topic Re: Hello Lucas, in Network Security

ASA5506 - firepower / sourcefire installation problems - version 6.0.0

jni — Tue, 12 Mar 2019 12:52:04 GMT

Hello

Does any of you have problems with installation af firepower / sourcefire 6.0.0?

I have a test 5506-x firewall and I intended to use it for som firepower testing. However I do have a lot of issues with installation of version 6.0.0.

It is possible to install version 5.4, but I am not able to neither install nor upgrade it. I've tried to install and upgrade it through ASA CLI, ASDM and through a FirePower Management Center (ESX version), but all fail.

The ASA itself is running:

Cisco Adaptive Security Appliance Software Version 9.5(2)
Device Manager Version 7.5(2).

1. ASA CLI

I am able to boot into the 6.0.0 image, enter IP addresses etc. and run the system install from a FTP server. I does download, extract and starts to install image, but then simply stops.

A sh module gives me this

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
sfr Recover Not Applicable

Steps for CLI install

sw-module module sfr uninstall
debug module-boot
sw-module module sfr recover configure image disk0:asasfr-5500x-boot-6.0.0-1005.img
sw-module module sfr recover boot
session sfr console

setup
system install ftp://10.10.62.3/asasfr-sys-6.0.0-1005.pkg

2. ASDM / FMC

I tell the firewall to install the .sh file. It does start the install, but I also fails ultimately during upgrade. Some times it just fails, other times the task manager informs me about heartbeat issues and also fails.

As said before, I am able to install version 5.4, but after install I do get some errors in the log (see below) which would explain why I get heartbeat issues and cannot upgrade through ASDM or Management Center.

Jan 08 2016 12:39:17: %ASA-1-323006: Module sfr experienced a data channel communication failure, data channel is DOWN.
Jan 08 2016 12:39:20: %ASA-1-323006: Module sfr experienced a data channel communication failure, data channel is DOWN.
Jan 08 2016 12:39:24: %ASA-3-323001: Module sfr experienced a control channel communication failure.
Jan 08 2016 12:39:24: %ASA-1-323006: Module sfr experienced a data channel communication failure, data channel is DOWN.

Jan 08 2016 12:40:30: %ASA-5-505005: Module sfr is initializing control communication. Please wait...
Jan 08 2016 12:40:30: %ASA-1-323006: Module sfr experienced a data channel communication failure, data channel is DOWN.
Jan 08 2016 12:40:37: %ASA-1-505015: Module sfr, application up "ASA FirePOWER", version "5.4.1-211" Normal Operation
Jan 08 2016 12:40:37: %ASA-5-505006: Module sfr is Up.
Jan 08 2016 12:40:38: %ASA-1-505011: Module sfr data channel communication is UP.
Jan 08 2016 12:40:41: %ASA-1-505011: Module sfr data channel communication is UP.

Jan 08 2016 13:36:03: %ASA-1-323006: Module sfr experienced a data channel communication failure, data channel is DOWN.
Jan 08 2016 13:36:05: %ASA-1-323006: Module sfr experienced a data channel communication failure, data channel is DOWN.
Jan 08 2016 13:36:13: %ASA-3-323001: Module sfr experienced a control channel communication failure.
Jan 08 2016 13:36:13: %ASA-1-323006: Module sfr experienced a data channel communication failure, data channel is DOWN.
Jan 08 2016 13:37:19: %ASA-5-505005: Module sfr is initializing control communication. Please wait...
Jan 08 2016 13:37:19: %ASA-1-323006: Module sfr experienced a data channel communication failure, data channel is DOWN.
Jan 08 2016 13:37:29: %ASA-3-323001: Module sfr experienced a control channel communication failure.
Jan 08 2016 13:37:30: %ASA-5-505005: Module sfr is initializing control communication. Please wait...
Jan 08 2016 13:37:37: %ASA-1-505015: Module sfr, application up "ASA FirePOWER", version "5.4.1-211" Normal Operation
Jan 08 2016 13:37:37: %ASA-5-505006: Module sfr is Up.
Jan 08 2016 13:37:37: %ASA-1-505011: Module sfr data channel communication is UP.
Jan 08 2016 13:37:41: %ASA-1-505011: Module sfr data channel communication is UP.

