topic Getting a cisco.com account in Network Security

Setup new ASA with Firepower

Mohd Khairul Nizam — Tue, 12 Mar 2019 12:42:16 GMT

Hi all,

i just bought and receive below item

1. ASA5515-FPWR-K9 ASA 5515-X with FirePOWER Services 6GE AC 3DES/AES SSD

2. SF-FP5.3.1-K9 - Cisco FirePOWER Softwarev5.3.1

3. ASA5515-CTRL-LIC Cisco ASA5515 Control License

Question

1. Is there any guide/manual on how to install/enable the Firepower? I couldn't see inside ASDM? i now how to configure the traditional ASA

2. I'm trying to install the Control License but it asking for License Key of sourcefire? where to get?

Please refer to the Quick

Marvin Rhoads — Wed, 17 Jun 2015 12:44:09 GMT

Please refer to the Quick Start Guide for initial configuration steps.

Once you work through that, you will move to the required FireSIGHT Management Center server for licensing and policy setup. You should have ordered an FMC license and it will have the license key necessary to install the Control/Protect license. Generally you should also have a license for both FMC and feature licenses for the ASA module (IPS, URL Filtering and/or Malware).

Thanks Marvin,i have read the

Mohd Khairul Nizam — Wed, 17 Jun 2015 16:11:43 GMT

Thanks Marvin,

i have read the guide but when i reach below part, i couldn't understand.

What hostname/ ip address are we talking about??

4. (Optional for 5506-X/5508-X/5516-X) Register the ASA FirePOWER module to a FireSIGHT Management Center:

> configure manager add {hostname | IPv4_address | IPv6_address | DONTRESOLVE}reg_key [nat_id]

That "hostname / IP address"

Marvin Rhoads — Wed, 17 Jun 2015 16:14:48 GMT

That "hostname / IP address" would be the FireSIGHT Management Center (FMC).

FMC is a separate server that is required to manage policies, licenses, events etc. for FirePOWER modules (except for the low-end models which have the option of running a lightweight FMC from within ASDM).

The FMC is not reside in the

Mohd Khairul Nizam — Thu, 18 Jun 2015 01:03:54 GMT

The FMC is not reside in the ASA itself?

I need a seperate server (phsical/VM) in order to fully utlize it? right?

How can i know that i entitled to this FMC? Any license required?

Mohd,FMC runs as a separate

Marvin Rhoads — Thu, 18 Jun 2015 02:31:31 GMT

Mohd,

FMC runs as a separate VM (or physical appliance for larger installations). In either case it is a separate server. The entry level ASAs (5506, 5508 and 5516) do have the option of running FireSIGHT on ASDM.

Your 5515X does not have that feature.

You are entitled to it only if you bought it.

Yes - it requires a license; that is provided (normally via eDelivery) when you purchase the product. Your reseller or partner should have advised you as to it being required (per the ordering guide which is available to them) and, if you purchased it, also provided the license and instructions for downloading the image.

i got this from CiscoPAK

Mohd Khairul Nizam — Thu, 18 Jun 2015 05:26:08 GMT

i got this from Cisco

PAK numbers : ASA5515-CTRL-LIC Cisco ASA5515 Control License .

What is this for? anything to do with FMC

The Control license is a

Marvin Rhoads — Thu, 18 Jun 2015 12:45:15 GMT

The Control license is a prerequisite zero cost license that the feature licenses (IPS, URL Filtering and Malware) build on. It provides he Application Visibility and Control information that the other licenses use as part of providing their respective functionality.

If is applied to the device or module from FMC, just as all the other licenses are.

hiI have two ASA 5545 with

freebsd1980 — Fri, 26 Jun 2015 11:30:50 GMT

I have two ASA 5545 with traditional IPS, i need to buy license for these device for Sourcefire and Firesight and I dont know what is difference between these license:

FS-VMW-10-SW-K9

L-ASA5555-TAMC-3Y

do I need both of above license?

where must i run these license? in asa or firesight?

Where must i run the ASA-CTRL license? in asa?

For download Sourcefire signature do i need SmartNet Account? or with "L-ASA5555-TAMC-3Y" licnese i get a SmartNet Acount?

thanks

The FS- license is for the

Marvin Rhoads — Fri, 26 Jun 2015 14:08:28 GMT

The FS- license is for the FireSIGHT Management Center (FMC) itself.

The other one is to license the FirePOWER module on the ASA. It requires the prerequisite ASA-CTRL license.

In either case, one installs the licenses on the FMC. The ASA-specific ones are applied to the ASA from FMC once the ASA is setup as a registered device.

A licensed FMC will download and apply VDB (Sourcefire Vulnerability And Fingerprint Database Updates) updates automatically (assuming you've set it up correctly and completely and that it has Internet access). That is setup under "System > Tools > Scheduling" where you can create a task to "Install Latest Update".

Is the ASA-CTRL an activation

freebsd1980 — Fri, 26 Jun 2015 15:53:26 GMT

Is the ASA-CTRL an activation key? I must apply it on asa?

and

is it possible to download VDB and do offline update? if yes, what kind of license i need?

ASA-CRTL is a license. It

Marvin Rhoads — Fri, 26 Jun 2015 16:40:08 GMT

ASA-CRTL is a license. It (and all FirePOWER-related licenses) is installed via the FireSIGHT Management Center.

