Cisco Sourcefire SNORT Reviews

I work directly with clients, such as financial companies like banks, for example. Most of the time they want they're product to be on their premises, only in their local area.

In general, the features are all great. However, if I need to take hardware for ASA because they need to upgrade to Firepower, we want to create rules. For that, most of the time we go to the command line. Right now Firepower is working really hard on the grid. You can apply all those rules to the grid. Even if you want to monitor the logs, for example, the activity will tell you which particular user has been blocked because of that rule. Firepower's monitoring interface is very good because you can see each and every piece. ASA also had it, but there you needed to type the command and be under the server to see all that stuff. In Firepower, you have the possibility to go directly to the firewall. The way the monitoring is displayed is also very nice. The feature I appreciate most in Firepower is actually the grid. The grid has worked very well. 

The functionality they have deployed is also very good. They provide the possibility to have one manager for other firewalls, which is Firepower Management Center. I can manage many other firewalls from Firepower Management Center, by just logging on to the other device. That feature is also very great. 

The idea that they implement the malware protection inside the firewall is another great feature. This has the same features and functionality as they had for the IPS device. The way they deploy the AMP is also great because from there we can even go to the packet level, both to the header of the packet, as well as inside the packet, to see if there is any virus there. Right now, the firewall has the possibility to pick up inspection, not only on the header of the packet but off the packet itself. That feature is very great.

There are a lot of features that I really appreciate with Firepower, which is why I advise most of my customers to go with Firepower.

To be frank, the product is not really stable, although they're working on that. Whenever I go to the technical community with an issue, they will usually say that it is not there yet, but the technical team is working on it. The issues are not insolvable. I think they should just keep working on the product to make sure that the product can become very stable. The technical support is great. I appreciate that. We have a lot of communities supporting Firepower now, so you can find help for whatever issue you have.

Another issue where there's room for improvement is that sometimes I feel like the device is heavy. For example, we can use either the physical or virtual device. Most of the time if you are using the virtual device, you need to have very good RAM. If, for example, we don't have a good RAM in the environment, the device will be kind of heavy. It will not run as quick as you want. Most of the time we need a  minimum of 4GB of RAM. Maybe they should add the possibility that we could use 2GB of RAM so that the device can be more lightweight.

Those are all small things, but if they can improve them it would be great. Of course, everything is dependent on the process running behind it. I don't know if they have the possibility to make these changes, but if they can, it would be great.

I've been using this solution for almost two years.

When I have an issue I usually go to the community. Most of the time I'll find the solution there. Right now, I don't have any open cases with Cisco, so I don't know if they're able to respond on time. For their other products like Fusion, I have an open case with their technical support team that I'm waiting for them to respond to. For Firepower, however, I don't have any issue that would lead me up to open up a case.

For my experience, technical support is okay. I never had the kind of issue that technical support could not resolve because I would just go to the community. The technical community is very good for me so far.

For me, it was straightforward, maybe because I'm used to it. 

The first step is to install Linux because the product is based on Linux OS. Then, I just install the Firewall Management Center. After installing that, I install the full Firepower Firewall. From there, I would make sure that the Firewall Management Center and Firepower can ping each other, that they have connectivity. If that works, then I would add all the IPs of Firepower to the Firepower Management Center. Once that is finished, the whole installation is done, and I can try to call the Firepower Firewall directly to the grid from within Firepower Management Center.

I think the installation is okay. It is easy for me.

Deployment time varies from customer to customer. It depends on what things they want to deploy.

I would recommend this solution and give it a rating of seven out of ten. That is mainly because of the expense. I don't know the exact amount, but most of the time when I go to a company with a proposition, they will say, "This thing that you are selling is good, but it's expensive. Why don't you propose something like FortiGate, Check Point, or Palo Alto?" Cisco devices are expensive compared to other devices. If not for that, I would rate it as nine out of ten. Because of the expense, I prefer to give it seven. Most of the time when I lose an offer from this product, it's only because of the expense. It is not because of the technical work that the product can do, just the cost of the device. That is the only reason the customer would not go for it directly.

