topic Re: ASA 5506-X: "Module Firepower is not supported on this platform” in Network Security

ASA 5506-X: "Module Firepower is not supported on this platform”

db62 — Fri, 21 Feb 2020 16:24:42 GMT

Hi,

So I was upgrading an ASA 5506-x from 9.9 to 9.10 using the "Tools / Check for ASA/ASDM updates..." function of the ASDM launcher.

It found the 9.10.1 update, but then a message box popped up:

"Module Firepower is not supported on this platform”

Excuse me?

A quick search led me to the 9.10 Release Notes, which say, quote:

No support in 9.10(1) for the ASA FirePOWER module on the ASA 5506-X series and the ASA 5512-X—The ASA 5506-X series and 5512-X no longer support the ASA FirePOWER module in 9.10(1) and later due to memory constraints [emphasis mine]. You must remain on 9.9(x) or lower to continue using this module. Other module types are still supported. If you upgrade to 9.10(1), the ASA configuration to send traffic to the FirePOWER module will be erased; make sure to back up your configuration before you upgrade. The FirePOWER image and its configuration remains intact on the SSD. If you want to downgrade, you can copy the ASA configuration from the backup to restore functionality.

Would anyone at Cisco care to address this loss of functionality that was bought and paid for, due to an "upgrade"? I'm sure some users might have something to say about this... And this thread might be relevant too...

Thank you kindly.

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

f2l — Wed, 07 Nov 2018 11:09:17 GMT

This does not make any sense to me either?!?!

Why buy a 5506-X, 5512-X, etc. If when you upgrade to the latest 9.10.1 version, you get the functionality of the 5505?

Surly, if you buy a 5506-X, etc., you bought it to make use of its full functionality, including FirePower.

Cisco: Please explain, or maybe provide free memory upgrades. 😉

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

Jason L — Tue, 13 Nov 2018 21:28:02 GMT

I just learned this from the release notes. If the 5506 and 5512 were EOL, this would make sense, but since they are not, this makes no sense.

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

k.nandakumar — Wed, 14 Nov 2018 06:02:08 GMT

If you need FirePOWER service function, why not re-image the box with FTD ?

You'll have latest ASA code and Firepower and single image

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

Jason L — Thu, 15 Nov 2018 14:58:19 GMT

FTD does not have all the features that ASA has.

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

honza.sotek — Thu, 15 Nov 2018 15:28:24 GMT

And next question is "why is not supported DTLS 1.2 on ASA 5506" ??

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

Marvin Rhoads — Fri, 16 Nov 2018 01:40:24 GMT

ASA 5506-X and 5512-X will not support Firepower after any 6.2.3.x release. That applies whether you are talking about ASA with Firepower service module or FTD image.

They only have 4 GB of non-upgradable RAM. This limitation is why ASA 9.10(1) and later are not be supported.

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

mummim — Fri, 30 Nov 2018 18:34:12 GMT

Just have the same issue; upgraded to ASA 9.10(1) and Firepower is no longer usable.

Because we just bought two Licenses for our two ASA5506-X: What do you recommend to still use the ASA5506-X with our TAM license under the latest ASA version?

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

mummim — Fri, 07 Dec 2018 07:30:50 GMT

I can give the answer by myself now: Cisco recommended us to change to ASA5508, because there's no way to use FirePOWER with ASA5506 and the latest Software (ASA5506 has only 4GB RAM but 8GB are required).

So my recommendation to all Cisco customers: Choose the ASA5508 from the beginning instead of choosing the ASA5506 when you plan to use FirePOWER.

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

Marvin Rhoads — Fri, 07 Dec 2018 08:44:20 GMT

DTLS 1.2 was just introduced in ASA 9.10(1). So it will not be available on ASA 5506-X or 5512-X.

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

honza.sotek — Fri, 07 Dec 2018 08:46:40 GMT

Why?

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

Marvin Rhoads — Fri, 07 Dec 2018 08:50:25 GMT

Because they have stopped developing new features for those two platforms in anticipation of discontinuing them.

Not supporting Firepower 6.3 / ASA 9.10(1) is the first indicator. Any new features that are introduced on those or later software versions will not make it to the ASA 5506-X and 5512-X

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

honza.sotek — Fri, 07 Dec 2018 08:55:27 GMT

It makes no sense. They would not release 9.10.1 to 5506-X. All features are available but DTLS 1.2 not.

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

Kasun Bandara — Fri, 07 Dec 2018 10:02:48 GMT

Hi ,

i just heard it from you. this is bit rude from a giant like cisco. so after this update cisco does not have small firewall which can support user's basic needs in current security world. its just a firewall.

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

Marvin Rhoads — Fri, 07 Dec 2018 10:13:29 GMT

5506-X and 5512-X are still available and ASA 9.8(3)16 (the current gold star recommended release) and Firepower 6.2.3.7 work fine on them. 95% of customers don't run the absolute latest versions in my experience.

Be patient and I am certain you will see a replacement device from Cisco.

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

Kasun Bandara — Fri, 07 Dec 2018 10:19:07 GMT

thanks Rhoads,

hope cisco will release something new which is for SMB customers. also i found 5506-X is not enough powerful to manage FP as well as FTD in my testings. hope cisco will do something for that. 🙂

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

mschiessl — Thu, 07 Feb 2019 02:43:57 GMT

we just bought a whole set of 5506X w/firepower from a trusted vendor and we were not made aware that those devices are discontinued.
In advance we also bought the TAC Lics to maintain support for all of these devices.

Hearing now that they might be discontinued (and seeing it on my own ASA that FP ist not showing up anymore does not give me a good feeling of trust regarding cisco maintainence policy)

Of course we want to use the latest images due to feature and of course security reasaons - so not giving us for what we paid without any notification is not the best behaviour

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

Marvin Rhoads — Thu, 07 Feb 2019 02:48:56 GMT

The ASA 5506 is not yet discontinued. Only new Firepower Threat Defense and Firepower service module 6.3 is not available for them. New ASA software will continue to be made available as will maintenance releases of the 6.2.x Firepower train.

Once the hardware EoX announcement is made it will follow standard Cisco policy for support timelines.

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

mschiessl — Thu, 07 Feb 2019 02:58:52 GMT

well, just bought those 5506x wihtout any notice upon the regarding topic from the vendor is a real shame.

So pointing to the 5508x because of the above reasons would have been a really good recommendation from cisco and vendor.

We clearly stated that we're in urge of using FP ...

rolling back to 9.9.2 now on the staging asa

Re: ASA 5506-X: "Module Firepower is not supported on this platform”

Marvin Rhoads — Thu, 07 Feb 2019 13:07:10 GMT

Yeah it's too bad your vendor wasn't able to give you better advice. Maybe it's time to consider using another partner.