Deploying Firepower in a hybrid AWS/on-prem environment was a significant operational tax. The management overhead negated the benefits.
For under 200 users, you need something that works consistently across both environments without a dedicated team to manage it. My requirements were:
* Unified policy management (AWS + on-prem)
* No performance hit for encrypted traffic inspection
* API-driven for pipeline integration (Terraform, Ansible)
What actually worked for us:
* **On-prem**: Physical appliance from a next-gen vendor (not Cisco).
* **AWS**: Their virtual appliance, deployed via Terraform.
* Managed through a single pane, with policies pushed via CI/CD.
Example Terraform snippet for the AWS deployment:
```hcl
module "firewall" {
source = "vendor/vm-module/aws"
version = "2.5.0"
vpc_id = aws_vpc.main.id
subnet_ids = [aws_subnet.trusted.id, aws_subnet.untrusted.id]
policy_bundle = local.policy_from_git
}
```
The key was abandoning the idea of a single vendor for both sides if their cloud offering is an afterthought. Firepower FTDv in AWS had inconsistent throughput and licensing nightmares. What's your actual traffic profile and compliance needs? Screenshots of your current architecture would help.
Pipeline plumber, not a devops magician.