Check if ASAs have Firepower Service Modules?

[jmaxwellUSAF]

Hello.

Are Firepower Service Modules separate physical cards inside ASAs?

We have a few ASA5525s, and an ASA1120. How do I check if these devices already have installed Firepower Service Modules?

Thank you.

[MHM Cisco World]

show module sfr details

This give you some detail about sfr if it add or not.

MHM

[Rob Ingram]

@jmaxwellUSAF use the command " show module sfr " on the 5525-X, the 1120 does not support the Firepower Services Module.

[balaji.bandi]

ASA5525 - you can see front there is SSD installed or you can also boot and look

show modules

show module ips details (if installed)

1120 is latest Firepower (you can boot and check is the FTD image or ASA image)

[jmaxwellUSAF]

Thank you for your replies.

May you please reply to the questions below?

1. Is the ASA5525 Firepower module  hardware?

2. How do I check the Firepower status on an ASA1120?

2. Does below mean the module is not physically present, or not turned on?

# show module sfr

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
sfr Unknown N/A FCH1944K3Y8

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
sfr 76a2.e5d7.f0f1 to 76a2.e5d7.f0f1 N/A N/A

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------
sfr Unknown No Image Present Not Applicable

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
sfr Unresponsive Not Applicable

--

Thank you.

[Rob Ingram · Accepted solution]

@jmaxwellUSAF the Firepower Services Module is an application that runs on the SSD of the ASA hardware. This hardwares runs the ASA software image AND if the Firepower Service Module is present can redirect packets to the FPR Services Module for inspection.

The Firepower hardware (including the 1120) do not support the Firepower Services Module, you either run just the ASA software image without Firepower functionality or you run the FTD software image instead of the ASA image, the FTD image is the NGFW.

[MHM Cisco World]

show module sfr details

Add details and share output.

MHM

[jmaxwellUSAF]

# show module sfr details
Unable to read details from module sfr

Card Type: Unknown
Model: N/A
Hardware version: N/A
Serial Number: FCH5302K1G3
Firmware version: N/A
Software version:
MAC Address Range: 74a2.e6d4.b510 to 74a2.e6d4.b210
Data Plane Status: Not Applicable
Console session: Not ready
Status: Unresponsive No Image Present

[MHM Cisco World]

It not up and not work

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/200889-Using-ASDM-to-manage-a-FirePOWER-module.html

[balaji.bandi]

You have module you need to re-image for that to work.

https://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configure-firepower-00.html

check compatability matrix what version require to re-image :

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/compatibility/threat-defense-compatibility.html

[jmaxwellUSAF]

"You have module"

... how do you know that?

[Rob Ingram]

@jmaxwellUSAF if you had a working module I would expect the output to be as below, but the output you provided above does not confirm the Card Type or even the Model.

ASA5525# show module sfr details
Getting details from the Service Module, please wait...

Card Type:          FirePOWER Services Software Module
Model:              ASA5525

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/200889-Using-ASDM-to-manage-a-FirePOWER-module.html

The output above from your ASA 5525-X?

[Marvin Rhoads]

The ASA 5525-X has the capability to run a Firepower service module but it requires the optional solid state drive (SSD) in addition to system software boot (img file) and system software package (pkg file). So, in that sense, they are both hardware and software.

They are also end of sales, so even if you had the images you would need licenses which are no longer sold to enable the features.