Cisco Asa 55 series Quick start guide

Cisco ASA and Firepower Threat Defense

Reimage Guide

Cisco ASA and Firepower Threat Defense Reimage Guide

This guide describes how to reimage between ASA and Firepower Threat Defense (FTD), and also how to

perform a reimage for FTD using a new image version; this method is distinct from an upgrade, and sets the

FTD to a factory default state. For ASA reimaging, see the ASA general operations configuration guide, where

you can use multiple methods to reimage the ASA.

Supported Models

The following models support either ASA software or Firepower Threat Defense Software. For ASA and

Firepower Threat Defense version support, see the ASA compatibility guide or Firepower compatibility guide.

• ASA 5506-X

• ASA 5506W-X

• ASA 5506H-X

• ASA 5508-X

• ASA 5512-X

• ASA 5515-X

• ASA 5516-X

• ASA 5525-X

• ASA 5545-X

• ASA 5555-X

• ISA 3000

• Firepower 2100

The Firepower 4100 and 9300 also support either the ASA or Firepower Threat Defense, but they are installed

as logical devices; see the FXOS configuration guides for more information.

Note

Cisco ASA and Firepower Threat Defense Reimage Guide

For the Firepower Threat Defense on the ASA 5512-X through 5555-X, you must install a Cisco solid state

drive (SSD). For more information, see the ASA 5500-X hardware guide. For the ASA, the SSD is also

required to use the ASA FirePOWER module. (The SSD is standard on the ASA 5506-X, 5508-X, and 5516-X.)

Note

Reimage the ASA 5500-X or ISA 3000

Many models in the ASA 5500-X or ISA 3000 series support either Firepower Threat Defense or ASA software.

•Supported Models, on page 1

•Download Software, on page 2

•Upgrade the ROMMON Image (ASA 5506-X, 5508-X, and 5516-X), on page 5

•Reimage from ASA to Firepower Threat Defense, on page 6

•Reimage from Firepower Threat Defense to ASA, on page 13

Console Port Access Required

To perform the reimage, you must connect your computer to the console port.

For the ASA 5512-X, 5515-X, 5525-X, 5545-X, and 5555-X, you might need to use a third party serial-to-USB

cable to make the connection. Other models include a Mini USB Type B console port, so you can use any

mini USB cable. For Windows, you may need to install a USB-serial driver from software.cisco.com. See the

hardware guide for more information about console port options and driver requirements:

http://www.cisco.com/go/asa5500x-install

Use a terminal emulator set for 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.

Download Software

Obtain Firepower Threat Defense software, or ASA, ASDM, and ASA FirePOWER module software. The

procedures in this document require you to put software on a TFTP server for the initial download. Other

images can be downloaded from other server types, such as HTTP or FTP. For the exact software package

and server type, see the procedures.

A Cisco.com login and Cisco service contract are required.

Note

The Firepower Threat Defense boot image and system package are version-specific and model-specific. Verify

that you have the correct boot image and system package for your platform. A mismatch between the boot

image and system package can cause boot failure. A mismatch would be using an older boot image with a

newer system package.

Attention

Cisco ASA and Firepower Threat Defense Reimage Guide

Reimage the ASA 5500-X or ISA 3000

Table 1: Firepower Threat Defense Software

PackagesDownload Location

Firepower Threat

Defense Model

You will also see patch files

ending in .sh; the patch

upgrade process is not

covered in this document.

Note

See:

http://www.cisco.com/go/asa-firepower-sw.

ASA 5506-X, ASA

5508-X, and ASA

5516-X

The boot image has a filename like

ftd-boot-9.6.2.0.lfbff.

Boot image

Choose your model >Firepower Threat

Defense Software >version.

The system software install package has

a filename like ftd-6.1.0-330.pkg.

System software install package

Choose your model >Firepower Threat

Defense Software >version.

You will also see patch files

ending in .sh; the patch

upgrade process is not

covered in this document.

Note

See:

http://www.cisco.com/go/asa-firepower-sw.

ASA 5512-X through

ASA 5555-X

The boot image has a filename like

ftd-boot-9.6.2.0.cdisk.

Boot image

Choose your model >Firepower Threat

Defense Software >version.

The system software install package has

a filename like ftd-6.1.0-330.pkg.

