FPR 1120 reimage problem

[lmoceze]

Hey there,

I try to reimage my FPR 1120 box from 6.x to 7.2.5, however I am facing the following problem:

xxx> show version 
----------------------[ xxx ]-----------------------
Model : Cisco Firepower 1120 Threat Defense (78) Version 6.4.0 (Build 102)
(...)
xxx(local-mgmt)# format everything 
All configuration and bootable images will be lost.
Do you still want to format? (yes/no):yes
(...)
rommon 13 > tftp -b
(...)
Ethernet init success 
Enable boot bundle: tftp_reqsize = 268435456
(...)
IMAGE: cisco-ftd-fp1k.7.2.5-208.SPA

link up
Receiving cisco-ftd-fp1k.7.2.5-208.SPA from (...) !!!
Overall timeout.

File reception completed.
Boot buffer bigbuf=640ff498
Boot image size = 199115728 (0xbde43d0) bytes
[image size] 199115728
(...)
Failed to validate digital signature in Primary key Storage !!
Failed to validate digital signature in Backup key Storage !!
+-------------------------------------------------------------------+
+------------------------- FAILURE ---------------------------------+
+-------------------------------------------------------------------+
| |
| LFBFF signature authentication failed !!! |
| |
+-------------------------------------------------------------------+

Incorrect installer image for this platform !!

Failed to Free memory block at address 0x00000000640ff498

(...) means that I cut some parts of the output.

However the Incorrect installer image for this platform !! seems to be a pretty straight forward message, as I understood, the SPA is the fresh install package, not the ral.tar. So im not sure what Im missing here.
Did anyone faced this issue too?

Thanks a lot!

[marce1000]

 - Ref : https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/release-notes/threat-defense/720/threat-defense-release-notes-72.html#r_ftd-upgrade-path
           Check Table 17.  it looks like you can not go directly from 6.4 to 7.2.5 , 

 M.

[lmoceze]

Hi M.!
Thanks for the reply!
However, I have did:

xxx(local-mgmt)# format everything 
All configuration and bootable images will be lost.
Do you still want to format? (yes/no):yes

 As of my understanding, it should be an "empty" box, does the upgrade path still matters?
Thanks a lot!

[lmoceze]

Hey there,
It turns out that the MD5 of the image on the Cisco site and the MD5 of the image copied is not the same (probably got lost on the way due to TFTP copy + internet)  so I think that is the reason. I will do it another way, will keep you posted.

[lmoceze · Accepted solution]

Hello All,
The problem was that more than 0 packets got lost during transit, so the image was incorrect.
Moral of the story: use USB or dont put your life on TFTP + Internet