The solution has improved our organization in terms of management. We don't need to have too many resources when it comes to managing it, unlike previously, when we had the IPS. It was a nightmare trying to download the signatures, and uploading them, was also a nightmare. This solution makes life a lot easier. There's fewer man-hours required.

The solution is rather easy to use. 

The signatures are uploaded and there's a set of recommended ones that we are using, which makes a lot easier than having to configure individual signatures together.

While the alerts they offer are good, it could improve it in the sense that they should be more detailed to make the alerts more useful to us in general. Sometimes the solution will offer up false positives. Due to the fact that the alerts aren't detailed, we have to go dig around to see why is it being blocked. The solution would be infinitely better if there was just a bit more detail in the alert information and logging we receive.

I've been working with the solution for a long time. It's been about five to six years at this point.

There are no bugs or glitches. The solution doesn't freeze. It doesn't crash. It's reliable. It's very stable.

In terms of scalability, I've not really had to look into it due to the fact that the devices we have are accurate for our purposes. I can't really say a lot about scalability because I've not had to. I'm sure they have got configurations where you can maybe put two or three together to scale it up if you need to.

We've only reached out to technical support once when we had to do an upgrade. The team at Cisco was very helpful. They were responsive and knowledgable. We were quite happy with the level of service we were provided.

The initial setup was not complex at all. It was very straightforward. We were able to handle it easily.

Deployment, in total, took about a week.

We're just an end-user of the service. We don't have a business relationship with Cisco.

The hardware we're using is still old. We bought it when the product was not under Cisco. That said, obviously, Cisco has now updated the product with new hardware. However, we've still got the old hardware. 

I would advise other organizations to go ahead and try the solution out. It's a good product. It's very straightforward and easy to implement especially when you compare it to other systems.

I'd rate the solution eight out of ten overall. If they offered better and more detailed alerts, I would rank them higher.

It has a huge rate of protection. It has a low level of positives and a huge rate of threat protection. It's easy to deploy and easy to implement. It has an incredible price rate compared to similar solutions. It has a good support channel, technical assistance. It's good. 

It's really good to sell as far as a Cisco firewall. It's really good to sell in the complex Cisco project because Cisco's really good for networking and routing. When we are networking, it's easier to sell a security-based firewall. It's a complex product. It's really good. There is syndication between different security products, and in Cisco's case, it's with integration.

Performance needs improvement. If you compare Cisco Sourcefire with other products, it performs at the same level of compliance. For Cisco Sourcefire, it's not really horrible and it's not really the market and price-performance rate. The performance can be improved. 

We have been using Sourcefire since 2011.

It's scalable. Sourcefire has a classic deployment model and you can scale up through the appliance if you need the same deployment so it's quite simple. It's quite scalable. We mostly work with mid-sized companies. 

Sourcefire Snort is the kind of software that is constantly running like 24/7,

In general, Cisco provides really good and reliable support. Overall it's good but sometimes, around 1% of the time, it doesn't work so well. 

We also use IBM and Palo Alto and from the technical perspective, it's probably equal. It's equal by the features, by the functionality, by the performance. But again, for the pricing, it's really bumpy.  For Palo Alto for example, the pricing is almost equal. But for the performance and the features, they are on the next level.

It is easy to setup. For a basic deployment, it can take up to three or four days to deploy in a minimal setup. If it's a huge project with a huge data center, a lot of configuration, a lot of work, and a lot of integration, it will take two or three weeks up to one month. 

You only need one person for a basic deployment. 

Make sure to have good sizing because it matters for the performance of the features. Also make sure to have a good design. Before starting with the deployment and installation for Sourcefire. Have a technical session with the local Cisco office or the local department to provide a good design. 

I would rate it an eight out of ten. 

