ASA5555 software modules not supported and cannot uninstall

[Semi-amateur]

Hi, I just update firmware to the latest with my asa5555-x. Appliance works otherwise, but I get the following two errors on boot:

IPS module is no longer supported and was prevented from booting
Consider uninstalling the unsupported IPS module with the command ‘sw-module module ips uninstall'
CXSC module is no longer supported and was prevented from booting
Consider uninstalling the unsupported CXSC module with the command ‘sw-module module cxsc uninstall'

When I try to run the given uninstall commands, the command fails for both of them with:

asa# sw-module module ips uninstall
Unable to uninstall Module ips, it does not have a software image installed.
asa# sw-module module cxsc uninstall
Unable to uninstall Module cxsc, it does not have a software image installed.

How could I get rid of those warnings? The device works otherwise perfectly.

[AViftrup]

This might only be a cosmetic error.

Could you please provide the output of "show module" and post in here?
Also could you please provide us with the version you upgraded to?

EDIT: However you could be hitting https://bst.cisco.com/bugsearch/bug/CSCvn61662 - even tho it is more oriented for the cxsc module. 

[Semi-amateur]

Thanlks for the reply, here is output of sh module:

asa# sh module

Mod  Card Type                                    Model              Serial No.
---- -------------------------------------------- ------------------ -----------
   0 ASA 5555-X with SW, 8 GE Data, 1 GE Mgmt     ASA5555            
 ips Unknown                                      N/A                
cxsc Unknown                                      N/A                
 sfr Unknown                                      N/A                

Mod  MAC Address Range                 Hw Version   Fw Version   Sw Version
---- --------------------------------- ------------ ------------ ---------------
   0 00a3.8e58.f5bc to 00a3.8e58.f5c5  3.0          2.1(9)8      9.14(4)23
 ips 00a3.8e58.f5ba to 00a3.8e58.f5ba  N/A          N/A
cxsc 00a3.8e58.f5ba to 00a3.8e58.f5ba  N/A          N/A
 sfr 00a3.8e58.f5ba to 00a3.8e58.f5ba  N/A          N/A

Mod  SSM Application Name           Status           SSM Application Version
---- ------------------------------ ---------------- --------------------------
 ips Unknown                        No Image Present Not Applicable
cxsc Unknown                        No Image Present Not Applicable

Mod  Status             Data Plane Status     Compatibility
---- ------------------ --------------------- -------------
   0 Up Sys             Not Applicable
 ips Down               Not Applicable
cxsc Down               Not Applicable
 sfr Unresponsive       Not Applicable

Mod  License Name   License Status  Time Remaining
---- -------------- --------------- ---------------
 ips IPS Module     Disabled        perpetual

[Marvin Rhoads]

The boot messages are indeed just cosmetic and do not affect the operations of your ASA in any way. Only the sfr (Firepower services) module will work with your ASA 5555-X and even that is past end-of-sales. FYI, the sfr latest release for the ASA 5555-X was 6.6.7.1 and that requires ASA 9.14 or lower (and a license which is no longer sold) to operate.

9.14 is the last version of software available for the ASA 5555-X. It was first released in September 2020 with the last interim build of 9.14(4) having been released in February 2023.

[Semi-amateur]

I'm using just that version:

asa# sh ver

Cisco Adaptive Security Appliance Software Version 9.14(4)23
SSP Operating System Version 2.8(1.200)

Compiled on Wed 15-Feb-23 19:58 GMT by builders
System image file is "disk0:/asa9-14-4-23-smp-k8.bin"
Config file at boot was "startup-config"

asa up 11 hours 58 mins

Hardware:   ASA5555, 16384 MB RAM, CPU Lynnfield 2800 MHz, 1 CPU (8 cores)
            ASA: 8564 MB RAM, 1 CPU (2 cores)

[Marvin Rhoads · Accepted solution]

So you are all good. Only the sfr module is installed and it appears to be not fully initialized. That's not problem as it only works with a license which you presumably do not have (and if you don't, they are no longer for sale).

You can just ignore all of the module messages and status and operate the ASA as a traditional layer 4 firewall.

[Semi-amateur]

Thanks, basic firewall functionality is really all I need. Value on this device was amazing, bought this for 40$.

BTW does the HA configuration still work without those modules if I find another ASA5555-X?

[Marvin Rhoads]

HA works without the sfr module installed as long as both ASAs have that state.