topic Re: Upgrading firmware of an ASA5515 in Network Security

Upgrading firmware of an ASA5515

Luke Smith — Fri, 21 Feb 2020 16:36:39 GMT

I'm trying to upgrade the firmware of my Cisco ASA 5515 from 9.1.1 to 9.8.1. I know I need to go to 9.1.2 before I can go to 9.8.1, but everytime I try to copy 9.1.2 to flash I get the error "No Cfg structure found in downloaded image file" I'm not even to the point of trying to load the new image, I just want to get it on the box to be able to schedule the upgrade ... I have plenty of room still to put the image on 8238202880 bytes total (4804546560 bytes free). Anyone experienced this issue? I know if I put 9.8.1 it would error, but why is it doing it for 9.1.2 when it has to be my next move?

Re: Upgrading firmware of an ASA5515

balaji.bandi — Wed, 26 Dec 2018 22:30:26 GMT

Look at ths bug :

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuh25271/?rfs=iqvred

Re: Upgrading firmware of an ASA5515

Luke Smith — Wed, 26 Dec 2018 22:41:23 GMT

This is what I am trying to do! I am trying to load 9.1.2 onto the ASA so I can boot from it and when trying to load the image to flash is when I get the error.

Re: Upgrading firmware of an ASA5515

Marvin Rhoads — Thu, 27 Dec 2018 03:15:06 GMT

Are you using "asa912-smp-k8.bin" as your upgrade file?

That one is required as it is the "bridge" between the old and new file format.

https://software.cisco.com/download/home/284143128/type/280775065/release/9.1.2.SMP.ED

Re: Upgrading firmware of an ASA5515

Luke Smith — Thu, 27 Dec 2018 03:43:33 GMT

Yes sir, that is the one I'm trying to load into flash.

Re: Upgrading firmware of an ASA5515

Marvin Rhoads — Thu, 27 Dec 2018 03:46:55 GMT

What copy method are you using? (ASDM (which uses https), ftp, tftp etc.)

Have you tried one other than the one that's failing?

Re: Upgrading firmware of an ASA5515

Luke Smith — Thu, 27 Dec 2018 06:41:37 GMT

I've got a USB drive plugged in that im trying to run copy disk1:/file disk0: via console.

Re: Upgrading firmware of an ASA5515

Marvin Rhoads — Thu, 27 Dec 2018 07:39:32 GMT

Is the USB FAT 16 formatted? Can you see the source file from the ASA console using "dir disk1:/"?

Is it possible for you to try ftp or ASDM-based copy?

Re: Upgrading firmware of an ASA5515

Abheesh Kumar — Thu, 27 Dec 2018 08:59:13 GMT

Hi,

ASA Upgrade Path 9.1(1) >> 9.1(2) >> 9.8(x)

As per Marvin try with the other copy options.

HTH

Abheesh

Re: Upgrading firmware of an ASA5515

Luke Smith — Thu, 27 Dec 2018 15:37:25 GMT

Yes it is. I've used the exact same USB drive to upgrade a couple ASA5555's to 9.8.1 as well within the past month. So I know it's not an issue with the formatting and I'm able to source the disk1:/ via console too as i can see the 2 images and the ASDM image.

Re: Upgrading firmware of an ASA5515

Luke Smith — Thu, 27 Dec 2018 15:41:08 GMT

Abheesh,

Thank you. I'm aware of the path I need to go. I am going to be trying to upload 9.1.2 via the ADSM today.

Re: Upgrading firmware of an ASA5515

Luke Smith — Thu, 27 Dec 2018 19:41:50 GMT

Upgrading via ADSM provides a different result ... I am now getting an error of "Invalid Http response".

Re: Upgrading firmware of an ASA5515

balaji.bandi — Thu, 27 Dec 2018 20:22:04 GMT

i would prefer always upgrade via console, so you see some more logs if any errors.

since most of the options you have tried, i would like to see output of

show version

dir

Re: Upgrading firmware of an ASA5515

Abheesh Kumar — Thu, 27 Dec 2018 20:23:07 GMT

Hi Luke,

Its due to a bug regrading the error which you are getting

CSCvf85831 - "Error occurred in performing File Transfer HTTP Response code -1"

CSCut08220 - "Invalid Http response error"

If you are hitting the first error then the file will be copied to ASA flash correctly. Just verify the md5 of the file which is copied to ASA. Syntax (verify /md5 flash:[filename] [md5 value] )

If you are hitting the second error then try to copy the file to ASA throgh cli with tftp

Thanks,
Abheesh
PS: Please don't forget to rate and select as validated answer if this answered your question

Re: Upgrading firmware of an ASA5515

Luke Smith — Thu, 27 Dec 2018 20:25:53 GMT

If I can't copy disk1 to disk0, I doubt I'll be able to go from TFTP to disk0 as well.

Re: Upgrading firmware of an ASA5515

Luke Smith — Thu, 27 Dec 2018 20:27:05 GMT

here are the outputs.

