topic Hi Marvin, in Network Security

Cisco ASA FTD vs Firepower Software

rjadhav163 — Tue, 12 Mar 2019 07:45:48 GMT

I am confused between Firepower FTD stuff and Firepower Services Software. So following are my questions based on what I understood:

With Firepower Services Software module:

1. You have your normal ASA OS and then you download the Firepower Services Software. Or is the compatible firewall always shipped with the Firepower Services Software pre installed?

2. So ASA will do - Routing, ACLs, NAT, VPN

Firepower Services Software will do - AVC, URL Filtering, NGIPS and AMP

Is this understanding correct?

3. ASA as well as Firepower Services Software can be managed by ASDM and CLI. But only Firepower Services Software can be managed by Firepower Management Center i.e. only the above mentioned 4 functions of Firepower Services Software can be controlled by Firepower Management Center.

With FTD Image

4. There is only one image on the firewall. Correct? (I say image because to install FTD I somehow need 2 files: like a *.lfbff file. and a .pkg file. Still confused why)

5. All the functions mentioned above for ASA as well as those provided by Firepower Services Software will be managed ONLY by Firepower Management Center. That means even if I have to add a simple ACE then I need to do it using the Management Center? Correct?

Please Clarify. Everything with FTD/Firepower is really confusing. 😞

1. The ASA is available both

Marvin Rhoads — Wed, 18 May 2016 01:34:28 GMT

1. The ASA is available both with and without the FirePOWER software module pre-installed. It no extra cost to specify it with so we (my company that it and other partners) typically specify it with so that it's already there in case the customer wants to activate it later.

2. That's the overall delineation of functions. The FirePOWER functions do require licensing. AVC is included with the no-cost Control license but NGIPS, URL Filtering and Malware (AMP) are licensed features that must be purchased separately.

3. Correct. (Plus you can also manage ASAs with CSM.)

4. One file, one binary image package.

5. Correct as of 6.0. (Note not all legacy ASA features are currently available in FTD - notably missing are all types of remote access VPN.) Stay tuned for changes to that with the release of 6.1 this summer.

Thanks Marvin.

rjadhav163 — Wed, 18 May 2016 07:22:19 GMT

Thanks Marvin.

Additional Question:

Assume that I have one legacy ASA (like 5525-X) without Firepower Features enabled and another ASA (like 5508-X with Firepower) with Firepower Services Module (that is pre v6.0). And now I want to migrate them to FTD and manage them with Management Center.

What is the best way to migrate objects and ACLs and other settings (ofcourse not VPN as you mentioned) ? Do I have to manually enter everything on the Management Center?

That would be a pain if you have 100s or 1000s of objects!

The best way would be to wait

Marvin Rhoads — Wed, 18 May 2016 13:07:36 GMT

The best way would be to wait until 6.1 is out in Summer 2016. There will be a standalone migration tool available then capable of migrating objects and ACLs. Over time that tool will be enhanced and integrated into FMC.

Thanks Marvin.

rjadhav163 — Thu, 19 May 2016 07:06:59 GMT

Thanks Marvin.

Unfortunately cannot wait till that long. Have to migrate the stuff next week. Is there a CLI Interface / Shell that I can use to atleast enter objects into the Management Centre.

Hi Marvin,

anil.kumark — Mon, 23 May 2016 02:15:22 GMT

Hi Marvin,

Kindly post any document over the difference of ASA with firepower & FTD. When to choose which one would help us to understand the product better.

@rjadhav163

Marvin Rhoads — Mon, 23 May 2016 03:07:18 GMT

rjadhav163

Sorry but there's no such capability at present.

@anil.kumark

Marvin Rhoads — Mon, 23 May 2016 03:08:45 GMT

[@anil.kumark]

For now the respective data sheets are the best publicly available source. If you work with your partner or Cisco SE, they can assist with additional information to guide your decision making.

Thanks Marvin however I am

anil.kumark — Wed, 25 May 2016 04:28:32 GMT

Thanks Marvin however I am looking for limitations around the technical implementation of FTD and ASA here,

1. Does the 4100/9300 appliance support running ASA image with firepower service as software just like the ASA X series?

2. Do the 4100/9300 appliance support running ASA or FTD operation with inter & Intra clustering?

3. Do the 4100/9300 appliance support running ASA or FTD image in HA mode (active/standby or active active) in intra and & inter chassis?

Hi,

PAUL GILBERT ARIAS — Wed, 14 Sep 2016 20:43:03 GMT

Hi, Where you able to get the answers? I am supposed to deploy a 4110 but I need it in ASA mode so that we can run similar things as the ASA 5500X. Is this possible?

1. No - and never will.

Marvin Rhoads — Thu, 15 Sep 2016 02:34:40 GMT

1. No - and never will.

2. Inter-chassis clustering for ASA image only. FTD does not have clustering in any form factor..

2. Inter-chassis only (at this time for 9300 - may change in the future).

4110 with ASA image supports

Marvin Rhoads — Thu, 15 Sep 2016 02:36:00 GMT

4110 with ASA image supports all base ASA features (stateful firewall, L2L VPN,remote access VPN etc.).

It does not and will not support FirePOWER module.

Thanks for the update Marvin,

anil.kumark — Mon, 24 Oct 2016 07:56:09 GMT

Thanks for the update Marvin,

We recently upgraded FMC to 6.1 and after upgrading we face issues with AMP cloud. When we go to AMP Management page (AMP > AMP Management) we don't see the default US site listed there. When we try to create a FMC connection then system does not pull any site information instead it displace "None".

Attached the screen shot, we did verify that DNS and its working fine.

@anil.kumark ,

Marvin Rhoads — Tue, 25 Oct 2016 02:23:40 GMT

[@anil.kumark] ,

I haven't seen that one. My FMC 6.1 retained its connection to the US Cloud.

I'd open a TAC case on that one.

Hi Marvin,

bernardovr — Tue, 15 Aug 2017 22:59:55 GMT

Hi Marvin,

I have a question of the ASA 5516-X FTD, I want to reimage this device with an ASA IOS, because the costumer want to have the ASA conifguration via CLI. My doubt was, if I reimage this ASA with ASA IOS can I deploy the sfr module and integrate with Firepower Management Center? or we lose the module with capabilities Firepower as you mentioned with the appliance 4110?

Thanks!

@bernardovr ,

Marvin Rhoads — Wed, 16 Aug 2017 02:25:30 GMT

bernardovr ,

When you reimage an ASA with FTD to ASA image type, you have a "regular" ASA capable of running the Firepower service module.

Note the license types for FTD vs. Firepower service are different so the device would have to be relicensed for Firepower services. There is no "migration license" or such.

Hi Marvin,

bernardovr — Thu, 17 Aug 2017 16:05:30 GMT

Hi Marvin,

Thanks for the answer, one question more the relicense has no cost? Or the costumer must buy the license.

Thanks!

You're welcome.

Marvin Rhoads — Thu, 17 Aug 2017 16:08:35 GMT

You're welcome.

They are different license SKUs with different costs. The new image would need newly purchased licenses. If it is a significant deal size, you may want to speak with the account manager from Cisco for potential relief on the cost.

Re: The best way would be to wait

Shaaka — Fri, 01 Dec 2017 03:06:58 GMT

Re: Thanks Marvin.

Shaaka — Fri, 01 Dec 2017 03:10:31 GMT

Thanks for your updates, those are really helpful.

I have a question on migrating from asa firepower module to frd, is any additional licenses required or existing licenses are enough. As we have url,mulware,avc,ngips and GMC