ASA flash upgrade

Never done it before but is there a second slot for internal flash or do you have to get external flash copy the files off and then upgrade the flash and copy back.

Thi might help you:
https://supportforums.cisco.com/message/3533328#3533328
Thanks,
Varun Rao
Security Team,
Cisco TAC

Similar Messages

ASA-SM Upgrade

Dears,
what precaution I have to take before upgrade,
I am upgrading ASA-SM image 8.5.1 to 9.1(2) and then 9.3(1) .And for ASDM direct upgrade from 6.5 to 7.3.
I have to upload both the images in Disk0 as per the link below it is showing in Disk0?? but below show version doesn't show up asdm image in disk0
http://www.cisco.com/c/en/us/td/docs/security/asa/asa93/upgrade/upgrade93.html#pgfId-52066
sh version
Cisco Adaptive Security Appliance Software Version 8.5(1)
Device Manager Version 6.5(1)
Compiled on Tue 03-May-11 14:21 MDT by builders
System image file is "disk0:/asa851-smp-k8.bin"
Config file at boot was "startup-config"
FWSM up 5 mins 11 secs
failover cluster up 5 mins 11 secs
Hardware:   WS-SVC-ASA-SM1, 23552 MB RAM, CPU Xeon 5600 series 2000 MHz
            2 CPUs, 24 cores
Internal ATA Compact Flash, 8192MB
BIOS Flash M25P32 @ 0x0, 64KB
Thanks

Dear Experts,
I am using SUP2T with the following IOS, do i need to upgrade the FPD, how i will know that i need to upgrade
the commands output are form the 6509 switch.
sh run | in boot
boot-start-marker
boot system flash bootdisk:
boot-end-marker
diagnostic bootup level minimal
dir from the 6509 switch.
Directory of bootdisk:/
    1 -rw-    33554432 Aug 14 2014 14:24:14 +04:00 sea_console.dat
    2 -rw-   113733048 Aug 14 2014 14:31:08 +04:00 s2t54-ipservicesk9-mz.SPA.151-2.SY2.bin
    3 -rw-    33554432 Aug 14 2014 14:26:52 +04:00 sea_log.dat
    4 -rw-       25832 Oct 31 2014 13:20:30 +04:00 startup-config.converted_vs-20141031-092028
Still I have not installed ASA-SM in the switch the day of migration i will install the ASA-SM, how i will know that i have to upgrade the FPD ??? and what actually it is helping for ASA-SM ,??? i hope compatibility is perfect between 15.1 switch version and asa-sm 9.3.???
I have a separate chassis (test scenario) with me i will upgrade the asa, and asdm image so i can upload the fpd image also if you experts give me confirmation for the fpd.
S1#sh hw-module switch 1 all fpd
% No cards with FPD support can be found in the indicated chassis or Not in VSS mode.
Thanks

Adobe Flash Upgrade will not install after Firefox upgrade to 3.6.7

I upgraded to Firefox 3.6.7. After the upgrade I got a message that I needed to upgrade Adobe Flash due to security vulnerabilities. The Flash upgrade will not install. It simply sits and never installs no matter how long I wait.
== This happened ==
Just once or twice

Thanks for your response. I have previously reviewed this. The only potential problem it seems to resolve is having 2 versions of Shockwave installed. I only have one. The only thing I can think of to do is just uninstall the one version and see if it will trigger an installation. When I go to the Flash install site, I agree to the terms and get the next screen that says download will start. I never get a message asking if it's ok to run or anything. No matter where I look for a download for Flash I wind up at the same place with the same problem. Any suggestions would be most appreciated.
Thanks

Flash upgrade; 5 year old mac 5; is there a way without being jacked?

