topic Hi Marvin, in Network Security

ASA FirePOWER Threat Defense unified image (FTD)

ilukeberry — Sat, 22 Feb 2020 06:21:43 GMT

Can someone from Cisco please explain what this image is? And what parts of ASA does include ? Can it do VPN/Anyconnect ?

Is ASA OS getting retired ?

Regards

Hi

yogdhanu — Wed, 23 Mar 2016 08:02:17 GMT

Hi The Firepower Threat Defense (FTD) is a unified image of ASA and Firepower. It is designed to do what ASA do and what Firepower do , together with unified management. It does not yet have anyconnect (in pipeline) . Yes ASA is going to get retired and unified image will come up in future. Thanks Yogesh

So basically all features of

ilukeberry — Wed, 23 Mar 2016 08:12:59 GMT

So basically all features of current ASA OS features will get transferred into FTD? I'll stick with ASA OS with FirePOWER combo until this FTD gets all the features.

Correct. As of now not all

yogdhanu — Wed, 23 Mar 2016 08:56:48 GMT

Correct. As of now not all the features are available but they will be eventually. Current image is out 6.0.1 which does not have anyconnect. Please rate the answer if it helps. Thanks Yogesh

One more question. Will any

ilukeberry — Wed, 23 Mar 2016 09:26:37 GMT

One more question. Will any migration tool be provided?

http://www.cisco.com/c/en/us

Per Tenggren — Wed, 23 Mar 2016 09:41:51 GMT

http://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/5500X/ftd-55xx-X-qsg.html

Br,

Per Tenggren

Already read that. Doesn't

ilukeberry — Wed, 23 Mar 2016 09:43:46 GMT

Already read that. Doesn't mention any migration tool.

What do you want to migrate?

Per Tenggren — Wed, 23 Mar 2016 09:49:23 GMT

What do you want to migrate? The classic ASA ACLs can't be migraded to the FTD afaik.

From the release notes:

When you reimage and install Firepower Threat Defense on your 5500-X appliance, all previous files and configurations saved on the ASA will be lost.

I don't want to migrate right

ilukeberry — Wed, 23 Mar 2016 09:52:33 GMT

I don't want to migrate right now, but i have ton of other settings for AnyConnect, VPN and AAA in ASA currently and i was just asking when FTD gets all features of ASA OS if it will be possible to migrate those.

FTD doesn't yet support all

yogdhanu — Wed, 23 Mar 2016 14:36:56 GMT

FTD doesn't yet support all of those features (read VPN) , so we don't yet know if that's something which will be possible. Once an image supporting anyconnect with full vpn functionality releases , we will know if it can be done.

Right now , all needs to be configured manually.

I have a few questions.

robert.decker — Tue, 29 Mar 2016 04:51:30 GMT

I have a few questions.

There is no documentation regarding the path Cisco is taking the ASA, yet the platform seems to be dramatically changing. Is there a definitive road map for the future of the ASA hardware and software platform?
Is the FTD unified image a different operating system than the ASA OS?
Will the FTD unified image operating system still have the ASA command line with the same configuration and commands we use on the ASA OS?
How long will Cisco maintain ASA OS before we will be required to upgrade to FTD?
I'm assuming FTD will be managed by the FirePower Management Center. Is this correct?
Will the ASDM continue to be used to manage the traditional ASA firewall features such as ACLs, NAT, IPSec, Routing, etc, or are these features being moved into FTD and to be managed with the FMC? Is ASDM being replaced?

Thanks.

Hi

yogdhanu — Tue, 29 Mar 2016 06:22:30 GMT

>I am not 100% sure about whats the future roadmap for ASA as that is subject to change but FTD is the future.

>FTD unified image is combination of ASA and firepower so ASA OS is same but all the config is supposed to be done from GUI and not CLI. CLI can be used for troubleshooting and same set of commands used in ASA can be run in ASA part of it.

>There is no decision yet on when ASA OS will be discontinued as FTD doesn't yet support all of ASA features so we need to wait and see how things turn out but it will be quite some time.

>Yes FTD will be managed by Firepower management center.

>There will be a release (under roadmap) where ASDM can also manage both ASA and Firepower for few models but its under development. With current release , everything is being done from Firepower management center.

Thanks

>There will be a release

ilukeberry — Tue, 29 Mar 2016 08:07:32 GMT

Why the heck would you want to manage FTD with old, ugly and JAVA based ASDM ?

This is currently possible with 9.3/9.4 ASA code w/ FirePOWER 6.x stuff.

>Yes FTD will be managed by Firepower management center.

No on-box management ? you need FMC VM/Appliance to manage FTD ?

@ilukeberry ,

Marvin Rhoads — Tue, 29 Mar 2016 13:46:56 GMT

ilukeberry ,

A migration tool will be offered later this year (ca. summer 2016).

Don't expect full feature parity until sometime in 2017.

Per: http://www.cisco.com/c

Edward Brennan — Tue, 29 Mar 2016 15:38:56 GMT

Per: http://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/5500X/ftd-55xx-X-qsg.html there are re-image options for many models, but I didn't see the 5585-x. These are a hefty investment. Will there be re-image or migration options for these?

On 5585-X FirePOWER runs on

ilukeberry — Tue, 29 Mar 2016 15:48:11 GMT

On 5585-X FirePOWER runs on seperate blade. So afaik there wont be unified image.

Marvin thanks for answer it

ilukeberry — Tue, 29 Mar 2016 15:49:18 GMT

Marvin thanks for answer it seems you know more than Cisco employees 😄

Correct - there's not

Marvin Rhoads — Tue, 29 Mar 2016 16:04:34 GMT

Correct - there's not currently a unified image for the 5585-X hardware. As of right now that's not supported and it's TBD whether it ever will be.

Generally speaking the new FirePOWER 4100 and 9300 series is a much better fit for the high performance uses cases where the FTD image feature set is desired. That's from both a cost and performance perspective.

The 5585-X should be the platform of choice where the full ASA feature set (remote access VPN, clustering, multiple context etc.) is required, potentially with the (non-unified image) NGIPS features via the SSP blade.

I would expect Cisco will eventually offer Investment Protection Program (IPP) and Technology Migration Program (TMP) options for 5585-X customers if and when they are ready to migrate. (That's just speculation informed by past experience on my part and nothing that's been decided at this point as far as I know.)

@Marvin Rhoads

WaliedFarghaly — Wed, 06 Apr 2016 09:46:34 GMT

@Marvin Rhoads

i can not find info about what feature it is going to support/not support?

http://www.cisco.com/c/en/us/td/docs/security/firepower/roadmap/firepower-roadmap.html

also i can not find the software to download it?

https://software.cisco.com/download/release.html?mdfid=286271171&flowid=77243&softwareid=286306337&release=6.0.1&relind=AVAILABLE&rellifecycle=&reltype=latest

Can you provide me with links please?

Regards

Walied

-------------------------------

edit:I just found, links added

What about FTD 6.0.1 on ASA w

Michael Gioia — Wed, 11 May 2016 07:05:00 GMT

What about FTD 6.0.1 on ASA w/FP, and defining NAT and Routing in FMC and have FTD on ASA w/FP do it ?

There is surely a document or release notes that tells you what each FTD ASA/wFP version can do ?