topic Re: Installing FirePOWER software on Cisco ASA 5516-X. in Network Security

Installing FirePOWER software on Cisco ASA 5516-X.

eng.khaled.omar — Mon, 10 Jun 2019 23:03:52 GMT

Hi all,

When i try to install the FirePOWER software on Cisco ASA 5516-X and i issue the following command:

ASASFR-boot> system install ftp://192.168.2.4/asasfr-sys-6.2.2-81.pkg

It gives the following:

Verifying

110

Upgrade aborted

When i ping the address 192.168.2.4 normally, it replies, but inside the (ASASFR-boot>) it is not replying.

I configured the system with IPv4 address/mask, default gateway and DNS information, don't know what is missing.

Thanks in advance.

Khaled Omar

Re: Installing FirePOWER software on Cisco ASA 5516-X.

Abheesh Kumar — Tue, 11 Jun 2019 05:59:52 GMT

Hi,
Please go through the below guide
https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/reimage/asa-ftd-reimage.html

Hope This Helps
Abheesh

Re: Installing FirePOWER software on Cisco ASA 5516-X.

Marvin Rhoads — Tue, 11 Jun 2019 12:00:04 GMT

The image on your ftp server could be corrupted. Compare and verify the checksum with what's posted on Cisco's download page.

Re: Installing FirePOWER software on Cisco ASA 5516-X.

eng.khaled.omar — Tue, 11 Jun 2019 23:28:40 GMT

Re: Installing FirePOWER software on Cisco ASA 5516-X.

eng.khaled.omar — Tue, 11 Jun 2019 22:39:18 GMT

I didn't download the FirePOWER software image from Cisco website, i downloaded it from internet, how can i compare and verify the checksum?

Re: Installing FirePOWER software on Cisco ASA 5516-X.

eng.khaled.omar — Tue, 11 Jun 2019 22:39:29 GMT

I didn't download the FirePOWER software image from Cisco website, i downloaded it from internet, how can i compare and verify the checksum?

Re: Installing FirePOWER software on Cisco ASA 5516-X.

eng.khaled.omar — Wed, 12 Jun 2019 01:46:51 GMT

The MD5 checksum is the same as in Cisco website.

Re: Installing FirePOWER software on Cisco ASA 5516-X.

Marvin Rhoads — Wed, 12 Jun 2019 02:20:15 GMT

Can you confirm that you are using the "asasfr-5500x-boot-6.2.2-3.img" boot image file that corresponds with the system installation package?

Re: Installing FirePOWER software on Cisco ASA 5516-X.

eng.khaled.omar — Wed, 12 Jun 2019 02:37:23 GMT

I use the following boot image:

asasfr-5500x-boot-5.4.1-211.img

Re: Installing FirePOWER software on Cisco ASA 5516-X.

Marvin Rhoads — Wed, 12 Jun 2019 02:42:18 GMT

You cannot use a boot image that doesn't match the installation package.

Re: Installing FirePOWER software on Cisco ASA 5516-X.

eng.khaled.omar — Mon, 17 Jun 2019 00:21:29 GMT

I uploaded the new boot image and removed the old boot image from flash, when i issue the following command:

ASA# sw-module module sfr recover boot

it gives the following error:

Module sfr cannot be recovered, please stop the current recovery before trying
to recover again.

When i issue the following command:

ASA# sw-module module sfr uninstall

It gives the following error:

Module sfr cannot be uninstalled, not in Up, Down, or Unresponsive state.

How to stop the current recovery and then use the new boot image?

Re: Installing FirePOWER software on Cisco ASA 5516-X.

Marvin Rhoads — Mon, 17 Jun 2019 02:28:54 GMT

First try to shutdown the module:

sw-module module sfr shutdown

Re: Installing FirePOWER software on Cisco ASA 5516-X.

eng.khaled.omar — Mon, 17 Jun 2019 02:35:41 GMT

It gives the following output:

Module sfr cannot be shut down, not in Up or Unresponsive state.

The output of the "show module" command is:

Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
1 ASA 5516-X with FirePOWER services, 8GE, AC, ASA5516 JAD194803CU
sfr Unknown N/A JAD194803CU

Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
1 00fe.c832.04b1 to 00fe.c832.04b9 2.1 1.1.12 9.8(1)
sfr 00fe.c832.04b0 to 00fe.c832.04b0 N/A N/A

Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------

Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
1 Up Sys Not Applicable
sfr Recover Not Applicable

Re: Installing FirePOWER software on Cisco ASA 5516-X.

Marvin Rhoads — Mon, 17 Jun 2019 02:56:10 GMT

I know one of the options works because I've done it myself. I just don't recall which one it is for when we get into this indeterminate state.

You've tried shutdown and uninstall so the remaining options are reset and reload. Give them a try.

Re: Installing FirePOWER software on Cisco ASA 5516-X.

eng.khaled.omar — Mon, 17 Jun 2019 03:00:31 GMT

SYD-ASA5516X-FW01/stby# sw-module module sfr reset

Module sfr should be shut down before resetting it or loss of configuration
may occur.

Module sfr cannot be reset, please stop the current recovery before trying
to reset the module.

SYD-ASA5516X-FW01/stby# sw-module module sfr reload

Reload module sfr? [confirm]

Module sfr cannot be reloaded, not in Up state.

No more options.

Re: Installing FirePOWER software on Cisco ASA 5516-X.

Marvin Rhoads — Mon, 17 Jun 2019 03:37:48 GMT

Try

sw-module module sfr recover stop

Re: Installing FirePOWER software on Cisco ASA 5516-X.

eng.khaled.omar — Mon, 17 Jun 2019 03:55:45 GMT

This worked, thanks

Now i booted from the new boot image and it is in the "Recover" status, waiting until it move to "Up".

Re: Installing FirePOWER software on Cisco ASA 5516-X.

eng.khaled.omar — Mon, 17 Jun 2019 04:28:07 GMT

Why it is not moving to the "Up" status and stops at the "Recover" status?

Should I start the system installation on the "Recover" status?

Re: Installing FirePOWER software on Cisco ASA 5516-X.

Marvin Rhoads — Mon, 17 Jun 2019 05:59:56 GMT

Yes - go ahead and proceed with installation (and, subsequently, configuration) of the system pkg file once the image recovery has returned a command prompt to the console output.

The module won't move to "Up" until after you have successfully completed the system installation phase.

Re: Installing FirePOWER software on Cisco ASA 5516-X.

eng.khaled.omar — Mon, 17 Jun 2019 06:03:49 GMT

I proceeded with the installation and still giving the same error:

Verifying

110

Aborted

I use quick and easy FTP server, do you recommend a specific FTP server that can be used easily?