Вы находитесь на странице: 1из 2


For many years, the Cisco PIX has been the established Cisco firewall. But in May 2005,
Cisco introduced a new offering—the Adaptive Security Appliance (ASA). However, the
PIX are still available. Many People think of the differences between these two product
lines. Let's take a look.

What is a Cisco PIX?

A Cisco PIX is a dedicated hardware firewall appliance. All Cisco PIX versions have
model numbers in the 500s. The most popular model for home offices and small networks
is the PIX 501; many midsize companies use the PIX 515 as a corporate firewall.

PIX firewalls run the PIX operating system. While the PIX OS is quite similar to the
Cisco IOS, there are enough differences to cause some frustration for users more familiar
with IOS.

The firewall sports the PIX Device Manager (PDM) for a graphical interface. This GUI is
a Java application downloaded through a Web browser.

Typically, a PIX firewall has an outside interface that connects to the inside of an Internet
router and goes to the public Internet. It also has an inside interface that connects to a
LAN switch, going to the private internal network.

What is a Cisco ASA?

A Cisco ASA is a new firewall and anti-malware security appliance from Cisco Systems.
(Don't confuse this product with what a PIX uses for stateful packet filtering—the
adaptive security algorithm, or ASA.)

ASA models are all in the 5500 series. The Enterprise Editions include four versions:
Firewall, IPS, Anti-X, and VPN. There's also a Business Edition for small to midsize

In total, there are five models of the Cisco ASA. All run the ASA version 7.2.2 software,
and the interface is much like the Cisco PIX. Both the Cisco PIX and ASA models vary in
performance, but the ASA's lowest model offers much more performance than the base

Like the PIX, the ASA can also serve as an intrusion prevention system (IPS) and VPN
concentrator. In fact, the ASA could take the place of three separate devices—a Cisco
PIX firewall, a Cisco VPN 3000 Series Concentrator, and a Cisco IPS 4000 Series

Now that we've covered the basics of each security appliance, let's see how they compare.


While the PIX are an excellent firewall, the landscape of security has changed over the
years. It's no longer sufficient to protect your network with a stateful packet filtering
firewall. There are so many new threats to a network—including viruses, worms,
unwanted applications (e.g., P2P, games, instant messaging), phishing, and application-
layer attacks.

When a device does protect against this variety of threats, we say it offers "anti-X"
capability or "multi-threat" protection. But the PIX just hasn’t been able to offer this level
of protection.

Most organizations don't want to have PIX performing stateful firewall filtering and some
other appliance protecting you from other threats. Instead, they want an "all-in-one"
device—or a unified threat management (UTM) device.

The ASA does offer protection from these different types of attacks. It can even be more
of a UTM device—however; it needs a Content Security and Control Security Service
Module (CSC-SSM) to be a real UTM. This is the module in an ASA that performs the
anti-X functions. Without the CSC-SSM, the ASA functions more like a PIX.

So which one is right for your organization? As always, the answer lies with your
organization's unique needs. However, anyone would choose the ASA over the PIX any
day. First of all, an ASA typically costs less than a similar featured PIX. Besides the cost
incentive, it just seems like a logical choice to choose the newer and faster technology.

For those who already use the Cisco PIX, Cisco has produced a Migration Guide (PDF)
that addresses how to migrate from a Cisco PIX to an ASA. In my opinion, this offering
foreshadows Cisco's impending discontinuation of the PIX. While the company has made
no announcements to this effect, I think it's only a matter of time.

Remember, we can no longer rely solely on a firewall to protect our organizations from
the varied threats of the Internet; a multifaceted approach is now necessary for complete
protection. While the ASA is a good choice, it isn't your only option. Many vendors offer
products to compare the ASA against before making that choice.

For more similar posts visit http://networksecurity.weebly.com/