topic Re: Unable to copy firmware image to ASA in Network Security

Unable to copy firmware image to ASA

UZaman3 — Mon, 29 Apr 2024 13:00:53 GMT

I am trying to upgrade the firmware on ASA's we have at multiple sites but for some reason copying over the firmware fails. We are currently running FP2140's in ASA mode and whenever I copy the files over from a windows machine, it fails. I am using scp to transfer the file over and the file begins to transfer. On the windows machine I see the progress of the transfer and on the ASA I see a temp file name of scp_1 which indicates the file is being transferred over. It takes 10 minutes or so for the transfer to say 100% on the windows box and then it fails with the error "Error: Signature not valid for file disk0:/cisco-asa-fp2k.9.18.4.22.spa. I was able to successfully transfer this image to our Nexus and even tried to scp it from the Nexus to the ASA but still no luck. Does anyone know how I can get this file up to the ASA so I can upgrade them?

Re: Unable to copy firmware image to ASA

balaji.bandi — Mon, 29 Apr 2024 13:18:23 GMT

check the release notes and bug available in the document :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa918/release/notes/asarn918.html

Re: Unable to copy firmware image to ASA

UZaman3 — Mon, 29 Apr 2024 13:59:22 GMT

Thanks for the reply. I was reading that and maybe I don't understand it correctly. Do I need to install a newer version of ASDM before I can copy the ASA image over?

Re: Unable to copy firmware image to ASA

UZaman3 — Mon, 29 Apr 2024 15:17:18 GMT

I added asdm-7191-95.bin to the firewall and was able to successfully get into the firewall from ASDM. I even tried transferring the file using ASDM and it failed there as well. The current firmware on the ASA is 9.10(1)

Re: Unable to copy firmware image to ASA

Aref Alsouqi — Tue, 30 Apr 2024 09:15:33 GMT

Looks like a bugy behaviour. I would try to upload a different image for example the 9.20.2 and then after that is installed I would try to downgrade it to the 9.18.4.

Re: Unable to copy firmware image to ASA

Marius Gunnerud — Tue, 30 Apr 2024 10:01:58 GMT

I agree that this sees very buggy. If you have issues uploading a different image to the FTD device I suggest opening a TAC case and have them check what is happening.

Re: Unable to copy firmware image to ASA

ImOwaisAB — Tue, 30 Apr 2024 10:09:24 GMT

Can you post the output of these commands?

1. dir flash:

2. show version

Re: Unable to copy firmware image to ASA

UZaman3 — Tue, 30 Apr 2024 12:24:03 GMT

Cisco Adaptive Security Appliance Software Version 9.10(1)
Firepower Extensible Operating System Version 2.4(1.103)
Device Manager Version 7.10(1)

Compiled on Wed 24-Oct-18 17:07 PDT by builders
System image file is "disk0:/mnt/boot/installables/switch/fxos-k8-fp2k-npu.2.4.1 .103.SPA"
Config file at boot was "startup-config"

columbia-asa up 161 days 17 hours
failover cluster up 161 days 17 hours

Hardware: FPR-2140, 14822 MB RAM, CPU MIPS 1800 MHz, 1 CPU (16 cores)

1: Int: Internal-Data0/1 : address is 000f.b748.4800, irq 0
3: Ext: Management1/1 : address is e8d3.225a.3a81, irq 0
4: Int: Internal-Data1/1 : address is 0000.0100.0001, irq 0
5: Int: Internal-Data1/2 : address is 0000.0000.0000, irq 0

License mode: Smart Licensing

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 1024
Inside Hosts : Unlimited
Failover : Active/Active
Encryption-DES : Enabled
Encryption-3DES-AES : Enabled
Security Contexts : 2
Carrier : Disabled
AnyConnect Premium Peers : 10000
AnyConnect Essentials : Disabled
Other VPN Peers : 10000
Total VPN Peers : 10000
AnyConnect for Mobile : Enabled
AnyConnect for Cisco VPN Phone : Enabled
Advanced Endpoint Assessment : Enabled
Shared License : Disabled
Total TLS Proxy Sessions : 10000
Cluster : Disabled

