Re-Image and Update the Cisco Firepower : how to completely install FTD or SFR on cisco firewall devices
Problem
This takes ages! Seriously, if it’s late in the afternoon you might want to do this tomorrow morning, or leave the re-imaging running overnight. (Remember if you set the FirePOWER module to ‘fail-closed’, you will lose internet access, so you might want to change that to ‘fail-open’ as well).
The process is a LOT EASIER to do in the ASDM, I’m not usually an advocate of the GUI, but if you can access the FirePOWER settings that way, it will do all the hard work for you, (see below).
See Updating FirePOWER Module (From ASDM)
Note: This ASDM upgrade will fail if the module is being managed by the FirePOWER Management center (FireSIGHT), you can update it from there, or remove the peer association, then update it.
Normally I only have to do this if something’s gone wrong, and I can’t contact the module, or I’ve go a lot of them to do, and I don’t have direct management access. This process works on the ‘baby ASA’s,’ i.e 5506-X and 5508-X, and also on the larger models i.e 5512-X upwards (but NOT the 5585-X, that has a hw-module not a sw-module).
Solution
Before you start you need three things;
- A Boot Image file (i.e. asasfr-5500x-boot-6.0.0-1005.img) – download from Cisco.
- A Firepower Software Package (i.e. asasfr-sys-6.0.0-1005.pkg) this is a BIG file (over a Gigabyte) – download from Cisco.
- A Web Server, (or FTP server) setup, with the files above available for ‘download’ into the FirePOWER module. Note: If using Microsoft IIS you need to add .img and .pkg as downloadable MIME objects or it wont work.
Connect to the firewall via command line, and check that the module is ‘Up’ and take a note of the current software version;
Petes-ASA(config)# show module
Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
1 ASA 5506-X with SW, 8GE Data, 1GE Mgmt, AC ASA5506 JAD200XXXXX
sfr FirePOWER Services Software Module ASA5506 JAD200XXXXX
Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
1 00f2.8bfb.fbc8 to 00f2.8bfb.fbd1 1.1 1.1.8 9.5(2)2
sfr 00f2.8bfb.fbc7 to 00f2.8bfb.fbc7 N/A N/A 5.4.1-211
Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------
sfr ASA FirePOWER UP 5.4.1-211
Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
1 Up Sys Not Applicable
sfr UP Sys Not Applicable
Petes-ASA(config)#
Download the boot image from your web server into the ‘flash’ memory in the parent firewall.
Petes-ASA(config)# copy http flash Address or name of remote host []? 10.3.0.84 Source filename []? asasfr-5500x-boot-6.3.0-3.img Destination filename [asasfr-5500x-boot-6.0.0-1005.img]? {Enter} Accessing http://10.3.0.84/asasfr-5500x-boot-6.3.0-3.img...!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Writing file disk0:/asasfr-5500x-boot-6.3.0-3.img... !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! INFO: No digital signature found 41848832 bytes copied in 5.20 secs (8369766 bytes/sec)
Then set that file as the boot image for the sourcefire module, and tell the module to perform a ‘recovery boot’.
Petes-ASA(config)# sw-module module sfr recover configure image disk0:/asasfr-5500x-boot-6.4.0-1.img Petes-ASA(config)# sw-module module sfr recover boot Module sfr will be recovered. This may erase all configuration and all data on that device and attempt to download/install a new image for it. This may take several minutes. Recover module sfr? [confirm]{Enter} Recover issued for module sfr.
