topic Re: ASA & ASDM upgrade in Network Security

ASA & ASDM upgrade

actica123 — Mon, 11 Mar 2019 18:23:00 GMT

We have a Cisco ASA5510 which came last year with the default software installed:

asa708-k8.bin

asdm-508.bin

i have successfully configured the vpn and security rules etc.

i would now like to upgrade the asdm and asa software, so i downloaded all the new software levels from the appropriate part of the cisco website

i have managed to upgrade the asdm to 509 using the following process:

***

asdm image disk0:/asdm509.bin

wr me

reload

***

If i try any other higher version such as 511 i get the error:

"Device Manager image set, but not a valid image file"

I have read that you can get this error and it doesn't matter, so if i continue and write the setting to flash and reboot - then i can't get into the asdm once it has rebooted.

I have also tried updating the boot system variable to later software (eg 711) as well as the asdm (611). When the system reboots it seems to see the new asa software but it will not boot it. it does not spit out any errors but keeps recycling back to the choice of booting in 10 seconds or press escape to stop, whereby i have to boot it back into the 708 level of the software from the rommon# command line

i am not using tftp (which i don't believe is so necessary anymore) and i used the asdm to upload the newer downloaded files from my laptop to the device. are there any more checks that i can make to verify the software other than filesize?

what further options have i got?

thanks

Re: ASA & ASDM upgrade

Jitendriya Athavale — Tue, 10 Aug 2010 08:35:54 GMT

you need to remove the old boot system mapping, it doesnt work like routers where you give a boot system command it over writes it.

try the following

show run boot

remove the old boot system commands

give the new boot system command and reload

you can read more here

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008067e9f9.shtml#maintask2

Re: ASA & ASDM upgrade

actica123 — Tue, 10 Aug 2010 09:35:13 GMT

i was using this link as a guide to changing the config. This is the method that i used:

config terminal

boot system disk0:/asa711-k8.bin

write memory

reload

i also tried using the GUI setting as well....

in the bootup sequence of the device on the CLI i could see that the 711 software was definitely starting - it just wasn't getting any further

thanks

dickon

Re: ASA & ASDM upgrade

Kureli Sankar — Tue, 10 Aug 2010 11:54:59 GMT

Download 7.2.4 and the matching asdm and upload the files to the ASA and change both

boot system and asdm image and see if they will load fine.

ASA code: (7.2.4) http://tools.cisco.com/squish/10C815

ASDM image (5.2.4): http://tools.cisco.com/squish/a5338C

-KS

Re: ASA & ASDM upgrade

actica123 — Tue, 10 Aug 2010 12:18:21 GMT

Hi thanks

i still get the following error

asafirewall(config)# sho disk

-#- --length-- -----date/time------ path

6 5548032 Jan 01 2003 00:06:26 asa708-k8.bin

7 0 Oct 22 2008 19:32:02 crypto_archive

8 6163744 Oct 22 2008 19:34:44 asdm-508.bin

11 6190944 Jul 23 2010 10:52:56 asdm-509.bin

12 7552312 Jul 23 2010 10:58:50 asdm511.bin

13 6746112 Jul 23 2010 11:06:16 asa711-k8.bin

14 7495680 Jul 23 2010 12:01:02 asdm-512.bin

15 6514852 Aug 10 2010 13:09:02 asdm-524.bin

16 8515584 Aug 10 2010 13:11:16 asa724-k8.bin

200589312 bytes available (54837248 bytes used)

asafirewall(config)# asdm image disk0:/asdm-524.bin

Device Manager image set, but not a valid image file disk0:/asdm-524.bin

is this always a problem? - should it just be ignored? is there an issue with the 711/511 version? there is no error when specifying the system disk.

Re: ASA & ASDM upgrade

Jitendriya Athavale — Tue, 10 Aug 2010 12:41:12 GMT

If I understand you right I think u r refering to the output of show disk as error.

