ASA Upgrading and Imaging a Hardware CX Module

KB ID 0001025 Dtd 20/01/15


Last time I had to do one of these the process was very straight forward, one command and the ASA got its new image from FTP, extracted it, and then installed it.

ASA CX Module

I had a CX module fail last week, and Cisco shipped me out a replacement. After installing it and running the setup, I needed to upgrade it (it will be managed by PRSM). It was running version 9.0.2 (probably been on the shelf a while!). And every time I tried to run a system upgrade it told me this, (regardless of what version I tried to install).

This package is not applicable to release 9.0.2.

If I tried to set a boot image in the ASA, I got the following errors;

Module 1 cannot be recovered.


ERROR: Module in slot 1 does not support recovery

Well there is a boot image especially for the 5585-X CX module, so how do you use it?


Remember the ASA-SSP-CX unit is basically the same hardware as the ASA, you need to boot that card to ROMMON, then install the boot image via TFTP. Once that’s loaded you can run setup and install the new software package.

1. As you can see this one’s running a very old OS.

Petes-CX>show version

Cisco ASA CX Platform 9.0.2 (103)

Cisco Prime Security Manager 9.0.2 (103) for Petes-CX firewall


2. Reload the module and as it starts to boot, send a ‘break’ keystroke.

Petes-CX>system reload Are you sure you want to reload the system? [N]: y Broadcast message from root (console) (Mon Jan 19 14:47:09 2015): The system is going down for reboot NOW! INIT: SwitchingStopping OpenBSD Secure Shell server: sshdstopped /usr/sbin/sshd (pid 3862) . Stopping Advanced Configuration and Power Interface daemon: no /usr/sbin/acpid found; none killed stopping Busybox inetd: inetd… stopped inetd (pid 3875) done. Stopping Vixie-cron. Stopping ntpd: stopped process in pidfile ‘/var/run/’ (pid 3880) done Stopping syslogd/klogd: done Deconfiguring network interfaces… done. Stopping CGroup Rules Engine Daemon…stopped /usr/sbin/cgrulesengd (pid 3865)

Success CGRE[3865]: Stopped CGroup Rules Engine Daemon at Mon Jan 19 14:47:13 2015 Stopping cgconfig service: Success Sending all processes the TERM signal… Sending all processes the KILL signal… Unmounting remote filesystems… Deactivating swap… Unmounting local filesystems… umount2: Device or resource busy —————————————— –Output Removed for the Sake of Brevity– ——————————————

The system is restarting…


Embedded BIOS Version 2.0(13)0 20:40:45 10/21/11

USB storage device found … SMART eUSB USB Device

Total memory : 12 GB

Total number of CPU cores : 8

CPLD revision 0008h Cisco Systems ROMMON Version (2.0(13)0) #0: Fri Oct 21 20:01:34 CDT 2011

Use BREAK or ESC to interrupt boot.Use SPACE to begin boot immediately.Boot in 10 seconds. Boot interrupted.

Management0/0 Link is UP MAC Address: 6c20.5658.928c

Use ? for help. rommon #0>

3. Remember in ROMMON mode you need to set up all the network settings to copy in the boot image (where will be the CX,and .101 is the TFTP server).

Note: This is the BOOT image, it will have a .img file extension.

rommon #0> ADDRESS= rommon #1> SERVER= rommon #2> GATEWAY= rommon #3> IMAGE=asacx-boot- rommon #4>

4. Make sure you can ping the TFTP server.

rommon #4> ping Sending 20, 100-byte ICMP Echoes to, timeout is 4 seconds: !!!!!!!!!!!!!!!!!!!! Success rate is 100 percent (20/20)

5. Issue a sync command, then start the transfer.

rommon #5> sync

Updating NVRAM Parameters…

rommon #6> tftp ROMMON Variable Settings: ADDRESS= SERVER= GATEWAY= PORT=Management0/0 VLAN=untagged IMAGE=asacx-boot- CONFIG= LINKTIMEOUT=20 PKTTIMEOUT=4 RETRY=20

tftp asacx-boot- via !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

—————————————— –Output Removed for the Sake of Brevity– —————————————— !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Received 65605385 bytes

