C H A P T E R
5
Image Management
•
About Image Management, page 33
•
Downloading Images from Cisco.com, page 34
•
Uploading an Image to the Firepower Security Appliance, page 34
•
Verifying the Integrity of an Image, page 34
•
Upgrading the Firepower eXtensible Operating System Platform Bundle, page 35
•
Updating the Image Version for a Logical Device, page 36
•
Firmware Upgrade, page 36
About Image Management
The FXOS chassis uses two basic types of images:
Note
All images are digitally signed and validated through Secure Boot. Do not modify the image in any way or you will receive a validation error.
• Platform Bundle — The Firepower platform bundle is a collection of multiple independent images that operate on the Firepower Supervisor and Firepower security module/engine. The platform bundle is a
Firepower eXtensible Operating System software package.
•
Application
—
Application images are the software images you want to deploy on the security module/engine of the FXOS chassis. Application images are delivered as Cisco Secure Package files
(CSP) and are stored on the supervisor until deployed to a security module/engine as part of logical device creation or in preparation for later logical device creation. You can have multiple different versions of the same application image type stored on the Firepower Supervisor.
Note
If you are upgrading both the Platform Bundle image and one or more Application images, you must upgrade the Platform Bundle first.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
33
Image Management
Downloading Images from Cisco.com
Downloading Images from Cisco.com
Before You Begin
You must have a Cisco.com account.
Procedure
Step 1
Choose
System
>
Updates
.
The Available Updates page shows a list of the FXOS platform bundle images and application images that are available on the chassis.
Step 2
Click the
Download latest updates from CCO
link at the bottom of the page.
The software download page for the FXOS chassis is opened in a new tab within the browser.
Step 3
Find and then download the appropriate software image to your local computer.
Uploading an Image to the Firepower Security Appliance
Before You Begin
Make sure the image you want to upload is available on your local computer.
Procedure
Step 1
Choose
System
>
Updates
.
The Available Updates page shows a list of the Firepower eXtensible Operating System platform bundle images and application images that are available on the chassis.
Step 2
Click
Upload Image
to open the Upload Image dialog box.
Step 3
Click
Browse
to navigate to and select the image that you want to upload.
Step 4
Click
Upload
.
The selected image is uploaded to the FXOS chassis.
Step 5
For certain software images you will be presented with an end-user license agreement after uploading the image. Follow the system prompts to accept the end-user license agreement.
Verifying the Integrity of an Image
The integrity of the image is automatically verified when a new image is added to the FXOS chassis. If needed, you can use the following procedure to manually verify the integrity of an image.
34
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Image Management
Upgrading the Firepower eXtensible Operating System Platform Bundle
Procedure
Step 1
Choose
System
>
Updates
.
The Available Updates page shows a list of the Firepower eXtensible Operating System platform bundle images and application images that are available on the chassis.
Step 2
Click
Verify
(check mark icon) for the image you want to verify.
The system will verify the integrity of the image and display the staus in the Image Integrity field.
Upgrading the Firepower eXtensible Operating System Platform
Bundle
Before You Begin
Download the platform bundle software image from Cisco.com (see
Downloading Images from Cisco.com,
on page 34 ) and then upload that image to the FXOS chassis (see
Uploading an Image to the Firepower
Security Appliance, on page 34
).
Note
The upgrade process typically takes between 20 and 30 minutes.
If you are upgrading a Firepower 9300 or Firepower 4100 Series security appliance that is running a standalone logical device or if you are upgrading a Firepower 9300 security appliance that is running an intra-chassis cluster, traffic will not traverse through the device while it is upgrading.
If you are upgrading Firepower 9300 or a Firepower 4100 Series security appliance that is part of an inter-chassis cluster, traffic will not traverse through the device being upgraded while it is upgrading.
However, the other devices in the cluster will continue to pass traffic.
Procedure
Step 1
Choose
System
>
Updates
.
The Available Updates page shows a list of the Firepower eXtensible Operating System platform bundle images and application images that are available on the chassis.
Step 2
Click
Upgrade
for the FXOS platform bundle to which you want to upgrade.
The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently installed applications and the specified FXOS platform software package.
It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade.
Step 3
Click
Yes
to confirm that you want to proceed with installation, or click
No
to cancel the installation.
The Firepower eXtensible Operating System unpacks the bundle and upgrades/reloads the components.
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
35
Image Management
Updating the Image Version for a Logical Device
Updating the Image Version for a Logical Device
Before You Begin
Note
After initial creation of a Firepower Threat Defense logical device, you do not upgrade the Firepower
Threat Defense logical device using Firepower Chassis Manager or the FXOS CLI. To upgrade a Firepower
Threat Defense logical device, you must use Firepower Management Center. See the Firepower System
Release Notes for more information: http://www.cisco.com/c/en/us/support/security/defense-center/ products-release-notes-list.html
.
Also, note that any updates to the Firepower Threat Defense logical device will not be reflected on the
Logical Devices
>
Edit
and
System
>
Updates
pages in Firepower Chassis Manager. On these pages, the version shown indicates the software version (CSP image) that was used to create the Firepower Threat
Defense logical device.