Any suggestions what to try next? Am I missing something or are we talking about a bug or defect hardware?

Thank you for your time.

When you've uninstalled a

Marvin Rhoads — Mon, 11 Jan 2016 15:36:08 GMT

When you've uninstalled a software module (such as the sfr), you need to reinstall it via the two step process - boot image and then setup and proceed with system image. Both images must be the exact same version.

The system image installation takes a while on the small 5506 - a couple of hours isn't unusual. You can tail or examine some detailed log files if you're having problems although that's best done with guidance from the TAC.

Hello Marvin

jni — Tue, 12 Jan 2016 07:22:11 GMT

Hello Marvin

Thank you for your answer. I did try to both upgrade from 5.4 -> 6.0 and also try to uninstall completely and reinstall through the two step process (img + pkg). Neither is working.

The update fails at some time during upgrade before it reaches 100% (last couple of times with a "lost heartbeat") and a complete reinstall through CLI also never finishes.

The complete reinstall terminated the last two times at this point:

Mod-sfr 420> Status: Mapping host 0x2aab38e00000 to VM with size 16777216
Mod-sfr 421> Warning: vlan 0 is not connected to host network
Console session with module sfr terminated.

If I try to reconnect to the console (sessions sfr or session sfr console) it fails.

The session sfr: Module sfr did not respond to session request. (since it is Recover status)

The session sfr console: It will connect (Connected to module sfr. Escape character sequence is 'CTRL-^X'.) but I am not able to enter anything. I just hangs.

The only img/pkg I am able to install is the 5.4.1-211 and no matter what I cannot install the 6.0.

I have the same problem on my

Tim Harrington — Tue, 12 Jan 2016 20:10:38 GMT

I have the same problem on my 5506 as well running the same versions as jnielsen. Attempting to upgrade via the .sh file OR a clean install with the 6.0 boot image and .pkg file fails every time—which totals about 8 attempts so far.

Also fails if trying to patch from 5.4.1-211 to 5.4.1.4-15 using the .sh file via ASDM. I let each attempt run for about 12 hours at one point to no avail. The point at which they fail is different every time. When this all happens sh module sfr simply shows a status of "unresponsive." It will stay that way until I force a reboot and start from scratch again. Crazy.

Yes, I am experiencing the

jni — Wed, 13 Jan 2016 12:04:02 GMT

Yes, I am experiencing the exact same problem/symptoms

Hi,

Aastha Bhardwaj — Thu, 14 Jan 2016 03:25:57 GMT

Hi,

Please make sure for 6.0 you are meeting the minimum requirements .

Refer link : http://www.cisco.com/c/en/us/td/docs/security/firepower/60/relnote/firepower-system-release-notes-version-600.html

Is there any exact error message that you can share where is it stuck ?

Regards,

Aastha Bhardwaj

Rate if that helps!!!

If I try to do a CLI upgrade

jni — Thu, 14 Jan 2016 07:35:41 GMT

If I try to do a CLI upgrade (and hence eliminate possible issues with Management Center), the ASA5506-X is running firepower ver. 5.4.

The ASA itself is running

Cisco Adaptive Security Appliance Software Version 9.5(2)
Device Manager Version 7.5(2).

According to the documentation the minimum requirements are "ASA version 9.4(2) or 9.5(1.5)".

