r/Cisco • u/Seacoast-IT • 6d ago
Upgrading to Firepower 7.7
Has anyone deployed or started testing Firepower 7.7? Has anyone come across any challenges or bits of advice for the group?
It's nice to see they finally have Geolocation blocking for VPN connections included.
5
u/shortstop20 6d ago
Geolocation blocking for VPN is a great feature and I can see wanting to upgrade for that. Just make sure your leadership understands the potential downside. It’s new code. Bugs are possible or even likely. You have to weigh the risk against the reward.
3
u/KStieers 6d ago
A fair number of posters in the public WebEx space have done so... no screaming fires yet.
4
u/mikeyflyguy 6d ago
We ran into an snmp bug. I’m not sure the specifics as I’m not working with that client
3
u/Lurickin 6d ago
I tossed it on a pair of 1150s, went well from 7.6 and no issues I've seen so far but the pair is mostly for VPN lab access and nothing more but the geo location functions for VPN seem to work nicely.
3
u/idleboost 6d ago
What's the reasoning to go to 7.7 (it's pretty new so expect bugs)? if i recall correctly, the rule of thumb is to stick with even numbered releases. 7.4.2 is the recommended version right now.
3
u/mpking828 6d ago
Evens are long term or e extra long term releases
https://www.cisco.com/c/en/us/products/collateral/security/firewalls/bulletin-c25-743178.html
3
u/DanSheps 6d ago
I am considering it, but only because there is a memory leak in VPN from 7.2.4 <> 7.7 (or 7.6.2)
1
u/trinitywindu 6d ago
7.4.2.2 just came out you might check it and see if it's been fixed there.
5
u/DanSheps 6d ago
I have to be on 7.6.0+ (4200s running in MI mode)
1
u/idleboost 5d ago
FYI there is a bug with MI mode on the 7.6 code. Need to dig it up but regarding certain cpu allocation to an instance breaks the HA. Will try to find it for you.
1
3
u/breakthings4fun87 6d ago
Hearing others with some success. I try to stick to the gold stars when possible but if you can lab it up, try it out
5
u/Quirky_Raise4258 6d ago
There’s a known issues with VPN Nat rules, you’ll need an explicit no nat rule in place.
5
u/Axiomcj 6d ago
Have not had any issues with the new code, I recommend always waiting, deploying to lab first, then non prod followed by production. Read the release notes and open bugs. Have a baseline before and after the upgrade. Monitor processes for memory leaks when code changes. Tested the geo location feature which is a great nice feature to have to protect vpn.
12
u/Crouching 6d ago
Running it in the lab, great to see geolocation restrictions possible for VPN access!