Cisco Defense Orchestrator vs Tufin Orchestration Suite comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

Cisco Defense Orchestrator
Ranking in Firewall Security Management
14th
Average Rating
8.2
Number of Reviews
14
Ranking in other categories
No ranking in other categories
Tufin Orchestration Suite
Ranking in Firewall Security Management
2nd
Average Rating
8.0
Number of Reviews
180
Ranking in other categories
Container Security (23rd)
 

Mindshare comparison

As of July 2024, in the Firewall Security Management category, the mindshare of Cisco Defense Orchestrator is 1.3%, down from 1.7% compared to the previous year. The mindshare of Tufin Orchestration Suite is 18.6%, down from 18.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Firewall Security Management
Unique Categories:
No other categories found
Container Security
0.2%
 

Featured Reviews

TE
Jul 10, 2019
Provides visibility into entire infrastructure and bulk changes save time and resources
Some of the issues we've had aren't really a CDO problem. For example, we had some MX devices that were blocking Windows Update from happening. We found out it was a Meraki issue, but it would have been nice if it had been flagged for us: "Hey, these updates are failing because the MX is blocking it." It wasn't a huge problem, but there was a loss of our time as well as the fact that the updates didn't get pushed out. You could look at that as a security issue but, at the same time, when updates won't run for any reason on certain machines, you freak out a little bit. We thought it was a licensing issue with Microsoft or it could have been Dell EMC. But we were wasting time making all these phone calls and having people remotely troubleshoot it. The troubleshooters were saying, "Man, this looks like a network issue." They tethered a phone and joined it to the wireless on the phone to see if it would update and, boom, it started working. The weird thing was that when we switched it back over to the network, the Meraki was letting it through at that point. It would have been nice if CDO had let us know that that was an issue. There are probably some things that it could do as far as some of the analytics are concerned, things I know it would be capable of: "Hey, why are all these requests coming in? The reason is that a firmware update needs to happen on the Meraki. It's a known issue." That would be helpful.
Amroy Lumban Gaol - PeerSpot reviewer
Sep 26, 2022
A flexible, very secure solution that works well in Layer 2 environments
Our company uses the solution to auto deploy and analyze locks for hundreds of Layer 2 firewalls which are more challenging than Layer 3.  We write script for manual configurations, create policies, analyze all rules and locks, and then auto deploy. We currently have 40 engineers and 100 staff who…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"I like the upgrade feature. That is pretty valuable to me because I have dual ASAs and when I go through CDO it does it for me pretty well. It's all done in the back-end and I don't really have to be involved. I just initiate, pick the image, and I pick when I want it done and it just does it, whether I have a single ASA or have a dual ASA."
"The most valuable feature is being able to do centralized upgrades on the ASAs. We can select all of those ASAs, and say, "Upgrade these ASAs at this scheduled time." It will copy down the ASA image, ASDM image, and then do the upgrade and failovers, and then put it all back into service as required at a scheduled time. It automates that process for us."
"For this product, they are very uncharacteristically interested in resolving whatever issue the customer reports. They're really attentive, and they address whatever we bring up as quickly as they can. That's been a very positive aspect of the product."
"The most valuable feature is the Intrusion prevention."
"When we're looking to the policies, it identifies the shadow rules. It notifies us about anything that will supersede other rules."
"The ability to do operations on multiple firewalls at once is valuable because it saves time and mental effort. The solution's ability to make bulk changes makes it very convenient to manage things at once on multiple targets."
"The most valuable feature is that you can push one policy or one rule out to several devices at a time."
"The bulk changes feature is definitely the most valuable."
"Our customer has the ability to centrally monitor and view all changes that have been made in the network, and they are able to revert any problems that they encounter, if somebody has made a problematic change."
"The solution's most valuable features are its security policy and steps for deployment."
"One of the things that came up this week was the ability to decommission a server, which we thought was interesting. We had a workshop recently that talked about all the things that need to be thought about when managing firewalls. People said, "A lot of times, things get forgotten when you are decommissioning a server." E.g., making sure rules are taken away and taking out the rule set. The fact that there is an automated workload for that can be helpful."
"It has helped us to meet our compliance mandates. We have some requirements that we need to provide more visibility on the risk levels of our firewall base and Tufin helped us with that requirement."
"It's user-friendly. It's easy to understand menus on the web GUI. That's a good feature for us. I can say that it's doing what it's supposed to do. It also integrates well with other products like Check Point."
"The most valuable feature of Tufin is rule analysis."
"It is an important application for controlling and monitoring firewall rules. It is useful for making and monitoring the changes."
"It's hard to pick the most valuable feature. All of them are valuable, they're all critical for us... ChangeTrack obviously has a lot of very good features, like the risk analysis, the USP, and the Policy Browser."
 

