Unable to copy firmware image to ASA

[UZaman3]

I am trying to upgrade the firmware on ASA's we have at multiple sites but for some reason copying over the firmware fails. We are currently running FP2140's in ASA mode and whenever I copy the files over from a windows machine, it fails. I am using scp to transfer the file over and the file begins to transfer. On the windows machine I see the progress of the transfer and on the ASA I see a temp file name of scp_1 which indicates the file is being transferred over. It takes 10 minutes or so for the transfer to say 100% on the windows box and then it fails with the error "Error: Signature not valid for file disk0:/cisco-asa-fp2k.9.18.4.22.spa. I was able to successfully transfer this image to our Nexus and even tried to scp it from the Nexus to the ASA but still no luck. Does anyone know how I can get this file up to the ASA so I can upgrade them?

[balaji.bandi]

check the release notes and bug available in the document :

https://www.cisco.com/c/en/us/td/docs/security/asa/asa918/release/notes/asarn918.html

[UZaman3]

Thanks for the reply. I was reading that and maybe I don't understand it correctly. Do I need to install a newer version of ASDM before I can copy the ASA image over?

[UZaman3]

I added asdm-7191-95.bin to the firewall and was able to successfully get into the firewall from ASDM. I even tried transferring the file using ASDM and it failed there as well. The current firmware on the ASA is 9.10(1)

[Aref Alsouqi]

Looks like a bugy behaviour. I would try to upload a different image for example the 9.20.2 and then after that is installed I would try to downgrade it to the 9.18.4.

[Marius Gunnerud]

I agree that this sees very buggy.  If you have issues uploading a different image to the FTD device I suggest opening a TAC case and have them check what is happening.

[ImOwaisAB]

Can you post the output of these commands?

1. dir flash:

2. show version

[UZaman3]

Cisco Adaptive Security Appliance Software Version 9.10(1)
Firepower Extensible Operating System Version 2.4(1.103)
Device Manager Version 7.10(1)

Compiled on Wed 24-Oct-18 17:07 PDT by builders
System image file is "disk0:/mnt/boot/installables/switch/fxos-k8-fp2k-npu.2.4.1 .103.SPA"
Config file at boot was "startup-config"

columbia-asa up 161 days 17 hours
failover cluster up 161 days 17 hours

Hardware: FPR-2140, 14822 MB RAM, CPU MIPS 1800 MHz, 1 CPU (16 cores)

1: Int: Internal-Data0/1 : address is 000f.b748.4800, irq 0
3: Ext: Management1/1 : address is e8d3.225a.3a81, irq 0
4: Int: Internal-Data1/1 : address is 0000.0100.0001, irq 0
5: Int: Internal-Data1/2 : address is 0000.0000.0000, irq 0

License mode: Smart Licensing

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 1024
Inside Hosts : Unlimited
Failover : Active/Active
Encryption-DES : Enabled
Encryption-3DES-AES : Enabled
Security Contexts : 2
Carrier : Disabled
AnyConnect Premium Peers : 10000
AnyConnect Essentials : Disabled
Other VPN Peers : 10000
Total VPN Peers : 10000
AnyConnect for Mobile : Enabled
AnyConnect for Cisco VPN Phone : Enabled
Advanced Endpoint Assessment : Enabled
Shared License : Disabled
Total TLS Proxy Sessions : 10000
Cluster : Disabled

Failover cluster licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 1024
Inside Hosts : Unlimited
Failover : Active/Active
Encryption-DES : Enabled
Encryption-3DES-AES : Enabled
Security Contexts : 4
Carrier : Disabled
AnyConnect Premium Peers : 10000
AnyConnect Essentials : Disabled
Other VPN Peers : 10000
Total VPN Peers : 10000
AnyConnect for Mobile : Enabled
AnyConnect for Cisco VPN Phone : Enabled
Advanced Endpoint Assessment : Enabled
Shared License : Disabled
Total TLS Proxy Sessions : 10000
Cluster : Disabled

Maybe I'm just doing this wrong. Not a FirePower SME by any means. Do I have to update this file - fxos-k8-fp2k-npu.2.4.1 .103.SPA? Wonder if the ASA image is included in the latest package for that?

