topic Re: Firepower ASA image in Network Security

Firepower ASA image

manvik — Wed, 08 Mar 2023 06:26:29 GMT

am trying to download asa image for Firepower 3130 device, but the download page shows only image for firepower 2100 series (cisco-asa-fp2k.9.12.4.SPA). Can this be used in 3130 device.

https://software.cisco.com/download/home/279513399/type/280775065/release/9.12.4

Re: Firepower ASA image

Kasun Bandara — Wed, 08 Mar 2023 06:57:00 GMT

this is the latest for 3130 model

https://software.cisco.com/download/home/286330420/type/280775065/release/9.19.1

Re: Firepower ASA image

manvik — Wed, 08 Mar 2023 07:39:18 GMT

thank you @Kasun Bandara and @aaliyanseo I was looking for 9.12.4 ASA version for firepower 3130. I am restoring config from aprevious ASA running in 9.12.4 version.

If new firepower 3130 runs nearest cisco-asa-fp3k.9.17.1.SPA, will the backup & restore work?

Re: Firepower ASA image

Kasun Bandara — Wed, 08 Mar 2023 08:21:39 GMT

it depends, if you have only basic configurations, it will work. you can copy and paste commands in CLI and verify working commands and find alternative commands if any errors

Re: Firepower ASA image

Marvin Rhoads — Wed, 08 Mar 2023 08:31:40 GMT

The older version is not available for the 3130 since it was just announced in summer 2022. ASA 9.12 software was first released in 2019. Thus 9.17 (first released in 2022) is the minimum version of ASA software you can run on the 3130.

A straight backup and restore might not work 100% if the interfaces you are using are at all different (i.e. old appliance Ethernet 1/1 maps to new appliance Ethernet 1/1 etc.). Also some things like certificate private keys and file images are not included in a configuration backup.

These caveats and more are mentioned in the Getting Started Guide:

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/getting-started/3100/secure-firewall-3100-gsg/asa.html#id_119800

Re: Firepower ASA image

Rob Ingram — Wed, 08 Mar 2023 08:32:03 GMT

@manvik as you will be forced to use ASA 9.17 on the 3100, version 9.13 depreciated weak encryption ciphers used for IKE, IPSec, SSH and SSL. So if you have any VPNs you may need to reconfigure them to use the stronger ciphers.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa913/release/notes/asarn913.html