Firepower 2100 FTD or ASA mode?

[Steven Williams]

I have just received my first set of FP2100s and I am reading some quick start guides and other Cisco documentation and I am trying to understand the FTD mode vs ASA mode and what limitations each has? Also what is the "common" method for deployment. These will be edge firewalls that strictly terminate SSL VPN endpoints and that is it. 

[balaji.bandi]

If you purchased 2100, Suggest to Install FTD, since you  are not looking old ASA legacy feature and you looking only remote access vpn solution.

(personally and eventually Cisco will retire ASA code) - for longer support i go with FTD code.

here is the good document FTD - remote access setup.

https://www.cisco.com/c/en/us/support/docs/network-management/remote-access/212424-anyconnect-remote-access-vpn-configurati.html

you can also see VPN Limitation ASA vs FTD

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/fdm/fptd-fdm-config-guide-640/fptd-fdm-ravpn.html

The Firepower 2100 Series hardware can run either FTD software or ASA software. Switching between FTD and ASA requires you to reimage the device

[Steven Williams]

Do I need to run FTD version same or lower than my FMC code? I am running 6.2.3 on my FMC and all my SFRs are also running 6.2.3 or 6.2.2

[balaji.bandi]

If you like a standard in the organization, (if i were you, i maintain all same version, so each to manage), until i go another version if the features not supporting?

[Steven Williams]

I think it's more of a does the FMC at code 6.2.3 manage a FTD at a higher Code level. Some solutions need to have the management tool higher or same as devices it manages.

[balaji.bandi]

Best Practice, Management needs to be always a high version to manage the device, if the lower version, it can not manage higher version code device, since it was not understood well? make sense?

[Steven Williams]

Yes so i should run 2100s at 6.2.3 or update my FMC.

[balaji.bandi]

Last i have worked FMC Stable one 6.4 , i have seen 6.5 released recently.

check the matrix before you upgrade and work with the version you are comfortable ( as long as the feature supports your needs)

[Rahul Govindan]

Correct. The FMC version is always higher than the managed device. The FMC will not let you register a device with a higher version than itself.

[simong]

I have have a pair of FP2110 devices running FTD v6.2.3.x in HA mode for over a year with no issues.  Recently upgraded to 6.4.0.4 and found static PAT to be unsupported (TAC case currently open). 

One point you may wish to consider is SSL HW acceleration which is only available on 2100 series from v6.3.  It may be worthwhile in your use case as SSL RAVPN headends.

Also, the FMC has been upgraded to v6.4 for a while now and continues to manage v6.2.3.x FTD sensors.

Regards,

Simon

[Steven Williams]

Seems to be for SSL decryption as it pertains to HTTPS, I am just going to be terminating about 7,000 SSL Anyconnect Clients.

[balaji.bandi]

If you looking 7000+ active session, choose the right model - i have shared other document in the previous post.