Package header failed verification during sfr package download

[QW_netzwerk]

Hello,

I am trying to download the package asasfr-5500x-boot-5.3.1-152.pkg. But everytime it comes with an error "Package header failed verification - object of type 'NoneType' has no len() Please verify that the package is not corrupted.Upgrade aborted." I have tried with ftp as well as http. But every case it is happening the same. My question is whether it is the right package. From Cisco doc I have read asasfr-sys-5.3.1-44.pkg. But this version I didn't found on cisco download software site. 

QW-SFR-boot>system install http://www.XXXXX.com/asasfr-sys-531-152.pkg
Verifying

Package header failed verification - object of type 'NoneType' has no len()

Please verify that the package is not corrupted.
Upgrade aborted.

thanks in advance.

Saimun

[Marvin Rhoads · Accepted solution]

Are you following the Quick Start Guide?

As directed there, we first copy the FirePOWER module boot image to the ASA, set it as the recover image for the module, recover the module using that boot image and then complete the full setup using the system image (step 7 in the Quick Start Guide). Until the first 6 steps are completed successfully, #7 will not work.

Please show us the output of show version and show module from the ASA cli.

[QW_netzwerk]

Marvin thanks for your suggestion. I had followed the guide. But the pkg file was somehow corrupted and I got it from our local support company. but after downloading directly from cisco site there was no issue anymore to download and upgrade the module.

[jonathan.fitz]

I am having the same issue with the HTTP download of the file off a HTTP server.  It connects but doesn't even wait long enough to download the large file.

Somehow I have no idea upon initial setup, the module locked up, and had to reload the ASA5512.  When the reload was done, the module was in a failed state.  I was able to boot using recover, but unable to download the package.   The MD5 matches what the Cisco download site shows. 

Any ideas?

[jonathan.fitz]

Figured it out, turns out the problem was the HTTP server killing the connection before download.  Changed to GoogleCode HTTP Server and worked great,

[robertmeier]

Not happy with this process.  I have a production network that I cant mess with and this process makes set this up set up things don't want to(Mgmt Center VM). ARGH

[hcarmenates1]

Hi Marvin.

Even though sometimes I don't have a problem I like to read your answers in the blog to learn but this time I do have a problem:

...

I have the same problem.

Error 113 ...Upgrade Aborted

I have made all steps.

I first made the "reimage" copying the IMG to Flash and running the commands

#sw-module module sfr recover configure image...

#sw-module module sfr recover boot 

#debug module-boot ....to monitor waht is happening

Until the end.

Then

#session sfr console

...and setup all the network information in the sfr console, etc.

I have already checked the MD5 Checksum of both files (IMG and PKG) and they are ok. They are both the same version (6.0.0-1005).

I have tried with Solarwinds TFTP Server, Filezilla, CoreFTP and from different folders in my computer checking they are shared and having full access to user "everyone".

I also have tried disabling the Computer Firewall.

It seems it is not FTP issue because I was able to copy the IMG from my computer to the Flash.

The installation in the sfr console with the command:

>system install noconfirm ftp://192.168.0.2/....pkg"

shows "Verifyng !!!!" and after three seconds the message "113 Upgrade Aborted"

Can you or anyone help me?

Thank you

[Marvin Rhoads]

hcarmenates1  

That's odd - another user has been reporting a similar issue here:

https://supportforums.cisco.com/discussion/13322006/asa5525

I had attrbuted his to potentially not following the procedure properly but in your case it sounds like you have a handle on what to do and check.

To be clear - does your ftp server show that the pkg file has transferred completely and then it is during the file verification that the process aborts?

[hcarmenates1]

Thanks for answering me so quickly.

Like you said I have made all the steps. I have read the Cisco Guide, PeteLive Guide and some other guides and I have followed all the steps/instructions they give. You also can notice in my previous message when I described all I did.

When I run the command

>system install noconfirm ftp://192.168.250.2/asasfr-sys-6.0.0-1005.pkg

I think It does not download anything, I don't think there is any transfer.

I see a message

Verifying!!!!

And a few seconds later

111

Upgrade aborted

..........................

Previously it was the message

113

Upgrade Aborted

That number changed since I connected my computer in the "inside" interface network.

I can ping the Firepower IP Address that I fixed in the session sfr console, that is the 192.168.250.254 and of course I can ping the inside interface ip addr 192.168.250.1

I don't know what is it verifying and the meaning of those numbers (111 and 113)

Since I connected the computer in the inside network I think I don't have any access-list denying me the transfer. And I was able to copy the IMG to Flash in the first step.

It's really weird

[Marvin Rhoads]

That's odd. If I were troubleshooting I'd look for the flow to start from the ftp server - i.e. with Wireshark or such.

Have you tried plugging your computer directly into the ASA management interface where the FirePOWER module has its IP address?

[hcarmenates1]

Thank yo, Marvin

I have not tried connecting the computer directly to the Management Interface, I will do that and I will let you know the results.

FYI - I did the whole process again but before the usual steps I did the following

#sw-module module sfr shutdown

#sw-module module sfr uninstall

#reload

And it got the installing process to last much more time verifying, but sadly when I thought I was going to achieve the installation then it showed me another number (this time it was 111) and the Upgrade aborted message again

[tbostrom · Accepted solution]

Sounds like the package could have been corrupted when downloaded from CCO.  Did you run an MD5 hash of the package and compare to the values posted on CCO for the file?

There's a number of free MD5 checksum programs that you can use.  My favorite is one called HashCheck.

Hash for SFR package is in red below.  If it doesn't match, re-download the image from CCO again and make sure the hashes match.

[QW_netzwerk]

You are right. I have checked the value and it was not the same what I have tried before. Later I have downloaded again and it works flawlessly.

Thanks again for your tremendous support.

[Ji-Won Park]

Here's a very simple easy step by step to enable the sensor:

1. Prepare boot and system image

2. tftp boot and system image to the bootflash of ASA

3. recover the boot image and boot up with it - this takes quite long too

4. run the system installation file - this takes long time due to the database

Total process takes around 1-2 hour.

Hope this helps

g1