topic Re: setting up firepower module, question about interfaces in Network Security

setting up firepower module, question about interfaces

faghouri83 — Fri, 21 Feb 2020 14:52:31 GMT

Hi all

I'm in the process of upgrading the firepower software on a Cisco 5525-X. I have updated the boot firmware to 6.2.2. Once I get into the module using the module sfr command i then enter setup to configure the ip address for the firepower module.

My question is, what physical interface on the firewall is this ip address binded to? does the firepower ip address have to be in the same subnet as the inside interface ip? Once i can get the firepower talking to filezilla server, i can then upgrade the rest.

Thanks

Re: setting up firepower module, question about interfaces

mikael.lahtela — Thu, 30 Nov 2017 12:52:56 GMT

Hi,

The firepower ip address configured at setup is bound to Management 1/1.
Don't think they need to be in the same subnet as inside, but it makes things easier.
You will only access the Firepower module through the Management port, asa configuration must be access from inside or an extra oob management port.
https://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/5500X/5500x_quick_start.html

br, Micke

Re: setting up firepower module, question about interfaces

faghouri83 — Thu, 30 Nov 2017 14:01:10 GMT

Thanks for the answer. I shall give it a go.

Re: setting up firepower module, question about interfaces

johnlloyd_13 — Sat, 02 Dec 2017 03:02:10 GMT

hi,

the FP module logical eth0 interface is binded to the ASA chassis management0/0 interface.

both the FP module interface and ASA management interface can be on the same subnet (for IP design ease) BUT the management functions are separate. meaning, you SSH/ASDM to ASA management0/0 IP while you use the FP module IP for FMC device registration.

here's a useful link for the ASA FP module upgrade process.

http://ccnpsecuritywannabe.blogspot.com/2017/09/cisco-asa-firepower-module-upgrade.html

Re: setting up firepower module, question about interfaces

Marvin Rhoads — Sun, 03 Dec 2017 02:32:02 GMT

@johnlloyd_13 note that the question was about the 5585-X. Those are a bit different in that they use a hardware module. As Micke noted, connectivity is via interface management 1/1 - e.g. the interface on the Firepower SSP module in slot 1.

(corrected information below - Thanks John)

Re: setting up firepower module, question about interfaces

johnlloyd_13 — Sun, 03 Dec 2017 01:58:14 GMT

hi marvin,

OP said it was for a 5525-X. look closely further above 🙂

"I'm in the process of upgrading the firepower software on a Cisco 5525-X."

Re: setting up firepower module, question about interfaces

Marvin Rhoads — Sun, 03 Dec 2017 02:31:00 GMT

Oh - sorry about that John. You are right. Time to get my glasses checked. 🙂

On the ASA 5525-X the Firepower module indeed uses interface Management 0/0. That applies to the 5512-X, 5515-X, 5525-X, 5545-X and 5555-X.

https://www.cisco.com/c/en/us/td/docs/security/asa/hw/maintenance/5500xguide/5500xhw/asa_overview.html#58700

On the 5506-X, 5508-X and 5516-X they number the sole management interface "Management 1/1".

The 5585-X has two management interfaces - Management 0/0 on the base ASA and Management 1/0 on the SSP. The latter is used for the Firepower SSP.

https://www.cisco.com/c/en/us/td/docs/security/asa/hw/maintenance/5500xguide/5500xhw/asa_overview.html#58700