SFR licensing in cluster mode?

[mythosmc1]

If I am running two ASAs in cluster mode, is there any special configuration I need to do on the sfr modules ?

Does the pair of clustered ASAs forward traffic to both sfr modules?

The documentation is very vague on the topic of sourcefire clustering, all it really says is "keep consistent policies on the sfr modules and dont use zones for your rules"

Is there any additional licenses required? i.e I have 2x control + protect however only 1 AMP / URL license

Does that mean only one of the SFR modules can process Malware and URL filtering?

Any help would be greatly appreciated

thanks

[Marvin Rhoads · Accepted solution]

Are you running the ASAs in an Active-Standby HA pair with FirePOWER module on each of them?

If so, the licensing on the modules should match on each module. Otherwise, you will not be able to appply any URL Filtering or file (AMP) policies on one of the modules.

If the ASAs are truly in a 2-node cluster (not active-Standby) then it's even more important that the licenses match because flow-by-flow the traffic may take a different member as the forwarding device.

Ideally you will simply build one set of policies in FireSIGHT Management Center and apply them to both FirePOWER modules.

[mythosmc1]

Ouch, so i've gotta buy both licenses again at the FULL price?

Are there any discounted licenses if you're clustering?

thanks so much for your replies

[Marvin Rhoads · Accepted solution]

Unfortuately yes - each unit needs a license. Perhaps Cisco will eventually see the light for these Active-Standby setups like they did for the ASA licensing since version 8.3 but for now you need to match them up.

If it helps, there are some promo pricing deals on for the smaller boxes (5506, 5508, 5516 and 5525) going on through the end of July.