Principal Architect
Software Version
Firepower 1150
Overall Satisfaction with Cisco Secure Firewall
we are rackspace private and public cloud SP we have over 20 000 firewalls from Cisco Secure Firewall for different customers
Pros
- NAT and policies
- IPS
- IDS
Cons
- HA stability
- upgrade ease
- AI capability
- Features matching between ASA and FTD
- software stability
- great cost TCO
- great patching for CVEs
- great VPN
we have been using SNORT and NGFW IDS and IPS for years and we love it including FMC and CDO dFMC
all we used and great features
Do you think Cisco Secure Firewall delivers good value for the price?
Yes
Are you happy with Cisco Secure Firewall's feature set?
Yes
Did Cisco Secure Firewall live up to sales and marketing promises?
Yes
Did implementation of Cisco Secure Firewall go as expected?
Yes
Would you buy Cisco Secure Firewall again?
Yes
Cisco Secure Firewall Feature Ratings
Cisco Security
As a Principal Architect at Rackspace, I’ve had the opportunity to work with a wide range of security solutions over the years, and Cisco Secure Firewall stands out for several reasons. Its integration with the broader Cisco security ecosystem brings a level of consistency and visibility that’s incredibly valuable, especially in large, complex environments. The threat intelligence powered by Talos adds a strong layer of proactive defense, and the policy management—especially through Cisco Defense Orchestrator—makes scaling security across distributed environments much more manageable.
We’ve deployed Cisco Secure Firewall in both multi-tenant and single-tenant models for our enterprise customers, and it has proven to be reliable, adaptable, and performance-oriented. Whether we’re protecting data centers, branch sites, or cloud workloads, the firewall consistently delivers solid results with strong threat protection and flexible deployment models.
Support has also been very responsive and knowledgeable, which is key when you're operating at scale. Overall, it's a product I trust to help secure critical infrastructure, and it continues to evolve in the right direction with each release.
We’ve deployed Cisco Secure Firewall in both multi-tenant and single-tenant models for our enterprise customers, and it has proven to be reliable, adaptable, and performance-oriented. Whether we’re protecting data centers, branch sites, or cloud workloads, the firewall consistently delivers solid results with strong threat protection and flexible deployment models.
Support has also been very responsive and knowledgeable, which is key when you're operating at scale. Overall, it's a product I trust to help secure critical infrastructure, and it continues to evolve in the right direction with each release.
As a Principal Architect at Rackspace, when we looked at our security program goals—things like reducing attack surface, simplifying policy enforcement across hybrid environments, and gaining better threat visibility Cisco checked all the boxes in a way that felt strategic, not just tactical.
What really stood out was Cisco’s ability to bring together threat intelligence, network context, and security controls into a unified framework. With Talos powering the backend, we knew we’d have one of the strongest threat intel engines out there, and that gave us confidence in Cisco’s ability to detect and block sophisticated threats before they could impact our infrastructure or our customers.
Another major factor was how well Cisco Secure Firewall integrates with the rest of the Cisco security stack, including SecureX and Umbrella. That gave us a smoother operational model and a way to respond to threats faster without jumping across ten different systems. For a multi-cloud, large-scale environment like ours, that efficiency really matters.
So for us, Cisco wasn’t just a firewall vendor—it was a strategic security partner that aligned with our vision for how modern, scalable, and resilient security should look.
What really stood out was Cisco’s ability to bring together threat intelligence, network context, and security controls into a unified framework. With Talos powering the backend, we knew we’d have one of the strongest threat intel engines out there, and that gave us confidence in Cisco’s ability to detect and block sophisticated threats before they could impact our infrastructure or our customers.
Another major factor was how well Cisco Secure Firewall integrates with the rest of the Cisco security stack, including SecureX and Umbrella. That gave us a smoother operational model and a way to respond to threats faster without jumping across ten different systems. For a multi-cloud, large-scale environment like ours, that efficiency really matters.
So for us, Cisco wasn’t just a firewall vendor—it was a strategic security partner that aligned with our vision for how modern, scalable, and resilient security should look.
yes customer support is great
reliability and maintenability
AI will become the brain of modern security operations. It’s already helping us move from reactive to predictive. Instead of waiting for alerts to pile up or for breaches to be detected after the fact, AI allows us to analyze massive volumes of telemetry in real time and spot anomalies that would be impossible for human analysts to catch quickly. Tools like Cisco SecureX and other XDR platforms powered by AI are great examples of this shift connecting the dots between endpoint, network, identity, and cloud data to highlight real threats instead of noise.