# sh ver

Cisco Adaptive Security Appliance Software Version 9.1(1)
Device Manager Version 7.1(3)

Compiled on Wed 28-Nov-12 11:15 PST by builders
System image file is "disk0:/asa911-smp-k8.bin"
Config file at boot was "startup-config"

asa01 up 1 year 206 days

Hardware: ASA5515, 8192 MB RAM, CPU Clarkdale 3058 MHz, 1 CPU (4 cores)
ASA: 4096 MB RAM, 1 CPU (1 core)
Internal ATA Compact Flash, 8192MB
BIOS Flash MX25L6445E @ 0xffbb0000, 8192KB

Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x1)
Boot microcode : CNPx-MC-BOOT-2.00
SSL/IKE microcode : CNPx-MC-SSL-PLUS-T020
IPSec microcode : CNPx-MC-IPSEC-MAIN-0022
Number of accelerators: 1
Baseboard Management Controller (revision 0x1) Firmware Version: 2.4

0: Int: Internal-Data0/0 : address is fc5b.39aa.3e37, irq 11
1: Ext: GigabitEthernet0/0 : address is fc5b.39aa.3e3b, irq 10
2: Ext: GigabitEthernet0/1 : address is fc5b.39aa.3e38, irq 10
3: Ext: GigabitEthernet0/2 : address is fc5b.39aa.3e3c, irq 5
4: Ext: GigabitEthernet0/3 : address is fc5b.39aa.3e39, irq 5
5: Ext: GigabitEthernet0/4 : address is fc5b.39aa.3e3d, irq 10
6: Ext: GigabitEthernet0/5 : address is fc5b.39aa.3e3a, irq 10
7: Int: Internal-Data0/1 : address is 0000.0001.0002, irq 0
8: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 0
9: Int: Internal-Data0/2 : address is 0000.0001.0003, irq 0
10: Ext: Management0/0 : address is fc5b.39aa.3e37, irq 0

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 100 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
Security Contexts : 2 perpetual
GTP/GPRS : Disabled perpetual
AnyConnect Premium Peers : 2 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 250 perpetual
Total VPN Peers : 250 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
UC Phone Proxy Sessions : 2 perpetual
Total UC Proxy Sessions : 2 perpetual
Botnet Traffic Filter : Disabled perpetual
Intercompany Media Engine : Disabled perpetual
IPS Module : Disabled perpetual
Cluster : Disabled perpetual

This platform has an ASA 5515 Security Plus license.

Serial Number: FCH18357LQJ
Running Permanent Activation Key: 0x9812d07d 0x5c9687e6 0x1d02dd08 0xdc802490 0x8812c193
Configuration register is 0x1
Configuration last modified by enable_15 at 14:39:58.951 CST Wed Dec 26 2018
asa01# dir

Directory of disk0:/

10 drwx 4096 05:05:12 Sep 26 2014 log
20 drwx 4096 05:05:40 Sep 26 2014 crypto_archive
21 drwx 4096 05:05:46 Sep 26 2014 coredumpinfo
116 -rwx 37416960 05:14:02 Sep 26 2014 asa911-smp-k8.bin
117 -rwx 18097844 05:15:52 Sep 26 2014 asdm-713.bin
118 -rwx 120868 11:44:50 Feb 02 2015 5515-tech.txt
119 -rwx 69318656 05:17:18 Sep 26 2014 asacx-5500x-boot-9.1.1-1-RelWithDebInfo.x86_64.img
143 -rwx 26970456 14:21:13 Dec 26 2018 asdm-782.bin
120 -rwx 12998641 05:37:10 Sep 26 2014 csd_3.5.2008-k9.pkg
121 drwx 4096 05:37:10 Sep 26 2014 sdesktop
122 -rwx 6487517 05:37:12 Sep 26 2014 anyconnect-macosx-i386-2.5.2014-k9.pkg
123 -rwx 6689498 05:37:14 Sep 26 2014 anyconnect-linux-2.5.2014-k9.pkg
124 -rwx 4678691 05:37:14 Sep 26 2014 anyconnect-win-2.5.2014-k9.pkg
125 -rwx 28771677 09:44:58 Jan 28 2015 anyconnect-win-3.0.08057-k9.pkg

8238202880 bytes total (4804546560 bytes free)

Re: Upgrading firmware of an ASA5515

Abheesh Kumar — Thu, 27 Dec 2018 20:27:54 GMT

Try with tftp

Re: Upgrading firmware of an ASA5515

Luke Smith — Thu, 27 Dec 2018 20:40:02 GMT

Same error when I copy from USB ... No Cfg structure found in downloaded image file

Re: Upgrading firmware of an ASA5515

balaji.bandi — Thu, 27 Dec 2018 20:41:50 GMT

thank you for the information :

i know you have this document and tried as per this document :

https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/asa-appliance-asav.html#id_27294

Re: Upgrading firmware of an ASA5515

balaji.bandi — Thu, 27 Dec 2018 20:43:32 GMT

if you get chance or maintenance window, reboot the device and try - another suggestion apart from the previous post.