Clean install Firepower module 6.2.3.1 on ASA5506X

Hi folks,

In this post I’m going to show you how to perform a clean install of the Firepower module on an ASA5506X. It is an easy task but takes some time to complete since the box is not as powerful as its bigger brothers.

Start downloading the necessary software elements from the Cisco site:

• asasfr-5500x-boot-6.2.3-4.img
• asasfr-sys-6.2.3-83.pkg
• asdm-792-152.bin
• Cisco_Network_Sensor_Patch-6.2.3.1-43.sh.REL.tar

I included the latest ASDM version to avoid compatibility issues. The ASA is already running the latest ASA version “asa992-lfbff-k8.SPA”

Prior to start the process, I recommend enabling the following debug commands for having full visibility on what’s going on in the background:

debug sfr error
debug sfr events
debug sfr messages
debug cplane
debug module-boot

Start uninstalling the existing Firepower instance running on the ASA:

sw-module module sfr shutdown

Once the module is down uninstall it:

sw-module module sfr uninstall

Ensure the physical management interface has no IP nor security configuration. This interface will act as a bridge between the internal Firepower management and your physical network, so make sure the interface is cabled and connected to the same subnet as your internal ASA subnet.

Copy the Firepower image file to the ASA disk0 using a TFTP client and issue the following command to configure the base image and boot it:

copy tftp://10.14.14.9/asasfr-5500x-boot-6.2.3-4.img disk0:/asasfr-5500x-boot-6.2.3-4.img
sw-module module sfr recover configure image disk0:asasfr-5500x-boot-6.2.3-4.img
sw-module module sfr recover boot

Right after issuing the previous command you’ll start seeing the debug messages generated by the module.

 

