Yikes ..

I'm assuming this factor causes a great reduction in the feasibility of this feature?!

Since you're a Cisco guy, have you heard of any plans to revamp the FWSM? Isn't it based on older PIX era technology?

When I first heard about the ACE I thought it might be a replacement, but the more I hear it doesn't sound like the two are very comparable.

Thanks.

ACE is an application control module that can provide some firewall functionality.

Some of the pros when compared to FWSM:

- Better scalability overall:

o 4M total bi-dir connections

o 1M total NAT translations, 4M with PAT

o 256K access-list entries

o Single flow of up to 8 Gbps

o High performance inspection engines

- More flexible and powerful inspection of HTTP, SIP (regex)

- Generic Protocol Parsing can make drop decisions

- Role-based access-control + domains for management

- Integrated SSL offload capabilities

- SNMPv3 for management

Here are some of the cons when compared to FWSM:

- no common FW GUI (ASDM or CSM)

- Syslogs for ACLs: Yes for denies, No for permits

- no dynamic routing

- no multicast routing

- no direct asymmetric routing support

- no Syslogs for deep inspection or other packet drops

- Application inspection limited to HTTP, ICMP, DNS, FTP, RTSP, SIP, H323, SCCP, LDAP

- no AAA for the data plane (only for mgmt)

- NAT config not backward compatible with Cisco firewalls

- no DHCP server (DHCP relay is in there, per context)

- no URL filtering using Websense / N2H2

- no time-based ACLs

- no nested object-groups

Hope that helps.

-lloyd

Please rate posts if they are helpful.