Adding Firepower to ASA5512

[cjmaddalena]

How do i determine if our ASA is capable of supporting the Firepower subscription? I don't seem to see any reference of it being a -X model. I'm assuming from looking around that the -X signifies that the Firewall is NGFW and capable of running these additional services?

[Austin Sabio]

Yes. Please see below. 

ASA 5512-X with FirePOWER Svcs. Chassis and Subs. Bundle

ASA5512-FPWR-BUN

ASA 5512-X with FirePOWER Services, 6GE data, AC, 3DES/AES, SSD

ASA5512-FPWR-K9

Cisco ASA5512 FirePOWER IPS and Apps 3YR Subscription	L-ASA5512-TA=	L-ASA5512-TA-3Y
Cisco ASA5512 FirePOWER IPS, Apps and URL 3YR Subscription	L-ASA5512-TAC=	L-ASA5512-TAC-3Y
Cisco ASA5512 FirePOWER IPS, Apps and AMP 3YR Subscription	L-ASA5512-TAM=	L-ASA5512-TAM-3Y
Cisco ASA5512 FirePOWER IPS, Apps, AMP and URL 3YR Subscription	L-ASA5512-TAMC=	L-ASA5512-TAMC-3Y
Cisco ASA5512 FirePOWER URL Filtering 3YR Subscription	L-ASA5512-URL=	L-ASA5512-URL-3Y

Source: http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/datasheet-c78-733916.html

[Marvin Rhoads]

Besides being an X model (which the ASA 5512 is), you also need to be running at least ASA software version 9.2(2) or later.

You also need to have the 120 GB SSD (Solid State Drive) installed. These were not always the default on ASA 5512-X shipment s, particularly the earlier ones.

With all of that, your software module needs to be imaged as FirePOWER and then licensed, either from FireSIGHT Management Center or, as of ASA 9.5 with FirePOWER 6.0 for that model, directly from ASDM.

[cjmaddalena]

Thanks Marvin, that's really helpful. I would need to take steps to do each of those pre-reqs you have mentioned. So upgrade FW, Install SSD and i would also need to run FireSIGHT appliance.

If i was going down this path simply for IPS and URL, would you suggest OpenDNS Umbrella might be the better Cisco option? This is only for around 100 users.

Thanks

[Marvin Rhoads]

OpenDNS is certainly quicker and easier from what I've heard. I haven't had the hands on with it to say for sure based on first hand experience though.

[cjmaddalena]

Thanks Marvin, you've been very helpful