Configure ASA 9.X Upgrade of a Software Image by Use of ASDM or CLI Configuration Example

Introduction

This document describes how to upgrade a software image on the Cisco ASA 5500 Appliances with the Cisco Adaptive Security Device Manager.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on these software and hardware versions:

• Cisco ASA 5500 and ASA 5500-X 9.1(2) and later

• Cisco ASDM 7.1 and later

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Related Products

This configuration can also be used with Cisco ASA 5500-X Series Security Appliance Software Version 9.x.

Conventions

Refer to the Cisco Technical Tips Conventions for more information on document conventions.

Download Software

To download the required release version of ASA Software images and ASDM Software images, use these links:

• Cisco ASA Software Release Download (registered customers only)

• Cisco ASDM Software Release Download (registered customers only)

Note: Valid Cisco user credentials are needed to download this software from Cisco.com.

Compatibility Between ASA and ASDM

The link shown is updated with the compatibility and Cisco-recommended ASDM release for each version of ASA.

ASA and ASDM Compatibility

ASA Upgrade Path

The link shown provides the upgrade path for ASA. Some versions require an interim upgrade before you can upgrade to the latest version.

ASA Upgrade Path

Upgrade an ASA Software Image with the Use of ASDM 7.x

Complete these steps to upgrade a software image on the ASA 5500 with the use of ASDM.

1. When ASA is in Single context mode, select Tools > Upgrade Software from Local Computer... from the Home window of the ASDM.

When ASA is run in Multiple context mode, the Upgrade Software from Local Computer option under the Tools menu tab is available only from System context.

2. Select ASA as the image type to upload from the drop-down list.

3. Click Browse Local Files... or type the path in the Local File Path field to specify the software image location on the PC.

4. Click Browse Flash....

5. A Browse Flash dialog box displays, with the file name entered automatically. If the file name does not appear, enter it manually in the File Name field. Click OK when finished.



6. Once both the local and remote file names are specified, click Upload Image.

7. A status window displays while ASDM writes the image to flash. Once finished, an Information window displays that indicates a successful upload occurred and asks if the image is to be set as the boot image. Select Yes.

Click OK in the Information dialog box and then click Close in the Upload Image from Local PC dialog box. 

8. Choose Tools > System Reload from the Home window to reload the device.

A new window appears that verifies the details of the reload. Select Save the running configuration at the time of reload and then choose a time to reload. Time choices include:

• Now— Reboot the device immediately.
• Delay By— Specify in how many minutes or hours from now to reload the device.
• Schedule at— Specify a time and date to reload the device.

Additionally, specify if the device is to force a reload immediately when a scheduled reload fails. Check On Reload failure, force an immediate reload after and then specify a maximum hold time. This is the amount of time the security appliance waits to notify other subsystems before a shutdown or reboot. After this time elapses, a quick (forced) shutdown/reboot occurs. Click Schedule Reload.

Once the reload is in progress, a Reload Status window displays to indicate a reload is in process. An option to exit ASDM is also provided.

Note: Start ASDM again after the ASA reloads.

Upgrade the ASDM Image with the Use of ASDM 7.x.

Complete these steps to upgrade a software image on the ASA 5500 with the one of ASDM.

1. Select Tools > Upgrade Software from Local Computer... from the Home window of the ASDM.

2. Select ASDM as the image type to upload from the drop-down list.

3. Click Browse Local Files...  or type the path in the Local File Path field to specify the software image location on the PC.

Click Browse Flash....

A Browse Flash dialog window displays with the file name entered automatically. If the file name does not display, enter it manually in the File Name field. Click OK when finished.

4. Click OK when the image is updated with the new image.

5. Select File > Save Running Configuration to Flash from the Home window of the ASDM.

Exit the ASDM and log in again to manage the ASA with the upgraded ASDM image.

Upgrade the ASA and ASDM by an Image Download Directly from CCO

Complete these steps to upgrade an ASA and ASDM image directly from CCO.

1. Select Tools > Check for ASA/ASDM Updates... from the Home window of the ASDM.

2. When the username and password prompt displays, provide the Cisco.com credentials and click Login.

3. The Cisco.com Upgrade Wizard dialog box displays. In the Overview section, click Next.



4. In the Select Software section, check the software that needs to be upgraded. If both ASA and ASDM need to be upgraded, check both options.


5. In the ASA version drop-down list, select the version to which the ASA upgrade has to be performed.

6. In the ASDM version drop-down list, select the version to which the ASDM upgrade has to be performed. Click Next when the appropriate versions have been selected.

7. In the Review Changes section, review the changes and click Next.

8. The installation of the images starts and the overall progress can be seen as shown. Once completed, click Finish.
In the Results section, check the Save configuration and reload device now option. Click Finish.

