| Zone-based firewall and NAT services | VRF-Aware Firewall and Network Address Translation (NAT) | VRF-Aware Firewall and Network Address Translation (NAT) | VRF-Aware Firewall and Network Address Translation (NAT) | VRF-Aware Firewall and Network Address Translation (NAT) | VRF-Aware Firewall and Network Address Translation (NAT) |
| Hardware VPN acceleration(DES, 3DES, AES) | Yes | Yes | Yes | Yes | Yes |
| IPSEC VPN services | FlexVPN, Easy VPN remote server, Enhanced Easy VPN, Dynamic Multipoint VPN (DMVPN) | FlexVPN, Easy VPN remote server, Enhanced Easy VPN, Dynamic Multipoint VPN (DMVPN) | FlexVPN, Easy VPN remote server, Enhanced Easy VPN, Dynamic Multipoint VPN (DMVPN) | FlexVPN, Easy VPN remote server, Enhanced Easy VPN, Dynamic Multipoint VPN (DMVPN) | FlexVPN, Easy VPN remote server, Enhanced Easy VPN, Dynamic Multipoint VPN (DMVPN) |
| | Group Encrypted Transport VPN (GET VPN), V3PN, MPLS VPN | Group Encrypted Transport VPN (GET VPN), V3PN, MPLS VPN | Group Encrypted Transport VPN (GET VPN), V3PN, MPLS VPN | Group Encrypted Transport VPN (GET VPN), V3PN, MPLS VPN | Group Encrypted Transport VPN (GET VPN), V3PN, MPLS VPN |
| SSL VPN | No | No | No | No | No |
| Intrusion prevention | Yes (Snort for Singnature Based and FirePower as nGIPS) | Yes (Snort for Singnature Based and FirePower as nGIPS) | Yes (Snort for Singnature Based and FirePower as nGIPS) | Yes (Snort for Singnature Based and FirePower as nGIPS) | Yes (Snort for Singnature Based and FirePower as nGIPS) |
| Anomaly Detection and Machine Learning | Cisco Self Learning Networks (SLN) | Cisco Self Learning Networks (SLN) | Cisco Self Learning Networks (SLN) | Cisco Self Learning Networks (SLN) | Cisco Self Learning Networks (SLN) |
| Network foundation protection | ACL, FPM, control plan protection, control plane policing (CoPP), QoS, role-based CLI access, source-based RTBH, uRPF, SSHv2 | ACL, FPM, control plan protection, control plane policing (CoPP), QoS, role-based CLI access, source-based RTBH, uRPF, SSHv2 | ACL, FPM, control plan protection, control plane policing (CoPP), QoS, role-based CLI access, source-based RTBH, uRPF, SSHv2 | ACL, FPM, control plan protection, control plane policing (CoPP), QoS, role-based CLI access, source-based RTBH, uRPF, SSHv2 | ACL, FPM, control plan protection, control plane policing (CoPP), QoS, role-based CLI access, source-based RTBH, uRPF, SSHv2 |
| Cisco Umbrella Branch Support | Yes | Yes | Yes | Yes | Yes |
| Cisco Cloud Web Security | Yes | Yes | Yes | Yes | Yes |
| Identity-based networking | No | No | No | No | No |
| Cisco TrustSec | Security Group Tag Exchange Protocol (SXP), SGT over GETVPN | Security Group Tag Exchange Protocol (SXP), SGT over GETVPN | Security Group Tag Exchange Protocol (SXP), SGT over GETVPN | Security Group Tag Exchange Protocol (SXP), SGT over GETVPN | Security Group Tag Exchange Protocol (SXP), SGT over GETVPN |
| | SGT over IPSEC | SGT over IPSEC | SGT over IPSEC | SGT over IPSEC | SGT over IPSEC |
| | SGT over DMVPN | SGT over DMVPN | SGT over DMVPN | SGT over DMVPN | SGT over DMVPN |
| | SGT-based ZBFW | SGT-based ZBFW | SGT-based ZBFW | SGT-based ZBFW | SGT-based ZBFW |
| | Port/Layer 3 interface/IP/subnet-to-SGT mapping | Port/Layer 3 interface/IP/subnet-to-SGT mapping | Port/Layer 3 interface/IP/subnet-to-SGT mapping | Port/Layer 3 interface/IP/subnet-to-SGT mapping | Port/Layer 3 interface/IP/subnet-to-SGT mapping |
| | SGT export in Flexible NetFlow | SGT export in Flexible NetFlow | SGT export in Flexible NetFlow | SGT export in Flexible NetFlow | SGT export in Flexible NetFlow |