Security Platforms Past, Present and Future May 3, 2012 Aaron Robel

Agenda Past Present Future Questions

Anyone Remember the Checkpoint Firewall 1,2,3 days? Well Defined Policy Control Integrated Logging and reporting GUI driven Platform Checkpoint Management GUI Simple architecture Reduced change risk Physical Firewalls

Only Physical separation Only a Global Policy Built for the Enterprise Many DMZ’s Large segments Huge policies Policy control No logical partitioning No delegation capability Multi- Tenancy Scalability through physical addition Challenges between OS and software Platform Old Checkpoint Platform Challenges

Enter: The Cisco Firewall Services Module Enter: The Cisco Firewall Services Module Consolidated Hardware and Software Robust Throughput Tightly Integrated with Network Core The Platform Distinct Logical firewalls Compartmentalized Policies Granular Service separation Quick scalability for new services Multi- Context Mode

Firewall Service Module Challenges Limited to 1 gig flows Limited visibility in backplane HA traffic coupled with data traffic Tightly integrated with Network Core The Platform Limited to stateful firewalling Firewall proliferation Inefficient packet flows Multi- Context Mode No log monitoring or reporting Still have to implement firewalls in CLI Not ready for multi-tenancy Cisco Security Manager

Tenants of a New Solution Delegated Service ModelSimplify Firewall ArchitecturePerformance LeapBeyond Stateful FirewallingManagement Single Pane of GlassProvider Grade ScalabilityReduce Operational Cost

After 6 successful years and long service life it’s now time to replace the FWSM… The RFP process was started to find the next generation security platform. Gathered RequirementsWent out for a RFIVendor Interviews/DemosWent out for RFPEvaluation, evaluation, evaluation…

The ASV is…

What drove this decision?? PerformanceFeaturesSupportPotential

Performance 480 Gig of stateful firewalling 71 Gig for IPS 32 Gig for Anti-Virus/Malware Throughput 132 million concurrent connections 1.1 million new connections per second Connections Up to 3000 individual VDOM’s or virtual firewalls Capacity

Primary Features Stateful firewallIDS/IPSApplication policy controlFQDN policy enforcementActive directory IntegrationURL filteringVPNScalability and HAL2 and L3 capabilityUnified MGMT GUI

Features VDOM 1 FirewallingRouting tableIPSIPSec VPNClient SSLVPN VDOM 2 FirewallingLayer 2 bridgeIPS VDOM 3 FirewallingRouting TableURL FilteringIPS Application ID Integrated with AD

Support Technical Account MGR Resident Engineer Training Lab Equipment

Potential Data Loss PreventionAnti-Virus/Malware InspectionIntegrated Wireless ControllerWAN OptimizationWEB CachingVoIP SupportIPv6 Support

Platform Challenges No proven track record with the State The Unknown Migration from vendor to vendor is always tough 6 years with FWSM Data flows may introduce challenges New datacenter infrastructure Datacenter deployment

Some Architectural Thoughts… Next Generation Architecture Re-Think SGN Cloud Scalability Hypervisor Firewalls

Lets get the 2 most frequently asked questions out of the way…

I love to talk so, OTHER questions?