Mod-sfr 47> *** EVENT: Disk Image created successfully.
Mod-sfr 48> *** TIME: 15:29:48 CEDT May 20 2018
Mod-sfr 49> ***
Mod-sfr 50> ***
Mod-sfr 51> *** EVENT: Start Parameters: Image: /mnt/disk0/vm/vm_1.img, ISO: -cdrom /mnt/disk0/
Mod-sfr 52> asasfr-5500x-boot-6.2.3-4.img, Num CPUs: 3, RAM: 2249MB, Mgmt MAC: F8:0B:CB:C5:02:A
Mod-sfr 53> D, CP MAC: 00:00:00:02:00:01, HDD: -drive file=/dev/sda,cache=none,if=virtio, Dev D
Mod-sfr 54> ***
Mod-sfr 55> *** EVENT: Start Parameters Continued: RegEx Shared Mem: 0MB, Cmd Op: r, Shared Mem
Mod-sfr 56> Key: 8061, Shared Mem Size: 16, Log Pipe: /dev/ttyS0_vm1, Sock: /dev/ttyS1_vm1, Me
Mod-sfr 57> m-Path: -mem-path /hugepages
Mod-sfr 58> *** TIME: 15:29:48 CEDT May 20 2018
Mod-sfr 59> ***
Mod-sfr 60> Status: Mapping host 0x2aab37e00000 to VM with size 16777216
Mod-sfr 61> Warning: vlan 0 is not connected to host network
Mod-sfr 62> ISOLINUX 3.73 2009-01-25 Copyright (C) 1994-2008 H. Peter Anvin
Mod-sfr 63> Cisco SFR-BOOT-IMAGE and CX-BOOT-IMAGE for SFR - 6.2.3
Mod-sfr 64> (WARNING: ALL DATA ON DISK 1 WILL BE LOST)
Mod-sfr 65> Loading bzImage.............................................................
Mod-sfr 66> Loading initramfs.gz...............................................................
Mod-sfr 67> ...................................................................................
Mod-sfr 68> ...................................................................................
Mod-sfr 69> ...................................................................................
Mod-sfr 70> ...................................................................................
Mod-sfr 71> ...................................................................................
Mod-sfr 72> ...................................................................................
Mod-sfr 73> .................................ready.
Mod-sfr 74> [ 0.000000] Initializing cgroup subsys cpuset
Mod-sfr 75> [ 0.000000] Initializing cgroup subsys cpu
Mod-sfr 76> [ 0.000000] Initializing cgroup subsys cpuacct
Mod-sfr 77> [ 0.000000] Linux version 3.10.107sf.cisco-1 (build@1fd5cd658885) (gcc version 4
Mod-sfr 78> .7.1 (GCC) ) #1 SMP PREEMPT Fri Nov 10 17:06:45 UTC 2017
Mod-sfr 79> [ 0.000000] Command line: initrd=initramfs.gz console=ttyS0,9600 BOOT_IMAGE=bzIm
Mod-sfr 80> age 
Mod-sfr 81> [ 0.000000] e820: BIOS-provided physical RAM map:
Mod-sfr 82> [ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
Mod-sfr 83> [ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
Mod-sfr 84> [ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
Mod-sfr 85> [ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x000000008c8fdfff] usable
Mod-sfr 86> [ 0.000000] BIOS-e820: [mem 0x000000008c8fe000-0x000000008c8fffff] reserved
Mod-sfr 87> [ 0.000000] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved
Mod-sfr 88> [ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
Mod-sfr 89> [ 0.000000] NX (Execute Disable) protection: active
Mod-sfr 90> [ 0.000000] SMBIOS 2.4 present.
Mod-sfr 91> [ 0.000000] Hypervisor detected: KVM
Mod-sfr 92> [ 0.000000] No AGP bridge found
Mod-sfr 93> [ 0.000000] e820: last_pfn = 0x8c8fe max_arch_pfn = 0x400000000
Mod-sfr 94> [ 0.000000] PAT not supported by CPU.
Mod-sfr 95> [ 0.000000] found SMP MP-table at [mem 0x000fdac0-0x000fdacf] mapped at [ffff880
Mod-sfr 96> 0000fdac0]
Mod-sfr 97> [ 0.000000] init_memory_mapping: [mem 0x00000000-0x000fffff]
Mod-sfr 98> [ 0.000000] init_memory_mapping: [mem 0x8c600000-0x8c7fffff]
Mod-sfr 99> [ 0.000000] init_memory_mapping: [mem 0x8c000000-0x8c5fffff]
Mod-sfr 100> [ 0.000000] init_memory_mapping: [mem 0x80000000-0x8bffffff]
Mod-sfr 101> [ 0.000000] init_memory_mapping: [mem 0x00100000-0x7fffffff]
Mod-sfr 102> [ 0.000000] init_memory_mapping: [mem 0x8c800000-0x8c8fdfff]
Mod-sfr 103> [ 0.000000] RAMDISK: [mem 0x7db0b000-0x7fffffff]
Mod-sfr 104> [ 0.000000] ACPI: RSDP 0x00000000000FD900 00014 (v00 BOCHS )
Mod-sfr 105> [ 0.000000] ACPI: RSDT 0x000000008C8FE3E0 00034 (v01 BOCHS BXPCRSDT 00000001 B
Mod-sfr 106> XPC 00000001)
Mod-sfr 107> [ 0.000000] ACPI: FACP 0x000000008C8FFF80 00074 (v01 BOCHS BXPCFACP 00000001 B
Mod-sfr 108> XPC 00000001)
Mod-sfr 109> [ 0.000000] ACPI: DSDT 0x000000008C8FE420 011A9 (v01 BXPC BXDSDT 00000001 I
Mod-sfr 110> NTL 20100528)
Mod-sfr 111> [ 0.000000] ACPI: FACS 0x000000008C8FFF40 00040
Mod-sfr 112> [ 0.000000] ACPI: SSDT 0x000000008C8FF740 007F7 (v01 BOCHS BXPCSSDT 00000001 B
Mod-sfr 113> XPC 00000001)
