Cisco ASA 5506 Firepower

[Mosasa]

I am confused as to whether my ASA 5506 units have firepower or not. 

Reading through forums so far, I gathered that firepower is not really supported on the ASA 5506 on versions 9.10 and up. Both of my ASA 5506 are running 9.14. 

A couple of show outputs:

For the first unit:

ciscoasa# show module

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
1 ASA 5506-X with FirePOWER services, 8GE, AC, ASA5506 JAD215203TT
sfr Unsupported Unsupported

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
1 00be.7511.c26d to 00be.7511.c276 2.1 1.1.12 9.14(3)18

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
1 Up Sys Not Applicable

ciscoasa#
ciscoasa# show ver

Cisco Adaptive Security Appliance Software Version 9.14(3)18
SSP Operating System Version 2.8(1.172)
Device Manager Version 7.13(1)

Compiled on Tue 14-Dec-21 05:00 GMT by builders
System image file is "disk0:/asa9-14-3-18-lfbff-k8.SPA"
Config file at boot was "startup-config"

ciscoasa up 1 hour 18 mins

Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
Internal ATA Compact Flash, 8000MB
BIOS Flash M25P64 @ 0xfed01000, 16384KB

Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1)
Number of accelerators: 1

for the second unit:

ciscoasa# show module

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
1 ASA 5506-X with SW, 8GE Data, 1GE Mgmt, AC ASA5506 JAD202105XC
sfr Unsupported Unsupported

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
1 cc16.7e00.d922 to cc16.7e00.d92b 2.2 1.1.14 9.14(3)18

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
1 Up Sys Not Applicable

ciscoasa#
ciscoasa# show ver

Cisco Adaptive Security Appliance Software Version 9.14(3)18
SSP Operating System Version 2.8(1.172)
Device Manager Version 7.5(1)

Compiled on Tue 14-Dec-21 05:00 GMT by builders
System image file is "disk0:/asa9-14-3-18-lfbff-k8.SPA"
Config file at boot was "startup-config"

ciscoasa up 1 hour 19 mins

Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
Internal ATA Compact Flash, 8000MB
BIOS Flash M25P64 @ 0xfed01000, 16384KB

Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1)
Number of accelerators: 1

In the output above. I've denoted in bold about the parts possibly pertaining to firepower?

both units share the: "sfr Unsupported Unsupported" which I've come to understand is the actual firepower itself. But because of both units running version 9.14, do they both have firepower? furthermore, one unit says: ASA 5506-X with FirePOWER where as the other doesn't say with firePOWER nor even mention anything about firepower other than the fact that "sfr Unsupported Unsupported" is prevalent across both.

Please help understand if my units have firepower or if firepower is just not supported at all

Thanks!!

[Rob Ingram]

@Mosasa the ASA 5506-X does support the Firepower module. You are correct that ASA version 9.9 is the last supported version. So if you wish to use the Firepower module on that hardware you'd have to downgrade the ASA software version. However the Firepower module is supported to version 6.2.3, which is really old.

The ASA 5506-X hardware is EOL, you'd be better purchasing the newer Firepower 1010 series hardware and run the FTD image, which supports the latest versions 7.x.

[Mosasa]

Thanks for the reply. @Rob Ingram 

Just for clarification. Is this: "ASA 5506-X with FirePOWER services" that shows up under show module what states unit has fire power? or is it this: "sfr Unsupported " that states the unit comes with firepower? Thanks, I'm just confused as to why one says comes with firepower and the other doesn't say it and they both state sfr unsupported.

[Rob Ingram · Accepted solution]

@Mosasa the ASA 5506-X hardware comes with the Firepower services module. It's probably saying the Firepower module is unsupported because you are running a newer version of ASA software which is incompatible with the Firepower software on the module.

[Mosasa]

Sorry for the late reply,

Thank you for confirming my suspicions. Like you stated, it's because I'm running a higher software on the ASA.