2

We are planning to replace our existing hardware firewall with new virtual one. The feature that we require from the virtual firewall is as below:

  • HTTPS decryption and logging
  • IPS/IDS
  • Gateway Antivirus
  • URL filtering
  • WAN load balancing and fault tolerance

Based on my Research I found that ASA virtual appliance does not have NGFW features mentioned above, but I could not confirm it.

Can anyone please help me with this query ?

Improve this question
6
  • The virtual devices do not have the dedicated hardware of the real devices.
    – Ron Maupin ♦
    Commented May 14, 2021 at 13:05
  • @RonMaupin It is strange that they didn’t give the virtual ASA the same SFR software module that most of the other ASA models have, given that it is just software (not hardware) and on models other than the 5585 they used the shared Management interface rather than having a dedicated interface like the 5585. So, I can’t think of why they did t include the SFR on the ASAv.
    – Jesse P.
    Commented May 14, 2021 at 13:09
  • @JesseP., there is other dedicated hardware. For example, hardware for NAT (much slower in software), TCAM, etc.
    – Ron Maupin ♦
    Commented May 14, 2021 at 13:29
  • @RonMaupin I suppose. Just strange that they couldn’t have virtualized it all. I mean, it’s effectively no different than a virtual server with a virtualized CPU, RAM, etc. they went through the task of virtualizing the main functionality but for some reason decided not to do the rest.
    – Jesse P.
    Commented May 14, 2021 at 13:31
  • There's no functional difference between an ASA and an ASAv. They both run the same software. (the only special piece of hardware is a Cavium crypto chip. they are otherwise a purpose built PC.) ASAv does not support the NGFW stuff as attempting to run VMs inside a VM is messy and usually does not work.
    – Ricky
    Commented May 14, 2021 at 14:26

2 Answers 2

Reset to default
4

Correct. The ASAv does not support the FirePOWER NGFW functionality. I’m not sure what your options are for wherever this is going but most manufacturers make a virtual appliance, and most others do support what you want. We can’t give recommendations here but, I have virtual Fortigate units for some clients that work well.

Improve this answer
0

The Cisco ASAv is handy for many purposes, but as any device it has it's limitations. As mentioned earlier, ASAv cannot support NGFW so you are "stuck" with ASA features. Keep in mind you cannot also implement multiple contexts for ASAv, which is a very nice function of the ASA.

While the ASA will yes provide URL filtering, I would recommend you to go with Cisco FTDv, which will deliver advanced NGFW functions, including the ones you listed while also delivering SNORT, the most advanced IPS system around.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.