System software install package

Choose your model >Firepower Threat

Defense Software >version.

You will also see patch files

ending in .sh; the patch

upgrade process is not

covered in this document.

Note

See: http://www.cisco.com/go/

isa3000-software

ISA 3000

The boot image has a filename like

ftd-boot-9.9.2.0.lfbff.

Boot image

Choose your model >Firepower Threat

Defense Software >version.

The system software install package has

a filename like ftd-6.2.3-330.pkg.

System software install package

Choose your model >Firepower Threat

Defense Software >version.

Cisco ASA and Firepower Threat Defense Reimage Guide

Download Software

Table 2: ASA Software

PackagesDownload LocationASA Model

http://www.cisco.com/go/asa-firepower-swASA 5506-X, ASA 5508-X,

and ASA 5516-X

The ASA software file has a filename like

asa962-lfbff-k8.SPA.

ASA Software

Choose your model >Adaptive Security Appliance

(ASA) Software >version.

The ASDM software file has a filename like

asdm-762.bin.

ASDM Software

Choose your model >Adaptive Security Appliance

(ASA) Device Manager >version.

The API software file has a filename like

asa-restapi-132-lfbff-k8.SPA. To install the

REST API, see the API quick start guide

REST API Software

Choose your model >Adaptive Security Appliance

REST API Plugin >version.

The ROMMON software file has a filename like

asa5500-firmware-1108.SPA.

ROMMON Software

Choose your model >ASA Rommon Software >

version.

http://www.cisco.com/go/asa-softwareASA 5512-X through ASA

5555-X

The ASA software file has a filename like

asa962-smp-k8.bin.

ASA Software

Choose your model >Software on Chassis >

Adaptive Security Appliance (ASA) Software >

version.

The ASDM software file has a filename like

asdm-762.bin.

ASDM Software

Choose your model >Software on Chassis >

Adaptive Security Appliance (ASA) Device

Manager >version.

The API software file has a filename like

asa-restapi-132-lfbff-k8.SPA. To install the

REST API, see the API quick start guide

REST API Software

Choose your model >Software on Chassis >

Adaptive Security Appliance REST API Plugin

>version.

For APIC 1.2(7) and later, choose either the

Policy Orchestration with Fabric Insertion, or

the Fabric Insertion-only package. The device

package software file has a filename like

asa-device-pkg-1.2.7.10.zip. To install the ASA

device package, see the “Importing a Device

Package” chapter of the Cisco APIC Layer 4 to

Layer 7 Services Deployment Guide.

ASA Device Package for Cisco Application Policy

Infrastructure Controller (APIC)

Choose your model >Software on Chassis >ASA

for Application Centric Infrastructure (ACI)

Device Packages >version.

Cisco ASA and Firepower Threat Defense Reimage Guide

Download Software

PackagesDownload LocationASA Model

http://www.cisco.com/go/isa3000-softwareISA 3000

The ASA software file has a filename like

asa962-lfbff-k8.SPA.

ASA Software

Choose your model >Adaptive Security Appliance

(ASA) Software >version.

The ASDM software file has a filename like

asdm-762.bin.

ASDM Software

Choose your model >Adaptive Security Appliance

(ASA) Device Manager >version.

The API software file has a filename like

asa-restapi-132-lfbff-k8.SPA. To install the

REST API, see the API quick start guide.

REST API Software

Choose your model >Adaptive Security Appliance

REST API Plugin >version.

Upgrade the ROMMON Image (ASA 5506-X, 5508-X, and 5516-X)

Follow these steps to upgrade the ROMMON image for the ASA 5506-X series, ASA 5508-X, and ASA

5516-X. The ROMMON version on your system must be 1.1.8 or greater.

You cannot upgrade the ROMMON image after you reimage to Firepower Threat Defense.

Note

Before you begin

You can only upgrade to a new version; you cannot downgrade. To see your current version, enter the show

module command and look at the Fw Version in the output for Mod 1 in the MAC Address Range table:

ciscoasa# show module

[...]

Mod MAC Address Range Hw Version Fw Version Sw Version

---- --------------------------------- ------------ ------------ ---------------

1 7426.aceb.ccea to 7426.aceb.ccf2 0.3 1.1.5 9.4(1)

sfr 7426.aceb.cce9 to 7426.aceb.cce9 N/A N/A

Procedure

Step 1 Obtain the new ROMMON image from Cisco.com, and put it on a server to copy to the ASA. This procedure

shows a TFTP copy.

