Firepower upgrade to 7.0.1-84 failed at 39%

[bcoverstone]

I was attempting to upgrade a Firepower 1010 HA pair to build 7.0.1-84 and received the following error:

Here is the stack trace:

Failed to generate data after all imported ApplicationException:java.lang.UnsupportedOperationException: SmartAgentManager#getCurrentSmartAgentDelegate is not allowed during the bootstrap
com.cisco.ngfw.onbox.importer.services.UpgradeSqliteToNeo4jImporter.retryFailedLinaAndSnortDataGeneration(UpgradeSqliteToNeo4jImporter.java:642)
com.cisco.ngfw.onbox.importer.services.UpgradeSqliteToNeo4jImporter.handleDataGenerationAfterEntitiesImported(UpgradeSqliteToNeo4jImporter.java:604)
com.cisco.ngfw.onbox.importer.services.UpgradeSqliteToNeo4jImporter.afterEntitiesImported(UpgradeSqliteToNeo4jImporter.java:528)
com.cisco.ngfw.onbox.backend.services.configdb.SqliteToNeo4jImporter.doImportFromSqlite(SqliteToNeo4jImporter.java:210) com.cisco.ngfw.onbox.backend.services.configdb.SqliteToNeo4jImporter.importFromSqlite(SqliteToNeo4jImporter.java:163)
com.cisco.ngfw.onbox.importer.services.UpgradeSqliteImportService.importConfigFromSqlite(UpgradeSqliteImportService.java:177)
Reporting error : Failed to generate data after all imported Fatal error: Failed to generate data after all imported

The upgrade readiness check was run and passed.

Any ideas what I can do to make this work?

[andrew.butterworth]

I've got a HA pair of FTDv's running on an ESXi platform in the lab.  These were build from the 6.6 .ova and have been upgraded a few times.  The last time I upgraded them to 7.0.0.1 without any issues.  I attempted to upgrade them to 7.0.1 recently - one worked and the other didn't and failed with some certificate error.

Its now in some limbo state where it needs to have changes deployed, however it fails the deployment and won't let you discard the changes.

Its looking like a re-image of both I think....

[bcoverstone]

It looks like it does not like one of your certificates. Maybe remove all certs, upgrade, add them back in?

Unfortunately with my issue, the error deals with the "Smart Agent", which is Cisco Licensing. And that's something I can't control.

Unless maybe I try delicensing the standby unit and then try to upgrade it...

[andrew.butterworth]

I ended up breaking the HA, building a new FTDv from the .ova and then recreating the HA.

[bcoverstone]

Cisco TAC got back to me today, and it appears that I am not alone and that other firewall upgrades have had the exact same issue. Cisco has devs on it to reproduce and correct the issue.

I'll reply back with a status once I find out more.

[bcoverstone · Accepted solution]

It looks like the unit was also not able to deploy any configuration changes because it kept giving me an error that my VPN RA had an overlapping IP address in the pool, which it definitely does not. I am using two ranges in 192.168.200.0/25 and 192.168.200.128/25, and it thinks those overlap. So maybe only use /24 addresses as the FDM seems to be confusing those ranges, though it didn't give me issues when I first configured them.

I tried restoring a good backup before attempting the firmware update, and it also has all the same problems, so even the backup has failed!!!!!

I did a full reimage of the standby unit and reconfigured it completely from scratch. This is the only way I was able to get things working again.