Swapping SSDs during ASA replacement

[od-slav777]

Hello, 

I have several 5516 and 5506 ASAs to replace. Replacing with "one to one".Someone told me that Firepower software portion sticks to hardware, so if I swap SSD from an old ASA to a new one, SFR module won't boot up. I tested that myself between two new ASAs swapping SSDs, SFR booted just fine. I wounder if there are any issues and it's allowed to swap the SSD during replacement. 

Thank you!

[Marvin Rhoads]

If Firepower is installed on an SSD it can be swapped and will boot following a hard (power cycle) or soft reload.

Obviously a blank SSD won't automagically install the software. :)

[richard-ziga]

I will be replacing ASA5516-FPWR-K9 and I have been told that the SSD has to be partitioned and re-imaged, is this correct?

[Marvin Rhoads]

It depends on its current state and the version of software that's installed.

When the ASA finishes booting and initializing the module, run "show module sfr detail" to see the current status.

You don't normally have to partition the SSD but you do need to ensure it has the proper version of software for compatibility with your FMC (the module can't be at a higher level than FMC) and general operational considerations (i.e. you should run the latest versions in most cases).

[richard-ziga]

Thanks for the quick response!  I am replacing a ASA5516-FPWR-K9 with another ASA5516-FPWR-K9.  I plan on a FMC backup and copying the image, configuration from the ASA to a USB.  Can the SSD just be moved to the new device? 

I am surprised that the Cisco does not supply a set of instruction for a RMA replacement...

[Marvin Rhoads]

An FMC backup only backs up FMC itself or sensors running Firepower OS (i.e., 3D series). It won't backup a Firepower service module.

An ASA firepower module needs to be bootstrapped and registered to FMC. Then you can apply Platform and Access Control policies to it.

I haven't tried just moving the SSD. It's worth a shot. I agree the documentation on that is lacking.