Cisco ASA vs Juniper SRX

[scottrad666]

Hi All

Not sure if this is the correct forum for this thread....

I am working for a consultancy firm and we are under increasing pressure from various customers to use Juniper SRX's in place of Cisco ASA equivalent due to cost. The ASA is a great product, and I enjoy working on them far more than the SRX, but it's over twice the cost once licensing is factored in than the SRX.

Just wondering how other members of the community are dealing with this situation, and if Cisco will compete head to head with Juniper on price and features. (or will I have to dust off the books and get the JNCIE cert, boooo!)

Regards

Andrew Radford

CCIE 16499

[jesse.fields]

Unless I am missing something, I don't think the FWSM is a good long-term investment based on this: 

http://www.cisco.com/en/US/prod/collateral/modules/ps2706/eol_c51-699134.html

No VPN capabilities and routing is limited.  They do provide basic firewall features very well in places where a large number of interfaces and/or contexts are needed. 

I am looking to deploy the SRX3600 in a datacenter environment over the ASA-5585 series.  The price, scale and flexibility is hard to pass up.  I agree Cisco TAC is awesome in most cases, but awesome support on a device that doesn't meet my needs isn't really that awesome in this case. 

[johng231]

We want to place the DC firewall at our core layer (Nexus 7K) to separate users/WAN traffic from servers. There is no FWSM yet for the Nexus that I'm aware of and if there was, I wouldn't use it. That's assuming all of your routing is happening at the core for each of your environments.

Also, the ASA can't perform BGP routing. We're debating running BGP vs OSPF in the core. Right now we're using EIGRP as our IGP. If we go Juniper SRX, it would be either BGP or OSPF. Can the ASA run full OSPF routing  at your core layer? If so, is anyone using dynamic routing on the ASA? I never seen any marketing docs on Cisco that show ASA doing full OSPF routing with x number of supported routes.

[Ramraj Sivagnanam Sivajanam]

Hi Bro

As you know, Cisco ASA can run OSPF, but the OSPF features are not as widespread, compared to those Cisco IOS equipment. For example, the Cisco ASA doesn’t support more than one OSPF routing process.

However, you must realize that Cisco ASA wasn’t built to do extensive routing, as its’ primary role. Cisco ASA was built to do far-reaching Firewalling, IPS and VPN (with the inclusion of the SSM modules). Even though the OSPF features are there in a Cisco ASA, but I’m sure Cisco will not position Cisco ASA as a total routing product, if you know what I mean :-)

P/S: If you think this comment was helpful, please do rate it nicely :-)

[tsubakaran]

Most important point - SRX/JunOS, well structured cli language that is missing in the ASA cli.
commit confirm - great feature for the short time commitment feature that is not available in ASA firewalls.
show | compare - easy to understand, what you add/remove in the cli - not at all in the ASA, changes going to running config ASA.
ASA5506 - you can't setup and use few ports in a vlan to act like a switch , it is still available in SRX firewalls.
I love Cisco, .. but srx was very impressive when configuring.

[walleed222]

I want to add to this nice discussion one advantage to ASA over SRX and one for SRX over ASA :

• actually SRX GUI is very slow ,juniper has GUI problems before on SSG and look like it is same with SRX , ASA ASDM is very nice and stable and have nice logging and tracking options
• ASA still not supporting IPsec VPN over virtual interfaces and GRE also , and those tow features are supported on SRX