Cisco IT Consultants

Cisco is a perennial front-runner in delivering cutting-edge firewall appliances for the widest possible range of environments. Cisco's Firepower Next Generation Firewall (NGFW) appliances represent a modern firewall platform that marshals sophisticed hardware, cloud-based services, and machine learning to anticipate, identify, and respond to cyber attacks without manual intervention. Progent's Cisco-certified CCIE-certified firewall experts can assist your organization to plan and execute a smooth migration to Cisco Firepower firewalls from Cisco's legacy ASA 5500-X, ASA 5500, or PIX appliances and show you how to integrate Firepower firewalls with Cisco's security services to build and centrally manage network ecosystems that encompass branch offices, data centers, private clouds and public clouds. Progent's firewall consultants can also help you to maintain and debug legacy Cisco security appliances. Progent's certified cybersecurity experts can assist you with policy creation and tuning based on leading practices so you can establish a consistent and effective security posture across all your endpoints anywhere.

Cisco's Firepower Next Generation Firewall Appliances
Cisco's line of Firepower Next-Generation Firewalls offer modern protection and unified control at price points, speed, and scale suitable for deployments spanning telecommuters and small organizations to global enterprises and Internet service providers. Cisco's Firepower NGFW appliances provide a significant performance boost over Cisco's previous-generation firewalls and offer unified management of advanced security capabilities such as application visibility and control (AVC), next-generation intrusion protection (NGIPS) with intelligent prioritization of risks, advanced malware protection (AMP), DDoS mitigation, and multi-node sandboxing.

All Firepower Next-Generation firewalls incorporate a single-pass design and support uninterrupted inspection and retrospective detection, which makes it possible to provide outbreak management and to uncover patient zero. Firepower NGFW firewalls also offer URL Filtering and sandboxing for detecting elusive malware, IoCs, and malware artifacts. NGIPS rule tuning and network firewall policy creation are automated, eliminating the need for time-consuming intervention by cybersecurity specialists. All Firepower Next-Generation security appliances offer the option of using either Firepower Threat Defense or Cisco Adaptive Security Appliance software. Centralized configuration, logging, monitoring, and reporting functions can be managed either by Management Center or in the cloud with Defense Orchestrator.

Cisco Firepower 1000 Series Next-Generation Firewalls
Firepower Next-Generation 1000 Series Firewalls are intended for small businesses, telecommuters, or branches. Devices in this family offer improved price/performance vs. comparable Cisco ASA 5506-X to ASA 5525-X firewalls, providing 4-6X higher firewall speed. Local management can be done with Cisco Firepower Device Manager. These firewalls feature an integrated 10M/100M/1GBASE-T Ethernet interface for management, an RJ-45 console interface, a USB 3.0 Type-A connection, and 200 GB of storage. High availability is supported along with virtual private network load balancing.

Cisco's Firepower 1010 firewall is a desktop or wall-mount, fanless appliance that delivers 890 Mbps throughput, Application Visibility/Control, and Next Generation Intrusion Prevention System (NGIPS). The unit has eight integrated RJ-45 I/O ports, two of them with POE+. IPsec VPN throughput is 500 Mbps and the firewall allows 100K concurrent sessions, 6,000 new connections/second, and a maximum of 75 VPN peers. The Firepower 1120 firewall is a 1RU rack appliance that provides firewall performance of 2.3 Gbps. The unit comes with 8 RJ45 built-in I/O ports and four SFP interface ports. IPsec VPN throughput is 1.2 Gbps and the device supports 200K concurrent sessions, 15,000 new connections per second with Application Visibility/Control, and up to 150 VPN peers.

The Firepower 1140 firewall is a 1RU rackmount appliance that delivers firewall throughput of 3.3 Gbps. The appliance includes eight integrated RJ-45 interfaces and 4 SFP interface ports. IPsec VPN performance is 1.4 Gbps and the appliance supports 400K simultaneous sessions, 22K new connections per second with Application Visibility/Control, and up to 400 VPN peers. The Firepower 1150 firewall is a 1RU appliance that offers firewall throughput of 5.3 Gbps. The appliance includes eight built-in RJ-45 ports, two SFP interface ports, and two 10G SFP+ interface ports. IPsec VPN performance is 2.4 Gbps and the firewall can handle 600K concurrent sessions, 28,000 new connections per second, and up to 800 VPN peers.

