How do ASA firewalls and UTM perimeter firewalls differ?
3 Answers
An ASA is a layer 3 and layer 4 firewall. UTM stands for Unified Threat Management, meaning it does the basic layer 3 and layer 4 firewalling but also has the capacity (much larger storage, more RAM, and faster CPU(s)) and capability (with licensing, usually) to go beyond, and filter up to layer 7 (in some cases). UTM appliances are usually for when you want a firewall but also the ability to filter spam, geo-filter (because normal firewalls can't usually handle the number of ACL entries required to do true geo-filtering), web filtering (blocking sites by category), etc. You can hack things together to kinda do some of these on a traditional ASA but it would only semi-work. Usually if you have an ASA and want to do web filtering, for example, you'd have to either have an in-line proxy to filter before sending to the firewall, or have a transparent proxy (using WCCP or such) to send web traffic from the ASA to something like a Websense appliance or similar, have it respond accordingly, and then either let the user hit the website or show a blocked/denied page.
There's more to it but that's a basic breakdown.
-
2ASAs have come a long way and include a lot more application level filtering URL filtering and threat detection. Commented Sep 9, 2020 at 3:52
-
2@RonTrunk If you use the SFR module or run FXOS on them to effectively convert them into FirePOWER appliances, they can do some of those things but hardware limitations would still exist that true FirePOWER appliances or other UTMs would not have.– Jesse P.Commented Sep 9, 2020 at 11:04
-
I've realized that my question doesn't have a "simple" answer but is much more "this product has these features and this product has these features". For example, can all CISCO ASAs be configured for DAP while UTMs cannot?– IzzoCommented Sep 10, 2020 at 13:51
-
@Izzo If that's your question (about DAP capabilities between ASA and FTD appliances) then you are correct, ASA OS supports DAP while FXOS currently does not. You can convert an FTD appliance into an ASA (have it run ASA OS) to gain that functionality but you forfeit the ability to do IDS/IPS (which defeats the point of having an FTD (UTM) appliance in the first place) in doing so because there is no SFR module like on an actual ASA.– Jesse P.Commented Sep 10, 2020 at 14:04
The Cisco ASA series (Adaptive Security Appliance) is a family of firewalls that started out as layer 3/4 firewalls. Their functionality has evolved considerably since.
UTM (Unified Threat Management) is a cross-vendor, umbrella term for an "all-encompassing" security solution that includes IPS, IDS, content filtering, malware detection, and so on. Essentially, these provide high-layer firewall functions as well. There may be considerable differences in functionality, performance and scalability between vendors - including Cisco's ASA line.
There is significant differences between UTA firewalls and cisco ASA statefull firewall
UTM Unified Threat Management Appliance Explained
It needs to be connected to the main network and works in order to provide maximum security against all incoming viruses. However, whereas the firewall is mainly concerned with the flow of data packets, a UTM appliance has a more diverse range of control traffic in deeper aspect of packet Unified threat management (UTM) provides multiple security features and services in a single device or service on the network, protecting users from security threats in a simplified way. UTM includes functions such as anti-virus, anti-spam, content filtering, and web filtering. Mainly looks for virus and threats and malwares , intrusion prevention and intrusion detection process. (source: SecPoint)
Cisco ASA firewall
It's is statefull firewall where as traffic can control as per our business requirements. It provides much more security features to protect our network and will have feasible to create vlan , and layer3 interfàce and allowing and restricting traffic among zones .asa firewall operates on layer3, layer4 and layer7 layers of OSI model .i
At layer3
We can enable configure routing , and create layer2 interfaces
Layer4
We can allow and restrict traffic based on TCP and UDP ports
Layer7
Firewall can even operates at layer7 by resticting traffic on application layer by web filter, url filtering,
The Cisco ASA is a security device that combines firewall, antivirus, intrusion prevention, and virtual private network (VPN) capabilities also
answered Sep 10, 2020 at 14:44
-
If you're going a to copy/paste text from a web source rather than coming up with your own answer, you need to at least include the link to the article so the users can see the rest of the text in its original context.– Jesse P.Commented Sep 10, 2020 at 18:40
-
Also, no, an ASA does not operate on layer 7. ASAs rely on software/hardware modules such as IPS, CXSC, and SFR to perform tasks such as web-filtering, anti-malware, etc., or have to make use of WCCP to redirect specific traffic to an external filter (such as a third-party proxy).– Jesse P.Commented Sep 10, 2020 at 18:47
-
-
Not exactly. First, you have to have a model of ASA that was purchased with "IPS" or "FPWR" in its model/part number to be able to have any of those available, then you have to have the SSD installed in the ASA if it wasn't included, then you have to have separate licensing, and the ASA sends traffic to the module for inspection and then the module sends the responses back to the ASA to either deny or permit the flow. The modules are completely independent of the ASA (different OS, different rules, different management method, etc.)– Jesse P.Commented Sep 10, 2020 at 19:14