Mod-sfr 114> [ 0.000000] ACPI: APIC 0x000000008C8FF610 00088 (v01 BOCHS BXPCAPIC 00000001 B
Mod-sfr 115> XPC 00000001)
Mod-sfr 116> [ 0.000000] ACPI: HPET 0x000000008C8FF5D0 00038 (v01 BOCHS BXPCHPET 00000001 B
Mod-sfr 117> XPC 00000001)
Mod-sfr 118> [ 0.000000] No NUMA configuration found
Mod-sfr 119> [ 0.000000] Faking a node at [mem 0x0000000000000000-0x000000008c8fdfff]
Mod-sfr 120> [ 0.000000] Initmem setup node 0 [mem 0x00000000-0x8c8fdfff]
Mod-sfr 121> [ 0.000000] NODE_DATA [mem 0x8c8fa000-0x8c8fdfff]
Mod-sfr 122> [ 0.000000] kvm-clock: Using msrs 4b564d01 and 4b564d00
Mod-sfr 123> [ 0.000000] kvm-clock: cpu 0, msr 0:8c8f9001, boot clock
Mod-sfr 124> [ 0.000000] Zone ranges:
Mod-sfr 125> [ 0.000000] DMA [mem 0x00001000-0x00ffffff]
Mod-sfr 126> [ 0.000000] DMA32 [mem 0x01000000-0xffffffff]
Mod-sfr 127> [ 0.000000] Normal empty
Mod-sfr 128> [ 0.000000] Movable zone start for each node
Mod-sfr 129> [ 0.000000] Early memory node ranges
Mod-sfr 130> [ 0.000000] node 0: [mem 0x00001000-0x0009efff]
Mod-sfr 131> [ 0.000000] node 0: [mem 0x00100000-0x8c8fdfff]
Mod-sfr 132> [ 0.000000] ACPI: PM-Timer IO Port: 0xb008
Mod-sfr 133> [ 0.000000] ACPI: LAPIC (acpi_id[0x00] lapic_id[0x00] enabled)
Mod-sfr 134> [ 0.000000] ACPI: LAPIC (acpi_id[0x01] lapic_id[0x01] enabled)
Mod-sfr 135> [ 0.000000] ACPI: LAPIC (acpi_id[0x02] lapic_id[0x02] enabled)
Mod-sfr 136> [ 0.000000] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1])
Mod-sfr 137> [ 0.000000] ACPI: IOAPIC (id[0x00] address[0xfec00000] gsi_base[0])
Mod-sfr 138> [ 0.000000] IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23
Mod-sfr 139> [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
Mod-sfr 140> [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level)
Mod-sfr 141> [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
Mod-sfr 142> [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level)
Mod-sfr 143> [ 0.000000] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level)
Mod-sfr 144> [ 0.000000] Using ACPI (MADT) for SMP configuration information
Mod-sfr 145> [ 0.000000] ACPI: HPET id: 0x8086a201 base: 0xfed00000
Mod-sfr 146> [ 0.000000] smpboot: Allowing 3 CPUs, 0 hotplug CPUs
Mod-sfr 147> [ 0.000000] e820: [mem 0x8c900000-0xfeffbfff] available for PCI devices
Mod-sfr 148> [ 0.000000] Booting paravirtualized kernel on KVM
Mod-sfr 149> [ 0.000000] setup_percpu: NR_CPUS:64 nr_cpumask_bits:64 nr_cpu_ids:3 nr_node_id
Mod-sfr 150> s:1
Mod-sfr 151> [ 0.000000] PERCPU: Embedded 24 pages/cpu @ffff88008c400000 s68672 r8192 d21440
Mod-sfr 152> u524288
Mod-sfr 153> [ 0.000000] kvm-clock: cpu 0, msr 0:8c8f9001, primary cpu clock
Mod-sfr 154> [ 0.000000] KVM setup async PF for cpu 0
Mod-sfr 155> [ 0.000000] kvm-stealtime: cpu 0, msr 8c40ba40
Mod-sfr 156> [ 0.000000] Built 1 zonelists in Node order, mobility grouping on. Total pages
Mod-sfr 157> : 567751
Mod-sfr 158> [ 0.000000] Policy zone: DMA32
Mod-sfr 159> [ 0.000000] Kernel command line: initrd=initramfs.gz console=ttyS0,9600 BOOT_IM
Mod-sfr 160> AGE=bzImage 
Mod-sfr 161> [ 0.000000] PID hash table entries: 4096 (order: 3, 32768 bytes)
Mod-sfr 162> [ 0.000000] Checking aperture...
Mod-sfr 163> [ 0.000000] No AGP bridge found
Mod-sfr 164> [ 0.000000] Memory: 2222688k/2302968k available (4805k kernel code, 392k absent
Mod-sfr 165> , 79888k reserved, 2414k data, 896k init)
Mod-sfr 166> [ 0.000000] Preemptible hierarchical RCU implementation.
Mod-sfr 167> [ 0.000000] RCU restricting CPUs from NR_CPUS=64 to nr_cpu_ids=3.
Mod-sfr 168> [ 0.000000] NR_IRQS:4352 nr_irqs:704 16
Mod-sfr 169> [ 0.000000] Console: colour VGA+ 80x25
Mod-sfr 170> [ 0.000000] console [ttyS0] enabled
Mod-sfr 171> [ 0.000000] allocated 9437184 bytes of page_cgroup
Mod-sfr 172> [ 0.000000] please try 'cgroup_disable=memory' option if you don't want memory 
Mod-sfr 173> cgroups
Mod-sfr 174> [ 0.000000] tsc: Detected 1249.999 MHz processor
Mod-sfr 175> [ 0.003000] Calibrating delay loop (skipped) preset value.. 2499.99 BogoMIPS (l
Mod-sfr 176> pj=1249999)
Mod-sfr 177> [ 0.004020] pid_max: default: 32768 minimum: 301
Mod-sfr 178> [ 0.005147] Security Framework initialized
Mod-sfr 179> [ 0.008819] Dentry cache hash table entries: 524288 (order: 10, 4194304 bytes)
Mod-sfr 180> [ 0.015037] Inode-cache hash table entries: 262144 (order: 9, 2097152 bytes)
Mod-sfr 181> [ 0.018310] Mount-cache hash table entries: 256
Mod-sfr 182> [ 0.020469] Initializing cgroup subsys memory
Mod-sfr 183> [ 0.022252] Last level iTLB entries: 4KB 0, 2MB 0, 4MB 0
Mod-sfr 184> [ 0.022252] Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0