Failover cluster licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 1024
Inside Hosts : Unlimited
Failover : Active/Active
Encryption-DES : Enabled
Encryption-3DES-AES : Enabled
Security Contexts : 4
Carrier : Disabled
AnyConnect Premium Peers : 10000
AnyConnect Essentials : Disabled
Other VPN Peers : 10000
Total VPN Peers : 10000
AnyConnect for Mobile : Enabled
AnyConnect for Cisco VPN Phone : Enabled
Advanced Endpoint Assessment : Enabled
Shared License : Disabled
Total TLS Proxy Sessions : 10000
Cluster : Disabled

Maybe I'm just doing this wrong. Not a FirePower SME by any means. Do I have to update this file - fxos-k8-fp2k-npu.2.4.1 .103.SPA? Wonder if the ASA image is included in the latest package for that?

Re: Unable to copy firmware image to ASA

UZaman3 — Tue, 30 Apr 2024 12:37:08 GMT

Cisco Adaptive Security Appliance Software Version 9.10(1)
Firepower Extensible Operating System Version 2.4(1.103)
Device Manager Version 7.10(1)

Compiled on Wed 24-Oct-18 17:07 PDT by builders
System image file is "disk0:/mnt/boot/installables/switch/fxos-k8-fp2k-npu.2.4.1 .103.SPA"
Config file at boot was "startup-config"

columbia-asa up 161 days 17 hours
failover cluster up 161 days 17 hours

Hardware: FPR-2140, 14822 MB RAM, CPU MIPS 1800 MHz, 1 CPU (16 cores)

License mode: Smart Licensing

Reading on Cisco's documentation that versions prior to 9.13 ran only in Platform mode. Since I'm on 9.10 and am jumping to 9.18, could it be an issue there? Do I need to change the fxos system file (fxos-k8-fp2k-npu.2.4.1 .103.SPA)?

Re: Unable to copy firmware image to ASA

UZaman3 — Tue, 30 Apr 2024 13:18:41 GMT

Also, I was able to successfully push this image to our FP1150's running ASA mode at another site and finished the upgrade for those yesterday. So just having issues on the 2140's

Re: Unable to copy firmware image to ASA

Dustin Anderson — Tue, 30 Apr 2024 13:53:15 GMT

Have you tried to download the file again. The 1150 and 2140 has different files for updates, so have you successfully updated a 2K series with the 2K file?

On windows, check the hash of the file

certutil -hashfile <file> MD5

cisco-asa-fp2k.9.18.4.22.SPA vs cisco-asa-fp1k.9.18.4.22.SPA

Re: Unable to copy firmware image to ASA

UZaman3 — Tue, 30 Apr 2024 19:19:57 GMT

Yes, sorry for not being clear. Same version for both firewall platforms but different files:

FPR-1150: cisco-asa-fp1k.9.18.4.22.SPA worked without issue

FPR-2140: cisco-asa-fp2k.9.18.4.22.SPA - does not allow me to copy over to the ASA

Re: Unable to copy firmware image to ASA

Dustin Anderson — Tue, 30 Apr 2024 21:40:46 GMT

Yeah, I have had a similar issue where the file did not download correctly and the hash did not match, so the system would not install it.

you can check the hash of the file in windows and compare it to the hash on cisco's site. If it doesn't match try to download it again and re-check.

in windows pull up a command prompt and this is the command. change <file> with the filename. just be in the folder the file is in.

certutil -hashfile <file> MD5

Re: Unable to copy firmware image to ASA

UZaman3 — Tue, 30 Apr 2024 21:46:28 GMT

PS C:\Users\Administrator\Desktop> certutil -hashfile .\cisco-asa-fp2k.9.18.4.22.spa MD5
MD5 hash of .\cisco-asa-fp2k.9.18.4.22.spa:
9ba8d793ef1e3dbdfef3f0bb60a08ab5
CertUtil: -hashfile command completed successfully.