We have some architecture concerns. I'm not really sure that Cisco can quickly solve this concern. Palo Alto has a user-friendly interface for the management. 

Our primary uses for this solution are URL filtering and malware filtering.

Sourcefire SNORT has been good for us.

The most valuable feature is reliability. This solution is better than Check Point.

The URL filtering is very good and you can create a group for customized URLs. 

Cisco SNORT is easy to manage.

There are problems setting up VPNs for some regions. There are cases where they are permitted in Sourcefire but blocked in Check Point. 

There are some outside ports that are allowed by default but should not be.

It would be helpful if a list of third-party services were listed so that the rules could be easily added. An example of this would be a ticket booking site. It would be in a list of services and selecting it would allow transactions with that site.

I have been working with Sourcefire SNORT for six months.

There are some bugs in this solution and troubleshooting them is complicated.

The scalability of this solution is good.

The technical support is good and is better than Check Point.

We are also using Check Point but it does not work as well as Sourcefire SNORT, which is why we are switching. For example, customized URLs do not work in Check Point. Check Point is also more complex.

The initial setup is straightforward.

This is a good solution and one that I would recommend to others.

I would rate this solution an eight out of ten.

The primary use of this solution is intrusion prevention, for both user-to-server traffic, and server-to-server traffic.

Most of our environment is Cisco including ISE, our access control, routers, switches, call center, and TelePresence.

The current solution that we are using is actually a bottleneck for us. It is negatively impacting our performance because it cannot handle our traffic. The SSL offloading did not work and gives us an error regarding resources in terms of memory and CPU. 

Other than the performance issue, this product is very good because it prevents many attacks and intrusions. We have seen this from the monitoring logs. Unfortunately, with the issue related to the system slowing down, it cannot be utilized 100%. I would like to be able to use the SSL offloading and the anti-malware features.

The most valuable feature is the ability to automatically learn the traffic in our environment, and change the merit recommendations based on that. It can tune its IPS rules automatically based on what it has learned. This feature is not available in other IPS solutions, so it is very beneficial for us. Manually tuning the IPS rules is difficult because we have thousands of them.

We are unhappy with technical support for this solution, and it is not as professional as what we typically expect from Cisco.

Sourcefire SNORT is very resource heavy in terms of CPU usage and memory consumption. Technical support has told us that this is related to bugs that have yet to be fixed.

We have been using Cisco Sourcefire SNORT for three years.

What we are using now is not very stable and it results in performance issues that are related to memory and CPU consumption.

Scalability-wise, I can see that Cisco is one of the leaders in IPS solutions. However, I cannot comment on it personally because I have not used products by other vendors for this use case.

We have many thousands of machines that are being monitoring by my team, cybersecurity. All of the production traffic goes through Sourcefire. Because of the performance issues, we are unable to use all of the features. For example, we cannot use the SSL policy or the AMP policy.

We did use another product prior to Cisco Sourcefire SNORT but it was before I joined the company and I am unable to comment on it.

The initial setup is straightforward and the configuration is easy.

We implemented this solution in stages because it could not be done all at once.  It took us perhaps just over a month to finish moving all of our servers from IDS to IPS, from detection to prevention.

Our own team was responsible for the implementation. I handled all of it myself.

A lot of Cisco equipment is very good, but in judging the model of this solution that we have, I feel that it is the worst. It has very big issues for us in terms of performance, reliability, and stability. It is slowing our network traffic down considerably.

I would rate this solution a one out of ten.

Our primary use case of this solution is as a firewall, as an access control. We don't use it as access detection or as an intrusion prevention system, because we didn't configure it as a detector.

I like most of Cisco's features, like malware detection and URL filtering.

I don't think this solution is a time-based control system, because one cannot filter traffic based on time. 

I have you been using this solution for about two years now.

Sometimes it has an object priority, like priority for users. Sometimes the cloud agent and the host device for the center, fails to update or to cache the objects from the cloud.