There isn't much of a error message when trying to install through the CLI. After installing the boot image and the setup (IP, GW, hostname, DNS, NTP etc.), I'll try to install the image itself (system install ftp://10.10.62.3/asasfr-sys-6.0.0-1005.pkg). It will do the downloading, verifying and extraction of the pkg and begin to install. It will run for a while and then it just hangs. It isn't possible to connect to the module any more (session sfr or session sfr console) and a show module gives the following output:

# sh mod

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
1 ASA 5506-X with FirePOWER services, 8GE, AC, ASA5506 JAD191602G9
sfr Unknown N/A JAD191602G9

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
1 78ba.f9da.3987 to 78ba.f9da.3990 1.0 1.1.1 9.5(2)
sfr 78ba.f9da.3986 to 78ba.f9da.3986 N/A N/A

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
1 Up Sys Not Applicable
sfr Recover Not Applicable

I've tried to install the upgrade again two days ago where I haven't touched the firewall since, but still no luck (so it shouldn't be the case that it just "takes a long time").

@Tim Harrington: Do you have anything to add?

Hi,

Aastha Bhardwaj — Thu, 14 Jan 2016 17:32:45 GMT

Hi,

Unfortunately we have a doc bug filed for time taken for on box devices. I have seen a case where in upgrading SFR to 6.0 took about 4 hours on asa 5506 or any onbox appliances.

This is because the management center is built into the local system so Firesight management features as well as Firepower service functionalities will need to be upgraded.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

That's exactly what happens

Tim Harrington — Thu, 14 Jan 2016 19:55:04 GMT

That's exactly what happens with mine. If I monitor the upgrade via ASDM task status it will update and display the % complete until the process crashes. Then you basically get the ASDM equivalent of a 404 error. Monitoring via the CLI gives a similar result. It doesn't matter whether I do a patch, upgrade, or a clean install of 6.0. It also doesn't matter whether I use the files on Cisco.com or the files from Sourcefire's support site. Same result.

This happens not only with the 6.0 upgrade, but also the simple 5.4 patches (e.g. 5.4.1.3, 5.4.1.4). I can't go beyond the default version 5.4.1 whether patching, upgrading, or a clean install.

Aha. That would definitely

Tim Harrington — Thu, 14 Jan 2016 19:57:45 GMT

Aha. That would definitely explain it, Aastha. I know it's rather soon, but is there any ETA on a fix for that? Thanks.

Thx for your reply :-).

jni — Thu, 14 Jan 2016 21:23:46 GMT

Thx for your reply :-).

But I have started an fresh install and let it "run" for over 24 hours and still it status is Recovery/Unknown. During install I loose connection to the console and it isn't possible to recover.

My problem is that I have a large installation comming up which has a hard deadline in march. I really must have a running ASA w. firepower at that time. Of course I could go with 5.4, but I would really prefer to be running with a 6.x.

A quick update: I tried to

Tim Harrington — Thu, 21 Jan 2016 17:07:08 GMT

A quick update: I tried to install patch 5.4.1.5-24 and got another failure. See attached screenshot. The upgrade appears to attempt to install the previous incremental patches before applying the most recent one—a cumulative patch process. This attempt seems to have failed during the 5.4.1.2 phase. I went back and tried to apply the previous patches one by one and got the same error: "Unknown Failure Condition." The failure point always seems to occur between 30% and 40% into the process. Each upgrade attempt took a LONG time (about 8 hours). After the first 30 minutes or so the task status in ASDM stopped updating. A refresh of the page then throws a connection refused error. The only thing to do then is to let the patch installer reach a failure condition which takes another few hours.

–Tim

Any fixes for this? I just

KRIS PATE — Mon, 25 Apr 2016 03:29:33 GMT

Any fixes for this? I just tried doing a new install on two 5512X and both loaded the boot and system image, but then hang after the reboot.

I was able to successfully upgrade some of my 5512s that were running 5.4.0.4-55.

I haven't heard anything. I

jni — Wed, 11 May 2016 09:29:33 GMT

I haven't heard anything. I also haven't been investigating a lot because the customer has bought PaloAlto FWs instead. They where tired of waiting for a solution.

