topic What are the high level steps involved while installing Firepower module on ASA 5545-X in Active/Standby state ? in Network Security

What are the high level steps involved while installing Firepower module on ASA 5545-X in Active/Standby state ?

damode — Fri, 21 Feb 2020 15:45:52 GMT

We have two 5545-X ASAs in active/standby mode that currently run sfr module 5.4.0.8.

Our plan is to upgrade our FMC from 5.4.1.7 to 6.2.0.5 through proper upgrade process. However, for our ASAs, we are planning to re-image them straight to 6.2.0 and patch 6.2.0.5.

My main question here is, can I install firepower module on standby first and then install on active firewall without having to do a failover ?

Re: What are the high level steps involved while installing Firepower module on ASA 5545-X in Active/Standby state ?

yogdhanu — Mon, 14 May 2018 07:34:51 GMT

Yes, you can. the modules installation is independent of ASA failover. You can install the module on both 1 by 1 and then configured the service policy later without having do failover or affecting traffic before the redirection is configured.

Hope it helps.

Yogesh

Re: What are the high level steps involved while installing Firepower module on ASA 5545-X in Active/Standby state ?

Marvin Rhoads — Mon, 14 May 2018 15:26:25 GMT

@yogdhanu

Note that service-module health is a failover criterion by default. It can be disabled since ASA 9.3(1) and higher.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/200944-Disable-Service-Module-Monitoring-on-ASA.html

If you don't disable the monitoring, shutdown or reload of a Firepower module on the active unit will cause a failover event (or status of "not ready" in case it is reloaded on a standby unit).