A selection of FAQs exploring Cisco's Next-Generation Firewall security features and solutions.
The Cisco Firepower™ Next-Generation Firewall (NGFW) is the industry’s first fully integrated, threat-focused NGFW. It delivers comprehensive, unified policy management of firewall functions, application control, threat prevention, and advanced malware protection from the network to the endpoint.
The capability of visibility and analysis up to layer 7: Intrusion prevention, Application visibility, Malware protection, URL Filtering, Security intelligence with Talos. This is the key reason why Cisco decided to take this direction. And everything can be managed from a single central point.
• Provides a next-generation intrusion prevention system (NGIPS) to deliver industry-leading threat protection
• Includes a fully integrated advanced malware protection (AMP) solution that addresses both known and unknown threats, along with an integrated sandbox
• Gives you the ability to track and contain malware infections • Automatically correlates threat events with your network’s vulnerabilities so you can focus your resources on the threats that matter most
• Analyzes your network’s weaknesses and recommends the best security policies to put in place
• Integrates with a number of Cisco® network security products to take advantage of your previous investments and provide stronger security
Cisco Secure Firewall Management Center provides unified management of firewalls, application control, intrusion prevention, URL filtering, and malware defense policies.
Yes! Most features are exported via REST APIs. For a good starting point on leveraging NGFW REST APIs please take a look at the following page.
Note that you can explore the APIs of your FMC instance by going here: https://<management_center_IP_or_name>:<https_port>/ api/api-explorer.
A common reason could be to check the URL that your endpoints are accessing (limiting malware sites, or blocking certain categories),or analyzing your endpoint network traffic for malware with the AMP (Anti-Malware Protection) capabilities of NGFW. Here is a reference guide that provides additional information on AMP for networks (which runs is only supported on NGFW). In addition, there are numerous customers that still use the ASA software for their VPN needs and there are no plans to End Of Life ASA software.
The best way to get started is with the NGFW webinars available at the following link: https://learningnetwork.cisco.com/s/next-generation- firewall-training-videos. There are multiple recorded sessions under “Training Videos”.
Choosing between ASA (Adaptive Security Appliance Software ) or Cisco Next Generation Firewall (NGFW) depends on your deployment requirements. There is still a large demand for traditional L3/L4 FW and VPN concentrators that is satisfied by customers running ASA software on Firepower hardware. In addition, ASA is optimized to run on the latest Firepower appliance. FTD software delivers the layer 7 NGFW features beyond traditional stateful inspection and VPN, including: NGIPS, Malware protection, URL filtering, etc. Choosing which firewall application is the best fit is all a matter of your requirements. The key difference is FTD has the capacity for enhanced visibility and analysis of traffic and threats all managed from a centralized console.
Yes, there is integration between NGFW and Application Centric Infrastructure (ACI).
The best place to start is to review the session named Deep Dive on Cisco Security in ACI - BRKACI-3004 that was given at Cisco Live. There are device packages available for Firepower Threat Defence (FTD), Firepower Management Center(FMC) , Deep Dive on ACI integration.
There are numerous customer benefits from the NGFW, Cisco Identity Services Engine (ISE) and ACI integration; you can correlate user identities with IP addresses, and in addition you can inherit Security Group Tags (SGT) from ISE and use them in the policies. There is a very good webinar that describes this more here. You have to click on “Training Videos”, and then choose “FMC External Authentication & Sources”, in particular “Lesson 3: User Awarenesses & User Policy”. The related documentation is in the Config Guide.
Regarding the ACI integration, we have device packages available to integrate FTD into ACI. Some customers still choose to have NGFW unmanaged and use it as a choke point within ACI. Firepower Threat Defense (FTD) and ISE have a number of integrations including SGTs, ISE attributes to build policy, as well as the integration of PxGrid and the NGFW remediation module to take action on bad actors. There is also an RAVPN integration with ISE and CoA.
Here are some very good references:
· For the NGFW integration with ACI, we recommend watching the following Cisco Live presentation. In addition, please take a look at the Quick Start Guide.
· For the DNA interaction, according to the DNA compatibility information only Cisco Adaptive Security Appliance (ASA) Software is supported (ASA5500-X, min supported version is 9.8.2). From the design guide we can use a firewall as a “fusion” device. A firewall, Layer 3 switch, or router can then be used to leak routing information, maintained in each VRF, thus enabling communication between virtual networks while also providing a control point to enforce established security policies. These network devices are commonly referred to as “fusion” firewalls or routers.
Today these fusion routers and firewalls must be external to the fabric.
· For the SD-WAN we have the IOS-XE ZBF and UTD functionalities. In the webpage you will find how to install, configure, activate, and update the Cisco SD-WAN Release 18.4 IPS/IDS and URL-F Security Policy Virtual Image. Zone-based firewalls are a type of localized data policy that allows stateful inspection of TCP, UDP, and ICMP data traffic flows.
· Regarding the Security Group membership of NSX-T, it’s supported with the Firepower Threat Defense (FTD) of Cisco Next-Generation Intrusion Prevention System (NGIPS) . We currently have device packages for FTD support in ACI and we support the use of SGTs. We are actively developing the use of dynamic objects from environments such as NSX-T into the NGFW for policy
FTD does support AnyConnect for SSL and IPsec-IKEv2 remote access VPNs. For available features and configuration steps please refer to the config guide: FMC Guide
Unfortunately not at this time. According to the FTD configuration guide “Firepower 9300 and 4100 series in cluster mode do not support remote access VPN configuration”. The same applies to the ASA software. RA VPN is supported in Active/Standby HA on ASA or FTD. RA VPN is not supported on clustering in either ASA or FTD.
We have a very powerful Firepower Migration Tool, which now supports migration from third party firewall platforms. Contact a Cisco Specialist here who can provide you a link to test this tool.
There is a very good performance estimator tool available for cisco customer at https://ngfwpe.cisco.com using their Cisco credentials.
It’s also possible to flag the IPS checkbox and see how much it impacts the performance and throughput of your appliance. Additionally, there are a number of factors that go into performance; traffic profile, object size, rule size, latency, etc. A general expectation of the impact of enabling IPS on our NGFWs is documented in our datasheets. We have an internal Proof Of Value and test team that can be used to bench test the FWs to show the performance with your specified criteria. If you want to test it or try the Firepower estimator tool please contact a Cisco Specialist filling this form.
The aim of Cisco Defence Orchestrator (CDO) is a bit different than simply trying to make it “Firepower Management Console (FMC) in the cloud.” The goals of CDO initially are to harmonize policies across multiple Cisco enforcement points (Cisco Adaptive Security Appliance ASA Software , Firepower Threat Defense , Meraki MX, etc) as well as extend policy management to select third-party enforcement points (such as Amazon Web Services Security Groups). Thus we do not anticipate feature parity with FMC for some time.
For more information on CDO, please watch this demo
For a big fleet of Cisco firewalls, we have two possibilities: the Firepower Management Console (FMC), which can manage hundreds of devices, and the Cloud Defence Orchestrator (CDO), which can manage thousands of ASA devices as well as harmonize security policies for FTD and other devices.
The difference is that FMC is an appliance (physical or virtual), while CDO is a cloud-based solution. In addition, CDO is also able to manage ASA software, while FMC can manage FTD and “ASA with Firepower”.
We currently offer FTD in both AWS and Azure marketplaces to help organizations secure their public cloud infrastructure. We will be adding support for GCP and OCI this year as well as an ongoing roadmap for other public clouds.