Download the image from:

https://software.cisco.com/download/type.html?mdfid=286283326&flowid=77251

Step 2 Copy the ROMMON image to the ASA flash memory:

copy tftp://server_ip/asa5500-firmware-xxxx.SPA disk0:asa5500-firmware-xxxx.SPA

Cisco ASA and Firepower Threat Defense Reimage Guide

Upgrade the ROMMON Image (ASA 5506-X, 5508-X, and 5516-X)

Step 3 Upgrade the ROMMON image:

upgrade rommon disk0:asa5500-firmware-xxxx.SPA

Example:

ciscoasa# upgrade rommon disk0:asa5500-firmware-1108.SPA

Verifying file integrity of disk0:/asa5500-firmware-1108.SPA

Computed Hash SHA2: d824bdeecee1308fc64427367fa559e9

eefe8f182491652ee4c05e6e751f7a4f

5cdea28540cf60acde3ab9b65ff55a9f

4e0cfb84b9e2317a856580576612f4af

Embedded Hash SHA2: d824bdeecee1308fc64427367fa559e9

eefe8f182491652ee4c05e6e751f7a4f

5cdea28540cf60acde3ab9b65ff55a9f

4e0cfb84b9e2317a856580576612f4af

Digital signature successfully validated

File Name : disk0:/asa5500-firmware-1108.SPA

Image type : Release

Signer Information

Common Name : abraxas

Organization Unit : NCS_Kenton_ASA

Organization Name : CiscoSystems

Certificate Serial Number : 553156F4

Hash Algorithm : SHA2 512

Signature Algorithm : 2048-bit RSA

Key Version : A

Verification successful.

Proceed with reload? [confirm]

Step 4 Confirm to reload the ASA when you are prompted.

The ASA upgrades the ROMMON image, and then reloads the ASA OS.

Reimage from ASA to Firepower Threat Defense

To reimage the ASA to FTD software, you must access the ROMMON prompt. In ROMMON, you must use

TFTP on the Management interface to download the FTD boot image; only TFTP is supported. The boot

image can then download the FTD system software install package using HTTP or FTP. The TFTP download

can take a long time; ensure that you have a stable connection between the ASA and the TFTP server to avoid

packet loss.

Before you begin

To ease the process of reimaging back to an ASA, do the following:

1. Perform a complete system backup using the backup command.

See the configuration guide for more information, and other backup techniques.

2. Copy and save the current activation key(s) so you can reinstall your licenses using the show activation-key

command.

Cisco ASA and Firepower Threat Defense Reimage Guide

Reimage from ASA to Firepower Threat Defense

3. For the ISA 3000, disable hardware bypass when using the Firepower Management Center; this feature

is only available using Firepower Device Manager in version 6.3 and later.

Procedure

Step 1 Download the FTD boot image (see Download Software, on page 2) to a TFTP server accessible by the

ASA on the Management interface.

For the ASA 5506-X, 5508-X, 5516-X, ISA 3000: You must use the Management 1/1 port to download the

image. For the other models, you can use any interface.

Step 2 Download the FTD system software install package (see Download Software, on page 2) to an HTTP or

FTP server accessible by the ASA on the Management interface.

Step 3 From the console port, reload the ASA:

reload

Example:

ciscoasa# reload

Step 4 Press Esc during the bootup when prompted to reach the ROMMON prompt.

Pay close attention to the monitor.

Example:

[...]

Booting from ROMMON

Cisco Systems ROMMON Version (2.1(9)8) #1: Wed Oct 26 17:14:40 PDT 2011

Platform ASA 5555-X with SW, 8 GE Data, 1 GE Mgmt

Use BREAK or ESC to interrupt boot.

Use SPACE to begin boot immediately.

Boot in 7 seconds.

Press Esc at this point.

If you see the following message, then you waited too long, and must reload the ASA again after it finishes

booting:

Launching BootLoader...

Boot configuration file contains 2 entries.

[...]

