ASA-SRF-FMC UPGRADE

[WEERAKOO69BA]

Dear All,

I need to upgrade ASA 5525-9.4 to 9.8

FMC(virtual )  existing version is 5.4.1

SFR existing version is 5.4.0

 My first question is  ,do I have to check the compatibility with ASA version for SRF? Or  since ,SRF totally managed by FMC,I have to check the compatibility only for FMC for SFR  .But Need to check the FMC and ASA compatibility.

Please anyone can clear my doubts.

Thank You

[Sheraz.Salim]

I just have a look you can go to 9.8 with 5.4.1. link here 

[WEERAKOO69BA]

Thanks for the reply

[Marvin Rhoads]

While, as @Sheraz.Salim correctly notes, you CAN do this I would recommend that you not do so. If you are running Firepower 5.4.x you are VERY far behind in release levels. You should be running 6.4.0.4 or later on both your FMC and Firepower service modules.

[WEERAKOO69BA]

Thanks a lot for you all prompt reply.

Could you pls clarify,do I have to check the compatibility mx of SFR and ASA?This is my confusion.

*ASA  vs FMC compatibilty need to check

*SFR  vs  FMC  compatibility need to check

*SFR vs ASA no need ,since SFR managed by FMC ?

Pls correct me if I am wrong.

[Marvin Rhoads]

You need to verify:

1. ASA vs. Firepower service module (SFR)
2. FMC vs all managed devices (including your Firepower service module)

Wherever possible, go with the Cisco-recommended "Gold Star" release (see the respective product download pages) unless there's a compelling reason not to do so.

[Sheraz.Salim]

*ASA  vs FMC compatibilty need to check --- Yes

*SFR  vs  FMC  compatibility need to check --- Yes

*SFR vs ASA no need ,since SFR managed by FMC --Yes.

you this matrix guide. https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/planning.html

and plan the downtime accordingly. 

[WEERAKOO69BA]

Thank you for the reply.

In the document you have shared ,says, need to check the ASA and SFR compatibility.

*SFR vs ASA no need ,since SFR managed by FMC --Yes  <--No need to check ,correct?

I could not find any document  given SFR compatibility with ASA.

[Marvin Rhoads]

Newer versions of Firepower service module generally require newer versions of ASA (and ASDM for those not using FMC management). 

Here is the document which has a table (Table 11) showing Firepower-ASDM-ASA compatibility:

https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html#id_60529