Firepower 1100/2100 ASA active/active upgrade

-

 Upgrade an Active/Active Failover Pair Using the CLI

To upgrade two units in an Active/Active failover configuration, perform the following steps on the Firepower 1000 or 2100 in Appliance mode.

Before you begin

Perform these steps on the primary unit.

Perform these steps in the system execution space.


Procedure

Step 1

On the primary unit in privileged EXEC mode, copy the ASA software to flash memory:

asa/act/pri# copy ftp://username:password@ip-address/cisco-asa-fp1k.9.14.1.SPA disk0:/cisco-asa-fp1k.9.14.1.SPA


Step 2

Copy the software to the secondary unit; be sure to specify the same path as for the primary unit:

asa/act/pri# failover exec mate copy /noconfirm ftp://username:password@ip-address/cisco-asa-fp1k.9.14.1.SPA disk0:/cisco-asa-fp1k.9.14.1.SPA


Step 3

Copy the ASDM image to the primary unit flash memory:

asa/act/pri# ciscoasa# copy ftp://username:password@ip-address/asdm-7141.bin disk0:/asdm-7141.bin


Step 4

Copy the ASDM image to the secondary unit; be sure to specify the same path as for the primary unit:

asa/act/pri# failover exec mate copy /noconfirm ftp://username:password@ip-address/asdm-7141.bin disk0:/asdm-7141.bin


Step 5

If you are not already in global configuration mode, access global configuration mode:

configure terminal


Step 6

Show the current boot image configured, if present.

show running-config boot system

Note that you may not have a boot system command present in your configuration; for example, if you installed the image from ROMMON, have a new device, or you removed the command manually.


Example:

ciscoasa(config)# show running-config boot system

boot system disk0:/cisco-asa-fp1k.9.13.1.SPA


Step 7

If you have a boot system command configured, remove it so that you can enter the new boot image.

If you did not have a boot system command configured, skip this step.

ciscoasa(config)# no boot system disk0:/cisco-asa-fp1k.9.13.1.SPA


Step 8

Set the ASA image to boot (the one you just uploaded).

You can only enter a single boot system command. The boot system command performs an action when you enter it: the system validates and unpacks the image and copies it to the boot location (an internal location on disk0 managed by FXOS). The new image will load when you reload the ASA. If you change your mind prior to reloading, you can enter the no boot system command to delete the new image from the boot location, so the current image continues to run.

ciscoasa(config)# boot system disk0:/cisco-asa-fp1k.9.14.1.SPA


The system is currently installed with security software package 9.13.1, which has:

   - The platform version:  2.7.1

   - The CSP (asa) version: 9.13.1

Preparing new image for install...

!!!!!!!!!!!!!

Image download complete (Successful unpack the image).

Installation of version 9.14.1 will do the following:

   - upgrade to the new platform version 2.8.1

   - upgrade to the CSP ASA version 9.14.1

After the installation is complete, reload to apply the new image.

Finalizing image install process...

 

Install_status: ready...........

Install_status: validating-images.....

Install_status: update-software-pack-completed

ciscoasa(config)#


Step 9

Set the ASDM image to use (the one you just uploaded).

asa/act/pri(config)# asdm image disk0:/asdm-7141.bin

You can only configure one ASDM image to use; in this case you do not need to first remove the existing configuration.


Step 10

Save the new settings to the startup configuration.

write memory

These configuration changes are automatically saved on the secondary unit.


Step 11

Make both failover groups active on the primary unit.


asa/act/pri(config)# failover active group 1

asa/act/pri(config)# failover active group 2


Step 12

Reload the secondary unit to boot the new image:

failover reload-standby

Wait for the secondary unit to finish loading. Use the show failover command to verify that both failover groups are in the Standby Ready state.


Step 13

Force both failover groups to become active on the secondary unit:

asa/act/pri(config)# no failover active group 1

asa/act/pri(config)# no failover active group 2

asa/stby/pri(config)# 


If you are disconnected from your SSH session, reconnect to the failover group 1 IP address, now on the secondary unit.


Step 14

Reload the primary unit:

asa/act/sec# failover reload-standby


Note

If you are connected to the primary unit console port, you should instead enter the reload command to reload the primary unit.

You may be disconnected from your SSH session.

Step 15

If the failover groups are configured with the preempt command, they automatically become active on their designated unit after the preempt delay has pass


https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/asa-appliance-asav.html#concept_lhx_vvn_kkb

Comments

Post a Comment

Popular posts from this blog

Firepower FMC and FTD troubleshooting

-
 1. Display real time log on FMC or FTD: pigtail for example: pigtail | grep 192.168.2.20                      pigtail | grep sftunnel 2. Restart communication channel manage_procs.pl run it from  the sensor only, run it from FMC will reset all sensors' channel. This scripts are nice to be used when the FMC and FTD have communication problems like heartbeats are not received, policy deployment is failing or events are not received > expert ************************************************************** NOTICE - Shell access will be deprecated in future releases          and will be replaced with a separate expert mode CLI. ************************************************************** admin@FTD:~$ sudo su Password: root@FTD:/home/admin# manage_procs.pl ****************  Configuration Utility  **************  1   Reconfigure Correlator  2   Reconfigure and flush Correlator  3    Restart Comm. channel  4   Update routes  5   Reset all routes  6   Validate Network  0   Exit *****
Read more

ASA IKEv1 VPN troubleshooting Steps and Tips

-
  1. Phase I proposal mismatch  Run show crypto isakmp sa  Initiator: MM_WAIT_MSG2 Responder: No info  Most likely this is phase1 proposal mismatch, verify IKEv1 policy, other symptoms:   Initiator log: Information Exchange processing failed All configured IKE versions failed to establish the tunnel Initiator debug: Received an un-encrypted NO_PROPOSAL_CHOSEN notify message, dropping Responder log: Error processing payload: Payload ID Responder debug:  All SA proposals found unacceptable 2. IKE version mismatch:  Run  show crypto isakmp sa  no info at both initiator and responder Initiator log: Removing peer from correlator table failed, no match! Reason: User Requested  All configured IKE versions failed to establish the tunnel Initiator debug: Oakley begin quick mode PHASE 1 COMPLETED IKE Initiator sending 1st QM pkt Removing peer from correlator table failed, no match! Session is being torn down. Reason: User Requested Responder log: Tunnel Rejected: Conflicting protocols specified
Read more

Firepower 2100/1100 FTD/ASA initial setup, reimage, upgrade.

-
  Chassis FXOS and FTD share same management IP (default 192.168.45.45) Chassis FXOS (192.168.45.45) and ASA ()use different management IP although on same physical interface. SSH to FXOS/FTD are on FTD CLI prompt, go to FXOS using the  connect fxos  command Console to Chassis is on FXOS CLI prompt, go to FTD using the  connect ftd  command The Firepower 1100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is supported for troubleshooting purposes. The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System (FXOS).  If you run ASA on Firepower 2100, ASA can be in the following modes: Appliance mode (the default after ASA 9.13)—Appliance mode lets you configure all settings in the ASA. Only advanced troubleshooting commands are available from the FXOS CLI. See the  FXOS troubleshooting guide  for more information. Firepower Chassis Manager is not supported . ciscoasa# connect fxos [admin] Connecting to fxos. Connected
Read more