I think I get ask what's the better firewall between these 2 vendors at least every month now.
It's a hard question to answer, but I would like to point out just some of the few differences that you should be aware of. This comparison list
is not 100% complete, and is just a few of the highlights that I've found or crossed when designing and deploying security gateways for enterprises and service-providers networks.
1st I would like to say, neither vendors are a slam dunk in all categories, but many differences exists between these 2 platforms. Both of these platform could be very well become a multi-box solution if you need advance security services and to take advantage of UTM features.
======================================================================
The SRX is used in every sector from SME to Enterprise, but is not well received like that of the cisco ASA and the former PIX. You will probably find more cisco ASA products out on the streets, and that's because cisco is better at peddling the ASA, than what juniper is at selling the SRX. But keep in mind, the meer more appliances ( volume ) don't always mean better. I 'm sure there's more Hyundai KIA cars on the streets of NYC than the Mercedes Benz, but that doesn't make the KIA a better car over the Mercedes.
^
PRO cisco ASA widely used & more than SRX in the NA/EU markets more support and more Security Engineers aligned with cisco
The Jweb WebGUI interface is integral, you do not need an "asdm" package software like that of a cisco ASA. The jweb runs okay, but it's not speedy as the cisco asdm and this more evident under the smaller branch series models, (
think a tortoise vrs a rabbit ). I tried to avoid the jweb at all cost, 78-92% of the time I'm in the CLI. This holds true on the cisco ASA, but I don't have any real complaints with ASDM accept it's awkward for me to use.
^
PRO cisco ASDM
Junos works, but some of the basic features somethings ; just don't work, and when they don't work; " it a very bad outcome ". ASA has been slightly better with asa code and it has been a more stable within the codeset from my experiences. JTAC will resolve the issues and identify the problems but you could struggle to get the resolution.
^
PRO cisco ASA for stability in the OS releases
Routing features, the ASA is a few years behind the SRX ( period ). No need to go further in this area. Juniper has shared a lot of the routing features in the SRX & from the M series. The cisco folks are still playing catch-up.
^
PRO juniper SRX for routing and advance L3 unicast/multicast support
Config archival and rollback, hands down a SRX has better diff controls on cfg and retsoral. I really wish cisco would make improvements in this area. Change controls and configuration commits and restores is not very well planned in a cisco or to recovery.
^
PRO juniper SRX cfg management and control points locally within CLI
IPV6 support, more mature, better and much stronger in a SRX
^
PRO juniper SRX IPV6
For WAN interface models or add-on WAN interfaces, hands-down the SRX leads the pack in this area. Your not going to get a E1/T1, ISDN, 3gCelluar or ADSL interface in a cisco ASA, but you can easily do this with a cisco ISR and their security ios codeset.
In fact cisco off-load these lacking features to a cisco router as a quick sell and pitch to the end-user, but they forget to tell you that the router is not going to be as quick or have high thruput as the firewall.
^
PRO juniper SRX WAN availability
For services restarts ( daemons ) the SRX is hands down better. In a ASA, you have very little to no means to restart a services for the most part. If it stops, you need the reboot the appliance to get it rolling again.
^
PRO juniper SRX services managements start and kill
The https/ssh allow-access is much easier to deploy in in a cisco ASA. Also the SRX is complicated with simple services enabling from dhcp to ipv6 neighbor-discovery and the various filter. When local source features and functions don't work, 9 out of 10 times it's due to the service filter.
^
PRO cisco ASA for management access configuration
The SRX has higher port density than a ASA, in fact you have more ports and more 10gige ports than the top-end cisco ASA. I believe the SRX was the 1st to offer 40gige and 100gige interfaces iirc. This is not even on the grid or radar for our cisco ASA. Both the 40 & 100gige interfaces are foreign words for the cisco ASA lineup ;)
^
PRO juniper SRX for higher thruput and faster interfaces
The SRX allows you access to a limited shell. here you can do captures, execute scripts, and do stuff that you can do from the simple unix sysadmin approach. For the cisco ASA ... this is not going to happen.
^
PRO juniper SRX for the shell access
Software code upgrades or download.....The ASA is a breeze in this area. The juniper requires more thought and preparations when doing systems upgrades.