It is possible to download and install the VDB files. The only reason I can imagine for doing so is if your FMC is on a closed network with no Internet access. The files are available for download here and require your cisco.com userid be associated with a current support contract (or term-licensed software).

Then for 2 asa5545 i need

freebsd1980 — Fri, 26 Jun 2015 19:02:11 GMT

Then for 2 asa5545 i need exactly :

1. SSD 120G * 4

2. ASA5545-CTRL-LIC= * 2

3.L-ASA5545-TAMC-3Y * 2

4. FS-VMW-2-SW-K9 * 1

5. ASA image 9.4 , asdm 7.4 and Sourcefire_Defense_Center_Virtual64_VMware-5.4.0-763.tar.gz

Is it correct?

or i need any more to order?

thanks for your answers.

Assuming you have a pair of

Marvin Rhoads — Fri, 26 Jun 2015 20:14:17 GMT

Assuming you have a pair of existing ASA 5545 without SSD already installed, the your items 1-4 are correct.

If you were ordering new, there is a bundle SKU in Cisco Commerce Workspace (CCW- Configuration and Ordering Tools for Cisco and their partners and resellers) that would show new ASA 5545s including the SSDs and software module pre-installed.

Item 5 is not required to be ordered per se but is software you would use. Technically, ASA 9.2(2) suffices for support of the sfr module so you can choose among the current 9.2, 9.3 and 9.4 images based on other features and caveats as documented in the release notes.

If you are indeed buying new SSDs, you will also need to download and deploy the img and pkg files for the FirePOWER modules on the ASAs to build an operating sfr module. Something like "asasfr-5500x-boot-5.4.0-763.img" and "asasfr-sys-5.4.0-764.pkg" (current releases as of this posting).

Those files can be found here.

The bundle I mentioned would have that already built for you.

If i want download VDB files

freebsd1980 — Sun, 28 Jun 2015 06:07:03 GMT

If i want download VDB files and do offline update, what part number i must order?

and it will be time-based too?

thanks

The VDB files support the IPS

Marvin Rhoads — Sun, 28 Jun 2015 16:29:10 GMT

The VDB files support the IPS functionality. While you would have the cisco.com access to download them with a FireSIGHT Management Center or any of the IPS, URL Filtering or Malware (AMP) licenses (in your case the TAMC includes all of those latter three), you could only use them in a policy if you have an Control and IPS license (at least) on one of the devices (FirePOWER appliance or ASA FirePOWER module) that you are managing.

Your time-based question doesn't make sense to me. If you are downloading manually, the time is whenever you go to cisco.com and make the download. You would then need to upload the files manually into FMC and then apply them. If you do this manually you are by definition not using an automated scheduled task (time-based).

The files themselves are updated a couple of time a week, depending on the threat landscape as determined by Cisco's TALOS security researchers.

ok, but i mean if i cant

freebsd1980 — Sun, 28 Jun 2015 17:24:31 GMT

ok, but i mean if i cant connect my FMC server to internet what license i will need for download VDB files from cisco.com?

if there is such license, what is the part number for ASA5545?

and for "time based", i mean if there is such license, it will be time bases, for example 1-y or 3-y? same as firepower license

Oh, I understand your

Marvin Rhoads — Sun, 28 Jun 2015 17:24:32 GMT

Ok, I understand your question better now. No worries.

We call these license "term-based". The term is how long the license is valid for.

In the case of "L-ASA5545-TAMC-3Y" which you indicated above, the term is indicated in the last two characters - "3Y" or 3 years in this case.

All of the FirePOWER licenses (see the types below) are currently available in 1 year, 3 year or 5 year terms. The part number is, generally speaking "L-ASA<model number>-<License type>-<term>.

As I noted earlier, your cisco.com ID won't be prevented from downloading the VDB files once you have access to the FirePOWOR file area as a result of any valid FMC or FirePOWER license type. However, you will need one of the license types that includes the IPS feature in order to be able to use the VDB definitions in a policy. That is enforced on the FMC itself when you build and apply policies.

I think I could not represent

freebsd1980 — Mon, 29 Jun 2015 03:37:45 GMT

I think I could not represent my question well, I ask the other way

As you noted earlier: "The files are available for download here and require your cisco.com userid be associated with a current support contract (or term-licensed software)."

now, my question is this: when i want download VDB files from above link, I will need a service contract account. to have this service contract what part number i must order to Cisco reseller?

If you have the "L-ASA5545

Marvin Rhoads — Mon, 29 Jun 2015 12:40:50 GMT

If you have the "L-ASA5545-TAMC-3Y", that is a qualifying term-licensed software subscription that will entitle you to the VDB updates. So are any of the other variations shown in the screenshot I posted earlier. Those by themselves will entitle you to the updates (when associated with your cisco.com account).

As far as support contracts, you will also have access to the files if you have a Smartnet contract for your FMC. For the "FS-VMW-2-SW-K9" 2 device license you mentioned earlier, that part number would be "CON-SAU-VMWSW2". I wouldn't focus on that thought since without the subscription license, you would not be able to use the updated definitions in a policy.

Your reseller has access to all of this information and should be able to guide you using tools available to them via Cisco's partner channels.