topic Re: CISCO IOS issue in Network Security

CISCO IOS issue

surajlingwal — Wed, 05 Oct 2022 18:42:09 GMT

While i upload the boot system for firewall ASA 5506-x with image cisco-asa-fp1k.9.16.2.SPA and after reloading getting below error and I couldn't able to login to firewall.

########################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################

Signature verification failed for key# 1
Failed to validate digital signature
Signature verification failed for key# 1
Failed to validate digital signature
LFBFF signature verification failed!!
lfbff_desc_get_payload_len bounds errorlfbff_desc_get_payload_len bounds error

Re: CISCO IOS issue

Marvin Rhoads — Thu, 06 Oct 2022 02:18:38 GMT

That's not the correct image for your hardware. The "fp1k" in the image name denotes that it is for ASA software running on Firepower 1k series appliances (1010, 1120, etc.).

You need one of the images listed on this page:

https://software.cisco.com/download/home/286283326/type/280775065/release/9.16.3%20Interim

For example, "asa9-16-3-23-lfbff-k8.SPA" would work.

Re: CISCO IOS issue

surajlingwal — Fri, 07 Oct 2022 14:22:06 GMT

Thanks for reply Marvin.

But the FW is stuck we cant do any changes so how we can get out from it.
IT is stuck on below path :-

Signature verification failed for key# 1
Failed to validate digital signature
Signature verification failed for key# 1
Failed to validate digital signature
LFBFF signature verification failed!!
lfbff_desc_get_payload_len bounds errorlfbff_desc_get_payload_len bounds error

Re: CISCO IOS issue

Marvin Rhoads — Fri, 07 Oct 2022 15:13:58 GMT

You can follow the procedure to reimage from fxos and specify a valid image.

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/reimage/asa-ftd-reimage.html#task_vhy_5kc_sgb

Re: CISCO IOS issue

iwearing — Fri, 18 Aug 2023 12:41:22 GMT

Hi Gents,

Interesting as I have a similar issue trying to re-image an FTD-1120 which was already deployed with a 6.3 FTD image. Trying to Load 7.0.5

Failed to validate digital signature in Primary key Storage !!

Failed to validate digital signature in Backup key Storage !!

+-------------------------------------------------------------------+

+------------------------- FAILURE ---------------------------------+

+-------------------------------------------------------------------+

| |

| LFBFF signature authentication failed !!! |

| |

+-------------------------------------------------------------------+

Incorrect installer image for this platform !!

boot: error executing "boot disk1:cisco-ftd-fp1k.7.0.5-72.SPA"

I tried the ASA Image for the FTD-1120 which passes signature authentication but then fails

lfbff_desc_get_payload_len bounds errorlfbff_desc_get_payload_len bounds error

Would you have any ideas what the issue may be?

thanks

Ian

Re: CISCO IOS issue

Marvin Rhoads — Fri, 18 Aug 2023 12:48:54 GMT

Are you following this procedure:

https://www.cisco.com/c/en/us/td/docs/security/firepower/2100/troubleshoot_fxos/b_2100_CLI_Troubleshoot/b_2100_CLI_Troubleshoot_chapter_011.html#task_uzp_kv1_hbb

Re: CISCO IOS issue

iwearing — Fri, 18 Aug 2023 12:55:35 GMT

Hi Marvin,

Thank you for the reply. Yes this is the procedure that I am following.

Do you think this document which references 1000/2100 also includes the 1120?