Yes, we actively use predictive threat detection and analysis as part of our security strategy at Rackspace. It’s no longer enough to rely solely on traditional signature-based methods or wait for incidents to occur—we need to anticipate threats before they become active breaches.
We leverage a combination of tools and platforms that incorporate machine learning and behavioral analytics to detect anomalies in real time. Cisco’s ecosystem plays a big role here. For example, with Cisco Secure Firewall integrated into SecureX and backed by Talos threat intelligence, we’re able to correlate activity across the network, endpoints, identity systems, and the cloud. This allows us to spot unusual behavior—like privilege escalation attempts, lateral movement, or command-and-control patterns—even if they don’t match known signatures.
In practical terms, that means we’re using predictive models to prioritize risk, highlight attack paths before they’re exploited, and automate initial response actions. We also feed telemetry into our SIEM and SOAR platforms, where we enrich it with external threat feeds and internal context, giving our SOC team better situational awareness and faster decision-making.
Ultimately, predictive threat detection helps us move toward a more proactive and resilient security posture. It’s not perfect—and it still requires tuning and human oversight—but it’s a major leap forward compared to where security was even a few years ago.
We leverage a combination of tools and platforms that incorporate machine learning and behavioral analytics to detect anomalies in real time. Cisco’s ecosystem plays a big role here. For example, with Cisco Secure Firewall integrated into SecureX and backed by Talos threat intelligence, we’re able to correlate activity across the network, endpoints, identity systems, and the cloud. This allows us to spot unusual behavior—like privilege escalation attempts, lateral movement, or command-and-control patterns—even if they don’t match known signatures.
In practical terms, that means we’re using predictive models to prioritize risk, highlight attack paths before they’re exploited, and automate initial response actions. We also feed telemetry into our SIEM and SOAR platforms, where we enrich it with external threat feeds and internal context, giving our SOC team better situational awareness and faster decision-making.
Ultimately, predictive threat detection helps us move toward a more proactive and resilient security posture. It’s not perfect—and it still requires tuning and human oversight—but it’s a major leap forward compared to where security was even a few years ago.
AI has a huge impact on how we use predictive threat detection and analysis at Rackspace—it’s really the engine that makes it possible at scale.
Traditionally, predictive security relied on static baselines and simple behavioral rules. But with AI, we can now process massive amounts of telemetry from across our infrastructure—network traffic, endpoint activity, user behavior, cloud logs—and actually learn what normal looks like in dynamic environments. That’s a game-changer.
AI helps us detect subtle patterns that might indicate an emerging threat—like a low-and-slow data exfiltration attempt, lateral movement across trusted systems, or unusual login behaviors that could be early signs of account compromise. These are things a human might miss or notice too late. But with AI-driven behavioral models and anomaly detection, we get alerted before the threat fully materializes.
It also reduces alert fatigue by filtering out noise and focusing analysts on the truly suspicious behaviors. We’ve seen significant improvements in mean time to detect (MTTD) and mean time to respond (MTTR) because of this.
Another benefit is automation. AI enables us to take immediate action based on confidence levels—such as isolating a device, blocking a process, or elevating the incident for human review.
Traditionally, predictive security relied on static baselines and simple behavioral rules. But with AI, we can now process massive amounts of telemetry from across our infrastructure—network traffic, endpoint activity, user behavior, cloud logs—and actually learn what normal looks like in dynamic environments. That’s a game-changer.
AI helps us detect subtle patterns that might indicate an emerging threat—like a low-and-slow data exfiltration attempt, lateral movement across trusted systems, or unusual login behaviors that could be early signs of account compromise. These are things a human might miss or notice too late. But with AI-driven behavioral models and anomaly detection, we get alerted before the threat fully materializes.
It also reduces alert fatigue by filtering out noise and focusing analysts on the truly suspicious behaviors. We’ve seen significant improvements in mean time to detect (MTTD) and mean time to respond (MTTR) because of this.
Another benefit is automation. AI enables us to take immediate action based on confidence levels—such as isolating a device, blocking a process, or elevating the incident for human review.
Resilience and Reliability
Resilience, in the context of cybersecurity, is one of the most valuable qualities a modern organization can build into its infrastructure. From my perspective as a Principal Architect at Rackspace, resilience goes beyond just preventing breaches—it’s about ensuring the business can recover, adapt, and continue to operate even when things go wrong.
