topic Re: CLI Commands for Ugrading Cisco 5516-X FTD Software in Network Security

CLI Commands for Ugrading Cisco 5516-X FTD Software

VCsupport17 — Fri, 21 Feb 2020 14:27:58 GMT

Hi Community,

We have Cisco ASA 5516-X Firepower Threat Defense running on version 6.1.0. We are planning to upgrade the firmware to version 6.2.X. I believe on version 6.1.X the available and only way to upgrade the firmware is to use HTTP, TFTP or SCP via SSH and CLI commands and not on GUI. Unfortunately, we dont have HTTP server and as usual we are using TFTP (TFTP64) for file transfer.

Is there a guide on how to upgrade or commands and procedures using TFTP?

Thank you in advance.

Re: CLI Commands for Ugrading Cisco 5516-X FTD Software

Marvin Rhoads — Tue, 10 Oct 2017 08:38:30 GMT

You can upgrade via the GUI whether you are running Firepower Device Manager (local manager) or Firepower Management Center (remote manager).

Instructions for each are linked below:

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/fdm/fptd-fdm-config-guide-620/fptd-fdm-mgmt.html#id_32969

https://www.cisco.com/c/en/us/td/docs/security/firepower/620/relnotes/Firepower_System_Release_Notes_Version_620/updating_to_version_6_2_0.html#id_39129

Re: CLI Commands for Ugrading Cisco 5516-X FTD Software

VCsupport17 — Tue, 10 Oct 2017 11:11:18 GMT

Hi Marvin,

Yeh, for version 6.2.X upgrade process can be done on GUI. But in my case i'm running on version 6.1 and cannnot be done on GUI. It just give me the instruction on how to upgrade using HTTP, FTP etc..

When I click the See intruction a new window will open like this:

Re: CLI Commands for Ugrading Cisco 5516-X FTD Software

Marvin Rhoads — Tue, 10 Oct 2017 12:51:19 GMT

Ah you are correct. I had forgotten they changed that behavior in 6.2.

In your case instead of the "sudo wget <filename>" command for http, you could downlaod something like the free SolarWinds SCP server and use scp instead. (I tried tftp and could not make the transfer work - some issue with option settings that aren't configurable from FTD).

Here's an example of using SCP:

root@vftd-new:/var/sf/updates# ls -al
total 8
drwxrwxr-x 2 root www 4096 Oct 10 12:48 .
drwxr-xr-x 68 root root 4096 Sep 6 07:30 ..
root@vftd-new:/var/sf/updates#
root@vftd-new:/var/sf/updates# scp marvin@172.31.1.5:test.txt test.txt
marvin@172.31.1.5's password:
test.txt 100% 7 0.0KB/s 00:00
lost connection
root@vftd-new:/var/sf/updates#
root@vftd-new:/var/sf/updates#
root@vftd-new:/var/sf/updates# ls -al
total 12
drwxrwxr-x 2 root www 4096 Oct 10 12:48 .
drwxr-xr-x 68 root root 4096 Sep 6 07:30 ..
-rwx------ 1 root root 7 Oct 10 12:48 test.txt
root@vftd-new:/var/sf/updates# more test.txt
test123
root@vftd-new:/var/sf/updates#

Re: CLI Commands for Ugrading Cisco 5516-X FTD Software

VCsupport17 — Wed, 11 Oct 2017 05:44:48 GMT

Hi Marvin,

Thank you for your reply.

I will try this commands using SCP. Is this only for uploading the file from SCP server to the device?

How about the command if i will install the upgrade file?

Thank you.

Re: CLI Commands for Ugrading Cisco 5516-X FTD Software

Marvin Rhoads — Wed, 11 Oct 2017 05:52:05 GMT

You're welcome.

Yes - the scp process is just to upload the file to the expected directory on your appliance.

If you scroll down on the help screen you shared earlier you will see the syntax for running the upgrade script (Firepower and FTD upgrades are generally ".sh" files = shell scripts).

Re: CLI Commands for Ugrading Cisco 5516-X FTD Software

VCsupport17 — Wed, 11 Oct 2017 06:23:25 GMT

Hello Marvin,

I tried the commands but i'm getting error.

Error MessageSCP Settings

Could you share your settings on your SCP? I'm using SSH via Putty to access the device.

Re: CLI Commands for Ugrading Cisco 5516-X FTD Software

Marvin Rhoads — Wed, 11 Oct 2017 07:56:35 GMT

You should execute the file transfer with superuser (su) privilege level.

Try "sudo su" first (to switch user for the session) or run the scp command preceded by "sudo" (to change user for that command only).

Re: CLI Commands for Ugrading Cisco 5516-X FTD Software

VCsupport17 — Wed, 18 Oct 2017 10:38:02 GMT

Hi Marvin,

Running the scp command preceeded by "sudo" made the file transfer successful.

I can now proceed with the upgrade process.

Thank you for your help.