Mod-sfr 185> [ 0.022252] tlb_flushall_shift: 6
Mod-sfr 186> [ 0.024066] Freeing SMP alternatives: 12k freed
Mod-sfr 187> [ 0.028639] ACPI: Core revision 20130328
Mod-sfr 188> [ 0.034332] ACPI: All ACPI Tables successfully acquired
Mod-sfr 189> [ 0.041689] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1
Mod-sfr 190> [ 0.042012] smpboot: CPU0: Intel QEMU Virtual CPU version 1.5.0 (fam: 06, model
Mod-sfr 191> : 02, stepping: 03)
Mod-sfr 192> [ 0.047000] Performance Events: unsupported p6 CPU model 2 no PMU driver, softw
Mod-sfr 193> are events only.
Mod-sfr 194> [ 0.054338] smpboot: Booting Node 0, Processors #1[ 0.003000] kvm-clock: 
Mod-sfr 195> cpu 1, msr 0:8c8f9041, secondary cpu clock
Mod-sfr 196> [ 0.071099] KVM setup async PF for cpu 1
Mod-sfr 197> #2 OK
Mod-sfr 198> [ 0.071099] kvm-stealtime: cpu 1, msr 8c48ba40
Mod-sfr 199> [ 0.003000] kvm-clock: cpu 2, msr 0:8c8f9081, secondary cpu clock
Mod-sfr 200> [ 0.090155] Brought up 3 CPUs
Mod-sfr 201> [ 0.090085] KVM setup async PF for cpu 2
Mod-sfr 202> [ 0.090085] kvm-stealtime: cpu 2, msr 8c50ba40
Mod-sfr 203> [ 0.091013] smpboot: Total of 3 processors activated (7499.99 BogoMIPS)
Mod-sfr 204> [ 0.094766] devtmpfs: initialized
Mod-sfr 205> [ 0.097104] NET: Registered protocol family 16
Mod-sfr 206> [ 0.101704] ACPI: bus type PCI registered
Mod-sfr 207> [ 0.104502] PCI: Using configuration type 1 for base access
Mod-sfr 208> [ 0.154126] bio: create slab <bio-0> at 0
Mod-sfr 209> [ 0.158123] ACPI: Added _OSI(Module Device)
Mod-sfr 210> [ 0.159016] ACPI: Added _OSI(Processor Device)
Mod-sfr 211> [ 0.160000] ACPI: Added _OSI(3.0 _SCP Extensions)
Mod-sfr 212> [ 0.160000] ACPI: Added _OSI(Processor Aggregator Device)
Mod-sfr 213> [ 0.168850] ACPI: Interpreter enabled
Mod-sfr 214> [ 0.169027] ACPI: (supports S0 S5)
Mod-sfr 215> [ 0.170000] ACPI: Using IOAPIC for interrupt routing
Mod-sfr 216> [ 0.170257] PCI: Using host bridge windows from ACPI; if necessary, use "pci=no
Mod-sfr 217> crs" and report a bug
Mod-sfr 218> [ 0.172688] ACPI: No dock devices found.
Mod-sfr 219> [ 0.203713] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff])
Mod-sfr 220> [ 0.204030] acpi PNP0A03:00: ACPI _OSC support notification failed, disabling P
Mod-sfr 221> CIe ASPM
Mod-sfr 222> [ 0.205000] acpi PNP0A03:00: Unable to request _OSC control (_OSC support mask:
Mod-sfr 223> 0x08)
Mod-sfr 224> [ 0.205469] acpi PNP0A03:00: fail to add MMCONFIG information, can't access ext
Mod-sfr 225> ended PCI configuration space under this bridge.
Mod-sfr 226> [ 0.208169] PCI host bridge to bus 0000:00
Mod-sfr 227> [ 0.209019] pci_bus 0000:00: root bus resource [bus 00-ff]
Mod-sfr 228> [ 0.210000] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7]
Mod-sfr 229> [ 0.210000] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff]
Mod-sfr 230> [ 0.210000] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff]
Mod-sfr 231> [ 0.211016] pci_bus 0000:00: root bus resource [mem 0xc0000000-0xfebfffff]
Mod-sfr 232> [ 0.230881] pci 0000:00:01.3: quirk: [io 0xb000-0xb03f] claimed by PIIX4 ACPI
Mod-sfr 233> [ 0.231056] pci 0000:00:01.3: quirk: [io 0xb100-0xb10f] claimed by PIIX4 SMB
Mod-sfr 234> [ 0.335431] ACPI: PCI Interrupt Link [LNKA] (IRQs 5 *10 11)
Mod-sfr 235> [ 0.338885] ACPI: PCI Interrupt Link [LNKB] (IRQs 5 *10 11)
Mod-sfr 236> [ 0.340000] ACPI: PCI Interrupt Link [LNKC] (IRQs 5 10 *11)
Mod-sfr 237> [ 0.340000] ACPI: PCI Interrupt Link [LNKD] (IRQs 5 10 *11)
Mod-sfr 238> [ 0.342880] ACPI: PCI Interrupt Link [LNKS] (IRQs *9)
Mod-sfr 239> [ 0.345920] ACPI: Enabled 16 GPEs in block 00 to 0F
Mod-sfr 240> [ 0.348990] vgaarb: device added: PCI:0000:00:02.0,decodes=io+mem,owns=io+mem,l
Mod-sfr 241> ocks=none
Mod-sfr 242> [ 0.349016] vgaarb: loaded
Mod-sfr 243> [ 0.350000] vgaarb: bridge control possible 0000:00:02.0
Mod-sfr 244> [ 0.351938] SCSI subsystem initialized
Mod-sfr 245> [ 0.352014] ACPI: bus type ATA registered
Mod-sfr 246> [ 0.356711] ACPI: bus type USB registered
Mod-sfr 247> [ 0.359190] usbcore: registered new interface driver usbfs
Mod-sfr 248> [ 0.362124] usbcore: registered new interface driver hub
Mod-sfr 249> [ 0.365145] usbcore: registered new device driver usb
Mod-sfr 250> [ 0.368692] pps_core: LinuxPPS API ver. 1 registered
Mod-sfr 251> [ 0.370009] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giomett
Mod-sfr 252> i <giometti@linux.it>
Mod-sfr 253> [ 0.372220] PTP clock support registered
Mod-sfr 254> [ 0.374342] PCI: Using ACPI for IRQ routing
Mod-sfr 255> [ 0.377796] NetLabel: Initializing
