topic FirePOWERS service configuration an existing ASA in Network Security

FirePOWERS service configuration an existing ASA

KarimOUATTARA0210 — Fri, 21 Feb 2020 17:14:18 GMT

Hello Expert,

We have an ASA 5525 that was running since 1 year now.

we have purchased firewpower service licenses.

We are juste interested in ips part of that service.

My question is : can asa image still handle the access-list and forward the allowed packets to firepower services ?

Regards,

Karim

Re: FirePOWERS service configuration an existing ASA

balaji.bandi — Sun, 23 Jun 2019 17:32:44 GMT

yes your ASA works as usal like FW, if you like to use IPS Service you need add additional configuration to intercept the traffic

look at the configuration guides :

https://www.cisco.com/c/en/us/support/security/asa-5525-x-firepower-services/model.html#ConfigurationExamplesandTechNotes

Re: FirePOWERS service configuration an existing ASA

Marvin Rhoads — Mon, 24 Jun 2019 14:23:21 GMT

When using a Firepower service module, the ASA continues to do everything it always has (ACL, NAT, VPN etc.) with the addition of having the Firepower services module to do IPS (and URL Filtering and Advanced Malware Protection if you desire and have the licenses).

See the order of Operations for ASA packet processing diagram below for a visual illustration: