Cisco Secure Firewall Threat Defense Virtual (formerly NGFWv) Pros and Cons

I went to school for networking, and my curriculum was very heavy on cisco routers and switches. The fact that they use the same (or similar) syntax in the firewalls allows for a those with cisco router and switch experience to transition easily. However, what I like most about the product is the simple command line configuration that I can script ahead of time. Other firewalls such as fortinet or palo alto are a pain to configure from the command line. Review collected by and hosted on G2.com.

I dislike the lack of troubleshooting capabilities for routing. On a cisco router you can do "sh ip route <address>" and see the exact route that the address is taking. On the cisco pix and ASA you have to do sh route | include <address> and hack off octets until you find one that MIGHT match. Review collected by and hosted on G2.com.

The Cisco ASA series FW is quite versatile and supports a plethora of features that's suitable for small to very large deployments. I particularily like the ability to deploy SSLVPN termination on the same FW device.

The GUI wizards are definately quite useful for the beginner as jumping into the CLI to implement IPSEC VPN tunnels could be challening for few.

I also quite enjoy the debugging capabilities any Cisco device has as you should be able to troubleshoot majority of the problems from the debug logs.

The ASA platform has recently incorporated Snort capabilities and Firepower. I look forward to using that a good threat defense. Review collected by and hosted on G2.com.

The JAVA ASDM GUI is one of it's major weakness. Nobody runs java apps anymore, yet their main GUI management is still stuck on that platform. The main interface also has not improved much since the beginning. Review collected by and hosted on G2.com.

More functions than I can use but fairly simple to maintain,manage and monitor external traffic. We also use the Intrusion Prevention module. Both provide very granular configuration. We did get a 3rd party partner to do the initial install which I recommend.

We have blocked many threats and had were able to verify our internal data assets were safe. Review collected by and hosted on G2.com.

Not really a dislike but it is a complicated system which makes sense for the amount of control provided over internet traffic monitoring and filtering.

Unless you know the system well, I strongly recommend help with the initial install as incorrect settings can either shut you down or leave you open to threats. Review collected by and hosted on G2.com.

Cisco has been in the security arena for a long time, and continue to improve and perfect their firewalls since their early PIX days. Their VPNs are rock solid and easy to manage. They have 24/7/365 support that can be extremely helpful if you escalate properly. The introduction of the FirePower platform only makes the solution better with much improved IDS/IPS capabilities. Review collected by and hosted on G2.com.

The add-on software features tended to be much less stellar that the firewall platform itself. I've had varied results in running any of their add-on modules and tend to use the firewall as a firewall, and not a multi-purpose device. Review collected by and hosted on G2.com.

Pretty much the industry standard. Always adding features prices have come down. Review collected by and hosted on G2.com.

Very difficult to get them setup if you don't know what you are doing. Review collected by and hosted on G2.com.

I recently started using this. What I like best is that it works decently even at low internet speeds. Review collected by and hosted on G2.com.

I use it regularly and its been very smooth so far. No reason to dislike anything so far. Review collected by and hosted on G2.com.

Robust hardware. Best in business warranty and support (with smartnet). Review collected by and hosted on G2.com.

Not coming from a cisco background and having to learn the ASDM interface. I've found it a little challenging and cumbersome at times. Had an issue a few months back where the primary/secondary units were not syncing correctly and it took Cisco support a few weeks to get the issue resolved (it ended up being a bug in the version we were running). I feel like the IDS interface could use a makeover. Review collected by and hosted on G2.com.

I work at a hospital and our patient information obviously needs to be very secure. Cisco ASA has given our company the ability to use a multitude of devices to access patient information without fear of our information being accessed by others. The support team is absolutely amazing as well which is great, as we are not a tech company. Review collected by and hosted on G2.com.

As with many types of software, the disadvantage is the price. Fortunately, we are a large hospital and it is very important for our system to be secure, so Cisco ASA is worth it for us. Review collected by and hosted on G2.com.

Cisco ASA5500 Series firewalls are very robust appliances. Between the ASDM interface and the CLI interface, most users will find management easy once you understand the basics of how the device works. Advance users will find tons of tools and debugging options for troubleshooting and granular management.

The appliances are powerful, allowing you to size your device for your user load. Cisco has a great chart to show you this plus the licensing schema. Contacting your Cisco Rep or partner is the best way to make sure you size your appliance the proper way.

Failover works extremely well if you are in an environment that cannot have downtime at your site. Review collected by and hosted on G2.com.

JAVA! The ASDM is still based on Java; the sooner Cisco can eliminate this, the better. The licensing schema can be a bit tough sometimes, so you need to make sure you check for what you need - especially on the VPN side of things. Review collected by and hosted on G2.com.

Cisco ASDM may seem complex at first, but it doesn't take long to learn to use it effectively to manage an environment's network traffic. With each iteration of the application, more useful features have been introduced, from rule hit counts to the ability to create network objects using FQDN to being able to quickly identify orphaned network objects, while the core features continues to deliver. The CLI provides users who prefer to perform management tasks using command line the options to do so, and the overall GUI is organized and simplifies the firewall management experience. Review collected by and hosted on G2.com.

Two things come to mind - Java dependency on launching ASDM and duplicate network objects.

With Java dependency, being able to launch the ASDM successfully becomes a challenge. At one point it was necessary to roll back Java to a previous version in order for ASDM to work, and a more common nuisance is finding which web browser will actually launch ASDM successfully. For example, I'm only able to launch ASDM through Firefox but not any other popular browers.

With regards to duplicate network objects, it may be specific to our company's deployment but after a recent firewall context upgrade, several existing network objects were duplicated. Furthermore there is no easy way to eliminate them so they end up sitting in the network objects list, not being used anywhere, until they are manually deleted. Review collected by and hosted on G2.com.