topic Re: New FO PIX upgrade in Network Security

New FO PIX upgrade

bcalabrese — Fri, 21 Feb 2020 07:13:39 GMT

I have a single UR PIX 515e running 6.3.3 in production. I'm adding a FO PIX 515e but it's running 6.3.1. I tried to add an IP address to the new FO PIX, it accepted the configuration and the inside interface got a link with my laptop. But TFTP and ICMP traffic would not pass to the PIX. How do I upgrade the FO PIX to 6.3.3 without the UR PIX.

Re: New FO PIX upgrade

shannong — Wed, 04 Feb 2004 18:38:42 GMT

You don't need to have the FO pix plugged into the UR just to upgrade the software. Without the failover cable attached, the FO will "randomly" reboot itself to prevent it being used alone. (message can be seen at boot time on the console) This won't affect you're upgrade process.

Simply plug a crossover cable on the inside interface to your laptop, assign an IP, and ping your laptop to test. By default, the Pix accepts ping request/replies. Once you can ping successfully, use tftp to pull the image on.

Make sure the interface is enabled..

interface ethernet1 100auto

Re: New FO PIX upgrade

bcalabrese — Wed, 04 Feb 2004 20:19:35 GMT

The FO PIX's inside interface was enabled and up/up. I couldn't ping from the FO PIX or the Laptop. Remember the FO PIX was never connected to a UR PIX to get a configuration. Can the FO PIX configuration work (meaning pass traffic) without ever being connected to a UR PIX?

Re: New FO PIX upgrade

shannong — Wed, 04 Feb 2004 21:01:21 GMT

Yes. The FO can operate solo but will reboot itself at random intervals to avoid licensing abuse. Otherwise, you wouldn't be able to replace the UR when it fails.

Just for fun, try connecting the secondary end of the cable to the FO without it being connected on the UR. The Pix can tell when the cable is connected even if nothing is on the other end. This simulates the scenario where the UR dies and is removed for replacement.

Re: New FO PIX upgrade

jose.couto — Thu, 05 Feb 2004 14:50:39 GMT

Try to do a 'failover active' on the pix without having it connected to the production network.

Hope this helps.

Re: New FO PIX upgrade

tckoon — Tue, 10 Feb 2004 03:40:33 GMT

Hi,

I am faced the same problem yesterday. I managed to resolve it.

Reload PIX,press ESC or BREAK to ROM mode, using ROM mode to upgrade the PIX OS on FO PIX.

Regards.

Re: New FO PIX upgrade

bcalabrese — Tue, 10 Feb 2004 17:42:09 GMT

Thanks! do you have a link for instructions on doing the upgrade through ROM mode?

Re: New FO PIX upgrade

shannong — Wed, 11 Feb 2004 00:24:00 GMT

Enter rommon using a sequence like any other IOS device. The commands are available using "?" at the prompt. Here is a link that explains it.

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a0080089cf6.html#xtocid4

Re: New FO PIX upgrade

bcalabrese — Wed, 11 Feb 2004 19:02:12 GMT

Thanks! I didn't have to do that. The problem was the FO PIX needed to be made active. One of the messages above was correct "failover active" and the FO PIX started passing traffic.

THANKS! to all