topic Re: FPR 1120 reimage problem in Network Security

FPR 1120 reimage problem

lmoceze — Fri, 29 Nov 2024 14:22:45 GMT

Hey there,

I try to reimage my FPR 1120 box from 6.x to 7.2.5, however I am facing the following problem:

xxx> show version 
----------------------[ xxx ]-----------------------
Model : Cisco Firepower 1120 Threat Defense (78) Version 6.4.0 (Build 102)
(...)
xxx(local-mgmt)# format everything 
All configuration and bootable images will be lost.
Do you still want to format? (yes/no):yes
(...)
rommon 13 > tftp -b
(...)
Ethernet init success 
Enable boot bundle: tftp_reqsize = 268435456
(...)
IMAGE: cisco-ftd-fp1k.7.2.5-208.SPA

link up
Receiving cisco-ftd-fp1k.7.2.5-208.SPA from (...) !!!
Overall timeout.

File reception completed.
Boot buffer bigbuf=640ff498
Boot image size = 199115728 (0xbde43d0) bytes
[image size] 199115728
(...)
Failed to validate digital signature in Primary key Storage !!
Failed to validate digital signature in Backup key Storage !!
+-------------------------------------------------------------------+
+------------------------- FAILURE ---------------------------------+
+-------------------------------------------------------------------+
| |
| LFBFF signature authentication failed !!! |
| |
+-------------------------------------------------------------------+

Incorrect installer image for this platform !!

Failed to Free memory block at address 0x00000000640ff498

(...) means that I cut some parts of the output.

However the Incorrect installer image for this platform !! seems to be a pretty straight forward message, as I understood, the SPA is the fresh install package, not the ral.tar. So im not sure what Im missing here.
Did anyone faced this issue too?

Thanks a lot!

Re: FPR 1120 reimage problem

Mark Elsen — Sat, 30 Nov 2024 11:32:24 GMT

- Ref : https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/release-notes/threat-defense/720/threat-defense-release-notes-72.html#r_ftd-upgrade-path
Check Table 17. it looks like you can not go directly from 6.4 to 7.2.5 ,

Re: FPR 1120 reimage problem

lmoceze — Mon, 02 Dec 2024 08:33:19 GMT

Hi M.!
Thanks for the reply!
However, I have did:

xxx(local-mgmt)# format everything 
All configuration and bootable images will be lost.
Do you still want to format? (yes/no):yes

As of my understanding, it should be an "empty" box, does the upgrade path still matters?
Thanks a lot!

Re: FPR 1120 reimage problem

lmoceze — Mon, 02 Dec 2024 09:24:14 GMT

Hey there,
It turns out that the MD5 of the image on the Cisco site and the MD5 of the image copied is not the same (probably got lost on the way due to TFTP copy + internet) so I think that is the reason. I will do it another way, will keep you posted.

Re: FPR 1120 reimage problem

lmoceze — Mon, 02 Dec 2024 12:12:47 GMT

Hello All,
The problem was that more than 0 packets got lost during transit, so the image was incorrect.
Moral of the story: use USB or dont put your life on TFTP + Internet