Asa Firepower Management; Compatibility With Asa Features; Licensing Requirements For The Asa Firepower Module; Guidelines For Asa Firepower - Cisco ASA Series Configuration Manual

Chapter 7 ASA FirePOWER Module

ASA FirePOWER Management

The module has a basic command line interface (CLI) for initial configuration and troubleshooting only.
You configure the security policy on the ASA FirePOWER module using one of the following methods:
•
•

Compatibility with ASA Features

The ASA includes many advanced application inspection features, including HTTP inspection.
However, the ASA FirePOWER module provides more advanced HTTP inspection than the ASA
provides, as well as additional features for other applications, including monitoring and controlling
application usage.
To take full advantage of the ASA FirePOWER module features, use the following guidelines for traffic
that you send to the ASA FirePOWER module:
•
•
•
Other application inspections on the ASA are compatible with the ASA FirePOWER module, including
the default inspections.

Licensing Requirements for the ASA FirePOWER Module

The ASA FirePOWER module and FireSIGHT Management Center require additional licenses, which
need to be installed in the module itself rather than the ASA. The ASA itself requires no additional
licenses.
See the Licensing chapter of the FireSIGHT System User Guide or the online help in FireSIGHT
Management Center for more information.

Guidelines for ASA FirePOWER

Failover Guidelines
•
•
FireSIGHT Management Center (all models)—Can be hosted on a separate FireSIGHT
Management Center appliance or as a virtual appliance.
ASDM (ASA 5506-X, 5508-X, and 5516-X)—You can manage both the ASA and the module using
the on-box ASDM.
Do not configure ASA inspection on HTTP traffic.
Do not configure Cloud Web Security (ScanSafe) inspection. If you configure both ASA
FirePOWER inspection and Cloud Web Security inspection for the same traffic, the ASA only
performs ASA FirePOWER inspection.
Do not enable the Mobile User Security (MUS) server; it is not compatible with the ASA
FirePOWER module.
Does not support failover directly; when the ASA fails over, any existing ASA FirePOWER flows
are transferred to the new ASA. The ASA FirePOWER module in the new ASA begins inspecting
the traffic from that point forward; old inspection states are not transferred.
You are responsible for maintaining consistent policies on the ASA FirePOWER modules in the
high-availability ASA pair to ensure consistent failover behavior.
Licensing Requirements for the ASA FirePOWER Module
Cisco ASA Series Firewall CLI Configuration Guide
7-5