One of a things that we conclude is that Cisco is constantly building their confidence portfolio in an try to keep adult with today’s complicated threats. I’ve prolonged been a fan of a Cisco ASA and a new FirePOWER procedure and FireSIGHT government core that we wrote about here. It’s a bit frustrating that we have dual opposite codes regulating on one box. That’s not a box anymore. Cisco recently announced an enhanced Next-Generation Platform and a singular picture to order them all. With a new Firepower Threat Defense (FTD) image, a ASA is a singular picture firewall with Firepower services built right in. In this essay I’ll take we by a stairs compulsory to ascent an ASA with a FirePOWER procedure to a new singular FTD image.
Before we start an ascent of your ASA to a new FTD image, we need to make certain we have a upheld platform. Currently a following platforms are supported:
- ASA 5506-X
- ASA 5506W-X
- ASA 5506H-X
- ASA 5508-X
- ASA 5512-X
- ASA 5515-X
- ASA 5516-X
- ASA 5525-X
- ASA 5545-X
- ASA 5555-X
In this example, we will be upgrading an ASA 5506-X to FTD. On a ASA 5506 a SSD is standard, and in fact it’s customary on a 5508-X and 5516-X as well. On a 5512-X and 5555-X we need to make certain we have an SSD. It competence sound funny, though it’s not a batch option. If we systematic one of those platforms with FirePOWER, it’s already there, though if we didn’t we competence not have it.
Obtaining Firepower Threat Defense (FTD) software
To get a program we have to have a support agreement with Cisco. You’re going to need a following software:
- The Firepower Threat Defense foot image. This will be a .cdisk prolongation unless your regulating a ASA 5506-X like me. In that box your prolongation will be lbff
- FTD complement package (.pkg extension)
- TFTP server
- FTP Server
The foot picture is commissioned regulating TFTP and a complement picture is commissioned around FTP or HTTP.
Once we have performed a program we can proceed.
Types of images
There are dual forms of images we need, and there are patch files we competence wish to request as well. Each of these have opposite record extensions. The foot images finish in a prolongation .ifbff or .cdisk depending on a platform. This was mentioned previously. For all platforms, a complement picture ends in .pkg and patch files finish in .sh.
High-level routine
- Upgrade ROMMON if necessary
- Upload and implement a FTD OS from a TFTP server
- After a reboot allot proxy network settings
- Upload and implement a FTD complement package
- Configure a device for government from a FMC
Upgrading a ROMMON picture
For a initial step we wish to ascent ROMMON. Let’s take a demeanour during a stream picture that’s installed. To do this, we emanate a authority uncover module.
ciscoasa# uncover module Mod Card Type Model Serial No. -------------------------------------------- ------------------ ----------- 1 ASA 5506-X with SW, 8GE Data, 1GE Mgmt, AC ASA5506 JAD200401KK sfr FirePOWER Services Software Module ASA5506 JAD200401KK Mod MAC Address Range Hw Version Fw Version Sw Version --------------------------------- ------------ ------------ --------------- 1 0035.1ae4.89a1 to 0035.1ae4.89aa 1.1 1.1.8 9.5(2) sfr 0035.1ae4.89a0 to 0035.1ae4.89a0 N/A N/A 5.4.1-211 Mod SSM Application Name Status SSM Application Version ------------------------------ ---------------- -------------------------- sfr ASA FirePOWER Up 5.4.1-211 Mod Status Data Plane Status Compatibility ------------------ --------------------- ------------- 1 Up Sys Not Applicable sfr Up Up ciscoasa#
In this box a ASA is already regulating chronicle 1.1.8. Had we indispensable to upgrade, we would follow this process:
- Get a duplicate of a ROMMON picture from Cisco.com
- Copy a picture to a ASA regulating TFTP:
ciscoasa# duplicate tftp://10.0.2.101/asa5500-firmware-1108.SPA disk0:asa5500-firmware-1108.SPA
- Upgrade a ROMMON image:
ciscoasa# ascent rommon disk0:asa5500-firmware-1108.SPA Verifying record firmness of disk0:/asa5500-firmware-1108.SPA Computed Hash SHA2: d824bdeecee1308fc64427367fa559e9 eefe8f182491652ee4c05e6e751f7a4f 5cdea28540cf60acde3ab9b65ff55a9f 4e0cfb84b9e2317a856580576612f4af Embedded Hash SHA2: d824bdeecee1308fc64427367fa559e9 eefe8f182491652ee4c05e6e751f7a4f 5cdea28540cf60acde3ab9b65ff55a9f 4e0cfb84b9e2317a856580576612f4af Digital signature successfully validated File Name : disk0:/asa5500-firmware-1108.SPA Image form : Release Signer Information Common Name : abraxas Organization Unit : NCS_Kenton_ASA Organization Name : CiscoSystems Certificate Serial Number : 553156F4 Hash Algorithm : SHA2 512 Signature Algorithm : 2048-bit RSA Key Version : A Verification successful. Proceed with reload? [confirm]
