500-X with FirePOWER Services review with 1 year of usages

Overall Satisfaction with Cisco ASA 5500-X with FirePOWER Services