Cisco ASA FTD vs Firepower Software

[rjadhav163]

Hi

I am confused between Firepower FTD stuff and Firepower Services Software. So following are my questions based on what I understood:

With Firepower Services Software module:

1. You have your normal ASA OS and then you download the Firepower Services Software. Or is the compatible firewall always shipped with the Firepower Services Software pre installed?

2. So ASA will do - Routing, ACLs, NAT, VPN

          Firepower Services Software will do - AVC, URL Filtering, NGIPS and AMP

Is this understanding correct?

3. ASA as well as Firepower Services Software can be managed by ASDM and CLI. But only Firepower Services Software can be managed by Firepower Management Center i.e. only the above mentioned 4 functions of Firepower Services Software can be controlled by Firepower Management Center.

With FTD Image

4. There is only one image on the firewall. Correct?  (I say image because to install FTD I somehow need 2 files: like a *.lfbff file. and a .pkg file. Still confused why)

5. All the functions mentioned above for ASA as well as those provided by Firepower Services Software will be managed ONLY by Firepower Management Center. That means even if I have to add a simple ACE then I need to do it using the Management Center? Correct?

Please Clarify. Everything  with FTD/Firepower is really confusing. :-(

[Marvin Rhoads · Accepted solution]

1. The ASA is available both with and without the FirePOWER software module pre-installed. It no extra cost to specify it with so we (my company that it and other partners) typically specify it with so that it's already there in case the customer wants to activate it later.

2. That's the overall delineation of functions. The FirePOWER functions do require licensing. AVC is included with the no-cost Control license but NGIPS, URL Filtering and Malware (AMP) are licensed features that must be purchased separately.

3. Correct. (Plus you can also manage ASAs with CSM.)

4. One file, one binary image package.

5. Correct as of 6.0. (Note not all legacy ASA features are currently available in FTD - notably missing are all types of remote access VPN.) Stay tuned for changes to that with the release of 6.1 this summer.

[rjadhav163]

Thanks Marvin.

Additional Question:

Assume that I have one legacy ASA (like 5525-X) without Firepower Features enabled and another ASA (like 5508-X with Firepower) with Firepower Services Module (that is pre v6.0). And now I want to migrate them to FTD and manage them with Management Center.

What is the best way to migrate objects and ACLs and other settings (ofcourse not VPN as you mentioned) ? Do I have to manually enter everything on the Management Center? 

That would be a pain if you have 100s or 1000s of objects!

[Marvin Rhoads]

The best way would be to wait until 6.1 is out in Summer 2016. There will be a standalone migration tool available then capable of migrating objects and ACLs. Over time that tool will be enhanced and integrated into FMC.

[rjadhav163]

Thanks Marvin.

Unfortunately cannot wait till that long. Have to migrate the stuff next week. Is there a CLI Interface / Shell that I can use to atleast enter objects into the Management Centre.

[Marvin Rhoads]

rjadhav163  

Sorry but there's no such capability at present.

[bernardovr]

Hi Marvin,

I have a question of the ASA 5516-X FTD, I want to reimage this device with an ASA IOS, because the costumer want to have the ASA conifguration via CLI. My doubt was, if I reimage this ASA with ASA IOS can I deploy the sfr module and integrate with Firepower Management Center? or we lose the module with capabilities Firepower as you mentioned with the appliance 4110?

Thanks!

[Marvin Rhoads]

bernardovr  ,

When you reimage an ASA with FTD to ASA image type, you have a "regular" ASA capable of running the Firepower service module.

Note the license types for FTD vs. Firepower service are different so the device would have to be relicensed for Firepower services. There is no "migration license" or such.

[bernardovr]

Hi Marvin, 

Thanks for the answer, one question more the relicense has no cost? Or the costumer must buy the license. 

Thanks!

[Marvin Rhoads]

You're welcome.

They are different license SKUs with different costs. The new image would need newly purchased licenses. If it is a significant deal size, you may want to speak with the account manager from Cisco for potential relief on the cost.

[anil.kumark]

Hi Marvin,

Kindly post any document over the difference of ASA with firepower & FTD. When to choose which one would help us to understand the product better.

[Marvin Rhoads]

[@anil.kumark]  

For now the respective data sheets are the best publicly available source. If you work with your partner or Cisco SE, they can assist with additional information to guide your decision making.

[anil.kumark]

Thanks Marvin however I am looking for limitations around the technical implementation of FTD and ASA here,

1. Does the 4100/9300 appliance support running ASA image with firepower service as software just like the ASA X series?

2. Do the 4100/9300 appliance support running ASA or FTD operation with inter & Intra clustering?

3. Do the 4100/9300 appliance support running ASA or FTD image in HA mode (active/standby or active active) in intra and & inter chassis? 

[PAUL GILBERT ARIAS]

Hi, Where you able to get the answers? I am supposed to deploy a 4110 but I need it in ASA mode so that we can run similar things as the ASA 5500X. Is this possible?

[Marvin Rhoads]

4110 with ASA image supports all base ASA features (stateful firewall, L2L VPN,remote access VPN etc.).

It does not and will not support FirePOWER module.