Hi all,

My company is ready to deploy the new ASA with firepower module.
We proceed on that purchasement as it seems that this acquisition promise a new restart regarding the strategic of Cisco in security market. (Gartner, NSS-Labs)

Personally i feel that I'm standing in front of a crossroad regarding the implementation-migration that has to do with the deployment of the L3-L4 configuration (aCLS).
As far as i know there are two ways that someone can follow to migrate form the previous ASA to the new one.

1) copy-paste the aCLS, NAT and VPN  from the old to the new one and seperate configuration for IPS and AMP on the sfr module. (like in the past with AIP-SSM)

2) create from scratch all aCLS to the new platform of firepower (leaving the NAT and VPN on the traditional ASA) and controlling everything through F.P (L3- L7)

I' m sure that there are advantages and disadvantages on each implementation but i would like to listen your opinion on this critical matter as you may have also faced this dilemma in your recent implementation.


Kind regards

Hi,

I will start from the end.

I agree that what ever deployment will eventually someone follow, one thing won't change (at least for the moment)  the NAT, VPN and Routing config will remain on ASA as this two features are not configurable on F.P

Despite that and as the plans of Cisco is to merge these two products I heard that enough soon the L3/L4 will be managed from F.P, this is also based on the fact that on new deployments the recommendations of Cisco is to redirect the traffic to F.P and through this making the total policy from L3 to L7.

Another thing that confuses me is that enough soon a new management console will arise, and as far as i know it will comes from F.P environment. So at this point the question is, will this console manage rules that previously will have been configured on ASA platform?   if not then there is a problem.

Regarding the performance matter the only thing that can produce safety is the same the purchasement for example if you had before  a 5520 and now you thinking change it with 5525 the spesifications gives you the same numbers including IPS and AMP as the new platforms have better CPUs etc.