ASA 9.1 and Context-Aware

[rustamovea]

Hello,

I'm going to upgrade our ASA5525-X to the new 9.1(1) software which should support new ASA CX.

Has anyone tried new version of software with Context-Aware? Do I need to buy licence to enable CX?

Thanks and have a good day!

[rustamovea]

I upgraded the ASA image to 9.1(1). I'm struggling with the ASA CX software installation.

I use this procedure to install the CX software, but I'm stuck on step 7.

When I enter sw-module module cxsc recover boot I'm getting error:

Storage device not found.  Install drive and try again.

[jan.nielsen]

I believe you need a hardware kit for CX to work which comes with the license, as it needs a harddrive in the ASA to run

[rustamovea]

The ASA CX module might be a hardware module or a software module, depending on the ASA model. For ASA5525-X which I'm using it should be a software module.

[Marvin Rhoads]

Can you do a "dir disk0:" and confirm the output shows the file  asacx-boot-9.1.1.img which you copied onto there?

[jan.nielsen]

Ah, i missed that you were trying the new software based version, i have a 5585x with cx module sitting in my lab :-)

[rustamovea]

dir disk0: shows that I have the image:

135    -rwx  69318656     09:41:10 Dec 06 2012  asacx-5500x-boot-9.1.1-1.img

I tried to delete it and reupload it again, but I'm still getting the same error.

Storage device not found.  Install drive and try again.

[Marvin Rhoads]

Hmm that looks correct. Assuming you did the previous step correctly. i.e.:

sw-module module cxsc recover configure image disk0:asacx-5500x-boot-9.1.1-1.img

...then you should be all correct.

It might be time for a TAC case.

[jan.nielsen]

I just checked, and i am sure you actually need a harddrive in the ASA to use CX, even the software version.

[rustamovea]

I think you are right. I'm going to check with our supplier if we can get a hard drive for the ASA so we can install the software. Otherwise I'll raise  a ticket with Cisco TAC. Thanks.

[Marvin Rhoads]

I know from partner training that the CX software lives on an on-board SSD. When ordered with a new ASA X series, it comes installed.

The configuration guide doesn't explicitly identify the need to order an SSD separately for an upgrade to CX on an existing X series. However, an e-mail I just reviewed from Cisco indicates that orderability for the SSDs will begin in the next few weeks with shipment beginning in January.

[rustamovea]

By the way did you play with the CX feature? Is it worth spending time and money on?

[Marvin Rhoads]

Yes I worked through the labs with the CX and Prime Security Manager (PRSM). It's pretty complex to setup. If you've ever used ISE and you liked that, then you'll love CX. ;)

Sent from Cisco Technical Support iPhone App

[alanc3141592654]

Does any body have further views or thoughts on the software based CX for the 5500-x series?  This is a direction we're looking into.

Is it really that complex to set up?

I've checked out some of the overview videos and it looks pretty awesome!  But I know it is a very new product for the 5500-x series.  I just don't see the point of utilising the IPS module for the X series, when the CX will be the main direction for Cisco.

Cheers,