The ASA FirePOWER module runs on the separately upgraded ASA operating system. There is wide compatibility between ASA and ASA FirePOWER versions. However, upgrading allows you to take advantage of new features and resolved issues. For example, the Firepower captive portal feature requires at least ASA FirePOWER Version 6.0.0 and ASA 9.5(2).

Version 7.0.0 is the last major release that supports ASA FirePOWER.

The following table shows the ASA, ASDM, and ASA FirePOWER support. If you are using an FMC to manage ASA FirePOWER, you can ignore the ASDM requirements.

Note that:

• ASA 9.14/ASDM 7.14/Firepower 6.6 is the final version for the ASA FirePOWER module on the ASA 5525-X, 5545-X, and 5555-X.

• ASA 9.12/ASDM 7.12/Firepower 6.4.0 is the final version for the ASA FirePOWER module on the ASA 5515-X and 5585-X.

• ASA 9.9/ASDM 7.9(2)/Firepower 6.2.3 is the final version for the ASA FirePOWER module on the ASA 5506-X series and 5512-X.

Note

ASDM versions are backwards compatible with all previous ASA versions, unless otherwise stated. For example, ASDM 7.13(1) can manage an ASA 5516-X on ASA 9.10(1). ASDM is not supported for FirePOWER module management with ASA 9.8(4.45)+, 9.12(4.50)+, 9.14(4.14)+, and 9.16(3.19)+; you have to use FMC to manage the module with these releases. These ASA releases require ASDM 7.18(1.152) or later, but ASDM support for the ASA FirePOWER module ended with 7.16. ASDM 7.13(1) and ASDM 7.14(1) did not support ASA 5512-X, 5515-X, 5585-X, and ASASM; you must upgrade to ASDM 7.13(1.101) or 7.14(1.48) to restore ASDM support.

This table lists compatibility with 7000/8000 series devices, AMP models, and legacy device platforms. Version 6.4.0 is the last major release that supports Firepower 7000/8000 series devices.

Version 7.0 is the last major version supported for NGIPSv (virtual NGIPS devices running on VMware).

These tables list the supported devices and management methods for Classic devices, by version.

The FMC can remotely manage multiple Firepower devices, including ASA FirePOWER modules (but not ASA firewall functions). The FMC must run the same or newer version as its managed devices.

Use ASDM to manage one ASA FirePOWER module. ASA FirePOWER is a separately installed module on an ASA device. Traffic is sent to the module after ASA firewall policies are applied. Newer versions of ASDM can manage newer ASA FirePOWER modules.

Version 5.4 sequences support different NGIPS appliance models and device management methods.

Note that Version 5.4.0.2/5.4.1.1 is the minimum for direct upgrade to Version 6.0.0. It is also the minimum device version that can be managed by Version 6.0.0, 6.0.1, and 6.1.0 Defense Centers/FMCs.

Parallel Release Sequences

Version 5.4.x releases are in parallel, starting with Version 5.4.0.1/5.4.1.0. For each pair, the Version 5.4.0.x release uses a last digit that is one more than the last digit of its parallel Version 5.4.1.x release:

• 5.4.0.1 (no longer supported) and 5.4.1.0

• 5.4.0.2 and 5.4.1.1

• 5.4.0.3 and 5.4.1.2

• … and so on

The following tables provide end-of-life details. Dates that have passed are in bold.

Snort

If you are still using the Snort 2 inspection engine with threat defense, switch to Snort 3 now for improved detection and performance. It is available starting in threat defense Version 6.7+ (with device manager) and Version 7.0+ (with management center). Snort 2 will be deprecated in a future release. You will eventually be unable to upgrade Snort 2 devices.

In management center deployments, upgrading to threat defense Version 7.2+ also upgrades eligible Snort 2 devices to Snort 3. For devices that are ineligible because they use custom intrusion or network analysis policies, manually upgrade Snort. See Migrate from Snort 2 to Snort 3 in the Firepower Management Center Snort 3 Configuration Guide.

In device manager deployments, manually upgrade Snort. See Intrusion Policies in the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.

Software

These major software versions have reached end of sale and/or end of support. Versions that have reached end of support are removed from the Cisco Support & Download site.

These software versions on still-supported branches have been removed from the Cisco Support & Download site.

Note

In Version 6.2.3+, uninstalling a patch (fourth-digit release) results in an appliance running the version you upgraded from. This means that you can end up running a deprecated version simply by uninstalling a later patch. Unless otherwise stated, do not remain at a deprecated version. Instead, we recommend you upgrade. If upgrade is impossible, uninstall the deprecated patch.

Hardware and Virtual Platforms

These platforms have reached end of sale and/or end of support.