Is our ASA5506X underpowered for FirePower?

[BE_IT]

We have an Active/Standby configuration with 2 ASA5506X's with ASA version 9.6(4)17 and ASDM Version 7.6(1).  We have stopped subscribing to Firepower because every once in a while, Firepower basically brings the throughput of the network into single digit kbps.  After a few interactions with TAC, they turn off Firepower and things come back to normal.  So I decided not to continue with the subscription since it does that.  I've been hearing rumors from various "experts" who have been telling us that we were doomed from the beginning by buying the Firepower services with the the ASA's - that they were never powerful enough to host Firepower.   As far as I know, they are regular ol' ASA5506X's with 8GB or RAM.  Would a RAM upgrade help?  Can I even do that?  Should I move on to some other firewall solution?  We are a small company and the ASA5506X's were reasonably priced.  I looked into the ASA5508X and for some reason the initial licensing for Firepower and SMARTnet on that device is more expensive than the device itself!  

Any tips?

[johnd2310]

Hi,

How much traffic are you sending through the ASA and what features are you using on the firepower?

Thanks

John

[BE_IT]

Hello John.  We typically see 40-50 Mbps traffic being pushed through the firewall based upon the little graphs on the ASDM home page.  To be honest, we only had a fresh install of Firepower.  We were never able to even get to the monitoring screens because it wasn't fully set up right.  So whatever the default installation had for IDS, IPS and content filtering, but as I said, we never got to set up any filtering.

[johnd2310]

Hi,

I think  you should look at getting the firepower module configured correctly. Once you have the module configured and working, you can run the firepower in monitor mode where it has a view of the traffic but does not impact throughput. Once you under stand the traffic flowing through  the  asa, you can slowly build your rules.

Thanks

John

[Marvin Rhoads]

ASA 5506 with Firepower has been a bit of a stretch on the device's capabilities. It works but it's no speed demon. 40-50 Mbps is at the edge of it's upper limit if you're pushing all traffic to the Firepower module for inspection.

If you look at the release notes for ASA 9.10(1) you will note that Cisco will no longer support Firepower on the 4 GB models such as ASA 5506-X as of that new release.

Unfortunately you cannot upgrade the RAM on these devices.