- [Lecturer] In an enterprise environment
the firewall is the gatekeeper of the network.
These devices monitor incoming and outgoing traffic
and they'll either permit or block the traffic
by performing simple packet filtering.
This is, essentially, the barrier
between our internal network
and the public internet.
So this is a critical piece
of our enterprise infrastructure.
Our traditional firewalls are not intelligent enough
to distinguish between different types of traffic
because they don't have the ability to inspect packet data
at the upper levels of the OSI model,
they simply protect based on ports,
protocols and IP addresses,
which is increasingly harder to do these days
because we have very complex emerging threats.
The answer to this is, of course,
next generation firewalls, but primary feature
of next generation firewalls
is deeper packet inspection capabilities
with better control of route traffic.
Other advantages of next generation firewalls
include the fact that they offer streamlined architecture.
Generation firewalls often are integrated
with many different services.
They may have antivirus, anti-malware,
spam filtering, IDS and IPS all bundled in together,
just to name a few services.
And many of these can also be deployed
as a virtual appliance.
So rather than having physical hardware taking up space,
they're much easier to deploy,
especially with multiple appliances
in a fail over configuration.
The ability to monitor traffic,
all the way up to layer seven, is another advantage.
Traditionally firewalls block applications
by blocking their common port numbers.
But this is becoming more difficult
and more ineffective these days.
Many next generation firewalls
have application awareness.
So they're able to see exactly
what is being sent or received.
This offers the ability for companies to set policies,
depending on the user
or depending on the application itself.
So for example, maybe you want to allow users
to have access to certain social media sites,
but you want to block the chat function from those sites.
With our traditional firewalls
this would not have been possible,
but with our next generation firewalls
with much deeper application inspection,
we can certainly do that.
Also speed is a big one,
traditional firewalls can get bogged down
when security services are enabled.
And they can experience less than ideal throughput
even lower than claimed by the vendor.
I've seen throughput cut
in more than half in many cases
once all the security services are up and running
and with the more streamlined software
and operation of next generation devices,
this isn't an issue.
That gives priority to traffic
and you'll get much better throughput rates.
Now that we know what a next generation firewall is
and some of the advantages offered,
let's look at some CISCO specific solutions.
Historically you might think of this CISCO ASA,
the adaptive security appliance line.
When you think of a CISCO firewall,
that's certainly the first thing that comes to my mind,
they're great devices and I've employed many of those
for businesses myself.
Now, what CISCO has done to create an effective
next generation solution is they've integrated
their existing ASA firewall with something called
the firepower NGIPS,
the next generation intrusion prevention system.
Features of firepower include IPS rules
to identify and block threats,
advanced endpoint and network analysis
for malware detection and a sandboxing environment
to examine what files do when they're executed.
Combining the ASA platform with the firepower NGIPS
created a product that CISCO calls
the CISCO Firepower Next Generation Firewall.
This is the industry's first fully integrated
next gen firewall with unified management,
this software platform is available
for all Firepower series appliances
as well as the ASA 5500 appliance line,
except for the 5585 model.
The unified management platform that's used
by this next generation firewall
is called the CISCO Firepower Management Center
or FMC for short.
This is where all the information
in our network is aggregated,
where we would find threat events correlated
and where we could even find
network device performance data.
All of the benefits offered
by CISCO Firepower Next Generation Firewall
meet our modern enterprise security needs
and that includes built-in intrusion prevention system,
virtual private network capabilities,
botnet filtering, zero-day break out prevention,
deep packet inspection and, of course, malware
and ransomware prevention.
These days a traditional stateful firewall
just isn't powerful enough
to protect against emerging threats,
so it's recommended that we employ
a next generation firewall solution.
This has been a look at some of the CISCO specific
next generation firewall solutions
that have been designed to meet our modern security needs.