Now it looks like nothing is happening, but the SFR module will restart with the recovery/boot image, you can see a little of what’s going on if you issue a debug command on the module,
Petes-ASA(config)# debug module-boot debug module-boot enabled at level 1 IF YOU LOOK AT THE MODULES STATUS IT WILL SAY 'RECOVER' Petes-ASA(config)# show module Mod Card Type Model Serial No. ---- -------------------------------------------- ------------------ ----------- 1 ASA 5506-X with SW, 8GE Data, 1GE Mgmt, AC ASA5506 JAD200XXXXX sfr FirePOWER Services Software Module ASA5506 JAD200XXXXX Mod MAC Address Range Hw Version Fw Version Sw Version ---- --------------------------------- ------------ ------------ --------------- 1 00f2.8bfb.fbc8 to 00f2.8bfb.fbd1 1.1 1.1.8 9.5(2)2 sfr 00f2.8bfb.fbc7 to 00f2.8bfb.fbc7 N/A N/A 5.4.1-211 Mod SSM Application Name Status SSM Application Version ---- ------------------------------ ---------------- -------------------------- sfr ASA FirePOWER Not Applicable 5.4.1-211 Mod Status Data Plane Status Compatibility ---- ------------------ --------------------- ------------- 1 Up Sys Not Applicable sfr Recover Not Applicable SAMPLE DEBUG OUTPUT Mod-sfr 657> *** EVENT: Disk Image created successfully. Mod-sfr 658> *** TIME: 07:05:36 GMT/BST Mar 1 2016 Mod-sfr 659> *** Mod-sfr 660> *** Mod-sfr 661> *** EVENT: Start Parameters: Image: /mnt/disk0/vm/vm_1.img, ISO: -cdrom /mnt/disk0 Mod-sfr 662> /asasfr-5500x-boot-6.4.0-1.img, Num CPUs: 3, RAM: 2266MB, Mgmt MAC: 00:F2:8B:FB Mod-sfr 663> :FB:C7, CP MAC: 00:00:00:02:00:01, HDD: -drive file=/dev/sda,cache=none,if=virtio, Mod-sfr 664> De Mod-sfr 665> *** <—Output Removed for the Sake of Brevity—> Mod-sfr 50> Starting Advanced Configuration and Power Interface daemon: acpid. Mod-sfr 51> acpid: starting up with proc fs Mod-sfr 52> acpid: opendir(/etc/acpi/events): No such file or directory Mod-sfr 53> starting Busybox inetd: inetd... done. Mod-sfr 54> Starting ntpd: done Mod-sfr 55> Starting syslogd/klogd: done
This would be a good time to go get a coffee, it doesn’t take that long, the documentation at Cisco says 5 minutes, I’d wait at least 10! You then need to login to the SFR module and give it a basic config;
Petes-ASA(config)# session sfr console Opening console session with module sfr. Connected to module sfr. Escape character sequence is 'CTRL-^X'. Cisco FirePOWER Services Boot Image 6.4.0 asasfr login: admin Password: Admin123 Cisco FirePOWER Services Boot 6.4.0 (1) Type ? for list of commands asasfr-boot>setup Welcome to Cisco FirePOWER Services Setup [hit Ctrl-C to abort] Default values are inside [] Enter a hostname [asasfr]: Firepower-Module Do you want to configure IPv4 address on management interface?(y/n) [Y]: Y Do you want to enable DHCP for IPv4 address assignment on management interface?(y/n) [N]: N Enter an IPv4 address [192.168.8.8]: 192.168.1.253 Enter the netmask [255.255.255.0]: 255.255.255.0 Enter the gateway [192.168.8.1]: 192.168.1.254 Do you want to configure static IPv6 address on management interface?(y/n) [N]: N Stateless autoconfiguration will be enabled for IPv6 addresses. Enter the primary DNS server IP address: 192.168.1.10 Do you want to configure Secondary DNS Server? (y/n) [n]: N Do you want to configure Local Domain Name? (y/n) [n]: Y Enter the local domain name: petenetlive.com Do you want to configure Search domains? (y/n) [n]: Y Enter the comma separated list for search domains: petenetlive.com Do you want to enable the NTP service? [Y]: Y Enter the NTP servers separated by commas: 194.35.252.7,130.88.202.49,93.93.131.118 Do you want to enable the NTP symmetric key authentication? [N]: N Please review the final configuration: Hostname:Firepower-Module Management Interface Configuration IPv4 Configuration:static IP Address:192.168.1.253 Netmask:255.255.25.0 Gateway:192.168.1.254 IPv6 Configuration:Stateless autoconfiguration DNS Configuration: Domain:petenetlive.com Search:petenetlive.com DNS Server:10.3.0.2 NTP configuration: 194.35.252.7[4C130.88.202.49 93.93.131.118 CAUTION: You have selected IPv6 stateless autoconfiguration, which assigns a global address based on network prefix and a device identifier. Although this address is unlikely to change, if it does change, the system will stop functioning correctly. We suggest you use static addressing instead. Apply the changes?(y,n) [Y]: Y Configuration saved successfully! Applying... Restarting network services... Restarting NTP service... Done. Press ENTER to continue...{Enter}
Now you can install the software package on the SFR module. Note: the URL has TWO forward slashes in it not one, (Cisco update your documentation!)
