Cisco ASA with FirePower Services vs. FTD

More questions about the Cisco ASA with firepower services and FTD:

“What’s the difference between traditional Cisco ASA with firepower and new Cisco Firepower threat defense?”

“Why customer will go for Firepower threat defense, if they already have Cisco ASA with firepower services.”

“What are the benefits of FTD and additional features in FTD?”

“What are the key benefits of Cisco Firepower appliances (4100, 9300) and what are the limitations of Firepower Appliances?”

All the questions above have one point: What are the difference between FTD and Firepower appliance? 

In which scenarios they use and other use cases? 

FTD combines both ASA and firepower code into a single image. At the moment FTD has not reached feature parity with ASA features (no remote-access vpn, no multiple-context mode, no clustering, etc.) but it will be the way forward.

One of the benefits is that you won’t need to configure two separate instances (ASA & Firepower), but have a unified security policy that is managed either with Firepower Device Manager for small to mid-range deployments (ASA 5506-X-5525-X) or using the central management with Firepower Management Center.

The Firepower appliances (4100, 9300) are the new NGFW hardware platform that can run either ASA (without firepower services) or FTD software. They are basically the evolution of the asa hardware platform that support higher throughput.

You may want to go down the FTD road if do not require the features not yet implemented from ASA as stated above. In about two years it should be the defacto standard.

Feature Comparison (Q4, 2016):

…

FTD is an integrated image which combines all of the FirePOWER Services features with many (but not all) ASA firewall services.

If a customer is already running ASA with FirePOWER services, they may want to migrate in the long term to simplify management and operations. Short term, there are few compelling reasons.

Right now there are very few FTD features that are not available with a combination of ASA and FirePOWER services. Longer term, more development resources on the FTD side may change that equation.

The 4100 and 9300 series are a whole new hardware platform for security appliances based on the UCS hardware. They offer much higher performance for a very attractive price when compared to the ASA platforms.

FTD runs on either the new 4100 and 9300 series or the ASA appliances (except 5585-X). FirePOWER appliances run only the legacy FirePOWER image and will not run FTD image.

Questions from https://supportforums.cisco.com/t5/firewalling/cisco-asa-with-firepower-services-vs-ftd/td-p/2958639

What is Cisco Firepower Threat Defense (FTD)?

Cisco Firepower Threat Defense (FTD) is a unified software image, which includes the Cisco ASA features and FirePOWER Services. This unified software is capable of offering the function of ASA and FirePOWER in one platform, both in terms of hardware and software features. This seems to be a good approach taken by Cisco especially when most of the Next Generation Firewall Vendors are offering Next Generation Solutions on a single platform with unified image. Currently the Cisco Firepower Threat Defense (FTD) unified software image is available in the following releases

• 6.0
• 6.2

The Cisco Firepower Threat Defense (FTD) is capable of offering following Next-Generation Firewall Services

• Stateful firewall Capabilities
• Static and dynamic routing
• Supports RIP, OSPF, BGP, Static Routing
• Next-Generation Intrusion Prevention Systems (NGIPS)
• URL Filtering
• Application visibility and control (AVC)
• Advance Malware Protection
• ISE Integration
• SSL Decryption
• Captive Portal
• Multi-Domain Management

Currently Cisco Firepower Threat Defense (FTD) unified software can be deployed on Cisco Firepower 4100 Series and the Firepower 9300 appliances as well the FTD can be also be deployed on Cisco Firepower Threat Defense (FTD) ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA5508-X, ASA 5512-X, ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, and ASA 5555-X. However, the Cisco Firepower Threat Defense (FTD) unified software cannot be deployed on Cisco ASA 5505 and 5585-X Series appliances.

Some of the key features which Currently Cisco Firepower Threat Defense (FTD) lacks are as follows:

• VPN Function
• Multi Context mode
• EIGRP and Multicast
• Does not support Cisco ASA 5505 & 5585-X Appliances

The lack of VPN function is a major drawback which Cisco needs to overcome in upcoming release of Cisco Firepower Threat Defense image. This certainly discourages the enterprise customers to adopt the Cisco Firepower Threat Defense unified image on their supported ASA 5500- Series platforms.