Here’s how I see the value it brings:
First, resilience shifts the mindset from "if" to "when." No system is invulnerable, especially in today’s world where threats evolve faster than ever. What matters is how well you can contain, absorb, and recover from an incident with minimal disruption. That’s the difference between a security team being overwhelmed for days and a team restoring services with confidence in hours.
Second, resilience is directly tied to customer trust and business continuity. If a breach or outage occurs and your organization can respond quickly, maintain transparency, and minimize downtime, it reinforces your credibility. In a multi-tenant environment like ours, where we manage infrastructure for enterprise clients, our ability to remain operational during security events is part of the service-level guarantee we owe them.
Third, resilience is not just about tools—it’s about architecture and culture. We design with redundancy, segmentation, and zero trust principles. We train our teams with playbooks and simulations. We integrate platforms like Cisco Secure Firewall, SecureX, and Threat Response not just for prevention, but to ensure fast detection and coordinated remediation.
Ultimately, resilience is what gives security teams the confidence to innovate
Here’s how I see the value it brings:
First, resilience shifts the mindset from "if" to "when." No system is invulnerable, especially in today’s world where threats evolve faster than ever. What matters is how well you can contain, absorb, and recover from an incident with minimal disruption. That’s the difference between a security team being overwhelmed for days and a team restoring services with confidence in hours.
Second, resilience is directly tied to customer trust and business continuity. If a breach or outage occurs and your organization can respond quickly, maintain transparency, and minimize downtime, it reinforces your credibility. In a multi-tenant environment like ours, where we manage infrastructure for enterprise clients, our ability to remain operational during security events is part of the service-level guarantee we owe them.
Third, resilience is not just about tools—it’s about architecture and culture. We design with redundancy, segmentation, and zero trust principles. We train our teams with playbooks and simulations. We integrate platforms like Cisco Secure Firewall, SecureX, and Threat Response not just for prevention, but to ensure fast detection and coordinated remediation.
Ultimately, resilience is what gives security teams the confidence to innovate
Building cybersecurity resilience starts at the top. Leaders play a critical role—not just in budgeting for tools, but in shaping a culture and architecture that can withstand and recover from cyber threats. From my experience at Rackspace, here’s what effective leaders can do to truly build resilience across the organization:
Make cybersecurity a business priority, not just an IT concern
Leaders should connect cybersecurity to business outcomes—uptime, customer trust, regulatory compliance, and brand reputation. When execs frame it this way, security gets the attention and investment it needs across departments.
Invest in layered defenses with built-in redundancy
Resilience isn’t just about having a firewall
Make cybersecurity a business priority, not just an IT concern
Leaders should connect cybersecurity to business outcomes—uptime, customer trust, regulatory compliance, and brand reputation. When execs frame it this way, security gets the attention and investment it needs across departments.
Invest in layered defenses with built-in redundancy
Resilience isn’t just about having a firewall
- Identity-based microsegmentation
- Cloud and container visibility bridge
- Multi-tenant policy abstraction layer
- Using SecureX and our SOAR platform, we created automated playbooks that trigger actions
- Traffic fingerprinting for insider threat detection
Using Cisco Secure Firewall
10000 - Value added resellet and IT partnerships and MSP
4000 - Supporting Cisco Secure Firewall effectively requires a mix of technical, operational, and analytical skills. At Rackspace
- Advanced Threat Prevention at the Edge and Core
- Microsegmentation and East-West Traffic Control
- Hybrid Cloud Protection
- Deeper Integration with Zero Trust Architecture
- Encrypted Traffic Analytics and SSL Decryption at Scale
- Security-as-Code and Full CI/CD Integration
Evaluating Cisco Secure Firewall and Competitors
Yes - Juniper firewall
- Cloud Solutions
- Scalability
- Integration with Other Systems
- Ease of Use
The most important of these—by far—was integration and visibility.
We operate in highly distributed environments with a mix of on-prem, private cloud, and public cloud workloads. Fragmented tools and disconnected telemetry just weren’t cutting it. What Cisco brought to the table with Secure Firewall was the ability to plug directly into the rest of their secure architecture—Umbrella, ISE, Secure Endpoint, and SecureX—so we could consolidate our visibility and streamline incident response.
That tight integration let us move from siloed alerts to full-context security events.
We operate in highly distributed environments with a mix of on-prem, private cloud, and public cloud workloads. Fragmented tools and disconnected telemetry just weren’t cutting it. What Cisco brought to the table with Secure Firewall was the ability to plug directly into the rest of their secure architecture—Umbrella, ISE, Secure Endpoint, and SecureX—so we could consolidate our visibility and streamline incident response.
