Table Of Contents
Upgrading the FWSM from Release 2.x to 3.1
Backing up the Single Mode Configuration or Multiple Mode System Configuration
Backing Up a Context Configuration in Flash Memory
Backing Up a Context Configuration within a Context
Copying the Configuration from the Terminal Display
Upgrading Maintenance Software to Release 2.1(2)
Checking the Maintenance Software Release
Upgrading the Maintenance Software
Upgrading the Application Software
Upgrading Application Software from the FWSM CLI
Upgrading Application Software Using the Maintenance Partition
Removing Unused Commands from the System Configuration
Single Mode Sample Configurations
Multiple Mode Sample Configurations
Restoring the FWSM to Release 2.x
Downloading Release 2.x to the Current Application Partition
Booting Release 2.x from the Backup Application Partition
Installing Release 2.x and Booting in to the Backup Application Partition
Changed and Deprecated Commands
Context-Sensitive Help Changes
Documentation Terminology Changes
Application Inspection (fixup Command)
Mixed Routed and Transparent Firewall Mode
Transparent Mode Bridge Groups
Public Key Infrastructure (PKI) Commands
Summary of Changes in the VPN Commands
Cisco Product Security Overview
Reporting Security Problems in Cisco Products
Obtaining Technical Assistance
Cisco Technical Support Website
Definitions of Service Request Severity
Obtaining Additional Publications and Information
Upgrading the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module from Release 2.x to Release 3.1
This guide describes how to upgrade from FWSM Release 2.2 or 2.3 to FWSM Release 3.1. This guide describes the features and commands that have changed or been deprecated in FWSM Release 3.1.
This guide is written for FWSM administrators with an understanding of FWSM CLI commands and features and with experience configuring the FWSM. This document includes the following sections:
•
Upgrading the FWSM from Release 2.x to 3.1
•
•
New Features
This section includes a brief summary of new features in Release 3.1. For more information on these features and the accompanying CLI commands, see the following documents:
•
•
•
FWSM Release 3.1 introduces the following new functionality and features:
•
–
–
–
–
–
•
–
–
–
–
•
–
–
•
–
–
–
–
–
–
–
•
–
–
–
–
–
–
•
–
–
–
–
–
–
–
–
•
–
–
•
–
–
–
–
–
–
–
•
–
–
–
–
•
–
–
–
–
•
–
–
–
–
–
–
–
–
–
–
–
Upgrading the FWSM from Release 2.x to 3.1
This section describes how to upgrade the FWSM to 3.1, and includes the following topics:
•
•
•
Upgrade Requirements
•
•
Table 1 Operating System and Browser Requirements for ASDM Version 5.0
Windows1
Windows 2000 (Service Pack 4) or Windows XP operating systems
Internet Explorer 6.0 with Java Plug-in 1.4.2 or 1.5.0
Note
Netscape 7.1/7.2 with Java Plug-in 1.4.2 or 1.5.0
SSL Encryption Settings—All available encryption options are enabled for SSL in the browser preferences.
Sun Solaris
Sun Solaris 8 or 9 running CDE window manager
Mozilla 1.7.3 with Java Plug-in 1.4.2 or 1.5.0
Linux
Red Hat Linux 9.0 or Red Hat Linux WS, Version 3 running GNOME or KDE
Mozilla 1.7.3 with Java Plug-in 1.4.2 or 1.5.0
1 ASDM is not supported on Windows 3.1, 95, 98, ME or Windows NT4.
Backing up the Configuration
This section describes how to back up your configuration before beginning the upgrade procedure. You might need the original configuration if you have to restore Release 2.x. See the "Restoring the FWSM to Release 2.x" section.
Note
To back up your configuration, use the following methods:
•
•
•
•
Note
Backing up the Single Mode Configuration or Multiple Mode System Configuration
In single context mode or from the system configuration in multiple mode, you can copy the startup configuration or running configuration to an external server or to the local Flash memory:
•
hostname# copy {startup-config | running-config} tftp://server[/path]/filename•
hostname# copy {startup-config | running-config} ftp://[user[:password]@]server[/path]/filename•
hostname# copy {startup-config | running-config} disk:[path/]filenameBe sure the destination directory exists. If it does not exist, first create the directory using the mkdir command.
Backing Up a Context Configuration in Flash Memory
In multiple context mode, copy context configurations that are on the local Flash memory by entering one of the following commands in the system execution space:
•
hostname# copy disk:[path/]filename tftp://server[/path]/filename•
hostname# copy disk:[path/]filename ftp://[user[:password]@]server[/path]/filename•
hostname# copy disk:[path/]filename disk:[path/]newfilenameBe sure the destination directory exists. If it does not exist, first create the directory using the mkdir command.