Info from https://itknowledgeexchange.techtarget.com/network-technologies/cisco-firepower-threat-defense-ftd/

More Related

Migrate from the Cisco ASA5505 to Cisco ASA5506X Series

Migration Recommendations for Cisco IPS and FirePOWER-NGIPS Series

Cisco ASA with Firepower Services, Setup Guide-Part1

Cisco ASA with Firepower Services, Setup Guide-Part2

Cisco ASA with Firepower Services, Setup Guide-Part3

Cisco ASA with Firepower Services, Setup Guide-Part4

How to Deploy the Cisco ASA FirePOWER Services in the Internet Edge, VPN Scenarios and Data Center?

Migration to Cisco NGFW

The Most Common NGFW Deployment Scenarios

Migrate to the Cisco Nexus 5600 Platform Switches

Cisco Nexus 6000 Series Switches have been announced end of sale and end of life since 2016. Customers are encouraged to migrate to the Cisco Nexus 5600 platform switches. 

If you have Nexus 6000 models or are considering the Nexus 6000 Series, you can read this migration to Nexus 5600 Platform Switches.

Table: Migration to Nexus 5600 Platform Switches

End-of-Sale Product Part Number	Product Description	Replacement Product Part Number	Replacement Product Description	Additional Information
C1-N6001-64T	Cisco ONE Nexus 6001, 1RUswitch, fixed48p 10GBASE-Tand4pQSFP+	C1-N5596T-FA	Cisco ONE Nexus 5596T 2RU, 2PS/4Fans, 32x10GT/16xSFP+Fixed	-
C1-N6004-B-24Q	Cisco ONE Nexus 6004 EF, 24x40GE Ports/FCoE Bundle; 6PS, 4 FAN	C1-N5696-B-24Q	Cisco ONE Nexus 5696Q Chassis 24x40GE FCoE Bundle, 6PS, 4 FAN	-
C1-N6004EF-4FEX-1G	Cisco ONE N6004 Chassis EF with 4 x 1G FEXe with FETs	C1-N5696Q-6FEX-1G	Cisco ONE N5696Q Chassis with 6 x 1G FEXes with FETs	-
C1-N6004EF4FEX10G	Cisco One N6004 Chassis with 4 x 10G FEXes with FETs	There is currently no replacement product available for this product.	-	-
C1-N6K-C6001-64P	Cisco One Nexus 6001, 1RU switch, fixed 48P 10G SFP+, 4P QSFP+	C1-N5K-C5672UP	Cisco OneNexus5672UP 1RU, 32x10G SFP+, 16pxUP SFP+, 6x40G QSFP+	-
C1A1PNEX60041K9	Cisco ONE Advanced Perpetual - Nexus 6004	C1A2PNEX56961K9	Cisco ONE Advanced Perpetual Nexus 5696	-
C1A2PNEX60001K9	Cisco ONE Advanced Perpetual Nexus 6001	C1A2PNEX56721K9	Cisco ONE Advanced Perpetual Nexus 5672	-
C1F1PNEX60041K9	Cisco ONE Foundation Perpetual - Nexus 6004	C1F2PNEX56961K9	Cisco ONE Foundation Perpetual Nexus 5696	-
C1F2PNEX60001K9	Cisco ONE Foundation Perpetual Nexus 6001	C1F2PNEX56721K9	Cisco ONE Foundation Perpetual Nexus 5672	-
DCNM-LAN-N61-K9	DCNM for LAN Advanced Edt. for Nexus 6001 switches	DCNM-LAN-N5K-K9	DCNM for LAN Advanced Edt. for Nexus 5000	License for 5000 only
DCNM-LAN-N64-K9	DCNM for LAN Advanced Edt. for Nexus 6004 switches	DCNM-LAN-N5K-K9	DCNM for LAN Advanced Edt. for Nexus 5000	License for 5000 only
