Firepower2100 e Firepower1000–Reimage FTD para ASA

Os novos appliances Cisco Firepower são usados normalmente com o software FTD. No entanto, evetualmente, ainda pode ser necessário usarmos o software ASA nestes appliances.

Neste caso é preciso fazer o reimage, apagando o FTD e instalado o ASA OS.

Antes de começar o reimage é importante apagar o FTD do FMC, ou se estiver usando FDM, desregistrar o SmartAccount. Com isso feito, basta seguir os passos abaixo.

Esses appliances usam o FXOS análogo a uma hypervisor. Este software faz a gerência do hardware, e o FTD/ASA é instalado como uma máquina virtual.

O usuário/senha padrão do FXOS é Admin/Admin123

1) Acesse o FXOS pela console, ou usando SSH através da interface M1/1. Se acessar via console vai entrar direto no FXOS. Via SSH (IP padrão é 192.168.45.45).é necessário usar o comando connect fxos para acessá-lo.

firepower#

2) Vá para o modo firmware e transfira o ASA OS.

firepower# scope firmware 
firepower /firmware #
firepower /firmware # download image tftp://192.168.45.46/cisco-asa-fp2k.9.8.4.SPA 
Please use the command 'show download-task' or 'show download-task detail' to check download progress.
firepower /firmware # show download-task
Download task:
     File Name Protocol Server          Port       Userid          State
     --------- -------- --------------- ---------- --------------- -----
     cisco-asa-fp2k.9.8.4.SPA
               Tftp     192.168.45.46            0                 Downloading
firepower /firmware # 
firepower /firmware # show download-task

Download task:
     File Name Protocol Server          Port       Userid          State
     --------- -------- --------------- ---------- --------------- -----
     cisco-asa-fp2k.9.8.4.SPA
               Tftp     192.168.45.46            0                 Downloaded

firepower /firmware #

3) Verifique os softwares disponíveis no appliance.

firepower /firmware # show package 
Name                                          Package-Vers
--------------------------------------------- ------------
cisco-asa-fp2k.9.8.2.SPA                      9.8.2
cisco-asa-fp2k.9.8.4.SPA                      9.8.4
cisco-ftd-fp2k.6.2.3-83.SPA                 6.2.3-83
firepower /firmware #

4) Instale o ASA OS.

firepower /firmware # scope auto-install 
firepower /firmware/auto-install # insnstall security-pack pversion 9.8.4

The system is currently installed with security software package 6.2.3-83, which has:
    - The platform version: 2.3.1.84
    - The CSP (ftd) version: 6.2.3.83
If you proceed with the upgrade 9.8.4, it will do the following:
    - upgrade to the new platform version 2.2.2.119
    - reimage the system from CSP ftd version 6.2.3.83 to the CSP asa version 9.8.4
During the upgrade, the system will be reboot

Do you want to proceed ? (yes/no):yes

This operation upgrades firmware and software on Security Platform Components
Here is the checklist of things that are recommended before starting Auto-Install
(1) Review current critical/major faults
(2) Initiate a configuration backup

Attention:
    If you proceed the system will be re-imaged. All existing configuration will be lost,
    and the default configuration applied.
Do you want to proceed? (yes/no):yes

Triggered the install of software package version 9.8.4
Install started. This will take several minutes.
For monitoring the upgrade progress, please enter 'show' or 'show detail' command.
firepower /firmware/auto-install #

5) Aguarde o appliance reiniciar. Durante o processo pode usar o comando show detail para acompanhar verificar a instalação.

firepower /firmware/auto-install # show detail

Firmware Auto-Install:
     Package-Vers: 9.8.4
     Oper State: Scheduled
     Installation Time: 2019-09-25T11:37:11.165
     Upgrade State: Ready
     Upgrade Status:
     Validation Software Pack Status:
     Firmware Upgrade Status:
     Current Task:

firepower /firmware/auto-install #

Broadcast message from root@firepower (Wed Sep 25 11:38:38 2019):

The system is going down for reboot NOW!

6) Após o boot conecte no ASA OS.

firepower-2110# conect asa
Attaching to Diagnostic CLI ... Press 'Ctrl+a then d' to detach.
Type help or '?' for a list of available commands.

ciscoasa> en
Password:

ciscoasa#

Mais informações aqui.

Até a próxima.