Launching TFTP Image…

Execute image at 0x14000 [STUB] Boot protocol version 0x209

—————————————— –Output Removed for the Sake of Brevity– ——————————————

Starting syslogd/klogd: done Cisco ASA CX Boot Image

Petes-CX login: admin Password: ************

Cisco ASA CX Boot (9) Type ? for list of commands Petes-CX-boot>

WARNING the following procedure will erase all the settings from your CX module

6. Partition the CX module drive. (This takes a long time, good time to put the kettle on!)

Petes-CX-boot>partition WARNING: You are about to erase all policy configurations and data. You cannot undo this action. Are you sure you want to proceed? [y/n]:y Logical volume "data" successfully removed Logical volume "var" successfully removed Logical volume "packages" successfully removed

—————————————— –Output Removed for the Sake of Brevity– ——————————————

Persistent partition is there so create symbolic link /etc/ntp.conf Persistent partition is there so create symbolic link /etc/hosts Petes-CX-boot>

7. Run the basic setup.


Welcome to Cisco Prime Security Manager Setup [hit Ctrl-C to abort] Default values are inside []

Enter a hostname [asacx]: Petes-CX Do you want to configure IPv4 address on management interface?(y/n) [Y]: Y Do you want to enable DHCP for IPv4 address assignment on management interface?(y/n) [N]: N Enter an IPv4 address []: Enter the netmask []: Enter the gateway []: Do you want to configure static IPv6 address on management interface?(y/n) [N]: N Stateless autoconfiguration will be enabled for IPv6 addresses. Enter the primary DNS server IP address: Do you want to configure Secondary DNS Server? (y/n) [n]: Y Enter the secondary DNS server IP address: Do you want to configure Local Domain Name? (y/n) [n]: Y Enter the local domain name: Do you want to configure Search domains? (y/n) [n]: Y Enter the comma separated list for search domains: Do you want to enable the NTP service? [Y]: Y Enter the NTP servers separated by commas:, Do you want to enable the NTP symmetric key authentication? [N]: N Please review the final configuration: Hostname:Petes-CX Management Interface Configuration

IPv4 Configuration:static IP Address: Netmask: Gateway:

IPv6 Configuration:Stateless autoconfiguration

DNS Configuration: Search: DNS Server:

NTP configuration:, CAUTION: You have selected IPv6 stateless autoconfiguration, which assigns a global address based on network prefix and a device identifier. Although this address is unlikely to change, if it does change, the system will stop functioning correctly. We suggest you use static addressing instead.

Apply the changes?(y,n) [Y]: Y Configuration saved successfully! Applying… Restarting network services… Restarting NTP service… Done. Press ENTER to continue… Petes-CX-boot>

8. You can now upgrade the CX module from FTP.

Note: This is the SYSTEM image, it will have a .pkg extension.

Petes-CX-boot>system install Verifying.. Downloading.. Extracting.. Package Detail Description:Cisco ASA-CX System Upgrade Requires reboot:Yes

Do you want to continue with upgrade? [y]: y

Warning: Please do not interrupt the process or turn off the system. Doing so might leave system in unusable state.

Upgrading.. Starting upgrade process .. Populating new system image.. Copying over new application components.. Cleaning up old application components.. Reboot is required to complete the upgrade. Press ‘Enter’ to reboot the system.


Broadcast message from root (consoStopping OpenBSD Secure Shell server: sshdstopped /usr/sbin/sshd (pid 2883)

9. After the module has reloaded, log in and make sure every thing is working.

Petes-CX login: admin

    Cisco Prime Security Manager (9) for Petes-CX firewall
  Type ? for list of commands

Petes-CX>show services status
Process           | PID   | Up    | Up Time
HTTP Server       | 6139  | True  | 00:02:00
Data Plane        | 6665  | True  | 00:01:35
Opdata Helper     | 6299  | True  | 00:01:59
AD Interface      | 6674  | True  | 00:01:35
HW Regex Server   | 6572  | True  | 00:01:43
Message Nameserver| 6279  | True  | 00:01:59
HTTP Auth Daemon  | 6469  | True  | 00:01:57
Management Plane  | 6481  | True  | 00:01:57
signup            | 6347  | True  | 00:01:59
PDTS              | 6442  | True  | 00:01:59
Predictive Defense| 6679  | True  | 00:01:35
HTTP Inspector    | 6689  | True  | 00:01:35
HPM Monitor       | 6684  | True  | 00:01:35
Updater           | 7772  | True  | 00:00:19
Card Manager      | 6071  | True  | 00:02:00
ARP Daemon        | 6458  | True  | 00:01:58
Event Server      | 6512  | True  | 00:01:52
TLS Proxy         | 6719  | True  | 00:01:35


Related Articles, References, Credits, or External Links

Special thanks to Veronika Klauzova from Cisco TAC

Author: Migrated

Share This Post On