Cisco Firepower 9300 with ASA OS

[Sumanta Ghosh]

Hi Experts

Could you confirm the HA setup options applicable for Cisco firepower 9300 chassis (SF-F9K-FXOS2.0-K9) running ASA OS (SF-F9K-ASA9.6.2-K9)? Native ASA appliances had active/standby and active/active options, depending on single or multiple context deployment. Do we have same in Firepower 9300? I was reading something about inter-chassis and intra-chassis clustering, not very much sure though.

The below hardware is present:-

FPR9K-SM-24

FPR9K-SUP

Regards,

Sumanta Ghosh.

[Marvin Rhoads · Accepted solution]

FIrePOWER 9300 appliances with ASA logical devices have all of the high availability and clustering options as stand alone ASA appliances (including multiple context) plus the ability to run multiple ASA logical devices on a single chassis when you have multiple service modules (SMs) installed.

[Sumanta Ghosh]

Hello Marvin

Thanks very much. I would also like to know more about licensing for IPS. Does the below part codes have in built IPS, with signature update support? Or we need to order Threat Defense?

FPR9K-SM-24

Firepower 9000 Series Security Module

SF-F9K-ASA9.6.2-K9

ASA 9.6.2 Software for Firepower appliance series

FPR9K-SUP	Firepower 9000 Series Supervisor
SF-F9K-FXOS2.0-K9	Cisco Firepower Extensible Operating System v2.0 for FPR9300

L-F9K-ASA	License to run Standard ASA on a Firepower 9300 module
L-F9K-ASA-ENCR-K9	License to enable strong encryption in ASA on Firepower 9300

Regards,

Sumanta.

[Marvin Rhoads · Accepted solution]

You're welcome.

When you run an ASA logical device on a FirePOWER 9300 (or 4100 series) appliance, you do not have the option of including IPS. ASA with FirePOWER service module ("IPS") is only possible on a physical ASA appliance (5500-X series).

To run IPS on one of those appliances, you have to run a FirePOWER Threat Defense (FTD) logical device. FTD requires the Threat Defense license.