Any particular fix that was

Lucas Phelps — Wed, 13 Jul 2016 22:11:12 GMT

Any particular fix that was ever given for this same issue? I'm experiencing exact same symptoms.

Thanks!

Hello Lucas,

Jetsy Mathew — Thu, 14 Jul 2016 04:28:05 GMT

Hello Lucas,

Which is the version that you are trying to move to and what is the existing version that you have. Please attach a screenshot of the error that you are facing.

Regards

Jetsy

I had the same issue and I

castilho1 — Wed, 27 Jul 2016 00:56:02 GMT

I had the same issue and I was able to resolve it through installing 5.4 boot image and package and installing all the updates. During my upgrade to 5.4.1.2 the update got hung and I was able to resolve this. I provided a link to help fix a hung update. One other note is that to upgrade to 6.0.0 you need to run the patch 5.4.1.999 prior to updating to 6.0. You will need to add them manually after downloading from Cisco support site in the upgrade page, after that you can download the remaining updates for 6.0.x from Firesight or ASDM.

Link to fix hung update:

https://supportforums.cisco.com/discussion/12632501/asa5506-x-sfr-module-upgrade-5413-26-error

Please rate if this helps!

Hello Lucas,

Jetsy Mathew — Wed, 27 Jul 2016 09:56:08 GMT

Hello Lucas,

Always try to keep the device in the latest version to avail all the latest features.

The latest 6.0.1.1 is available and having several issues resolved.

http://www.cisco.com/c/en/us/td/docs/security/firepower/601/6011/relnotes/firepower-system-release-notes-version-6011.html

Rate if the post helps you

Regards

Jetsy

Same issue with mine 5506x.

Sheraz.Salim — Sat, 01 Oct 2016 16:05:54 GMT

Same issue with mine 5506x. running

Cisco Adaptive Security Appliance Software Version 9.6(1)
Device Manager Version 7.6(1)

firepower 6.0 pkg not working either on mine.

Data Plane Status: Not Applicable
Console session: Ready
Status: Recover

kindly please suggest what is the fix.

Yes, tailing the log file

joezersk — Mon, 10 Oct 2016 13:27:55 GMT

Yes, tailing the log file definitely shows a more exact view of what is happening. I suffered from the same symptoms as most others here. When you upgrade it seems to step back through all the earlier patches. from my own tail -f of the log file as I upgraded to 5.4.1.8:

ui:[5.4.1.7 at 1%] Running script 000_start/100_start_messages.sh...
ui:[5.4.1.7 at 3%] Running script 000_start/105_check_model_number.sh...
ui:[5.4.1.7 at 5%] Running script 000_start/107_version_check.sh...
ui:[5.4.1.7 at 14%] Running script 000_start/400_run_troubleshoot.sh...
ui:[5.4.1.7 at 15%] Running script 200_pre/001_check_reg.pl...
ui:[5.4.1.7 at 16%] Running script 200_pre/002_check_mounts.sh...
ui:[5.4.1.7 at 17%] Running script 200_pre/003_check_health.sh...
ui:[5.4.1.7 at 29%] Running script 200_pre/201_disable_faild.sh...
ui:[5.4.1.7 at 30%] Running script 200_pre/202_disable_syncd.sh...
ui:[5.4.1.7 at 31%] Running script 200_pre/400_restrict_rpc.sh...
ui:[5.4.1.7 at 32%] Running script 200_pre/500_stop_system.sh...
ui:[5.4.1.7 at 35%] Running script 200_pre/999_enable_sync.sh...
ui:[5.4.1.7 at 39%] Running script 450_prior_updates/100_run_prior_updates.sh...
ui:[5.4.1.6 at 0%] Running script 000_start/100_start_messages.sh...
ui:[5.4.1.6 at 2%] Running script 000_start/105_check_model_number.sh...
ui:[5.4.1.6 at 4%] Running script 000_start/107_version_check.sh...
ui:[5.4.1.6 at 9%] Running script 000_start/113_EO_integrity_check.pl...