UPDATE: (Thanks to Eli Davis) To avoid having to wait to confirm with the following step, use the ‘no confirm’ keyword. i.e. “system install noconfirm http://10.3.0.84/asasfr-sys-6.0.0-1005.pkg”.
WARNING You might want to set the SSH timeout to 45 minutes before you do this, or it will keep logging you out while you are waiting!
asasfr-boot>system install noconfirm http://10.3.0.84/asasfr-sys-6.4.0-102.pkg Verifying. .. Downloading. .. Extracting. .. Package Detail Description:Cisco ASA-SFR 6.4.0-102 System Install Requires reboot:Yes Do you want to continue with upgrade? [y]: Y Warning: Please do not interrupt the process or turn off the system. Doing so might leave system in unusable state. <——Output Removed for the Sake of Brevity——> Mod-sfr 61> login: [ 2498.828291] sd 0:0:0:0: [sda] 6291456 512-byte hardware sectors: (3.22 G Mod-sfr 62> B/3.00 GiB) Mod-sfr 63> [ 2498.832675] sd 0:0:0:0: [sda] Write Protect is off Mod-sfr 64> [ 2498.835298] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't Mod-sfr 65> support DPO or FUA Mod-sfr 808> ************ Attention ********* Mod-sfr 809> Initializing the configuration database. Depending on available Mod-sfr 810> system resources (CPU, memory, and disk), this may take 30 minutes Mod-sfr 811> or more to complete. Mod-sfr 812> ************ Attention ********* Mod-sfr 813> Executing S10database Console session with module sfr terminated.
May take 30 minutes! I waited 45 then drove 8 miles home reconnected and it was still going, (it’s a lot faster on the larger firewalls.) Just keep an eye on the status it will change from recover to up when its complete
Petes-ASA(config)#show module Mod Card Type Model Serial No. ---- -------------------------------------------- ------------------ ----------- 1 ASA 5506-X with SW, 8GE Data, 1GE Mgmt, AC ASA5506 JAD200XXXXX sfr Unknown N/A JAD200XXXXX Mod MAC Address Range Hw Version Fw Version Sw Version ---- --------------------------------- ------------ ------------ --------------- 1 00f2.8bfb.fbc8 to 00f2.8bfb.fbd1 1.1 1.1.8 9.5(2)2 sfr 00f2.8bfb.fbc7 to 00f2.8bfb.fbc7 N/A N/A Mod SSM Application Name Status SSM Application Version ---- ------------------------------ ---------------- -------------------------- Mod Status Data Plane Status Compatibility ---- ------------------ --------------------- ------------- 1 Up Sys Not Applicable sfr Recover Not Applicable WAIT AGES UNTIL... Petes-ASA# show module Mod Card Type Model Serial No. ---- -------------------------------------------- ------------------ ----------- 1 ASA 5506-X with SW, 8GE Data, 1GE Mgmt, AC ASA5506 JAD200XXXXX sfr FirePOWER Services Software Module ASA5506 JAD200XXXXX Mod MAC Address Range Hw Version Fw Version Sw Version ---- --------------------------------- ------------ ------------ --------------- 1 00f2.8bfb.fbc8 to 00f2.8bfb.fbd1 1.1 1.1.8 9.5(2)2 sfr 00f2.8bfb.fbc7 to 00f2.8bfb.fbc7 N/A N/A 6.0.0-1005 Mod SSM Application Name Status SSM Application Version ---- ------------------------------ ---------------- -------------------------- sfr ASA FirePOWER Up 6.4.0-102 Mod Status Data Plane Status Compatibility ---- ------------------ --------------------- ------------- 1 Up Sys Not Applicable sfr Up Up
Now you need to connect to the SFR and configure it, (yes again).
