topic Firewall + IPS + CX on ASA5512-X ? in Network Security

Firewall + IPS + CX on ASA5512-X ?

susanto.liu — Tue, 12 Mar 2019 01:10:22 GMT

Dear All Master

is that possible ASA5512-X include Firewall + IPS + Context-Aware in single box ?

If possible, so buy "ASA5512-IPS-K9" + "ASA5512-AW1Y-PR=" ?

for enable Context-Aware in ASA5512-x, we need to buy PRSM (Prime Security Manager) ?

Thanks,

Susanto

Firewall + IPS + CX on ASA5512-X ?

Julio Carvajal — Wed, 06 Mar 2013 16:46:03 GMT

Hello,

Both of them are software based but I would say that the ASA would only support one at the time,

I heard that in a moment the CX would have IPS capabilities,

Regards,

Julio Carvajal

Firewall + IPS + CX on ASA5512-X ?

susanto.liu — Thu, 07 Mar 2013 01:28:16 GMT

Hi jcarvaja,

Thx for your support.

Ok , i see.

One more questions

for enable Context-Aware in ASA5512-x, we need to buy PRSM (Prime Security Manager) ?

Regards,

Susanto

Firewall + IPS + CX on ASA5512-X ?

Julio Carvajal — Thu, 07 Mar 2013 04:17:04 GMT

Hello,

Nope, It came built in in the Cisco ASA CX box...

Regards,

Firewall + IPS + CX on ASA5512-X ?

Marvin Rhoads — Thu, 07 Mar 2013 04:21:02 GMT

Hi Susanto,

Julio is correct - as of now you can run CX or IPS but not both. That may change in the future.

With regard to PRSM, each ASA CX comes pre-installed with an “on-box” version of PRSM that can be used to manage a single CX module. This version does not require a separate license. It has limited storage available for event logging and reporting purposes. In all but the most trivial CX deployments, it is recommended that customers procure PRSM central management solution.

The centralized off-box solution is avaialble as a VM (5, 10, or 25 device version) or as a physical appliance.

Firewall + IPS + CX on ASA5512-X ?

susanto.liu — Thu, 07 Mar 2013 04:40:18 GMT

jcarvaja and Marvin,

Thank You

Now, it's clear.

See you Pal

Firewall + IPS + CX on ASA5512-X ?

Charisdian Salim — Thu, 07 Mar 2013 07:03:28 GMT

Hi Marvin,

If the ASA Firewall devices 5545-X, 5555-X or 5585-X is it possible include Firewall + IPS + Contex Aware in Single Box ?

rgds,

Charis

Firewall + IPS + CX on ASA5512-X ?

Marvin Rhoads — Thu, 07 Mar 2013 14:04:20 GMT

Charis,

You cannot combine the IPS and Context Aware features on any of the ASA platforms at this time.

Firewall + IPS + CX on ASA5512-X ?

l.guerrero — Wed, 23 Oct 2013 15:33:11 GMT

It is not yet supported IPS and Context Aware features on any of the ASA platforms at this time?

in the new release 9.2 talk about support IPS filtering..

http://www.cisco.com/en/US/partner/docs/security/asacx/roadmap/asacxprsm_new_features.html

•Next Generation IPS filtering, including automatic signature updates, global settings, dasbhoards, events, and reporting. You configure IPS filtering directly in access policies. Next Generation IPS filtering is a separately-licensed service; the device includes an evaluation license.

boy its no so clear..

Firewall + IPS + CX on ASA5512-X ?

Marvin Rhoads — Wed, 23 Oct 2013 16:55:54 GMT

The ASA CX and PRSM 9.2 (just released last week) adds the ability to run NGFW IPS with the other CX functions (AVC and WSE).

It's not the exact same IPS product as the traditional Cisco IPS appliance (or module) but more threat-based vs. signature-based.

It does require an IPS license for the CX.

Dear Marvin,Based on your

Syed Farhan Ali — Mon, 14 Apr 2014 06:00:55 GMT

Dear Marvin,

Based on your post, I believe if we quote:

"ASA5515-SSD120-K9" with "ASA5525-AI1Y" OR "ASA5525-AWI1Y"

then CX and IPS features will be readily available within the same box.

Regards,

Farhan.

Farhan,Yes that is correct.

Marvin Rhoads — Mon, 14 Apr 2014 11:54:19 GMT

Farhan,

Yes that is correct. The exact order would also include the service contract line item for the base ASA as it is a prerequisite for the subscription services. If you use Cisco Commerce Workspace (CCW) as a partner this will be automatically included.

You also have the option of quoting 3-year and 5-year subscriptions. They are discounted when purchased up front that way.

Dear Marvin,Yes sure,

Syed Farhan Ali — Tue, 15 Apr 2014 05:30:28 GMT

Dear Marvin,

Yes sure, SMARTNET is a must when procuring subscription services.

Thanks for clearing out. Now I will tell our clients to go for ASA NGN Firewalls since it has the features to become a robust security solution.

Regards,

Farhan.

Hi Julio I see that this post

ysantizo1 — Wed, 27 May 2015 22:32:09 GMT

Hi Julio

I see that this post has two years since posted.

Do you know if now is there any possibilities to have both ips and cx working at the same time?

I have an ASA 5512-x too.

Thanks in advance.

Best regards!

ysantizo1,Please see the

Marvin Rhoads — Thu, 28 May 2015 02:06:18 GMT

ysantizo1,

Please see the posts later on in this thread past the initial question and answer.

Cisco did add basic IPS functionality and associated licensing to the CX module in December 2013.

However, the end-of-sales for the entire product has since been announced. You can technically purchase the IPS license through 17 August 2015 but you will be discouraged from doing so as it will not be enhanced going forward.

The replacement product is the FirePOWER Service module, based on technology from the Sourcefire acquisition. That is a much more capable and powerful solution. The CX software module can be re-imaged to a FirePOWER module ("sfr") and then licensed and configured from a FireSIGHT Management Center.

That is Cisco's strategic product direction moving forward. As noted in the End of Sales document:

"Customers are encouraged to migrate from Cisco ASA CX Context-Aware Security to Cisco ASA with FirePOWER Services. Information about this product can be found at:
http://www.cisco.com/c/en/us/products/security/asa-firepower-services/index.html."