For example, copy the admin.cfg file to a 2_3 subdirectory:
hostname# mkdir 2_3Create directory filename [2_3]?Created dir disk:/2_3hostname# copy disk:admin.cfg disk:2_3/admin.cfgBacking Up a Context Configuration within a Context
In multiple context mode, from within a context, you can perform the following backups:
•
hostname/contexta# copy running-config startup-config•
hostname/contexta# copy running-config tftp:/server[/path]/filenameCopying the Configuration from the Terminal Display
To print the configuration to the terminal, enter the following command:
hostname# show running-configCopy the output from this command, then paste the configuration in to a text file.
Upgrading Maintenance Software to Release 2.1(2)
You must install maintenance software Release 2.1(2) or later before you upgrade to FWSM Release 3.1. The latest maintenance release also works with FWSM Release 2.x, so if you later have to restore the FWSM to Release 2.x, this procedure will not prevent it.
Note
This section includes the following topics:
•
•
Checking the Maintenance Software Release
To determine the maintenance software release, boot in to the maintenance partition and view the release by performing the following steps:
Step 1
hostname# exitLogoff[Connection to 127.0.0.31 closed by foreign host]Router#You might need to enter the exit command multiple times if you are in a configuration mode.
Step 2
•
Router# hw-module module mod_num reset cf:1•
Console> (enable) reset mod_num cf:1Step 3
•
Router# session slot number processor 1•
Console> (enable) session module_numberStep 4
Login: rootStep 5
Password:By default, the password is cisco.
The FWSM shows the version when you first log in, as in the following example:
Maintenance image version: 2.1(2)Step 6
root@localhost# show versionMaintenance image version: 2.1(2)mp.2-1-2.bin : Thu Nov 18 11:41:36 PST 2004 : integ@kplus-build-lx.cisco.comLine Card Number :WS-SVC-FWM-1Number of Pentium-class Processors : 2BIOS Vendor: Phoenix Technologies Ltd.BIOS Version: 4.0-Rel 6.0.9Total available memory: 1004 MBSize of compact flash: 123 MBDaughter Card Info: Number of DC Processors: 3Size of DC Processor Memory (per proc): 32 MB
Upgrading the Maintenance Software
To upgrade the maintenance software, perform the following steps. If you have a failover pair, upgrade the standby unit first, and then the active unit. The standby unit will become active while the formerly active unit is upgrading.
Step 1
http://www.cisco.com/pcgi-bin/tablebuild.pl/cat6000-serv-maint
Put the software on a TFTP, HTTP, or HTTPS server that is accessible from the FWSM admin context (if you are using multiple context mode).
Step 2
a.
root@localhost# logoutb.
–
Router# hw-module module mod_num reset–
Console> (enable) reset mod_numc.
–
Router# session slot number processor 1–
Console> (enable) session module_numberThe default password is cisco (see the password command). In single mode, you can configure Telnet authentication, so the username and password depends on your configuration.
Step 3
•
hostname# upgrade-mp tftp[://server[:port][/path]/filename]You are prompted to confirm the server information. If you do not supply it in the command, you can enter it in response to the prompt.
•
hostname# upgrade-mp http[s]://[user[:password]@]server[:port][/path]/filenamePasswords for the root and guest accounts of the maintenance partition are retained after the upgrade.
The following example shows the prompts for the TFTP server information:
hostname# upgrade-mp tftpAddress or name of remote host [127.0.0.1]? 10.1.1.5Source file name [cdisk]? mp.2-1-0-3.bin.gzcopying tftp://10.1.1.5/mp.2-1-0-3.bin.gz to flash[yes|no|again]? yes!!!!!!!!!!!!!!!!!!!!!!!Received 1695744 bytes.Maintenance partition upgraded.Step 4
hostname# reloadAlternatively, you can log out of the FWSM in preparation for booting in to the maintenance partition; from the maintenance partition, you can install application software to both application partitions. To end the FWSM session, enter the following command:
hostname# exitLogoff[Connection to 127.0.0.31 closed by foreign host]Router#You might need to enter the exit command multiple times if you are in a configuration mode.
See the "Downloading Application Software Using the Maintenance Partition" section on page 12 to reload the FWSM into the maintenance partition.
Upgrading the Application Software
To upgrade the FWSM application software, use one of the following methods:
•
The benefit of this method is you do not have to boot in to the maintenance partition; instead you log in as usual and copy the new software.
This method supports downloading from a TFTP, FTP, HTTP, or HTTPS server.
You cannot copy software to the other application partition. You might want to copy to the other partition if you want to keep the old version of software as a backup in the current partition.
