cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
15717
Views
6
Helpful
14
Replies

Sfr module upgrade aborted

wayne loh
Level 1
Level 1

Hi Guys,

Tried to perform the reimage of the Cisco 5525-x firepower module to 6.0.0 but failed. I've setup the ftp server(filezilla) and uploaded the boot image to disk0 parttion without any issue, however, perform system image ftp://username:password@<ftp ip>/...pkg file give me the 113 upgrade aborted after verifying. The ftp server should be working as it able to trasnfer to disk0 and telnet without any issue.

Anyone encounters before? Pls advise

Many Thanks.

14 Replies 14

Dennis Perto
Level 5
Level 5

Please check that the MD5 sum of the update file is correct. You can see the correct one at Ciscos website, where you downloaded the file. :)

I have the same problem.

Of course I first make the "reimage" copying the IMG to Flash and running the commands

#sw-module module sfr recover configure image...

then

#session sfr console

and setup the network information in the sfr console, etc.

I have already checked the MD5 Checksum of both files and they are right, the IMG and PKG are both the same version (6.0.0-1005).

I have tried with Solarwinds TFTP Server, Filezilla, CoreFTP and from different folders in my computer checking they are shared and having full access to user "everyone".

I also have tried disabling the Computer Firewall.

Like Wayne it seems it is not FTP issue because I was able to copy the IMG from my computer to the Flash.

The installation process with the command in the sfr console

>system install noconfirm ftp://192.168.0.2/....pkg"

shows "Verifyng !!!!" and after three seconds the message "113 Upgrade Aborted"

Can anyone help us?

Thank you

Another tip:

In order to check the IMG in flash is copied ok I ran the command #verify /md5 disk0:/.... and of course I compared that hash checksum number with cisco.

I also checked the PKG in the FTP Folder

hi,

did you setup an IP on the FP module?

asasfr-boot>setup

does ASA have routes to reach FTP?

also ensure ASA MGMT0/0 interface is UP (no shut).

I had this same problem. From the ASA I was able to hit the filezilla (FTP) server no problem, transfer, etc. However, when attempting to ping from the module to FTP server I could not hit it at all or transfer files. 

get into the module: 

"session sfr console"

and run a ping to the ftp server that you have in place and see if you can hit the FTP server. If you cannot, I would suggest you drop it (FTP server) on the same vlan you have configured for the module.  

That was my problem, I am now loading file no problem, I just assumed if the ASA could hit it, the module could to. 

Not applicable

I had this same problem. From the ASA I was able to hit the filezilla (FTP) server no problem, transfer, etc. However, when attempting to ping from the module to FTP server I could not hit it at all or transfer files. 

get into the module: 

"session sfr console"

and run a ping to the ftp server that you have in place and see if you can hit the FTP server. If you cannot, I would suggest you drop it (FTP server) on the same vlan you have configured for the module.  

That was my problem, I am now loading file no problem, I just assumed if the ASA could hit it, the module could to. 

I had just deployed SourceFIRE for a customer and decided to deploy it on my home 5506-X.  Had the exact same problem when I went to issue the following command:
system install noconfirm ftp://<IP>/asasfr-sys-6.2.0-362.pkg

It would start verifying then end almost immediately with:

113
Upgrade aborted

 

Found this thread and immediately remembered I hadn't cabled up the Mgmt interface - still had the memory of doing the customer's ASA and forgot to do my own.

Hi I had the same problem(ip example)

 

system install ftp://1.1.1.1/asasfr-sys-6.2.2-81.pkg,

Verifying

113
Upgrade aborted.

 

the problem was only the IP, after check and write the correct

 

system install ftp://1.1.1.10/asasfr-sys-6.2.2-81.pkg,
Verifying
Downloading..

Extracting.


all was ok,

 

Atte

José G.

Hey Guys,

 

It seems that you're using the incorrect gateway on the SFR (likely the Inside ASA address).  If you're transit or inside network is 192.168.1.0/24, for example:  Hypothetically -- ASA Inside 192.168.1.5, ASA-SFR 192.168.1.10, VLAN X SVI 192.168.1.1.  Set the gateway of the SFR to the SVI 192.168.1.1.  If the rest of your inter vlan routing is correct, you should be able to reach the FTP server.  I hope this helped.

Tom

This worked for me using filezilla server and follow above without creds in FTP statement... if you have creds like i have, it'll ask for creds after you initiate FTP session.

siva.ratana
Level 1
Level 1

Make sure your FTP server is connected to the management port of cisco ASA and the port is un-shut.

 

thanks.

lukrze
Level 1
Level 1

I had the same problem - my cable was not inside Mng interface :) When I fix the cable problem the installation succeded.

d.lachapelle
Level 1
Level 1

Hi guys, here is how you do this:

 

1) setup FTP server with anonymous login

2) make sure you can ping your FTP server from SFR:

asasfr-boot>ping 10.1.1.148
PING 10.1.1.148 (10.1.1.148): 56 data bytes
64 bytes from 10.1.1.148: seq=52 ttl=255 time=2007.810 ms
64 bytes from 10.1.1.148: seq=53 ttl=255 time=1008.056 ms
64 bytes from 10.1.1.148: seq=54 ttl=255 time=8.172 ms
64 bytes from 10.1.1.148: seq=55 ttl=255 time=35.558 ms

3) asasfr-boot>system install ftp://10.1.1.148/asasfr-sys-6.3.0-83.pkg   ***(notice no username at all, I can't get it to work with username. If successful you'll see a connection on your FTP server, I use FileZilla)***

 4) Success:

Verifying
Downloading
Extracting..

More to add on this topic.

Connectivity to ftp server is not in question.I have verified with packet capture that SYN, SYN-ACK packets sent and received. Something in the SYN-ACK from FTP server cause RST from sfr module.

Hmm, thinking about this more, maybe asymmetric routing. Maybe RST comes from ASA.

Packet out from Management 0/0, in to inside, out of inside, (intra-interface) to proper gateway. Packet returns direct to Management0/0. 

I used an ftp server on my own workstation (VPN) and the download succeeded.

I would test it further but, it takes forever so perhaps I won't.

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card