Cisco Firepower 2100 Series NGFW Firewalls
Cisco's Firepower 2100 Series Next-Generation Firewalls are one-rack units designed for use at the data center. Devices in this line have a dual multicore CPU architecture that enables them to offer 3-6X faster performance than Cisco ASA 5545-X to ASA 5555-X models they are engineered to succeed. Local management can be done using Cisco Firepower Device Manager. All Firepower 2100 Series NGFW Firewalls incorporate 12 RJ45 interfaces and four SFP interfaces. These firewalls include one integrated 10M/100M/1GBASE-T Ethernet interface for network management, an RJ-45 console interface, and one USB connection. Active/standby high availability is supported as well as virtual private network load balancing.

The Firepower 2110 firewall includes 4 integrated 1 Gb SFP Ethernet interfaces and 100 GB of storage. The 2110 delivers 2.6 Gbps firewall throughput and 800 Mbps IPsec VPN performance and allows 1 million simultaneous sessions, 18,000 new connections per second, and up to 1,500 VPN peers. Cisco's Firepower 2120 model firewall includes 12 integrated 10M/100M/1GBASE-T Ethernet RJ-45 interface ports, four built-in 1G SFP Ethernet ports, and 100 GB of storage. The 2120 delivers 3.4 Gbps firewall performance and 1 Gbps IPsec VPN throughput and enables 1.5 million concurrent sessions, 28,000 new connections per second and a maximum of 3,500 VPN peers.

Cisco's Firepower 2130 firewall features four built-in 10 G SFP+ interfaces and 200 GB of storage. The 2130 also accepts a network module with 8 extra ports. The Firepower 2130 offers 5.4 Gbps firewall throughput and 1.9 Gbps IPsec VPN performance and supports 2 million simultaneous sessions, 30,000 new connections per second, and a maximum of 7,500 VPN peers. Cisco's top-of-the-line Firepower 2140 firewall comes with four integrated 10G SFP+ ports and 200 GB of storage. The unit also scales via a network module with 8 additional interface ports for a maximum of 24 Ethernet interface ports. The 2140 delivers 10.4 Gbps firewall throughput and 3.6 1Gbps IPsec VPN performance and allows 3 million concurrent, 57,000 new connections per second, and a maximum of 10,000 VPN peers. Both the 2130 and 2140 units feature dual AC or DC power supplies.

Cisco 3100 Firewall Series
Cisco's Secure Firewall 3100 Series appliances are modular one-rack devices targeted at large companies who require performance, high port density, and zero-trust security at the Internet edge, the corporate data center, or a private cloud. For maximum uptime, all Secure Firewall 3100 Series appliances allow 8-chassis clustering and operate in Active/active or Active/standby mode. The units can run Cisco's ASA or Firewall Threat Defense software. Built-in I/O for each unit includes eight 10M/100M/1GBASE-T Ethernet interfaces (RJ-45) and 8 1/10 Gigabit Ethernet interface ports. Available network modules support 1/10/25/40G options and all versions have 900 GB of storage as well as an additional storage expansion slot.

Cisco's 3100 Firewall device offers 18 Gbps firewall performance and 8 Gbps IPsec VPN throughput. The 3110 allows two million simultaneous sessions, 64,000 new connections/second, and a maximum of 3,000 VPN peers. Cisco's Secure Firewall 3120 model delivers 22 Gbps firewall performance and up to 10 Gbps IPsec VPN throughput. The 3120 allows 4 million simultaneous sessions, 98K new connections/second, and up to 7,000 VPN peers. Cisco's Secure Firewall 3130 device delivers 42 Gbps firewall throughput and up to 14 Gbps IPsec VPN throughput. The 3130 firewall allows 6 million concurrent sessions, 200K new connections per second, and as many as 15,000 VPN peers. Cisco's 3140 Firewall appliance offers 49 Gbps firewall throughput and up to 17 Gbps IPsec VPN throughput. The 3140 firewall supports 10 million concurrent sessions, 200K new connections per second, and a maximum of 20K VPN peers.

Cisco Firepower 4100 Series NGFW Firewalls
Cisco's Firepower 4100 Series NGFW Firewalls are single-rack appliances designed for operation at high-performance data centers. Appliances in this line deliver 5-10X faster throughput than the Cisco ASA 5585-X device they are designed to replace. Local management can be performed using Firepower Device Manager. All Firepower 4100 Series Next-Generation Firewalls have 8 built-in SFP+ ports and all accept a selection of plug-in network modules for a maximum of 24 ports. All Firepower 4100 Series NGFW Firewalls support virtual private network load balancing, high availability, and clustering of up to six chassis. These devices feature a built-in 1Gb Ethernet port for network management, one RJ-45 console port, and one USB interface.

