FTD vs FPR: what's in and what's out?

[HQuest]

For those familiar with both FTD and FPR, which features did FPR lost that FTD had, and which features did FPR gained that FTD did not had?

While the traditional, pure L3 Cisco ASA still has its niche and it is very well known by the security community, Cisco FTD was Cisco's entry into the L7 firewall realm. Of course, you could extend your traditional ASA with the NGFW parallel image, but this was not on par with the competition, neither was an elegant solution for this new problem. FTD was L7 centric with L3 capabilities included. Long story short, it is safe to say it is mostly clear what ASA, ASA+NGFW and FTD are, its distinctions, limitations and functionalities. Then Cisco decided to begin FTD retirement, with FPR in its place. At first, FPR looks like a much needed improved version of FTD: faster, more scalable, more affordable and overall competitive. It brings the core features of FTD: L7 capabilities, central management (via FMC), IPS, AMP for Networks, URL filtering, SSL decryption.

Is the above a correct statement?

[Marvin Rhoads]

I'm not sure what you're asking. There is no Cisco product known as FPR.

There are currently:

1. Classic ASA (running on ASA or Firepower appliances or as a VM)

2. ASA with Firepower service module (running only on ASA hardware)

3. Firepower appliances (or VM) running Firepower OS (previous Sourcefire product).

4. Firepower Threat Defense software (running on ASA or Firepower appliances or as a VM).

[HQuest]

Originally, the hardware we used to order was the ASA firewall, which ran the ASDM mode. Then the ASA was extended to the Sourcefire as either ASDM+FP or FTD. Now, some of the new hardware can only be purchased as Firepower (Product ID FPR - I.e., Firepower 2100 series).

From your note, it sounds like the ASA running as FTD and a similarly spec’ed Firepower appliance are the same, except the new Firepower appliance has no option of running traditional ASA ASDM code. Which is what I’m after.

Thank you.

[Marvin Rhoads]

Firepower hardware appliances, including the 1100, 2100, 4100 and 9300 series are all able to run ASA code. Some of them weren't initially but that has changed.