What is Cisco Firepower?
- Often referred to as Cisco secure Firepower, this advanced firewall was developed by Cisco to succeed and replace the Cisco ASA firewall line. Cisco Firepower operates on two different codes:
- The ASA (Adaptive Security Appliance) Code
- The FTD (Firepower Threat Defense) Code
The ASA code provides basic software but lacks advanced next-gen and IPS functionalities. In contrast, the next-gen ASA software includes a Firepower module that runs inline on top of the existing ASA architecture. In this setup, ASA offers IPS, malware protection, and URL filtering capabilities through Firepower.
Currently, Cisco Firepower integrates firewall capabilities with Firepower functionalities into a single solution, branded by Cisco as Cisco Secure Firewall.
The Secure Firewall suite delivers various critical capabilities, including:
- Unified Management of Firewalls
- Application Control
- URL Filtering and IPS
- Malware Defense
What is the use of Cisco Firepower?
Cisco Firepower line is designed to help businesses handle their network traffic while complying with network security policies – the guidelines for protecting the business network.
The Cisco Firepower Module runs on ASA devices installed in different cisco secure network segments and monitors network traffic for analysis. When deployed inline, the system can influence traffic flow using access control features that specify how to handle incoming, outgoing, and traversing traffic.
The data collected about network traffic, along with information from Cisco Firepower, helps filter and control traffic based on:
- Simple transport and network layer characteristics, such as source, destination, port, and protocol.
- Latest contextual information, including reputation, risk, business relevance, applications used, and URLs visited.
- Users of Microsoft Active Directory LDAP in your organization.
Each type of traffic inspection and control is performed where it offers the most flexibility and performance. For example, reputation-based blacklisting, which uses data on source and destination, can quickly block prohibited traffic while also detecting and blocking intrusions and exploits.
What are the key capabilities of Cisco Firepower?
The main capabilities of Cisco Firepower are as follows:
- Access Control Policies
- Identifying and Preventing Intrusions
- Advanced Malware Protection and File Control
Access Control Policies
It is a policy-based feature that helps you specify, inspect, and log the traffic allowed to traverse your network. This feature determines how the traffic is handled on your network.
The simplest access control policy uses a default action to handle all traffic. You can set this policy to either block or trust all traffic without further inspection for intrusions.
Alternatively, you can implement a more complex access control policy called blacklist traffic, which is based on Security Intelligence data. This policy includes access control rules that enable granular control over network logging and handling. With this policy, you can manage traffic by security zone, network, geographic location, port, requested URL, application, or user.
Furthermore, each access rule specifies an action that determines whether you monitor, trust, block, or allow the matching traffic.
Identifying and Preventing Intrusions
Intrusion detection and prevention serve as the last line of defense before traffic enters the network. You can set and configure intrusion policies, which include rules and settings for traffic inspection to identify security violations. In inline deployments, these intrusion policies block or alter malicious traffic.
If the system-provided policies don’t fully protect against intrusions, you can create custom policies to enhance system performance in your business environment. These custom policies offer a focused view of malicious traffic and policy violations occurring on your network.
Advanced Malware Protection and File Control
The ASA Firepower module’s advanced malware and file control protection components can identify, track, capture, analyze, and optionally block file transmissions over the network.
File control features allow devices to detect and block users from uploading or downloading specific file types through certain application protocols.
In contrast, advanced malware protection inspects network traffic for malware. If you store a detected file, you can then submit it to the CSI Cloud for a straightforward known-disposition lookup.
What are the license conventions for Cisco Firepower?
A Protection License enables devices to perform intrusion detection, prevention, file control, and Security Intelligence Filtering. You automatically receive this license when you purchase an ASA Firepower module.
Similarly, you need a Control License to manage users and applications. This license requires the Protection License, which comes with the ASA Firepower module purchase.
To utilize updated cloud-based category and reputation data for managing traffic based on requested URLs, you must obtain a URL Filtering License. This license also requires the Protection License, and you can buy it separately as an add-on subscription.
Finally, a Malware License provides advanced malware protection across your network. Like the others, this license requires the Protection License and can be purchased separately as an add-on or included in a service subscription that combines it with the Protection License.
Are you ready to upgrade your network security with Cisco Firepower modules?
Author: TechBlonHub
As a passionate blogger, I'm thrilled to share my expertise, insights, and enthusiasm with you. I believe that technical knowledge should be shared, not hoarded. That's why I take the time to craft detailed, well-researched content that's easy to follow, even for non-tech. I love hearing from you, answering your questions, and learning from your experiences. Your feedback helps me create content that's tailored to your needs and interests