The document discusses migrating customers from Cisco PIX firewalls to Cisco ASA 5500 series firewalls and security appliances. It provides an overview of the migration program objectives, outlines strategies for qualifying customers and developing sales approaches, and includes case studies. The presentation provides details on the features and benefits of Cisco ASA 5500 appliances compared to older Cisco PIX and competitor products, and recommends which Cisco ASA products and editions are best suited for different customer deployment scenarios.

1. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 1
Migrating Customers
to the Cisco ASA
5500 Series

2. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 2
ASA Migration
 Program Objectives
 Customer Qualification and Sales
Strategy
 Case Studies
 What Products Should You Sell?

3. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 3
Program Objectives
Drive Increased
Account Revenues
with Cisco ASA
5500 Series Sales
 Upgrade Cisco PIX® installed-base
 Expand Cisco PIX deployments with
Cisco ASA 5500 appliances
Improve Account
Control by Keeping
Competitors Out of
Your Accounts
 Remove the opportunity for
Competitors to churn Cisco gear
 Provide customers with a cost-
effective, easy-to-deploy upgrade for
the Cisco PIX Security Appliance

4. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 4
Why You Should Drive ASA Migrations
 The security appliance market is diversifying
Small to medium businesses are moving toward converged, multifunctional
security platforms for increased productivity
and lower costs
Larger enterprises seek environment-specific security solutions tailored to their
needs
This is the perfect opportunity to showcase the modularity and flexibility of Cisco
ASA for multiple types of environments
 Reduced capital and operating expenditures
(CapEx and OpEx)
Technology Migration Program (TMP) credits, security bundles, Capital Leasing
reduce a customer’s total cost of ownership
Single platform, many uses means customers save OpEx by having fewer
devices to deploy, troubleshoot and maintain
 If you don’t migrate your customers, the competitor will
Security and VPN are customers’ top priorities; ensure your customers keep
technology current or competitors will

5. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 5
Customer Qualification and Sales Strategy

6. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 6
Who Should You Target?
 Customers with Cisco PIX 520s:
Cisco PIX 520s cannot run the latest Cisco PIX software v7.x releases that delivers
advanced application inspection, active/active failover, transparent firewalling,
Multimedia/VoIP security and more
Don’t just refresh these customers. Let them leverage earlier investments for trade-in credit.
Migrate them to ASA for more than just firewalling services.
 Customers who purchased Cisco PIX appliances over 3 years ago
Don’t just refresh these customers. Let them leverage earlier investments for trade-in credit.
Migrate them to ASA for more than just firewalling services.
 Customers with competitor point products:
Remove your competitor’s point products from an otherwise Cisco network. Leverage the
network infrastructure upgrade discussion to highlight the value of migrating to a converged
security platform—ASA.
 Customers with existing Cisco PIX deployments who must expand
deployments
Cisco ASA 5500 appliances are fully compatible with existing Cisco PIX appliances, with
higher performance and features. Expand with the Cisco ASA appliances and benefit from
increased capabilities.

7. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 7
What Is the Sales Strategy?
1) What plans do you have to update your network security
infrastructure?
2) How do you combat network-based attacks in your network? What
are you doing to meet compliance requirements Sarbanes-Oxley,
etc.)?
3) How do you secure remote workers accessing the network?
Engage Customer Using Simple Qualification Questions:
1) Highlight the business and technology drivers for migrating
2) Use following customer scenarios to
Find the best solution for customers
Articulate the TMP credit benefit
Follow Through and:

8. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 8
Plans to Update Your Network
Security Infrastructure?
 Many customers are refreshing their network gear for cost
savings, a performance boost, or to deploy more advanced
technologies
 Determine which Cisco or competitor firewall, VPN, Anti-X and/or
IPS equipment is installed
 Use the customer scenarios to show the cost savings associated
with trading in existing equipment whether, Cisco or competitor,
and upgrading to a platform like ASA which delivers
multifunctional security services including firewalling, VPN, and
IPS
Question #1
• What plans do you have to update your network
security infrastructure?

9. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 9
Question #2
• How do you combat worms and viruses in your network?
• Are you considering adding IPS in the future?
How Do You Combat Worms and
Viruses?
 Many customers already have firewalls and VPNs installed today and
are in the process of considering deploying IPS
 Even if your customer wasn’t thinking about migrating or buying IPS, the
requirement to meet compliance demands is likely something that will
resonate with your customer
 Determine which Cisco or competitor firewall, VPN, Anti-X and/or IPS
equipment is installed
 Use the customer scenarios to show the cost savings associated with
trading in existing firewalls, Cisco or competitor, and upgrading to a ASA
with Advanced Inspection and Prevention Module (AIP) or Content
Security and Control Module (CSC)

10. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 10
Question #3
• How do you secure remote workers who are accessing
your network?
How Do You Secure Remote Workers?
 Many customers have remote workers (employees or partners)
accessing the corporate network and require a customizable
remote access solution to support virtually any application
 Determine which Cisco or competitor firewall, VPN equipment
is installed
 Use the customer scenarios to show the cost savings
associated with trading in existing firewalls, Cisco or
competitor, and upgrading to a Cisco ASA 5500 Series VPN
edition

11. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 11
Key Technology Drivers
 Superior solution with converged best-of-breed security services
Combines market-proven firewall, IPS, IPSec, and SSL VPN services along with adaptive
architecture for future services extensions—protects businesses with its superior network
security posture, while providing strong investment protection
 Threat-protected VPN Services
Gives businesses VPN deployment flexibility by offering both IPSec and WebVPN services,
allowing businesses to tailor fit secure connectivity services based on their growing
connectivity and scalability requirements
 Consistent user experience
Leverages customers existing knowledge of Cisco PIX Security Appliances for easy
migration to Cisco ASA 5500 solutions
 High-performance IPS and Anti-X Services
Advanced Intrusion Prevention Services (IPS) and network Anti-X services mitigate wide
range of threats including worms, web-based attacks, and more
Why Trade Your Cisco PIX Security Appliance to a
New Cisco ASA 5500 Adaptive Security Appliance?

12. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 12
Customer Scenarios
Details on Recommending the Optimal
Cisco ASA 5500 Solution for Customers

13. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 13
Security Appliance Market Has Diversified
to Meet Changing Security Needs
Security Appliance Market Is Evolving
 Small to medium businesses are moving to converged, multifunctional security appliances
 Larger enterprises seek environment-specific security solutions tailored to their needs
Source: IDC, 2005
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
2005 2006 2007 2008 2009
SSL VPN
UTM
Secure
Content
ID&P
Firewall/VPN
IDC: Threat Management Security Appliance by Market Share
Market
Size
($M)

14. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 14
Scenario: Customer with Older Cisco
PIX Deployments
 Migrate old Cisco PIX 500 appliances to newer Cisco
ASA 5500 appliances
Target old Cisco PIX 520 appliances which cannot run newest
PIX software
 Expand firewall deployments with Cisco ASA 5500
Appliances
Cisco ASA 5500 Series appliances run the same Cisco PIX
firewall software as Cisco PIX 500 appliances
Cisco ASA 5500 Series appliances have higher performance
and expansion capabilities for other
security services
Solution

15. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 15
Cisco ASA 5500 Series Firewall Edition
Cisco ASA 5500
Firewall Edition
Cisco ASA 5500 Series Firewall Edition:
Trusted Technology from the Most Deployed Firewall: Cisco PIX
World-Class Application Security Services
Enables Businesses to Deploy New Applications
Securely, While Protecting Valuable Assets from
Unauthorized Access
Flexible, Reliable Deployment Options
Provides Wide Range of Services Such as
Transparent Firewall, Virtualization, Intelligent
Network Integration, and Award-Winning Resiliency
Comprehensive Management Solutions
Lower Operational Costs
Flexible Centralized Management Solutions Provide
Full-Featured Provisioning and Monitoring Services

16. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 16
Comparison: Cisco ASA 5500 and
Cisco PIX 500
Advantages of Cisco ASA 5500 over Cisco PIX 500:
 Better price and performance compared to similar Cisco PIX models
 More high availability options
 Increased connectivity options with SSL VPN
 Additional Security Services with Anti-X and IPS
Cisco ASA 5500 Delivers a Superset of Functionality Relative to the Cisco PIX 500
Cisco ASA 5500 Series Cisco PIX 500 Series
Firewall Services
Advanced Firewall Services, Including
Application Layer Firewall
Advanced Firewall Services, Including
Application Layer Firewall
VPN Services
SSL and IPSec VPN Services, including
VPN Clustering/Load Bal.
Only IPSec VPN Services for
Site-to-Site and Remote Access
Additional Security Services Anti-X, IPS None
Maximum Firewall Performance per
Appliance
150 Mbps to 1.2 Gbps 60 Mbps to 1.65 Gbps
Maximum IPSec VPN Performance
per Appliance
100 to 425 Mbps 3 to 495 Mbps
High Availability Support Available on All ASA 5500 Appliances Only Available on PIX 515E, 525, 535
I/O Capabilities
Copper and Optical GE Support, up to 8
GE Interfaces on ASA 5520, 5540, 5550,
up to 200 VLANs on 5540/5550
Optical GE Support (No Copper) on PIX
525/535, up to 100 VLANs on 525 and
200 VLANs on PIX 535

17. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 17
Scenario: Customers Seeking Added
Security Services Beyond Firewall and VPN
 Migrate old Cisco PIX 500 appliances to newer Cisco
ASA 5500 appliances
Take advantage of additional security services—SSL VPN, Anti-
X and IPS
Showcase the financial converged advantage with a multi-
function appliance, including OpEx and CapEx savings
Solution

18. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 18
Cisco ASA 5500
Firewall Edition
ASA 5500 Series Enterprise Editions
 Enables standardization
on the ASA 5500 series
platform to reduce costs
in management, training,
and sparing
 Superior protection by
providing the right
services for the right
location
 Simplifies design and
deployment by providing
pre-packaged location-
specific security solutions
Cisco ASA 5500
Anti-X Edition
Cisco ASA 5500
VPN Edition
Cisco ASA 5500
IPS Edition
A Family of
Tailored Packages
for Location
Specific Needs

19. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 19
ASA 5500 Series Enterprise Editions
Tailored Packages to Location Specific Needs
Remote Site w/
Local Internet
Access
Data Center
Outbound User
Internet Access
Extranet:
Business
Partner Access
Remote Access
Users
DMZ: Inbound
Public Internet
Services
Corporate LAN
Wireless
LAN
Internal
Segmentation
ASA 5500
IPS Edition
ASA 5500
VPN
Edition
ASA 5500
Anti-X
Edition
ASA 5500
IPS Edition
ASA 5500
Firewall
Edition
Firewall Edition
Robust Access and Policy
Enforcement with Rich Application
Protections Based on Cisco PIX®
Firewall
VPN Edition
Unified SSL and IPSec Remote
Access Services with Unified
Threat Management
IPS Edition
Protect Servers and Critical Assets
from Hackers and Network Worms
with Intrusion Prevention, Worm
Protection and Firewall Services
Anti-X Edition
Protect Users from Internet Threats
and Connect Remote Sites
Securely with Anti-X, firewall and
VPN Services

20. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 20
Cisco ASA 5500 Series VPN Edition
Cisco ASA 5500
VPN Edition
Cisco ASA 5500 Series VPN Edition:
Scalable, Secure SSL and IPSec VPN Remote Access
VPN for Any Deployment Environment
Clientless and Full Network VPN Access Delivers
Unsurpassed Customizability for Diverse Requirements
Threat-Protected VPN
Integrated Endpoint and Network Security
Technologies Ensure the VPN Is Not a Conduit
for Damaging Security Threats
Making VPNs More Cost Effective
Integrated Load Balancing, Network Intelligence
and Security Reduces the Number of Devices
Required to Scale and Secure the VPN

21. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 21
Cisco VPN Services for Any Deployment Environment
SSL and IPSec VPN Services with Comprehensive Security
Provides Fully Secured, Highly Customizable Access for Any User
from Any Location on a Single Device and Management Infrastructure
Public
Internet
Access Scenarios:
Company-Managed Desktop
Kiosk Access
Site-to-Site Connectivity
Full or Limited Network Access
Partner Access
ASA 5500
Employee at Home
Requires Consistent
LAN-Like Access
Supply Partner
Requires Access
to Ordering Databases
Converged VPN, Firewall, and Threat Mitigation:
Inspect/Control VPN Sessions
Integrated Malware Mitigation
Single RA VPN Device Infrastructure
Unified User Management
Branch Office
Requires Site-to-Site
Scalability and Resiliency:
Cost Effective Scaling
Integrated Load Balancing
Stateful Failover
QoS, VLANs, Routing
Hourly Employee
Requires Access to Online Schedule
and Timesheets (Specific Apps)

22. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 22
ASA 5500 Series—Threat-Protected VPN Services
Leveraging On-Board Security to Protect the VPN Network
Leverages Depth of Threat Defense Features to Stop Malicious Worms,
Viruses and More … and Without External Devices or Performance Loss
ASA 5500
Threat Mitigation
Incident Control Virus
Detection
Worm Mitigation
Spyware Detection
Accurate Enforcement
Real-Time Correlation
Risk Rating
Attack Drop
Session Removal and Resets
Worm/
Virus
Unwanted
Application
Spyware
Illegal
Access
Exploit
Remote Access
VPN User
Comprehensive Endpoint Security
Pre-Connection Posture Assessment
Malware Mitigation
Session/Data Security
Post-Session Clean-Up
Application Firewall and Access Control
Application Inspection/Control
Granular, Per-User/Group Access Control
Protocol Anomaly Detection
Stateful Traffic Filtering

23. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 23
Introducing the Cisco ASA 5500 Series
Anti-X Edition
Cisco ASA 5500
Anti-X Edition
Cisco ASA 5500 Series Anti-X Edition:
Protecting Clients Using the Public Internet
Superior Firewall
Built on Industry’s Most Trusted and
Deployed Cisco PIX® Firewall Technology for
Solid Access and Policy Control
High-Quality Malware Protection
Based on Trend Micro’s Time Tested and Market
Proven Technology and Business Processes for
Uncompromising Security
Unified Security and Content Control
Provides Everything You Need for Small Office,
Remote Office and Kiosks in a Single Device

24. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 24
Cisco ASA 5500 Series Anti-X Edition
Key Technologies and Innovations
 Granular policy controls
Built on Cisco PIX Firewall technology
 Comprehensive malware protection
Integrates Trend Micro antivirus and malware
technology to stop virtually
all threats
 Advanced content filtering
Secures employee productivity and reduces
legal liability
 Integrated message security
Removes unsolicited email
 Ease of management and automatic
update capabilities
Minimizes administrator support
Unified Threat
Prevention

25. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 25
Cisco ASA 5500 Series IPS Edition
Cisco ASA 5500
IPS Edition
Cisco ASA 5500 Series IPS Edition:
Protecting Critical Information Assets and Infrastructure
Control Access to Critical Assets
Firewall Access Control and Application Policy
Enforcement Provide Authenticated Access to
Critical Resources
Accurate, Multi-Vector Threat Prevention
Achieves Maximum Attack Identification via Multiple
Analysis Techniques and Technologies
Complete Incident Lifecycle Management
Complete Solution Covering Management, Monitoring,
Incident Response, and Outbreak Prevention

26. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 26
Multi-Vector Threat Detection Process
Multiple Techniques Utilized to Detect and Prevent
Attacks
Heuristic
Anomaly
Policy Exploit
Vulnerability
Statistical
Algorithms and
Rules for Event
Compression and
Correlation
Traffic and
Protocol Anomaly
Detection for
Protection
from New
Vulnerabilities
Flow-Based
Filtering Based
on Application
Access Control
and Acceptable
Use Policy
Protection from
Unknown
Threats and
Quickly Mutating
Viruses
Encoding
Signatures to
the Underlying
Vulnerability for
Day-Zero
Protection
Worms/Viruses
Covert Channels
Protocol Abuse
DoS/DDoS
Bots/Zombies
Trojans/Backdoors
Port 80 Misuse
Hack Attempts

27. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 27
Option 1: Migrate and converge today!
Trade in your PIX for an ASA with IPS
functionality today and take advantage
of special Technology Migration
Program (TMP) promotional pricing.
Option 3: Keep your PIX, deploy an
IPS-dedicated appliance next year to
accompany your PIX.
Option 2: Keep your PIX, deploy an
IPS-dedicated appliance today to
accompany your PIX.
Option 4: Migrate today by leasing
your ASA products with a Cisco
Systems Capital® Corporation Fair
Market Value (FMV) lease.
$0
$2,000
$4,000
$6,000
$8,000
$10,000
$12,000
$14,000
Year 1 Year 2 Year 3 Year 4 Year 5
Customer Scenario
The Converged Advantage
Scenario: This customer has a PIX515 installed and is considering adding IPS to their network.
They assume that buying an IPS stand alone appliance is the cheapest option. But because of
special TMP credits and converged platform price breaks, it is actually cheaper to migrate to
ASA5510-AIP10-K9. Leasing options deliver that same cost savings with additional cash-flow
flexibility. Review the options below to learn more.

28. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 28
0
2000
4000
6000
8000
10000
PIX, VPN and IPS ASA with AIP
38%
CapEx and OpEx Costs
Customer Scenario
The Converged Advantage—CapEx + OpEx
Scenario: When you add the previous CapEx and OpEx expenditures together, you get a combined
converged cost advantage. For the customer who has a PIX installed and is interested in adding
the VPN 3000 Series and the IPS 4200 Series to the network, migrating to ASA with AIP instead of
deploying stand alone devices costs 38% less.

29. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 29
Cisco ASA 5500 Series Product Lineup
Solutions Ranging from SOHO to Large Enterprise
Cisco
ASA 5520
Cisco
ASA 5540
Cisco
ASA 5510
Performance
Max Firewall
Max Firewall + IPS
Max IPSec VPN
Max IPSec/SSL VPN Peers
SMB and
SME
Target Market
Platform Capabilities
Max Firewall Conns
Max Conns/Second
Base I/O
VLANs Supported
HA Supported
List Price
Enterprise
Medium
Enterprise
Starting at
$3,495
Starting at
$7,995
Starting at
$16,995
300 Mbps
150 Mbps
170 Mbps
250/250
450 Mbps
375 Mbps
225 Mbps
750/750
650 Mbps
450 Mbps
325 Mbps
5000/2500
50,000/130,000
6,000
3+1 FE/5 FE
10/25
A/A and A/S
(Sec Plus)
Cisco
ASA 5550
Large
Enterprise
Starting at
$19,995
1.2 Gbps
N/A
425 Mbps
5000/5000
280,000
9,000
4 GE + 1 FE
100
A/A and A/S
400,000
20,000
4 GE + 1 FE
200
A/A and A/S
650,000
28,000
8 GE + 1 FE
200
A/A and A/S
Cisco
ASA 5505
SOHO and
ROBO
Starting at
$595
150 Mbps
Future
100 Mbps
25/25
10,000/25,000
3,000
8-Port FE Switch
3/3 (Trunk)
Stateless A/S
(Sec Plus)
New! New!

30. © 2006 Cisco Systems, Inc. All rights reserved. Cisco Confidential
Presentation_ID 30