Petes-ASA# session sfr Opening command session with module sfr. Connected to module sfr. Escape character sequence is 'CTRL-^X'. Cisco ASA5506 v6.0.0 (build 1005) firepower login: admin Password: Admin123 Last login: Tue Mar 1 10:08:16 UTC 2016 on pts/0 Copyright 2004-2015, Cisco and/or its affiliates. All rights reserved. Cisco is a registered trademark of Cisco Systems, Inc. All other trademarks are property of their respective owners. Cisco Fire Linux OS v6.4.0 (build 102) Cisco ASA5506 v6.0.0 (build 1005) Last login: Tue Mar 1 10:01:01 UTC 2016 on cron Last login: Tue Mar 1 10:08:16 UTC 2016 on pts/0 You must accept the EULA to continue. Press to display the EULA: {Enter} END USER LICENSE AGREEMENT IMPORTANT: PLEASE READ THIS END USER LICENSE AGREEMENT CAREFULLY. IT IS VERY IMPORTANT THAT YOU CHECK THAT YOU ARE PURCHASING CISCO SOFTWARE OR EQUIPMENT FROM AN APPROVED SOURCE AND THAT YOU, OR THE ENTITY YOU REPRESENT (COLLECTIVELY, THE "CUSTOMER") HAVE BEEN REGISTERED AS THE END USER FOR THE --Output Removed for the Sake of Brevity - Press Space Bar (A LOT!)-- Please enter 'YES' or press to AGREE to the EULA: YES System initialization in progress. Please stand by. You must change the password for 'admin' to continue. Enter new password: Password123 Confirm new password: Password123 You must configure the network to continue. You must configure at least one of IPv4 or IPv6. Do you want to configure IPv4? (y/n) [y]: Y Do you want to configure IPv6? (y/n) [n]: N Configure IPv4 via DHCP or manually? (dhcp/manual) [manual]: {Enter} Enter an IPv4 address for the management interface [192.168.45.45]: 192.168.1.123 Enter an IPv4 netmask for the management interface [255.255.255.0]: 255.255.255.0 Enter the IPv4 default gateway for the management interface []: 192.168.1.254 Enter a fully qualified hostname for this system [firepower]: Firepower-Module Enter a comma-separated list of DNS servers or 'none' []: 192.168.1.10 Enter a comma-separated list of search domains or 'none' [example.net]: petenetlive.com If your networking information has changed, you will need to reconnect. For HTTP Proxy configuration, run 'configure network http-proxy' Creating default Identity Policy. Creating default SSL Policy. Update policy deployment information - add device configuration - add network discovery - add system policy - add access control policy - applying access control policy You can register the sensor to a Firepower Management Center and use the Firepower Management Center to manage it. Note that registering the sensor to a Firepower Management Center disables on-sensor Firepower Services management capabilities. When registering the sensor to a Firepower Management Center, a unique alphanumeric registration key is always required. In most cases, to register a sensor to a Firepower Management Center, you must provide the hostname or the IP address along with the registration key. 'configure manager add [hostname | ip address ] [registration key ]' However, if the sensor and the Firepower Management Center are separated by a NAT device, you must enter a unique NAT ID, along with the unique registration key. 'configure manager add DONTRESOLVE [registration key ] [ NAT ID ]' Later, using the web interface on the Firepower Management Center, you must use the same registration key and, if necessary, the same NAT ID when you add this sensor to the Firepower Management Center. > exit Remote card closed command session. Press any key to continue. Command session with module sfr terminated. Petes-ASA#
Back at the firewall prompt make sure you can ping it, (you did put a cable in the management interface didn’t you?)
Petes-ASA# ping 192.168.1.123
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.123, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
Petes-ASA# wr mem
Building configuration...
Cryptochecksum: 6bcde85c dc7a074d 8e22978c 0620c211
7149 bytes copied in 0.350 secs
[OK]
Petes-ASA#
Now you can manage the FirePOWER Services console from the ASDM, or add it onto the FirePOWER Management Center (FireSIGHT).
Related Articles, References, Credits, or External Links
Thanks to Eli Davis for the feedback.
Cisco SFR Session – Cannot Exit To Command Line
Deploy Cisco FirePOWER Management Center (Appliance)