About Marvin Rhoads

Marvin Rhoads · ‎08-17-2018

I'm not sure what you mean by controller license. Are you asking about the Firepower Management Center (FMC) license or your ASA 5506-X Firepower service module Control license. The first one is for FMC. That is not a free download and never has been. It requires entitlement based on having purchased it and having a license but you don't need to install it anywhere as it is right-to-use now. The second one is for the Firepower service module only and does not transfer to FTD. FTD requires a "Threat" smart license to enable its base functionality.

Marvin Rhoads · ‎08-15-2018

In addition to what @Troy Jackson correctly noted, I can confirm I have a Firepower 2140 running FTD -Nexus Etherchannel working in production. It's only 2x10 Gbps, but adding more members is a simple task. Firepower supports up to 16 members in a given Etherchannel (asl long as they are all the same speed and type). Given that the base 2140 only has 4 each SFP+ interfaces, you would indeed need that 8 port expansion module. (It's VERY expensive so brace yourself.) Why do you want 80 Gbps of interface speed though? That far exceeds the maximum throughput of the 2140 (approximately 8.5 Gbps): https://www.cisco.com/c/en/us/products/collateral/security/firepower-ngfw/datasheet-c78-736661.html?cachemode=refresh

Marvin Rhoads · ‎08-15-2018

Their second cluster should first be migrated to a similar 9.1 release as the first one. Then you can copy the configurations over much more easily. You can run ASA image on a Firepower 2110 (however you cannot run Firepower services when using it that way). That would also make eventual migration to FTD an easier and better step since the hardware is better suited to that.

Marvin Rhoads · ‎08-15-2018

Wow those are very old releases. The current version is 6.2.3.4. In all cases, you must upgrade the managing FireSIGHT (known as Firepower Management Center since release 6.0) first since it has to be at or above the release level of any managed devices. Once you get the FMC to 6.1, you must also bring your managed devices to that release because moving up to 6.2 means the oldest compatible managed device release is 6.1 at that point.

Marvin Rhoads · ‎08-13-2018

@balaji.bandi is correct. If you follow through the link to the SalesConnect page (partner access required), the material there will cover everything you need to know in order to pass the exam.

Marvin Rhoads · ‎08-13-2018

Sure, page 27 has the following: AMP for Endpoints Linux Connector 1.3.0 New Features • Added support for Red Hat Enterprise Linux and CentOS 7.2 and 7.3

Marvin Rhoads · ‎08-13-2018

The 7.x releases showing as supported in the release notes are 7.2, 7.3, 7.4 and 7.5. https://docs.amp.cisco.com/Release%20Notes.pdf You can try a TAC case but they will most likely advise the same.

Marvin Rhoads · ‎08-13-2018

You should be able to deploy directly using the ESXi vSphere Web client. I've done several of them that way. Can you confirm the image name you are using and that you have followed the instruction in the Quick Start Guide exactly (especially regarding vSwitch settings)? https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/asav/quick-start/asav-quick/asav-vmware.html

Marvin Rhoads · ‎08-12-2018

Your Firesight (now known as Firepower) Management Center must always be at or above the version of your managed sensors (Firepower Service modules, FTD devices or Firepower NGIPS appliances). That's probably why you are getting incompatible version messages. As @Nikolaj Nielsen mentioned, reimaging is your best bet for the module. Depending on your FMC configuration that's in place, it may even be the best bet for it as well. Otherwise you have to do a whole lot of sequential upgrades to move from your 3 year old version to something current. (6.2.3.3 is the current latest and recommended release.)

Marvin Rhoads · ‎08-12-2018

My laptop works fine with AnyConnect Roaming Security module (Umbrella), Network Access Module and VPN all running while tethered and using hotspot. I didn't have to take any special measures.

Marvin Rhoads · ‎08-12-2018

No I don't believe it's an option to customize that - at least not in any supported way.

Marvin Rhoads · ‎08-12-2018

Because it has a hardware Firepower service module, not a software one. The software module only applies to all of the lower models of the 5500-X family.

Marvin Rhoads · ‎08-10-2018

For MOST (but not all) features you are right. A few things - such as default inspections - are configurable locally via cli. That applies even when the FTD device is managed by FMC. https://www.cisco.com/c/en/us/td/docs/security/firepower/command_ref/b_Command_Reference_for_Firepower_Threat_Defense/c_3.html#wp2136048707 As noted in the above reference, you should consider using a Flexconfig object in FMC to make this change persistent across policy deployments (if you have version 6.2.3 or later).

Marvin Rhoads · ‎08-09-2018

Your site https://srhvpn.srh.noaa.gov/ is currently showing the certificate from the SRH root CA, not the one from GoDaddy. Check that you have bound the GoDaddy certificate to the outside interface: ssl trust-point ASDM_TrustPoint7 outside (assuming the nameif is "outside")

Marvin Rhoads · ‎08-06-2018

Does it affect any feature or performance? No. How can I remove that message? You cannot (unless you remove the license from the secondary unit).

Date Registered	‎06-28-2001 03:55 PM
Date Last Visited	‎08-17-2018 03:02 PM
Total Messages Posted	14,549
Total Helpful Votes Received	12358

Re: Cisco Firepower Management Center

Re: Etherchannel between Cisco 9300-48T...

Re: Migration from ASA 5520 to 5516-X

Re: Upgrade FireSight 3500 // Which the...

Re: Advanced Security Architecture for ...

Re: cisco AMP for endpoints 1.8 failing...

Re: cisco AMP for endpoints 1.8 failing...

Re: Unable to deploy ASAv

Re: Cisco ASA5585 Firepower upgrade

Re: Tethering with Umbrella

Re: AC VPN icon change

Re: Cisco ASA5585 Firepower upgrade

Re: Disable SMTP inspection via FMC

Re: Cert for ASA

Re: AnyConnect Licensing