You must have an operational configuration with network access. For multiple context mode, you need to have network connectivity through the admin context.
•
The benefit of this method is you can copy software to both application partitions, and you do not have to have an operational network on the application configuration. You just need to configure some routing parameters in the maintenance partition so you can reach the server on VLAN 1. For example, you can leave Release 2.x on one partition and install 3.1 on the other partition, in case you need to restore the FWSM to 2.x.
The disadvantage is that you need to boot in to the maintenance partition, which might not be convenient if you have active connections.
This method supports downloading from an FTP server only.
Note
The running activation key is not validThis cosmetic issue can be ignoredl; the FWSM is not affected.
Upgrading Application Software from the FWSM CLI
When you log in to the FWSM during normal operation, you can copy the application software to the current application partition from a TFTP, FTP, HTTP, or HTTPS server.
Note
To upgrade software to the current application partition from an FTP, TFTP, or HTTP(S) server, perform the following steps:
Step 1
hostname# ping ip_addressStep 2
•
hostname# copy tftp://server[/path]/filename flash:The flash keyword refers to the application partition on the FWSM. You can only copy an image and ASDM software to the flash partition. Configuration files are copied to the disk partition.
•
hostname# copy ftp://[user[:password]@]server[/path]/filename flash:•
hostname# copy http[s]://[user[:password]@]server[:port][/path]/filename flash:For example, to copy the application software from an FTP server, enter the following command:
hostname# copy ftp://10.94.146.80/tftpboot/bnair/cdisk flash:copying ftp://10.94.146.80/tftpboot/bnair/cdisk to flash:!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!Received 6128128 bytes.Erasing current image.This may take some time..Writing 6127616 bytes of image.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!Image installed.Step 3
•
hostname# reloadProceed with reload? [confirm]At the `Proceed with reload?' prompt, press Enter to confirm the command.
Rebooting...•
a.
secondary(config)# write memoryThe saved configuration will load when you restart the secondary unit. This step is useful if the primary unit fails to start up correctly.
For multiple context mode, if the primary unit has context configurations in Flash memory, be sure to enter the write memory command in each primary unit context; the context will automiticallly be copied to the secondary unit Flash memory.
b.
primary(config)# reloadProceed with reload? [confirm]At the `Proceed with reload?' prompt, press Enter to confirm the command.
Rebooting...secondary(config)# reloadProceed with reload? [confirm]While the units reload, all active connections are terminated. We recommend reloading both units at the same time because if both units are running, and the major version number does not match (2.x vs. 3.1), then both units become active. Two active units can cause networking problems.
After the upgrade to FWSM Release 3.1 is completed, the startup configuration will still be a Release 2.x configuration, but the running configuration will be the newly migrated 3.1 configuration. Once the FWSM is running the 3.1 image, you can no longer enter the Release 2.x commands.
Until you save the new configuration to Flash memory, the software will convert the old startup configuration automatically every time the FWSM reboots.
Step 4
hostname# write memoryIn multiple context mode, enter the new write memory all command from the system execution space. This command saves all context configurations to which the FWSM has write access.
If the context configurations are on an HTTP/HTTPS server, or you otherwise do not have write access, use the show running-config command for each context and copy the new configuration so you can later update the context configuration on the server.
Upgrading Application Software Using the Maintenance Partition
You must install maintenance software Release 2.1(2) before you upgrade to FWSM Release 3.1.
If you log in to the maintenance partition, you can install application software to either application partition (cf:4 or cf:5).
Note
To install application software from an FTP server while logged in to the maintenance partition, perform the following steps.
Note
Step 1
Step 2
hostname# exitLogoff[Connection to 127.0.0.31 closed by foreign host]Router#You might need to enter the exit command multiple times if you are in a configuration mode.
Step 3
•
Router# show boot device [mod_num]For example:
Router# show boot device[mod:1 ]:[mod:2 ]:[mod:3 ]:[mod:4 ]: cf:4[mod:5 ]: cf:4[mod:6 ]:[mod:7 ]: cf:4[mod:8 ]:[mod:9 ]:•
Console> (enable) show boot device mod_numFor example:
Console> (enable) show boot device 4Device BOOT variable = cf:4Step 4
•
Router(config)# boot device module mod_num cf:{4 | 5}•
Console> (enable) set boot device cf:{4 | 5} mod_numStep 5
•
Router# hw-module module mod_num reset cf:1•
Console> (enable) reset mod_num cf:1Step 6
•
Router# session slot number processor 1•
Console> (enable) session module_numberStep 7
Login: rootPassword:By default, the password is cisco.
