topic Re: FTD Out of Compliance in Network Security

FTD Out of Compliance

h.dam — Thu, 04 Feb 2021 11:01:45 GMT

Hello,

My FTD is out of compliance because of wrong contract attachment.

Today I just checked my smart account which seems the number of license is ok.

I would like to know: How to re-activate my license using FDM (I don't use FMC)

From Cisco FTD-smart-license-registration document, there is a "re-authorize" case to check, but I don't have this in FDM smart licensing.

Thank you.

Re: FTD Out of Compliance

Marvin Rhoads — Thu, 04 Feb 2021 12:58:19 GMT

Unregister it and then re-register using a new token from the correct Smart account.

Re: FTD Out of Compliance

h.dam — Fri, 05 Feb 2021 11:39:28 GMT

Thank you Marvin.

I did successfully the registration.

Now I am trying to upgrade to v6.6 firmware, it failed.

The FTD is v6.3, can I go direct to v6.6 ?

When I clicked upgrade install, it had been trying to do something and I was logged out.

But on my console screen, it didn't reboot without any messages.

show version gave me the same version as before.

Any idea?

Re: FTD Out of Compliance

Marvin Rhoads — Fri, 05 Feb 2021 12:45:43 GMT

Please share more information such as: the Firepower model, exact current version, file you are using to upgrade and what steps you are trying.

Generally speaking you can go directly from 6.3 to 6.6. Firepower 4100 and 9300 series require a firmware (FXOS) upgrade first. Also, we would recommend going directly to 6.6.1 at this time as that is the current recommended release.

Re: FTD Out of Compliance

h.dam — Fri, 05 Feb 2021 13:48:16 GMT

Hello,

It is a FTD 2130 with origin v6.3 firmware

I did upgrade using FDM GUI.

I uploaded the v6.6.1 file then clicked install. But nothing happened.

The FW always stayed with v6.3.

Re: FTD Out of Compliance

h.dam — Sun, 07 Feb 2021 09:35:40 GMT

Hello Marvin,

Here's my feedbacks to share.

Since I didn't find out why 6.6 was failed, I tried to upgrade to 6.7.

After having validated the upgrade, I found that it was done after one hour later (keeping FDM logged out)

This FTD software makes me disappointed. The update rollout is done silently without any signs of running/finish.

The time is long. Now I need to re-think if we replace all our ASA by FTD in production.

Please let me know if someone has replacement feedbacks and difficulties.

Re: FTD Out of Compliance

Marvin Rhoads — Sun, 07 Feb 2021 11:23:09 GMT

FTD upgrade on a 2100 series is expected to take ~30 minutes.

Reference:

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/relnotes/firepower-release-notes-660/upgrade.html#id_64089

In the FDM GUI you won't get any visual indication of progress.The upgrade instructions in the Configuration Guide note:

"You are automatically logged out of the system. Installation might take 30 minutes or more.

Wait before logging into the system again."

Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/660/fdm/fptd-fdm-config-guide-660/fptd-fdm-mgmt.html#id_32969

When using FMC, the GUI will display progress.

On either platform you can watch progress step by step from the cli by using "tail - status.log" of the log file that's in the folder of the current upgrade. Those folders are found under /var/log/sf/<upgrade version> or /ngfw/var/log/sf/<upgrade version> (varies according to model and version).