cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
741
Views
0
Helpful
2
Replies

ASA HA Primary Swap with Firepower

NETAD
Level 4
Level 4

Hello, I’m planning on replacing the primary ASA in HA and need to know the procedure when it comes to Firepower. Do I have to re-configure mgmt and re-add it to FMC since I will need to remove the SSD and installing it in the new one?  Here’s what I’m planning on doing:

 

1-Power of primary and break HA by disconnecting the failover link

2-Remove the SSD drive from the existing ASA

3-Install SSD in the new firewall 

4-Match the IOS on the new ASA and unshut the ports

5-Configure it for failover

6-Connect the failover link and wait for config sync

 

and finally failover to it and test.

 

what I’m not clear on is the firepower piece and if I have to re-configure it.

 

Thanks

1 Accepted Solution

Accepted Solutions

Here's what I had to do here: 

1-Match the version of the new firewall to the existing firewall

2-re-host the licenses to the new firewall and make sure it matches the existing firewall 

3-Copy the anyconnect and asdm images to the new firewall

4-Configure the new firewall as secondary and configure the existing secondary firewall as primary to prevent the secondary from sync'ing its config with a blank config from the new firewall 

5-Unshut the Failover links only on the new firewall

6-Failover to the secondary 

7-Power off the primary and remove the ssd 

8-Power off the new firewall and install the ssd from the old firewall 

Next you have to re-install firepower on the new firewall

9-Copy the firepower img file to flash 

 

10-issue sw-module module sfr recover configure image disk0:...

    and sw-module module sfr recover boot 

11-Login to the firepower module with session sfr console 

12-Issue the setup command to do the initial configuration 

13-Use the command system-install http|FTP to install firepower 

14-Remove the old firepower from FMC 

15-remove the defective firewall and rack the new one 

16-connect the failover link first and make sure the configuration gets pushed to it. 

17-Connect the remaining cables (outside,inside,dmz,etc) 

18-Add the firepower to FMC and perform the needed upgrades 

19-Failover to test. 

15-Add the new one

 

 

 

 

 

View solution in original post

2 Replies 2

NETAD
Level 4
Level 4
Anyone here?

Here's what I had to do here: 

1-Match the version of the new firewall to the existing firewall

2-re-host the licenses to the new firewall and make sure it matches the existing firewall 

3-Copy the anyconnect and asdm images to the new firewall

4-Configure the new firewall as secondary and configure the existing secondary firewall as primary to prevent the secondary from sync'ing its config with a blank config from the new firewall 

5-Unshut the Failover links only on the new firewall

6-Failover to the secondary 

7-Power off the primary and remove the ssd 

8-Power off the new firewall and install the ssd from the old firewall 

Next you have to re-install firepower on the new firewall

9-Copy the firepower img file to flash 

 

10-issue sw-module module sfr recover configure image disk0:...

    and sw-module module sfr recover boot 

11-Login to the firepower module with session sfr console 

12-Issue the setup command to do the initial configuration 

13-Use the command system-install http|FTP to install firepower 

14-Remove the old firepower from FMC 

15-remove the defective firewall and rack the new one 

16-connect the failover link first and make sure the configuration gets pushed to it. 

17-Connect the remaining cables (outside,inside,dmz,etc) 

18-Add the firepower to FMC and perform the needed upgrades 

19-Failover to test. 

15-Add the new one

 

 

 

 

 

Review Cisco Networking products for a $25 gift card