简介

本文档介绍在升级因小型Nextroot分区而失败时更换vESA和vSMA的过程。 

背景信息

最初，虚拟邮件安全设备(vESA)和虚拟安全管理设备(vSMA)映像是使用小于500 MB的下一根分区大小构建的。多年来，随着包含其他功能的较新AsyncOS版本的推出，升级在整个升级过程中需要此分区中有更多空间。由于此分区大小，升级可能会失败。本文档提供有关解决方案的详细信息，即使用4-GB Nextroot分区部署新的虚拟映像。 

ESA的相关缺陷：Cisco Bug ID CSCvy69068和SMA:Cisco Bug ID CSCvy69076

症状

如果Nextroot分区大小小于500M的旧映像vESA或vSMA无法升级，则会看到这些错误。 

...
...
...
Finding partitions... done.
Setting next boot partition to current partition as a precaution... done.
Erasing new boot partition... done.
Extracting eapp done.
Extracting scanerroot done.
Extracting splunkroot done.
Extracting savroot done.
Extracting ipasroot done.
Extracting ecroot done.
Removing unwanted files in nextroot done.
Extracting distroot
/nextroot: write failed, filesystem is full
./usr/share/misc/termcap: Write failed
./usr/share/misc/pci_vendors: Write to restore size failed
./usr/libexec/getty: Write to restore size failed
./usr/libexec/ld-elf.so.1: Write to restore size failed
./usr/lib/libBlocksRuntime.so: Write to restore size failed
./usr/lib/libBlocksRuntime.so.0: Write to restore size failed
./usr/lib/libalias.so: Write to restore size failed
./usr/lib/libarchive.so: Write to restore size failed

解决方案

要确保虚拟设备可以升级，请验证Nextroot分区大小为4 GB。

命令:ipcheck

(example.cisco.com) > ipcheck

<----- Example output (relevant section) ----->

  Root                  4GB 7%
  Nextroot 4GB 1%
  Var                   400MB 3%
  Log                   172GB 3%
  DB                    2GB 0%
  Swap                  6GB
  Mail Queue            10GB

<----- End of example output ----->

预期输出：Nextroot显示4GB。

如果Nextroot分区小于4 GB，请完成适用的过程以将当前虚拟机模板迁移到更新的映像。

重要信息：根据设备类型选择一个路径：vESA使用基于群集的迁移（步骤4-5）。vSMA使用基于备份的迁移（步骤6）。

步骤1:

部署新的vESA/vSMA

从前提条件下载虚拟ESA/SMA映像，并根据《思科内容安全虚拟设备安装指南》进行部署。

注意：安装指南提供有关DHCP(**interfaceconfig**)、设置默认网关(**setgateway**)和加载虚拟设备许可证文件的信息。确保按指示完成部署。

Step 2.

许可新的vESA/vSMA

部署新的虚拟ESA或SMA后，便需要加载许可证文件。对于传统许可（版本15.0及更低版本），许可证包含在XML文件中，必须使用CLI进行加载。在CLI中，使用loadlicense命令，然后按照提示完成许可证导入。

如果版本低于15.5，您可以查看此文章，因为智能许可是必需的：在ESA/SMA/WSA上激活智能许可和故障排除

第 3 步：

验证两台设备运行相同的AsyncOS版本。如果版本不同，请在迁移之前在新设备上运行upgrade以匹配原始版本。

步骤4.（仅适用于vESA，适用于vSMA跳过）

注意：此步骤假设不存在现有集群。如果集群已存在，请将新的vESA添加到现有集群以复制配置，然后删除新设备以开始升级过程。

创建新集群

在原始vESA上，运行clusterconfig创建新集群。

Original-ESA.example.com> clusterconfig

Do you want to join or create a cluster?
1. No, configure as standalone.
2. Create a new cluster.
3. Join an existing cluster over SSH.
4. Join an existing cluster over CCS.
[1]> 2

Enter the name of the new cluster.
[]> Cluster-1

Must all machines in the cluster communicate with each other by hostname or by IP address?
1. Communicate by IP address.
2. Communicate by hostname.
[2]> 1

What IP address should other machines use to communicate with Machine C170.local?
1. 192.0.2.10 port 22 (SSH on interface Management)
2. Enter an IP address manually
[]> 1

Other machines will communicate with Machine C195.local using IP address 192.0.2.10 port 22. You can change this by using the COMMUNICATION subcommand of the clusterconfig command.
New cluster committed: Sat Jun 08 11:45:33 2019 GMT
Creating a cluster takes effect immediately, there is no need to commit.