DCNM-LS-N61-K9	DCNM for SAN and LAN Advanced Edt. for Nexus 6001 switches	DCNM-LAN-N5K-K9	DCNM for LAN Advanced Edt. for Nexus 5000	License for 5000 only
DCNM-SAN-N61-K9	DCNM for SAN Advanced Edt. for Nexus 6001 switches	DCNM-SAN-N5K-K9	DCNM for SAN Advanced Edt. for Nexus 5000	License for 5000 only
DCNM-SAN-N64-K9	DCNM for SAN Advanced Edt. for Nexus 6004 switches	DCNM-SAN-N5K-K9	DCNM for SAN License for Nexus 5000	License for 5000 only
N6001-16PP-SSK9	Nexus Promo 6001 Storage License, 16x10G ports or 4x40G port	N56-16P-SSK9	Nexus 5600 Series 16 Port Storage License	License for 5600 only
N6001-64P-SSK9	Nexus 6001 Storage License, 64-ports 10G or 16-ports 40G	N5672-72P-SSK9	Nexus 5672 Chassis Storage License	License for 5600 only
N6001-DFA-BUN-P1	Nexus 6001 DFA Bundle-Limited Time Promo; LAN, EL2, DCNM-LAN	N5672-DFA-BUN-P1	Nexus 5672 DFA Bundle‑Limited Time Promo; LAN, EL2, DCNM-LAN	License for 5600 only
N6001-EL2-SSK9	Nexus 6001 Enhanced Layer 2 License	N5672-EL2-P-SSK9	Limited Time Promotion-Nexus 5672 Enhanced Layer 2 License	License for 5600 only
N6001-EL2P-SSK9	Limited Time Promotion-Nexus 6001 Enhanced Layer 2 License	N5672-EL2-P-SSK9	Limited Time Promotion-Nexus 5672 Enhanced Layer 2 License	License for 5600 only
N6001-LAN1K9	Layer 3 License for Nexus 6001 Platform	N56-LAN1K9-P	Limited Time Promotion for Nexus 5600 Series LAN Enterprise	License for 5600 only
N6001-LAN1K9-P	Promo Layer 3 License for Nexus 6001 Platform	N56-LAN1K9-P	Limited Time Promotion for Nexus 5600 Series LAN Enterprise	License for 5600 only
N6001-SBUN-P1	Nexus 6001 SBUN-Promo; L3, DCNM-LAN/SAN, 64p 10G Storage, EL2	N5672-SBUN-P1	Nexus5672 SBUN-Promo; L3, DCNM-LAN/SAN, 72 Ports10G Storage, EL2	License for 5600 only
N6001P-2FEX-10G	N6001P Chassis with 2 x 10G FEXes with FETs	N5672UP-2FEX-10G	N5672UP Chassis with 2 x 10G FEXes with FETs
N6001P-4FEX-10G	N6001P Chassis with 4 x 10G FEXes with FETs	N5672UP-4FEX-10G	N5672UP Chassis with 4 x 10G FEXes with FETs	-
N6001P-4FEX-10GT	N6001P Chassis with 4 x 10GT FEXes with FETs	N5672UP-4FEX-10GT	N5672UP Chassis with 4 x 10GT FEXes with FETs	-
N6001P-4FEX-1G	N6001P Chassis with 4 x 1G FEXes with FETs	N5672UP-4FEX-1G	N5672UP Chassis with 4 x 1G FEXes with FETs	-
N6001P-6FEX-10G	N6001P Chassis with 6 x 10G FEXes with FETs	N5672UP-6FEX-10G	N5672UP Chassis with 6 x 10G FEXes with FETs	-
N6001P-6FEX-10GT	N6001P Chassis with 6 x 10GT FEXes with FETs	N5672UP-6FEX-10GT	N5672UP Chassis with 6 x 10GT FEXes with FETs	-
N6001P-6FEX-1G	N6001P Chassis with 6 x 1G FEXes with FETs	N5672UP-6FEX-1G	N5672UP Chassis with 6 x 1G FEXes with FETs	-
N6001P-8FEX-1G	N6001P Chassis with 8 x 1G FEXes with FETs	N5672UP-8FEX-1G	N5672UP Chassis with 8 x 1G FEXes with FETs	-
