topic Yes. Please see below. in Network Security

Adding Firepower to ASA5512

cjmaddalena — Mon, 14 Dec 2015 04:13:42 GMT

How do i determine if our ASA is capable of supporting the Firepower subscription? I don't seem to see any reference of it being a -X model. I'm assuming from looking around that the -X signifies that the Firewall is NGFW and capable of running these additional services?

Yes. Please see below.

Austin Sabio — Mon, 14 Dec 2015 19:12:07 GMT

Yes. Please see below.

ASA 5512-X with FirePOWER Svcs. Chassis and Subs. Bundle

ASA5512-FPWR-BUN

ASA 5512-X with FirePOWER Services, 6GE data, AC, 3DES/AES, SSD

ASA5512-FPWR-K9

Cisco ASA5512 FirePOWER IPS and Apps 3YR Subscription	L-ASA5512-TA=	L-ASA5512-TA-3Y
Cisco ASA5512 FirePOWER IPS, Apps and URL 3YR Subscription	L-ASA5512-TAC=	L-ASA5512-TAC-3Y
Cisco ASA5512 FirePOWER IPS, Apps and AMP 3YR Subscription	L-ASA5512-TAM=	L-ASA5512-TAM-3Y
Cisco ASA5512 FirePOWER IPS, Apps, AMP and URL 3YR Subscription	L-ASA5512-TAMC=	L-ASA5512-TAMC-3Y
Cisco ASA5512 FirePOWER URL Filtering 3YR Subscription	L-ASA5512-URL=	L-ASA5512-URL-3Y

Source: http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/datasheet-c78-733916.html

Besides being an X model

Marvin Rhoads — Tue, 15 Dec 2015 20:42:39 GMT

Besides being an X model (which the ASA 5512 is), you also need to be running at least ASA software version 9.2(2) or later.

You also need to have the 120 GB SSD (Solid State Drive) installed. These were not always the default on ASA 5512-X shipment s, particularly the earlier ones.

With all of that, your software module needs to be imaged as FirePOWER and then licensed, either from FireSIGHT Management Center or, as of ASA 9.5 with FirePOWER 6.0 for that model, directly from ASDM.

Thanks Marvin, that's really

cjmaddalena — Tue, 15 Dec 2015 21:29:12 GMT

Thanks Marvin, that's really helpful. I would need to take steps to do each of those pre-reqs you have mentioned. So upgrade FW, Install SSD and i would also need to run FireSIGHT appliance.

If i was going down this path simply for IPS and URL, would you suggest OpenDNS Umbrella might be the better Cisco option? This is only for around 100 users.

Thanks

OpenDNS is certainly quicker

Marvin Rhoads — Tue, 15 Dec 2015 22:53:21 GMT

OpenDNS is certainly quicker and easier from what I've heard. I haven't had the hands on with it to say for sure based on first hand experience though.

Thanks Marvin, you've been

cjmaddalena — Wed, 16 Dec 2015 03:07:57 GMT

Thanks Marvin, you've been very helpful