topic Re: ASA5555 software modules not supported and cannot uninstall in Network Security

ASA5555 software modules not supported and cannot uninstall

Semi-amateur — Mon, 23 Oct 2023 15:12:14 GMT

Hi, I just update firmware to the latest with my asa5555-x. Appliance works otherwise, but I get the following two errors on boot:

IPS module is no longer supported and was prevented from booting Consider uninstalling the unsupported IPS module with the command ‘sw-module module ips uninstall' CXSC module is no longer supported and was prevented from booting Consider uninstalling the unsupported CXSC module with the command ‘sw-module module cxsc uninstall'

When I try to run the given uninstall commands, the command fails for both of them with:

asa# sw-module module ips uninstall Unable to uninstall Module ips, it does not have a software image installed. asa# sw-module module cxsc uninstall Unable to uninstall Module cxsc, it does not have a software image installed.

How could I get rid of those warnings? The device works otherwise perfectly.

Re: ASA5555 software modules not supported and cannot uninstall

AViftrup — Mon, 23 Oct 2023 15:51:32 GMT

This might only be a cosmetic error.

Could you please provide the output of "show module" and post in here?
Also could you please provide us with the version you upgraded to?

EDIT: However you could be hitting https://bst.cisco.com/bugsearch/bug/CSCvn61662 - even tho it is more oriented for the cxsc module.

Re: ASA5555 software modules not supported and cannot uninstall

Marvin Rhoads — Mon, 23 Oct 2023 18:50:40 GMT

The boot messages are indeed just cosmetic and do not affect the operations of your ASA in any way. Only the sfr (Firepower services) module will work with your ASA 5555-X and even that is past end-of-sales. FYI, the sfr latest release for the ASA 5555-X was 6.6.7.1 and that requires ASA 9.14 or lower (and a license which is no longer sold) to operate.

9.14 is the last version of software available for the ASA 5555-X. It was first released in September 2020 with the last interim build of 9.14(4) having been released in February 2023.

Re: ASA5555 software modules not supported and cannot uninstall

Semi-amateur — Tue, 24 Oct 2023 02:52:04 GMT

Thanlks for the reply, here is output of sh module:

asa# sh module Mod Card Type Model Serial No. ---- -------------------------------------------- ------------------ ----------- 0 ASA 5555-X with SW, 8 GE Data, 1 GE Mgmt ASA5555 ips Unknown N/A cxsc Unknown N/A sfr Unknown N/A Mod MAC Address Range Hw Version Fw Version Sw Version ---- --------------------------------- ------------ ------------ --------------- 0 00a3.8e58.f5bc to 00a3.8e58.f5c5 3.0 2.1(9)8 9.14(4)23 ips 00a3.8e58.f5ba to 00a3.8e58.f5ba N/A N/A cxsc 00a3.8e58.f5ba to 00a3.8e58.f5ba N/A N/A sfr 00a3.8e58.f5ba to 00a3.8e58.f5ba N/A N/A Mod SSM Application Name Status SSM Application Version ---- ------------------------------ ---------------- -------------------------- ips Unknown No Image Present Not Applicable cxsc Unknown No Image Present Not Applicable Mod Status Data Plane Status Compatibility ---- ------------------ --------------------- ------------- 0 Up Sys Not Applicable ips Down Not Applicable cxsc Down Not Applicable sfr Unresponsive Not Applicable Mod License Name License Status Time Remaining ---- -------------- --------------- --------------- ips IPS Module Disabled perpetual

Re: ASA5555 software modules not supported and cannot uninstall

Semi-amateur — Tue, 24 Oct 2023 02:53:13 GMT

I'm using just that version:

asa# sh ver Cisco Adaptive Security Appliance Software Version 9.14(4)23 SSP Operating System Version 2.8(1.200) Compiled on Wed 15-Feb-23 19:58 GMT by builders System image file is "disk0:/asa9-14-4-23-smp-k8.bin" Config file at boot was "startup-config" asa up 11 hours 58 mins Hardware: ASA5555, 16384 MB RAM, CPU Lynnfield 2800 MHz, 1 CPU (8 cores) ASA: 8564 MB RAM, 1 CPU (2 cores)

Re: ASA5555 software modules not supported and cannot uninstall

Marvin Rhoads — Tue, 24 Oct 2023 03:47:18 GMT

So you are all good. Only the sfr module is installed and it appears to be not fully initialized. That's not problem as it only works with a license which you presumably do not have (and if you don't, they are no longer for sale).

You can just ignore all of the module messages and status and operate the ASA as a traditional layer 4 firewall.

Re: ASA5555 software modules not supported and cannot uninstall

Semi-amateur — Tue, 24 Oct 2023 03:41:48 GMT

Thanks, basic firewall functionality is really all I need. Value on this device was amazing, bought this for 40$.

BTW does the HA configuration still work without those modules if I find another ASA5555-X?

Re: ASA5555 software modules not supported and cannot uninstall

Marvin Rhoads — Tue, 24 Oct 2023 04:14:19 GMT

HA works without the sfr module installed as long as both ASAs have that state.