It is a bit confusing. Firepower (or more properly the FXOS) sees SFP modules as a different "type" than built-in Ethernet ports. A copper 1 Gbps SFP module is seen as a different type than a copper 1 Gbps built-in, while a copper SFP is considered the same type as a fiber 1 Gbps SFP module. ... View more

ASA 5506 does not have a limit on the number of internal users. The older ASA 5505 used to have this and a premium license was required to go from 10 (default) to 50 users. If you're buying a new firewall the Firepower 1010 would be a much better choice. The 5506 is nearly at the end of its sales life and already cannot run the newer Firepower software versions. ... View more

Please read the entire section of the guide that was linked earlier. It explains what I am saying. I will quote it here for reference:   Cisco Software Support Service (SWSS) is included for the duration of all Cisco ISE subscription licenses. Higher-value service levels, Software Support Enhanced and Premium, are available for Cisco ISE Base, Plus and Apex licenses. These service levels provide everything included in Software Support Basic with a richer feature set such as software configuration guidance, direct access to experts with faster response time and technical adoption support. The Enhanced and Premium Software Support is based on the number of concurrent sessions, and can be ordered via the top-level ATO PID in CCW: CISE-SW-SUPP. Please note that Smart Net Total Care® or SWSS contracts for Cisco ISE physical and virtual appliances must be purchased separately and are required to consume any ISE subscription licenses. Smart Net Total Care and SWSS contracts for Cisco ISE physical and virtual appliances cover Base and Device Admin deployments as well. Please also note that Cisco does not offer standalone ISE software upgrade service SKUs or separate support SKUs for subscription licenses.   ... View more

You're welcome. Please rate my replies if they helped you. ... View more

The AnyConnect Umbrella Roaming Security module requires ASA 9.6(2) or later. The AnyConnect version must be at least 4.3 but the latest (currently 4.8.03036) is recommended. https://www.cisco.com/c/en/us/td/docs/security/asa/roadmap/asa_new_features.html#reference_dwt_r2m_pz Both of your ASAs are past end-of-sales models. The 5585-X can be upgraded to a compatible release. The 5510 however is long past end of Engineering milestone and can only run software up to 9.1.7. As such it cannot be setup to deploy the module. ... View more

ISE licenses license the features only. They do not by themselves provide support. You need to have a current support contract on your underlying VMs or physical appliances. That contract covers hardware support (for the physical appliances) and software support (upgrades, TAC assistance with any issues etc.). When you have a support contract the TAC support will include 24-7 assistance with all licensed software features. Hardware support varies according to the type of contract purchased. Most common is 8x5xNBD (Next Business Day) meaning they will send out a replacement hardware the next business day (5 days per week) as long as the request is approved during a given 8 hour business day. ... View more

ISE Posture doesn't require NAM. You can use the native supplicant for machine certificate authentication. Also for user authentication (certificate or username). You just cannot do both at once, AKA EAP-chaining (currently - Microsoft is supposed to be releasing EAP-TEAP support soon). So you have to trust one or the other for a given authentication session. ... View more

Thanks for sharing @Leo Laohoo . Did you get a BugID from the TAC? ... View more

Most people do backups using their ntework management software. Cisco Prime Infrastructure, SolarWinds NCM, SolarWinds Cattools are popular commercial options. RANCID is an open source alternative. If you have an FTP or SCP server you can create a script to kick off periodically and copy the config to it. As far as a GUI, Cisco ASA's have the ASDM (Adaptive Security Device Manager) tool.   ... View more

FMC cannot manage Firepower appliances running ASA image. When you say backup do you mean a backup of the configuration? ... View more

As @Sheraz.Salim FTD on any ASA model does not support multi-instance (the FTD analogue to multi-context). To support FTD multi-instance you need Firepower 4100 or 9300 series appliances. https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/firepower_threat_defense_logical_devices_for_the.html#id_77542 With Firepower 6.6 we also have the capability to support multi-VRF. That may address some of the use cases whee we had previously used multiple contexts on traditional ASAs. https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/virtual-routing-for-firepower-threat-defense.html ... View more