The solution is scalable and I think it can be integrated with some Cisco devices and other third party devices.

If you compare it to other vendors, the technical support from Cisco is excellent. 

The initial setup is quite complex and some set parameters are definitely needed. However, the more you try it, the easier it gets. When we push a specific policy, it takes from two minutes up to five minutes to deploy. So it depends on the deployment configuration. For the general deployment, it depends on the expert. 

The main problem we have when we implement security policies for our customers is scheduling. For example, customers want to take up with a time-based security policy, so that we have a different setup for working hours and non-working hours, and for weekends. But that feature is not supported by Cisco Sourcefire. So, I think it would be very good if Cisco can implement this scheduling feature.

What's more, some of the configurations are a little bit complex, like the mapping.  It's very difficult to rotate their VPN when you set up the access points. You must bypass those access points by using the VPN portal bypass. I think it will be very good if they can set up a tool that one can use to stop this VPN portal. It is very hazardous for security because the users of that VPN portal are visible and it's very risky for them, because they are bypassing the access points of the company.

On a scale from one to 10, I will rate this solution an eight. 

We are a system integrator and this is one of the solutions that we provide to our customers.

This solution is for inspecting traffic. It works with the firewall, email, etc.

This is for an on-premises deployment.

This is a solution that we trust for protection.

The most valuable feature of this solution is the filtering.

It does well for eliminating email spam.

The GUI is user-friendly.

The price of this solution could be improved. If the price is brought down then everybody will be happy.

I would like to see a cloud-based version of this solution.

This is a stable solution.

Scalability is something that Cisco has always cared about. There is no problem with it. For example, if you have one branch and you want to expand to two or three then it will work without any problems.

The technical support is very good. I deal with several Cisco departments, and they have a good team. The team around the world is large and their support is very good.

We had a customer who had a problem with their server, and Cisco sent an entirely new one as a replacement. 

The initial setup of this solution is a little bit complex compared to other solutions.

The average deployment takes approximately half a day. It depends on the environment. If we are connecting braches versus only connecting the head office, the length of time to deploy can change.

Licensing for this solution is paid on a yearly basis.

This solution has improved a lot in the past few years.

I would rate this solution an eight out of ten.

The main features of the Cisco Sourcefire are that it's a next-generation firewall with new features. It has application security, advanced malware protection, URL filterings, encryption, and decryption.

It is also used for email filtration and web application cyber protection.

The deployment model we used was on-premises.

This solution has improved our security level for our organization. It's a more intellectual system with many features that can help us with decryption. 

At this time, we have more than eighty-six percent of the traffic is SSL. We must decrypt this, and these devices provide us with tools for encrypted traffic inspection.

 It's user-friendly for engineers and works well for configuration and debugging.

The solution can be integrated with some network electors like Cisco Stealthwatch, Cisco ISE, and Active Directory to provide the client with authentication certificates.

This is a good solution, but some others may have some advantages. For example, Palo Alto has more useful and suitable application abilities. This solution has a better Firepower but the functionalities are not as good.

With the next release, I would like to see some PBR, so that you can do the configuration with the features.

This solution is stable if we talk about boxes, and usually, it is a strong system, but with some software versions, we have had some trouble. I think that it depends on the manufacturers. 

This solution is scalable and reliable.

You can use it in a cluster for one PC or a cluster for two different data centers.

The support is good.

For customers, there are many features and we try to resolve as many issues as we can, but we only have access to some of the core elements. They can only be resolved by contacting technical support.

The initial setup and configuration are easy.

You can create panels with deeper functionalities, but you need a bit more experience with the technology. 

Providing videos and materials are useful, but really what you need is the experience in analyzing logs. Without that, you wouldn't be able to problem-solve on your own, even with the assistance of videos.

I would recommend this solution. It's reliable and scalable, with easy installation and integration.

I would rate this solution an eight out of ten.