topic Re: Firepower/Firesight Compatibility Matrix in Network Security

Firepower/Firesight Compatibility Matrix

Matt — Fri, 21 Feb 2020 15:16:55 GMT

I would like to upgrade our firepower modules as well as our firesight management console. Our modules are running 5.4.0.3-37 and our FMC is running 5.4.1.2. Is there a compatibility matrix that defines which modules are compatible with which FMC versions? I have searched the below link and it does not seem to contain this information.

https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html

Re: Firepower/Firesight Compatibility Matrix

Philip D'Ath — Sat, 03 Feb 2018 05:41:26 GMT

You should keep the module version matching the FMC version. You are asking for trouble by not keeping them in sync.

Re: Firepower/Firesight Compatibility Matrix

Marvin Rhoads — Sun, 04 Feb 2018 02:53:59 GMT

Philip is correct about matching, generally speaking. However FMC 6.2.x (most recent is 6.2.2.1 as of this posting) requires the managed devices be at 6.1 or later.

If you upgrade sequentially you are in for a loooooooong process since your devices are very out of date.

https://www.cisco.com/c/en/us/td/docs/security/firepower/622/622x/relnotes/Firepower_Relase_Notes_622x/Firepower_Relase_Notes_622x_chapter_01011.html#id_52977

An FMC upgrade takes 30 minutes to an hour depending on the platform and each device upgrade of the several you will need to do per device takes from 15-ish minutes (Firepower 7000 or 8000 series appliance) to as long as an hour and a half (ASA 5506 Firepower service module).

Depending on how many devices you are managing it may be easier to unregister the the devices, update your FMC to 6.2.2, re-image the sensors to 6.2.2 and then re-register / deploy policies. then finally deploy the 6.2.2.1 patch

Re: Firepower/Firesight Compatibility Matrix

Ajay Saini — Sun, 04 Feb 2018 10:09:59 GMT

Hello,

Although its recommended to keep the FMC and managed devices at parallel versions, it's unavoidable to have both at same versions since upgrade of FMC precedes the upgrade of managed devices.

To check the compatibility, you should check the release notes of the version to which you are planning to upgrade. For example, in your case, you should check the release notes for next release like FMC 6.0 version.

Now, FMC 6.0 version release notes will indicate if you can upgrade from current version and also if it can support the current managed device(till you upgrade them as well).

https://www.cisco.com/c/en/us/td/docs/security/firepower/60/relnote/firepower-system-release-notes-version-600.html#pgfId-415774

HTH
AJ