KB ID 0001766
Problem
Note: This procedure is to re-image a Cisco Firepower device from FTD to ASA code, (in this example a Cisco FPR 1010).
Why would you want to do this? Well to be frank FTD is bobbins, so if you have a device running FTD code you might want to ‘convert’ it to ASA code. If you tried to do this with an older firewall (ASA 5500-X) then you needed to go to Cisco TAC and try and get them to give you an activation code for the ASA. But if you are using an FPR device then YOU DON’T NEED TO DO THAT.
You might also want to do this because, (at time of writing) buying a Cisco FPR device running ASA code, the lead times in the UK are eye wateringly long (200-300 days!) But you can buy a chassis running FTD code and then convert that to ASA code with the following procedure.
Solution
Connect to your FPR device with a console cable, and log on as admin (the default password is Admin123, unless you have changed it of course!) Download the latest version of ASA code for your device from Cisco, in my case (at time of writing) that’s cisco-asa-fp1k.9.14.3.15.SPA. Copy that onto a USB drive (WARNING: The drive needs to be formatted with FAT32, the firewall will not recognise or mount the drive unless it is!) Finally insert the USB drive into the firewall, and issue the following commands.
[box]
FTD-1# scope firmware FTD-1 /firmware # download image usbA:/cisco-asa-fp1k.9.14.3.15.SPA Please use the command 'show download-task' or 'show download-task detail' to check download progress. FTD-1 /firmware # show download-task Download task: File Name Protocol Server Port Userid State --------- -------- --------------- ---------- --------------- ----- cisco-asa-fp1k.9.14.3.15.SPA Usb A 0 Downloading % Download-task cisco-asa-fp1k.9.14.3.15.SPA : completed successfully.
[/box]
Note: If it says, ‘failed. Download failure – USB drive is not mounted‘ the drive is probably formatted incorrectly. If it says ‘Download-task failed. Failed signature validation‘, then the image is probably corrupt, try again, or use a different version.
Verify the file has downloaded correctly.
[box]
show download-task
Download task:
File Name Protocol Server Port Userid State
--------- -------- --------------- ---------- --------------- -----
cisco-asa-fp1k.9.14.3.15.SPA
Usb A 0 Downloaded
[/box]
Then make sure the package is listed with a show package command.
[box]
FTD-1 /firmware # show package
Name Package-Vers
--------------------------------------------- ------------
cisco-asa-fp1k.9.13.1.2.SPA 9.13.1.2
cisco-asa-fp1k.9.14.3.15.SPA 9.14.3.15
cisco-ftd-fp1k.6.6.0-90.SPA 6.6.0-90
[/box]
Note: You can see (above) there’s an ASA code version from a previous install and it shows the current running FTD code also. To re-image the firewall execute the following commands. (Note: you enter the VERSION NOT THE FILENAME!)
[box]
FTD-1 /firmware # scope auto-install FTD-1 /firmware/auto-install # install security-pack version 9.14.3.15 The system is currently installed with security software package 6.6.0-90, which has: - The platform version: 2.8.1.105 - The CSP (ftd) version: 6.6.0.90 If you proceed with the upgrade 9.14.3.15, it will do the following: - upgrade to the new platform version 2.8.1.172 During the upgrade, the system will be reboot Do you want to proceed ? (yes/no):yes {Enter} This operation upgrades firmware and software on Security Platform Components Here is the checklist of things that are recommended before starting Auto-Install (1) Review current critical/major faults (2) Initiate a configuration backup Do you want to proceed? (yes/no):yes {Enter} Triggered the install of software package version 9.14.3.15 Install started. This will take several minutes. For monitoring the upgrade progress, please enter 'show' or 'show detail' command. FTD-1 /firmware/auto-install #
[/box]
Now go and have a coffee, it will take 20 minutes, and a few reboots before it’s finished. When completed you should see a login prompt, login with admin/Admin123 and reset the password.
[box]
firepower-1010 login: admin Password: Admin123 Successful login attempts for user 'admin' : 1 Last failed login: Sun Nov 21 16:55:16 UCT 2021 on ttyS0 There was 1 failed login attempt since the last successful login. Hello admin. You must change your password. Enter new password: password123 Confirm new password: password123 Your password was updated successfully.
[/box]
Then connect to the ASA CLI with the connect asa command. Go to enable mode, and set the enable password. Finally, save the config.
[box]
firepower-1010# connect asa firepower-1010# Verifying signature for cisco-asa.9.14.3.15 ... Verifying signature for cisco-asa.9.14.3.15 ... success ciscoasa> ciscoasa> enable The enable password is not set. Please set it now. Enter Password: password123 Repeat Password: password123 Note: Save your configuration so that the password can be used for FXOS failsafe access and persists across reboots ("write memory" or "copy running-config startup-config"). ciscoasa# write memory Building configuration... Cryptochecksum: a607255a a64f2898 97bb6b40 9a8ff25c
[/box]
You will now be running ASA code with the factory settings (Inside 192.168.1.1/24, Management 192.168.45.1/24 (with DHCP enabled), Outside set to get IP dynamically, and all traffic allowed out).
Remember if you’re a ‘light weight’ and cant use command line, then you will need to install and configure the ASDM 🙂