Upgrading the built-in FireSIGHT in ASA5506-X

[LJ Gabrillo]

Hi Everyone,

So, have a new ASA 5506-X here fresh from the box, but the current version is 5.3.1

Considering it has a built-in FireSIGHT management Center, So how do I do it?

[Marvin Rhoads]

Download the upgrade to 5.4 locally on your computer. Links to the download pages are here:

http://www.cisco.com/c/en/us/support/security/asa-5506-x-firepower-services/model.html#~tab-downloads

Be sure to also read the release notes to check if and when an upgrade of the base ASA software might be a prerequisite. (e.g FirePOWER 6.0 requires at least ASA 9.4(2).)

Then use the "Upload Updates" option in the ASDM-Based FirePOWER Configuration screen to make them available on the module and deploy the upgrade job.

I've done this to move from 5.3 > 5.4 > 6.0.

[LJ Gabrillo]

Hi Marvin,

Thank you for the reply

So I Still need to follow the upgrade path?
Since this is a new device, can I just go straight directly to 6.0? since this is new, so there is really no issue if the configuration is lost 

[Marvin Rhoads]

LJ,

Yes you could follow that path.

To go directly to 6.0, follow the process to first uninstall and then re-image the sfr software module:

http://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configure-firepower-00.html#anc5

[LJ Gabrillo]

Hi Marvin, Yeap, that's what I intend really to do, since this device is new, I will just skip directly to the 6.0 bootstrap and system image for FirePOWER

But, my main concern is the built-in firesight Management Center, the one additional tab, on the ASDM. Do i need to still follow the upgrade path or the same as the module, can I upgrade it directly?

[Marvin Rhoads]

The built-in in lightweight FireSIGHT Management Center is just ASDM interacting with the module.

As long as you have the latest ASDM you will be fine - nothing additional required beyond the basic module bootstrapping.

[LJ Gabrillo]

Hi Marvin,

THank you for your replies, that is greatly appreciated.
Last question, so basically, if ever in the future, a patch for 6.X arrives, then I only need to update the module? No need for the FireSIGHT patch?

[Marvin Rhoads · Accepted solution]

You're welcome LJ.

It depends. Cisco usually includes a few new features with the FirePOWER software updates (in addition to bug fixes). If those new features add configuration or monitoring functions, you would likely have to update the ASDM software.

Sometimes (less often) a new update may also require updating the ASA software as a prerequisite.

In any case, the requirements would be documented in the Release Notes.

[LJ Gabrillo]

Thanks Marvz! ^_^