Scenario:
Make: Cisco
Model: Cisco ASA 5506-X, 5506W-X, 5506H-X, 5508-X and 5516-X with FirePOWER Services
Version: ASA 9.x with ASA FirePOWER (SFR) module 6.x (example: ASA 9.13(1)10, SFR 6.0.0-1005)
Mode: CLI [Command Line Interface]
Description: In this article, we will discuss a stepwise method of how to safely shut down and restart the SFR (FirePOWER) module on a Cisco ASA firewall, and how to make sure traffic keeps flowing while the module is down.
Introduction
On ASA 5500-X firewalls with FirePOWER Services, the SFR module runs the next-generation security features, such as intrusion prevention (IPS), application control and URL filtering. The ASA sends selected traffic to this module for inspection. The module is managed locally through ASDM or centrally through the Firepower Management Center (FMC), and needs valid FirePOWER licenses.
You may need to shut the module down, for example before powering off or moving the firewall, while troubleshooting, or before maintenance. Shutting it down gracefully protects the module’s disk from corruption. The ASA itself keeps running, so firewall, NAT and VPN functions are not affected.
Before You Start: Will Traffic Keep Flowing?
Whether users notice the shutdown depends on how the ASA sends traffic to the module. This is set in the ASA service policy:
| Service Policy Setting | What Happens When the SFR Module Is Down |
| sfr fail-open | Traffic continues to flow through the ASA without FirePOWER inspection. No outage. |
| sfr fail-close | Traffic that should be inspected is dropped. Users lose access. |
| sfr fail-open monitor-only | The module only receives a copy of traffic, so there is no impact on traffic. |
Check your setting before shutting down:
edledge-asa# show running-config policy-map
...
class sfr_traffic_class
sfr fail-openImportant Note: If your policy shows fail-close, shutting down the SFR module will interrupt traffic. Either schedule the work in a maintenance window, or temporarily change the setting to fail-open and change it back afterwards.
Steps to Shut Down the SFR Module
Step 1: Connect to the ASA
Connect to the ASA over SSH or the console. If SSH is not set up yet, see Configure SSH on Cisco ASA via CLI or Configure SSH on Cisco ASA via GUI.
Step 2: Log In and Enter Privileged Mode
Log in with your ASA credentials and enter enable mode:
login as: admin
edledge-asa's password: ********
User admin logged in to edledge-asa
Type help or '?' for a list of available commands.
edledge-asa> enable
Password: ********
edledge-asa#This is the ASA login, not the FirePOWER module login. For the module itself, see FirePOWER default username and password and change or reset the SFR/FirePOWER password.
Step 3: Check the Current Module Status
Confirm that the SFR module is installed and up:
edledge-asa# show module
Mod Card Type Model Serial No.
---- -------------------------------------------- ------------ -----------
1 ASA 5508-X with FirePOWER services, 8GE, AC ASA5508 JAD12345678
sfr FirePOWER Services Software Module ASA5508 JAD12345678
...
Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- -----------------------
sfr ASA FirePOWER Up 6.0.0-1005
Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
1 Up Sys Not Applicable
sfr Up UpThe SFR module shows Up in both the application status and the module status.
Step 4: Shut Down the Module
Run the shutdown command and press Enter to confirm:
edledge-asa# sw-module module sfr shutdown
Shutdown module sfr? [confirm]
Shutdown issued for module sfr.
edledge-asa#Step 5: Confirm the Module Is Down
Check the status again. It first shows Shutting Down, and after a minute or two changes to Down:
edledge-asa# show module sfr
...
Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
sfr Shutting Down Not Applicable
edledge-asa# show module sfr
...
Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
sfr Down Not ApplicableThe SFR module is now shut down. If you are powering off the firewall, wait until the status shows Down before removing power.
How to Start the SFR Module Again
When your work is finished, start the module again with:
edledge-asa# sw-module module sfr reloadRebooting the whole ASA also starts the module. The module takes several minutes to boot; check its progress with show module sfr until both the status and the data plane status show Up. If you changed the service policy to fail-open, change it back to your original setting.
Important Note: Do not use sw-module module sfr recover to restart the module. The recover commands are used to re-image the module with a new boot image, which erases its configuration. To re-image, follow Reimage or Update Cisco ASA SFR Module instead.
Troubleshooting
- Traffic stopped after the shutdown – the service policy uses fail-close. Start the module again, or change the policy to fail-open.
- The module stays in “Shutting Down” – wait a few more minutes. If it does not change, check show module sfr details and the ASA logs.
- The module does not come back “Up” after a reload – it may still be booting, which can take up to 10 minutes. If it stays down, check the SFR module network settings and the module details.
- The ASA fails over unexpectedly – in a failover pair, a module failure can trigger failover. See Unwanted ASA Failover Due To SFR Error.
Frequently Asked Questions
Does shutting down the SFR module cause downtime?
Not if the service policy uses fail-open. Traffic continues through the ASA without FirePOWER inspection. With fail-close, inspected traffic is dropped while the module is down.
Do I need to shut down the SFR module before rebooting the ASA?
A normal reload of the ASA shuts down the module gracefully. Shutting it down first is recommended before you power off the firewall, to avoid corrupting the module’s disk.
Is the ASA FirePOWER (SFR) module still supported?
The SFR module is an older technology, and many of these ASA models have reached end of life. Cisco now recommends Firepower Threat Defense (FTD) or newer Secure Firewall appliances for new deployments.
Disclaimer: This article is for educational purposes only and is not professional financial, medical, or legal advice. It may contain affiliate links, which earn us a small commission at no extra cost to you. See our Disclaimer and Affiliate Disclosure.
Article ID: EA00147