Corporate networks are encountering the highest levels of change in history. Users require anywhere, anytime access to the network from a variety of company- and personally-owned mobile devices. In addition, applications have evolved to be highly dynamic and multifaceted, blurring the line between legitimate business applications and those that waste time and increase the company's exposure to internet-based threats. As a result, organizations must take a new approach to security - without abandoning time-tested methods - to unify the network's security framework, accelerate business innovation, and proactively protect against new and emerging threats.
Cisco® ASA CX Context-Aware Security is a modular security service that addresses these needs by blending a proven stateful inspection firewall with next-generation capabilities and a host of additional network-based security controls - for end-to-end network intelligence and streamlined security operations. Cisco ASA CX enables organizations to rapidly adapt to dynamic business needs while maintaining the highest levels of security. Like most next-generation firewalls, ASA CX delivers application and user ID awareness capabilities for enhanced visibility and control of network traffic. In addition, ASA CX enables administrators to:
• Control specific behaviors within allowed micro-applications
• Restrict web and web application usage based on reputation of the site
• Proactively protect against Internet threats
• Enforce differentiated policies based on the user, device, role, and application type
Unprecedented Network Visibility
Cisco ASA CX Context-Aware Security gives security administrators an unprecedented level of visibility into the traffic flowing through the network, including the users connecting to the network, the devices used, and the applications and websites that are accessed.
ASA CX uses Cisco security technologies to provide actionable intelligence to security administrators. For example, Cisco AnyConnect® provides information on the type and location of a mobile device before it can access the network. ASA CX also uses global threat intelligence from Cisco Security Intelligence Operations (SIO) to provide zero-day threat protection. Using these and other Cisco security technologies throughout the network, ASA CX delivers end-to-end network visibility for superior security control, including:
• Robust authentication. In addition to passive authentication methods using Active Directory agent and Lightweight Directory Access Protocol (LDAP), Kerberos and NT LAN Manager are used to provide active authentication.
• Device information. Cisco AnyConnect provides information on the specific types of user devices attempting to gain access to the network, as well as whether the device is located locally or remotely, enabling administrators to confidently allow devices while maintaining high levels of network protection and control.
• Reputation-based threat defense. Threat intelligence feeds from Cisco SIO use the global footprint of Cisco security deployments (more than 2 million devices) to analyze approximately one-third of the world's Internet traffic from email, intrusion protection system (IPS), and web threat vectors. The feeds are updated every three to five minutes for near-real-time protection from zero-day threats.
Granular Application, User, and Device Control
Cisco ASA CX blocks port- and protocol-hopping applications such as Skype and other peer-to-peer applications, providing more effective security while requiring fewer policies. It enables policies to be written based on a wide range of contextual elements, including application, user, device, and location.
ASA CX also employs deep social networking controls. It recognizes more than 1000 applications and 75,000 micro-applications, enabling organizations to provide individual or group-based access to specific components of an application (Facebook for business use, for example) while disabling other components (such as Facebook games). Specific behaviors can also be blocked within allowed micro-applications for an additional layer of control.
Using Cisco AnyConnect, ASA CX shows the specific type of device attempting to gain access to the network, as well as information on whether the device is located within the network or is attempting remote access. With a clear understanding of the devices that are attempting to access network resources, administrators can confidently allow a multitude of devices while maintaining high levels of network protection and control.
Comprehensive Security Architecture
ASA CX extends the ASA platform to provide unprecedented visibility and control. Support for Layer 3 and Layer 4 stateful firewall features, including access control, network address translation, and stateful inspection, enables organizations to keep existing stateful inspection firewall policies that are essential for a host of compliance regulations, while adding Layer 7 context-aware rules that can act intelligently on contextual information. ASA CX uses the Cisco SecureX Architecture® to gain local intelligence from the Cisco AnyConnect Secure Mobility Client and near-real-time global threat intelligence from Cisco SIO. A proven firewall platform, combined with the power of local and global threat intelligence, provides a comprehensive, dynamic security architecture that is capable of addressing an organization's evolving security needs to enable growth, extensibility, and ongoing innovation.
