The upgrade procedure a Cisco Firepower ASA 2100 standalone unit with ASA version 9.13 and above is similar to the upgrade procedure in a classic Cisco ASA firewall.
The newer Firepower 2100 with ASA are shipped with ASA version 9.13 above which runs in Appliance mode. The ASA version 9.16.3 is the TAC recommended code (with gold star) as of this writing. Always check the ASA version and ASDM compatibility using this matrix. The ASA 9.16.3.19 is compatible with ASDM 7.18 (1.152)
ciscoasa# show version
Cisco Adaptive Security Appliance Software Version 9.16(2)3
SSP Operating System Version 2.10(1.172)
Device Manager Version 7.16(1)
Compiled on Mon 06-Sep-21 19:54 GMT by builders
System image file is "disk0:/mnt/boot/installables/switch/fxos-k8-fp2k-npu.2.10.1.172.SPA"
Config file at boot was "startup-config"
ciscoasa up 31 mins 46 secs
Hardware: FPR-2120, 6588 MB RAM, CPU MIPS 1200 MHz, 1 CPU (8 cores)
1: Int: Internal-Data0/1 : address is 000f.b748.1234, irq 0
3: Int: Not licensed : irq 0
4: Ext: Management1/1 : address is 3c26.e404.5678, irq 0
5: Int: Internal-Data1/1 : address is 0000.0100.0001, irq 0
License mode: Smart Licensing
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 1024
Inside Hosts : Unlimited
Failover : Active/Active
Encryption-DES : Enabled
Encryption-3DES-AES : Disabled
Security Contexts : 2
Carrier : Disabled
AnyConnect Premium Peers : 3500
AnyConnect Essentials : Disabled
Other VPN Peers : 3500
Total VPN Peers : 3500
AnyConnect for Mobile : Enabled
AnyConnect for Cisco VPN Phone : Enabled
Advanced Endpoint Assessment : Enabled
Shared License : Disabled
Total TLS Proxy Sessions : 8000
Cluster : Disabled
Serial Number: JAD26291234
Configuration register is 0x1
Configuration last modified by enable_1 at 08:19:10.249 UTC Sun Dec 11 2022
ciscoasa# show run asdm
no asdm history enable
ciscoasa# show fxos mode
Mode is currently set to appliance
I used a USB flash disk to easily copy the ASA image and ASDM files. There's no syslog generated by the ASA when a USB flash disk is inserted.
ciscoasa# dir ?
/all List all files
/recursive List files recursively
all-filesystems List files on all filesystems
disk0: Directory or file name
disk1: Directory or file name
flash: Directory or file name
system: Directory or file name
<cr>
ciscoasa# dir disk1:
Directory of disk1:/
<OUTPUT TRUNCATED>
181 -rwx 474321104 23:27:50 Sep 12 2022 cisco-asa-fp2k.9.16.3.19.SPA
182 -rwx 110401360 17:03:44 Dec 11 2022 asdm-7181-152.bin
12 file(s) total size: 1036935529 bytes
2013265920 bytes total (886046720 bytes free/44% free)
Use the copy disk1: disk0: to transfer image files from USB to ASA flash memory.
ciscoasa# copy disk1:/asdm-7181-152.bin disk0:/asdm-7181-152.bin
Source filename [asdm-7181-152.bin]?
Destination filename [asdm-7181-152.bin]?
Copy in progress...CCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
Verifying file disk0:/asdm-7181-152.bin...
Writing file disk0:/asdm-7181-152.bin...
110401360 bytes copied in 27.340 secs (4088939 bytes/sec)
ciscoasa# copy disk1:/cisco-asa-fp2k.9.16.3.19.SPA disk0:/cisco-asa-fp2k.9.16.3.19.SPA
Source filename [cisco-asa-fp2k.9.16.3.19.SPA]?
Destination filename [cisco-asa-fp2k.9.16.3.19.SPA]?
Copy in progress...CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
Verifying file disk0:/cisco-asa-fp2k.9.16.3.19.SPA...
Writing file disk0:/cisco-asa-fp2k.9.16.3.19.SPA...
