ASA 5506-X: "Module Firepower is not supported on this platform”

[db62]

Hi,

So I was upgrading an ASA 5506-x from 9.9 to 9.10 using the "Tools / Check for ASA/ASDM updates..." function of the ASDM launcher.

It found the 9.10.1 update, but then a message box popped up:

"Module Firepower is not supported on this platform”

Excuse me?

A quick search led me to the 9.10 Release Notes, which say, quote:

No support in 9.10(1) for the ASA FirePOWER module on the ASA 5506-X series and the ASA 5512-X—The ASA 5506-X series and 5512-X no longer support the ASA FirePOWER module in 9.10(1) and later due to memory constraints [emphasis mine]. You must remain on 9.9(x) or lower to continue using this module. Other module types are still supported. If you upgrade to 9.10(1), the ASA configuration to send traffic to the FirePOWER module will be erased; make sure to back up your configuration before you upgrade. The FirePOWER image and its configuration remains intact on the SSD. If you want to downgrade, you can copy the ASA configuration from the backup to restore functionality.

Would anyone at Cisco care to address this loss of functionality that was bought and paid for, due to an "upgrade"? I'm sure some users might have something to say about this... And this thread might be relevant too...

Thank you kindly.

[Kasun Bandara]

thanks Rhoads,

hope cisco will release something new which is for SMB customers. also i found 5506-X is not enough powerful to manage FP as well as FTD in my testings. hope cisco will do something for that. :)

[mschiessl]

we just bought a whole set of 5506X w/firepower from a trusted vendor and we were not made aware that those devices are discontinued.
In advance we also bought the TAC Lics to maintain support for all of these devices.

Hearing now that they might be discontinued (and seeing it on my own ASA that FP ist not showing up anymore does not give me a good feeling of trust regarding cisco maintainence policy)

Of course we want to use the latest images due to feature and of course security reasaons - so not giving us for what we paid without any notification is not the best behaviour

[Marvin Rhoads · Accepted solution]

The ASA 5506 is not yet discontinued. Only new Firepower Threat Defense and Firepower service module 6.3 is not available for them. New ASA software will continue to be made available as will maintenance releases of the 6.2.x Firepower train.

Once the hardware EoX announcement is made it will follow standard Cisco policy for support timelines.

[mschiessl]

well, just bought those 5506x wihtout any notice upon the regarding topic from the vendor is a real shame.

So pointing to the 5508x because of the above reasons would have been a really good recommendation from cisco and vendor.

We clearly stated that we're in urge of using FP ...

rolling back to 9.9.2 now on the staging asa

[Marvin Rhoads]

Yeah it's too bad your vendor wasn't able to give you better advice. Maybe it's time to consider using another partner.

[ecarlseen]

"Yeah it's too bad your vendor wasn't able to give you better advice. Maybe it's time to consider using another partner."

While having a great vendor partner is certainly a desirable situation, distinguishing levels of competence is problematic from a customer standpoint. We use two Gold-Certified partners and have gotten plenty of incorrect information over the years. Because of this, we make a practice of verifying as much as we can ourselves.

The implication in this case is that Cisco deliberately withholds information about material functionality and product roadmap differences in released products from the general public, which is deeply problematic both morally and legally.

[Marvin Rhoads]

Every vendor makes plans about future product directions that are only announced at a certain point. When that point is is neither a legal or moral issue but rather a business decision. That applies whether is it Cisco, Juniper, Arista, or even WalMart.

[willb1]

Just came across this thread. This is ridiculous. Why continue to sell the 5506X if the Firepower module isn't supported in the latest IOS versions? We purchased a batch of these ASA's 2 years ago, now we have to consider replacing them again in order to stay up to date?

[briancarson]

Oh fraq. I had scuttled the ASA/SF setup and went with the single image using FDM. I only just discovered they were discontinuing support of the 5506 on the FDM/FTD side thanks to one of Lamlle's posts last week. After confirming with TAC, I was encouraged to switch back to ASA. I can't say I'm surprised that Cisco yanked FP out of the 5506. I am ticked at the lack of communication. With the amount of newsletters and AnyConnect updates they send me, you'd think something about my contracted device getting EOL'd would make the cut. It shouldn't be surprising that they are still advertising the ASA5506X w/ Firepower Services. 

Does the revamp make it more or less a copy of the 5505 now? ...like it probably should have been...

I pinged my Charlie Delta Wiskey source to see if they were aware. This isn't going to be a fun confab with my management.