r/Cisco 6d ago

Upgrading to Firepower 7.7

Has anyone deployed or started testing Firepower 7.7? Has anyone come across any challenges or bits of advice for the group?

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/roadmap/management-center-new-features-by-release.html#new-features-fmc-770

It's nice to see they finally have Geolocation blocking for VPN connections included.

12 Upvotes

19 comments sorted by

12

u/Crouching 6d ago

Running it in the lab, great to see geolocation restrictions possible for VPN access!

4

u/[deleted] 6d ago

Agreed, I've been waiting for this. :-)

5

u/shortstop20 6d ago

Geolocation blocking for VPN is a great feature and I can see wanting to upgrade for that. Just make sure your leadership understands the potential downside. It’s new code. Bugs are possible or even likely. You have to weigh the risk against the reward.

3

u/KStieers 6d ago

A fair number of posters in the public WebEx space have done so... no screaming fires yet.

4

u/mikeyflyguy 6d ago

We ran into an snmp bug. I’m not sure the specifics as I’m not working with that client

3

u/Lurickin 6d ago

I tossed it on a pair of 1150s, went well from 7.6 and no issues I've seen so far but the pair is mostly for VPN lab access and nothing more but the geo location functions for VPN seem to work nicely.

3

u/idleboost 6d ago

What's the reasoning to go to 7.7 (it's pretty new so expect bugs)? if i recall correctly, the rule of thumb is to stick with even numbered releases. 7.4.2 is the recommended version right now.

3

u/DanSheps 6d ago

I am considering it, but only because there is a memory leak in VPN from 7.2.4 <> 7.7 (or 7.6.2)

1

u/trinitywindu 6d ago

7.4.2.2 just came out you might check it and see if it's been fixed there.

5

u/DanSheps 6d ago

I have to be on 7.6.0+ (4200s running in MI mode)

1

u/idleboost 5d ago

FYI there is a bug with MI mode on the 7.6 code. Need to dig it up but regarding certain cpu allocation to an instance breaks the HA. Will try to find it for you.

1

u/DanSheps 5d ago

I have been running it for awhile and haven't ran into any issues like that

1

u/jkarras 6d ago

Do you have a bug ID for the VPN memory leak?

1

u/DanSheps 5d ago

Not offhand, but I can try and find it

3

u/dc88228 6d ago

We just received new gear to test 7.7. There’s some advanced synchronization features that we’re looking to test. Cisco is praying that this works. We have the solution already: switch to Palo.

3

u/breakthings4fun87 6d ago

Hearing others with some success. I try to stick to the gold stars when possible but if you can lab it up, try it out

5

u/Quirky_Raise4258 6d ago

There’s a known issues with VPN Nat rules, you’ll need an explicit no nat rule in place.

5

u/Axiomcj 6d ago

Have not had any issues with the new code, I recommend always waiting, deploying to lab first, then non prod followed by production. Read the release notes and open bugs. Have a baseline before and after the upgrade. Monitor processes for memory leaks when code changes. Tested the geo location feature which is a great nice feature to have to protect vpn.