^
PRO ciscoASA for code deployment ( simple , sweet ,and to the spot )
For the SRX SNAT, much easier to manipulate. Cisco requires a PhD to just about NAT any thing outside of a 1-to-Many ;)
^
PRO juniper SRX NAT'ing
Firewall HA clustering is very straight forward in the cisco ASA and you need a PhD to figure it out in a SRX ;). Doing a ISSU is simpler and let's of an issues in a cisco ASA. I always recommend opening a JTAC case, and get a 2nd opinions on your maintenace-operation-plan for any upgrades when you have a clustered pair.
^
PRO cisco failover creation and management
Integration into a l2/l3switch, will the cisco ASA has a firewall blade. But be careful and review what features are NOT available on the blade.
^
PRO cisco integration for existing multislot chassis
The Cisco software virtual firewall has been out ahead of juniper Firefly, but one key plus here is that the juniper version has support for KVM, where cisco is all VMware. If you have access to Junos software you can still get a 60day eval image for testing.
^
PRO juniper SRX firefly
UTM features like Anti-Spam exists in a SRX but requires a license and is not available across all models. I believe that cisco ASA NGFW still don't have am on appliance AS/AV UTM feature. Most of any UTM features in a cisco ASA 5558-X will be external or a cloud based solution & at some extra-license and cost.
Application visibility is a big weak spot in the cisco ASA, where-as Juniper AppSecure is available but not refined as let's say PaloAlto or Fortinets , but it works and can be buggy in earlier JunOS codes. Also Juniper AppSecure is for a higher end model SRX and is not available across all platforms. Cisco has recently bought and now includes FirePower, but little information and use can be found about it's accuracy in application visibility.
^
PRO juniper SRX for application awareness but still is not a single-box solution , & neither is the cisco ASA
Layer3 and 4 attack mitigation is slightly better with Juniper "Screens" in the SRX. At least the concept and controls are better.
The Cisco ASA will probably need a few ACL and service policys or other methods. Everything in a SRX is "security screen" single line configuration item.
^
PRO juniper SRX for simple L3/4 flooding and L3/4 based attacks
GRE tunneling support is available in a SRX and not even an options in a ASA.
^
PRO juniper SRX for ad-hoc GRE tunnels or other tunneling-support
Multiple VirtualRouter instances is probably better designed within the SRX than the ASA 's multi-context. You don't need to reboot the firewall when deploying VRinstances as what you need to do when converting from single context to multi-context or back in a ASA.
^
PRO for juniper on multiple instances support, design and exchange of information between instances
Cisco TAC and Juniper JTAC have both declined in the past 5 years or so.Cisco still has a better RMA process for relacement and delivery. Juniper has gotten better with Kb knowledge. It's still hit & miss on each person feedback and experience with working with these 2 outfits, but cisco has a slight edge.
^
PRO cisco
For SSLvpn
, we have the availability in the cisco ASA for ipv4/v6 sslvpns, but still the SRX has no means for SSL based vpns. For Juniper, you will need a SecureAccess appliance or a MAG, which is yet another box.
^
PRO for cisco ASA on webvpn availabilities integral to the appliance
Speaking of SSLVPN, the Juniper SA/MAG is a cheaper solution for SSLVPN users. The average cost for example with a SA2500 vrs the basic 100 cisco-ASA-webvpn license will place the Juniper SA/MAG appliance cheaper per sslvpn-users.
^
PRO juniper per sslvpn seat cost
======================================================================
Okay that's a wrap on my SRX vrs ASA comparison. Keep in mind, they both offer great firewall in the security realm & the sectors they serve. To be fair, don't try to think of "
which one is better", but look at what's your need and them decide after doing a 1-to -1 comparison and cost analysis.
With these appliances, you have understand that the Juniper SRX is a zone-based firewall & where the cisco ASA is a ACL based filter firewall. They do the same thing, but the concepts are very different. There's pro/cons within these 2 strategies but that another thread and only become a factor when you have dozens+ of interfaces or more.
lastly, I hate the cisco/juniper shops that only expect one vendor to be present from switching/routing./firewall/others services. Some of the best networks that I ever worked and consulted for, where a mix of everything from A to Z.
Ken Felix
Freelance Network/Security Engineer Mail Security Specialist
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( % $ )=
@
/ \
