Unified policies have strengthened zero-trust demos and automate rapid threat containmentFeedback and Improvement Areas – Cisco Secure Firewall (Customer Perspective) From a customer point of view, there are a few improvement areas observed while positioning Cisco Secure Firewall in competitive scenarios. 1. Dashboard & Visibility Enhancements Customers often compare firewall dashboards across different OEMs during evaluation. * Competing vendors typically provide more feature-rich and visually detailed dashboards. * There is a perception that Cisco dashboards still require enhancement in terms of visualization, consolidated reporting, and built-in analytics. * Some OEMs advertise additional security capabilities clearly within their publicly available data sheets, making competitive positioning easier. In comparison, Cisco sometimes references separate documentation or explains how certain capabilities (such as anti-spam or antivirus functionality) can be achieved through integration or ecosystem components rather than native, built-in features. This creates a perception gap during customer discussions. Improvement Opportunity: * Enhance dashboard capabilities. * Clearly articulate feature availability in public documentation and data sheets. * Reduce dependency on cross-referenced documentation for commonly compared features. 2. Virtual Firewall / Multi-Instance Capabilities in Lower Models Another competitive challenge relates to virtual firewall capabilities. * Several OEMs provide virtual firewall (VDOM-like) functionality in lower-end models. * In Cisco’s portfolio, multi-instance capability typically starts from higher-end platforms such as the 3K series or higher. * Customers looking for smaller deployments with logical segmentation are often forced to consider higher models, resulting in a price jump. Competitors also offer: * Compact hardware models * Dongle-based firewall appliances * Smaller entry-level products with virtual segmentation In Cisco’s case: * To achieve similar multi-instance functionality, customers must opt for higher-tier models. * This creates a significant pricing gap in entry-level or SMB deployments. This pricing difference becomes a key factor when customers compare solutions. If competitors offer a lower-cost model with virtual segmentation, and Cisco requires a higher platform investment, customers may lean toward alternative OEMs. 3. Documentation Gaps – OT Protocol Visibility In our lab environment, we have deployed Cisco Secure Firewall and are using Application Visibility and Control (AVC) for OT network monitoring. Observations: * OT protocols are clearly visible within application visibility. * The firewall successfully identifies and classifies OT traffic. However: * This capability is not clearly mentioned in publicly available documentation. * When a feature is available and functional, it should be explicitly documented in data sheets and feature guides. The need for third-party integration depends on what we are looking for. Here I am saying that the integration with Cisco NAC can be done because RTC functionality is only available with Cisco ISE and the firewall integration. For other ecosystems, if we use a NAC solution that is not Cisco, we can still integrate it for user authentication, such as with VPN user authentication. But in that case, we don't achieve the same functionality, such as RTC with other NAC solutions. This is one aspect. Another part is that if we are using it, it always happens with some NAC solutions because we have Cisco NAC and Cisco firewall; we want consistent policy across the network, whether the user is on-prem or using VPN services. If this is a unified OEM solution, in that case, we require an agent, such as the Cisco Secure Client. That allows us to easily check the posture status of the remote user and connect to the network effortlessly. But if we are using a third-party solution, we can't achieve that. From a SIEM perspective, certain prerequisites must be fulfilled before integration with Cisco Secure Firewall can be completed. The feasibility of integration depends on the capabilities of the SIEM platform. If the SIEM solution supports the required APIs and event handling mechanisms, similar functionality can be achieved. Therefore, integration itself is generally not the challenge; the key consideration is the desired security outcome within the overall ecosystem. If the customer does not have a SIEM solution and intends to automate quarantine actions or enforce restricted access for users, a Network Access Control (NAC) solution becomes mandatory. In this scenario, the recommended NAC solution is Cisco Identity Services Engine (Cisco ISE). Automated quarantine and dynamic access control workflows are dependent on NAC capabilities. From a feature enhancement perspective for Cisco Secure Firewall, deeper NAC-driven integration adds significant value. 1. TrustSec / Tag-Based Policy Enforcement Cisco ISE supports Cisco TrustSec, which enables Security Group Tag (SGT)-based segmentation. * In traditional (legacy) networks, firewall policies are created based on IP addresses. * With TrustSec, policies are defined based on user identity, group membership, and security tags instead of IP subnets. * When users authenticate to the network, Cisco ISE assigns Security Group Tags (SGTs). * These tags are shared with Cisco Secure Firewall. * The firewall then enforces policies based on SGT-to-SGT rules rather than IP-to-IP rules. Benefits: * Significant reduction in the number of firewall rules * Simplified policy management * Improved scalability * Easier implementation of role-based access control This integration enhances operational efficiency and security posture. 2. Rapid Threat Containment (RTC) Another key capability is Rapid Threat Containment (RTC). If Cisco Secure Firewall detects malicious activity—such as malware download attempts identified via signature-based or advanced threat detection—it can notify Cisco ISE about the compromised endpoint. Based on this input: * Cisco ISE can automatically quarantine the user * The endpoint can be moved to a restricted VLAN * Access can be dynamically limited without manual intervention This automated workflow ensures faster response time and reduces the risk of lateral movement within the network. 3. VPN and Posture Assessment This functionality is not limited to wired or LAN users. For VPN users: * Authentication can be integrated with third-party NAC solutions. * However, if posture assessment (device compliance checking) is required in addition to authentication, Cisco ISE integration with Cisco Secure Firewall becomes essential. Cisco ISE enables: * Endpoint posture validation * Dynamic policy assignment * Automated remediation workflows
