Recommended version of ASA and SFR

[ymadheka]

Hi Team,

We have a customer that has recently purchased firepower services on existing ASA but would like to test the functionality of firepower on ASA with SSL inspection capabilities in production firewall. We would like to understand based on the existing versions available and field response which is the best recommended  version to start with.

Current Version: ASA 5545 with 9.2.2.4 and SFR 5.4.0


Kindly advise.

Thanks & Regards,

Yogesh Madhekar

[Karsten Iwen]

You should use at minimum version 6.0 of SFR. This is also needed if you want to use SSL inspection. The ASA also has to be upgraded to at least version 9.4(2).

You find more on the requirements in the release-notes.

[Oliver Kaiser]

Use 9.6.2 for ASA and 6.0.1.2 for Firepower. FP 6.1.0 has introduced some critical bugs that are not fixed yet (6.1.0.1 scheduled for december).

As Karsten stated, 6.0 is required for SSL inspection but keep in mind that the performance hit for using ssl decryption is about 80% because its done in software.