topic The IMG is pretty quick - the in Network Security

SFR is in Recovery Mode

hasanul.kabir — Tue, 12 Mar 2019 12:42:01 GMT

Dear all,

i have a situation as mentioned below.

I have two ASA 5525 in Active-Standby mode
I have installed firesight Successfully.
Situation is when i would like to go "Session sfr" for cli mode. it gives me a syslog massage which is "sfr is not responding the for this session". moreover when i typed "sh module" in cli mode i found that SFR is in "Recovery" mode. after that i stopped the Recovery mode and try to reboot the sfr. but it remains in Recovery mode.

need suggestion.

You may need to re-image the

Marvin Rhoads — Sun, 14 Jun 2015 14:41:32 GMT

You may need to re-image the sfr software module. the following will accomplish that:

ciscoasa# sw-module module sfr recover configure image disk0:/<boot file name that you have loaded onto ASA flash - it is an "img" file type>
ciscoasa# sw-module module sfr recover boot

Once you've done that, you should be able to session into the module console and run "setup", followed by "system install". During this last step you will need the full "pkg" file available for upload onto the module.

Files can be found here for registered users with a support contract. (Expand the 5.4.0 section of the tree to see the smaller img and large pkg files.)

Hi Marvin Rhoads,Thanks for

hasanul.kabir — Sun, 14 Jun 2015 15:13:14 GMT

Hi Marvin Rhoads,

Thanks for your suggestion.

i am also thinking to re-image the SFR.

should i need to boot the PKG file after system install. because when i use commsnd "Sh disk0:/" i could not see the PKG file in the device.

Hasanul,Imaging and booting

Marvin Rhoads — Sun, 14 Jun 2015 18:01:08 GMT

Hasanul,

Imaging and booting an sfr module is a 2-stage process.

The first stage is to bootstrap using the img file (~ 40 MB) that is on the ASA disk0 compact flash (or other accessible media such as the USB). Running setup after you've done that gets you to the point of the sfr module having enough functionality to be a client on the network and proceed to the next stage.

The second stage involves transferring the much larger pkg file (~420 MB) from an external source (such as an ftp server) onto the sfr module itself and then completing the installation.

Thanks for your kind

hasanul.kabir — Sat, 20 Jun 2015 11:08:33 GMT

Thanks for your kind assistance.

Now problem is solved.

You're welcome.Please rate or

Marvin Rhoads — Sat, 20 Jun 2015 14:37:29 GMT

You're welcome.

Please rate or mark question as answered if it helped.

Marvin is correct - Ive done

Peter Long — Mon, 21 Mar 2016 09:41:04 GMT

Marvin is correct - Ive done a shedload of these now!

Re-Image and Update the Cisco FirePOWER Services Module

Pete

Hi Guys,

Darren Frowen — Mon, 12 Sep 2016 11:55:53 GMT

Hi Guys,

I have 5525X and started the process of upgrade from

asasfr-5500x-boot-5.4.0-763.img

asasfr-5500x-boot-6.1.0-330.img

I uploaded the image to flash via browser and performed the following

sw-module module sfr recover configure image disk0:/asasfr-5500x-boot-6.1.0-330.img
sw-module module sfr recover boot

Unfortunately now the module appears to be stuck in ---- ------------------ --------------------- -------------
sfr Recover

Any idea how i can get out of this, do i reload the ASA or the module?

Regards

Darren

how long have you waited they

Peter Long — Mon, 12 Sep 2016 12:31:01 GMT

how long have you waited they take ages? did you turn debugging on to see whats its doing?

debug module-boot

Hi Peter,

Darren Frowen — Mon, 12 Sep 2016 13:07:44 GMT

Hi Peter,

Yes i waited a good 45mins and was still the same. So i have now rebooted the ASA itself and now i have a sfr module thats unresponsive. Going to try it again.

fw-01/pri/act# sw-module module sfr recover configure image disk0:/asasfr-$
fw-01/pri/act# sw-module module sfr recover boot

Module sfr will be recovered. This may erase all configuration and all data
on that device and attempt to download/install a new image for it. This may take
several minutes.

