Difference between Firepower FPR2130-NGFW-k9 and FPR2130-ASA-k9

[YHam]

Hello Everyone,

I need to purchase a Firepower 2130 firewall and primary use cases are site-to-site VPN, Anyconnect VPN, BGP routing, MFA. I'm confused between FPR2130-NGFW-k9 and FPR2130-ASA-k9 when selecting the part number for the firewall. I have gone through the documentation and it appears that FPR2130-NGFW-k9 can run in both FTD or ASA mode whereas FPR2130-ASA-k9 can run only in ASA mode. I read on some other website that FTD/NGFW doesn't support VPN so I'm confused which model (FPR2130-NGFW-k9 or FPR2130-ASA-k9) I would choose and here are some questions:

If FPR2130-NGFW-k9 with FTD does support site-to-site and Anyconnect VPNs, do I need additional license(s)? I believe I would need a license (e.g. Anyconnect plus L-AS-PLS-P-G) for Anyconnect but not sure about site-to-site VPN. I found a part number FPR2K-ENC-K9 (Cisco Firepower 2100 Strong Encryption (3DES/AES)) that is included in FPR2130-ASA-k9 but I don't see it or similar item for FPR2130-NGFW-k9.

do I need to purchase/deploy a separate management tool such as FMC to manage a single 2130 firewall (if its running FTD) or does firewall come with in-built software (like ASDM for ASA) that I can access through browser and administer the firewall?

I assume both FPR2130-NGFW-k9 and FPR2130-ASA-k9 support BGP routing protocol but looking for confirmation here?

If I don't need advance security features such as threat protection, malware protection, URL filtering etc. at the moment, can I exclude their subscriptions (FPR2K-EXCLUDE-SUBS)?

Is there a tool like Cisco Feature Navigator where I can check all available feature in different firewall platforms?

Thank you all. I will appreciate the help.

[Rob Ingram]

@YHam if you run the FTD image you will need to purchase a Remote Access VPN license, which is AnyConnect Apex/Plus, for a minimum of 25 users.

The FTD can be managed locally via Firepower Device Management (FDM), however it supports less features than if managed via an FMC. You access the FDM via Web browser. Another option is cloud based management via CDO, it also supports less features than if managed by the FMC.

BGP is supported.

If you do not need the advanced threat licenses then you do not need to purchase, the FTD will come with a base license.

[YHam]

Thank you, Rob. A couple follow-up questions. I will appreciate if you try to clarify

"if you run the FTD image you will need to purchase a Remote Access VPN license, which is AnyConnect Apex/Plus, for a minimum of 25 users."
Just to confirm on VPN, does FTD image support site-to-site VPN and do I not need any license?

"The FTD can be managed locally via Firepower Device Management (FDM), however it supports less features than if managed via an FMC."

Do you know how features supports look like for basic firewall setup, S2S VPN, anyconnect and BGP? Do you think i will run into issue if plan to manage FTD using FDM only (no FMC or CDO)?

With my specific feature needs (i mentioned above), I'm trying to think of any reason why I should buy FPR2130-ASA-k9 instead of FPR2130-NGFW-k9?

Thanks once again

[Rob Ingram · Accepted solution]

@YHam you don't need a license for Site-to-Site VPN only Remote Access VPN.

FDM will support S2S VPN, RAVPN and BGP, use version 7.x.

When managing via FDM it doesn't currently support all the features, such as DAP for RAVPN which requires either the FMC or use the ASA software. If you want advanced features you might find FDM lacking, but you could re-image the NGFW version to ASA software if you wanted, but using the ASA software you don't get the threat features, which you aren't planning to use those anyway.

[buffkata]

If you do not  need any advanced inspection that can be provided by the IPD/IDS functions - go for the ASA mode as it will  support all of your major concerns BGP,s2s and RA VPNs. As FTD most will be supported but you will always hit a bug or something that is not available as Cisco have not fully developed this yet and the whole concept of putting two systems(ASA and Snort)  together is not implemented well (?).  The FMC is also going to add cost to you if you need it.