Module sfr did not respond to session request.

[KRSC]

Hi

I have few ASA's in my network for which when I try to do session SFR
Iam getting the message :

"Opening command session with module sfr.
Module sfr did not respond to session request."

What could be the reasons for getting the above messages ?
Has the module gone faulty and require any HW replacemet ?
Or
How can I recover this SFR module, can anyone pls help.

Thanks in Advance
KRSC

[Abheesh Kumar]

Hi,
Can you share the output of below command.
sh module sfr details

-Abheesh

[KRSC]

Below is the command output

sh module sfr details
Getting details from the Service Module, please wait...
Unable to read details from module sfr

Card Type: Unknown
Model: N/A
Hardware version: N/A
Serial Number: FCH2154JQ2D
Firmware version: N/A
Software version:
MAC Address Range: 5cd0.2dc6.3a59 to 2cd0.2ab6.5a59
Data Plane Status: Not Applicable
Console session: Ready
Status: Recover

[Marvin Rhoads]

The Firepower service module ("sfr") appears to be in recovery mode for the one you shared the output on. On all ASA models except the 5585-X it is a software-only module and can be completely re-imaged to get it back up and running. You will then need to re-register it to FMC and redeploy policies.

https://community.cisco.com/t5/security-blogs/reimage-firepower-module-in-cisco-5500-x-firewall-models/ba-p/3760395

Note - Be sure to not try to image an ASA 5506-X or 55512-X with version 6.3 software because they don't support it.

[EngSaidy]

Mine is stuck as well in recover mode. However, the ASA model is 5525 

[Marvin Rhoads]

@EngSaidy 

Can you provide more details of how you arrived in that state and what you've tried to remedy it thus far?

[EngSaidy]

Firstly, I had 6.0.0 SFR already installed. I wanted to upgrade to 6.2.3, so uploaded the asasfr-5500x-boot-6.2.3-4.img to the flash, then downloaded the asasfr-sys-6.2.3-83.pkg to the device, when everything completed, I waited 24 hours, but did not give a good result, it was kept stuck in recover state. 

When After 24 hours, I re-imaged the the device with 6.0.0 and downloaded the packages ... It's working perfect. 
The bottom line is, I want to upgrade to 6.2.3, how to do so ... please help

[Marvin Rhoads]

If you want to upgrade vs. re-image you should be able to do so by first going to 6.1.0 and then to 6.2.3.

That said, a reimage straight to 6.2.3 should work as well and save some time. I've done numerous and they always worked OK. The module will show as in recovery state when you have the .img but not the .pkg installed. Only after successfully completing the "system install ..." process will the module be fully "up".

[EngSaidy]

Thank you for your reply. In fact, the problem was with ASA software version which was 9.2, when I upgraded to 9.8, the direct re-imaging to 6.2.3 worked. 
Previously, The module was booting normally, While I was downloading the SYS package from FTP, some debugs were showing up that the processing is going on. Waited for 24 hours, the process was not completed. 

The bottom line is that ASA version upgrading really worked for me. 

[Marvin Rhoads]

Ah OK - thanks for the resolution. I did neglect to confirm with you that you were running a compatible ASA version.

FYI the compatibility list can be found here:

https://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html#id_59075

[seckka21]

Hi i have the same problem .I am using a ASA 5525 but after sw-module module sfr boot the module remains status recovery.can you help me please

[Marvin Rhoads]

@seckka21 please provide more details. For example, your ASA software version and output of "show module sfr detail".

[seckka21]

Hi 

Here you are the output of the command and the version

[Marvin Rhoads]

Your ASA is running software version 9.2(2)4. That is not compatible with any current Firepower service module release.

The current recommended Firepower service module release (6.6.4) requires at least ASA 9.5(2). Recommended would be ASA 9.12(4)26 or 9.14(2)15

https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html#id_60529

https://software.cisco.com/download/home/284143129/type/280775065/release/9.14.2%20Interim

[seckka21]

my fmc has version 6.2.2 if i upgrade the ASA to version 9.5 will it work with the firepower.?