474321104 bytes copied in 110.830 secs (4312010 bytes/sec)
ciscoasa# dir
Directory of disk0:/
134217958 drwx 52 19:54:29 Jul 20 2022 log
268599726 -rw- 37230720 19:55:18 Sep 06 2021 asdm.bin
2 drwx 4096 19:49:07 Jul 20 2022 cores
134217961 drwx 6 19:53:47 Jul 20 2022 fxos
134217962 drwx 22 19:54:51 Jul 20 2022 smart-log
402653602 -rw- 176 08:18:37 Dec 11 2022 npu-asa-cmd-server.log
402653603 -rw- 39 08:18:26 Dec 11 2022 snortpacketinfo.conf
268745990 drw- 26 19:55:22 Jul 20 2022 coredumpinfo
402653597 -rwx 474321104 09:15:43 Dec 11 2022 cisco-asa-fp2k.9.16.3.19.SPA
402653605 -rwx 110401360 09:17:03 Dec 11 2022 asdm-7181-152.bin
5 file(s) total size: 621953399 bytes
21475885056 bytes total (20637024256 bytes free/96% free)
Use the verify command to check the integrity of the file. MD5 checksum are found in the Cisco website.
ciscoasa# verify /md5 asdm-7181-152.bin
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
<OUTPUT TRUNCATED>
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Done!
verify /MD5 (disk0:/asdm-7181-152.bin) = 5871d371950e3861c303d351de361f54
ciscoasa# verify /md5 cisco-asa-fp2k.9.16.3.19.SPA
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
<OUTPUT TRUNCATED>
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Done!
verify /MD5 (disk0:/cisco-asa-fp2k.9.16.3.19.SPA) = 1fc4a0d9ad1729f1719e978713585ba8
Like the classic ASA, just change the boot system variable to point to the new ASA image and ASDM, save and reload for it to take effect.
ciscoasa# show run boot system
ciscoasa# <BLANK>
ciscoasa# configure terminal
ciscoasa(config)# boot system disk0:/cisco-asa-fp2k.9.16.3.19.SPA
The system is currently installed with security software package 9.16.2.3, which has:
- The platform version: 2.10.1.172
- The CSP (asa) version: 9.16.2.3
Preparing new image for install...
!!!!!!!!!!!
Image download complete (Successful unpack the image).
Installation of version 9.16.3.19 will do the following:
- upgrade to the new platform version 2.10.1.207
- upgrade to the CSP ASA version 9.16.3.19
After installation is complete, ensure to do write memory and reload to save this config and apply the new image.
Finalizing image install process...
Install_status: ready............
Install_status: validating-images.....
Install_status: upgrading-npu
Install_status: upgrading-system
Install_status: update-software-pack-completed
ciscoasa(config)# asdm image disk0:/asdm-7181-152.bin
ciscoasa(config)# end
ciscoasa# write memory
Building configuration...
Cryptochecksum: dc4d65b9 d6d90953 487e762f c145c225
12006 bytes copied in 1.890 secs (12006 bytes/sec)
[OK]
ciscoasa# reload
Proceed with reload? [confirm]
ciscoasa#
***
*** --- START GRACEFUL SHUTDOWN ---
Shutting down Application Agent
Shutting down isakmp
Shutting down webvpn
Shutting down sw-module
Shutting down License Controller
Shutting down File system
***
*** --- SHUTDOWN NOW ---
Process shutdown finished
Rebooting... (status 0x9)
..
lina_monitor pro2022 Dec 11 09:25:15 PMLOG: PM IPC UTILITY: Shutting down all ports
Cisco ASA: CMD=-stop, CSP-ID=cisco-asa.9.16.2.3__asa_001_JMX2630X263NOV0U01, FLAG=''
Cisco ASA stopping ...
Cisco ASA stopped successfully.
Stopping Octeon Serial Logd...
Stopping Octeon Serial Logd... success
Stopping OpenBSD Secure Shell server: sshd
stopped /usr/sbin/sshd (pid 9975)
done.
Stopping Octeon NPU ...
<OUTPUT TRUNCATED>
It took around 9 mins for the upgrade to complete.
Cisco ASA: CMD=-bootup, CSP-ID=cisco-asa.9.16.2.3__asa_001_JMX2630X263NOV0U01, FLAG=''
Cisco ASA booting up ...
INFO:-MspCheck: Configuration Xml found is /opt/cisco/csp/applications/configs/cspCfg_cisco-asa.9.16.2.3__asa_001_JMX2630X263NOV0U01.xml
INFO:
firepower-2120 login: admin (automatic login)
Successful login attempts for user 'admin' : 1
INFO: System Disks /dev/sda is present. Status: Operable. /dev/sdb is present. Status: Inoperable.
Waiting for Application infrastructure to be ready...
Verifying the signature of the Application image...
Please wait for Cisco ASA to come online...1...
Please wait for Cisco ASA to come online...2...
Please wait for Cisco ASA to come online...3...
Please wait for Cisco ASA to come online...4...
Please wait for Cisco ASA to come online...5...
Please wait for Cisco ASA to come online...6...
Please wait for Cisco ASA to come online...7...
Please wait for Cisco ASA to come online...8...
Cisco ASA: CMD=-upgrade, CSP-ID=cisco-asa.9.16.3.19__asa_001_JMX2630X263NOV0U01, FLAG='cisco-asa.9.16.2.3__asa_001_JMX2630X263NOV0U01'
Cisco ASA begins upgrade ...
