10 big differences between the Cisco ASA and the Fortinet Fortigate

In this post we will go over some of the difference between these 2 models of firewalls.

The cisco ASA and Fortinet Fortigate


1st  The licensing model 

ASA:
Cisco has a whole gamlet of licensing that can be applied, and it can be quite confusing

Licensing is not additve ( e.g if you have 25 vpn peers and want  25 more, you have to buy a 50 vpn peer license  and can't buy a 25 peer license )

fortinet:
only has 1 or 2 license  types ( vdom and forticlients )


2: blackhole routes

ASA:
You can't do this on a ASA.   Typically one relies on the next-hop device , or just ACL'ing off  the traffic

fortigate:
Supports blackhole routes via  null-interface

3 :Cisco Context vrs Fortigate VDOM

ASA:

• Cisco contexts are very restrictive, typically you are limited to  3-4 contexts ( except a ASA5505 no contexts available )  

• Context in ASA don't support any remote-access vpn, and until recently no dynamic routing protocols. And then in multi context mode, your limited to just OSPF or EIGRP only (ipv4) and no dynamic routing protocols for ipv6

• Also the context configuration files management, is awkward and confusing,  the first time that you deploy the configurations files

•  Just the pure enabling of  the multi mode context  feature,  requires a reboot

fortigate:

• Supports a minimum of 10 vdom ( virtual domains )

• Vdom supports all open routing protocols  ( rip,ospf,bgp,is-is) , and not as restrictive. 

• No reboot required for enabling vdoms

• by default all interfaces are part of the vdom root, so enabling  vdom support does not drop any interfaces/policies or configurations if your going from a vdom-less to vdom-concept

• one big configuration file, with no separations for the unique vdoms

4: IPv6 support

  ASA: 
  getting better, but ipv6 support is still quite new  in the ASA lineup


  fortigate: 
  been ipv6 enabled for at least 6+ years now, but we still don't have OSPFv3 authentication :(

5: Fwpolicies

ASA: 
Uses  a ACL approach for the ingress/egress interface and no other direction is requires
Cisco also eliminates duplicate  by disallowing the entry of  duplicate acl lines within a single access-list

fortigate:
Policies are built between zones to zone or interface to interface similar to juniper. Duplicates can be installed with no warning, causing issues when auditing policies


6: Intrusion detection

ASA:

• Supports for custom rules, but not very user friendly

• auto-updates are not as easy to allow

• limited number of rules

• requires some IDS engine or card and managed separately & possible license restrictions

fortigate:

• support for custom rules

• auto-updates pretty much every day

• IDS protection is part of the appliance hardware ( no add-on card/module, no special licensing or restrictions )

• Fortinet fortiguard is quite awesome and very mature and advance

7: remote-managemnt

Both unit allows for common management protocols with the fortinet allowing you to changing ssh/telnet ports and restricting access to a user. It also has a fail-login delay block, to protect from brute-force or mis-used from failed logins

8: flow data exportation

ASA:
netflow v9 , but it's not similar to netflow v9 that most  routers exports, could cause issues with certain collectors

fortigate:
sflow only ( no netflow support )


9: VPN restrictions

ASA:  
Numerous license models, this  limits the number of peers regardless of type;  clientless vrs client sslvpn , ipsec,l2tp-ipsec

fortigate: 
VPN numbers are limited only by the hardware chassis make


10: Traffic Inspection & processing

ASA:
Only traffic moving from a  lower to higher security-level , needs an acl entry ( security-level concept )

fortigate:

All traffic passing between interfaces on a fortigate, needs a fwpolicy.

Ken Felix

Freelance Network / Security Engineer

kfelix  ----a---t---socpuppets ---d---o---t---com

     ^      ^

=(  @   @ )=

          o

       /     \