Cisco ASA vs FTD, two firewalls, two jobs

two firewalls walk into a rack

if you've spent any time around cisco gear you've probably run into both of these boxes. asa and ftd look similar from the outside, same appliances a lot of the time, same rj45 ports staring at you, but under the hood they're running completely different philosophies about what a firewall should be doing. understanding the difference isn't just trivia for a ccnp exam, it actually matters for how you defend your network, because picking the wrong one or misconfiguring the one you have leaves gaps.

asa, the classic workhorse

asa runs cisco's original firewall os. it's lean, it's been around forever, and it's rock solid at the stuff it was built for, layer 3 and layer 4 filtering plus vpn termination. if you've got a site to site tunnel or a bunch of anyconnect remote users, asa handles that job without drama. management is through asdm or straight cli, no separate management server required, which some defenders actually prefer because it's one less thing to patch and maintain.

the tradeoff is that asa's inspection is shallow by modern standards. it knows ports and protocols and basic connection state, but it doesn't have a real application aware engine baked in. if your threat model includes anything past "block bad ports," asa on its own isn't going to see it.

ftd, the ngfw

ftd is cisco's next gen firewall software, and it's built around snort. specifically snort 3 now, which is a real intrusion prevention engine doing deep packet inspection, not just header checking. ftd also brings app-id, meaning it can actually identify what application is generating traffic instead of just guessing based on port number. that matters because plenty of malware and c2 traffic rides on port 443 right alongside your normal https traffic. a device that can only see "port 443, allow" is blind to that. a device with app-id and real ips signatures has a shot at catching it.

management for ftd usually goes through fmc, the firepower management center, or fdm for smaller single device setups. fmc gives you centralized policy, correlation across multiple firewalls, and a much richer view of what your ips is actually seeing across the estate.

why this matters for defenders, not just architects

here's the practical part. if you're running asa in 2024 and beyond purely as a vpn concentrator, that's a legitimate use case and it still works fine, but don't assume it's doing threat inspection it was never designed to do. pair it with something that actually looks inside the traffic, whether that's ftd elsewhere in your stack or another ips layer, because asa alone will pass plenty of malicious payloads straight through as long as the port and state look normal.

if you're planning a new deployment, cisco's own investment and roadmap point at ftd. new features, new snort rule development, new hardware platforms, it's all going toward ftd. building fresh on asa in 2024 is choosing to inherit a shrinking feature set on day one. that's not fear mongering, it's just where the vendor is putting its engineering hours.

how to check what you're actually running

a lot of shops don't even know for sure which os their box is on, especially if it was racked by someone who left the team years ago. worth a five minute audit.

show version
show inventory

on asa this gives you the asa software version directly. on ftd hardware managed by fmc, you'll want to check the device record in fmc itself, or pull the version from fdm if it's standalone. if you find you're on asa and doing anything more than site to site vpn or basic acl filtering, that's your cue to reassess whether you're getting real inspection coverage or just a false sense of it.

also check your snort engine version if you're already on ftd. snort 2 vs snort 3 is a meaningful jump in detection capability and rule support, and plenty of ftd boxes are still sitting on snort 2 because nobody scheduled the migration.

the takeaway

asa isn't obsolete, it's a specialist tool that's great at one job, vpn termination and basic filtering, and you should feel fine running it for exactly that. ftd is the generalist that actually looks at what's inside your traffic. the mistake to avoid is assuming your firewall is doing deep inspection when it's really just checking ports. go find out what your edge is actually running, confirm what it's inspecting versus what it's just passing through, and if you're building new, start the conversation with ftd instead of defaulting to whatever's always been there.