Step 8
a.
root@localhost# ip address ip _address netmaskThis address is the address for VLAN 1, which is the only VLAN used by the maintenance partition.
b.
root@localhost# ip gateway ip_addressc.
root@localhost# ping ftp_addressStep 9
root@localhost# upgrade ftp://[user[:password]@]server[/path]/filename cf:{4 | 5}cf:4 and cf:5 are the application partitions on the FWSM. Install the new software to the backup partition.
Follow the screen prompts during the upgrade.
Step 10
root@localhost# logoutStep 11
•
Router# hw-module module mod_num reset•
Console> (enable) reset mod_numStep 12
•
Router# session slot number processor 1•
Console> (enable) session module_numberBy default, the password to log in to the FWSM is cisco (set by the password command). If this partition does not have a startup configuration, the default password is used.
Step 13
hostname> enableThe default password is blank (set by the enable password command). If this partition does not have a startup configuration, the default password is used.
Step 14
•
hostname# write memory•
hostname# copy tftp://server[/path]/filename startup-config•
hostname# copy ftp://[user[:password]@]server[/path]/filename startup-config•
hostname# copy http[s]://[user[:password]@]server[:port][/path]/filename startup-configStep 15
hostname# configuration terminalhostname(config)# mode multipleWARNING: This command will change the behavior of the deviceWARNING: This command will initiate a RebootProceed with change mode? [confirm]Confirm to reload the FWSM.
Note
Step 16
hostname# reloadAfter you reload, the startup configuration will still be a Release 2.x configuration, but the running configuration will be the newly migrated 3.1 configuration. Once the FWSM is running the 3.1 image, you can no longer enter the Release 2.x commands.
Until you save the new configuration to Flash memory, the software will convert the old startup configuration automatically every time the FWSM reboots.
Step 17
hostname# write memoryIn multiple context mode, enter the write memory all command from the system execution space. This command saves all context configurations to which the FWSM has write access.
If the context configurations are on an HTTP/HTTPS server, or you otherwise do not have write access, use the show running-config command for each context and copy the new configuration so you can later update the context configuration on the server.
Removing Unused Commands from the System Configuration
Most commands are converted automatically when you load Release 3.1. Some deprecated commands are left in your configuration so you can decide how to manage the changes. For example, you can no longer configure any logging commands in the system execution space. Instead, system messages (including failover messages) are output to the admin context. However, logging commands are not automatically removed from the system configuration.
When the FWSM loads deprecated commands, you see error messages; however, they do not affect the running of your configuration. To clean up your configuration, perform the following steps:
Step 1
hostname# show startup-config errorsStep 2
Upgrading from PDM to ASDM
To upgrade from PDM 4.x to ASDM 5.0F, which runs with application software Release 3.1, see the Cisco ASDM Release Notes.
Upgrade Examples
This section includes sample Release 2.3 configurations and converted Release 3.1 configurations. This section contains the following topics:
•
•
Single Mode Sample Configurations
The following is sample output from the show version command for a system running FWSM Release 2.3 before upgrading to FWSM Release 3.1:
hostname(config)# show versionFWSM Firewall Version 2.3(2)9Compiled on Thu 14-Jul-05 01:30 by daleckiFWSM up 28 mins 48 secsHardware: WS-SVC-FWM-1, 1024 MB RAM, CPU Pentium III 1000 MHzFlash V1.01 SMART ATA FLASH DISK @ 0xc321, 20MB0: gb-ethernet0: irq 51: gb-ethernet1: irq 72: ethernet0: irq 11Licensed Features:Failover: EnabledVPN-DES: EnabledVPN-3DES: EnabledMaximum Interfaces: 256Cut-through Proxy: EnabledGuards: EnabledURL-filtering: EnabledThroughput: UnlimitedISAKMP peers: UnlimitedSecurity Contexts: 2This machine has an Unrestricted (UR) license.Serial Number: SAD062302U5Running Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000Configuration last modified by enable_15 at 06:36:55 Aug 24 2005Table 2 shows the unmodified startup configuration and the converted running configuration after upgrading to Release 3.1.
The following is sample output from the show version command for a system after upgrading to FWSM Release 3.1:
hostname(config)# show versionFWSM Firewall Version 3.1(0)78Compiled on Tue 23-Aug-05 23:54 by bnairFWSM up 20 mins 17 secsHardware: WS-SVC-FWM-1, 1024 MB RAM, CPU Pentium III 1000 MHzFlash SMART ATA FLASH DISK @ 0xc321, 20MBDisk Partition: ATA Compact Flash, 57MB0: Int: Not licensed : irq 51: Int: Not licensed
Guest
