topic Re: Difference between ASA running Firepower service module and FTD in Network Security

Difference between ASA running Firepower service module and FTD

KimG — Fri, 21 Feb 2020 15:06:43 GMT

Hi,

Is there a difference between ASA running firepower service modules and Standalone Firepower 2100 FTD?

Re: Difference between ASA running Firepower service module and FTD

Francesco Molino — Wed, 10 Jan 2018 23:43:19 GMT

Hi

The biggest difference is the image. On ASA with Firepower module running the legacy ASA and Firepower have 2 different configs to manage where FTD is a unified image merging ASA and Firepower features in only 1 config management.
All ASA features are not yet implemented in FTD like Multiple Context.
Also some cli troubleshooting commands used in legacy ASA are not anymore available in FTD.

If your ASA supports FTD image, by reimaging it with FTD image, you will have exactly same features as Firepower 2100 box.

Re: Difference between ASA running Firepower service module and FTD

KimG — Tue, 16 Jan 2018 23:18:18 GMT

Thank you Francesco,

I have question to your answer,

ASA with Firepower module, have 2 configuration to manage meaning, does "Show running-config" will only show the ASA config or Both?

Can it still be managed by Firepower Management center? If yes, then the config you see in "Show running-config"does that belong to ASA or Both?

Also, Firepower 2100, if it's managed by FMC then how do you see the configuration? again, the config you see in "Show running-config"does that belong just Firepower device? Does it show the configuration configured via FMC?

Re: Difference between ASA running Firepower service module and FTD

Francesco Molino — Tue, 16 Jan 2018 23:30:19 GMT

Using show run you'll see a part of the config but not everything.
To explain that, here a copy paste of the documentation that gives details:
The show running-config command displays the active configuration in memory (including saved configuration changes) on the device. You cannot directly configure these commands. Instead, they are configured by the manager controlling the device, for example, Firepower Management Center or Firepower Device Manager.

However, this is a partial configuration. It shows what can be configured using ASA Software configuration commands only, although some commands might be specific to Firepower Threat Defense. These commands are ported to Firepower Threat Defense. Thus, you should use the information in the running configuration as a troubleshooting aid only. Use the device manager as the main means to analyze the device configuration.

Re: Difference between ASA running Firepower service module and FTD

KimG — Tue, 16 Jan 2018 23:42:08 GMT

Thank you Francesco. That helps.

Re: Difference between ASA running Firepower service module and FTD

Francesco Molino — Tue, 16 Jan 2018 23:42:43 GMT

You're welcome