Restore FDM from a backup - SRU package required

Chess Norris · ‎08-29-2023

Hello,

We had a hardware failure on our FTD 1120. We received a new device and decided to restore from a backup.

However, the new device came with FTD version 7.1 and the backup was made with version 6.6. We therefore did a re-image to version 6.6 and we were then able to restore the backup. However, after restoring the backup the deploy fails with the following error "a package file required for deployment, modules-2984-x86_64.tgz does not exist. The installation of a SRU package may be required"

We then tried to installed the SRU file, but it fails. The pigtail log gives us a coupple of error (se below) , but not sure how to fix this.

I: 08-29 08:38:56 ajp-nio-8009-exec-5: INFO  FileUploadResource:298 - File: Cisco_Firepower_SRU-2021-11-15-001-vrt.sh.REL.tar successfully loaded to temporary disk space, will be copied to the necessary folder from this temp location
NGUI: 08-29 08:38:56 ajp-nio-8009-exec-5: INFO  AuditEntityRepositoryImpl:84 - Creating AuditEvent:  : 7dec89f1-4647-11ee-b2e3-4f90aa87405e : SRU-File Upload
NGUI: 08-29 08:38:56 ajp-nio-8009-exec-5: INFO  AuditEntityRepositoryImpl:94 - No entity changes to create
NGUI: 08-29 08:38:56 ajp-nio-8009-exec-5: INFO  UploadDBUpdateFileResource:199 - Uploading: Cisco_Firepower_SRU-2021-11-15-001-vrt.sh.REL.tar
NGUI: 08-29 08:38:56 ajp-nio-8009-exec-5: INFO  UploadDBUpdateFileResource:215 - File:Cisco_Firepower_SRU-2021-11-15-001-vrt.sh.REL.tar will be copied to folder:/ngfw/var/sf/SRU/verify
NGUI: 08-29 08:38:56 ajp-nio-8009-exec-5: INFO  UploadDBUpdateFileResource:224 - Uploaded file is of size 55285760 bytes.  Disk has 111073599488 bytes in verifyDir and 111073599488 bytes in finalDir. 1073741824 are reserved for other io.
NGUI: 08-29 08:38:56 ajp-nio-8009-exec-5: INFO  UploadDBUpdateFileResource:245 - Completed file copy without errors
NGUI: 08-29 08:38:56 ajp-nio-8009-exec-5: INFO  AuditEntityRepositoryImpl:84 - Creating AuditEvent:  : 7dfd52d2-4647-11ee-b2e3-e5c307c86032 : SRU-File Upload: Cisco_Firepower_SRU-2021-11-15-001-vrt.sh.REL.tar
NGUI: 08-29 08:38:56 ajp-nio-8009-exec-5: INFO  AuditEntityRepositoryImpl:94 - No entity changes to create
NGUI: 08-29 08:38:56 ajp-nio-8009-exec-5: INFO  UploadDBUpdateFileResource:270 - Successfully Uploaded file of size (55285760b) to /ngfw/var/sf/SRU/verify/Cisco_Firepower_SRU-2021-11-15-001-vrt.sh.REL.tar

MSGS: 08-29 08:38:57 MULTEK-FP-01 sudo:      www : TTY=unknown ; PWD=/opt/cisco/csp/applications ; USER=root ; COMMAND=/ngfw/usr/local/sf/bin/verify_signed_image.sh -s /ngfw/var/tmp/sigstatus_lL1Dbjcu -i /var/sf/SRU/Cisco_Firepower_SRU-2021-11-15-001-vrt.sh.REL.tar
MSGS: 08-29 08:38:58 MULTEK-FP-01 sudo:      www : TTY=unknown ; PWD=/opt/cisco/csp/applications ; USER=root ; COMMAND=/ngfw/usr/local/sf/bin/package_info.pl /var/tmp/upgrade-patch/Cisco_Firepower_SRU-2021-11-15-001-vrt.sh --lsm
MSGS: 08-29 08:38:59 MULTEK-FP-01 sudo:      www : TTY=unknown ; PWD=/opt/cisco/csp/applications ; USER=root ; COMMAND=/ngfw/usr/local/sf/bin/package_info.pl /var/tmp/upgrade-patch/Cisco_Firepower_SRU-2021-11-15-001-vrt.sh --check-sha512
MSGS: 08-29 08:39:01 MULTEK-FP-01 sudo:      www : TTY=unknown ; PWD=/opt/cisco/csp/applications ; USER=root ; COMMAND=/ngfw/usr/local/sf/bin/package_info.pl /var/tmp/upgrade-patch/Cisco_Firepower_SRU-2021-11-15-001-vrt.sh --info
MSGS: 08-29 08:39:02 MULTEK-FP-01 sudo:      www : TTY=unknown ; PWD=/opt/cisco/csp/applications ; USER=root ; COMMAND=/ngfw/usr/local/sf/bin/package_info.pl /var/tmp/upgrade-patch/Cisco_Firepower_SRU-2021-11-15-001-vrt.sh --lsm

NGUI: 08-29 08:39:03 ajp-nio-8009-exec-5: INFO  DefaultJobExecutionRepository:286 - Creating new job history for entity: SRUUpdateManual
NGUI: 08-29 08:39:03 ajp-nio-8009-exec-5: INFO  DefaultJobExecutionRepository:421 - Adding new JobSchedule: SRUUpdateManual.823f1b33-4647-11ee-b2e3-65ff0278bcfb
NGUI: 08-29 08:39:03 ajp-nio-8009-exec-5: INFO  UploadDBUpdateFileResource:440 - Uploaded file: Cisco_Firepower_SRU-2021-11-15-001-vrt.sh.REL.tar is being copied to the necessary location from the internal uploaded space

NGUI: 08-29 08:39:03 schedulerFactoryBean_Worker-1: INFO  NgfwJobListener:59 - SRUUpdateManualJob is going to be executed.
NGUI: 08-29 08:39:03 schedulerFactoryBean_Worker-1: INFO  AuditEntityRepositoryImpl:84 - Creating AuditEvent: sruupdatemanual : 8247a6b5-4647-11ee-b2e3-9d0f9cd78331 : Rule Update
NGUI: 08-29 08:39:03 schedulerFactoryBean_Worker-1: INFO  AuditEntityRepositoryImpl:94 - No entity changes to create
NGUI: 08-29 08:39:03 schedulerFactoryBean_Worker-1: INFO  SRUUpdateJob:77 - Executing Rule Update
NGUI: 08-29 08:39:03 schedulerFactoryBean_Worker-1: INFO  SRUUpdateServices:283 - Start Rule Update. JobType:SRU_UPDATE, Forced:false
NGUI: 08-29 08:39:03 schedulerFactoryBean_Worker-1: INFO  SystemInformationRepository:410 - Updating the Security Intelligence Feeds Info Object to System Information.
NGUI: 08-29 08:39:03 schedulerFactoryBean_Worker-1: ERROR SRUUpdateHandler:100 - Failed to update Rulesjava.lang.NullPointerException
NGUI: 08-29 08:39:03 schedulerFactoryBean_Worker-1: ERROR SRUUpdateHandler:127 - 8240a1d4-4647-11ee-b2e3-e9a3c7b1f140:Rule Update Installation Failed, errorcode is unknown

Any ideas?

Thanks

/Chess

S3C · ‎08-29-2023

I almost had the same issue, backup didnt work, broke snort...my only option was to delete the entire conf and conf the device manually (not restore the backup). Afterwards talking to cisco I shouldve created a TAC ticket and a technician maybe couldve solved it without reimage. So maybe try with that?