Cisco’s Next Generation Firewall Product Line Software Release and Sustaining Bulletin

Released: December 4, 2019

Updated: February 21, 2025

Note: This product bulletin describes the support timelines for the following Cisco Next Generation Firewall Product Line (Secure Firewall Product Line) software: Cisco Firepower Threat Defense (FTD), Firepower Management Center (FMC), Firepower Device Manager (FDM), Secure Firewall, Secure Firewall Management Center and Adaptive Security Appliance (ASA) releases after 7.7 or ASA 9.23. Version 10.0 for Secure Firewall/9.24.1 for ASA is planned for 2H25. For information about earlier releases, see Support Timelines for Earlier Releases.

Introduction

This product bulletin describes the support timeline and support guidelines for Cisco Secure Firewall Product Line software on the supported security appliances, as described in the Secure Firewall Compatibility Guides:

●      Firepower Compatibility Guide

●      ASA Compatibility Guide

●      FXOS Compatibility

Cisco Secure Firewall Product Line Software Release Delivery

Release Number Versioning Scheme

The examples in these guidelines use the W.X.Y.Z format for release version numbers, for example 10.0.0.12 (Figure 1).

Cisco Secure Firewall Software release numbering: W.X.Y.Z format

Major Versions will be specified by the first two digits and include a series of Minor Releases. Each Major Version will start with an Initial Minor Release (W.0) and then follow up with a Final Minor Release 9 months later (W.5). After Final Minor Release, we will deliver Maintenance Releases for 33 Months and then Vulnerability releases for 24 Months.

ASA will continue with Version 9.X.Y.Z

For example. FTD 10.0 will be 9.24.1 for ASA. 10.5 will be 9.25.1. MRs and Interims will continue to be delivered in the same cadence that ASA has been delivering. With new MRs incrementing the 3rd digit.

Customers adopting 9.24.x will ultimately need to upgrade to 9.25.x to continue getting quality and vulnerability updates.

FTD and ASA Version Mapping

Table 1.        Cisco Secure Firewall release numbering breakdown

Software Support Lifecycle guidelines

The Cisco Secure Firewall Product Line Software Support Lifecycle guidelines have pre-set time intervals for each of the lifecycle milestones. These time intervals are based on the support model of the affected Cisco Secure Firewall Product Line software version. Table 2 summarizes the Support Lifecycle milestones for these software releases.

Table 2.        Cisco Secure Firewall product line Software Support Lifecycle milestones by release

Software release and support milestones

The primary milestones that define the software feature release lifecycle and the support durations are shown in Figure 2 below.

Note: These support periods are minimums.

Cisco Secure Firewall product line software lifecycle

Every Major Version will have the same release lifecycle and every Major Version will be submitted for Government Certification with the Final minor release.

Note: The above figure only shows Threat Defense Release expectations. ASA will continue to release sustaining/maintenance releases at the same frequency they have been. Interims every 6-8 weeks. Maintenance Releases every 5-7 months. In the Vulnerability phase, it will just be interims.

Feature Phase: 9 Months. Initial Minor Release (W.0) and Final Minor Release (W.5) are planned 9 Months apart. Between these releases a Maintenance Release will be released based on the initial Minor Release. These will be the same for both ASA and Threat Defense.

Maintenance Phase: 33 Months - Maintenace Releases (MR) : Quality fixes and PSIRT Fixes every 6 Months on the W.5 releases. We will also provide 1-2 Vulnerability releases on the W.0 Minor Release.

Vulnerability Phase: Vulnerability (PSIRT) Release 24 Months Starts with EoS and provides PSIRT and Critical defect fixes also every 6 months. ASA will only be delivering Interims in this period.

Throughout the software maintenance cycle, representatives from Cisco TAC and Cisco Engineering evaluate the priority of bug fixes and determine which ones should be included in each Maintenance or Vulnerability release. Cisco aims to provide Vulnerability updates on a semiannual basis for supported software releases. Due to the ever-changing vulnerability landscape, updates may need to be provided more frequently. Cisco encourages Cisco Secure Firewall Product Line software customers to include maintenance releases and patches in their software maintenance plan to avoid possible operational effects from known software bugs.

Upgrade paths

Customers are encouraged to migrate to the current Minor Release when the release becomes available with appropriate features for the applications, as shown in Figure 2.

Initial Minor Release Support

If customers wish to stay on the initial Minor Release after the final Minor Release is released, 1 Vulnerability Release will be planned on the initial Minor Release. If the final Minor Release doesn’t achieve suggested release by the next Vulnerability delivery date (6 months later) we will provide one additional Vulnerability release on the initial Minor Release. ASA MRs and Interims against the initial minor release (9.24.1, 11.0, 12.0, etc) will follow the same scheme as Threat Defense.

Sustaining Support

For Threat Defense, Maintenance and Vulnerability releases will all be fully upgradeable starting with 10.5. This has always been true for ASA.

For the upgrade path of a Major Version, customers may have unique requirements, and they are encouraged to work with local Cisco customer representatives to find the optimal release for their network.

Suggested Release Management

Suggested Release (“The Star”) is managed within CCO. It is used to indicate when a Major Version has achieved suggested status. This indicates that the Major Version is well-adopted and has no critical defects or security vulnerabilities. Once a Major Version achieves the star, all subsequent MRs and PSIRT releases will automatically inherit the Suggested Release attribute.

Customer notifications

Cisco notifies customers of the lifecycle and major milestones of a particular release by the following methods:

●      Compatibility Guide: When a feature release is introduced, Cisco updates the product Compatibility Guide on Cisco.com with compatibility information for that particular feature release. When announced, this document is updated with the end-of-sale, end-of-software maintenance, and end-of-life dates for that release:

◦    Firepower Compatibility Guide

◦    ASA Compatibility Guide

◦    FXOS Compatibility

●      External Announcement: Cisco issues an official End-of-Sale bulletin for the software release, which includes all End-of-Sale milestones affected including end of maintenance and last date of support. External announcements for all Cisco products are listed here: https://www.cisco.com/c/en/us/products/eos-eol-listing.html

All of these documents are intended to provide advanced notification to Cisco Secure Firewall Product Line software customers of the pending End-of-Sale and End-of-Life milestones.

Cisco Services

Cisco offers a wide range of services programs to accelerate customer success. These innovative services programs are delivered through a unique combination of resources, processes, tools, and partners, resulting in high levels of customer satisfaction. Cisco Services help you protect your network investment, optimize network operations, and prepare your network for new applications to extend network intelligence and the power of your business. For more information about Cisco Services, refer to: http://www.cisco.com/go/services.

Support timelines for earlier releases

The following links provide information about the support timelines for releases prior to Cisco FTD/FPS/FMC 6.4 and ASA 9.12:

●      Firepower versions for 7000/8000 Series: https://www.cisco.com/c/en/us/products/security/firepower-8000-series-appliances/eos-eol-notice-listing.html

●      All other Firepower Appliances: https://www.cisco.com/c/en/us/products/security/firepower-ngfw/eos-eol-notice-listing.html

●      ASA Appliances: https://www.cisco.com/c/en/us/products/security/asa-firepower-services/eos-eol-notice-listing.html

●      FXOS for FPR-4K/9K Series: https://www.cisco.com/c/en/us/products/security/firepower-9000-series/eos-eol-notice-listing.html

For more information

For more information about the Cisco FTD and ASA product line visit the following page: https://www.cisco.com/c/en/us/products/security/firewalls/index.html

or contact your local Cisco account manager.

For information about Cisco service and support programs and benefits, visit: https://www.cisco.com/c/en/us/services/technical/software-support.html