ASA FO Pair - Sourcefire upgrade

dclee — Tue, 12 Mar 2019 06:44:52 GMT

We currently run a pair of ASA5555x's in FO for our prod perimeter protection.

I have bought all of the required licenses and hard drives to upgrade the firewalls to run the Firepower services.

Both firewalls currently run the Cisco IPS module.

Hoping someone can provide me an upgrade gameplan to get this done. Is this upgrade something I can schedule with TAC ?

I have a maint window end of this month to get it done, where I can live without both firewalls if needed..

Both firewalls currently running 9.1(2), pretty sure I have to get to at least 9.3(2) for the firepower upgrade.

A few questions

- Should I break the FO pair before hand and upgrade the inactive 5555x first ?

- Do I need to uninstall the current IPS modules in both firewalls first ? Whats the best way to do this ?

- Harddrive installation ( 2 each) are hot swappable right ?

Any help or advice would be appreciated.

cheers

Dave

Hi, >> You should break the

Rishabh Seth — Wed, 14 Oct 2015 13:07:47 GMT

Hi,

>> You should break the failover and upgrade the install the FirePOWER module.

>> ASA can run only one module at a time, uninstall IPS before installing FirePOWER.

>> The SSD is not hot swappable.

For more details you can refer following link:

http://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configure-firepower-00.html

In case you run into any issues you can reach out to TAC.

Hope it helps!!!

Thanks,

R.Seth

Mark the answer as correct if it helps in resolving your query!!!