topic Re: Scriptability of sensor patch application in Network Security

Scriptability of sensor patch application

ryanbwn — Fri, 21 Feb 2020 15:03:45 GMT

I'm a developer for an integrator that updates and configures customer hardware before they take delivery of it. I was asked to create a process to automate the integration of a large amount of ASA 5506-X appliances which includes a sensor patch update. Doing this through the ASDM GUI is not going to work for 2000+ firewalls. I know that the sensor patches are just shell scripts that can be run from expert mode, but it seems as though cisco doesn't support this practice. Is there a way to apply the patch using ANY kind of non-GUI, whether it be through the console port, ssh, or an API?

Re: Scriptability of sensor patch application

Marvin Rhoads — Wed, 03 Jan 2018 15:44:24 GMT

You're correct in that they are just shell scripts (albeit pretty big ones).

I seem to remember one of the TAC engineers who sometimes posts here recommending using the cli method to perform a sensor upgrade as an alternative when the GUI was not working as designed.

There is a nice blog post on doing just that here:

https://ciscoskills.net/2017/07/12/update-firepower-devices-manually/

As an aside, if the client has a large number of ASA 5506-X they should be managed via FMC. You can push upgrades to multiple devices at once pretty easily using FMC.

Re: Scriptability of sensor patch application

ryanbwn — Wed, 03 Jan 2018 17:38:20 GMT

Thanks Marvin. I appreciate the reply. I'm building out the process based on the post you shared and it's exactly what I was looking for. As for FMC, I'm sure they use it in-house but unfortunately I don't have access to their infrastructure. The process I'm working on basically just pre-seeds the ASA's for plug and play use.