Home > Articles > FTD on ASA 5500-X Series Hardware

FTD on ASA 5500-X Series Hardware

Chapter Description

In this sample chapter from Cisco Firepower Threat Defense (FTD): Configuration and Troubleshooting Best Practices for the Next-Generation Firewall, Next-Generation Intrusion Prevention System, and Advanced Malware Protection, review the steps required to reimage and troubleshoot any Cisco ASA 5500-X Series hardware.

Verification and Troubleshooting Tools

This section describes the commands you can use to verify the status of ASA hardware before and after the FTD software is installed.

Navigating to the FTD CLI

After a reboot following a successful installation of FTD software, your ASA hardware should automatically display the > prompt. This prompt is different from the traditional prompt ciscoasa> that you see on classic software running on ASA hardware. Furthermore, when ASA hardware runs the FTD software, you can enter various consoles or shells, including the following:

  • FTD default shell: You can configure most of the necessary items and view their status by using this shell.

  • ASA console: This console allows you to perform advanced commands for diagnostic purposes.

  • Firepower Linux shell: This shell lets you enter the back end of the operating system and is used by Cisco for advanced troubleshooting.

Figure 2-10 shows different types of consoles and command prompts of an ASA running the FTD software.

Figure 2-10

Figure 2-10 Command Prompts on ASA Hardware Running FTD Software

Example 2-26 shows the commands that allow you to navigate various modes of an FTD CLI.

Example 2-26 Commands to Connect to the Various Shells of the FTD CLI

>

! The > prompt confirms that you are on the FTD default shell. Run the following
  command to connect to the ASA console:

> system support diagnostic-cli
Attaching to ASA console ... Press 'Ctrl+a then d' to detach.
Type help or '?' for a list of available commands.

firepower>

! Now you have entered the ASA console. Run the enable command to enter the
  privilege exec mode.

firepower> enable
Password:
firepower# exit

Logoff
Type help or '?' for a list of available commands.

firepower>

! If you want to quit from the ASA console, the exit command logs you off from the
  ASA console, but does not let you return to the FTD default shell. To disconnect
  from the ASA console, press the Ctrl+a keys together, then press d separately.

firepower>

Console connection detached.
>

! To connect to the Firepower Linux shell, run the expert command. To return to the
  FTD default shell, run the exit command.

>  expert
admin@firepower:~$ exit
logout
>

Determining the Version of Installed Software

From the default command prompt > in FTD, you can determine what FTD software version is running on ASA hardware.

Example 2-27 shows ASA 5506-X hardware running FTD Version 6.1.0.

Example 2-27 Finding the Software Version Running on an ASA After a Fresh FTD Installation

> show version

-------------------[ firepower ]--------------------
Model                     : Cisco ASA5506-X Threat Defense (75) Version 6.1.0
    (Build 330)
UUID                      : c84ceb32-7ea7-11e6-a7ad-94bcd8f36790
Rules update version      : 2016-03-28-001-vrt
VDB version               : 270
----------------------------------------------------

>

Determining the Free Disk Space on ASA Hardware

Before you install FTD on ASA hardware, you must check whether the currently available space is sufficient. To do so, you can run one of the following commands on your ASA software in privileged exec mode:

ciscoasa# dir
ciscoasa# show flash:

Example 2-28 shows the amount of free space on the same ASA hardware from two different command outputs. The shaded portion of the example shows that the ASA hardware has free space of 4544851968 bytes, which is equal to 4438332 KB, or 4334.3 MB, or 4.23 GB. The first command output uses disk0: to indicate internal flash memory. If there were external flash memory, it would be denoted by disk1:.

Example 2-28 Finding the Amount of Free Space on ASA Hardware

ciscoasa# dir

Directory of disk0:/

88     -rwx  91290240     11:04:08 May 12 2016  asa961-50-lfbff-k8.spa
89     -rwx  63           16:25:14 Sep 19 2016  .boot_string
11     drwx  4096         12:14:22 May 12 2016  log
19     drwx  4096         12:15:12 May 12 2016  crypto_archive
20     drwx  4096         12:15:16 May 12 2016  coredumpinfo

7859437568 bytes total (4544851968 bytes free)

ciscoasa#

ciscoasa# show flash:

--#--  --length--  -----date/time------  path
   88  91290240    May 12 2016 11:04:08  asa961-50-lfbff-k8.spa
   89  63          Sep 19 2016 16:25:14  .boot_string
   11  4096        May 12 2016 12:14:22  log
   13  0           May 12 2016 12:14:22  log/asa-appagent.log
   19  4096        May 12 2016 12:15:12  crypto_archive
   20  4096        May 12 2016 12:15:16  coredumpinfo
   21  59          May 12 2016 12:15:16  coredumpinfo/coredump.cfg

7859437568 bytes total (4544851968 bytes free)

ciscoasa#

Deleting a File from a Storage Device

When you want to delete a file to free up disk space, run the following command in the privileged exec mode:

ciscoasa# delete flash:/filename

Example 2-29 shows the command to delete a file named output.txt.