Please wait for Cisco ASA to come online...9...
Please wait for Cisco ASA to come online...10...
Please wait for Cisco ASA to come online...11...
Please wait for Cisco ASA to come online...12...
Please wait for Cisco ASA to come online...13...
Please wait for Cisco ASA to come online...14...
Verifying signature for cisco-asa.9.16.3.19 ...
Verifying signature for cisco-asa.9.16.3.19 ... success
Please wait for Cisco ASA to come online...15...
Cisco ASA: CMD=-start, CSP-ID=cisco-asa.9.16.3.19__asa_001_JMX2630X263NOV0U01, FLAG=''
Cisco ASA starting ...
Registering to process manager ...
Cisco ASA started successfully.
Please wait for Cisco ASA to come online...16...
Please wait for Cisco ASA to come online...17...
Please wait for Cisco ASA to come online...18...
lina_init_env: memif is not enabled.
System Cores 8 Nodes 1 Max Cores 48
Number of Cores 8
Global Reserve Memory Per Node: 692060160 bytes Nodes=1
LCMB: HEAP-CACHE POOL got 683671552 bytes on numa-id=0, virt=0x0000005555600000
total_reserved_mem = 1073741824
total_heapcache_mem = 683671552
total mem 7168280331 system 7222935552 kernel 54655221 image 0
new 7168280331 old 1073741824 reserve 1757413376 priv new 5465522176 priv old 0
Processor memory: 6908362752
POST started...
POST finished, result is 0 (hint: 1 means it failed)
Cisco Adaptive Security Appliance Software Version 9.16(3)19
Compiled on Wed 03-Aug-22 05:26 GMT by builders
Platform is FPR-2120
Adding Cavium NIC interface 1 port 0
Total NICs found: 5
NIC pci:id 00, slot 0, port 1, bus -1, dev -1 func 0, irq 00, internal, ten_gb-ethernet, ind 1
NIC pci:id 01, slot 0, port -1, bus 0, dev 0 func 0, irq 00, internal, , ind 0
NIC pci:id 02, slot 1, port 1, bus -1, dev -1 func -1, irq 00, internal, gb-ethernet, ind 1
NIC pci:id 03, slot 1, port 1, bus -1, dev -1 func -1, irq 00, external, gb-ethernet, ind 1
NIC pci:id 04, slot 1, port 1, bus -1, dev -1 func -1, irq 00, internal, gb-ethernet, ind 1
en_vtun rev00 Backplane Ext-Mgmt Interface @ index 03 MAC: 3c26.e404.9e81
en_vtun rev00 Backplane Tap Interface @ index 04 MAC: 0000.0100.0001
WARNING: Attribute already exists in the dictionary.
Use software crypto.
The 3DES/AES algorithms require a Encryption-3DES-AES entitlement.
The 3DES/AES algorithms require a Encryption-3DES-AES entitlement.
Cisco Adaptive Security Appliance Software Version 9.16(3)19
****************************** Warning *******************************
This product contains cryptographic features and is
subject to United States and local country laws
governing, import, export, transfer, and use.
Delivery of Cisco cryptographic products does not
imply third-party authority to import, export,
distribute, or use encryption. Importers, exporters,
distributors and users are responsible for compliance
with U.S. and local country laws. By using this
product you agree to comply with applicable laws and
regulations. If you are unable to comply with U.S.
and local laws, return the enclosed items immediately.
A summary of U.S. laws governing Cisco cryptographic
products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by
sending email to export@cisco.com.
******************************* Warning *******************************
Cisco Adaptive Security Appliance Software, version 9.16
Copyright (c) 1996-2022 by Cisco Systems, Inc.
For licenses and notices for open source software used in this product, please visit
http://www.cisco.com/go/asa-opensource
Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706
Reading from flash...
!!!.....
Cryptochecksum (unchanged): dc4d65b9 d6d90953 487e762f c145c225
INFO: Power-On Self-Test in process.
..............
INFO: Power-On Self-Test complete.
INFO: Starting SW-DRBG health test...
INFO: SW-DRBG health test passed.
User enable_1 logged in to ciscoasa
Logins over the last 1 days: 1.
Failed logins since the last login: 0.
Attaching to ASA CLI ... Press 'Ctrl+a then d' to detach.
