Compare exact Cisco firewall Product IDs side by side across Firepower 1000 and 2100 and Secure Firewall 3100, 4100 and 4200 appliances, with Threat Defense (-NGFW-K9) and ASA (-ASA-K9) variants kept separate. Each comparison lines up inspected throughput, TLS decryption, VPN capacity, sessions, interfaces, high availability, clustering and power.
Browse Cisco firewall comparison guides or compare exact Firepower and Secure Firewall model numbers.
Compare exact firewall models by software image, security performance, connection capacity and interfaces.
Understand the throughput, connection and interface values in a Cisco firewall comparison. Learn what each specification means and what to check between models.
ASA and Firewall Threat Defense (FTD) are software options used on supported Cisco firewall hardware. The software image determines the available security features and management options.
Throughput is the amount of traffic processed per second. AVC means Application Visibility and Control; IPS means Intrusion Prevention System. A Firewall + AVC + IPS figure includes all three functions in the stated test.
NGIPS means Next-Generation Intrusion Prevention System. Its throughput figure describes intrusion-prevention processing under the published test conditions.
TLS protects encrypted connections, including HTTPS traffic. TLS decryption throughput describes the capacity to decrypt and inspect that traffic under a stated test profile.
IPsec protects traffic carried over VPN connections. IPsec VPN throughput measures how much encrypted VPN traffic the firewall processes under the stated test conditions.
Concurrent connections count the sessions a firewall can keep active at once. Connections per second measures how quickly it can establish new sessions. One describes connection scale; the other describes the rate of new connections.
Data interfaces carry network traffic. Their specifications show the number of ports, connector types such as RJ-45 or SFP/SFP+, and supported speeds. Some models can add interfaces through supported modules.
High availability (HA) provides continuity when a firewall fails, using the supported failover arrangement. Clustering lets supported devices operate together as a group. They describe different ways of combining firewalls.
Compare the listed Cisco firewall models by software image, threat inspection, TLS and VPN performance, connection capacity and interfaces.
| Cisco Model | Security Software | FTD Firewall + AVC + IPS Throughput | NGIPS Throughput | TLS Decryption Throughput | IPsec VPN Throughput | Concurrent Sessions with AVC | Data Interfaces |
|---|---|---|---|---|---|---|---|
| FPR1010-NGFW-K9 | Cisco Secure Firewall Threat Defense | 0.88 Gbps | 0.9 Gbps | 0.195 Gbps | 0.4 Gbps | 100,000 | 8 x 1000BASE-T RJ-45; ports 1 and 2 support PoE+ output |
| FPR2110-NGFW-K9 | Cisco Secure Firewall Threat Defense | 2.6 Gbps | 2.6 Gbps | 0.365 Gbps | 0.95 Gbps | 1,000,000 | 12 x 10M/100M/1GBASE-T RJ-45 plus 4 x 1G SFP |
| FPR3105-NGFW-K9 | Cisco Secure Firewall Threat Defense | 10 Gbps | 10 Gbps | 3.2 Gbps | 5.5 Gbps | 1,500,000 | 8 x 10M/100M/1GBASE-T RJ-45 plus 8 x 1/10G SFP |
| FPR1120-NGFW-K9 | Cisco Secure Firewall Threat Defense | 2.3 Gbps | 2.6 Gbps | 0.85 Gbps | 1.2 Gbps | 200,000 | 8 x 10M/100M/1GBASE-T RJ-45 plus 4 x 1G SFP |
| FPR1140-NGFW-K9 | Cisco Secure Firewall Threat Defense | 3.3 Gbps | 3.5 Gbps | 1.2 Gbps | 1.4 Gbps | 400,000 | 8 x 10M/100M/1GBASE-T RJ-45 plus 4 x 1G SFP |
| FPR3110-NGFW-K9 | Cisco Secure Firewall Threat Defense | 17 Gbps | 17 Gbps | 4.8 Gbps | 8 Gbps | 2,000,000 | 8 x 10M/100M/1GBASE-T RJ-45 plus 8 x 1/10G SFP |
The chart compares Threat Defense models; ASA variants publish different measurements and appear on their own comparison pages.
“Not listed” means no value is recorded for that model; it does not mean zero or unsupported.
The suffix selects the software image on the same hardware. The FPR3105-NGFW-K9 runs Threat Defense and is rated at 10 Gbps with application control and IPS, plus 3.2 Gbps of TLS decryption. The FPR3105-ASA-K9 runs ASA, rated at 10 Gbps of stateful inspection and 150,000 new connections per second, with 2 security contexts included and up to 100 supported.
Threat Defense throughput with application control and IPS rises by family: 0.88 Gbps on the FPR1010-NGFW-K9 to 4.9 Gbps on the FPR1150-NGFW-K9, 2.6 to 10.4 Gbps across the Firepower 2100, 10 to 45 Gbps across the Secure Firewall 3100, 19 to 53 Gbps across the 4100 and 65 to 140 Gbps across the 4200.
The FPR3110-NGFW-K9, FPR3120-NGFW-K9, FPR3130-NGFW-K9 and FPR3140-NGFW-K9 cluster up to 8 appliances, and the Secure Firewall 4100 and 4200 models cluster up to 16. Firepower 1000 and 2100 models and the FPR3105-NGFW-K9 do not cluster and use high-availability pairs instead.
The FPR2130-NGFW-K9, FPR2140-NGFW-K9 and every Secure Firewall 3100, 4100 and 4200 model support 1+1 power supplies. Firepower 1000 models and the FPR2110-NGFW-K9 and FPR2120-NGFW-K9 have no redundant power supply option.
Choose Firewalls, search each complete Product ID and add up to four models. Compare Threat Defense models with each other and ASA models with each other, since the two images publish different performance measurements.
Each value comes from Cisco data sheets and hardware installation guides for the exact Product ID and software image. Throughput rows keep Cisco's test conditions, such as 1024-byte packets for Threat Defense, so each row compares like with like.