At VMworld this week in Las Vegas, Cisco will be providing a preview of a virtual implementation of our ASA security appliance. A “preview” implies that we aren’t ready to announce ultimate pricing or availability, but we are demonstrating a strategic direction for the ASA product line. Earlier, I alluded to important new advances in our virtual security story upcoming at VMworld in the comments section of a recent blog post I wrote responding to HP criticisms of our Virtual Security Gateway (VSG) product.

With security concerns being the most frequently cited obstacle to large scale virtualization projects and adopting cloud computing models, Cisco will be greatly enhancing its industry-leading virtual security infrastructure with this product. The new virtual ASA introduces a wide range of security services that have not been available from Cisco before in a virtual form factor. The virtual ASA will enable more sophisticated security policies that better align with business and compliance needs in the virtual data center.

Some of the key aspects of this new virtual ASA product:

• The ASA family is one of the most deployed and trusted security products in the industry, with over 15 years of security experience and more than 1 million appliances installed, and now is available in a virtual form factor for greater flexibility in the data center
• Virtual ASA runs the ASA feature set, so important capabilities such as VPN , NAT, and much more will be available in addition to firewall capabilities
• The Virtual ASA will run on top of the Nexus 1000V virtual switch, fully leveraging the VM and traffic visibility provided by the Cisco virtual fabric, as well as optimal traffic steering to the security node from the VM and virtual switch

Rather than replacing our VSG virtual firewall, the virtual ASA will be a strong complement for the current VSG capabilities. The virtual ASA includes security functionality most often deployed at the edge of an organization and the edge of the data center. As such, it is better suited for North-South traffic into the data center and virtual applications. VSG, with its greater visibility to VM-specific and application attributes, enforces security policies between applications and virtual machines, and is more East-West traffic oriented.

Across the whole ASA product line, customers will be able to get consistent functionality, management and policy enforcement across all form factors (stand-alone appliance, modular blade, and now virtual instances). And with Nexus 1000V integration, Virtual ASA customers will also get consistency in management, provisioning and service routing with Cisco’s other virtual services including VSG and vWAAS. At a minimum, this should alleviate all objections that we just offered a virtual firewall and not other key security services.

If you are in Las Vegas next week, we encourage you to come by the Cisco booth (#700) for a look. If not, stay tuned for more details…

Tags: ASA, Nexus 1000v, virtual security, Virtual Security Gateway, vsg

One of the things I admire about Cisco marketing, and I think generates a lot of respect for us from our customers, is how we approach competitive marketing. Most importantly, we hardly ever do it. Sure, we arm our sales teams with specific comparison data, but it’s rare we feel the need to compare ourselves publically or to bash competitors. When you bash a competitor, it really only serves to give them credibility, and highlights that they must be doing something important to occupy your mindshare, or that of your customer’s.  Occasionally though, we are faced with not only having to take the gloves off a little more, but responding to the inevitable FUD that gets thrown our way.

This brings us to a blog post written by HP about Cisco’s Virtual Security Gateway (VSG), which unfortunately contains a number of inaccuracies and misrepresentations of our product that we have to clear up.

Let’s start with this example:

Cisco has a product called the Virtual Security Gateway (VSG) for the Nexus 1000V Series. It is a virtual firewall that lets you enforce policy and segmentation virtual environments. All associated security profiles are configured to include trust-zone definitions and access control lists (ACLs) or rules. They also support VM mobility when properly configured. If there’s one thing the company is good at, it is those good-old ACLs developed back in the early 90s!

The strength of VSG’s firewall capabilities is its awareness of the virtual machine environment, and specifically the ability to write firewall rules based on the attributes of the virtual machine, attributes such as the NAME of the VM. This gives tremendous power to establish policies in virtual environments, such as logically isolating tenants running on the same machine, or separating VMs based on operating system or application type in virtual desktop environments, a use case I wrote about earlier. To imply VSG is enforcing good-old ACL’s from the 90’s is disingenuous at best. Read More »

Tags: ASA, data center security, Nexus 1000v, Virtual Security Gateway, vsg

There is a lot of buzz out there right now about Telework Solutions for Government as many agencies are making the transition that so many Corporations have already completed.  Personally, I haven’t worked full time in an office since pre-1996 and can’t imagine wasting that much time every day on preparations and commuting for no real purpose other than donuts, coffee and the latest office gossip.

Work is an activity, not a location in today’s professional world with pervasive networking capabilities and the Government is getting on board under the leadership of the current administration.

If you want to get a feel for the progress and momentum around this,  check out the public/private partnership at the Telework Exchange site focused on eliminating the Telework Gridlock.  Cisco is one of the sponsors of this activity because we see the value, have lived it for better than 15 years,  and can offer solutions to help make this a reality for our Government customers. Read More »

Tags: anyconnect, Apple, ASA, borderless, Borderless Networks, firewall, iPad, iphone, telework

In my last post on this topic, I highlighted just how true the words “Work is no longer a place you go, but what you do” really are. We now have the ability to work anytime, anywhere, using any device. As easy as this has made the lives of workers all over the world, it’s made the lives of security administrators immensely difficult. Providing secure access to the corporate network in a borderless world, while still somehow keeping out the bad stuff, has caused traditional security policies to become increasingly difficult to configure, manage, and troubleshoot – the source of inordinate amounts of pain for security administrators.

That’s why Cisco has introduced identity-based firewall security as a new capability of the ASA platform. As the first installation of what will soon become full context-aware security, identity-based firewall security enables security administrators to utilize the plain language names of users and groups in policy definitions. Rather than authoring and managing the growing list of IP addresses to cover every possible location, device, or protocol that may be required for secure access to the network, identity-based firewall security enables security administrators to grant access to “Jeff.” Regardless of where I am or what I’m using for access, I’m still Jeff… so in the simplest case, my administrator can literally write one policy to provide “Jeff” access to the corporate network, rather than six different IP addresses for all the instantiations of Jeff.

Read More »

Tags: ASA, borderless, firewall, identity, security

Few people in the world would disagree that a network firewall is an essential component for any size datacenter. In fact, operating without one could be considered by many to be network asset suicide! But adding a firewall to an existing datacenter is by no means a trivial task. In fact, the amount of work that would be required to re-cable every physical interface to properly tie it in with the rest of the network is enough to make many network administrators think twice about just how badly they really need that shiny new firewall, versus just sticking with what they have. Add to that the additional rack space, power, cooling, and management required by the new device, and some serious ROI questions may be raised.

Read More »

Tags: ASA, ASAMC, product launch, security