If so it's not an error all its saying is what you have in your flash

Re: ASA & ASDM upgrade

actica123 — Tue, 10 Aug 2010 12:46:34 GMT

no - i am showing you the output of the show disk command to show you the file size of the uploaded binary files

and i am showing you the error from the asdm image setting command

Re: ASA & ASDM upgrade

mirober2 — Tue, 10 Aug 2010 15:37:21 GMT

Hi Dickon,

If your ASA is running 7.1(1), ASDM 5.2(4) will not work. The latest ASDM image available for 7.1(1) is ASDM 5.1(2). 5.2 or higher will generate the error message you're seeing.

Your best bet is to upgrade to ASA 7.2(4) and ASDM 5.2(5).

Hope that helps.

-Mike

Re: ASA & ASDM upgrade

actica123 — Tue, 10 Aug 2010 17:01:55 GMT

hi Mike

as i mentioned before above my current config is:

asa 7.0(8)

asdm 5.0(9)

i have followed the directions to upgrade from asa 708 to asa 711 and from asdm 509 to 511(with both the CLI and the GUI) and it does not seem to work properly, this resulted in a perpetual rebooting process whereby i could only stop it by escaping from the boot process at the 'rommon:' prompt to force it to boot back into the asa 708. i have only been able to upgrade successfully from asdm 5.0(8) to 5.0(9). There was no obvious error message in this rebooting process. when i next try it i might be able to include a sample - i will need to extend the history of the putty terminal - but it should be ok.

should i be able to make the following step upgrade in one go as you suggest?

asa 7.0(8)- > asa 7.2(4)

asdm 5.0(9) - > asdm 5.2(5)

when i make the command :

asdm image disk0:/asdm525.bin

i always get the image invalid error - see my previous post - is this to be expected?

dickon

Re: ASA & ASDM upgrade

Kureli Sankar — Tue, 10 Aug 2010 17:25:44 GMT

That error (i always get the image invalid error ) doesn't make sense.

When you issue "dir flash:" you do see the exact same file name correct?

asdm image disk0:/asdm525.bin

It is not missing a "-" or other character? Copy and paste it from the "dir flash" output instead of typing.

Issue

"asdm image flash:/"

-KS

Re: ASA & ASDM upgrade

Allen P Chen — Tue, 10 Aug 2010 17:42:52 GMT

Hi Dickon,

Quick question for you. You mentioned the following:

Did you experience the perpetual reboot when the ASA image was changed from 708 to 711 (with the "boot system" command), or when the ASDM image was changed from 509 to 511 (with the "asdm image" command)? Please let me know.

Thanks in advance.

Re: ASA & ASDM upgrade

actica123 — Tue, 10 Aug 2010 17:48:38 GMT

ok - small typographical error i missed the '-', however whichever .bin file i try to make the asdm image it does always come up with the same error

again i include the show disk output to illustrate the file sizes of the uploaded files. the only time when i have not received this error is when i upgraded the asdm from 5.0(8) to 5.0(9)

asafirewall(config)# sho asdm image

Device Manager image file, disk0:/asdm-508.bin

asafirewall(config)#

asafirewall(config)# sho run boot

boot system disk0:/asa708-k8.bin

asafirewall(config)#

asafirewall(config)# sho disk

-#- --length-- -----date/time------ path

6 5548032 Jan 01 2003 00:06:26 asa708-k8.bin

7 0 Oct 22 2008 19:32:02 crypto_archive

8 6163744 Oct 22 2008 19:34:44 asdm-508.bin

11 6190944 Jul 23 2010 10:52:56 asdm-509.bin

12 7552312 Jul 23 2010 10:58:50 asdm511.bin

13 6746112 Jul 23 2010 11:06:16 asa711-k8.bin

14 7495680 Jul 23 2010 12:01:02 asdm-512.bin

15 6514852 Aug 10 2010 13:09:02 asdm-524.bin

16 8515584 Aug 10 2010 13:11:16 asa724-k8.bin

17 6507516 Aug 10 2010 18:40:14 asdm-525.bin

194076672 bytes available (61349888 bytes used)

asafirewall(config)#

asafirewall(config)# asdm image disk0:/asdm-525.bin

Device Manager image set, but not a valid image file disk0:/asdm-525.bin

asafirewall(config)#

Re: ASA & ASDM upgrade

Kureli Sankar — Tue, 10 Aug 2010 17:54:13 GMT

Uh huh !

