ASA5506-X Firepower upgrade issues

Michel Derycke · ‎12-22-2017

Hi All,

When trying to upgrade my 5506-X from 5.4.1.5-22 to 5.4.1.8 I get following error:

[171208 10:22:07] BEGIN 450_prior_updates/100_run_prior_updates.sh

./upgrade.sh: line 394: /tmp/upgrade.lock/PID: No such file or directory

ln: failed to create symbolic link '/tmp/upgrade.lock/main_upgrade_script.log':No such file or directory

[171208 10:34:06] FAILED 450_prior_updates/100_run_prior_updates.sh

[171208 10:34:06] ====================================

[171208 10:34:06] tail -n 10 /var/log/sf/Cisco_Network_Sensor_Patch-5.4.1.8/450_prior_updates/100_run_prior_updates.sh.log

removed directory: '/tmp/upgrade.lock'

[171208 10:34:06] Attempting to remove upgrade lock

[171208 10:34:06] Success, removed upgrade lock

Fatal error: Cisco_Network_Sensor_Patch-5.4.1.6 failed

[171208 10:34:06] Fatal error: Error running script 450_prior_updates/100_run_prior_updates.sh

[171208 10:34:06] Exiting.

[171208 10:34:06] Attempting to remove upgrade lock

[171208 10:34:06] Success, removed upgrade lock

Fatal error: Cisco_Network_Sensor_Patch-5.4.1.7 failed

[171208 10:34:06] Fatal error: Error running script 450_prior_updates/100_run_prior_updates.sh

[171208 10:34:07] Exiting.

[171208 10:34:07] Attempting to remove upgrade lock

[171208 10:34:07] Success, removed upgrade lock

Process 10548 exited.I am going away.

RC: 256

The update failed!

The goal is to have my firepower module connected to my new Firesight Mgmnt Center (6.2.2).

Again, many thanks in advance!

Kind regards,

Michel

Marvin Rhoads · ‎12-22-2017

The log isn't very helpful in this case, but it is always a good idea to check there.

Are you currently managing with ASDM?

Is there a reason why you are upgrading to 5.4.1.8 and not straight to 6.0?

In fact, if I were going to change from locally managed to FMC-managed (a change which will wipe any policy configuration in any case), I would just re-image the ASA module to release 6.2.2 and then add it to FMC.

Michel Derycke · ‎12-22-2017

Hi Marvin,

Since I can't manage the firepower with the FMC 6.2.2, I need to do it using asdm.

I assumed the upgrade process was:

5.4.1.8

6.0.0 pre-install package

6.0.0

6.0.1 pre-install package

6.0.1

6.1.0 pre-install package

6.1.0

6.2.2

How to re-image the ASA? You mean imaging with the FTD?
Many thanks.

Kind regard,
Michel

Marvin Rhoads · ‎12-22-2017

If you don't mind blowing away the module configuration, you can re-image just the Firepower service module. (The parent ASA configuration will be unchanged.)

Follow this procedure:

https://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configure-firepower-00.html#anc7

...and use the files "asasfr-5500x-boot-6.2.2-3.img" (boot image) and "asasfr-sys-6.2.2-81.pkg" (system package). Those files can be found here:

https://software.cisco.com/download/release.html?mdfid=286283326&flowid=77251&softwareid=286277393&release=GeoDB&relind=AVAILABLE&rellifecycle=&reltype=latest

(Expand the 6.2 branch of the tree.)

That method will be several times faster than the step-by-step upgrades - especially on a 5506 where each upgrade takes 1-1/2 hours or more.