Item: Cisco Secure Firewall
Rating: 10
Author: Verified User

Overall Satisfaction with Cisco Secure Firewall

Use Cases and Deployment Scope

Our Cisco firewalls are deployed to provide border security firewall, a bounary between our production network and DMZ application/proxy servers, and provide Inline IPS inspection of north-south and east-west traffic. We also have them working as our remote access VPN gateway and IPSEC S2S routed and policy based tunnels to remote partners and cloud infrastructure.

Pros and Cons

Pros

Configuration management and deployment
Ability to configure multiple policing types in one place.
Unified searching of events (threat, connection, intel, etc.)

Cons

Cost for HA active -standby model requires two full licenses, even though only gets used at a time.
Speed of change deployment
Exporting of logs in CEF format direct to a dialog server over TCP/TLS with needing a third party external pull client or code
Old storage on virtual appliance should not be limited by anything but the disk attached.
Inability to perform “to the box” filtering using standard policies, and things like stateful inspection and GeoIP filtering.

Return on Investment

ROI is very low. Licensing is more that the hardware cost and seems excessive, especially given having to pay for two full sets of licenses in an Active-Standby pair. Cost has driven CIO to consider replacing Cisco with a competitor.

Security and Performance

We are able to use single pair of Cisco Secure Firewall Threat Defend (FTD) 4145 firewalls to perform all of our required border firewalling, VPN gateway endpoint, S2S IPSEC tunnel endpoint, and provide IPS inline traffic inspection without impacting any of the throughput of the connected networks, most of which are 10Gbps links.

Support Rating

Support is typically great, but have had a few sessions where the technician did not seem to understand the issue or how to go about troubleshooting and had to escalate to different technician. Overall though the TAC technicians have been very knowledgeable in how to troubleshoot our issues, from unknown packet drops, routing issues through zones, upgrade failures and performance issues.

Cisco Security Ecosystem

Log management is lacking in that in order to float logs with all the enrichment you have to use a third party tool (estreamer) instead of natively pushing logs out dialog, especially given that Cisco ended support for the tool that they were supporting. Leaving customers with the option to build their own tool or pay significant amounts of money to use their Splunk solution.. The ability to configure route base IPSEC now is great, as well as AnyConnect support for remote access.

Alternatives Considered

Palo Alto Networks Advanced Threat Prevention

They are peer competitors, with Palo Alto offering some advantages over the Cisco products in the way of licensing simplicity and costs. The Palo Alto also supports the abilty to do "to the box" filtering and policy enforcement where Cisco requires special rules that are applied at low level that only do stateless control based on three tupile (IP, port, protocol).

Key Insights

Do you think Cisco Secure Firewall delivers good value for the price?

Yes

Are you happy with Cisco Secure Firewall's feature set?

Yes

Did Cisco Secure Firewall live up to sales and marketing promises?

Yes

Did implementation of Cisco Secure Firewall go as expected?

Yes

Would you buy Cisco Secure Firewall again?

Yes

Likelihood to Recommend

Secure, easy to manage, continuous improvements to management UI.