topic Re-Installing Firepower on ASA in Network Security

Re-Installing Firepower on ASA

HimeshGohil — Wed, 25 Aug 2021 10:05:02 GMT

I've got issues with a Firepower Module on our system and will be re-installing it.

I've researched the method and I've never done this before and would appreciate a sanity check to see if I'm missing anything before I go ahead and submit the change documents

Our setup is

Four ASA 5555-x with Firepower configured as two separate active/passive failover pairs

ASDM for ASA management

FMC 6.0 for Firepower management

High level plan

Collect the following info

Hostname =

Network Address =

Subnet Mask =

Gateway =

DNS Servers =

Local Domain Name =

Search Domain =

NTP Server =

Issue the command show summary and make note of the result

Ensure the ASA and Firepower is in fail open mode

Ensure the node I'm working on is the standby

Remove the Module form the FMC

Shutdown and remove the FP module

Install a new (supported in the ASA and FMC matrix) image

"Mount" and config the SFR

Install the relevant software package

config the SFR

Add the FP module back into the FMC

Does this sound solid?

Is there any more info I should collect to ensure it's all smooth? Maybe licences?

Will adding the Module back into the FMC reload the policies or is there additional config I will need to do once I do so?

I have the process fully documented. If anybody is interested in seeing it I'm happy to share although I'm not planning to post it here as this post is quite long already.

Thanks in advance

Re: Re-Installing Firepower on ASA

Chakshu Piplani — Wed, 25 Aug 2021 11:14:00 GMT

Small advise, You can edit the IP and rename the dead SFR on FMC, instead of deleting it completely from the FMC, also remove the licenses for it via FMC, by editing the existing device, and unchecking the licenses.

But dont delete it from FMC, as you might want to refer to the old SFR for zone mapping etc.

Licenses for SFR are classic licenses so that would remain on the FMC, under system--> licenses, since you are re-imaging it, the mac address would remain same.

You can delete the old one in there once you are satisfied with the new one working.

Regards,

Chakshu

Do rate helpful posts!

Re: Re-Installing Firepower on ASA

HimeshGohil — Wed, 25 Aug 2021 12:46:57 GMT

Thank you Chakshu, that's a really good tip.

I'll add that to my plan