RE: PIX Vs ASA

On Thu, 16 Feb 2006, Baussmann, Peter wrote:

> Yeah...but do you *really* want one? From past experience, "all-in-one"
> solutions aren't always a good thing.

Yes, I really do; Past experience not always remains true.
IMHO CiscoASA is going to play in the UTM (Unified Thread Management)
market share, in alliance with Trend to supply third part solutions;


> - Performance usually suffers (a good example is turning on the IDS
> signatures on a Netscreen firewall and see what happens to performance).

Yup; but nowadays ASIC perspective (i.e. Fortinet) doesn't repeat the mistake.
ASA ASIC's based is the same way.

> - Firewalls with anti-virus/IPS capabilities usually only scan for
> well-known malware/worms etc. and aren't as comprehensive as dedicated
> systems.

not totally true; there're heuristic features included too in all-in-one
appliances.


> - If you're relying on one box to do all your security work, you're
> going to be losing your anti-virus, IPS and firewall capabilities if
> that box goes down.

If you do a correct sizing of your network needs, you have a lot more
for the money and time  with one all-in-one appliance;
(add in a column licensin for WebFilter(i.e. Websense)+ AV/ASpam (i.e. Trend) +
IDS/IPS + SSL VPN + .. and compare)
If you firewall dows down, I think that AVirus is the minor of your problems.
All-in-one boxes offers to you HA (failover) too.

best regards,


--

Abel Lucano _______________________________________

GlobalGate
TE:  (+5411) 5218 4242/44     FAX: (+5411) 5218 4245
Ciudad de Buenos Aires   -    Argentina