Cisco's Firepower 4110 firewall features 200 GB of storage and offers 13 Gbps firewall performance and 6 Gbps IPsec VPN throughput. The 4110 model supports 10 million simultaneous sessions, 64K new connections/second, and as many as 10K VPN peers. Cisco's Firepower 4112 firewall has 400 GB of storage and delivers 19 Gbps firewall throughput and 8.5 Gbps IPsec VPN throughput. The 4112 appliance supports 10 million concurrent sessions, 98K new connections/second, and as many as 10,000 VPN peers. Cisco's more recent Firepower 4115 firewall includes 400 GB of storage and offers 27 Gbps firewall throughput and 8 Gbps IPsec VPN throughput. The 4115 unit allows 15 million simultaneous sessions, 200K new connections per second, and as many as 15,000 VPN peers. Cisco's Firepower 4120 appliance includes 200 GB of storage and offers 22 Gbps firewall performance and 19 Gbps IPsec VPN performance. The 4120 firewall supports 15 million concurrent sessions, 118K new connections per second, and a maximum of 15,000 VPN peers. Cisco's more recent Firepower 4125 model features 800 GB of storage and offers 40 Gbps firewall throughput and 14 Gbps IPsec VPN performance. The 4125 firewall supports 25 million simultaneous sessions, 265K new connections/second, and up to 20K VPN peers.

Cisco's Firepower 4140 model firewall includes 400 GB of storage and delivers 32 Gbps firewall throughput and 13 Gbps IPsec VPN throughput. The 4140 unit allows 25 million simultaneous sessions, 172K new connections per second, and as many as 20K VPN peers. Cisco's newer Firepower 4145 model has 800 GB of storage and offers 53 Gbps firewall performance and 18 Gbps IPsec VPN performance. The 4145 firewall allows 30 million concurrent sessions, 350K new connections/second, and a maximum of 20K VPN peers. Cisco's Firepower 4150 firewall has 400 GB of storage and delivers 45 Gbps firewall performance and 14 Gbps IPsec VPN performance. The 4150 firewall allows 30 million simultaneous sessions, 263K new connections per second, and as many as 20K VPN peers.

Cisco Firepower 9300 Series NGFW Firewalls
Cisco's Firepower 9300 Series Next-Generation Firewalls are massively scalable and carrier-grade security appliances. The 3RU chassis of Firepower 9300 NGFW Series firewalls can hold two add-in network modules and three security modules. Fully loaded, the 9300 can hold 24 10-Gigabit SFP+ ports or eight 100G interfaces. Clustering of up to 5 9300 chassis allows a total 1.2 Tbps of firewall performance. The top-of-the-line Cisco Firepower 9300 SM-56 delivers 70 Gbps firewall performance and 27 Gbps IPsec VPN throughput. The unit allows 35 million simultaneous sessions, 490K new connections per second, and a maximum of 20,000 VPN peers.

Firepower Services
Firepower NGFW security appliances accept software or hardware modules that enable Cisco's Firepower Services, which offer layered protection against advanced threats. Cisco's Firepower Services are based on technology acquired by Cisco from Sourcefire. Major capabilities of Firepower Services include:

• Multi-layer protection against familiar and new attacks
• Advanced Malware Protection that utilizes big data to find and remediate intrusions
• Cisco's Next-Generation Intrusion Prevention System (NGIPS) that provides contextual analysis that looks at clients, network infrastructure, apps, and content to discover attacks that use simultaneous approaches
• Fine-grained Application Visibility and Control that is aware of thousands of applications and can automatically activate both standard and customized IPS policies based on the degree of threats

Smaller deployments of Cisco's Firepower Next Generation firewalls can be effectively managed via Cisco's on-box Adaptive Security Device Manager (ASDM) Adaptive Security Device Manager, a web utility which is provided with all firewall versions. ASDM includes an easy-to-use web console for configuring, managing, and debugging Firepower firewalls and service modules.