That tight integration let us move from siloed alerts to full-context security events.
If I had to go through the evaluation and selection process again, I’d definitely keep the core focus on security effectiveness and scalability, but I’d place even more emphasis on how well the solution fits into our broader operational ecosystem from day one.
One of the biggest changes I’d make is bringing our SecOps and infrastructure teams into the process earlier—not just for feedback, but as active participants in testing and validation. Their day-to-day experience with policy enforcement, troubleshooting, and integration with SIEM and SOAR platforms is critical, and getting their perspective up front would’ve made the rollout even smoother.
I’d also shift more of the evaluation toward real-world simulation. Instead of purely lab-based testing, I’d run more scenarios based on our actual traffic, workloads, and incident patterns—especially under pressure. It’s one thing to read about performance numbers, but it’s another to see how a firewall handles a burst of encrypted traffic while also logging to multiple systems and responding to threats.
Finally, I’d go deeper into the licensing model from the start. Cisco offers strong capabilities, but like many enterprise platforms, the licensing structure can get nuanced. Clarifying long-term costs and flexibility for cloud, HA, and MSSP models earlier in the process would help streamline budgeting and avoid surprises.
One of the biggest changes I’d make is bringing our SecOps and infrastructure teams into the process earlier—not just for feedback, but as active participants in testing and validation. Their day-to-day experience with policy enforcement, troubleshooting, and integration with SIEM and SOAR platforms is critical, and getting their perspective up front would’ve made the rollout even smoother.
I’d also shift more of the evaluation toward real-world simulation. Instead of purely lab-based testing, I’d run more scenarios based on our actual traffic, workloads, and incident patterns—especially under pressure. It’s one thing to read about performance numbers, but it’s another to see how a firewall handles a burst of encrypted traffic while also logging to multiple systems and responding to threats.
Finally, I’d go deeper into the licensing model from the start. Cisco offers strong capabilities, but like many enterprise platforms, the licensing structure can get nuanced. Clarifying long-term costs and flexibility for cloud, HA, and MSSP models earlier in the process would help streamline budgeting and avoid surprises.
Cisco Secure Firewall Support
| Pros | Cons |
|---|---|
Quick Resolution Knowledgeable team Kept well informed Immediate help available Support cares about my success | Poor followup Problems left unsolved Escalation required Need to explain problems multiple times Slow Initial Response |
es, we did purchase premium support for Cisco Secure Firewall, and it was a strategic decision based on the critical role the platform plays in our infrastructure.
In an environment like Rackspace where uptime, rapid incident response, and security assurance are non-negotiable, having direct access to Cisco’s high-touch support resources makes a real difference. Premium support gives us faster response times, access to senior-level TAC engineers, and proactive case management—which helps reduce risk during high-impact events or upgrades.
Another reason we chose premium support is because of the complexity of our deployment. We're not running a cookie-cutter environment—we’ve got hybrid cloud, multi-tenancy, custom policies, and integrations across multiple platforms. When something unusual happens, we need a support team that understands the nuance and can engage with urgency and depth. Cisco’s premium support gives us that confidence.
We’ve also used it during lifecycle planning and feature adoption.
In an environment like Rackspace where uptime, rapid incident response, and security assurance are non-negotiable, having direct access to Cisco’s high-touch support resources makes a real difference. Premium support gives us faster response times, access to senior-level TAC engineers, and proactive case management—which helps reduce risk during high-impact events or upgrades.
Another reason we chose premium support is because of the complexity of our deployment. We're not running a cookie-cutter environment—we’ve got hybrid cloud, multi-tenancy, custom policies, and integrations across multiple platforms. When something unusual happens, we need a support team that understands the nuance and can engage with urgency and depth. Cisco’s premium support gives us that confidence.
We’ve also used it during lifecycle planning and feature adoption.
Yes - yes it took time from the BU to get the fix but we got it in the end
issue that was a big and after working with R&D BU we got it fixed
Using Cisco Secure Firewall
| Pros | Cons |
|---|---|
Like to use Easy to use Well integrated Quick to learn Feel confident using | Unnecessarily complex Requires technical support Inconsistent Cumbersome Lots to learn |
- Policy Object Reuse and Grouping
- pplication-Aware Rule Creation
- Policy Rule Management at Scale
- Logging and Event Correlation in FMC
- Deployment and Policy Commit Process
Comments
Please log in to join the conversation