I spent all the money I had on Apple products just 5 years ago spending sixteen thousand dollars on my MAC 5 with all the bells and whistles you can think of. Now, all over the internet there is a growing experience of receiving more and more error messages stating that my system is no-longer compatible. The latest being a visit to my Facebook page where I uploaded a video and shortly thereafter I received a message that says I must upgrade Flash Player. Of course, you already know that anything new won't play on a Apple MAC 5 OS 10.4.
Oh, it was so exiting back then. Got my new computer and it wasn't just any ol' computer it was an Apple computer!
Now I'm being treated like dirt. Even Apple has turned a deaf ear. They said that I will have to throw my $16K computer in the dumpster and spend another $16k on another Apple product to reach that height of bliss I experienced 4 years ago. And what happens 4 years from now. Is it to the dumpster again? But before the dumpster, will I get the dirt treatment again? The error massages? The deaf ear?
Some of you may think that 5 years is old. I still have my 30 year old 16 track Teac reel to reel linear recorder with encoder and control panel that still works with the most incredible sound that most highly technologically talented gurus of today have never experienced.
"Flash upgrade; 4 year old mac 5; is there a way" to upgrade without having to buy a whole new Apple computer?...as opposed to relying on my Windows XP more and more?
If it is your intentions to ridcule me because I'm poor now, please save it, I feel bad enough as it is. Believe me, if I had the money, I'd probably keep buying more and more just like you...
...(or maybe not). Will Apple appreciate my second $16K purchase as much as it did the first one? Will it reward me the same as the first?
It's all I have left, I can't play my own video on my own Facebook.
(This will probably get deleted)

Thanks John.
I have a Mac OS X vers 10.4.11 with 4 x 2.5 GHz PowerPC G5; Memory 4.5 GB DDR2 SDRAM
I do not have Intels.
When you go to a person to ask for investment capital, they want to know everything you need to create a successful business. Couches, chairs, office rental, electricity, gas, cell phones, land line, fey boards, fax machines, microphone mixers, sound samplers, speakers, CRT monitors, printers, audio boards, microphones, cameras, advertising, transportation, including computers.
When you go out of business, the investor sells what ever he can get his hands on, couches, chairs, tape decks, monitors, keyboards, including computers, ell phones, land line, fey boards fax machines, microphone mixers, sound samplers, speakers, CRT monitors, printers, audio boards, microphones, cameras, including computers.
My tax corporation depreciates those items on my taxes each year as tax credits.
If the investors and the IRS treats them as assets, who's to argue?
I looked at my Apple invoice and it reads $16k, however, I was reluctant to consider other items on the invoice. I should not include all items but for the most part , with all the bells and whistles including soft ware, (adobe etc) it came to $16k ( in which I gladly paid. I was happy)
I'm real happy that you are still able to occasionally use your Powerbook as you are probably happy that I can occasionally still use my 16 track reel to reel.
I am not trying to run Adobe Flash I am trying to run what ever the internet dictates to me to run.
Ranting? Unprofessional? I am one of the most professional people you can meet. Turning 60 next year, I have many years invested in production in radio and television, rubbing elbows with many famous and well known people in the entertainment industry. Many of whom share in my dilemma. When a company has an opportunity to observe growing issues first hand from its client base about their product or service, is always a good thing.
Opportunities for that company are created! A good company, when opportunity knocks, takes advantage of the opportunity, others complain about the noise.

IPhone safari v/s Adobe Flash upgrade

iPhone safari will not allow Adobe Flash upgrade. Any thoughts or suggestions?

Any thoughts or suggestions?
None. Flash can't be used on an iPhone or iPod touch at this time.
(47437)

Will the 512GB Flash upgrade be available to 2011 Air owners

Does anyone know if Apple will make the 512GB flash upgrade available for the 2011 macbook air owners? I know that you can order it through CTO on the newly announced Airs but it would be amazing if Apple made it available for 2011 air owners.
TIA for any responses.
Chris

Apple doesn't make any upgraded SSD's available for the MBA.
You will have to consider aftermarket, such as is available at macsales.com
They have a 480 GB available.
http://eshop.macsales.com/shop/SSD/OWC/Aura_Pro_Express

