It's a bit more than the management. FTD basically combines the asa and sourcefire code into one image so there is no need for a software or hardware module in the firewall. I wouldn't say it is their goal to eliminate CLI but it was an unfortunate conclusion that was reached. CLI configuration is not possible as of now (with some cli operations being the exception) and all configuration must be done from FMC or FDM UI.   As of now I would say it is worth taking a look at, since it will be the way forward in ciscos firewall strategy. Ofc there are still some limitations that you should keep in mind: Unsupported Multiple-Context mode Clientless SSL VPN Configuration CLI HA (Active/Standby) for Public Cloud (AWS/Azure) ASA5585-X Platform support (not possible due to hardware architecture) Hyper-V support TLS Proxy for Encrypted Voice Inspection Supported with limitations Local device manager (no feature parity between FDM and FMC) Central management via in-band data path (Staging or OOB required for remote management) AnyConnect (no feature parity with ASA) REST API (no feature parity with ASA REST API yet) SSL Acceleration (only for FPR4100 & FPR9300) Clustering (only for FPR4100 & FPR9300) Unified Connection Logging (FTD Connection events do not include detailed L4 information, e.g. SYN Timeout, etc.) Supported with FlexConfig Modular Policy Framework (e.g. changing tcp timeouts, changing inspections depending on ACL) Bidirectional Forwarding Detection (BFD) Web Cache Communications Protocol (WCCP) Virtual Extensible LAN (VXLAN) Intermediate System to Intermediate System (IS-IS) Enhanced Interior Gateway Routing Protocol (EIGRP) Policy-based Routing (PBR) Equal-cost multi-path routing (ECMP) NetFlow   Hope that helps. :)    ... View more

There could be various reasons as to why the performance is measured at 2.5Gbps by NSS Labs. According to their testing methodology (v 7.0) they are using traffic generators that will do various src/dst ip/port variations but I could not figure out the exact numbers.    Since Firepower load balances traffic across multiple snort (ips) instances the result could be like that because of sub-optimal load balancing due to insufficient number of variations in the test traffic. The datasheet numbers are basically the max performance if traffic is evenly distributed to all snort instances... so the maximum throughput of a single flow = [datasheet-throughput] / [snort-instances].   Another reason could be bugs in 6.1.0.1 that lead to performance degradation. If you seek a more detailed reason you would have to contact cisco or buy the nss labs report that might go into more details.   Hope that helps.    kind regards Oliver ... View more

CPU MIB   1.3.6.1.4.1.9.9.109.1.1.1.1.3. cpmCPUTotal5sec 1.3.6.1.4.1.9.9.109.1.1.1.1.4. cpmCPUTotal1min 1.3.6.1.4.1.9.9.109.1.1.1.1.5. cpmCPUTotal5min Memory MIB 1.3.6.1.4.1.9.9.48.1.1.1.5. ciscoMemoryPoolUsed 1.3.6.1.4.1.9.9.48.1.1.1.6. ciscoMemoryPoolFree ... keep in mind that this is only the lina part of FTD. As you may know FTD consists of two parts. Lina, which is basically the ASA code running in userspace and snort. Using the listed MIBs you will get stats for lina but not the various snort instances which handle L7 traffic.  As far as I am aware of there is no way to poll the linux part to get stats for snort instances using SNMP.   Hope that helps ... View more

The image is from a presentation. I am not sure if there is a customer facing document detailing all the feature differences between ASA with Firepower Services and FTD. As for the images content... it is still correct except for Remote Access VPN, which was added in 6.2.1 release for FPR2100 and 6.2.2 for all other platforms ... View more

FMC UI user accounts are being synced between FMCs. You may see a certain delay since the configuration must be replicated to the passive FMC... there is a enhancement request to publish more documentation on what exactly is synced between FMCs in HA (CSCve00330)   Hope that helps. :) ... View more

No offense but that logic is kinda flawed. I am not a big fan of the backup concept either. Its basically a database dump with some configuration files attached. I have some larger installations which already produce backup files that are > 2GB of size. @anazarenko - unfortunately you will need to live with the backup size. as of now there is no flat file configuration backup like what you are used to. 6.2.2.1 should include a better audit trail which might help you with compliance requirements. ... View more

Âs Marvin suggest I would also recommend using FTDv. You can install a 2x FTDv and build an HA bundle. No need to invest in hardware if you dont have to do specific tests that require you to have a certain hardware model. The software is exactly the same... the only difference to FP2100/4100/9300 is that you dont have FX-OS underneath. ... View more