topic Hi Jetsy, in Network Security

Patching ASA Firepower

chanccmtech — Tue, 12 Mar 2019 07:57:43 GMT

Good Day all,

If I were to patch ASA Firepower module from version 6.0.0 to 6.0.1.1, can this be done via CLI?

If yes, please point me to the correct guide. Thanks.

Is this controlled by a

Philip D'Ath — Wed, 29 Jun 2016 04:47:41 GMT

Is this controlled by a Firesight management appliance? If so you need to use that to do the software upgrade.

Yes in future it will be

chanccmtech — Wed, 29 Jun 2016 04:51:02 GMT

Yes in future it will be managed by FMC. Physically the firewall distance from FMC is geographically very far

What is managing it at the

Philip D'Ath — Wed, 29 Jun 2016 04:58:02 GMT

What is managing it at the moment?

If it is nothing, including no local management, you can re-image the module to the new software version.

Not being managed at the

chanccmtech — Wed, 29 Jun 2016 05:29:04 GMT

Not being managed at the moment and it has a firepower version 5.3.1. Re-image to version 6.0.0 or 6.0.1.1?

Hello Team,

Jetsy Mathew — Wed, 29 Jun 2016 05:40:55 GMT

Hello Team,

Ideally the upgrade or update patch should be done from FMC GUI .

Here is the release notes for the same. In this its has the steps on how to upgrade the devices.

Firepower System Release Notes, Version 6.0.1.1

http://www.cisco.com/c/en/us/td/docs/security/firepower/601/6011/relnotes/firepower-system-release-notes-version-6011.html

I cannot see any info regards with either ASDM or FMC manages your device. How it is managed now ? If there is nothing manages the device then you can reimage directly the firepower module to 6.0.1.1. Also kindly setup the FMC in future.

Kindly rate if this answer helps you.

Regards

Jetsy

You have to re-image to 6.0.0

Philip D'Ath — Wed, 29 Jun 2016 06:35:01 GMT

You have to re-image to 6.0.0.

Hi Jetsy,

chanccmtech — Wed, 29 Jun 2016 07:34:03 GMT

Hi Jetsy,

Thanks for your input, let me explain here:

The current FW my customer have is in production being managed by using ASDM, as they just recently bought SFR license. But the issue that they are facing is, the patch files are too big to be transferred over VPN.

Their firewall is in another country, meanwhile the FMC is in another country. But the FMC version is 6.0.1 but their SFR is only version 5.3.1. So their plan is to have the SFR re-imaged to version 6.0.0 and then apply the patches or is there a way that we can re-image SFR to at least version 6.0.1?

And future patches, is there a way to be done over CLI or must it be done via FMC GUI?

So I still have to get to

chanccmtech — Wed, 29 Jun 2016 07:35:19 GMT

So I still have to get to base image and do an upgrade.

That's where my initial question started, can the SFR perform patches via CLI? Or must it be ran from FMC GUI?

I don't believe patches can

Philip D'Ath — Wed, 29 Jun 2016 07:38:14 GMT

I don't believe patches can be done from CLI.

I see, what about FTD images?

chanccmtech — Wed, 29 Jun 2016 07:58:52 GMT

I see, what about FTD images? I was told that the below:

http://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/5500X/ftd-55xx-X-qsg.html#pgfId-182159

By running the command:

> system install http://upgrades.example.com/packages/ftd-6.0.0-567.pkg

I don't know about FTD images

Philip D'Ath — Wed, 29 Jun 2016 08:00:24 GMT

I don't know about FTD images.