Cluster Cluster-1

Choose the operation you want to perform:
- ADDGROUP - Add a cluster group.
- SETGROUP - Set the group that machines are a member of.
- RENAMEGROUP - Rename a cluster group.
- DELETEGROUP - Remove a cluster group.
- REMOVEMACHINE - Remove a machine from the cluster.
- SETNAME - Set the cluster name.
- LIST - List the machines in the cluster.
- CONNSTATUS - Show the status of connections between machines in the cluster.
- COMMUNICATION - Configure how machines communicate within the cluster.
- DISCONNECT - Temporarily detach machines from the cluster.
- RECONNECT - Restore connections with machines that were previously detached.
- PREPJOIN - Prepare the addition of a new machine over CCS.
[]>

(Cluster Cluster-1)>

步骤5.（仅适用于vESA，适用于vSMA跳过）

将新的vESA加入原始ESA集群

从新vESA的CLI运行clusterconfig，然后选择加入现有集群，将新vESA添加到原始vESA上配置的集群中。

New-ESA.example.com> clusterconfig

Do you want to join or create a cluster?
1. No, configure as standalone.
2. Create a new cluster.
3. Join an existing cluster over SSH.
4. Join an existing cluster over CCS.
[1]> 3

While joining a cluster, you will need to validate the SSH host key of the remote machine to which you are joining.  To get the public host key fingerprint of the remote host, connect to the cluster and run: logconfig -> hostkeyconfig -> fingerprint.

WARNING: All non-network settings will be lost. System will inherit the values set at the group or cluster mode for the non-network settings. Ensure that the cluster settings are compatible with your network settings (e.g. dnsconfig settings)

Exception:Centralized Policy, Virus, and Outbreak Quarantine settings are not inherited from the cluster.  These settings on this machine will remain intact.

Do you want to enable the Cluster Communication Service on esa.example.com? [N]> n

Enter the IP address of a machine in the cluster.
[]> 192.0.2.10

Enter the remote port to connect to.  This must be the normal admin ssh port, not the CCS port.
[22]>

Would you like to join this appliance to a cluster using pre-shared keys? Use this option if you have enabled two-factor authentication on the appliance. [Y]> n

Enter the name of an administrator present on the remote machine
[admin]>

Enter passphrase:
Please verify the SSH host key for 192.0.2.11:
Public host key fingerprint: 80:11:33:aa:bb:44:ee:ee:22:77:88:ff:77:88:88:bb
Is this a valid key for this host? [Y]> y

Joining cluster group Main_Group.
Joining a cluster takes effect immediately, there is no need to commit.
Cluster Cluster-1

Choose the operation you want to perform:
- ADDGROUP - Add a cluster group.
- SETGROUP - Set the group that machines are a member of.
- RENAMEGROUP - Rename a cluster group.
- DELETEGROUP - Remove a cluster group.
- REMOVEMACHINE - Remove a machine from the cluster.
- SETNAME - Set the cluster name.
- LIST - List the machines in the cluster.
- CONNSTATUS - Show the status of connections between machines in the cluster.
- COMMUNICATION - Configure how machines communicate within the cluster.
- DISCONNECT - Temporarily detach machines from the cluster.
- RECONNECT - Restore connections with machines that were previously detached.
- PREPJOIN - Prepare the addition of a new machine over CCS.
[]>

(Cluster Cluster-1)>

连接并同步设备后，新的vESA与现有vESA的配置相同。

命令:集群检查

预期输出：不报告任何不一致，同步完成。

步骤6.（仅适用于vSMA，适用于vESA跳过）

查看《SMA管理员指南》中SMA数据备份的必备条件：备份必备条件。

在要替换的设备上运行backupconfig，以安排对新部署的vSMA的备份。

要启动立即备份，请执行以下操作：

1. 以管理员身份登录原始SMA CLI。
2. Enterbackupconfig。
3. 选择Schedule。
4. 输入要向其传输数据的新计算机的IP地址。
5. 源SMA验证目标SMA的存在，并确保目标SMA具有足够的空间来接收数据。
6. 选择3（立即启动单个备份）。
7. 输入vieworstatus以验证备份是否已成功计划。

注意：完成数据备份所需的时间因数据大小、网络带宽等而异。

备份完成后，新的vSMA已从以前的SMA收到所有数据。

要将新计算机配置为主设备，请参阅SMA管理员指南：将新计算机配置为主设备。

第 7 步：

如果需要部署多个ESA/SMA，请执行步骤1-6。

相关信息

思科内容安全虚拟设备安装指南

ESA集群要求和设置

SMA最终用户指南

修订历史记录

版本	发布日期	备注
4.0	23-Jun-2026	更新的技术内容、标题、简介、机器翻译、样式要求和格式。
1.0	27-May-2021	初始版本