Mod-sfr 256> [ 0.378011] NetLabel: domain hash size = 128
Mod-sfr 257> [ 0.379000] NetLabel: protocols = UNLABELED CIPSOv4
Mod-sfr 258> [ 0.379000] NetLabel: unlabeled traffic allowed by default
Mod-sfr 259> [ 0.379000] HPET: 3 timers in total, 0 timers will be used for per-cpu timer
Mod-sfr 260> [ 0.379000] hpet0: at MMIO 0xfed00000, IRQs 2, 8, 0
Mod-sfr 261> [ 0.379000] hpet0: 3 comparators, 64-bit 100.000000 MHz counter
Mod-sfr 262> [ 0.385411] amd_nb: Cannot enumerate AMD northbridges
Mod-sfr 263> [ 0.387012] Switching to clocksource kvm-clock
Mod-sfr 264> [ 0.390595] pnp: PnP ACPI init
Mod-sfr 265> [ 0.392135] ACPI: bus type PNP registered
Mod-sfr 266> [ 0.398878] pnp: PnP ACPI: found 8 devices
Mod-sfr 267> [ 0.400876] ACPI: bus type PNP unregistered
Mod-sfr 268> [ 0.444344] NET: Registered protocol family 2
Mod-sfr 269> [ 0.447550] TCP established hash table entries: 32768 (order: 7, 524288 bytes)
Mod-sfr 270> [ 0.452147] TCP bind hash table entries: 32768 (order: 7, 524288 bytes)
Mod-sfr 271> [ 0.455530] TCP: Hash tables configured (established 32768 bind 32768)
Mod-sfr 272> [ 0.458687] TCP: reno registered
Mod-sfr 273> [ 0.460276] UDP hash table entries: 2048 (order: 4, 65536 bytes)
Mod-sfr 274> [ 0.463125] UDP-Lite hash table entries: 2048 (order: 4, 65536 bytes)
Mod-sfr 275> [ 0.466489] NET: Registered protocol family 1
Mod-sfr 276> [ 0.469201] RPC: Registered named UNIX socket transport module.
Mod-sfr 277> [ 0.471972] RPC: Registered udp transport module.
Mod-sfr 278> [ 0.474201] RPC: Registered tcp transport module.
Mod-sfr 279> [ 0.476426] RPC: Registered tcp NFSv4.1 backchannel transport module.
Mod-sfr 280> [ 0.479414] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
Mod-sfr 281> [ 0.482206] pci 0000:00:01.0: PIIX3: Enabling Passive Release
Mod-sfr 282> [ 0.484938] pci 0000:00:01.0: Activating ISA DMA hang workarounds
Mod-sfr 283> [ 0.488320] Trying to unpack rootfs image as initramfs...
Mod-sfr 284> [ 2.723443] Freeing initrd memory: 37844k freed
Mod-sfr 285> [ 2.749608] microcode: CPU0 sig=0x623, pf=0x0, revision=0x1
Mod-sfr 286> [ 2.752302] microcode: CPU1 sig=0x623, pf=0x0, revision=0x1
Mod-sfr 287> [ 2.754941] microcode: CPU2 sig=0x623, pf=0x0, revision=0x1
Mod-sfr 288> [ 2.757965] microcode: Microcode Update Driver: v2.00 <tigran@aivazian.fsnet.co
Mod-sfr 289> .uk>, Peter Oruba
Mod-sfr 290> [ 2.765177] HugeTLB registered 2 MB page size, pre-allocated 0 pages
Mod-sfr 291> [ 2.769086] VFS: Disk quotas dquot_6.5.2
Mod-sfr 292> [ 2.771094] Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
Mod-sfr 293> [ 2.775717] NFS: Registering the id_resolver key type
Mod-sfr 294> [ 2.778137] Key type id_resolver registered
Mod-sfr 295> [ 2.780109] Key type id_legacy registered
Mod-sfr 296> [ 2.782541] msgmni has been set to 4415
Mod-sfr 297> [ 2.787083] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251
Mod-sfr 298> [ 2.790547] io scheduler noop registered
Mod-sfr 299> [ 2.792411] io scheduler deadline registered
Mod-sfr 300> [ 2.794583] io scheduler cfq registered (default)
Mod-sfr 301> [ 2.799982] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input
Mod-sfr 302> [ 2.803425] ACPI: Power Button [PWRF]
Mod-sfr 303> [ 2.814473] ACPI: PCI Interrupt Link [LNKD] enabled at IRQ 11
Mod-sfr 304> [ 2.820727] ACPI: PCI Interrupt Link [LNKA] enabled at IRQ 10
Mod-sfr 305> [ 2.827646] ACPI: PCI Interrupt Link [LNKC] enabled at IRQ 11
Mod-sfr 306> [ 2.836584] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
Mod-sfr 307> [ 2.867594] 00:05: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A
Mod-sfr 308> [ 2.898649] 00:06: ttyS1 at I/O 0x2f8 (irq = 3) is a 16550A
Mod-sfr 309> [ 2.905482] Non-volatile memory driver v1.3
Mod-sfr 310> [ 2.907484] Linux agpgart interface v0.103
Mod-sfr 311> [ 2.910796] [drm] Initialized drm 1.1.0 20060810
Mod-sfr 312> [ 2.914401] Floppy drive(s): fd0 is 1.44M, fd1 is 1.44M
Mod-sfr 313> [ 2.926135] brd: module loaded
Mod-sfr 314> [ 2.929550] FDC 0 is a S82078B
Mod-sfr 315> [ 2.935196] loop: module loaded
Mod-sfr 316> [ 2.942913] vda: vda1 vda2 vda3 < vda5 vda6 vda7 >
Mod-sfr 317> [ 2.953346] Loading iSCSI transport class v2.0-870.
Mod-sfr 318> [ 2.967716] scsi0 : ata_piix
Mod-sfr 319> [ 2.970113] scsi1 : ata_piix
Mod-sfr 320> [ 2.972137] ata1: PATA max MWDMA2 cmd 0x1f0 ctl 0x3f6 bmdma 0xc0c0 irq 14
Mod-sfr 321> [ 2.975261] ata2: PATA max MWDMA2 cmd 0x170 ctl 0x376 bmdma 0xc0c8 irq 15
Mod-sfr 322> [ 2.979356] e100: Intel(R) PRO/100 Network Driver, 3.5.24-k2-NAPI
