Adding SSD to ASA 5555X or 5525X - general questions

[kbyrd]

I am prep'ing two HA pairs of ASAs for FirePOWER. I have (hot) installed the SSDs (two in 5555X and one in 5525X) and did not see the SSDs in SHOW INVENTORY. Upon reading the instructions in the ASA hardware guide, it says that you must reload the ASA to recognize the SSD. I reloaded the non-active 5525X and the SSD still did not show up in SHOW INVENTORY.

Questions:

1) when you install the SSD, is the old non-SSD drive still active? (Yes, because the non-active ASA reloaded with no problem, but please verify)

The instructions say to "image" the SSD. My thought was that the FirePOWER image would be the only image I would put on the SSD and I would continue to use the non-SSD for other files like the ASA and ASDM images.

2) Can you use both the non-SSD and SSD drives in a single ASA?

3) Do I need to move the files from the non-SSD to the SSD? From the instructions, it seems both are referred to as DISK0: so I'm not sure how to reference both drives individually. How would I load the FirePOWER image onto the SSD if both non-SSD and SSD are referenced as Disk0:?

The SSDs lights are illuminated after the drives were installed.

Thanks.

[Marvin Rhoads]

1. The base storage on an ASA (both legacy and X series) is a compact flash (CF) card, designated "disk0" on the ASA. The solid state drive (SSD) is in addition to - not instead of - disk0.

2. As noted above - you can (and indeed you must).

3. The SSD is not user-adressable or -accessible storage. It is used for storage by the module (sfr or cx). No file manipulation or other operations referencing the SSD directly are required of the either the user or administrator.

[Marvin Rhoads · Accepted solution]

Adding...

... when you "image" the sfr module, it is using a special boot image on disk0 compact flash card. That boot image bootstraps the SSD and the full FirePOWER module image is later loaded into and installed, making the "sfr" module fully functional (i.e. up status and ready to be setup and registered with a Firesight Management Center) 

[kbyrd]

Marvin, thank you for your detailed reply.

TAC is saying that the SSD should show up in SHOW INVENTORY, however they are saying that because the legacy IPS is enabled, that may be affecting the display of the SSD.

[Marvin Rhoads · Accepted solution]

You're welcome.

That could be - I know in the ASA with FirePOWER lab guide we were instructed to uninstall the legacy IPS module (image / application) when we find it in existence as a prep step for the sfr module. While that shouldn't per se affect the hardware inventory displayed, it could be a bug in that respect.

[jwornstaff]

I know this thread is little old but hoping to piggy back a question. I am going through the same process i.e. upgrading ASA IPS module to firepower. Should I remove the IPS module before install the new SSD, as I currently do not have SSD installed. Or will it mater?

Thanks!

[Marvin Rhoads]

Give us a few more details please. The (sanitized) output of the following would do it:

show  inventory
show module
show version

[jwornstaff]

Not sure why all the outputs needed, not looking for the technical implementation details and beside can't do that.

Was just looking for the order of operations.

1. Install new SSD drive.

2. Remove IPS Software module

3. Install SFR software module

or

1. Remove IPS software module

2. Install new SSD drive

3. Installs SFR software module

[Marvin Rhoads]

The output is requested in order to give as accurate an answer as possible. I have found over years of experience that I am not safe in assuming anything about the customer's environment since there is so much variation.

Seeing the exact equipment model (show inventory), the installed modules and their status (show module) and verifying the prerequisite version required to support a FirePOWER module (show version) all guide an accurate response.

That being said, assuming you have a 5500-X series ASA with a software IPS module installed, the order of items 1 and 2 in your list do not matter. Installing the SSD must be done while the ASA is powered off, so I would normally uninstall the IPS module first, shutdown the ASA, install the SSD and then bring the ASA back online. If you have ASA 9.2(2.4) or later (required for sfr module) then you can install the module. If you want to install newer sfr versions (e.g., 6.x) then higher releases of ASA software would be required as noted in the compatibility guide:

http://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html#pgfId-137110

[jwornstaff]

Exactly the info and reassurance I was looking for...thanks!

I'm all good on the pre-reqs and compatibility....did plenty of research on that. But understood, some don't and everyone situation is different.

[kbyrd]

The first task would be to get IOS to a level that supports both the SSD and sourcefire. I initially upgraded to 9.2.2.4, but I'm now running 9.3.3. Check to make sure compatibility with the legacy IPS.

I don't know if it matters whether you install the SSD first, then remove the legacy IPS, or vice versa. I installed the SSD first in my case.

When you remove the legacy IPS, you will need to reboot the ASA. If you have an HA active/standby pair, that task is non-disruptive.

Then you can load sourcefire.

Good luck.

[kbyrd]

Marvin, one last question, do you know if a minimum ASA firmware version is required to recognize those SSD? I'm running 9.01 and 9.02 on the two ASAs. All I can find in the release notes related to SSD is that v9.1.1 is required for the ASA CX SSP software module - which requires the SSD.

[Marvin Rhoads]

I do believe ASA 9.1(1) is required as a minimum. See the matrix in Table 3 in the ASA compatibility matrix.

Also the release notes for ASA 9.1 note under "New Features in ASA 9.1(1)" that they introduced support for the SSD-based CX SSP. 

You have to move up to at least 9.2(2.4) for for FirePOWER Service module.

[kbyrd]

I upgraded to 9.2.2.4 last evening (from 9.0(4)) and the SSD appears in the display for SHOW INVENTORY: (serial numbers masked).

C5525X-P10-DMZ# sh inv
Name: "Chassis", DESCR: "ASA 5525-X with SW, 8 GE Data, 1 GE Mgmt, AC"
PID: ASA5525           , VID: V01     , SN: xxxxxxxxxxxx

Name: "Storage Device 1", DESCR: "Model Number: Micron_M550_MTFDDAK128MAY"
PID: N/A               , VID: N/A     , SN: xxxxxxxxxxxx

Thanks again for Marvin's responses.

[gamoore]

If you are using dual SSD drives, how and where does the Raid 1 configuration take place?