Cisco ASA with firepower services vs FTD

[shubhamkulkarni39]

Hello,

Whats the difference between traditional Cisco ASA with firepower vs new Cisco Firepower threat defence. 

why customer will go for Firepower threat defence, if they already have Cisco ASA with firepower services. 

what are the benefits of FTD and additional features in FTD? 

I also would like to know, what are the key benefits of Cisco Firepower appliances (4100, 9300) and what are the limitation of Firepower Appliances?

what are the difference between FTD and Firepower appliance? 

in which scenarios they use and other use cases? 

Thanks 

[Oliver Kaiser]

FTD combines both asa and firepower code into a single image. At the moment FTD has not reached feature parity with ASA features (no remote-access vpn, no multiple-context mode, no clustering, etc.) but it will be the way forward.

One of the benefits is that you wont need to configure two seperate instances (ASA & Firepower), but have a unified security policy that is managed either with Firepower Device Manager for small to mid-range deployments (ASA 5506-X - 5525-X) or using the central management with Firepower Management Center.

The Firepower appliances (4100, 9300) are the new NGFW hardware platform that can run either ASA (without firepower services) or FTD software. They are basically the evolution of the asa hardware platform that support higher throughput.

You may want to go down the FTD road if do not require the features not yet implemented from ASA as stated above. In about two years it should be the defacto standard.

Feature Comparison (Q4, 2016):

[Sebastian Stepponat]

Hi,

could you tell me from which document that picture is from? I am searching for a recent document, but was unable to finds something.

Kind Regards

Sebastian

[Oliver Kaiser]

The image is from a presentation. I am not sure if there is a customer facing document detailing all the feature differences between ASA with Firepower Services and FTD.

As for the images content... it is still correct except for Remote Access VPN, which was added in 6.2.1 release for FPR2100 and 6.2.2 for all other platforms

[Sebastian Stepponat]

Thanks, that was the answer I was looking for!

[khalid_mahmood]

Hi Oliver, very useful is their a newer version of this comparison chart for 2020/21?  thanks

[Marvin Rhoads]

You've asked some very broad questions. Here are a few answers.

FTD is an integrated image which combines all of the FirePOWER Services features with many (but not all) ASA firewall services.

If a customer is already running ASA with FirePOWER services, they may want to migrate in the long term to simplify management and operations. Short term, there are few compelling reasons.

Right now there are very few FTD features that are not available with a combination of ASA and FirePOWER services. Longer term, more developement resources on the FTD side may change that equation.

The 4100 and 9300 series are a whole new hardware platform for security appliances based on the UCS hardware. They offer much higher performance for a very attractive price when compared to the ASA platforms.

FTD runs on either the new 4100 and 9300 series or the ASA appliances (except 5585-X). FirePOWER appliances run only the legacy FirePOWER image and will not run FTD image.

[derscisco.com]

Hi Marvin,

"" Firepower appliances run only the legacy FirePOWER image and will not run FTD image"

Can you please explain which are the firepower appliances that you are referring to here ?

---

@Marvin Rhoads wrote:

You've asked some very broad questions. Here are a few answers.

FTD is an integrated image which combines all of the FirePOWER Services features with many (but not all) ASA firewall services.

If a customer is already running ASA with FirePOWER services, they may want to migrate in the long term to simplify management and operations. Short term, there are few compelling reasons.

Right now there are very few FTD features that are not available with a combination of ASA and FirePOWER services. Longer term, more developement resources on the FTD side may change that equation.

The 4100 and 9300 series are a whole new hardware platform for security appliances based on the UCS hardware. They offer much higher performance for a very attractive price when compared to the ASA platforms.

FTD runs on either the new 4100 and 9300 series or the ASA appliances (except 5585-X). FirePOWER appliances run only the legacy FirePOWER image and will not run FTD image.

---

---

---

 to here ?

[gvargo]

CIsco Firepower is garbage

Keep the ASA at least you can do stuff with it