Mod-sfr 323> [ 2.982310] e100: Copyright(c) 1999-2006 Intel Corporation
Mod-sfr 324> [ 2.985143] igb: Intel(R) Gigabit Ethernet Network Driver - version 5.0.3-k
Mod-sfr 325> [ 2.988322] igb: Copyright (c) 2007-2013 Intel Corporation.
Mod-sfr 326> [ 2.991156] Fusion MPT base driver 3.04.20
Mod-sfr 327> [ 2.993110] Copyright (c) 1999-2008 LSI Corporation
Mod-sfr 328> [ 2.995395] Fusion MPT SPI Host driver 3.04.20
Mod-sfr 329> [ 2.997698] Fusion MPT FC Host driver 3.04.20
Mod-sfr 330> [ 2.999955] Fusion MPT SAS Host driver 3.04.20
Mod-sfr 331> [ 3.002879] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
Mod-sfr 332> [ 3.005921] ehci-pci: EHCI PCI platform driver
Mod-sfr 333> [ 3.008262] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
Mod-sfr 334> [ 3.011311] uhci_hcd: USB Universal Host Controller Interface driver
Mod-sfr 335> [ 3.014712] usbcore: registered new interface driver usblp
Mod-sfr 336> [ 3.017515] usbcore: registered new interface driver usb-storage
Mod-sfr 337> [ 3.020703] i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 
Mod-sfr 338> irq 1,12
Mod-sfr 339> [ 3.026754] serio: i8042 KBD port at 0x60,0x64 irq 1
Mod-sfr 340> [ 3.029233] serio: i8042 AUX port at 0x60,0x64 irq 12
Mod-sfr 341> [ 3.032605] mousedev: PS/2 mouse device common for all mice
Mod-sfr 342> [ 3.037709] input: AT Translated Set 2 keyboard as /devices/platform/i8042/seri
Mod-sfr 343> o0/input/input1
Mod-sfr 344> [ 3.041708] rtc_cmos 00:00: RTC can wake from S4
Mod-sfr 345> [ 3.046060] rtc_cmos 00:00: rtc core: registered rtc_cmos as rtc0
Mod-sfr 346> [ 3.049610] rtc_cmos 00:00: alarms up to one day, 114 bytes nvram, hpet irqs
Mod-sfr 347> [ 3.053361] i2c /dev entries driver
Mod-sfr 348> [ 3.055862] md: raid1 personality registered for level 1
Mod-sfr 349> [ 3.059498] device-mapper: ioctl: 4.24.0-ioctl (2013-01-15) initialised: dm-dev
Mod-sfr 350> el@redhat.com
Mod-sfr 351> [ 3.063392] cpuidle: using governor ladder
Mod-sfr 352> [ 3.066870] hidraw: raw HID events driver (C) Jiri Kosina
Mod-sfr 353> [ 3.078644] usbcore: registered new interface driver usbhid
Mod-sfr 354> [ 3.081393] usbhid: USB HID core driver
Mod-sfr 355> [ 3.083396] ipip: IPv4 over IPv4 tunneling driver
Mod-sfr 356> [ 3.086821] TCP: cubic registered
Mod-sfr 357> [ 3.088440] Initializing XFRM netlink socket
Mod-sfr 358> [ 3.090764] NET: Registered protocol family 10
Mod-sfr 359> [ 3.093706] NET: Registered protocol family 17
Mod-sfr 360> [ 3.095867] Key type dns_resolver registered
Mod-sfr 361> [ 3.099358] registered taskstats version 1
Mod-sfr 362> [ 3.102539] console [netcon0] enabled
Mod-sfr 363> [ 3.104270] netconsole: network logging started
Mod-sfr 364> [ 3.133367] ata1.00: ATA-7: QEMU HARDDISK, 1.5.0, max UDMA/100
Mod-sfr 365> [ 3.136133] ata1.00: 6291456 sectors, multi 16: LBA48 
Mod-sfr 366> [ 3.139781] ata1.00: configured for MWDMA2
Mod-sfr 367> [ 3.141785] ata2.00: ATAPI: QEMU DVD-ROM, 1.5.0, max UDMA/100
Mod-sfr 368> [ 3.141986] scsi 0:0:0:0: Direct-Access ATA QEMU HARDDISK 1.5. PQ: 
Mod-sfr 369> 0 ANSI: 5
Mod-sfr 370> [ 3.142888] sd 0:0:0:0: [sda] 6291456 512-byte logical blocks: (3.22 GB/3.00 Gi
Mod-sfr 371> B)
Mod-sfr 372> [ 3.143172] sd 0:0:0:0: [sda] Write Protect is off
Mod-sfr 373> [ 3.143255] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn'
Mod-sfr 374> t support DPO or FUA
Mod-sfr 375> [ 3.159184] ata2.00: configured for MWDMA2
Mod-sfr 376> [ 3.160908] sd 0:0:0:0: Attached scsi generic sg0 type 0
Mod-sfr 377> [ 3.162451] sda: unknown partition table
Mod-sfr 378> [ 3.163325] sd 0:0:0:0: [sda] Attached SCSI disk
Mod-sfr 379> [ 3.169427] scsi 1:0:0:0: CD-ROM QEMU QEMU DVD-ROM 1.5. PQ: 
Mod-sfr 380> 0 ANSI: 5
Mod-sfr 381> [ 3.174796] sr0: scsi3-mmc drive: 4x/4x cd/rw xa/form2 tray
Mod-sfr 382> [ 3.177394] cdrom: Uniform CD-ROM driver Revision: 3.20
Mod-sfr 383> [ 3.182413] sr 1:0:0:0: Attached scsi generic sg1 type 5
Mod-sfr 384> [ 3.185770] Freeing unused kernel memory: 896k freed
Mod-sfr 385> INIT: version 2.86 booting
Mod-sfr 386> Please wait: booting...
Mod-sfr 387> mount: sysfs already mounted or /sys busy
Mod-sfr 388> mount: according to mtab, sysfs is already mounted on /sys
Mod-sfr 389> Starting udev [ 3.478938] udevd (765): /proc/765/oom_adj is deprecated, please 
Mod-sfr 390> use /proc/765/oom_score_adj instead.
Mod-sfr 391> [ 3.483265] udevd version 124 started
Mod-sfr 392> [ 3.681920] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/s
Mod-sfr 393> erio1/input/input2
Mod-sfr 394> [ 3.747189] tsc: Refined TSC clocksource calibration: 1249.999 MHz

