ASA 5506 ASDM can't connect to Firepower module

[Javid_B]

Hi everyone, 

Not long time ago started to see such problem. I'm using the default ASA firewall config (inside is 192.168.42.253/24) and setup the FirePower module to use 192.168.42.203/24. I can ping the FirePower module from my PC and from the ASA's CLI and can connect via SSH. 

I've ran "show module" and the sfr module is Up/Up, and I have IP connection with the module from the ASA CLI. 

ASDM log from Java console show "Failed to connect to FirePower, continuing without it"

ASA version - 7.6(1)

ASDM version - 9.6(1)

Firepower module version - 6.0.1.4-82

Java version - JRE 1.8.0_181 x86

Help please.

[Javid_B]

I've ran "show module" and the sfr module is Up/Up, and I have IP connection with the module from the ASA CLI. 

ASDM log from Java console show "Failed to connect to FirePower, continuing without it"

ASA version - 7.6(1)

ASDM version - 9.6(1)

Firepower module version - 6.0.1.4-82

Java version - JRE 1.8.0_181 x86

Help please.

[Marvin Rhoads]

Is this a lab device or is it passing production traffic?

If it's in the lab I would just go ahead and re-image it and start over with version 6.2.3.

If it's in production I'd open a TAC case. It may have more issues that just ASDM access.

[Javid_B]

Is this version supported by:

ASA version - 9.6(1)

ASDM version - 7.6(1)

or I need to upgrade everything?

[Marvin Rhoads]

Your ASA software is OK with respect to compatibility. For ASDM, you should use 7.9(2) with Firepower 6.2.3.x.

Reference:

https://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html#id_59075

[Javid_B]

Ok. Thank you. As I understood I have to uninstall current version of FirePOWER and install the new version 6.2.3.x with .img and .pkg files downloaded from cisco. Am I right?

[Marvin Rhoads · Accepted solution]

Yes, that's correct.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa93/configuration/firewall/asa-firewall-cli/modules-sfr.html#pgfId-1485825

...except that you shutdown and uninstall the sfr module in your use case (not ips) and then follow the procedure as written.

You'd start with 6.2.3 (asasfr-5500x-boot-6.2.3-4.img and asasfr-sys-6.2.3-83.pkg) and then patch it to 6.2.3.6 (Cisco_Network_Sensor_Patch-6.2.3.6-37.sh.REL.tar).

Those files can all be found here (entitlement required to download):

https://software.cisco.com/download/home/286283326/type/286277393/release/6.2.3.6

[Javid_B]

Thank you!

[puddephad]

Hi Marvin, quick question. I have a similar issue where ASDM access to FirePower is intermittent, it loads but sometimes it asks for the SFR IP address and port and then opens but it loses access, whilst in operation (as per the picture).  If this is an easy fix for this great, however if I was to re-image to 6.2.3.6 would my FirePower backup from 6.2.2 work? Reconfiguring FirePower would cause me some pain.