Features and Benefits
Table 1 lists the features and benefits of Cisco ASA CX Context-Aware Security.
Table 1. Features and Benefits
Feature
Benefit
Application awareness
Enforces access policy based on more than 1000 commonly used applications and 75,000 micro-applications; provides granular access control based on "behavior" (for example, a file upload or a post on a social networking site) to further control user activity related to applications; controls port- and protocol-hopping applications that can evade classic security controls.
Identity-based firewalling
Provides differentiated access control based on user and user role; supports common identity mechanisms such as Active Directory agent, LDAP, Kerberos, and NT LAN Manager.
Device-type-based enforcement
Uses Cisco AnyConnect to identify the types of devices (such as iPads, iPhones, and Android devices) that are accessing the network, and controls which devices will be permitted or denied.
URL filtering
Enterprise-class, full-featured URL filtering solution enables granular control of Internet traffic.
Global threat intelligence
Uses the global footprint of Cisco security deployments for more comprehensive network protection. Cisco SIO delivers regularly updated threat intelligence feeds for near-real-time protection from zero-day malware.
Stateful firewall capabilities
In addition to enabling Layer 7 context-aware rules, provides extensive support for Layer 3 and Layer 4 stateful firewall features, including access control, network address translation, and stateful inspection.
Intuitive management solution
Preloaded with Cisco Prime™ Security Manager, a powerful, intuitive management solution that simplifies the management of context-aware firewalls.
Product Performance
Table 2 lists the capabilities and capacities of the Cisco ASA CX Context-Aware Security hardware for the ASA 5585-X appliance. For the capabilities and capacities of ASA CX software on the ASA 5500-X platform, please see the data sheets for ASA 5500-X appliances for small and branch offices or for the Internet edge.
Table 2. Cisco ASA CX Hardware Blade Capabilities and Capacities
Feature
ASA 5585-X CX SSP-10
ASA 5585-X CX SSP-20
Throughput
2 Gbps (multiprotocol)
5 Gbps (multiprotocol)
Maximum concurrent sessions
500,000
1,000,000
Connections per second
40,000
75,000
Supported applications
1000+
1000+
Supported micro-applications
75,000+
75,000+
URL categories
78
78
Number of URLs categorized
20+ million
20+ million
Languages for URL filtering
60+
60+
Number of web requests analyzed by Cisco SIO every day
Centralized configuration, logging, monitoring, and reporting
Multidevice Cisco Prime Security Manager
Multidevice Cisco Prime Security Manager
Regulatory and Standards Compliance
Safety
UL 60950
CSA C22.2 No. 60950
EN 60950
IEC 60950
AS/NZS60950
UL 60950
CSA C22.2 No. 60950
EN 60950
IEC 60950
AS/NZS60950
Electromagnetic compatibility (EMC)
CE marking
FCC Part 15 Class A
AS/NZS CISPR22 Class A
VCCI Class A
EN55022 Class A
CISPR22 Class A
EN61000-3-2
EN61000-3-3
CE marking
FCC Part 15 Class A
AS/NZS CISPR22 Class A
VCCI Class A
EN55022 Class A
CISPR22 Class A
EN61000-3-2
EN61000-3-3
Platform Support/Compatibility
The ASA 5585-X CX SSP-10 and SSP-20 hardware blades are supported on Cisco ASA 5585-X platforms running Cisco ASA Software Release 8.4.4 and higher. ASA CX software is supported on the Cisco ASA 5500-X Series of next-generation midrange security appliances running Cisco ASA Software Release 9.1 and higher. Regardless of form factor, ASA CX is managed using Cisco Prime Security Manager.
Ordering Information
To place an order, visit the Cisco Ordering Home Page. Table 4 provides ordering information for Cisco ASA CX.