cp_connect: Error - cp_connect() returned -1
cp_check_connection: handle -1, conflicts with connection 1 (-1)
cp_check_connection: handle -1, conflicts with connection 2 (-1)
cp_check_connection: handle -1, conflicts with connection 3 (-1)
cp_update_connection: Error updating connection_id 0Mod-sfr 395> [ 4.478112] end_request: I/O error, dev fd0, sector 0
Mod-sfr 396> [ 4.501112] end_request: I/O error, dev fd0, sector 0
Mod-sfr 397> and populating dev cache 
Mod-sfr 398> Root filesystem already rw, not remounting
Mod-sfr 399> Configuring network interfaces... done.
Mod-sfr 400> net.ipv4.conf.default.rp_filter = 1
Mod-sfr 401> net.ipv4.conf.all.rp_filter = 1
Mod-sfr 402> Configuring kvm-ivshmem
Mod-sfr 403> Configuring busybox-syslog
Mod-sfr 404> System startup links for /etc/init.d/sysklogd already exist.
Mod-sfr 405> Configuring openssh-sshd
Mod-sfr 406> Adding system startup for /etc/init.d/sshd.
Mod-sfr 407> Configuring sudo
Mod-sfr 408> Configuring ntpdate
Mod-sfr 409> adding crontab
Mod-sfr 410> Configuring update-modules
Mod-sfr 411> INIT: Entering runlevel: 5
Mod-sfr 412> Starting OpenBSD Secure Shell server: sshd
Mod-sfr 413> generating ssh RSA key...
Mod-sfr 414> generating ssh DSA key...
Mod-sfr 415> done.
Mod-sfr 416> Starting Advanced Configuration and Power Interface daemon: acpid.
Mod-sfr 417> acpid: starting up with proc fs
Mod-sfr 418> acpid: opendir(/etc/acpi/events): No such file or directory
Mod-sfr 419> starting Busybox inetd: inetd... done.
Mod-sfr 420> Starting ntpd: done
Mod-sfr 421> Starting syslogd/klogd: done
Mod-sfr 422> Cisco FirePOWER Services Boot Image 6.2.3

