topic Check if ASAs have Firepower Service Modules? in Network Security

Check if ASAs have Firepower Service Modules?

MicJameson1 — Mon, 27 Nov 2023 19:36:15 GMT

Hello.

Are Firepower Service Modules separate physical cards inside ASAs?

We have a few ASA5525s, and an ASA1120. How do I check if these devices already have installed Firepower Service Modules?

Thank you.

Re: Check if ASAs have Firepower Service Modules?

MHM Cisco World — Mon, 27 Nov 2023 19:46:59 GMT

show module sfr details

This give you some detail about sfr if it add or not.

MHM

Re: Check if ASAs have Firepower Service Modules?

Rob Ingram — Mon, 27 Nov 2023 19:47:44 GMT

@MicJameson1 use the command " show module sfr " on the 5525-X, the 1120 does not support the Firepower Services Module.

Re: Check if ASAs have Firepower Service Modules?

balaji.bandi — Mon, 27 Nov 2023 19:49:26 GMT

ASA5525 - you can see front there is SSD installed or you can also boot and look

show modules

show module ips details (if installed)

1120 is latest Firepower (you can boot and check is the FTD image or ASA image)

Re: Check if ASAs have Firepower Service Modules?

MicJameson1 — Mon, 27 Nov 2023 20:03:41 GMT

Thank you for your replies.

May you please reply to the questions below?

1. Is the ASA5525 Firepower module hardware?

2. How do I check the Firepower status on an ASA1120?

2. Does below mean the module is not physically present, or not turned on?

# show module sfr

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
sfr Unknown N/A FCH1944K3Y8

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
sfr 76a2.e5d7.f0f1 to 76a2.e5d7.f0f1 N/A N/A

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------
sfr Unknown No Image Present Not Applicable

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
sfr Unresponsive Not Applicable

Thank you.

Re: Check if ASAs have Firepower Service Modules?

Rob Ingram — Mon, 27 Nov 2023 20:08:49 GMT

@MicJameson1 the Firepower Services Module is an application that runs on the SSD of the ASA hardware. This hardwares runs the ASA software image AND if the Firepower Service Module is present can redirect packets to the FPR Services Module for inspection.

The Firepower hardware (including the 1120) do not support the Firepower Services Module, you either run just the ASA software image without Firepower functionality or you run the FTD software image instead of the ASA image, the FTD image is the NGFW.

Re: Check if ASAs have Firepower Service Modules?

MHM Cisco World — Mon, 27 Nov 2023 20:12:54 GMT

show module sfr details

Add details and share output.

MHM

Re: Check if ASAs have Firepower Service Modules?

MicJameson1 — Mon, 27 Nov 2023 20:16:55 GMT

# show module sfr details
Unable to read details from module sfr

Card Type: Unknown
Model: N/A
Hardware version: N/A
Serial Number: FCH5302K1G3
Firmware version: N/A
Software version:
MAC Address Range: 74a2.e6d4.b510 to 74a2.e6d4.b210
Data Plane Status: Not Applicable
Console session: Not ready
Status: Unresponsive No Image Present

Re: Check if ASAs have Firepower Service Modules?

MHM Cisco World — Mon, 27 Nov 2023 20:23:19 GMT

It not up and not work

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/200889-Using-ASDM-to-manage-a-FirePOWER-module.html

Re: Check if ASAs have Firepower Service Modules?

balaji.bandi — Mon, 27 Nov 2023 20:23:56 GMT

You have module you need to re-image for that to work.

https://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configure-firepower-00.html

check compatability matrix what version require to re-image :

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/compatibility/threat-defense-compatibility.html

Re: Check if ASAs have Firepower Service Modules?

MicJameson1 — Mon, 27 Nov 2023 20:25:49 GMT

"You have module"

... how do you know that?

Re: Check if ASAs have Firepower Service Modules?

Rob Ingram — Mon, 27 Nov 2023 20:37:00 GMT

@MicJameson1 if you had a working module I would expect the output to be as below, but the output you provided above does not confirm the Card Type or even the Model.

ASA5525# show module sfr details
Getting details from the Service Module, please wait...

Card Type:          FirePOWER Services Software Module
Model:              ASA5525

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/200889-Using-ASDM-to-manage-a-FirePOWER-module.html

The output above from your ASA 5525-X?

Re: Check if ASAs have Firepower Service Modules?

Marvin Rhoads — Tue, 28 Nov 2023 09:49:51 GMT

The ASA 5525-X has the capability to run a Firepower service module but it requires the optional solid state drive (SSD) in addition to system software boot (img file) and system software package (pkg file). So, in that sense, they are both hardware and software.

They are also end of sales, so even if you had the images you would need licenses which are no longer sold to enable the features.