In short: Cisco Secure Firewall Threat Defense Virtual (FTDv) is the virtual machine edition of Threat Defense for private cloud hypervisors and public clouds such as AWS, Azure, Google Cloud and Oracle Cloud. It is licensed by subscription in performance tiers, supports auto-scale in those four clouds, and is managed like hardware firewalls. ASA virtual is the ASA equivalent.
What is Threat Defense Virtual?
Threat Defense Virtual (FTDv), which Cisco's pages also present as Cisco Firewall for Private Cloud, is the Secure Firewall Threat Defense image packaged as a virtual machine. It brings the same Snort 3 IPS, application control, URL filtering, malware defence, VPN and encrypted traffic visibility (including TLS 1.3, without decryption) to virtual data centres and cloud networks, with Talos intelligence and the same policies you use on hardware.
ASA virtual does the same for ASA software, and is often used as a cloud VPN headend or a like-for-like replacement for an existing ASA.
Where it runs
| Environment | Threat Defense Virtual | ASA virtual |
|---|---|---|
| Private cloud | VMware vSphere/ESXi, KVM, Microsoft Hyper-V, Nutanix, OpenStack and Cisco HyperFlex | VMware, KVM, Hyper-V, Nutanix and OpenStack |
| Public cloud | AWS, Microsoft Azure, Google Cloud, Oracle Cloud, Alibaba Cloud, plus the Megaport and Equinix network platforms | AWS, Microsoft Azure, Google Cloud, Oracle Cloud and Alibaba Cloud |
| Containers | A separate Threat Defense container edition (Cisco Firewall for Container) runs on Docker and Kubernetes, and on Amazon EKS in public cloud | No |
Platform support varies by software version and by manager (Device Manager supports fewer platforms than Management Center), so we check Cisco's compatibility guide for your exact combination.
Licensing: tiers, BYOL and marketplace
- Performance tiers: Threat Defense Virtual licences come in tiers that set a throughput limit and a remote access VPN session limit, up to an unlimited tier. Any tier can be used with any supported virtual CPU and memory configuration, which you size separately, and both units of a high-availability pair need matching licences.
- Subscription licensing: unlike most hardware, even the Essentials base licence is a term subscription on Threat Defense Virtual, with IPS, Malware Defense and URL Filtering added as needed (see Secure Firewall licensing)
- Bring your own licence (BYOL) through Cisco Smart Licensing is available on all the supported public and private cloud platforms
- Pay as you go through the cloud marketplace is offered only on AWS and Azure
Remote access users also need Secure Client licences. For a costed comparison of BYOL and marketplace options, ask us for a quote.
Auto-scale, deployment and management
In AWS, Azure, Google Cloud and Oracle Cloud, Threat Defense Virtual can be deployed in auto-scale groups, so capacity follows demand. Cisco's data sheet lists no auto-scale support on Alibaba Cloud, Megaport or Equinix.
Manage virtual firewalls with an on-premises or cloud-delivered Management Center (including through Security Cloud Control), or with Device Manager for a single instance. Platform support differs slightly between managers, so check the compatibility guide for your combination.
One upgrade point matters for virtual estates: from version 10, Threat Defense Virtual supports Secure Boot and UEFI, and a virtual firewall upgraded to version 10 cannot be reverted to 7.7 or earlier. Cisco recommends deploying fresh version 10 instances and migrating the configuration, which we plan into any upgrade.
Threat Defense Virtual or Multicloud Defense?
Cisco now lists Cisco Multicloud Defense as its firewall for public cloud. The two overlap, so here is how we decide:
| Threat Defense Virtual | Multicloud Defense | |
|---|---|---|
| Model | A firewall VM you deploy and size | A SaaS control plane that deploys and manages cloud security gateways for you |
| Best for | Lift-and-shift networks, VPN headends, consistency with on-premises Threat Defense | Cloud-native estates across several clouds with ingress, egress and east-west policy |
| Automation | Templates and APIs | Infrastructure as code and real-time asset discovery |
| Management | Management Center or Device Manager | Security Cloud Control |
Both fit inside Cisco's Hybrid Mesh Firewall approach, licensed through the Cloud Protection Suite where that makes sense.
How we help
We design and deploy Threat Defense Virtual and ASA virtual in VMware, Hyper-V and Nutanix estates and in AWS, Azure and Google Cloud, including high availability, auto-scale and VPN. We also help you decide between virtual firewalls, Multicloud Defense and cloud-native controls. Contact us to discuss your environment.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Cisco FTDv?
FTDv is Firepower Threat Defense Virtual, now called Cisco Secure Firewall Threat Defense Virtual. It is the virtual machine edition of Cisco's next-generation firewall software for hypervisors and public clouds.
Is Cisco Secure Firewall available in Azure and AWS?
Yes. Threat Defense Virtual and ASA virtual both run in AWS and Microsoft Azure. Threat Defense Virtual can be bought bring-your-own-licence or pay-as-you-go through the marketplace in both, and supports auto-scale in both.
How is Threat Defense Virtual licensed?
By subscription, in performance tiers that set throughput and VPN session limits, with optional IPS, Malware Defense and URL Filtering subscriptions. Licences are managed through Cisco Smart Licensing; ask us for a quote.
Should I use Threat Defense Virtual or Multicloud Defense in the cloud?
Threat Defense Virtual suits lift-and-shift designs and consistency with on-premises firewalls. Multicloud Defense suits cloud-native, multi-cloud estates that want a SaaS control plane and infrastructure-as-code automation.