The easiest route - we'll conduct a 15 minute phone interview and write up the review for you.
Use our online form to submit your review. It's quick and you can post anonymously.
Cisco Secure Access is used for CTNA with a couple of applications deployed on it. There is a journey underway to move all applications off VPN into CTNA, but some applications are too old and legacy and will not support it very well. Business input into testing is required, and everyone is busy with everything, making it quite difficult. The VPN is working wonderfully.
The integration of Cisco Secure Access with Meraki is going well and has been a very positive experience compared to the previous deployment of Check Point. The difference this time around is having a Customer Success Manager and a direct path to the product owners, where feature requests can be made and feedback received. Cisco has been quite involved in the onboarding process.
Cisco Secure Access is significantly different compared to Check Point. Nearly a year since deployment of Cisco Secure Access, users have likely forgotten about turning the VPN on as it is now automatic. Users just open their laptop and are connected straight away regardless of whether they are home or not. From a user point of view, it has been very good. Things such as the ThousandEyes module have been deployed into it along with posture assessments, so all these different modules have been put into one single agent, which has helped get a unified view of everything.
The features of ThousandEyes integrate with Cisco Secure Access by providing end-user ThousandEyes licenses and end data center ones, which gives a holistic view. That is all complemented with Cisco Catalyst Center, providing an overarching view of what is going on on the network. The service desk can have access to that so they can see what is going on across the entire environment. This has provided a single pane of glass, which was not available with two different vendors before.
Regarding Cisco Secure Access, there are some areas that are not positive. Dedicated IP addresses for Cisco Secure Access platform took quite a while to obtain, and the process can be streamlined and improved. Issues arise because everyone is coming off a single IP address and sites such as YouTube think there are bots, asking to verify or just blocking access. When this was raised with Cisco, the official response was that accounts need to be signed up for or Gmail accounts created, with nothing that can be done on Cisco's side as it is on the end website. This is somewhat understandable, but those relationships should exist between large organizations. For instance, when presenting a PowerPoint with an embedded YouTube video, it suddenly says it cannot verify identity, causing issues for all levels. Three or four people come to the service desk every week with this issue, and the response is to use a generic Gmail account or sign up independently, which is probably not adequate.
Another issue has been with VPN profiles. When creating different VPN profiles, the underlying infrastructure has had to be replicated or provided, such as another RADIUS server for authentication. The whole VPN profile side of things can be improved for different subsets of users, such as guests or people who bring their own devices. Different profiles are wanted for different user bases, and it is quite complex on Cisco Secure Access to set all that up at the moment. Historically, with ASAs or Check Point firewalls, VPN profiles could be set up quite easily and what they had access to and what they did not have access to could be limited. There is interest in seeing how it can further integrate with Cisco Identity Services Engine because there is scope there to allow people on the environment via the VPN, but also restrict what they can access or not based on their profile. Those two can work a bit closer together.
Cisco Secure Access was deployed internally for approximately 2,400 users in April of last year.
Cisco Secure Access is stable and reliable if certain features are not used. Initially, SSL decryption was enabled, where certificates are decrypted, and when that was turned on, the performance was very unpredictable, plummeting significantly. In the end, it had to be turned off, and since it was turned off, there has been a great experience. It is understood that it requires much more processing power to decrypt things before they hit the network, but the unpredictability of the performance was only realized once it went live, and it had to be immediately pulled.
Cisco Secure Access can scale, integrate with other solutions, and meet the needs of users. Many things are in the pipeline which suggest Cisco is moving towards more integration and a single point of view, which is positive. There has been indication that Cisco will be looking at the Identity Services Engine integration.
The experience with Cisco Secure Access customer support is good. They have always been reachable, and fortnightly cadences have been established now that things have settled down. Meetings with the actual product engineers working on the solution have also been arranged. When there are more complex issues, they work with the team to pull that data directly from systems and take that back to improve on it and work on it. This has been a very collaborative experience.
Cisco support is rated an 8 overall. From feedback received from the team, it is between an 8 and a 9.
Positive
An expedited deployment of Cisco Secure Access was conducted. A proof of concept was run in December 2024, and then the solution was deployed between January and March, which was very quickly because the Check Point contract was ending on April 1st. It was quite a quick, speedy move, but support was provided all along the way with the managed service partner as well as Cisco, so the delivery was successful.
The price to value from Cisco Secure Access is justified. Money has been saved by moving to one vendor, and that has been a material cash saving that was able to be handed back to the business. It has not only been a better solution overall, but also been cost saving, which is unusual—too good to be true at one point, but it has delivered. Approximately half a million pounds a year is the amount that has been saved.
AI Assist is quite good at how it can collect information from various sources and pull it all together to give an answer. It can also resolve issues further down the line, so it appears quite powerful.
Cisco Secure Access is rated an 8 overall. It is good at what it does at a fundamental level, but when it comes to trying to customize it slightly for what is needed, because it is a cloud-based solution, it is much harder. There are some features that are missing from it that used to exist in the older platforms. The overall review rating for Cisco Secure Access is 8.
Cisco Secure Firewall is used for securing perimeters, such as internal or external perimeters of the network.
I consider a valuable feature of Cisco Secure Firewall to be that it serves its purpose. ASA is nice, but it is outdated now. When it comes to FTD, complexity is one of the things. I am not sure they should build it from scratch.
Cisco Secure Firewall has helped improve my company over the last 15 years. Nowadays, you cannot live without a firewall. We are currently moving to another vendor.
Navigating through Cisco Secure Firewall is not intuitive. Complexity is another significant issue that needs to be addressed.
I have been using Cisco Secure Firewall for 15 years.
Cisco Secure Firewall is working with some bugs and glitches, but it is stable overall. ASA is a super stable firewall, even though it is outdated nowadays. FTD is working fine with some glitches.
Scalability depends on which Cisco Secure Firewall you are buying. For the enterprise level, it is scalable, but not significantly.
I have contacted Cisco support about these issues and opened many TAC cases for the firewalls.
I would evaluate Cisco support as good. Cisco is the best there. However, they need to rebuild this product. I love Cisco products, but when it comes to the firewall, I do not.
We are transitioning to Palo Alto.
I find Palo Alto to be much easier to operate and much more stable. If you want to incorporate FTD with another Cisco product, then you need to go with Cisco to have the full ecosystem. Since we do not have that requirement, we are going to another vendor, which is definitely easier to handle.
I have knowledge about the pricing and licensing.
A couple of days ago, I was working on a project and received a quote for the FTD 1230. For the same level with Palo Alto, even though we had a huge discount with Cisco, it turned out to be more expensive than Palo Alto. The pricing is quite expensive. My overall review rating for this product is 6.
