cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2410
Views
12
Helpful
13
Replies

ASA FirePOWER services vs FTD

tato386
Level 6
Level 6

Is the SFR module on an 5516X ASA considered an FTD? Reason I ask is that I have FMCv v7.0.1 managing ASA 9.16 devices that have V7.01 Firepower code installed. The option to upgrade to Snort3 seems to be available but documentation says Snort3 is only for FTD. Can I upgrade these devices to Snort3?

 

Thanks,
Diego

1 Accepted Solution

Accepted Solutions

Marvin Rhoads
Hall of Fame
Hall of Fame

Snort is the IPS engine in Firepower - both as part of FTD and Firepower service modules.

Even if your ASA Firepower service module supports version 7.0 (not all do, but the ASA 5516-X does) Snort 3 is only supported on FTD devices (i.e.  not ASA with Firepower service module).

 

(edited to correct my earlier incorrect reply that we could run Snort 3 on a Firepower service module - we CANNOT.)

View solution in original post

13 Replies 13

Octavian Szolga
Level 4
Level 4

Hi,

FTD is not ASA with Firepower Services.

You do not seem to have FTD.

You manage using FMC your Firepower Services module installed on top of ASA software and hardware.

 

BR,

Octavian

Yes, I would agree with that.  My worry is all the Snort3 documentation I find references only FTD but yet the FMC is giving me the option to upgrade.

 

Snort3-upgrade.PNG

 

Marvin Rhoads
Hall of Fame
Hall of Fame

Snort is the IPS engine in Firepower - both as part of FTD and Firepower service modules.

Even if your ASA Firepower service module supports version 7.0 (not all do, but the ASA 5516-X does) Snort 3 is only supported on FTD devices (i.e.  not ASA with Firepower service module).

 

(edited to correct my earlier incorrect reply that we could run Snort 3 on a Firepower service module - we CANNOT.)

Very glad to hear that.  I wish the documentation would specifically mention the ASA FP services platform somewhere to avoid doubt.

 

Thank you sir.

Marvin,

 

I finally got a chance to try to upgrade the firepower services module (currently on v7.0.1) to Snort3 and the FMC told me the device was not compatible with snort3.  Maybe snort3 is only for ASA hardware that has been re-imaged as FTD device?  Should I open a ticket with TAC for further investigation?  Thanks

@tato386 sorry my earlier response was incorrect. I have since also verified that we cannot run Snort 3 on a Firepower service module.

I've corrected my earlier response. Sorry for the confusion

no worries! I just wanted to make sure I wasn't missing something.

 

Thanks

patoberli
VIP Alumni
VIP Alumni

Sorry to re-awaken this old thread, but I just discovered that somehow it was possible to run SNORT 3 on a 5516-X:

patoberli_0-1686577703110.png

Surprisingly this even worked, although this ASA just run out of memory. 

@patoberli the difference is that it is running FTD - not the Firepower service module.

In that specific case it's officially possible to run Snort3? If yes, then I really interpret the release notes differently

Yes it is possible with 7.0+ @patoberli. See the release notes here: https://www.cisco.com/c/en/us/td/docs/security/firepower/70/relnotes/firepower-release-notes-700/features.html

The section heading "Snort 3 for FTD" does not restrict what platform running FTD 7.0 it applies to.

There it indeed isn't stated, unlike here in the configuration guide https://www.cisco.com/c/en/us/td/docs/security/firepower/70/snort3/config-guide/snort3-configuration-guide-v70/overview.html where they state:

  • Hardware support—Snort 3 is supported only on FTD of version 7.0 and above. Snort 3 is not supported on ASA 5500-X or Firepower 7000 and 8000 series devices.

Or do they mean by "FTD" only the module and not if it's running full "FTD" image? I assume not, based on the wording. 

I believe the document you cited should read "ASA 5500-X with Firepower service module".

The screen shot posted here earlier (as well as my own experience) shows that to be a documentation error.

Review Cisco Networking for a $25 gift card