2. Confirm a ascent after reload regulating a uncover procedure command.
Reimage a ASA to FTD
Our subsequent step is to reimage a ASA to a FTD image. Before we do that it’s a good thought to backup a stream system.
ciscoasa# backup [Press lapse to continue or enter a backup location]: No filename provided! Using default ciscoasa.backup.2017-05-12-101022.tar.gz Begin backup ... Backing adult [ASA Version] ... Done! Backing adult [Running Configurations] ... Done! Backing adult [Startup Configurations] ... Copy in progress...C Done! Backing adult [WebVPN Data] ... Done! Compressing a backup office ... Done! Copying Backup ... Done! Cleaning adult ... Done! Backup finished! ciscoasa#
Now make certain we save this somewhere.
ciscoasa# duplicate disk0:/ciscoasa.backup.2017-05-12-101022.tar.gz tftp://10.0.2.1$ Source filename [ciscoasa.backup.2017-05-12-101022.tar.gz]? Address or name of remote horde [10.0.2.101]? Destination filename [ciscoasa.backup.2017-05-12-101022.tar.gz]? INFO: No digital signature found 45905 bytes copied in 0.170 secs ciscoasa#
Next, duplicate out a activation key:
ciscoasa# uncover activation-key Serial Number: JAD200401KK Running Permanent Activation Key: 0x###64 0x###be6a9 0x3#####28 0x######6c 0x####2289 Licensed facilities for this platform: Maximum Physical Interfaces : Unlimited perpetual Maximum VLANs : 5 perpetual Inside Hosts : Unlimited perpetual Failover : Disabled perpetual Encryption-DES : Enabled perpetual Encryption-3DES-AES : Enabled perpetual Carrier : Disabled perpetual AnyConnect Premium Peers : 2 perpetual AnyConnect Essentials : Disabled perpetual Other VPN Peers : 10 perpetual Total VPN Peers : 12 perpetual AnyConnect for Mobile : Disabled perpetual AnyConnect for Cisco VPN Phone : Disabled perpetual Advanced Endpoint Assessment : Disabled perpetual Shared License : Disabled perpetual Total UC Proxy Sessions : 2 perpetual Botnet Traffic Filter : Disabled perpetual Cluster : Disabled perpetual This height has a Base license. The peep permanent activation pivotal is a SAME as a regulating permanent key. ciscoasa#
Now we need to reload a ASA and enter ROMMON mode. Remember that this means we need to do this from a sequence console. An SSH eventuality into a ASA will not cut it here.
ciscoasa# reload System config has been modified. Save? [Y]es/[N]o: Y Cryptochecksum: d7f49992 bec177a3 f17e3159 1d47f5c8 2851 bytes copied in 0.270 secs Proceed with reload? [confirm] ciscoasa# *** *** --- START GRACEFUL SHUTDOWN --- Shutting down isakmp Shutting down sw-module Shutting down License Controller Shutting down File system *** *** --- SHUTDOWN NOW --- Process shutdown finished Rebooting..... INIT: Sending processes a TERM signal Deconfiguring network interfaces... done. Sending all processes a TERM signal... Sending all processes a KILL signal... Deactivating swap... Unmounting internal filesystems... Rebooting... Rom picture accurate correctly Cisco Systems ROMMON, Version 1.1.8, RELEASE SOFTWARE Copyright (c) 1994-2015 by Cisco Systems, Inc. Compiled Thu 06/18/2015 12:15:56.43 by builders Current picture running: Boot ROM0 Last reset cause: PowerCycleRequest DIMM Slot 0 : Present Platform ASA5506 with 4096 Mbytes of categorical memory MAC Address: 00:35:1a:e4:89:a1 Use BREAK or ESC to miscarry boot. Use SPACE to start foot immediately. Boot interrupted. rommon 1
Now that you’re sitting during ROMMON we need to set adult some proxy government settings. This allows we to lift a foot picture off of a TFTP server.
