topic ASA5512 Active/Standby with Firepower services in Network Security

ASA5512 Active/Standby with Firepower services

Michalis Michael — Wed, 18 Mar 2015 22:45:54 GMT

I have two ASA5512X firewalls in Active/Standby mode.

We want now to enable FirePOWER subscription- TAMC - IPS and Apps Updates plus URL Filtering and AMP Subscription

My customer does not want to buy the subscription for the standby firewall.

He needs the standby firewall to do only firewalling, routing and VPN in the event of a failure.

Is it technically possible?

technically it would work.

Marvin Rhoads — Tue, 24 Mar 2015 01:44:10 GMT

technically it would work. The service policy would still direct the traffic through the FirePOWER module that's unlicensed (The base FirePOWER software would have to be installed but without any license or policies from FMC).

Thanks Marvin for your

Michalis Michael — Tue, 24 Mar 2015 06:20:00 GMT

Thanks Marvin for your response.

You're welcome. Please mark

Marvin Rhoads — Tue, 24 Mar 2015 12:10:03 GMT

You're welcome. Please mark your question as answered if it has been.

Hello Marvin,I'm exactly in

Marc Rousseau — Thu, 04 Jun 2015 12:11:27 GMT

Hello Marvin,

I'm exactly in same situation : buy a license for a standby firewall seems pretty useless (in my case).

You said that technically it will work, but is this asymmetric configuration officially supported ?

Is that possible that TAC refuse to troubleshoot a potential issue in this configuration ?

Thanks

Marc

It's not an issue of TAC

Marvin Rhoads — Thu, 04 Jun 2015 13:15:24 GMT

It's not an issue of TAC support. From the point of view of the FireSIGHT Management Center, you have two separate managed ASA's, each with a different set of policies applied.

The problem is that your desired security level - with intrusion, URL and potentially file (AMP) policies - cannot be applied to a module without the prerequisite license. So you need to make two sets of policies - one for the fully licensed module and one for the partially licensed module. Depending on what licenses you have on the latter, your security protection may suffer during a failover scenario until you've restored the primary unit to operation.

Operationally you could go in and "unlicense" the failed module and apply that license to the operational one and then reapply the more secure policy set. That's a lot more headache and opportunity for human error than is advisable for most customers though.

Thank you for your answer

Marc Rousseau — Thu, 04 Jun 2015 15:41:34 GMT

Thank you for your answer Marvin !

I have 2 ASA 5525X FirePOWER

Sandile Mazamane — Thu, 05 Nov 2015 16:41:48 GMT

I have 2 ASA 5525X FirePOWER added to my FireSIGHT manager, I added FireSIGHT host and User license, and 2 Malware Licenses for ASA5525, but My Devices License Type shows 'Unlicensed".

I don't know where to start fixing this, I'm with SourceFire stuff.

I don't know, maybe I'm missing something

Please help

Hi Sandile,

bbogdane — Thu, 05 Nov 2015 22:02:28 GMT

Hi Sandile,

You need to edit the device and add the license that you have uploaded to the Management Centre.

Hi Sandi,

dhvenkat — Fri, 06 Nov 2015 00:18:05 GMT

Hi Sandi,

Please add the PROTECT+CONTROL license for the ASA5525, there should be a PAK sent along with the device. Please register the PAK to obtain the license for "PROTECT+CONTROL".

- DD

The PAKs I got gave me only

Sandile Mazamane — Fri, 06 Nov 2015 09:26:28 GMT

The PAKs I got gave me only the licenses you see on the images. Part number L-ASA5525-TAMC

Sandlike,

Marvin Rhoads — Fri, 06 Nov 2015 12:04:57 GMT

Sandile,

The Protect+Control PAK is delivered as a paper PAK in the box with the appliance. It is a zero cost item delivered with all FirePOWER modules. If it has been misplaced, the vendor can call it up on the Cisco ordering system.

You need to redeem that PAK and apply the license as a prerequisite for any of the other licenses.

Re: technically it would work.

KK Admin — Fri, 25 Aug 2017 18:53:15 GMT

Hi Marvin,

Thank you for your iput. Perhaps this is a matter of symantics with the words licensing vs subscription which is why I need clarification. I have two ASA5512X Appliances with FirePower Services (ASA5512-FPWR-K9) in Active/Standby mode. I am now looking to purchase the necessary subscription, specifically "Cisco ASA with FirePOWER Services IPS, Advanced Malware Protection and URL Subscription" (Mfg. Part#: L-ASA5512-TAMC-1Y). Do I need to purchase a quantity of two subscriptions - one for each appliance? In other words, do I need to purchase a subscription for the standby unit? Thank you!

Re: technically it would work.

Marvin Rhoads — Sat, 26 Aug 2017 04:19:37 GMT

@KK Admin,

Yes - both the Active and Standby units require their own subscription.

Re: ASA5512 Active/Standby with Firepower services

abjohnson — Thu, 26 Oct 2017 14:40:58 GMT

I have the same situation. This answer is helpful. Thanks