Recover module sfr? [confirm]
Recover issued for module sfr.
fw-01/pri/act# Mod-sfr 4> ***
Mod-sfr 5> *** EVENT: Creating the Disk Image...
Mod-sfr 6> *** TIME: 06:02:04 UTC Sep 12 2016
Mod-sfr 7> ***
Mod-sfr 8> ***
Mod-sfr 9> *** EVENT: The module is being recovered.
Mod-sfr 10> *** TIME: 06:02:04 UTC Sep 12 2016
Mod-sfr 11> ***

See attached log so far...... Still siting at sfr Recover, how long should it take, i was under the impression no longer than 10mins?

Regards

45 mins is not long enough

Peter Long — Mon, 12 Sep 2016 13:07:45 GMT

45 mins is not long enough Ive seen them take hours sometimes

Hi Peter,

Darren Frowen — Mon, 12 Sep 2016 13:25:40 GMT

Hi Peter,

Thanks again for your response its is appreciated. Are you saying it takes hours for the .img initial recover or the consequent upload of the .pkg?

Regards

The IMG is pretty quick - the

Peter Long — Mon, 12 Sep 2016 14:07:46 GMT

The IMG is pretty quick - the PKG takes ages! leave debugging on! also I noticed on a 5.4. to 6.0 upgrade last week it asks you a question to which you need to respond yes halfway though!!

I watched one for an hour once, then drove an hour home, it didnt come up till 22:00 hours at night!

Pete

Hi Peter,

Darren Frowen — Mon, 12 Sep 2016 14:22:17 GMT

Hi Peter,

Thanks again. So i think my problem was the fact that although in recover mode waiting for .img i was then just thinking it was failed or stuck. I was also try

"session sfr" but then tried "session sfr console" and was then presented with the boot prompt 🙂 Just performed the following

system install noconfirm ftp://10.22.1.201/asasfr-sys-6.1.0-330.pkg

apparently the "noconfirm" then you dont get any prompts to confirm. Its downloaded from the ftp server and i have the debugging on (see attached), still now worried my session will time out, set ssh timeout to 60. I'll wait to see what happens now. Thanks for your help very much appreciated

Re: Marvin is correct - Ive done

Md.Jashim Uddin — Wed, 04 Oct 2017 10:19:44 GMT

Hi All,

I am experiencing a problem. Please find the bellow console output.

asasfr-boot>system install ftp://10.184.184.205/asasfr-sys-6.2.0-362.pkg
Verifying
Downloading
Extracting
Package Detail
Description: Cisco ASA-SFR 6.2.0-362 System Install
Requires reboot: Yes

Do you want to continue with upgrade? [y]:
y
Warning: Please do not interrupt the process or turn off the system.
Doing so might leave system in unusable state.

Upgrading
Starting upgrade process ...
Populating new system image

Reboot is required to complete the upgrade. Press 'Enter' to reboot the system.

Broadcast message from root (ttyS1) (Sun Sep 17 00:24:56 2017):

The system is going down for reboot NOW!
Console session with module sfr terminated.
EXT-FWR-1# session sfr console
ERROR: Failed opening console session with module sfr. Module is in "Recover" state.
Please try again later.

EXT-FWR-1# show module

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
0 ASA 5525-X with SW, 8 GE Data, 1 GE Mgmt, AC ASA5525 FCH203XXX
ips Unknown N/A FCH203XXXX
cxsc Unknown N/A FCH20XXXX
sfr Unknown N/A FCH203XXXXX

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
0 006b.f1fa.149b to 006b.f1fa.14a4 3.0 2.1(9)8 9.2(2)4
ips 006b.f1fa.1499 to 006b.f1fa.1499 N/A N/A
cxsc 006b.f1fa.1499 to 006b.f1fa.1499 N/A N/A
sfr 006b.f1fa.1499 to 006b.f1fa.1499 N/A N/A

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------
ips Unknown No Image Present Not Applicable
cxsc Unknown No Image Present Not Applicable

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
0 Up Sys Not Applicable
ips Unresponsive Not Applicable
cxsc Unresponsive Not Applicable
sfr Recover Not Applicable

Mod License Name License Status Time Remaining
---- -------------- --------------- ---------------
ips IPS Module Disabled perpetual

EXT-FWR-1#

Already 4 hours passed. but it is showing in recover status.