rommon 1 residence 10.0.2.107 rommon 2 netmask 255.255.255.0 rommon 3 server 10.0.2.101 rommon 4 record ftd-boot-9.7.1.4.lfbff rommon 5 set ADDRESS=10.0.2.107 NETMASK=255.255.255.0 GATEWAY=10.0.2.1 SERVER=10.0.2.101 IMAGE=ftd-boot-9.7.1.4.lfbff CONFIG= PS1="rommon ! " rommon 6 sync rommon 7
Our subsequent step is to download a foot image. This is a flattering elementary routine as we can see below.
rommon 7 tftpdnld ADDRESS: 10.0.2.107 NETMASK: 255.255.255.0 GATEWAY: 10.0.2.1 SERVER: 10.0.2.101 IMAGE: ftd-boot-9.7.1.4.lfbff MACADDR: 00:35:1a:e4:89:a1 VERBOSITY: Progress RETRY: 40 PKTTIMEOUT: 7200 BLKSIZE: 1460 CHECKSUM: Yes PORT: GbE/1 PHYMODE: Auto Detect Receiving ftd-boot-9.7.1.4.lfbff from 10.0.2.101!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! File accepting completed. Boot aegis bigbuf=348bd018 Boot picture distance = 107035120 (0x66139f0) bytes [image size] 107035120 [MD5 signaure] fea0e064574aec139158a85fc364df56 LFBFF signature verified. INIT: chronicle 2.88 booting Starting udev Configuring network interfaces... done. Populating dev cache Detected PID ASA5506. Found device sequence series JAD200401KK. Found USB peep expostulate /dev/sdb Found tough drive(s): /dev/sda fsck from util-linux 2.23.2 dosfsck 2.11, 12 Mar 2005, FAT32, LFN There are differences between foot zone and a backup. Differences: (offset:original/backup) 65:01/00 Not automatically regulating this. /dev/sdb1: 53 files, 814354/1918808 clusters Launching foot CLI ... Configuring network interface regulating immobile IP Bringing adult network interface. Depending on your network, this competence take a integrate of mins when regulating DHCP... ifup: interface lo already configured Using IPv4 address: 10.0.2.107 INIT: Starting complement summary bus: dbus. Starting OpenBSD Secure Shell server: sshd generating ssh RSA key... generating ssh ECDSA key... generating ssh DSA key... Could not bucket horde key: /etc/ssh/ssh_host_ed25519_key done. Starting Advanced Configuration and Power Interface daemon: acpid. acpid: starting up acpid: 1 order loaded acpid: watchful for events: eventuality logging is off Starting ntpd: done Starting syslog-ng:[2017-05-12T10:42:55.702033] Connection failed; fd='15', server='AF_INET(127.128.254.1:514)', local='AF_INET(0.0.0.0:0)', error='Network is unreachable (101)' [2017-05-12T10:42:55.702137] Initiating tie failed, reconnecting; time_reopen='60' . Starting crond: OK Cisco FTD Boot 6.0.0 (9.7.1.4) Type ? for list of commands ciscoasa-boot
Now that we have booted into a FTD foot picture we need to form setup and go by a simple IP settings. Most of your configured settings will come by as we can see in a following output. Items in block brackets are values we can accept by attack enter.
