Cisco ASA Firewall pros and cons

If you have a solution that is creating a script and you need to deploy many implementations, you can create a script in the device and it will be the same for all. After that, you just have to do the fine tuning.

If we look at the Cisco ASA without Firepower, then one of the most valuable features is the URL filtering.

It's easy to integrate ASA with other Cisco security products. When you understand the technology, it's not a big deal. It's very simple.

The benefits we see from the ASA are connected to teleworking as well as, of course, having the basic functionality of a firewall in place and the prevention of attacks.

Everything is all documented in the file or in the command line script that gets uploaded to the device. It gives us great visibility.

Cisco ASA provides us with very good application visibility and control.

The traffic inspection and the Firepower engine are the most valuable features. It gives you full details, application details, traffic monitoring, and the threats. It gives you all the containers the user is using, especially at the application level. The solution also provides application visibility and control.

The configuration was kind of straightforward from the command line and also from the ASDM. It was very easy to manage by using their software in Java.

The remote access, VPN, and ACL features are valuable. We are using role-based access for individuals.

Even in very big environments, Cisco comes in handy with configuration and offers reliability when it comes to managing multiple items on one platform.

It is extremely stable I would say — at least after you deploy it.

Cisco missed the mark with all the configuration steps. They are a pain and, when doing them, it looks as if we're using a very old technology — yet the technology itself is not old, it's very good. But the front-end configuration is very tough.

One area where the ASA could be improved is that it doesn't have AMP. When you get an ASA with the Firepower model, ASA with FTD, then you have advanced malware protection.

If I want to activate IPS features on it, I have to buy another license. If I want Cisco AnyConnect, I have to buy another license. That's where we have challenges.

I would say that in inexperienced hands, the interface can be kind of overwhelming. There are just a lot of options. Too much, if you don't know what you are looking for or trying to do.

If they want to add better features to the current Cisco ASA, they can start by increasing the encryption. That is the only thing they need to improve.

Security generally requires integration with many devices, and the management side of that process could be enhanced somewhat. It would help if there was a clear view of the integrations and what the easiest way to do them is.

One thing that we really would have loved to have was policy-based routing. We had a lot of connections, and sometimes, we would have liked to change the routing depending on the policies, but it was lacking this capability. We also wanted application filtering and DNS filtering.

Other products are becoming easier to access and configure. They are providing UI interfaces to configure, take backup, synchronize redundant machines, and so on. It is very easy to take backup and upgrade the images in those products. Cisco ASA should have such features. If one redundant machine is getting upgraded, the technology and support should be there to upgrade other redundant machines. In a single window, we should be able to do more in terms of backups, restores, and upgrades.

We have more than one Cisco firewall and it is difficult for me to integrate both on the single UI.

They need to do an overhaul of the management console.