New OS X malware masquerades as flash upgrade

There is a new mac os x trojan which tricks the user by posing as a flash upgrade. I downloaded a file which may be the trojan last week. It is called install_flash_player_osx_intel.dmg, and it is size 6,376,888 bytes. Today I went to get.adobe.com manually and downloaded the legitimate install_flash_player_osx_intel.dmg, and it is size 6,365,350 bytes.
I also acquired an application last Wednesday at the same time as the install_flash_player_osx_intel.dmg appeared, called 'Adobe Flash Player Install Manager' in my /Applications/Utilities directory.
Is the 6,376,888 bytes file legit? Is '/Applications/Utilities/Adobe Flash Player Install Manager' legit? Is there any published hash values for adobe software or other tools to ensure that what users download is the real software?
(Is everyone -- like me -- who turned on the 'Check for updates automatically' in the Flash pane of System Preferences a complete fool? Ok, I know the answer to that. *sigh*)

> Is '/Applications/Utilities/Adobe Flash Player Install Manager' legit?
Using flashplayer11_rc1_install_mac_090611.dmg from Adobe, Install Adobe Flash Player.app does write to that path. Here's an fseventer view of things:

My I-Mac won't let me download Adobe Flash upgrade

I can't download an Adobe Flash upgrade in my I-Mac.

Please fill out your "User Profile" so we can more specifically answer your questions. Model, processor, speed, RAM and hard drive capacity. All this can be found under the Apple Logo on the upper far left of your screen, About this Mac and More Info...

ASA Firewall Upgrade from 8.2,8.4, to 9.0

Dear All ,
we have five firewalls with the following details:
First Firewall
Hardware:   ASA5550, 4096 MB RAM, CPU Pentium 4 3000 MHz, Flash 256MB , BIOS Flash1024KB , ASA IOS 8.4(3) ,Device Manager Version 6.4(7)
    my question can i upgrade ASA IOS 8.4(3) to 9.0 directly without any issues also can i upgrade Device manager 6.4(7) to 7.0 without upgrading the       ASA IOS itself
Second Firewall
Hardware:   ASA5520,2048 MB RAM, CPU Pentium 4 2000MHz, Flash 256MB , BIOS Flash1024KB , ASA IOS 8.2(3) ,Device Manager Version
6.2(3)
my question can i upgrade ASA IOS 8.2(3) to 9.0 directly without any issues also can i upgrade Device manager 6.2(3) to 7.0 without upgrading the       ASA IOS itself
Third Firewall
Hardware:   ASA5520,2048 MB RAM, CPU Pentium 4 2000MHz, Flash 256MB , BIOS Flash1024KB , ASA IOS 8.4(3) ,Device Manager Version 6.4(7)
my question can i upgrade ASA IOS 8.4(3) to 9.0 directly without any issues also can i upgrade Device manager 6.4(7) to 7.0 without upgrading the       ASA IOS itself
Fourth Firewall
Hardware:   ASA5520,2048 MB RAM, CPU Pentium 4 2000MHz, Flash 256MB , BIOS Flash1024KB , ASA IOS 8.4(3) ,Device Manager Version 6.4(7)
my question can i upgrade ASA IOS 8.4(3) to 9.0 directly without any issues also can i upgrade Device manager 6.4(7) to 7.0 without upgrading the       ASA IOS itself
fifth Firewall:
Hardware:   ASA5520,2048 MB RAM, CPU Pentium 4 2000MHz, Flash 256MB , BIOS Flash1024KB , ASA IOS 8.2(3) ,Device Manager Version 6.2(3)
my question can i upgrade ASA IOS 8.2(3) to 9.0 directly without any issues also can i upgrade Device manager 6.2(3) to 7.0 without upgrading the       ASA IOS itself
please help i am doing the upgrading remotely using the ASDM and i don't want to do any upgrade could result disconnectivity.
Best regards

Hi Basel,
Honestly, I wouldn't suggest a direct upgrade from 8.2 to 9.0. This is a *major* upgrade. The recommended path to reach 9.0 would be from 8.2-->8.4-->9.0
Here are the release notes for 9.0:
http://www.cisco.com/en/US/docs/security/asa/asa90/release/notes/asarn90.html#wp690047
Per above document:
If you are upgrading from a pre-8.3 release, see also the Cisco ASA 5500 Migration Guide to Version 8.3 and Later
for important information about migrating your configuration.
Once you are on 8.3/8.4 (I would suggest 8.4 as a lot of issues were fixed post 8.3 as that was a huge transition from 8.2) upgrade to 9.0 is fairly simple.
Major part is upgrade from 8.2 to 8.4 as configuration changes and few things can be broken as a result. I would highly recommend you to check these docs before attempting an upgrade and also do it with some maintenence window so as to correct things in case they broke:
Following doc talks about 8.3 but it is applicable to direct upgrade to 8.4 as well:
https://supportforums.cisco.com/docs/DOC-12690
Release notes for 8.4:
http://www.cisco.com/en/US/docs/security/asa/asa84/release/notes/asarn84.html
Sourav