N6004-12Q-LIC	N6004 Platform12 x 40G ports License; For slot 3 and 4	There is currently no replacement product available for this product.	-	Not needed for 5696Q
N6004-12Q-SSK9	Nexus 6004 Storage License, 12-ports 40G or 48-ports 10G	N56-12Q-P-SSK9	Nexus 5600 Promo Storage Lic, 12-ports 40G or 48-ports 10G	License for 5600 only
N6004-24Q-LIC-P	Promotional 24 40GE Port License on the Norcal 6004	There is currently no replacement product available for this product.	-	Not needed for 5696Q
N6004-4Q-SSK9-P	Nexus 6004 Promo Storage License 4-ports 40G or 16-ports 10G	N56-4Q-P-SSK9	Nexus 5600 Promo Storage Lic, 4-ports 40G or 16-ports 10G	License for 5600 only
N6004-96Q-BUN	2K-6K Bundles- 6004 24 x 40GE Ports; 6PS, 4 FAN	There is currently no replacement product available for this product.	-	Tracking PID
N6004-B-24Q	Nexus 6004 EF chassis 24x40GE Ports/FCoE Bundle; 6PS, 4 FAN	N5696-B-24Q	Nexus 5696Q chassis 24x40GE Ports/FCoE Bundle; 6PS, 4 FAN	-
N6004-DFA-BUN-P1	Nexus 6004 DFA Bundle-Limited Time Promo; LAN, EL2, DCNM-LAN	N5696-DFA-BUN-P1	Nexus 5696 DFA Bundle-Limited Time Promo; LAN, EL2	License for 5600 only
N6004-EL2-SSK9	Nexus 6004 Enhanced Layer 2 License	N5696-EL2P-SSK9	Limited Time Promotion-Nexus 5696Q Enhanced Layer 2 License	License for 5600 only
N6004-LAN1K9	Layer 3 License for Nexus 6004 Platform	N56-LAN1K9	Nexus 5600 Series LAN Enterprise License	License for 5600 only
N6004-M12Q	Nexus 6004 EF Chassis Module 12Q 40GE Ethernet/FCoE	N5696-M12Q	Nexus 5696Q Chassis Module 12Q 40GE Ethernet/FCoE	License for 5600 only
N6004-M12Q-B	Nexus 6004 EF Chassis Module 12Q 40GE for Bundle	There is currently no replacement product available for this product.	-	Tracking PID
N6004-M12Q=	Nexus 6004 Module 12Q 40GE Ethernet/FCoE, spare	N5696-M12Q=	Nexus 5696Q Chassis Module 12Q 40GE Ethernet/FCoE	-
N6004-SBUN-P1	Nexus 6004 SBUN-Promo; LAN, DCNM-LAN/SAN, 96p 40G Storage, EL2	N5696-SBUN-P1	Nexus 5696 SBUN-Promo; LAN, 96p 40G Storage, EL2, DCNM	License for 5600 only
N6004-SBUN-P1-L	Nexus 6004 SBUN Lite-Promo; LAN, DCNM-LAN, 24p 40G Storage, EL2	N5696-SBUN-P1	Nexus 5696 SBUN-Promo; LAN, 96p 40G Storage, EL2, DCNM	License for 5600 only
N6004-SBUN-P2	Nexus 6004 Promotion SBUN; LAN, DCNM-LAN/SAN, 96ports 40G, EL2	N5696-SBUN-P1	Nexus 5696 SBUN-Promo; LAN, 96p 40G Storage, EL2, DCNM	License for 5600 only
N6004EF-12FEX-1G	N6004 Chassis EF with 12 x 1G FEXe with FETs	N5696Q-12FEX-1G	N5696Q Chassis with 12 x 1G FEXes with FETs	-
N6004EF-24Q-B-LAB	N6004 demo bundle (Requires BU Approval - Lab use only)	There is currently no replacement product available for this product.	-	-
