Deploying Cisco ASA FirePOWER Services in the Data Center

The Data Center is a one of popular words in network communication. And it can be definited as a very complex world.

The Data Center not only provides a rich set of services and architectures but also hosts the crown jewels of an organization. It is extremely important to maintain visibility of everything that is happening in the data center.

The concept of “north-to-south” and “east-to-west” is often used in describing the types of communication (or flow) within and to the outside of the data center:

• North-to-south describes communication between end users and external entities.
• East-to-west describes communication between entities in the data center.

The following Figure illustrates the concepts of north-to-south and east-to-west communication.

The data center has many different high-throughput and low-latency requirements, in addition to increased high-availability requirements. In addition, automated provisioning and control with orchestration, monitoring, and management tools are crucial.

The data center architecture consists of three primary modular layers with hierarchical interdependencies:

• Data center foundation: This is the primary building block of the data center, on which all other services rely. Regardless of the size of the data center, the foundation must be resilient, scalable, and flexible to support data center services that add value, performance, and reliability. The data center foundation provides the computing necessary to support the applications that process information and the seamless transport between servers, storage, and the end users who access the applications.
• Data center services: These services include infrastructure components to enhance the security of the applications and access to critical data. They also include virtual switching services to extend the network control in a seamless manner from the foundation network into the hypervisor systems on servers to increase control and reduce operational costs (as well as other application resilience services).
• User services: These services include email, order processing, and file sharing or any other applications in the data center that rely on the data center foundation and services, like database applications, modeling, and transaction processing.

The Figure below illustrates some of the components of the data center services architecture.

Examples of the data center service insertion components include the following:

• Firewalls (In the example illustrated in the Figure above, Cisco ASAs with FirePOWER modules are deployed.)
• Intrusion prevention systems (IPS)
• Application delivery features
• Server load balancing
• Network analysis tools (such as NetFlow)
• Virtualized services deployed in a distributed manner along with virtual machines
• Traffic direction with vPath and Nexus 1000v
• Application Centric Infrastructure (ACI) automated framework components for service insertion

In the case of virtualized environments, the Cisco ASAv (virtual machine) can be deployed to protect VM-to-VM communication. The Cisco ASA FirePOWER module in these environments is not supported, as the Cisco ASAv is just a virtual machine. Cisco FirePOWER virtual machines running network AMP can be deployed in those scenarios.

NOTE: The Cisco ASAv supports both traditional tiered data center deployments and the fabric-based deployments of Cisco ACI environments. The Cisco ASAv can also be deployed in cloud environments like Amazon Web Services (AWS).

The Cisco ASA with FirePOWER modules can be deployed in geographically dispersed cluster environments.

The following Figure shows an example in which four Cisco ASAs with FirePOWER modules are deployed in two separate sites (site A and site B).

In the example illustrated in the Figure above, the cluster of four Cisco ASAs is fully extended between the two data centers, using the cluster control links (CCL) operating at Layer 2 with a latency of less than 10 milliseconds. A single spanned EtherChannel for transient data is used on the cluster side. The local data links are also configured with EtherChannels at the switch pairs on each site.

TIP: The data VLANs between the switches are not extended to prevent network loops.

The Article from http://www.ciscopress.com/articles/article.asp?p=2730336&seqNum=12

More Related…

NGFW-Cisco ASA with FirePOWER Services

ASA 5506-X/SecurityPlus, 5506W-X & 5506H-X, Cisco ASA with FirePOWER Services, What’s New Here?

How to Start Cisco Firepower 9300 ASA Security Module?

Find Your Cisco’s Next-Generation Firewalls