Type help or '?' for a list of available commands.
ciscoasa> enable
Password: ********
ciscoasa# show version
Cisco Adaptive Security Appliance Software Version 9.16(3)19
SSP Operating System Version 2.10(1.207)
Device Manager Version 7.18(1)152
Compiled on Wed 03-Aug-22 05:26 GMT by builders
System image file is "disk0:/mnt/boot/installables/switch/fxos-k8-fp2k-npu.2.10.1.207.SPA"
Config file at boot was "startup-config"
ciscoasa up 1 min 37 secs
Hardware: FPR-2120, 6588 MB RAM, CPU MIPS 1200 MHz, 1 CPU (8 cores)
1: Int: Internal-Data0/1 : address is 000f.b748.1234, irq 0
3: Int: Not licensed : irq 0
4: Ext: Management1/1 : address is 3c26.e404.5678, irq 0
5: Int: Internal-Data1/1 : address is 0000.0100.0001, irq 0
License mode: Smart Licensing
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 1024
Inside Hosts : Unlimited
Failover : Active/Active
Encryption-DES : Enabled
Encryption-3DES-AES : Disabled
Security Contexts : 2
Carrier : Disabled
AnyConnect Premium Peers : 3500
AnyConnect Essentials : Disabled
Other VPN Peers : 3500
Total VPN Peers : 3500
AnyConnect for Mobile : Enabled
AnyConnect for Cisco VPN Phone : Enabled
Advanced Endpoint Assessment : Enabled
Shared License : Disabled
Total TLS Proxy Sessions : 8000
Cluster : Disabled
Serial Number: JAD26291234
Configuration register is 0x1
Configuration has not been modified since last system restart.
ciscoasa# show asdm ?
history Show contents of Device Manager history buffer
image Show current Device Manager image file
log_sessions Show current Device Manager logging sessions
sessions Show current Device Manager sessions
ciscoasa# show asdm image
Device Manager image file, disk0:/asdm-7181-152.bin
Remove the default ASA config with this command script.
interface Ethernet1/1
no ip address dhcp setroute
interface Ethernet1/2
no ip address
interface Management1/1
no ip address
no dns domain-lookup outside
no object network obj_any
no http 0.0.0.0 0.0.0.0 management
no http 192.168.1.0 255.255.255.0 inside
no dhcpd auto_config outside
no dhcpd address 192.168.1.20-192.168.1.254 inside
no dhcpd enable inside
write memory
ciscoasa# show run
: Saved
:
: Serial Number: JAD26291234
: Hardware: FPR-2120, 6588 MB RAM, CPU MIPS 1200 MHz, 1 CPU (8 cores)
:
ASA Version 9.16(3)19
!
hostname ciscoasa
enable password ***** pbkdf2
service-module 0 keepalive-timeout 4
service-module 0 keepalive-counter 6
names
no mac-address auto
!
interface Ethernet1/1
nameif outside
security-level 0
ip address dhcp setroute
!
interface Ethernet1/2
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Ethernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1/8
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1/9
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1/10
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1/11
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1/12
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1/13
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1/14
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1/15
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1/16
shutdown
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
nameif management
security-level 100
ip address dhcp setroute
!
boot system disk0:/cisco-asa-fp2k.9.16.3.19.SPA
ftp mode passive
dns domain-lookup outside
dns server-group DefaultDNS
name-server 208.67.220.220
name-server 208.67.222.222
object network obj_any
subnet 0.0.0.0 0.0.0.0
pager lines 24
mtu outside 1500
mtu inside 1500
mtu management 1500
no failover
no failover wait-disable
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-7181-152.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 32768
!
object network obj_any
nat (any,outside) dynamic interface
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
http server enable
http 0.0.0.0 0.0.0.0 management
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint _SmartCallHome_ServerCA
no validation-usage
crl configure
crypto ca trustpoint _SmartCallHome_ServerCA2
no validation-usage
crl configure
crypto ca trustpool policy
auto-import
crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca 0a0142800000014523c844b500000002
30820560 30820348 a0030201 0202100a 01428000 00014523 c844b500 00000230
0d06092a 864886f7 0d01010b 0500304a 310b3009 06035504 06130255 53311230
<OUTPUT TRUNCATED>
6b3c1083 c6addea8 cd168e8d f0073771 9ff2abfc 41f5c18b ec00375d 09e54e80
effab15c 3806a51b 4ae1dc38 2d3cdcab 1f901ad5 4a9ceed1 706cccee f457f818
ba846e87
quit
crypto ca certificate chain _SmartCallHome_ServerCA2
certificate ca 0509
308205b7 3082039f a0030201 02020205 09300d06 092a8648 86f70d01 01050500
3045310b 30090603 55040613 02424d31 19301706 0355040a 13105175 6f566164
<OUTPUT TRUNCATED>
b478a53a 874c8d8a a5d54697 f22c10b9 bc5422c0 01506943 9ef4b2ef 6df8ecda
f1e3b1ef df918f54 2a0b25c1 2619c452 100565d5 8210eac2 31cd2e
quit
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group14-sha256
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.20-192.168.1.254 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
profile License
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination transport-method http
Cryptochecksum:dc4d65b9d6d90953487e762fc145c225
: end