Also, you need to make sure "sh ver" shows a proper asa code running for it to take the asdm image line which matches the asa code already loaded

on the ASA.

Meaning you can't be running ASA 7.x code and pointing to the asdm image for 6.2.x. It will not work.

-KS

Re: ASA & ASDM upgrade

actica123 — Tue, 10 Aug 2010 17:54:23 GMT

ok - i am pretty sure i experienced the perpetual rebooting only when i changed the boot system disk on its own and when i changed them both at the same time - it was a few hours ago now - the first time i tried it from the CLI it added the .bin to list list but the 7.0(8) was higher. i have read that it should be possible to change them both at once.

if you try and change just the asdm (from 508 to 511) on its own it will give you the image error and then reboot - but you can't access the asdm once it is rebooted - i thought i had read somewhere it was backwards compatible one version

dickon

Re: ASA & ASDM upgrade

Allen P Chen — Tue, 10 Aug 2010 18:00:46 GMT

Hi Dickon,

ASDM 5.2(5) is only compatible with ASA 7.2. Therefore, can you try the following.

1. First change the boot parameters to point to the 7.2 file:

no boot system disk0:/asa708-k8.bin

boot system disk0:/asa724-k8.bin

wr mem

2. Reboot the ASA, verifiy that it boots into 7.2(4) in the output of "show version".

3. Once it boots into 7.2(4), please change your ASDM image:

asdm image disk0:/asdm-525.bin

Please let us know your findings, thanks.

Re: ASA & ASDM upgrade

actica123 — Tue, 10 Aug 2010 18:06:50 GMT

ok thanks for both your answers and suggestions (kusankar and allenpch) i think i understand - and it sort of makes sense.

i will try this - have to do it out of hours on thursday night (UK time) - so i will repost on friday morning (UK time) what the results are

dickon

Re: ASA & ASDM upgrade

actica123 — Fri, 13 Aug 2010 08:36:18 GMT

ok great!

thanks very much - did this last night and it worked perfectly! it's nice to know that there is an up to date software on the system rather than something 2 years old - which was a year out of date when we bought the device!

is there a particular version of java which will work with this version - i have been holding back on java 6 update 7, since anything newer would not work with the 5.0(8) asdm. which level can i upgrade to?

at some point i will investigate upgrading to 8.X when i have the time....- i see there are other discussions discussing this and i don't want to break everything for everybody!

cheers for all the help

dickon

Re: ASA & ASDM upgrade

Allen P Chen — Fri, 13 Aug 2010 17:19:50 GMT

Hi Dickon,

Glad to hear you were able to successfully upgrade the ASA. Here are the Release Notes for ASDM 5.2(5), seems like any version of Java 6 is supported:

http://www.cisco.com/en/US/partner/docs/security/asa/asa72/asdm52/release/notes/asdmrn525.html#wp156974

Hope that helps!

Re: ASA & ASDM upgrade

cashqoo — Wed, 24 Nov 2010 10:31:52 GMT

sorry for digging up old thread.

i am preparing to upgrade my asa(7.0(8) and adsm 5.0(8), and realised that i need to do it in an increment manner.

i am looking to upgrade to the latest asa 8.3 and adsm available.

what are the software version sequence i should take?

something like this for ASA - 7.0(8) > 7.1 > 7.2 > 8.0 > 8.1 > 8.2 > 8.3

Re: ASA & ASDM upgrade

Kureli Sankar — Wed, 24 Nov 2010 12:59:37 GMT

Right. You should have spun up a new thread.

Here is the link: https://supportforums.cisco.com/docs/DOC-12690

-KS