topic Re: FPR4140-NGFW-K9 vs FPR4140-NGIPS-K9 in Network Security

FPR4140-NGFW-K9 vs FPR4140-NGIPS-K9

atiye.bigdeli — Tue, 07 Apr 2020 07:30:35 GMT

I have a question about difference between the following products:

FPR4140-NGFW-K9

FPR4140-NGIPS-K9

FPR4140-AMP-K9

I want to order the 4145 Firewall, but in "built and price" there isn't FPR4145-GFW-K9 part number.

is FPR4145-NGIPS-K9 the same as FPR4145-NGFW-K9?

Re: FPR4140-NGFW-K9 vs FPR4140-NGIPS-K9

Marvin Rhoads — Tue, 07 Apr 2020 09:55:46 GMT

Which top level appliance SKU you select depends on the desired deployment type. So select the desired appliance by deployment type (4140 example):
● FPR4140-ASA-K9 (for firewall deployment, running standalone ASA firewall)
or
● FPR4140-NGFW-K9 (for NGFW deployment, running Cisco Firepower Threat Defense)
or
● FPR4140-NGIPS-K9 (for NGIPS deployment [inline options], running Cisco Firepower Threat Defense)

Certain license and netmod SKUs will only be available to bundle into the top level part number when you select the correct starting point. For example, fail-to-wire netmods are not available on appliances running the ASA image.

Re: FPR4140-NGFW-K9 vs FPR4140-NGIPS-K9

atiye.bigdeli — Wed, 15 Apr 2020 10:14:42 GMT

Hi, thank you so for your help.

According to your respond we decided to buy the FPR4140-NGIPS-K9 appliance.

I have a another question

on FPR4140-NGIPS-K9 that has the "NGIPS deployment [inline options]" still can we use this device as a firewall like FPR4140-NGFW-K9 and use the access-lists?

Re: FPR4140-NGFW-K9 vs FPR4140-NGIPS-K9

Marvin Rhoads — Wed, 15 Apr 2020 17:45:47 GMT

You can but your options will be more limited since in NGIPS mode the device is transparent to user traffic. So it cannot NAT, for example. If you want to use it like a firewall (vs IPS) then why not just go with NGFW mode (FTD)?

Re: FPR4140-NGFW-K9 vs FPR4140-NGIPS-K9

atiye.bigdeli — Thu, 16 Apr 2020 13:48:10 GMT

thank you so much.

because I dont know the exactly difference between these appliances.

is there any document about their difference?

can we say that the following feature is only supported on FPR4125-NGIPS-K9?

Hardware Bypass ports

and the following feautres are not supported on FPR4125-NGIPS-K9?

DHCP server
DHCP relay
DHCP client
TCP Intercept
Routing
NAT
VPN
Application inspection
QoS
NetFlow

Re: FPR4140-NGFW-K9 vs FPR4140-NGIPS-K9

Marvin Rhoads — Fri, 17 Apr 2020 05:53:37 GMT

I don't have a comprehensive list although yours does list several pertinent differences.

The vast majority of customers are ordering the NGFW variant as they do so much more in general. NGIPS is purchased only by those who need a purely security appliance and prefer to perform all of the non-supported features on other devices. We see these primarily in larger organizations where a dedicated security team is responsible for all aspects of operations of the appliances.