Example 2-29 Deleting a File from ASA Hardware

ciscoasa# delete flash:/output.txt

Determining the Availability of Any Storage Device or SSD

From the CLI, you can determine the type of a storage device that is installed on an ASA. Example 2-30 shows that the ASA 5506-X hardware has one SSD installed.

Example 2-30 Viewing the Storage Device Information on ASA 5500-X Series Hardware

ciscoasa# show inventory
Name: "Chassis", DESCR: "ASA 5506-X with FirePOWER services, 8GE, AC, DES"
PID: ASA5506           , VID: V01     , SN: JMX1916Z07V

Name: "Storage Device 1", DESCR: "ASA 5506-X SSD"
PID: ASA5506-SSD       , VID: N/A     , SN: MSA190600NE

ciscoasa#

Example 2-31 shows ASA 5545-X hardware with two storage devices.

Example 2-31 Determining the List of Storage Devices on ASA 5500-X Series Hardware

ciscoasa# show inventory
Name: "Chassis", DESCR: "ASA 5545-X with SW, 8 GE Data, 1 GE Mgmt"
PID: ASA5545           , VID: V02     , SN: FTX1841119Z

Name: "power supply 0", DESCR: "ASA 5545-X/5555-X AC Power Supply"
PID: ASA-PWR-AC        , VID: N/A     , SN: 47K1E0

Name: "Storage Device 1", DESCR: "Model Number: Micron_M550_MTFDDAK128MAY"
PID: N/A               , VID: N/A     , SN: MXA183502EG

Name: "Storage Device 2", DESCR: "Model Number: Micron_M550_MTFDDAK128MAY"
PID: N/A               , VID: N/A     , SN: MXA183502FW

ciscoasa#

Table 2-2 summarizes the default availability of SSDs in various ASA 5500-X Series hardware. It also shows whether an SSD is hot-swappable on a particular model in case of a failure.

Table 2-2 Availability and Replacement of SSD on ASA 5500-X Series Hardware

ASA 5500-X Series Models Availability of SSD Hot-Swappable?
5506-X, 5506W-X, 5506H-X Comes with an SSD. No.
5508-X, 5516-X Comes with an SSD. Yes, requires a screwdriver.
5512-X, 5515-X, 5525-X Might not come with an SSD, if not ordered separately. You can install one Cisco SSD. Yes, easy to hot-swap. A button is available to push and release the locking lever.
5545-X, 5555-X Might not come with an SSD, if not ordered separately. You can install up to two Cisco SSDs with RAID 1.

Determining the Version of the ROMMON Software or Firmware

The version information for the ROMMON software (also known as firmware) is displayed during the bootup process for ASA 5500-X hardware. Example 2-32 shows the initial messages that appear after ASA 5506-X hardware is turned on. It shows that the ROMMON version is 1.1.01.

Example 2-32 Messages That Appear During the Bootup Process

Cisco Systems ROMMON, Version 1.1.01, RELEASE SOFTWARE
Copyright (c) 1994-2014  by Cisco Systems, Inc.
Compiled Mon 10/20/2014 15:59:12.05 by builder

Current image running: Boot ROM0
Last reset cause: PowerCycleRequest
DIMM Slot 0 : Present

Platform ASA5506 with 4096 Mbytes of main memory
MAC Address: a4:6c:2a:e4:6b:bf
Using default Management Ethernet Port: 0

Use BREAK or ESC to interrupt boot.
Use SPACE to begin boot immediately.

Located '.boot_string' @ cluster 1607965.
#
Attempt autoboot: "boot disk0:/asa961-50-lfbff-k8.spa"
Located 'asa961-50-lfbff-k8.spa' @ cluster 10.
##################################################################################
##################################################################################
##################################################################################
#######################################

LFBFF signature verified.
INIT: version 2.88 booting
Starting udev
Configuring network interfaces... done.

If ASA hardware is running in a production environment, and you do not want to reboot it, you can still determine the version of the ROMMON software by running the show module command. Example 2-33 shows that the ROMMON version of the ASA 5506-X hardware is 1.1.01.

Example 2-33 Command That Displays the ROMMON Software Version of an ASA

ciscoasa# show module

Mod  Card Type                                    Model              Serial No.
---- -------------------------------------------- ------------------ -----------
   1 ASA 5506-X with FirePOWER services, 8GE, AC, ASA5506            JAD191100HG
 sfr Unknown                                      N/A                JAD191100HG

Mod  MAC Address Range                 Hw Version   Fw Version   Sw Version
---- --------------------------------- ------------ ------------ ---------------
   1 a46c.2ae4.6bbf to a46c.2ae4.6bc8  1.0          1.1.1        9.6(1)50
 sfr a46c.2ae4.6bbe to a46c.2ae4.6bbe  N/A          N/A

Mod  SSM Application Name           Status           SSM Application Version
---- ------------------------------ ---------------- --------------------------

Mod  Status             Data Plane Status     Compatibility
---- ------------------ --------------------- -------------
   1 Up Sys             Not Applicable
 sfr Init               Not Applicable

ciscoasa#

There are currently no related articles. Please check back later.