Download the application image you want to use for the logical device from Cisco.com (see
Downloading
Images from Cisco.com, on page 34
) and then upload that image to the FXOS chassis (see
Uploading an
Image to the Firepower Security Appliance, on page 34
).
If you are upgrading both the Platform Bundle image and one or more Application images, you must upgrade the Platform Bundle first.
Procedure
Step 1
Choose
Logical Devices
to open the Logical Devices page.
The Logical Devices page shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.
Step 2
Click
Update Version
for the logical device that you want to update to open the
Update Image Version
dialog box.
Step 3
For the
New Version
, choose the software version to which you want to update.
Step 4
Click
OK
.
Firmware Upgrade
Use the following procedure to upgrade the firmware on your FXOS chassis.
Procedure
Step 1
Using a web browser, navigate to http://www.cisco.com/go/firepower9300-software or http://www.cisco.com/ go/firepower4100-software .
36
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
Image Management
Firmware Upgrade
The software download page for the FXOS chassis is opened in the browser.
Step 2
Find and then download the appropriate firmware package from Cisco.com to a server that you can access from the FXOS chassis.
Step 3
On the FXOS chassis, enter firmware mode: fxos-chassis #
scope firmware
Step 4
Download the FXOS firmware image to the FXOS chassis: fxos-chassis /firmware #
download image URL
Specify the URL for the file being imported using one of the following syntax:
•
ftp
://
username
@
hostname
/
path
•
scp
://
username
@
hostname
/
path
•
sftp
://
username
@
hostname
/
path
•
tftp
://
hostname
:
port-num
/
path
Step 5
To monitor the download process: fxos-chassis /firmware # show download task image_name detail
Step 6
After the download has completed, you can enter the following command to view the contents of the firmware package: fxos-chassis /firmware # show package image_name expand
Step 7
You can enter the following command to view the version number of the firmware package: fxos-chassis /firmware #
show package
This version number is used in the following step when installing the firmware package.
Step 8
To install the firmware package: a) Enter firmware-install mode: fxos-chassis /firmware #
scope firmware-install
b) Install the firmware package: fxos-chassis /firmware/firmware-install # install firmware pack-version version_number
The system will verify the firmware package and will notify you that the verification process can take several minutes to complete.
c) Enter
yes
to proceed with the verification.
After verifying the firmware package, the system will notify you that the installation process can take several minutes to complete and that the system will reboot during the update process.
d) Enter
yes
to proceed with the installation. Do not power cycle the FXOS chassis during the upgrade process.
Step 9
To monitor the upgrade process: fxos-chassis /firmware/firmware-install #
show detail
Step 10
After the installation has completed, you can enter the following commands to view the current firmware version: fxos-chassis /firmware/firmware-install #
top
fxos-chassis #
scope chassis 1
fxos-chassis /firmware #
show sup version
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
37
Image Management
Firmware Upgrade
The following example upgrades the firmware to version 1.0.10: fxos-chassis#
scope firmware
fxos-chassis /firmware #
download image tftp://10.10.10.1/fxos-k9-fpr9k-firmware.1.0.10.SPA
fxos-chassis /firmware #
show download-task fxos-k9-fpr9k-firmware.1.0.10.SPA detail
Download task:
File Name: fxos-k9-fpr9k-firmware.1.0.10.SPA
Protocol: Tftp
Server: 10.10.10.1
Port: 0
Userid:
Path:
Downloaded Image Size (KB): 2104
Time stamp: 2015-12-04T23:51:57.846
State: Downloading
Transfer Rate (KB/s): 263.000000
Current Task: unpacking image fxos-k9-fpr9k-firmware.1.0.10.SPA on primary(
FSM-STAGE:sam:dme:FirmwareDownloaderDownload:UnpackLocal) fxos-chassis /firmware #
show package fxos-k9-fpr9k-firmware.1.0.10.SPA expand
Package fxos-k9-fpr9k-firmware.1.0.10.SPA:
Images: fxos-k9-fpr9k-fpga.1.0.5.bin
fxos-k9-fpr9k-rommon.1.0.10.bin
fxos-chassis /firmware #
show package
Name Version
--------------------------------------------- ------fxos-k9-fpr9k-firmware.1.0.10.SPA
1.0.10
fxos-chassis /firmware #
scope firmware-install
fxos-chassis /firmware/firmware-install #
install firmware pack-version 1.0.10
Verifying FXOS firmware package 1.0.10. Verification could take several minutes.
Do you want to proceed? (yes/no):yes
FXOS SUP ROMMON: Upgrade from 1.0.10 to 1.0.10
FXOS SUP FPGA : Upgrade from 1.04 to 1.05
This operation upgrades SUP firmware on Security Platform.
Here is the checklist of things that are recommended before starting the install operation
(1) Review current critical/major faults
(2) Initiate a configuration backup
Attention:
The system will be reboot to upgrade the SUP firmware.
The upgrade operation will take several minutes to complete.
PLEASE DO NOT POWER RECYCLE DURING THE UPGRADE.
Do you want to proceed? (yes/no):yes
Upgrading FXOS SUP firmware software package version 1.0.10
command executed
38
Cisco FXOS Firepower Chassis Manager Configuration Guide, 2.0(1)
