Security · NGFW
Size a Cisco Secure Firewall (Firepower) by real throughput with TLS inspection, NGIPS, and VPN — then pick FMC vs cdFMC for management.
Firepower datasheet numbers are best-case with minimal features. Turn on Snort with full rules, TLS 1.3 decryption, and URL filtering — and throughput can drop by 60%. This tool applies real derate factors and returns a model that won't crush at peak.
Output returns a recommended FTD model with effective throughput under your feature mix. "Effective" accounts for: Snort derate (~30-40% hit), TLS decryption (~50-70% hit on TLS portion), URL filtering (~10%). If your peak exceeds the effective number, size up.
Snort 3 is faster than Snort 2 but still the main CPU sink. Balanced ruleset runs hot on older 2100-series. Connectivity-over-Security is a sensible middle ground for internal/DMZ. TLS inspection is where most sizings go wrong — full decryption on 1 Gbps of TLS is real work, especially with TLS 1.3 ECH.
Management: FMC on-prem supports 4-750 devices per appliance. Cloud-Delivered FMC (cdFMC) is smoother for new deployments but check your data residency constraints.
For effective malware and data-loss protection — yes. But it's operationally expensive. Start with outbound partial (exclude healthcare/financial/user categories).
New deployments: FTD. ASA software is maintained but gets no new features. Mixed ASA/FTD fine on the same hardware family.
Recommended: 2× FPR 3110 (effective ~4-5 Gbps each with derate). FMC 2600 or cdFMC for management.
Recommended: 4-node FPR 4215 cluster. Each node ~15 Gbps effective, cluster ~55 Gbps aggregate with HA.