ASA firmware upgrade from console - tftp error

Have an asa 5510, trying to upgrade the firmware via console.
I have a tftp program installed on my PC but get an error running the command, any idea what I'm doing wrong?
asa# copy tftp flash
Address or name of remote host [142.xx.xx.xx]? ------------> IP of my PC
Source filename [asa912-k8.bin]?
Destination filename [asa912-k8.bin]?
Accessing tftp://142.xx.xx.xx/asa912-k8.bin...
%Error opening tftp://142.xx.xx.xx/asa912-k8.bin (No such device)

Hi,
You really cant upload files through the Console connection. Its not a network connection.
Your PC might have an IP address configured but that would be configured in its network interface card which has nothing to do with the console cable connection.
So you will have to configure one of the ASAs network interfaces with IP address and other basic settings. Then you need to configure the PCs network interface cards settings to match the IP address/subnet configured on the ASA. Then you will have an connection between the ASA and the PC and should be able to load the software to ASA.
For example
interface Management0/0
nameif management
security-level 100
ip address 10.10.10.1 255.255.255.0
no shutdown
and the configure the PC with IP address 10.10.10.100 and mask 255.255.255.0 for example and then load the software from the PCs IP address of 10.10.10.100.
- Jouni

ASA 5520 Upgrade From 8.2 to 9.1

To All Pro's Out There,
I have 2 x ASA 5520 in Active/Standby state (Routed, Single context) running 8.2(3) image. They are working great and everybody is happy. Now it's time for us to upgrade to the latest and greatest version: 9.1 and as you know there are some architectural changes Cisco made to NAT statements and Access Lists. As one can tell, we have a monster environment in terms of NAT statements and access list that are currently configured on the appliances.
In order to make the upgrade process "less" painful, I was able to find a loaner ASA 5520 device so I can practice the upgrade process offline and if needed, I use it in production (in conjunction with existing Primary and Secondary devices) should it be helpful. I currently don't have any plans on how to move forward with these 3 devices and put together an smooth upgrade. I am asking advice from experts that perhaps have done this in the past and know some Do's and Don’ts and can provide me some options toward getting best result: Minimum downtime and Smooth upgrade.
I appreciate all the help in advance.