This looks like it matches what is on Cisco's website for this image -

Description :	Cisco Adaptive Security Appliance for the Cisco Firepower 2100 Series.
Release :	9.18.4 Interim
Release Date :	06-Mar-2024
FileName :	cisco-asa-fp2k.9.18.4.22.SPA
Size :	468.58 MB ( 491340160 bytes)
MD5 Checksum :	9ba8d793ef1e3dbdfef3f0bb60a08ab5

Re: Unable to copy firmware image to ASA

UZaman3 — Tue, 30 Apr 2024 23:30:37 GMT

I found this table - wondering if I need to update the FXOS OS before I can update the ASA firmware:

Table 15.Threat DefenseASAFXOS

7.4.1.1	9.20(2.201)	2.14.1.131
7.4.1	9.20(2.2)	2.14.1.131
7.4.0	9.20(1.84)	2.14.0.475
7.3.1.1	9.19(1.202)	2.13.0.1022
7.3.1	9.19(1.200)	2.13.0.1022
7.3.0	9.19(1)	2.13.0.198
7.2.7	9.18(4.201)	2.12.1.73
7.2.6	9.18(4.22)	2.12.1.73
7.2.5.1	9.18(3.60)	2.12.0.530
7.2.5	9.18(3.53)	2.12.0.519

Re: Unable to copy firmware image to ASA

Marius Gunnerud — Wed, 01 May 2024 08:02:17 GMT

FXOS package should be included in the update you are trying to install. It is just the 4100 and 9100 series that require a separate FXOS upgrade.

I suggest trying to upload random .cfg file you create to the ASA to verify that upload actually works. if that works, try uploading 9.20 to the device. Just be clear that you are not upgrading to 9.20 unless you want to, we just need to verify that copying files to the device is not the issue and that the issue is with that specific software.

If those do not copy to the ASA then there is an issue that you will need TAC to assist with.

Re: Unable to copy firmware image to ASA

UZaman3 — Wed, 01 May 2024 13:16:04 GMT

So I was able to successfully copy over asdm-7191-95.bin to the 2140 and set it as the new asdm image so copying files over definitely works. But for whatever reason, whenever I try to copy the ASA image over, it fails with the same error every time: "%Error: Signature not valid for file disk0:/asa_file_name"

These are the ASA images I have tried to copy over and they have all failed with that error:

cisco-asa-fp2k.9.20.2.10.SPA

cisco-asa-fp2k.9.17.1.SPA

cisco-asa-fp2k.9.16.3.14.SPA

cisco-asa-fp2k.9.14.3.1.SPA

Re: Unable to copy firmware image to ASA

Dustin Anderson — Wed, 01 May 2024 18:13:28 GMT

Not sure if this is applicable to yours, but there was a similar copy bug on the 5500 series it looks like that they had to disable the SFR module to get the copy to succeed.

https://community.cisco.com/t5/network-security/asa-ios-upgrade-quot-signature-not-valid-for-file-quot-error-9-8/td-p/4398459

Re: Unable to copy firmware image to ASA

UZaman3 — Wed, 01 May 2024 18:53:37 GMT

Thank you for sharing and yeah, I saw that as well. Does the 2140 chassis have the SFR module? I don't believe it does since it's natively a Firepower chassis and not an ASA chassis with a FirePower Module like the 5500 series was. I could be wrong though

Re: Unable to copy firmware image to ASA

Dustin Anderson — Wed, 01 May 2024 19:40:42 GMT

Yeah, I know the 5500 series had a show module command, but on our 2140 I don't see anything, but we also have it as a FTD, not ASA.

It really seems like some bug, and you may need to open a TAC to see if they have a workaround.

On a side note, do you have physical access to it that you could try copying from a USB drive?