topic Re: Firepower 2100 FTD or ASA mode? in Network Security

Firepower 2100 FTD or ASA mode?

Steven Williams — Fri, 21 Feb 2020 17:37:22 GMT

I have just received my first set of FP2100s and I am reading some quick start guides and other Cisco documentation and I am trying to understand the FTD mode vs ASA mode and what limitations each has? Also what is the "common" method for deployment. These will be edge firewalls that strictly terminate SSL VPN endpoints and that is it.

Re: Firepower 2100 FTD or ASA mode?

balaji.bandi — Wed, 23 Oct 2019 13:18:32 GMT

If you purchased 2100, Suggest to Install FTD, since you are not looking old ASA legacy feature and you looking only remote access vpn solution.

(personally and eventually Cisco will retire ASA code) - for longer support i go with FTD code.

here is the good document FTD - remote access setup.

https://www.cisco.com/c/en/us/support/docs/network-management/remote-access/212424-anyconnect-remote-access-vpn-configurati.html

you can also see VPN Limitation ASA vs FTD

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/fdm/fptd-fdm-config-guide-640/fptd-fdm-ravpn.html

The Firepower 2100 Series hardware can run either FTD software or ASA software. Switching between FTD and ASA requires you to reimage the device

Re: Firepower 2100 FTD or ASA mode?

Steven Williams — Wed, 23 Oct 2019 13:23:12 GMT

Do I need to run FTD version same or lower than my FMC code? I am running 6.2.3 on my FMC and all my SFRs are also running 6.2.3 or 6.2.2

Re: Firepower 2100 FTD or ASA mode?

balaji.bandi — Wed, 23 Oct 2019 13:32:08 GMT

If you like a standard in the organization, (if i were you, i maintain all same version, so each to manage), until i go another version if the features not supporting?

Re: Firepower 2100 FTD or ASA mode?

Steven Williams — Wed, 23 Oct 2019 13:33:37 GMT

I think it's more of a does the FMC at code 6.2.3 manage a FTD at a higher Code level. Some solutions need to have the management tool higher or same as devices it manages.

Re: Firepower 2100 FTD or ASA mode?

balaji.bandi — Wed, 23 Oct 2019 13:55:51 GMT

Best Practice, Management needs to be always a high version to manage the device, if the lower version, it can not manage higher version code device, since it was not understood well? make sense?

Re: Firepower 2100 FTD or ASA mode?

Steven Williams — Wed, 23 Oct 2019 14:01:20 GMT

Yes so i should run 2100s at 6.2.3 or update my FMC.

Re: Firepower 2100 FTD or ASA mode?

balaji.bandi — Wed, 23 Oct 2019 14:10:19 GMT

Last i have worked FMC Stable one 6.4 , i have seen 6.5 released recently.

check the matrix before you upgrade and work with the version you are comfortable ( as long as the feature supports your needs)

Re: Firepower 2100 FTD or ASA mode?

Rahul Govindan — Wed, 23 Oct 2019 15:22:17 GMT

Correct. The FMC version is always higher than the managed device. The FMC will not let you register a device with a higher version than itself.

Re: Firepower 2100 FTD or ASA mode?

simong — Wed, 23 Oct 2019 16:47:09 GMT

I have have a pair of FP2110 devices running FTD v6.2.3.x in HA mode for over a year with no issues. Recently upgraded to 6.4.0.4 and found static PAT to be unsupported (TAC case currently open).

One point you may wish to consider is SSL HW acceleration which is only available on 2100 series from v6.3. It may be worthwhile in your use case as SSL RAVPN headends.

Also, the FMC has been upgraded to v6.4 for a while now and continues to manage v6.2.3.x FTD sensors.

Regards,

Simon

Re: Firepower 2100 FTD or ASA mode?

Steven Williams — Wed, 23 Oct 2019 17:21:33 GMT

Seems to be for SSL decryption as it pertains to HTTPS, I am just going to be terminating about 7,000 SSL Anyconnect Clients.

Re: Firepower 2100 FTD or ASA mode?

balaji.bandi — Wed, 23 Oct 2019 19:54:05 GMT

If you looking 7000+ active session, choose the right model - i have shared other document in the previous post.