topic Re: 1. Correct. in Network Security

ASA 5585X SSP 10 with firepower module installation

kkolawole — Sun, 10 Mar 2019 13:39:21 GMT

Hello,

I have 2 ASA 5585 SSP10 in active/standby configuration working. We have purchased 2 SFR modules ASA5585-SSP-SFR10 to be installed.

My question is whether the boot and system software images are already factory pre-installed on the cards. Or should we need to download the images from Cisco and re image the cards during install ?

Thank you.

The FirePOWER system image

Marvin Rhoads — Wed, 20 Jul 2016 23:04:15 GMT

The FirePOWER system image should be installed already.

However they are probably on the older version 5.3.x.

You will want to get them up to the latest 6.0.1.1 via your FirePOWER Management center once you have them bootstrapped and registered.

The cards will be configured

kkolawole — Thu, 21 Jul 2016 00:04:19 GMT

The cards will be configured in IDS mode (monitor-only) for some time, as the virtual management center is not ready yet. Iam wondering if we could use ASDM to upgrade the modules to the latest version, though we are not registering them in ASDM.

Could you reference some documentation for bootstraping and ASDM upgrade in this particular case ?

Thanks

i have the quick start guide

kkolawole — Thu, 21 Jul 2016 01:05:22 GMT

i have the quick start guide at this link:

http://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118824-configure-firepower-00.html#anc6

Is this guide referencing the bootstrap process ?

Im confused because this guide does the image recovery all over (bootstrap and system images), as if the module has no image pre installed. If the module does have system image pre installed, how is the bootstrap and registration done in that case

If your modules come with <6

Marvin Rhoads — Thu, 21 Jul 2016 01:10:36 GMT

If your modules come with <6.0 FirePOWER version you will not be able to upgrade them via ASDM.

The ante for using ASDM to manage (including upgrade) a FirePOWER module on anything other than the Kenton models (5506/08/16) is ASDM 7.5.112 and FirePOWER 6.0.

http://www.cisco.com/c/en/us/td/docs/security/asdm/7_5/release/notes/rn75.html#ID-2172-00000128

You'd be much better off standing up a FirePOWER Management Center on a VM. If you ever plan to run the 5585 modules with anything near the load they are capable of, ASDM (with the module only event storage) is really not a sustainable solution.

If you go the route of upgrading from 5.3.x to 6.0 without FMC, you will need to go the cli route - a lot more work and it's roughly described here:

http://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configure-firepower-00.html

As noted there, upgrade apart from either FirePOWER Management Center or ASDM management (the latter only available post-6.0) requires reimaging - I would not recommend it for the new user.

Thank you for this

kkolawole — Thu, 21 Jul 2016 08:57:49 GMT

Thank you for this clarification.

1- By this statement, Do you mean any version lower than 6.0 can not be upgraded via ASDM ?

If your modules come with <6.0 FirePOWER version you will not be able to upgrade them via ASDM.

2- Is it possible to use ASDM for upgrade for the meanwhile and later switch to full FMC VM ?

3- The cli option you mentionned is for the software module. Is this link for the hardware module ?

http://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118824-configure-firepower-00.html#anc6

If correct, does this mean a complete image recovery is necessary via cli ?

Thank you.

1. Correct.

Marvin Rhoads — Thu, 21 Jul 2016 13:05:45 GMT

1. Correct.

2. No - not on ASA 5585 with pre-6.0 FirePOWER software.

3. Sorry - yes that's the correct link for the hardware module.

Yes, as I noted earlier - without FMC you will need a completely re-image via cli.

Thanks a lot.

kkolawole — Thu, 21 Jul 2016 23:26:55 GMT

Thanks a lot.

Registration is done with the

Ed Padilla Jr — Wed, 27 Jul 2016 19:21:31 GMT

Registration is done with the license Key. Usually you received a doc with the PAK

very important.. make sure you Firepower Management Console is in the same version or higher than the sensor or module FP.

Hello

MKH — Mon, 13 Mar 2017 18:08:20 GMT

Hello

We have 12 ASA5585X with IPS-SSP-20.Can we install Firepower image on them without changing hareware?

Thank you.

Yes, you can. Make sure the

Ed Padilla Jr — Mon, 13 Mar 2017 18:25:29 GMT

Yes, you can. Make sure the image is equal or below the FMC release. And make sure you match the ASA version working with FP. I highly recommend using the FP 6.1 or up, if your FMC is 6.2 ....avoid all the headaches in between...

@edpadilla ,

Marvin Rhoads — Tue, 14 Mar 2017 02:39:08 GMT

edpadilla ,

Sorry for the correction but the 5585-X IPS-SSP cards cannot be reimaged to run FirePOWER.

In cases such as this, there is a special SKU (ASA5585-xx-FP-UPG, using 10, 20, 40 or 60 in place of "xx") the customer can order to get a discounted price on the required new hardware module. The model ordered should be considered carefully - the customer's Cisco or partner SE can use the internal sizing tool to choose the right one given the customer's current and projected performance requirements.

They should also consider moving to a new FirePOWER 2100 (FTD image only) or 4100 (ASA or FTD image) series appliance as the end of sales for 5585-X FirePOWER variants has been announced recently. The EoS date will be August 2017.

http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-x-series-next-generation-firewalls/eos-eol-notice-c51-738643.html

Hello

MKH — Tue, 14 Mar 2017 02:44:50 GMT

Hello

I've tried to install and change our ASA5585X with IPS-SSP-20 to Firepower image 6.2 according to below link:

http://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118824-configure-firepower-00.html

But After final reboot and when the module reloads, All process reset to IPS-SSP-20 mode and image installation process failed.

Is there something wrong with that?

Thank you.

@mkhalegi1 ,

Marvin Rhoads — Tue, 14 Mar 2017 02:55:50 GMT

mkhalegi1 ,

Note the guide you referenced instructs that "the other module must be uninstalled to make space for the SSP-SFR".

This is referring to uninstallation of the older hardware module, consistent with the advice I gave just a short while ago in this thread.

Here comes the tricky side of

Ed Padilla Jr — Tue, 14 Mar 2017 03:00:54 GMT

Here comes the tricky side of these cards. Before you move forward with any purchase. Survey the traffic that will pass thru your ASA. In addition, the type of traffic. Another aspect to look forward, is the type of policies you will be pushing. Once you have a good idea of your traffic inspection, get the specs on these cards. You will be surprise on the performance taxing these cards. Or see if Cisco Sales rep is willing to loan a card as proof of concept. This is before you move forward on any recommendations or suggestions.

Re: 1. Correct.

rloyola22 — Wed, 30 Jan 2019 21:38:14 GMT

If I am 5.3.1, reimage can be done to the latest 6.2.3 or need to follow specifics path?