Re: New Sourcefire module install. Stuck in recover mode.

Kgrevemberg · ‎03-26-2019

There are already a few of these questions like this on here but the solutions don't quite line up with mine so bare with me please, I'm still learning this.

I have an ASA 5525x running 9.8bin. I'm trying to put a sourcefire module on it. I've downloaded sourcefire 6.3.0 software.

asasfr-5500x-boot-6.3.0-3.img

asasfr-sys-6.3.0-83.pkg

Following this guide here : https://www.petenetlive.com/KB/Article/0001164

I type my commands as follows:

FOBFW# sw-module module sfr recover configure image disk0:/asasfr-5500x-boot-6.3.0-3.img

FOBFW# sw-module module sfr recover boot

Everything is fine until I start the recovery process. The "debug module-boot" only shows a few lines at the start and stops

*******************************

FOBFW# debug module-boot
debug module-boot enabled at level 1
FOBFW# Mod-sfr 8> ***
Mod-sfr 9> *** EVENT: Disk Image created successfully.
Mod-sfr 10> *** TIME: 17:20:34 GMT Mar 26 2019
Mod-sfr 11> ***
Mod-sfr 12> ***
Mod-sfr 13> *** EVENT: Start Parameters: Image: /mnt/disk0/vm/vm_3.img, ISO: -cdrom /mnt/disk0/
Mod-sfr 14> asasfr-5500x-boot-6.3.0-3.img, Num CPUs: 3, RAM: 1342MB, Mgmt MAC: C0:67:AF:03:54:9
Mod-sfr 15> C, CP MAC: 00:00:00:04:00:01, HDD: -drive file=/dev/md0,cache=none,if=virtio, Dev D
Mod-sfr 16> ***
Mod-sfr 17> *** EVENT: Start Parameters Continued: RegEx Shared Mem: 32MB, Cmd Op: r, Shared Me
Mod-sfr 18> m Key: 8061, Shared Mem Size: 64, Log Pipe: /dev/ttyS0_vm3, Sock: /dev/ttyS1_vm3, M
Mod-sfr 19> em-Path: -mem-path /hugepages
Mod-sfr 20> *** TIME: 17:20:35 GMT Mar 26 2019
Mod-sfr 21> ***
Mod-sfr 22> Status: Mapping host 0x2aaaff200000 to VM with size 67108864
Mod-sfr 23> Failed to open device /dev/cpp_user_kvm
Mod-sfr 24> ***
Mod-sfr 25> *** EVENT: The module is being automatically restarted.
Mod-sfr 26> *** TIME: 17:20:38 GMT Mar 26 2019
Mod-sfr 27> ***
Mod-sfr 28> ***
Mod-sfr 29> *** EVENT: Start Parameters: Image: /mnt/disk0/vm/vm_3.img, ISO: , Num CPUs: 3, RAM
Mod-sfr 30> : 1342MB, Mgmt MAC: C0:67:AF:03:54:9C, CP MAC: 00:00:00:04:00:01, HDD: -drive file=
Mod-sfr 31> /dev/md0,cache=none,if=virtio, Dev Driver: virtio
Mod-sfr 32> *** TIME: 17:20:38 GMT Mar 26 201
Mod-sfr 33> ***
Mod-sfr 34> *** EVENT: Start Parameters Continued: RegEx Shared Mem: 32MB, Cmd Op: , Shared Mem
Mod-sfr 35> Key: 8061, Shared Mem Size: 64, Log Pipe: /dev/ttyS0_vm3, Sock: /dev/ttyS1_vm3, Me
Mod-sfr 36> m-Path: -mem-path /hugepages
Mod-sfr 37> *** TIME: 17:20:38 GMT Mar 26 2019
Mod-sfr 38> ***
Mod-sfr 39> Status: Mapping host 0x2aaaff200000 to VM with size 67108864
Mod-sfr 40> Warning: vlan 0 is not connected to host network

*****************************

If i do a show module it only states the sfr is in recovery.

If I session into it I dont get any prompt at all and can't type.

I've waited over an hour just in case.

Any ideas on this would be very helpful as I'm not quite sure what I'm doing wrong.

Rahul Govindan · ‎03-26-2019

Steps look correct. Is your Management port connected to the inside network? You need this anyway for the next step of transferring the package to the SSD. Also, get a "show module" from the ASA.

I would run through the recover boot steps again to see if this issue is seen constantly.

Kgrevemberg · ‎04-02-2019

Sorry to get back to you so late Rahul, my thread was actually marked as "spam" for a while. I don't know why but moving on. Thanks for your reply. My laptop is connected to the management port. I think my current issue is actually with Filezilla. It sends the entire 1.3g file in 1 second. Which seems way too fast. However it does say it is sending the whole file. Our system admin is currently looking into an alternative software to use or should I be using the client version of filezilla instead of the server version? Thanks for your help.