Cons

"It would be a better product if it incorporated device control for third-party products easily."
"The main thing that would useful for us would the logging and monitoring. I have to check it out, to get the beta, because I don't have access to them... I wanted CDO to be a central place so where I could do everything but right now I don't think that's possible. I really don't want to go back and forth between this and FMC. Maybe the logging portion, when I look at it, will give me some similarities."
"When logging into the device, we sort of had problems with it staying in sync. If somebody made a change onsite, it wouldn't do an automatic sync. It would have to wait, as you would have to do a manual sync up."
"If I make a change locally to the firewall, CDO gives an alarm or an error message and says there's a change in compliance: "The firewall has this configuration but the last time it was compiled it had that configuration." That view of new changes versus the old could be better... I had to log in manually, locally on the firewall, to check which version, which configuration was actually running. I couldn't see it in CDO."
"I'd like CDO to be the one-stop-shop where we could do all the configurations easily. It would be nice, for ASA upgrades, if we could do them from a central repository and not have to reach out to Cisco. That would be a definite plus."
"The dashboard needs to be more customizable to provide better reporting for our network."
"We had some MX devices that were blocking Windows Update from happening. We found out it was a Meraki issue, but it would have been nice if it had been flagged for us: "Hey, these updates are failing because the MX is blocking it." It wasn't a huge problem, but there was a loss of our time as well as the fact that the updates didn't get pushed out... It would have been nice if CDO had let us know that that was an issue."
"There could be some slight improvements to navigation. In some of the navigation you've got to go back to be able to get into where you need to be once you've made a change. If I make a change, I've then got to go back to submit and send the change."
"We would like to see automation metrics, from a reporting standpoint. We would also like to see automation of site-to-site VPN tunnels. We would like to see automation of Check Point application-based firewall rules."
"With scalability, we are going to run into some issues. We have been talking about converting over to actual hardware as opposed to virtual. Therefore, I don't think we are scalable at this time, especially with the updates coming. I'm told that they're going to need a lot more horsepower to push them."
"It would be better if they modernized the web GUI. The web interface GUI is simple and not complicated, but it's also too old."
"The older version that we have doesn't support some newer firewall vendors."
"This solution increases the time it takes to make changes."
"I would like to see more configuration options on next-generation firewalls, defining possible standards for devices."
"They need to offer more support to vendors, such as Cisco, Checkpoint, Fortinet, and Forcepoint."
"We want to have the ability for a ticket requester to add somebody, or to give somebody view rights to their ticket."
 

Pricing and Cost Advice

"I work with a lot of clients, and the price or value of the Cisco Defense Orchestrator can vary from one client to another. If you have a lot of Cisco solutions, the price of the Cisco Defense Orchestrator is justified. Whereas if you have some security components from other vendors, such as Check Point or Palo Alto. This solution would be a pretty expensive proposition considering that they don't integrate with them well."
"It's around £500 per unit for a three-year license."
"It is covered under the CIsco Enterprise License Agreement (ELA). So, it is licensed and ours."
"After our free trial was done we got a subscription for three years and it was under $3,000 or so. It's part of the EA we already paid for, so I don't know what it would be if it was a la carte."
"It is about a $100 per year for an ASA 5506 firewall, and from there it keeps going up if you have a bigger box. For example, the 5516 is $200 to $300 per year."
"If you compare to what is available on the market, they are in the same range with respect to pricing."
"We have seen ROI from the side of operations, and we'll probably get to more of that as time goes on. However it took a while to get to that point."
"While licensing varies greatly, it is about $50,000 a year."
"Licensing is available in both perpetual and subscription models, and it appears to be good for our scalable environments."
"There is a permanent license for devices, but it's not relative to a device itself. Once you purchase 10 licenses for virtual appliances or virtual context, you can put them into different virtual firewalls, but you can reuse these licenses for other devices if you don't need them for the old ones."
"Licensing is on a customer by customer basis."
"The solution has helped us to reduce the time it takes to make changes. With Tufin, it takes ten to 15 minutes. Before, it was 30 minutes or more."
"We've seen a decrease of about 50 percent in the overall time it takes to complete a firewall change."
"The seller of Tufin, when I wanted the solution, was very flexible because the cost on the lease was very high in Latin America. So, he was able to reduce the cost."
report
Use our free recommendation engine to learn which Firewall Security Management solutions are best for your needs.
793,295 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
47%
Manufacturing Company
8%
Financial Services Firm
7%
Government
5%
Financial Services Firm
19%
Computer Software Company
17%
Manufacturing Company
8%
Retailer
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Ask a question
Earn 20 points
What do you like most about Tufin?
The most valuable feature of Tufin is security auditing. We are able to check the rules and compliance of the company, for example, what is allowed or not. We are able to check the rules over diffe...
What is your experience regarding pricing and costs for Tufin?
Tuffin is expensive, and we have to explain to our customers the benefit for them to purchase. If we explain the benefits in the correct way they do not mind the price. We typically do costing for ...
What needs improvement with Tufin?
The reporting function could improve in Tufin. For our clients with companies that have strong compliance, reporting privacy data is mostly a problem. In the IT department, private data needs a fun...
 

Also Known As

CDO
Tufin SecureCloud
 

Learn More

Video not available
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Insurance Company of British Columbia, Shawmut
3M, AT&T, Blue Cross Blue Shield, BNP Parabas, ConocoPhillips, Deutsche Bank, GE, IBM, Pfizer, United States Postal Service 
Find out what your peers are saying about Cisco Defense Orchestrator vs. Tufin Orchestration Suite and other solutions. Updated: July 2024.
793,295 professionals have used our research since 2012.