I recently acquired a 5506-X and I have to say that the out of the box experience with FirePOWER and with Cisco's website is pretty bad.
Once the 5506-X has completed the initial configuration wizard, and the user has jumped through the hoops of installing licenses for the ASA and the FirePOWER module (most of which the ASDM-IDM presents incorrect URL's or instructions for), even the most basic functionality does not actually work out of the box, and provides terrible diagnostic feedback.
My current annoyance is the behavior of trying to get updates for the FirePOWER module. If I choose "Download Update" from the ASDM, I get the completely unhelpful error:
Error
Download updates failed: Unable to connect to update server
Well, that's not very specific is it? So after poking around and getting a shell on the FirePOWER module, I first tried to ping something random to see if it could do a DNS lookup and discovered that the answer is yes, sort of:
So great, some things are allowed to do queries and some are not. This is totally the kind of fiddling around in a shell that I was hoping to deal with when I installed the godawful security nightmare that is Java just to manage a security appliance.
Rule updates are no better. A similarly useless error message is presented, and the rule update log only seems to show successes (namely loading the default snort rule set from January). The online documentation on Cisco's site provides two different URLs for downloading rule updates manually, but both are invalid. I thought I'd try downloading the latest firmware images manually for the ASA and the FirePOWER, but of course somehow having the licenses for both on the 5506-X in one's user profile somehow doesn't make them downloadable manually and it just gives me useless links to tell me that that I need more entitlements. I basically just don't have the patience after poking at this Broken-As-Designed product to tolerate this kind of nonsense, and it beggars belief that in an age when patching quickly is the only way to maintain even a presence of security, this kind of basic functionality doesn't actually work with a completely default install.
So basically the FirePOWER doesn't seem to work at all out of the box and the diagnostics are useless. Am I missing something completely obvious?
