Introduction
Data centers are evolving rapidly, driven by the need for businesses to accelerate operations and capture new opportunities. IT professionals face challenges in scaling networks for workload mobility and meeting operational service level agreements. This document provides guidance for enterprises seeking to implement a robust security architecture using Cisco ASA Clustering with FirePOWER Services to address advanced data security threats.
The solution integrates key technologies and architectures to provide application awareness within the data center fabric and network services. It offers simplified operations, increased high availability, data loss protection, enterprise-wide consistent policies, enhanced security, flexible scalability, efficient resource utilization, and advanced threat mitigation capabilities.
This guide focuses on the Cisco Secure Data Center for the Enterprise portfolio, building upon foundational concepts and previous guides for a comprehensive approach to securing physical and virtualized workloads.
About the Authors
This document was authored by experts at Cisco Systems, Inc., including Tom Hogue, Bart McGlothin, Matt Kaneko, and Mike Storm, who bring extensive experience in data center security, network architecture, and threat management.
Key Features of ASA Clustering with FirePOWER Services
- Simplified operations
- Increased high availability
- Data loss protections
- Enterprise-wide consistent policies
- Enhanced security throughout the fabric
- Flexible scalability
- Efficient use of fabric resources
- Signature- and reputation-based protections
- Behavioral analysis for threat mitigation and remedy
Solution Design Considerations
The solution is based on three key design principles: Provisioning, Performance, and Protection. It leverages integrated platforms for automation and management, including Cisco Security Manager, FireSIGHT Management Center, Cisco UCS Director, and Cisco Identity Services Engine (ISE).
Performance is enhanced through Cisco ASA 5585-X Firewall Clustering, which provides significant throughput and handles asymmetric traffic flows efficiently. Fabric integration relies on virtual port channels (vPCs) for reliable connectivity and enhanced bandwidth utilization.
Validated Components
The document details validated components, including the Cisco ASA 5585-X Adaptive Security Appliance, Cisco FirePOWER Service Module, and Cisco Nexus 7000 Series switches, along with their respective hardware and software versions.
Further Information
For additional content and resources, visit the Cisco Design Zone at http://www.cisco.com/go/designzone.