Looking forward for good response.

Re: Marvin is correct - Ive done

emmanuel.mbanda — Thu, 01 Nov 2018 13:41:21 GMT

How long can this process take, l have been waiting for 2hours now but no lucky. From the logs its showing that the module installation is complete.

Please help

Configuring update-modules
INIT: Entering runlevel: 5
Starting OpenBSD Secure Shell server: sshd
generating ssh RSA key...
generating ssh DSA key...
done.
Starting Advanced Configuration and Power Interface daemon: acpid.
acpid: starting up with proc fs

acpid: opendir(/etc/acpi/events): No such file or directory

starting Busybox inetd: inetd... done.
Starting ntpd: done
Starting syslogd/klogd: done
Cisco FirePOWER Services Boot Image 6.2.0

asasfr login: [ 418.624687] vda: vda1
[ 422.635745] Adding 4194752k swap on /dev/vda1. Priority:-1 extents:1 across:4194752k
[ 903.800054] kjournald starting. Commit interval 5 seconds
[ 903.801672] EXT3 FS on vda5, internal journal
[ 903.802162] EXT3-fs: mounted filesystem with ordered data mode.
[ 903.842924] kjournald starting. Commit interval 5 seconds
[ 903.843632] EXT3 FS on sda1, internal journal
[ 903.844178] EXT3-fs: mounted filesystem with ordered data mode.
INIT: Switching to runlevel: 6
INIT: Sending processes the TERM signal
Stopping OpenBSD Secure Shell server: sshdstopped /usr/sbin/sshd (pid 1991)
.
Stopping Advanced Configuration and Power Interface daemon: no /usr/sbin/acpid found; none killed
stopping Busybox inetd: inetd... stopped inetd (pid 1999)
done.
Stopping ntpd: stopped process in pidfile '/var/run/ntp.pid' (pid 2110)
done
Stopping syslogd/klogd: done
Deconfiguring network interfaces... done.
Sending all processes the TERM signal...
Sending all processes the KILL signal...
Unmounting remote filesystems...
Deactivating swap...
Unmounting local filesystems...
umount2: Device or resource busy
umount: none busy - remounted read-only
Rebooting... [ 1169.182952] md: stopping all md devices.
[ 1170.283057] sd 0:0:0:0: [sda] Synchronizing SCSI cache
[ 1170.475972] Restarting system.
[ 1170.476333] machine restart

***
*** EVENT: The module is being automatically restarted.
*** TIME: 13:43:33 SAST Nov 1 2018
***

SFR uploading issue

EngSaidy — Sat, 15 Jun 2019 09:49:02 GMT

Dear sir,
I uploaded (asasfr-5500x-boot-6.2.3-4.img) image file from TFTP to ASA flash memory, then run execute the following commands:

SW-module module sfr recover configure image disk0:asasfr-5500x-boot-6.2.3-4.img
SW-module module sfr recover boot

Then, Cisco FirePOWER Services Boot Image 6.2.3 debug was finally displayed.
As I logged in to SFR console, set up all the IP configuration for device and run System install ftp://10.29.85.20/asasfr-sys-6.2.3-83.pkg

When the extraction completed, the device stucks in recover state, and I can no longer log in to SFR console, please help me on this regard.

Thanks,

Re: SFR uploading issue

Marvin Rhoads — Sat, 15 Jun 2019 14:34:51 GMT

How long did you wait? It can take several hours.

Re: SFR uploading issue

Filip Gerasimov — Wed, 14 Aug 2019 11:39:13 GMT

Hi my sfr module is stuck in init state. Is there any chance to start recovering of sfr module and then to stop it without to erase the configuration. My idea is sfr go in unresponsive state and then to shutdown / reset / reload.

Re: SFR uploading issue

Marvin Rhoads — Thu, 15 Aug 2019 02:34:15 GMT

init state is what we normally see during the process of imaging. You first boot the module with the new image and then wait for it to present you with a login prompt. At this point the module will be in "init". You then download and install the system image to complete the process and move to "Up/Up" state.

You can have a look at your module's log from the ASA cli. I usually do the following:

term pager 0
show module sfr log console

It should be a long string of log messages ending with a login prompt.