how to update the "Cisco Firepower Management Center for VMWare"

[walter baziuk]

I want to update my ASA5506x Cisco Firepower Management Center .it is running on VMWare

as this time Firepower Management Centeris version 6.0.0.1

the latest Firepower Management Center version is 6.1.0.1

when i go to the cisco.com support download. i only see .SH file.

i see no .ISO files

on my  local Cisco Firepower Management Center web site i try to upload the .sh file,

they upload, but it tells me that that file type is no supported

these are files i got now 

can someone please let me how i can update the Firepower Management Center?

do i have to go the vCntre and add a new server?

if so, how do i update with saving all my config.

there must be an easy way to do this

please help me 

cheers

[Marvin Rhoads]

You need to make a couple of interim steps:

1. Upgrade to 6.0.1

2. Run the 6.1.0 preinstall script (optional but it's a good idea to do so)

3. Upgrade to 6.1.0

4. Finally patch to the current 6.1.0.1.

The above is outlined in the relase notes here:

http://www.cisco.com/c/en/us/td/docs/security/firepower/610/6101/relnotes/Firepower_System_Release_Notes_Version_6101.html#pgfId-784876

[walter baziuk]

thank you

Happy New years

I will review those steps and let you know

i wish that the upgrade was simpler );

[walter baziuk]

this update is very buggy

i still cant update from v 6.0.0.1

see below

my version is correct but it cant update

[walter baziuk]

even witt the latest asa and asdm s/w, the firepower cant update from 6.0.0.1 to ANY HIGHER version.

both the ASA and FP Vm were restarted to ensure the system was fresh

sh ver

Cisco Adaptive Security Appliance Software Version 9.6(2)7
Device Manager Version 7.6(2)150

Compiled on Mon 05-Dec-16 12:17 PST by builders
System image file is "disk0:/asa962-7-lfbff-k8.SPA"
Config file at boot was "startup-config"

asa-5506x up 3 mins 17 secs

Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
Internal ATA Compact Flash, 8192MB
BIOS Flash M25P64 @ 0xfed01000, 16384KB

Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1)
Number of accelerators: 1

[Marvin Rhoads]

Walter,

You appear to be trying to use a FirePOWER Threat Defense (FTD) image. That is not the correct image for an ASA FirePOWER Service module. FTD is a new unified image that completely reimages the ASA.

You should be using the FirePOWER Services software for ASA. It can be found at the following page:

https://software.cisco.com/download/release.html?mdfid=286283326&flowid=77251&softwareid=286277393&release=6.1.0&relind=AVAILABLE&rellifecycle=&reltype=latest

For instance, the 6.0.1 file would be "Cisco_Network_Sensor_Patch-6.0.1-29.sh"

[walter baziuk]

hello

i have been trying many s/w updates files. Any additional debugging tips or  debug files or some means to find out WHY it fails would help

i tried the "Cisco_Network_Sensor_Patch-6.0.1-29.sh" it tries to load it then it fails.

here is the limited syslog. when i upload the file the SHA checksum passes so the file is good. i d/l from cisco a second time and both files match 

Jan 02 2017 08:49:59 firepower sudo: pam_unix(sudo:session): session closed for user root
Jan 02 2017 08:49:59 firepower sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Jan 02 2017 08:49:55 firepower sudo: pam_unix(sudo:session): session closed for user root
Jan 02 2017 08:49:55 firepower sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Jan 02 2017 08:49:55 firepower sudo: www : TTY=unknown ; PWD=/usr/local/sf/htdocs/admin ; USER=root ; COMMAND=/bin/kill -s USR1 4435
Jan 02 2017 08:49:55 firepower sudo: pam_unix(sudo:session): session closed for user root
Jan 02 2017 08:49:48 firepower sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Jan 02 2017 08:49:48 firepower sudo: www : TTY=unknown ; PWD=/usr/local/sf/htdocs/admin ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/sf/updates/Cisco_Network_Sensor_Patch-6.0.1-29.sh --check-sha512
Jan 02 2017 08:49:48 firepower sudo: pam_unix(sudo:session): session closed for user root
Jan 02 2017 08:49:41 firepower sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Jan 02 2017 08:49:41 firepower sudo: www : TTY=unknown ; PWD=/usr/local/sf/htdocs/admin ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/sf/updates/Cisco_Network_Sensor_Patch-6.0.1-29.sh --check-sha512
Jan 02 2017 08:49:41 firepower sudo: pam_unix(sudo:session): session closed for user root
Jan 02 2017 08:49:34 firepower sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Jan 02 2017 08:49:34 firepower sudo: www : TTY=unknown ; PWD=/usr/local/sf/htdocs/admin ; USER=root ; COMMAND=/usr/local/sf/bin/package_info.pl /var/sf/updates/Cisco_Network_Sensor_Patch-6.0.1-29.sh --check-sha512
Jan 02 2017 08:49:34 firepower sudo: pam_unix(sudo:session): session closed for user root
Jan 02 2017 08:49:34 firepower sudo: pam_unix(sudo:session): session opened for user root by (uid=0)

[Marvin Rhoads]

There is a directory for your install attempt on the sensor. Log into the module cli, switch to expert mode and then look in /var/log/sf for the sub directory named consistent with the update file. It contains a set of verbose logs and should include in the last time-stamped one the exact step where installation fails 

TAC can assist in such cases and can almost always set you back on the path to a successful upgrade. 

[walter baziuk]

i asked my SE and he agrees with me. the process is poor. i will open a TAC case

[walter baziuk]

i opened a sev 3 TAC ticket

once resolved, i will advise on the soln

thank you for the help

[walter baziuk]

i gave up

no soln from TAC worked.

i gave up on a upgrade

I built a new 6.1 FMC and then did an update to 6.1.0.1 

i am  now waiting for 5 days to get my licenses transferred from the old FMC to  the NEW FMC, the ticket has been escalated

[kelhaka]

I have exactly the same problem, no instructions found anywhere.

I opened TAC case to Cisco to get this sorted.