N6004EF-4FEX-10G	N6004 Chassis with 4 x 10G FEXes with FETs	N5696-N2300-BUN	Nexus 5696 and Nexus 2300 FEX Bundle	-
N6004EF-4FEX-10GT	N6004 Chassis with 4 x 10GT FEXes with FETs	N5696Q-8FEX-10GT	N5696Q Chassis with 8 x 10GT FEXes with FETs	-
N6004EF-4FEX-1G	N6004 Chassis EF with 4 x 1G FEXe with FETs	N5696Q-6FEX-1G	N5696Q Chassis with 6 x 1G FEXes with FETs	-
N6004EF-6FEX-10G	N6004 Chassis with 6 x 10G FEXes with FETs	N5696-N2300-BUN	Nexus 5696 and Nexus 2300 FEX Bundle	-
N6004EF-6FEX-10GT	N6004 Chassis with 6 x 10GT FEXes with FETs	N5696Q-8FEX-10GT	N5696Q Chassis with 8 x 10GT FEXes with FETs	-
N6004EF-6FEX-1G	N6004 Chassis EF with 6 x 1G FEXe with FETs	N5696Q-6FEX-1G	N5696Q Chassis with 6 x 1G FEXes with FETs	-
N6004EF-8FEX-10G	N6004 Chassis with 8 x 10G FEXes with FETs	N5696-N2300-BUN	Nexus 5696 and Nexus 2300 FEX Bundle	-
N6004EF-8FEX-10GT	N6004 Chassis with 8 x 10GT FEXes with FETs	N5696Q-8FEX-10GT	N5696Q Chassis with 8 x 10GT FEXes with FETs	-
N6004EF-8FEX-1G	N6004 Chassis EF with 8 x 1G FEXe with FETs	N5696Q-12FEX-1G	N5696Q Chassis with 12 x 1G FEXes with FETs	-
N6004EF-96Q-BUN	2K-6K Bundles- 6004 EF 24 x 40GE Ports; 6PS, 4 FAN	There is currently no replacement product available for this product.	-	Tracking PID
N6004X-M20UP	Nexus 6004 Unified Mod 20P 10GE Eth/FCoE OR 8/4/2G FC	N5696-M20UP	Nexus 5696Q Unified Mod 20P 10GE Eth/FCoE OR 8/4/2G FC
N6004X-M20UP=	Nexus 6004 Unified Mod 20P 10GE Eth/FCoE OR 8/4/2G FC	N5696-M20UP=	Nexus 5696Q Unified Mod 20P 10GE Eth/FCoE OR 8/4/2G FC	-
N6K-20P-SSK9	Nexus 6004 20 Port Storage License for the UP LEM	N56-20PP-SSK9	Promotion Nexus 5696Q 20 Port Storage License for the UP LEM	License for 5600 only
N6K-20PP-SSK9	Promotion Nexus 6004 20 Port Storage License for the UP LEM	N56-20PP-SSK9	Promotion Nexus 5696Q 20 Port Storage License for the UP LEM	License for 5600 only
N6K-BAS1K9	Layer 3 Base License for Nexus 6000 Platform	N56-BAS1K9	Nexus 5600 Series LAN Base License	License for 5600 only
N6K-C6001-64P	Nexus 6001, 1RU switch, fixed 48p of 10G SFP+ and 4p QSFP+	N5K-C5672UP-16G	Nexus 5672UP 1RU, 24x10G SFP+, 24pxUP SFP+, 6x40G QSFP+	-
N6K-C6001-64P-BUN	N6K-C6001-64P Chassis used in N6K-N2K Bundles	There is currently no replacement product available for this product.	-	Tracking PID
N6K-C6001-64P-NFR	Nexus 6001 Chassis Demo bundle, not for resale	There is currently no replacement product available for this product.	-	-
N6K-C6001-64P=	Nexus 6001, 1RU switch, fixed 48p of 10G SFP+ and 4p QSFP+	N5K-C5672UP	Nexus 5672UP 1RU, 32x10G SFP+, 16pxUP SFP+, 6x40G QSFP+	-
N6K-C6001-64T	Nexus 6001, 1RU switch, fixed 48p of 10G BASE-T and 4p QSFP+	N5K-C5596T-FA	Nexus 5596T 2RU, 2PS/4Fans, 32x10GT/16xSFP+ Fixed Ports	9372TX could be alternative replacement