[UZaman3]

Cisco Adaptive Security Appliance Software Version 9.10(1)
Firepower Extensible Operating System Version 2.4(1.103)
Device Manager Version 7.10(1)

Compiled on Wed 24-Oct-18 17:07 PDT by builders
System image file is "disk0:/mnt/boot/installables/switch/fxos-k8-fp2k-npu.2.4.1 .103.SPA"
Config file at boot was "startup-config"

columbia-asa up 161 days 17 hours
failover cluster up 161 days 17 hours

Hardware: FPR-2140, 14822 MB RAM, CPU MIPS 1800 MHz, 1 CPU (16 cores)

1: Int: Internal-Data0/1 : address is 000f.b748.4800, irq 0
3: Ext: Management1/1 : address is e8d3.225a.3a81, irq 0
4: Int: Internal-Data1/1 : address is 0000.0100.0001, irq 0
5: Int: Internal-Data1/2 : address is 0000.0000.0000, irq 0

License mode: Smart Licensing

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 1024
Inside Hosts : Unlimited
Failover : Active/Active
Encryption-DES : Enabled
Encryption-3DES-AES : Enabled
Security Contexts : 2
Carrier : Disabled
AnyConnect Premium Peers : 10000
AnyConnect Essentials : Disabled
Other VPN Peers : 10000
Total VPN Peers : 10000
AnyConnect for Mobile : Enabled
AnyConnect for Cisco VPN Phone : Enabled
Advanced Endpoint Assessment : Enabled
Shared License : Disabled
Total TLS Proxy Sessions : 10000
Cluster : Disabled

Failover cluster licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 1024
Inside Hosts : Unlimited
Failover : Active/Active
Encryption-DES : Enabled
Encryption-3DES-AES : Enabled
Security Contexts : 4
Carrier : Disabled
AnyConnect Premium Peers : 10000
AnyConnect Essentials : Disabled
Other VPN Peers : 10000
Total VPN Peers : 10000
AnyConnect for Mobile : Enabled
AnyConnect for Cisco VPN Phone : Enabled
Advanced Endpoint Assessment : Enabled
Shared License : Disabled
Total TLS Proxy Sessions : 10000
Cluster : Disabled

Reading on Cisco's documentation that versions prior to 9.13 ran only in Platform mode. Since I'm on 9.10 and am jumping to 9.18, could it be an issue there? Do I need to change the fxos system file (fxos-k8-fp2k-npu.2.4.1 .103.SPA)?

[UZaman3]

Also, I was able to successfully push this image to our FP1150's running ASA mode at another site and finished the upgrade for those yesterday. So just having issues on the 2140's

[Dustin Anderson]

Have you tried to download the file again. The 1150 and 2140 has different files for updates, so have you successfully updated a 2K series with the 2K file? 

On windows, check the hash of the file 

certutil -hashfile <file> MD5

cisco-asa-fp2k.9.18.4.22.SPA vs cisco-asa-fp1k.9.18.4.22.SPA

[UZaman3]

Yes, sorry for not being clear. Same version for both firewall platforms but different files:

FPR-1150: cisco-asa-fp1k.9.18.4.22.SPA worked without issue

FPR-2140: cisco-asa-fp2k.9.18.4.22.SPA - does not allow me to copy over to the ASA

[Dustin Anderson]

Yeah, I have had a similar issue where the file did not download correctly and the hash did not match, so the system would not install it.

you can check the hash of the file in windows and compare it to the hash on cisco's site. If it doesn't match try to download it again and re-check.

in windows pull up a command prompt and this is the command. change <file> with the filename. just be in the folder the file is in.

certutil -hashfile <file> MD5

[UZaman3]

PS C:\Users\Administrator\Desktop> certutil -hashfile .\cisco-asa-fp2k.9.18.4.22.spa MD5
MD5 hash of .\cisco-asa-fp2k.9.18.4.22.spa:
9ba8d793ef1e3dbdfef3f0bb60a08ab5
CertUtil: -hashfile command completed successfully.

This looks like it matches what is on Cisco's website for this image - 

Description :	Cisco Adaptive Security Appliance for the Cisco Firepower 2100 Series.
Release :	9.18.4 Interim
Release Date :	06-Mar-2024
FileName :	cisco-asa-fp2k.9.18.4.22.SPA
Size :	468.58 MB ( 491340160 bytes)
MD5 Checksum :	9ba8d793ef1e3dbdfef3f0bb60a08ab5

[UZaman3]

I found this table - wondering if I need to update the FXOS OS before I can update the ASA firmware:

Table 15.Threat DefenseASAFXOS

7.4.1.1	9.20(2.201)	2.14.1.131
7.4.1	9.20(2.2)	2.14.1.131
7.4.0	9.20(1.84)	2.14.0.475
7.3.1.1	9.19(1.202)	2.13.0.1022
7.3.1	9.19(1.200)	2.13.0.1022
7.3.0	9.19(1)	2.13.0.198
7.2.7	9.18(4.201)	2.12.1.73
7.2.6	9.18(4.22)	2.12.1.73
7.2.5.1	9.18(3.60)	2.12.0.530
7.2.5	9.18(3.53)	2.12.0.519