Step 5 Set the network settings, and load the boot image using the following ROMMON commands:

interface interface_id

address management_ip_address

netmask subnet_mask

server tftp_ip_address

Cisco ASA and Firepower Threat Defense Reimage Guide

Reimage from ASA to Firepower Threat Defense

gateway gateway_ip_address

filepath/filename

set

sync

tftpdnld

The FTD boot image downloads and boots up to the boot CLI.

See the following information:

•interface—(ASA 5512-X, 5515-X, 5525-X, 5545-X, and 5555-X only) Specifies the interface ID. Other

models always use the Management 1/1 interface.

•set—Shows the network settings. You can also use the ping command to verify connectivity to the server.

•sync—Saves the network settings.

•tftpdnld—Loads the boot image..

Example:

Example for the ASA 5555-X:

rommon 0 > interface gigabitethernet0/0

rommon 1 > address 10.86.118.4

rommon 2 > netmask 255.255.255.0

rommon 3 > server 10.86.118.21

rommon 4 > gateway 10.86.118.1

rommon 5 > file ftd-boot-latest.cdisk

rommon 6 > set

ROMMON Variable Settings:

ADDRESS=10.86.118.3

NETMASK=255.255.255.0

SERVER=10.86.118.21

GATEWAY=10.86.118.21

PORT=GigabitEthernet0/0

VLAN=untagged

IMAGE=ftd-boot-latest.cdisk

CONFIG=

LINKTIMEOUT=20

PKTTIMEOUT=4

RETRY=20

rommon 7 > sync

Updating NVRAM Parameters...

rommon 8 > tftpdnld

Example for the ASA 5506-X:

rommon 0 > address 10.86.118.4

rommon 1 > netmask 255.255.255.0

rommon 2 > server 10.86.118.21

rommon 3 > gateway 10.86.118.21

rommon 4 > file ftd-boot-latest.lfbff

rommon 5 > set

ROMMON Variable Settings:

Cisco ASA and Firepower Threat Defense Reimage Guide

Reimage from ASA to Firepower Threat Defense

ADDRESS=10.86.118.3

NETMASK=255.255.255.0

SERVER=10.86.118.21

GATEWAY=10.86.118.21

VLAN=untagged

IMAGE=ftd-boot-latest.lfbff

CONFIG=

LINKTIMEOUT=20

PKTTIMEOUT=4

RETRY=20

rommon 6 > sync

Updating NVRAM Parameters...

rommon 7 > tftpdnld

Ping to troubleshoot connectivity to the server:

rommon 1 > ping 10.123.123.2

Sending 10, 32-byte ICMP Echoes to 10.123.123.2 timeout is 4 seconds

!!!!!!!!!!

Success rate is 100 percent (10/10)

rommon 2 >

Step 6 Enter setup, and configure network settings for the Management interface to establish temporary connectivity

to the HTTP or FTP server so that you can download and install the system software package.

If you have a DHCP server, the FTD automatically sets the network configuration. See the following

sample startup messages when using DHCP:

Configuring network interface using DHCP

Bringing up network interface.

Depending on your network, this might take a couple of minutes when using DHCP...

ifup: interface lo already configured

Using IPv4 address: 10.123.123.123

Using IPv6 address: fe80::2a0:c9ff:fe00:0

Using DNS server: 64.102.6.247

Using DNS server: 173.36.131.10

Using default gateway: 10.123.123.1

Note

Example:

Cisco FTD Boot 6.3.0

Type ? for list of commands

firepower-boot>

firepower-boot>setup

Welcome to Cisco FTD Setup

[hit Ctrl-C to abort]

Default values are inside []

Enter a hostname [firepower]: example.cisco.com

Do you want to configure IPv4 address on management interface?(y/n) [Y]: y

Do you want to enable DHCP for IPv4 address assignment on management interface?(y/n) [Y]:

Enter an IPv4 address: 10.123.123.123

Cisco ASA and Firepower Threat Defense Reimage Guide

Reimage from ASA to Firepower Threat Defense

Enter the netmask: 255.255.255.0

Enter the gateway: 10.123.123.1

Do you want to configure static IPv6 address on management interface?(y/n) [N]: n

Stateless autoconfiguration will be enabled for IPv6 addresses.

Enter the primary DNS server IP address [64.102.6.247]: 10.123.123.2

Do you want to configure Secondary DNS Server? (y/n) [y]: n

Any previously configured secondary DNS servers will be removed.

