Do I need Threat Defense with a FirePower 1140 firewall?

[grahamgardner]

I am looking to upgrade to a Cisco Firepower 1140 firewall but the added cost of having all three Threat Defense Licenses makes it pretty expensive as it increases the cost of the solution by almost double. I am wondering if we dont go for the additional Threat Defense licensing, what are we missing out on? Do we still end up with a great usable firewall? Obviously we will be purchasing additional per user VPN licensing but the Threat Defense licenses are fairly pricey. We are a 50 user team in a single office location made up of regular desktop users.

[Francesco Molino]

Hi

Licenses you're talking about are for IPS (Threat protection), Malware and URL Filtering. You can buy all of them or some of them (for example Threat + Malware or Malware only or ...). If you don't buy them, you'll have your firewall working as a standard FW without these extra protections. You can add them afterwards without issues.

Also, if you don't want to use these features, you can make the decision to go with ASA code only instead of FTD unified image.

[Marvin Rhoads]

Do you have any other security solution in your environment? I'd only recommend forgoing Threat Defense if there was a strong implementations of things like Umbrella and possibly AMP for Endpoints to supplement the security posture.