Palo Alto Networks Firewalls versus Cisco ASA Palo Alto Networks beat Fortinet in 2015 on the promise of adaptive security features. It is now the third-largest vendor of security appliances, just behind Check Point and Cisco, which still hold a 35 percent market share. Market data aside, choosing the right firewall depends on many factors. While the vendor should be able support the product you buy, the first question you need is: What features does my firewall require? Your security policy should address this question. Remember that the security appliance you choose will implement your security policies. This will make it more difficult for you to do the right thing in the future. Before you begin your search, you should know what you need. Learn how to become a security expert. Palo Alto is an adaptive security app that allows or denies traffic based on a single fingerprint. It supports your IP and port policy rules and then enables policies based upon actual users and applications within your network… and beyond. The “beyond” portion means that firewalls share protection worldwide with all subscribers. All subscribers are automatically updated with the fingerprint of a company that is subject to an attack. Cool things: You can allow certain functions without blocking the entire application. You can, for example, allow Facebook but block Candy Crush. This is the best part. Palo Alto appliances are built with these next-generation features. There are no modules or additional management screens. All of their best features are built in. One other thing: Palo Alto firewalls were not affordable until a few decades ago. They do sell them today (relatively), but they will be charging for the next generation of technologies. Cisco ASA If your IT career has been long, you may have encountered an ASA (or a PIX) at some point. Cisco ASA Cisco firewalls were not available until a few years ago. This meant that their appliances did not have application identification and control. They have reintroduced these features since Sourcefire was acquired. Overall, the IDS/IPS arena has been very positive since then, so the $2.7 billion acquisition was probably worthwhile. The best part: Cisco has been around for a long time and has a 24-7 support system to assist you in any situation. Cisco was the first to enter the enterprise security market with their solid VPNs. Another thing is that Cisco has a mature firewall architecture. However, they often roll out modules which means multiple management system for similar functions. Every environment is unique. Your firewall will most likely serve as a switch and filter in a smaller office. The firewall will likely stand alone in a larger office. Talk to the sales reps of the company, get a few demo units and test your options (after you have finalized your security policy). After you have made your decision, make sure to train your team about Palo Alto and Cisco ASA. In Keith Barker’s webinar The Power of Palo Alto firewalls, learn more about Cisco, Check Point and Palo Alto. P.S. P.S. Start your free week. Download