Do you want to configure Local Domain Name? (y/n) [n]: n

Do you want to configure Search domains? (y/n) [y]: n

Any previously configured search domains will be removed.

Do you want to enable the NTP service? [N]: n

Please review the final configuration:

Hostname: example.cisco.com

Management Interface Configuration

IPv4 Configuration: static

IP Address: 10.123.123.123

Netmask: 255.255.255.0

Gateway: 10.123.123.1

IPv6 Configuration: Stateless autoconfiguration

DNS Configuration:

DNS Server:

10.123.123.2

NTP configuration: Disabled

CAUTION:

You have selected IPv6 stateless autoconfiguration, which assigns a global address

based on network prefix and a device identifier. Although this address is unlikely

to change, if it does change, the system will stop functioning correctly.

We suggest you use static addressing instead.

Apply the changes?(y,n) [Y]: y

Configuration saved successfully!

Applying...

Restarting network services...

Done.

Press ENTER to continue...

firepower-boot>

Step 7 Download the FTD system software install package. This step shows an HTTP installation.

system install [noconfirm]url

Include the noconfirm option if you do not want to respond to confirmation messages.

Example:

> system install noconfirm http://10.86.118.21/ftd-6.0.1-949.pkg

You are prompted to erase the internal flash drive. Enter y.

######################## WARNING ############################

# The content of disk0: will be erased during installation! #

#############################################################

Do you want to continue? [y/N] y

Cisco ASA and Firepower Threat Defense Reimage Guide

Reimage from ASA to Firepower Threat Defense

This manual suits for next models

Other Cisco Security System manuals

Cisco

Cisco MEDVIEW-C-30XS-A01 User manual

Cisco

Cisco 4116 - EtherFast Switch Guide

Cisco

Cisco Firepower 2100 Series Manual

Cisco

Cisco ISA550 Instruction Manual

Cisco

Cisco MARS Instructions for use

Cisco

Cisco C195 Quick start guide

Cisco

Cisco ISA 3000 User manual

Cisco

Cisco WVC200 - Wireless-G PTZ Internet Camera Instruction Manual

Cisco

Cisco M5 User manual

Cisco

Cisco Meraki MX67 User manual

Cisco

Cisco ASA 5506W-X Manual

Cisco

Cisco ISA550 User manual

Cisco

Cisco NCS 4000 Series User manual

Cisco

Cisco ISA 3000 Operator's manual

Cisco

Cisco MS410-16 User manual

Cisco

Cisco PIX 525 User manual

Cisco

Cisco PIX 501 - Security Appliance User manual

Cisco

Cisco Small Business Pro SA 500 Series User manual

Cisco

Cisco Firepower 1100 Series User manual

Cisco

Cisco 500 Series User manual

Cisco

Cisco IronPort S670 User manual

Cisco

Cisco C395 Manual

Cisco

Cisco 6400E User manual

Cisco

Cisco PIX-515-RPS - PIX 515-R - Firewall User manual

Popular Security System manuals by other brands

Polon-Alfa

Polon-Alfa 4000 Installation and maintenance manual

Nexcom

Nexcom NViS 14162 Series user manual

Eminent

Eminent EM8670 Quick install

urmet domus

urmet domus alpha 1060 INSTALLATION AND USE BOOKLET

SmartPool

SmartPool YardGuard YG03 manual

DSC

DSC PC5964 Mounting instructions

Secure

Secure USAB-1 operating instructions

B&B

B&B 480 SERIES Operation & maintenance manual

ADEMCO

ADEMCO VISTA-20P Series Installation and setup guide

Inner Range

Inner Range Concept 2000 user manual

Johnson Controls

Johnson Controls PENN Connected PC10 Install and Commissioning Guide

Aeotec

Aeotec Siren Gen5 quick start guide

Swann

Swann SW-P-MC2 Specifications

Ecolink

Ecolink Siren+Chime user manual

EDM

EDM Solution 6+6 Wireless-AE installation manual

Siren

Siren LED GSM operating manual

Detection Systems

Detection Systems 7090i Installation and programming manual

FRIEDLAND

FRIEDLAND MA10 Installation and operating instructions

Cisco ASA 55 Series Quick start guide

Popular Security System manuals by other brands