A small package that delivers great results
Rating: 9 out of 10
IncentivizedUse Cases and Deployment Scope
Here at our organization, we have about 15 remote locations, from small sales offices to manufacturing plants, all connected to our HQ using VPN. 2 years ago, we started to deploy Firepower NGIPS in some of those locations. Our main goal was to offer a robust, secure and centralized option for each location. Having centralized administration in our HQ, we can have the same policies applied for all the locations, check status, audit logs, etc. Also, once you have the templates, it's just a matter of order the same p/n and the setup will be very easy. Also, as we already, use Cisco routers for other purposes, like voice gateway, wan optimization, having the Firepower as a virtual machine inside the router was also a key feature for our convergence strategy.
Pros
- The option to deploy it as a virtual machine in a UCS-E inside a Cisco Router is something to consider a lot. It simplifies a lot the deployment in places where you need to optimize resources and keep things simple. It also saves some money on unnecessary hardware.
- Having the most complete license, we can have in the same box IPS, inspection for malware and URL filtering. As Cisco uses Talos Intelligence network to mitigate and evaluate risks, having this complete set of security features turns the box into a powerful resource to protect our remote locations. Considering the hyper-connected business we have today, it's almost impossible to think that we can run a business without this kind of protection.
- The integration between Firepower NGIPS and other products, like Cisco ISE and Splunk, is also a key feature for this solution. In both cases, you can integrate the product to have the best of both. As a security appliance, it's very important for us to have all the logs centralized in Splunk and this is done simply connecting FMC (Firepower Management Console) to the Splunk collector.
Cons
- The initial setup of the box can be a little tricky, especially in deployments like ours, where you have it running on a UCSE server inside a router. I think Cisco could do it a little easier, like having a script to configure it.
- The interface of the FMC (Firepower Management Console) is a little outdated. Cisco could use the latest design language they already used for other platforms like Cisco Prime to make that interface more user-friendly.
Likelihood to Recommend
For scenarios, I described before, like when you have centralized administration and several locations, and the majority of those locations have the same size/requirements, Firepower is well suited. Easy to maintain, relatively cheap to buy. For scenarios too small, like small sales offices like ours, I don't think Firepower could fit, basically because you'll need to invest a certain amount of money to buy, license and deploy.
EV
Eduardo Viero
IT Infrastructure Specialist in Information Technology at RANDON S.A (Automotive, 5001-10,000 employees)
Vetted Review
2 years of experience