N6K-C6001-64T=	Nexus 6001, 1RU switch, fixed 48p of 10G BASE-T and 4p QSFP+	N5K-C5596T=	Nexus 5596T 2RU, No PS, No Fans, For Service Only	9372TX could be alternative replacement
N6K-C6001-ACC-KIT	Nexus 6001, 1RU Accessory Kit	N5672-ACC-KIT	Nexus 5672 Chassis Accessory Kit	-
N6K-C6001-ACC-KIT=	Nexus 6001, 1RU Accessory Kit	N5672-ACC-KIT=	Nexus 5672 Chassis Accessory Kit	-
N6K-C6001P-C	Nexus 6001P Chassis with License and SW Image for comcast	N5K-C5672UP-C	Nexus 5672UP Chassis with License and SW image for comcast	-
N6K-C6004-ACC-KIT	Nexus 6004 Chassis Accessory Kit	N5696-ACC-KIT	Nexus 5696Q Chassis Accessory Kit	-
N6K-C6004-ACC-KIT=	Nexus 6004 Chassis Accessory Kit, spare	N5696-ACC-KIT=	Nexus 5696Q Chassis Accessory Kit	-
N6K-C6004-FAN-B	Nexus 6004 Fan Module with Back to Front Airflow	N5K-C5696-FAN-B	Nexus 5696Q Fan Module with Back to Front Airflow	-
N6K-C6004-FAN-B=	Nexus 6004 Fan Module with Back to Front Airflow, spare	N5K-C5696-FAN-B=	Nexus 5696Q Fan Module with Back to Front Airflow	-
N6K-C6004-FAN-F	Nexus 6004 Fan Module with Front to Back Airflow	N5K-C5696-FAN	Nexus 5696Q Fan Module with Front to back Airflow	-
N6K-C6004-FAN-F=	Nexus 6004 Fan Module with Front to Back Airflow, spare	N5K-C5696-FAN=	Nexus 5696Q Fan Module with Front to back Airflow, Spare	-
N6K-C6004-M-BLNK	Nexus 6004 Module Blank Cover	N5K-C5696-M-BLNK	Nexus 5696Q Module Blank Cover	-
N6K-C6004-M-BLNK=	Nexus 6004 Module Blank Cover, spare	N5K-C5696-M-BLNK=	Nexus 5696Q Module Blank Cover	-
N6K-C6004=	Nexus 6004 EF Chassis Bare	N5K-C5696Q=	Nexus 5696Q Bare Chassis (No Fans/PSU)	-
N6K-C6004EF	Nexus 6004 EF Chassis 6 PSU, 4 FAN (No LEMs)	N5K-C5696Q	Nexus 5696Q Chassis 6PS, 4 FAN VxLAN	-
N6K-C6004EF-C	Nexus 6004EF Chassis with license and SW image for comcast	N5K-C5696Q-C	Nexus 5696Q Chassis with license and SW image for comcast	-
N6K-DFA-P1	Nexus DFA production support	N5K-DFA-P1	Nexus DFA production support	License for 5600 only
N6K-FNPV-SSK9	Nexus 6000 FCoE NPV License	N56-FNPV-SSK9	Nexus 5600 FNPV License	License for 5600 only
N6K-PS-BLANK	Nexus 6004 Power Supply Blank Cover	There is currently no replacement product available for this product.	-	-
N6K-PS-BLANK=	Nexus 6004 Power Supply Blank Cover	There is currently no replacement product available for this product.	-	-
N6K-VMFEXK9	Nexus 6000 series VM-FEX license	N56-VMFEX9	Nexus 5600 VM-FEX license	License for 5600 only

The detailed EoS and EoL Announcement for the Cisco Nexus 6000 Series Switches

More Related

Cisco Nexus 5500 and Nexus 5600-Model Features

Cisco Nexus 5500 and Nexus 5600 Licensing Options

Feature-Based Licenses for the Cisco Nexus 5000, Nexus 5500 and Nexus 5600 Series