topic Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not in Network Security

Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

Leon1 — Fri, 21 Feb 2020 15:14:50 GMT

Hello!

I updated my Firepower Threat Defense from 6.2.2.1 Build 75 to 6.2.2.2 Build 4, as this update was released yesterday.

The Update process starts and logs me off, like I expect. Then after some minutes my ping to the ASA is lost and after some minutes it comes back. So I think it reboots. After some time the web interface is reachable again.

When I log on the device, it still shows Version 6.2.2.1-75 to me. I am totally confused about this. I retried it four times, but got the same result. So I tried to find some update logs, but I didn't find them.

What I found is an empty file called "Cisco_FTD_Hotfix_AB-6.2.2.2_build_4_applied" in the directory "/var/log".

This update is related to a high risk security exploit and I need to be absolutely sure if it is applied or not. Has anybody applied it too and could confirm that something is wrong on my side or within the update?

I am also a little bit confused about the versioning in software.cisco.com.

It shows the wrong version also:

Firepower Threat Defense Hotfix 6.2.2.1
Cisco_FTD_Hotfix_AB-6.2.2.2-4.sh.REL.tar

Please help me, as my device remains offline, until this is fixed.

Cheers

Leon

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

mikael.lahtela — Wed, 31 Jan 2018 12:05:55 GMT

Hi,

Are you using FMC or FDM?
You should contact TAC if your network is down.

br, Micke

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

Leon1 — Wed, 31 Jan 2018 12:15:13 GMT

Hello!

excuse me for misunderstanding. My network is not down. I shutdown VPN for this device, until I am sure the Hotfix is applied.

I am using FTD Device Manager sadly you could not use FMC and Device Manager at the same time.

Cheers

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

mikael.lahtela — Wed, 31 Jan 2018 12:22:20 GMT

Ok great, I usually open TAC anyways if there is issues with updates as it can really mess things up if it fails.
What platform are you using?

br, Micke

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

Leon1 — Wed, 31 Jan 2018 12:43:16 GMT

ASA 5500-X

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

mikael.lahtela — Wed, 31 Jan 2018 12:59:10 GMT

Ok,
If you downloaded the file and did not unpack the file before upgrade I think you should contact Cisco TAC.
Looks like you are using the correct file and if you have read the release notes and follow the correct upgrade procedure it should work.
I haven't tried this upgrade yet.

br, Micke

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

Rahul Govindan — Wed, 31 Jan 2018 13:14:08 GMT

I did an update to a 4120 deployment running FTD yesterday and did not see any issues after the upda. But this was not in full production yet so can't confirm if there are any major issues with traffic like you see. Like Mikael mentioned, open a TAC case if it is impacting your traffic.

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

Leon1 — Wed, 31 Jan 2018 14:11:15 GMT

I do not see traffic issues.

I can not confirm whetever the update is applied or not.

The system still shows Version 6.2.2.1 but there is an empty log file which says it was applied.

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

mikael.lahtela — Wed, 31 Jan 2018 14:26:22 GMT

Can you check if you find this file in expert mode in FTD.
/ngfw/var/log/update.status
Sanitize the file and post it here?

br, Micke

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

Rahul Govindan — Wed, 31 Jan 2018 14:38:24 GMT

I checked my status log and it shows as upgraded:

ui:[98%] Running script 999_finish/999_z_complete_upgrade_message.sh...
ui:[98%] Upgrade complete
ui:[99%] Running script 999_finish/999_z_must_remain_last_finalize_boot.sh...
ui:[99%] Running script 999_finish/999_zz_install_bundle.sh...
ui:[100%] The system will now reboot.
ui:System will now reboot.
ui:[100%] Installation completed successfully.
ui:Upgrade has completed.
state:finished
admin@ftd2:/ngfw/var/log/sf/Cisco_FTD_SSP_Hotfix_AB-6.2.2.2$

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

Leon1 — Wed, 31 Jan 2018 14:44:34 GMT

I searched through the logfiles and found something! thanks for pointing me in the correct direction.

...

looks good, but when I enter "show version", it shows me the following:

> show version
----------------------[ fw1 ]-----------------------
Model                     : Cisco ASA5508-X Threat Defense (75) Version 6.2.2.1 (Build 73)
UUID                      : <a guid was here>
Rules update version      : 2018-01-24-001-vrt
VDB version               : 292
----------------------------------------------------

hmmm .

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

mikael.lahtela — Wed, 31 Jan 2018 14:48:38 GMT

I'm upgrading my lab now, so I will see my show version.
Might be that HF is not showing there.

br, Micke

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

mikael.lahtela — Wed, 31 Jan 2018 15:25:46 GMT

Not sure if this works on 5500x FTD but try check this:
connect to FTD
> system support diagnostic-cli
firepower> show ver

Before update on a 2100:
Cisco Adaptive Security Appliance Software Version 9.8(2)10
Firepower Extensible Operating System Version 2.2(2.63)

After update with HF:
Cisco Adaptive Security Appliance Software Version 9.8(2)12
Firepower Extensible Operating System Version 2.2(2.63)

Version output in FTD is still same Cisco Firepower 2110 Threat Defense (77) Version 6.2.2.1 (Build 80)

br, Micke

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

Leon1 — Wed, 31 Jan 2018 15:34:38 GMT

hey thank you very much in assisting me.

firepower> show ver
----------------------[ fw1 ]-----------------------
Model                     : Cisco ASA5508-X Threat Defense (75) Version 6.2.2.1 (Build 73)
UUID                      : <guid was here>
Rules update version      : 2018-01-24-001-vrt
VDB version               : 292
----------------------------------------------------

Cisco Adaptive Security Appliance Software Version 9.8(2)12
Firepower Extensible Operating System Version 2.2(2.52)

This is my output.

So you could confirm the version is not changed after hotfix.

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

mikael.lahtela — Wed, 31 Jan 2018 19:44:38 GMT

I would say that it is upgraded.

This is same in my 2100 after upgrade:
Cisco Adaptive Security Appliance Software Version 9.8(2)12
I think Cisco has a special ASA image in the FTD upgrade that is fixed.

br, Micke

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

TomKaspar — Mon, 05 Feb 2018 14:53:13 GMT

Are you sure? I installed hotfix 6.2.2.2-4 (new version AN).

I have ASA version 9.8(2)135

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

Leon1 — Mon, 05 Feb 2018 15:02:01 GMT

The new Version was not tried. I will download and install it. Maybe the Version is chown correclty then. I will report.

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

TomKaspar — Mon, 05 Feb 2018 15:12:02 GMT

OK, but in system, I can't see new version (I see still version 6.2.2.1) 😞

If I try install hotfix again, FMC show me same Firepower appliances. In FMC see old version FTD.

Did you open TAC for this issue?

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

Rahul Govindan — Mon, 05 Feb 2018 15:16:31 GMT

They did replace the hotfix version yesterday. According to their download page:

We have replaced Hotfix AC with Hotfix AN; Hotfix AB with Hotfix AO.

I am going to try to see if there is a a change in the version after this hotfix install. So far, I don't think anyone's version has changed to anything other than the one they had before.

Re: Updating FTD 6.2.2.1-75 to 6.2.2.2-4 - System does not show if update is applied or not

TomKaspar — Mon, 05 Feb 2018 16:01:05 GMT

OK, thank you. I installed last version (from yesterday).

I will wait for your info.