SourceFire and firewall

[CSCO11428485]

could i replace the asa with sourcefire NOT "FIrepower" , because i have asa 5520 as a current firewall and some one advice me to replace it with  a "Sourcefire SF-3D8140 ", and if bought it, how could i use this with the current setup scenario If the budget cannot afford to buy a new  ٍِِASA device instead of the old asa that i had, please advice 

[scdugan]

There is not enough information about how you are implementing the ASA 5520 to answer your question fully.  You can replace your older ASA with a 8140 Firepower sensor and implement NGFW and NGIPS.  HOWEVER, the ASA is very good at the NGFW part while the SourceFire sensor is very good at the NGIPS piece.  Remember also that the sensor isn't configured directly on box.  it requires a FireSight manager to implement policy.

The easier solution for most would be to upgrade your ASA to a 5500-X NGFW model and install the FirePower module for NGIPS with a FireSight manager (virtual or appliance) to control the IPS, AMP, AIC, and URL filter policies.

[CSCO11428485]

Thanks so much for your advice 

[Skjalg Eggen]

No need to buy a 3D8140, just get two ASA5515-X or 5525-X and buy a firepower amp/url/ips lic. also get the 2 device license for Firesight management and download the vmware version. 

use the regular asa ASDM for regular accesslists/routing/NAT and then inspect the wanted traffic with FirePower.

this way you can loosen up on the ACL's and tighten down with application rules. 

set up an E-mail warning for impact 1 events, block all bad reputation websites in URL and all malware with a file policy.

[CSCO11428485]

Thanks so much.  For Your valuable information 

[Marvin Rhoads · Accepted solution]

Wow an 8140 is way overkill to replace a 5520.

If you went with even an HA pair of new ASA 5545-X with full FirePOWER module licenses and the necessary two node FireSIGHT Management Center (FMC) license, the cost would be less than half that of a single 8140 with similar licenses and the larger FMC that's necessary.

I recommend to get your advice from a better qualified source.

[CSCO11428485]

Thanks for your advice and information