For more complex deployments, NGFW firewalls with Firepower Services can be administered with Firepower Management Center, implemented as one or more physical units or virtual devices. Cisco's Firepower Management Center offers unified firewall management, Application Visibility and Control, enhanced IPS, URL filtering, and Cisco's Advanced Malware Protection. Due to ongoing rebranding after Cisco's acquisition of Sourcefire Defense Center, Cisco's Firepower Management Center has been delivered under various names that include Cisco Defense Center, FireSIGHT Defense Center, and FireSIGHT Management Center.

Firepower Management Center appliance offers capabilities unavailable with Cisco's on-box Adaptive Security Device Manager tool. Extra capabilities include expanded context awareness, Cisco's Advanced Malware Protection (AMP) with mitigation for user devices, a console that offers real-time infrastructure visualization, automated policy tuning driven by impact evaluation of threats, advanced IPS, custom app discovery for Application Visibility and Control (AVC), customized health notifications, enhanced reporting features, and APIs for host input and databases. Hardware-dependent capabilities like clustering, stacking, switching, routing, VPN, and NAT must be handled using either Cisco's on-box ASDM or the Firepower CLI.

Progent's Migration Support Services for Cisco Next Generation Firewalls
Because Cisco has discontinued selling the PIX 500 and ASA 5500 product lines, many businesses are concerned about depending on a key security component that might stop being supported. Firepower NGFW Series security appliances offer the advantage of being current products and also offer important functions and economic advantages in comparison to legacy firewalls. These advantages include substantially better throughput, optional SSL tunneling capability, and an expandable architecture that guards your investment by allowing you to self-install more security features whenever you require them. Progent's CCIE-certified experts can help your company to assess the business case for moving from PIX 500 or Cisco ASA 5500 firewalls, create a migration plan that permits a quick and seamless upgrade, help you to configure new Firepower Series appliances, and offer remote training, consulting, and troubleshooting services.

Additional Ways Progent Can Support Your Cisco Firewalls
Cisco's Firepower NGFW Series firewalls incorporate a wealth of configuration, monitoring, and troubleshooting features which offer you the ability to deploy these firewalls to match your company's needs. Progent's CCIE authorized network experts can help you to build an efficient network infrastructure that includes Cisco firewalls and that provides world-class protection, fault tolerance, performance, and recoverability. Progent's CISA and CISM-premier information security experts can help you to create a security policy appropriate for your environment and can configure your security appliance to enforce your security strategy. Progent's security evaluation consultants can evaluate the effectiveness of your current firewall solution and help determine the overall security of your whole IT network. Progent's Help Desk support team can provide emergency online technical support for Cisco technology and offer quick access to a Cisco CCIE expert.

Progent offers remote or on-premises consulting services and can deliver occasional guidance to help your organization resolve a stubborn technical impasse or Progent can provide end-to-end project management services to make sure your firewall initiative is completed on time and within budget.

To find out additional information about Progent's engineering help for Cisco products, pick a subject:

• Overview of Progent's Cisco Expertise
• Fast Online Assistance from a Cisco CCIE Engineer
• ASA 5500-X Firewalls with Cisco Firepower Services: Configuration and Troubleshooting Expertise
• Cisco ASA 5500 Firewall Consulting Services
• Cisco PIX 500 Firewall Upgrade. Migration Help
• Cisco Routers Engineering Expertise
• Cisco Wireless Deployment Help
• Aironet Wireless APs Design Support
• Cisco Small Business 100, 300 and 500 Wireless Access Points Consulting Expertise
• Catalyst 802.11ax Wireless APs Planning, Configuration and Debugging Consulting
• Cisco Wireless Controllers Integration Consulting
• Meraki Wireless Access Points Consulting Help
• Cisco Unified Communications Manager (CUCM or Unified CM) and Cisco CallManager Configuration and Troubleshooting
• Cisco VoIP Phones and IP Video Phones Consulting and Wireless IP Phone Integration
• Cisco Jabber Migration and Support Services
• Cisco Catalyst Switches Consulting and Support Expertise
• Nexus Switches Deployment Services
• Cisco Meraki MS Switches Support and Troubleshooting Expertise
• Cisco VPN and Security Integration Assistance
• SIP and CUBE Infrastructure Solutions: SIP PSTN Trunks and Cisco CUBE Integration Consulting
• Design Expertise for Cisco-powered Datacenters
• Infrastructure Design Expertise for Internet Service Providers
• Remote Management Strategies for Cisco Environments