Upgrade ASA software on ASA5585X with SSP-20 Module

[CiscoPurpleBelt]

Reading the docs, I dont see anything wrong with just upgrading the ASA software on a 5585X Chassis that has a SSP-20 module. Does this sound right?

[balaji.bandi]

May be we should not confuse ourself here - i did one time

5585-X is chasis, it has module. SSP-20   - you are in right path  ASA Upgrade.

Do not confuse with SFR Module that is different.

[CiscoPurpleBelt]

Not sure if I know what you mean. Yes traffic is sent to it via policy I see in promiscuous mode, my question is if upgrading the ASA to different software without doing anything to the IPS will have an effect?

[Marvin Rhoads]

Please share the current and planned version of ASA software as well as the current IPS module type (i.e,, is it really the legacy IPS or actually the more recent Firepower module?) and details of its current version.

This is important because it is possible to upgrade to an ASA version that's incompatible with your IPS module.

[CiscoPurpleBelt]

It is currently ASA version 9.6(3)1 and upgradoing to ASA9-12-4-smp-k8

IPS version is 7.1(11)E4

[balaji.bandi · Accepted solution]

i mean if you like to upgrade - you can go independtly, make sure it is compatable.

below matrix will help you :

https://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html

[CiscoPurpleBelt]

Here is the thing, I cant even log into it, and I dont think it is doing anything because no protocols boxes in the settings are even checked for it to inspect. I thought I could verify if a license even exists from the regular ASA module but it does not reference any IPS licenses.

[balaji.bandi]

Loging to ASA command level

post below output -

show version

show modules

show inventory

[CiscoPurpleBelt]

I cant unfortunately I would need to type.

[Marvin Rhoads · Accepted solution]

Most likely it's not is use. If it was, you would see reference to in in your policy-map with an entry for it under a "class <class map name>" line with action "ips" under it.

https://www.cisco.com/c/en/us/td/docs/security/ips/5-1/configuration/guide/cli/cliguide/cliSSM.html#wp1030972

The old style IPS that you have has been end of life for several years and even if the ASA is configured to send traffic to it for inspection it's not very effective in the current threat landscape. You can remove the inspection entry (if indeed there is one) and then upgrade the ASA according solely to the compatibility matrix posted earlier.

[CiscoPurpleBelt]

There is a policy I see referencing IPS, but it is set to fail-open and in promiscuos mode so I assume it is really not even doing anything.

The GUI shows boxes for protocols to check un-checked as I explained eariler. Should be ok you think?