ASA5506 sensor patch to 6.2.3.3-76 install failed

[pantelis1]

Hi 

I am running the following sfr but when trying to update to 6.2.3.3-76 from the GUI it fails

Model	ASA5506
Serial Number	*****
Software Version	6.2.3 (build 83)
OS	Cisco Fire Linux OS 6.2.3 (build13)
Snort Version	2.9.12 GRE (Build 327)
Rule Update Version	2018-07-30-001-vrt
Rulepack Version	2118
Module Pack Version	2401
Geolocation Update Version	2018-07-16-002
VDB Version	build 300 ( 2018-07-03 15:49:24 )

Based on the status log, the update is stuck on 58% (info below)

firepower:/var/log/sf/Cisco_Network_Sensor_Patch-6.2.3.3# tail -f status.log
ui:[52%] Running script 600_schema/000_bef_install_csm.sh...
ui:[53%] Running script 600_schema/000_install_csm.sh...
ui:[53%] Running script 600_schema/001_Start_Sybase.sh...
ui:[54%] Running script 600_schema/100_update_database.sh...
ui:[55%] Running script 600_schema/110_post_update_dbic.sh...
ui:[55%] Running script 800_post/002_unpack_gwt_files.sh...
ui:[56%] Running script 800_post/005_extra_peer_info.pl...
ui:[57%] Running script 800_post/010_update_vmware_tools.sh...
ui:[57%] Running script 800_post/011_reconfigure_model_pack.sh...
ui:[58%] Running script 800_post/021_reinstall_sru.sh...

The sensor is up and traffic is being inspected with no issue. Can anyone suggest a way to remove the stale update (it is running for almost 24h so I assume it won't complete ) and re apply the update?

Thanks

[Raghunath Kulkarni]

The first recommendation is to check the status of the upgrade. Once we ensure that the upgrade process has died or timed out then we can make changes associated with the stale entry.

The stage where it is stuck is relating to installing the SRU updates. Check if there are any pending SRU updates that are happening on the device at the same time.

In case if you are uncomfortable with this, I would recommend having TAC involved.

[pantelis1 · Accepted solution]

So I reboot the ASA and left it over night and this morning was updated to the latest version (6.2.3.3-76)

[Mohammad Rahman]

Hi Pantelis,
Can you share with whole process from beginning to end to patch ASA 5506X with 6.2.3.3-76? I am new to do this. I browsed lot of links but I did not find any reliable link to complete the project. I have ASA 5506X.

[pantelis1]

Please follow this guide

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/623x/relnotes/Firepower_Release_Notes_623x/upgrade_procedures.html

Please note that upgrade of sensor on ASA5506 can actuallly take a long time. Install it and wait for it to complete (about 49 minutes in my case)

[Mohammad Rahman]

Thank you very much.

[bilaal.amin]

Hi all,

I am having the same issue. I have the Installing Cisco Network Sensor Patch version: 6.2.2.5-57 process running for almost a week. First it stopped at 44% and I did restart the Firewall. Then is strated the isntallation process again yesterday and from there it is stuck on 37%.

This process is affecting the deployment of Access Policies.

Any suggestion to cancel this process or have it completed?

[bilaal.amin]

Not sure what happened but the installation came to an end and it failed.

I downloaded the update from cisco and sucessfuly intalled it on the Firepower.