Last line informs that the module has been configured and you can connect using the console for the initial network setup. Default Firepower module credentials are “admin/Admin123″. At this stage remember to configure the module with an IP address in the same subnet than your internal network. You will need reachability between your management computer and the Firepower module.

session sfr console

Now download and install the Firepower package using a FTP client this time instead of TFTP. Make sure you have connected your ASA management interface to the same VLAN where the FTP server is running. Issue a ping for double check. Review local OS firewall if necessary.

Run the command system install ftp://10.14.14.9/asasfr-sys-6.2.3-83.pkg (replace with your FTP client IP) and the Firepower package will be downloaded into the box and installed. At the end of the process you will have to reboot the module only. It does not affect to the normal ASA function.

Now it’s time to be patient. The process can take up to 45 min. Once the process is finished you’ll see the Firepower module ready again. Issue the command show module sfr to review the status:

 

Ok, so far we have the major version installed, let’s apply the latest patch available. For this task we will leverage ASDM. Upload the previously downloaded patch to the module using the Firepower update section:

Now click on “Install” and wait for almost 1 hour to run the script until the module is availabile again. You can review the progress on the tasks pop-up:

 

After a while our Firepower module is up and running again fully updated!

On my next post I’ll show how to perform a patch upgrade and how to recover the module from a stuck-in-recovery status.