setting up firepower module, question about interfaces

[faghouri83]

Hi all

I'm in the process of upgrading the firepower software on a Cisco 5525-X. I have updated the boot firmware to 6.2.2. Once I get into the module using the module sfr command i then enter setup to configure the ip address for the firepower module. 

My question is, what physical interface on the firewall is this ip address binded to? does the firepower ip address have to be in the same subnet as the inside interface ip?  Once i can get the firepower talking to filezilla server, i can then upgrade the rest. 

Thanks

[mikael.lahtela]

Hi,

The firepower ip address configured at setup is bound to Management 1/1.
Don't think they need to be in the same subnet as inside, but it makes things easier.
You will only access the Firepower module through the Management port, asa configuration must be access from inside or an extra oob management port.
https://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/5500X/5500x_quick_start.html

br, Micke

[faghouri83]

Thanks for the answer. I shall give it a go. 

[johnlloyd_13]

hi,

the FP module logical eth0 interface is binded to the ASA chassis management0/0 interface.

both the FP module interface and ASA management interface can be on the same subnet (for IP design ease) BUT the management functions are separate. meaning, you SSH/ASDM to ASA management0/0 IP while you use the FP module IP for FMC device registration.

here's a useful link for the ASA FP module upgrade process.

http://ccnpsecuritywannabe.blogspot.com/2017/09/cisco-asa-firepower-module-upgrade.html

[Marvin Rhoads]

@johnlloyd_13 note that the question was about the 5585-X. Those are a bit different in that they use a hardware module. As Micke noted, connectivity is via interface management 1/1 - e.g. the interface on the Firepower SSP module in slot 1.

(corrected information below - Thanks John)

[johnlloyd_13]

hi marvin,

OP said it was for a 5525-X. look closely further above :)

"I'm in the process of upgrading the firepower software on a Cisco 5525-X."

[Marvin Rhoads]

Oh - sorry about that John. You are right. Time to get my glasses checked. :)

On the ASA 5525-X the Firepower module indeed uses interface Management 0/0. That applies to the 5512-X, 5515-X, 5525-X, 5545-X and 5555-X.

https://www.cisco.com/c/en/us/td/docs/security/asa/hw/maintenance/5500xguide/5500xhw/asa_overview.html#58700

On the 5506-X, 5508-X and 5516-X they number the sole management interface "Management 1/1". 

The 5585-X has two management interfaces - Management 0/0 on the base ASA and Management 1/0 on the SSP. The latter is used for the Firepower SSP.

https://www.cisco.com/c/en/us/td/docs/security/asa/hw/maintenance/5500xguide/5500xhw/asa_overview.html#58700