9. The Reload Status dialog box displays while the device reloads.

10. Click Exit ASDM and log in again once the device comes up after reload.

Use CLI to Upgrade a Software Image and ASDM Image

A TFTP server is required to upgrade or downgrade a software image, as well as an ASDM image for a ASA. Refer to TFTP Server Selection and Use to learn more about TFTP server selection.

The copy tftp flash command enables a software image to download into the Flash memory of the firewall by TFTP. Use the copy tftp flash command with any security appliance model. The image downloaded can now be used on the next reboot by a change of the boot system variable to point to this image.

This is the output from the copy tftp flash command:

copy tftp[:[[//location] [/tftp_pathname]]] [[flash/disk0][:[image | asdm]]]

For multiple context mode, perform these steps in the system execution space.

Note: For ASA, keyword disk0 replaces flash in the copy command.

If the command is used without the location or pathname optional parameters, then the location and filename are obtained from the user interactively by a series of questions similar to those presented by Cisco IOS® software. If only a colon is entered, parameters are taken from the tftp-server command settings. If other optional parameters are supplied, then these values are used in place of the associated tftp-server command setting. If any of the optional parameters, such as a colon and anything after it are supplied, the command runs without a prompt for user input.

The location is either an IP address or a name that resolves to an IP address by the security appliance name resolution mechanism, which is currently static mapped by the name and names commands. The security appliance must know how to reach this location by its routing table information. This information is determined by the IP address, the route, or the RIP commands. This depends on your configuration.

The pathname can include any directory names besides the actual last component of the path to the file on the server. The pathname cannot contain spaces. If a directory name has spaces, set to the directory in the TFTP server instead of in the copy tftp flash command. And if your TFTP server is configured to point to a directory on the system from which you download the image, only use the IP address of the system and the image filename. The TFTP server receives the command and determines the actual file location from its root directory information. The server then downloads the TFTP image to the security appliance.

These commands are needed to upgrade the software image, as well as the ASDM image, and make it as a boot image at the next reload.

ASA#copy tftp [[flash:/disk0:][software image name/asdm image name]]

!--- Command to set an image as bootup or specify the 
!--- ASDM image file. 

ASA(config)#boot system [flash:/disk0:]/[software image name]

!--- Save active configuration to the Flash.

ASA#write memory

!--- Reboot the security appliance and load 
!--- with the new boot image as per the configuration file.

ASA#reload

Example:

ASA-5512# copy tftp: disk0:

Address or name of remote host []? 172.16.31.1
Source filename []? asa916-smp-k8.bin
Destination filename [asa916-smp-k8.bin]?
Accessing tftp://172.16.31.1/asa916-smp-k8.bin...!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Writing file disk0:/asa916-smp-k8.bin...
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
38043648 bytes copied in 32.290 secs (1188864 bytes/sec)

ASA-5512# sh disk0
--#--  --length--  -----date/time------  path
  191  38191104    Nov 21 2014 21:07:48  asa912-smp-k8.bin
  192  17906032    Apr 08 2015 22:33:44  asdm-713.bin
  193  26350916    Apr 09 2015 06:28:20  asdm-741.bin
  194  38043648    May 10 2015 02:14:06  asa916-smp-k8.bin

4118732800 bytes total (3556712448 bytes free)


!--- Command to set "asa916-smp-k8.bin" as the boot image.

ASA-5512(config)# boot system disk0:/asa916-smp-k8.bin

!--- Command to set "asdm-741.bin" as the ASDM image.

ASA-5512(config)# asdm image disk0:/asdm-741.bin
ASA-5512# write memory
ASA-5512# reload

Note: When you try to upgrade the image on the ASA from an FTP server, use the copy ftp flash command. This command allows parameters, such as  remote IP address and source file name to be specified. This procedure is similar to TFTP. However, one limitation is that you cannot modify the remote IP/source interface (like you can with TFTP). In TFTP mode, options specified with the tftp-server command can be pulled and executed. But with FTP, there is no such option. By default, the source interface is always the outside, which cannot be modified. That is, the FTP server is reachable from the outside interface.

Verify

Use this section to confirm the software upgrade was successful.

The Cisco CLI Analyzer (registered customers only) supports certain show commands. Use the Cisco CLI Analyzer to view an analysis of the show command output.

After the ASA reloads and successfully logged into ASDM again, verify the version of the image that runs on the device. See the General tab on the Home window for this information.

These CLI commands are used to verify the upgrade:

1. Show version — This shows the current image with which the ASA is booted.
2. Show bootvar — This shows the priority of the image to be used after reload.
3. Show asdmimage — This shows the current ASDM image used by the ASA.

Troubleshoot

There is currently no specific information available to troubleshoot this configuration.

Related Information

• Release Notes
• Cisco ASA New Features by Release
• Cisco ASA Compatibility
• Planning Your Upgrade
• Upgrade an Active/Standby Failover Configuration