Hi,
My personal approach from the start has been to learn the new NAT configuration format on the ASA CLI and manually convert the configurations for the new ASA software. I am under the impression that the automatic conversion that the ASA does by rebooting straight into a new software level causes quite a lot of configurations and they arent really optimal.
In your case it seems that you have a pretty much better situation than most people that dont have the chance to use a test device to test out the setup before actually putting it in production.
What you can basically do is
Insert the 8.2 configuration to the test ASA and boot it straight to the higher software levels and see what the conversion has done to the ASA configurations.
You can use "packet-tracer" command to test if correct NAT rules are still hit after the conversion
So far I have been lucky in the sense that most of the upgrades I have done have involved new hardware which has basically let me configure everything ready and just switch devices for the customer. So far everything has went really well and there has been only a 1-2 mistakes in NAT configurations because of misstyping some IP address or interface name which basically resulted from a lot of copy/paste when building the configurations. And these couple of mistakes have been from around 150 firewall migrations (of which most from FWSM Security Context to a ASA Security Context)
If you have time to put into this then I would suggest you try to learn the new NAT format and write your NAT configurations yourself. Converting the existing configurations should essentially give you the tools to then maintain that firewall configuration easily in the future and apply that knowledge elsewhere.
If you want to read a bit about the new NAT configuration format then I would suggest having a look at the NAT 8.3+ document I made:
https://supportforums.cisco.com/docs/DOC-31116
My personal approach when starting to convert NAT configurations for the upgrade is
Collect all NAT configurations from the current ASA including any ACLs associated with the Policy type NATs and NAT0 configurations
Divide NAT configurations based on type
Dynamic NAT/PAT
Static NAT
Static PAT
NAT0
All Policy Dynamic/Static NAT/PAT
Learn the basic configuration format for each type of NAT configuration
Start by converting the easiest NAT configurations
Dynamic NAT/PAT
Static NAT/PAT
Next convert the NAT0 configurations
And finally go through the Policy NAT/PAT configurations
Finally go through the interface ACLs and change them to use the real IP address as the destination in all cases since the NAT IP address is not used anymore. In most common screnarios this basically usually only involves modifying the "outside" interfaces ACL but depending if the customer has some other links to external resourses then its highly likely that same type of ACL changes are required on those interfaces also.
The most important thing is to understand how the NAT is currently working and then configure the new NAT configuration to match that. Again, the "packet-tracer" command is a great tool to confirm that everything is working as expected.
One very important thing to notice also is that you might have a very large number of Identity NAT configurations between your local networks interfaces of the ASA.
For example
static (inside,dmz) 10.10.10.0 10.10.10.0 netmask 255.255.255.0
In the new software you can pretty much leave all of these out. If you dont need to perform NAT between your local interfaces then you simply leave out all NAT configurations.
Naturally you can also use these forums to ask help with NAT configuration conversions. Even though its a very common topic, I dont personally mind helping out with those.
So to summarize
Try out the ASAs automatic configuration conversion when simply booting to new software levels on the test ASA you have
Learn the new NAT configuration format
Ask for help here on CSC about NAT configuration formats and help with converting old to new configurations.
Personally if I was looking at a samekind of upgrade (which I will probably be looking at again soon) I would personally do the following
Convert the configurations manually
Lab/test the configurations on an test ASA
During Failover pairs upgrade I would remove the Standby device from network, erase its configurations, reboot it to new software, insert manually written configurations.
Put the upgraded ASA to the device rack and have cables ready connected to the customer devices if possible (or use existing ones)
Disconnect currently active ASA running 8.2 and connect the new ASA to the network while clearing ARP on the connected routers to avoid any problems with traffic forwarding.
Test connectivity and monitor ASAs connection and xlate tables to confirm everything is working
Will add more later if anything comes to mind as its getting quite late here
Hope this helps
- Jouni

ASA 5520 upgrade from 8.4.6 to 9.1.2

Dear All,
I am having ASA 5520 in Active Standby failover configuration . I want to know if I can upgrade it from 8.4.6 to 9.1.2 using the zero downtime upgrade process mentioned on cisco site .
Below is the process :
Upgrade an Active/Standby Failover Configuration
Complete these steps in order to upgrade two units in an       Active/Standby failover configuration:
Download the new software to both units, and specify the new image to           load with the boot system command.
Refer to           Upgrade           a Software Image and ASDM Image using CLI for more           information.
Reload the standby unit to boot the new image by entering the           failover           reload-standby command on the active unit as shown           below:
active#failover reload-standby
When the standby unit has finished reloading and is in the Standby           Ready state, force the active unit to fail over to the standby unit by entering           the no           failover active command on the active unit.
active#no failover active
Note: Use the show             failover command in order to verify that the standby unit             is in the Standby Ready state.
Reload the former active unit (now the new standby unit) by entering           the reload command:
newstandby#reload
When the new standby unit has finished reloading and is in the           Standby Ready state, return the original active unit to active status by           entering the failover           active command:
newstandby#failover active
This completes the process of upgrading an Active/Standby Failover       pair.
Also after upgrade are there any changes required after IOS migration ( i.e are there any changes in the command line of 8.4.6 and 9.1.2 )
It is mentioned on cisco site that
Major Release
—You can upgrade from the last minor           release of the previous version to the next major release. For example, you can           upgrade from 7.9 to 8.0, assuming that 7.9 is the last minor version in the 7.x           release.

