topic Re: Reimage Question in Network Security

Reimage Question

m.azlan — Thu, 08 Apr 2021 06:32:18 GMT

Hi,

I have some question regarding reimage FTD. We have a model Cisco 5545. The current version is 5.4.0-764 and plans to upgrade to 6.6.1. The question is can we use the backup current version after reimaging to 6.6.1? Since the path is very long, we try to consider reimage the FTD.

Another question, can we configure bypass mode to prevent interruption during upgrade/reimage? Meaning that to apply fail-open, I guess the term.

Re: Reimage Question

Marvin Rhoads — Fri, 09 Apr 2021 04:15:45 GMT

You seem to be asking about the ASA Firepower service module (not FTD).

When you reimage a Firepower service module, all configuration from the old module is lost. It cannot be migrated per se. If it was being managed by a Firepower Management Center, the Access Control Policy (and all other associated policies) can be reapplied to the newly imaged module.

You will have to re-do the bootstrap configuration of the module in either case (IP address, gateway, etc.).

If the class-map entry for sfr is fail-open then there will be no service impact when reimaging (other than loss of IPS services of course).

Re: Reimage Question

m.azlan — Fri, 09 Apr 2021 08:17:50 GMT

Hi Marvin,

Thank you for your reply. May I know if reimage, meaning that, we just need to configure the IP, gateway, etc and then establish a connection between FMC and FTD after that push the configuration (policy, etc) from FMC? it should be work right? no need to configure all the configuration right?

class-map entry for sfr is fail-open, may I know which guide to refer to this one? we need to configure before perform the upgrade.

Re: Reimage Question

Marvin Rhoads — Fri, 09 Apr 2021 14:24:19 GMT

m.azlan - that's correct.

Step 7 in the following document sets the fail-open or fail-close action using ASDM:

https://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.html#pgfId-150498

More details on the actual cli command:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-cli-reference/S/asa-command-ref-S/sa-shov-commands.html#wp3900250880

Re: Reimage Question

ajmn — Tue, 11 Mar 2025 11:50:40 GMT

Hi, m.azlan. Please take a look at https://youtu.be/uYJRLAcG0vY for more information.