Cisco Secure Firewall

Cisco Secure Firewall
Name	Cisco Secure Firewall
Developer	Cisco Systems
Initial release	1994 (as Cisco PIX lineage)
Written in	C, C++, Python
Operating system	Cisco IOS, Cisco ASA OS, Linux variants
Platform	x86, ARM, ASIC-based appliances
License	Proprietary
Website	Cisco Systems

Cisco Secure Firewall is a family of network security appliances and software developed by Cisco Systems, providing firewall, intrusion prevention, VPN, and segmentation capabilities. It evolved from legacy products into an integrated platform designed for data centers, enterprise campuses, cloud environments, and managed service providers. The product line is positioned alongside other Cisco security portfolios and competes with offerings from major vendors in the cybersecurity and networking industries.

Overview

Cisco Secure Firewall is offered as hardware appliances, virtual appliances, and cloud-managed instances, designed to enforce perimeter and segmentation policies across networks operated by organizations such as Bank of America, Walmart, AT&T, Deutsche Bank, Goldman Sachs and public sector agencies like the United States Department of Defense, National Health Service (England), NASA. It integrates with Cisco platforms including Cisco Identity Services Engine, Cisco SecureX, Cisco AnyConnect, and Cisco Umbrella while interoperating with third-party systems from vendors like Microsoft, Amazon Web Services, Google Cloud Platform, VMware, and Palo Alto Networks. The family addresses requirements found in compliance frameworks such as Payment Card Industry Data Security Standard, Health Insurance Portability and Accountability Act, and General Data Protection Regulation.

History and Development

The lineage traces to early Cisco acquisitions and products including the Cisco PIX era, succeeding devices like Cisco ASA and integrations from acquisitions such as Sourcefire and technologies aligned with OpenBSD-derived tools. Cisco announced strategic roadmaps at events like Cisco Live and partnerships with organizations such as National Institute of Standards and Technology, Internet Engineering Task Force, MITRE, and industry analysts including Gartner and Forrester. Milestones include transitions when Cisco embraced virtualization and cloud-native architectures to meet trends promoted by companies like Amazon Web Services and projects such as OpenStack, aligning features with standards from bodies like IEEE and IETF.

Architecture and Features

The architecture incorporates packet-processing pipelines on ASICs used in chassis and modular systems comparable to designs from Juniper Networks and Arista Networks. Core components interact with identity and access solutions like Okta, Microsoft Active Directory, and orchestration platforms such as Ansible, Terraform, and Kubernetes. Features include stateful inspection, deep packet inspection influenced by research from SANS Institute and CERT/CC, intrusion prevention deriving signatures similar to those developed by Snort community contributors, TLS inspection, application-layer filtering referencing application catalogs used by Cisco Umbrella and threat intelligence exchanges like MISP and VirusTotal.

Deployment Models and Integration

Deployment models span physical chassis used by service providers including Verizon, BT Group, and NTT Communications; virtual appliances deployed in VMware ESXi, Microsoft Hyper-V, and KVM environments; and cloud instances in Amazon EC2, Google Compute Engine, and Microsoft Azure marketplaces. Integration points include SD-WAN overlays pioneered by Viptela and others, secure access service edge patterns associated with vendors like Zscaler and Cato Networks, and orchestration workflows tied to Red Hat OpenShift and HashiCorp Consul.

Management and Configuration

Management is provided through centralized consoles and management planes that compete with systems from FireEye and Checkpoint Software Technologies, aligning with telemetry standards advocated by OpenTelemetry and log-analysis platforms such as Splunk, Elastic, and Sumo Logic. Configuration automation leverages APIs compatible with RESTful API practices, integrations with Cisco SecureX and SIEM platforms like IBM QRadar, ArcSight, and McAfee Enterprise Security Manager. Operational workflows reference playbooks and standards from MITRE ATT&CK and incident response guidance produced by United States Computer Emergency Readiness Team.

Security Capabilities and Performance

Security capabilities include intrusion prevention, sandboxing integrations similar to those from FireEye MVX and Cuckoo Sandbox projects, encrypted traffic analysis, and high-availability clustering architectures comparable to solutions from F5 Networks and Fortinet. Performance metrics are benchmarked in labs and reports by firms such as Ixia and NSS Labs and adopted in large deployments by organizations like Siemens, General Electric, ExxonMobil, and Toyota. Threat intelligence enrichment leverages feeds and partnerships with vendors such as Talos, Cisco Talos Intelligence Group, and collaborations with research organizations including Carnegie Mellon University, University of Cambridge, and Stanford University.

Licensing, Editions, and Support

Licensing models include perpetual appliance licensing, subscription services for threat updates and support tiers similar to models used by Microsoft, Adobe Inc., and Oracle Corporation, and cloud-native licensing aligning with marketplaces operated by Amazon Web Services and Microsoft Azure. Editions target small and midsize businesses, enterprise, and service provider markets, with support programs coordinated through Cisco's global partner network which includes distributors such as Ingram Micro and systems integrators like Deloitte and Accenture. Certifications and training for administrators are available via programs including Cisco Certified Network Professional and Cisco Certified Internetwork Expert curricula administered at events like Cisco Live.

Category:Network security