Hi Tushar,
The steps you mentioned are perfectly fine. There is no major difference in the commands of the 2 versions, it's just that in access-rule from 9.1 you have to any4 instead of any for ipv4 and any6 for ipv6. During conversion it will get convert automatically.
Also, please refer to the following document (release notes of 9.1.2) for viewing the new features added in that version:
http://www.cisco.com/en/US/docs/security/asa/asa91/release/notes/asarn91.html#wp685480
- Prateek Verma

ASA 5520 Upgrade 8.0(4)-- 8.4.2--Zero Downtime

Hello Everyone,
We are currently on 8.0(4) and planning on upgrading our failover pair to 8.4.2, I read some documents saying that we can perform a zero downtime upgrade.
According the below documents Version 8.2 supports mismatch memory failover,
http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_overview.html#wp1077536
https://supportforums.cisco.com/message/3549760#3549760//
Upgrade Path:
Active Firewall:                         Standby Firewall:
   8.0(4)                                       8.0(4)-->8.2.2
   8.0(4)                                       Upgrade RAM-2G---Reload
   faiover to standby                    8.2.2
   8.0(4)--->8.2.2                          8.2.2
   Upgrade RAM-2G-reload         8.2.2----Fail over
   8.2.2--Active                             8.2.2--Standby
8.2.2                                          8.3.1
8.2.2                                          8.4.2
Failover to stanby                      8.4.2
8.2.2--Standby                           8.4.2-----Active
Can I perform zero downtime upgrade with the above upgrade path? Will both the firewalls act as a failover pair if one is on 8.2.2 and other is on 8.4.2.
"Performing Zero Downtime Upgrades for Failover Pairs
The two units in a failover configuration should have the same major (first number) and minor (second number) software version. However, you do not need to maintain version parity on the units during the upgrade process; you can have different versions on the software running on each unit and still maintain failover support." (http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/admin_swconfig.html)
Upgrade RAM-2G

You can do it in a lot fewer steps.
1. Upgrade RAM on standby, reload and make it active.
2. Repeat process for newly standby unit.
Now you have 2 units still on 8.0(4) with requisite RAM for 8.3+. TAC will recommend you go up in "baby steps" but the software will work upgrading directly from 8.0 to 8.4. 8.4(3) is the current version for the 5520 platform. At most conservative, I might upgrade to 8.2(4) as an interim but it's not strictly necessary. So my next step would be:
3. Upgrade standby unit from 8.0(4) to 8.4(3). At this point take stock of the script syntax changes. Examine the upgrade log (on disk0:) and address any discrepancies.
Note active/standby failover will work here but should not be run this way for any extended time as syntax changes would affect the ability to synchronize if changes are introduced on the active member.
Finally:
4. Flip upgraded standby unit to active and upgrade remaining standby unit to 8.4(3).
If you follow these steps and check your work after each step, this would all be zero downtime.

Problems installing code after flash upgrade

I just upgraded a 2600 router from 8 MB flash to 16 MB flash (that came from a working 3600). I know for a fact that the firmware for the router with the upgrade is good - I was able to upgrade a different router with no problem. However, with the new flash, the transfer of the code errors out with
File reception completed.
TFTP copy: operation terminated due to bad checksum comparison.
As best as I can tell, the flash is the same between the 2600 and 3600. Please let me know if anyone was able to successfuly do this. Thank you.

I tftp'd the image for the 2600 into the flash when it was installed in the 3600, stuck the flash into the 2600, and it boots.

Multiple Vulnerabilities in Cisco ASA Software Upgrade

Hello,
Has anyone upgraded their ASA's IOS to the recommended version as mentioned in this link -->
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20131009-asa?
I have upgrade my 8.2 & 8.6 softwares to the new release versions (as recommended by Cisco), but whenever I use the reload command, my I get the following error:
*** --- START GRACEFUL SHUTDOWN ---
Shutting down isakmp
Shutting down webvpn
Shutting down sw-module
Shutting down File system
*** --- SHUTDOWN NOW ---
Write failed: Broken pipe
Any ideas as to why this is happening and any suggestions to answer this issue?
Thanks,
Arun

We will need to investigate this further.
Allow me sometime or if it is urgent please open a TAC case.
Mike

ASA flash upgrade

Similar Messages

Maybe you are looking for