ASA with Firepower or just Firepower for AWS?

[AlexPi]

Hello All,

I am looking on some advice regarding ASA with Firepower Services, versus standalone Firepower to implement on AWS.

The scenario is as follows (very roughly). We are deploying microservices through AWS for our online platforms, some exposed to the open internet some exposed only internally via site-to-site VPN. In the future AWS will also be hosting some databases for those platforms.

I still cannot figure out what is the best solution for perimeter security though… ASA with Firepower services or just the virtual Firepower appliance.

Also, if I implement an ASA in AWS can I create the VPNs through the ASA or I still need to use the AWS VPN?

Thanks in advance!

[Florin Barhala]

Nice scenario ! I am also curious about our colleagues feedback. Until then I think an important point is also your knowledge on both solutions.
For the record I have no FTD OS knowledge hence I would gladly install an ASA with Firepower if critical business services will stay there and equally I would pick FTD so I can learn if the business impact is lower.

[AlexPi]

So I had a look and AWS offers Cisco Adaptive Security Virtual Appliance (ASAv), or Cisco Firepower NGFW Virtual (NGFWv), I cannot see anywhere a virtual appliance characterized as ASA with Firepower Services. That being said and considering that Firepower NGFW offers all that the ASA will, plus obviously the IPS, which is a must for our scenario among others I am inclined to go for the Firepower NGFW.

OS knowledge, is also a consideration to be taken under advisement in general, but not if you need IPS and NGFW capabilities! Then you have to go Firepower.

I would be eager to hear the opinion of someone who has implemented something similar in AWS, before I go on buying expensive licenses!

[jimholla]

Correct. There are no virtual offerings for ASA with Firepower Services. There is ASAv and Firepower Threat Defense NGFWv.