ciscoasa-bootsetup Welcome to Cisco FTD Setup [hit Ctrl-C to abort] Default values are inside [] Enter a hostname [ciscoasa]: ftd1 Do we wish to configure IPv4 residence on government interface?(y/n) [Y]: Y Do we wish to capacitate DHCP for IPv4 residence assignment on government interface?(y/n) [N]: N Enter an IPv4 residence [10.0.2.107]: 10.0.2.107 Enter a netmask [255.255.255.0]: 255.255.255.0 Enter a gateway: 10.0.2.1 Do we wish to configure immobile IPv6 residence on government interface?(y/n) [N]: N Stateless autoconfiguration will be enabled for IPv6 addresses. Enter a primary DNS server IP address: 10.0.2.1 Do we wish to configure Secondary DNS Server? (y/n) [n]: n Do we wish to configure Local Domain Name? (y/n) [n]: n Do we wish to configure Search domains? (y/n) [n]: n Do we wish to capacitate a NTP service? [Y]: Y Enter a NTP servers distant by commas [203.0.113.126]: 10.0.2.1 Please examination a final configuration: Hostname: ftd1 Management Interface Configuration IPv4 Configuration: static IP Address: 10.0.2.107 Netmask: 255.255.255.0 Gateway: 10.0.2.1 IPv6 Configuration: Stateless autoconfiguration DNS Configuration: DNS Server: 10.0.2.1 NTP configuration: 10.0.2.1 CAUTION: You have comparison IPv6 stateless autoconfiguration, that assigns a tellurian address based on network prefix and a device identifier. Although this residence is unlikely to change, if it does change, a complement will stop functioning correctly. We advise we use immobile addressing instead. Apply a changes?(y,n) [Y]: Y Configuration saved successfully! Applying... Restarting network services... Done. Press ENTER to continue... ciscoasa-boot
Next, use a complement implement authority to implement a FTD complement image. This is a .pkg file.
ciscoasa-bootsystem implement noconfirm ftp://10.0.2.101/ftd-6.2.0-363.pkg ################## WARNING The calm of disk0: will be erased during installation! Do we wish to continue? [y/N] y Erasing disk0 ... Extracting ... Verifying Enter certification to substantiate with ftp server Username: bcarroll Password: Verifying Downloading Extracting Package Detail Description: Cisco ASA-FTD 6.2.0-363 System Install Requires reboot: Yes Warning: Please do not miscarry a routine or spin off a system. Doing so competence leave complement in obsolete state. Starting ascent routine ... Populating new complement picture Broadcast summary from root@ftd1 (ttyS1) (Fri May 12 11:06:27 2017): The complement is going down for reboot NOW! Stopping OpenBSD Secure Shell server: sshdstopped /usr/sbin/sshd (pid 1719) . Stopping Advanced Configuration and Power Interface daemon: stopped /usr/sbin/acpid (pid 1723) acpid: exiting acpid. Stopping complement summary bus: dbus. Stopping ntpd: stopped routine in pidfile '/var/run/ntp.pid' (pid 1812) done Stopping crond: OK Deconfiguring network interfaces... done. Sending all processes a TERM signal... Sending all processes a KILL signal... Deactivating swap... Unmounting internal filesystems... Rebooting...
Finally, after about 30 – 40 mins we are prepared to record in.
Cryptochecksum (changed): b03622ce c784e983 5f8c8d31 fe1fc861 INFO: Power-On Self-Test in process. ....................................................................... INFO: Power-On Self-Test complete. INFO: Starting HW-DRBG health test... INFO: HW-DRBG health exam passed. INFO: Starting SW-DRBG health test... INFO: SW-DRBG health exam passed. Cisco ASA5506-X Threat Defense v6.2.0 (build 363) firepower login:
The default login here will be adminAdmin123, though we’re not going to get into a specifics of a pattern in this article. However, we now have a glossy new FTD picture regulating on your ASA. One new premonition to understanding with in this box is that government is now different. In a past we could use a CLI or ASDM to conduct your ASA. With a FTD picture we can use possibly Firepower Device Manager or Firepower Management Center to conduct your device. (Cisco’s install and ascent guides have some-more information.)
The Firepower Device Manager is an on-box web-based manager that is identical to how we used to use a ASDM to conduct a device. If we have a low and mid-range ASA height regulating FTD you’ll expected run a Firepower Device Manager.
While it seems like a extensive process, we can always step divided and work on other things while a images load. You should be wakeful that we will remove some of a facilities we used to have with a ASA regulating a aged ASA image, though this is really a destiny of Cisco’s confidence appliances so I’d rarely suggest we get informed now.
Also see:
The best security? Have Zero Trust, says expert
How to register an ASA SFR procedure with a FirePOWER Management Center
Why businesses have a wrong cybersecurity mindset, and how they can repair it
4 vicious points to cruise when receiving cybersecurity and remoteness advice
Article source: http://www.techrepublic.com/article/how-to-upgrade-an-asa-5506-x-to-the-new-firepower-threat-defense-software/#ftag=RSS56d97e7