簡介

本文檔介紹在升級因小Nextroot分割槽而失敗時更換vESA和vSMA的過程。 

背景資訊

最初，虛擬郵件安全裝置(vESA)和虛擬安全管理裝置(vSMA)映像構建的Nextroot分割槽大小小於500 MB。多年以來，隨著包含其他功能的較新AsyncOS版本的推出，升級在整個升級過程中需要此分割槽中有更多空間。由於此分割槽大小，升級可能會失敗。本文檔提供有關解決方案的詳細資訊，該解決方案是使用4 GB的Nextroot分割槽部署新的虛擬映像。 

ESA的相關缺陷：思科錯誤ID CSCvy69068和SMA:思科錯誤ID CSCvy69076

症狀

Nextroot分割槽大小小於500M的較舊映像vESA或vSMA可能無法升級，但會出現這些錯誤。 

...
...
...
Finding partitions... done.
Setting next boot partition to current partition as a precaution... done.
Erasing new boot partition... done.
Extracting eapp done.
Extracting scanerroot done.
Extracting splunkroot done.
Extracting savroot done.
Extracting ipasroot done.
Extracting ecroot done.
Removing unwanted files in nextroot done.
Extracting distroot
/nextroot: write failed, filesystem is full
./usr/share/misc/termcap: Write failed
./usr/share/misc/pci_vendors: Write to restore size failed
./usr/libexec/getty: Write to restore size failed
./usr/libexec/ld-elf.so.1: Write to restore size failed
./usr/lib/libBlocksRuntime.so: Write to restore size failed
./usr/lib/libBlocksRuntime.so.0: Write to restore size failed
./usr/lib/libalias.so: Write to restore size failed
./usr/lib/libarchive.so: Write to restore size failed

解決方案

要確保虛擬裝置可以升級，請驗證Nextroot分割槽大小為4 GB。

指令:ipcheck

(example.cisco.com) > ipcheck

<----- Example output (relevant section) ----->

  Root                  4GB 7%
  Nextroot 4GB 1%
  Var                   400MB 3%
  Log                   172GB 3%
  DB                    2GB 0%
  Swap                  6GB
  Mail Queue            10GB

<----- End of example output ----->

預期輸出：Nextroot顯示4GB。

如果Nextroot分割槽小於4 GB，請完成適用的過程以將當前虛擬機器模板遷移到較新的映像。

重要：根據裝置型別選擇一個路徑：vESA使用基於群集的遷移（步驟4-5）。vSMA使用基於備份的遷移（步驟6）。

步驟 1.

部署新的vESA/vSMA

根據前提條件，下載虛擬ESA/SMA映像，並根據思科內容安全虛擬裝置安裝指南進行部署。

附註：安裝指南提供有關DHCP(**interfaceconfig**)、設定預設網關(**setgateway**)和載入虛擬裝置許可證檔案的資訊。確保按照指示完成部署。

步驟 2.

許可新的vESA/vSMA

部署新的虛擬ESA或SMA後，就應該載入許可證檔案。對於傳統許可（版本15.0及更低版本），許可證包含在XML檔案中，必須使用CLI載入。在CLI中，使用loadlicense命令，然後按照提示完成許可證匯入。

如果版本高於15.5，您可以檢視此文章，因為智慧許可是強制性的：在ESA/SMA/WSA上啟用智慧許可和故障排除

步驟 3.

驗證兩台裝置運行相同的AsyncOS版本。如果版本不同，請在遷移之前在新裝置上運行upgrade以匹配原始版本。

步驟4.（僅適用於vESA，適用於vSMA跳過）

附註：此步驟假定不存在現有群集。如果群集已存在，請將新的vESA新增到現有群集以複製配置，然後刪除新裝置以啟動升級過程。

建立新群集

在原始vESA上，運行clusterconfig以建立新群集。

Original-ESA.example.com> clusterconfig

Do you want to join or create a cluster?
1. No, configure as standalone.
2. Create a new cluster.
3. Join an existing cluster over SSH.
4. Join an existing cluster over CCS.
[1]> 2

Enter the name of the new cluster.
[]> Cluster-1

Must all machines in the cluster communicate with each other by hostname or by IP address?
1. Communicate by IP address.
2. Communicate by hostname.
[2]> 1

What IP address should other machines use to communicate with Machine C170.local?
1. 192.0.2.10 port 22 (SSH on interface Management)
2. Enter an IP address manually
[]> 1

Other machines will communicate with Machine C195.local using IP address 192.0.2.10 port 22. You can change this by using the COMMUNICATION subcommand of the clusterconfig command.
New cluster committed: Sat Jun 08 11:45:33 2019 GMT
Creating a cluster takes effect immediately, there is no need to commit.

Cluster Cluster-1

Choose the operation you want to perform:
- ADDGROUP - Add a cluster group.
- SETGROUP - Set the group that machines are a member of.
- RENAMEGROUP - Rename a cluster group.
- DELETEGROUP - Remove a cluster group.
- REMOVEMACHINE - Remove a machine from the cluster.
- SETNAME - Set the cluster name.
- LIST - List the machines in the cluster.
- CONNSTATUS - Show the status of connections between machines in the cluster.
- COMMUNICATION - Configure how machines communicate within the cluster.
- DISCONNECT - Temporarily detach machines from the cluster.
- RECONNECT - Restore connections with machines that were previously detached.
- PREPJOIN - Prepare the addition of a new machine over CCS.
[]>

(Cluster Cluster-1)>

步驟5.（僅適用於vESA，適用於vSMA跳過）

將您的新vESA加入您的原始ESA集群

從新vESA上的CLI運行clusterconfig，然後選擇加入現有群集，將新vESA新增到在原始vESA上配置的群集中。

New-ESA.example.com> clusterconfig

Do you want to join or create a cluster?
1. No, configure as standalone.
2. Create a new cluster.
3. Join an existing cluster over SSH.
4. Join an existing cluster over CCS.
[1]> 3

While joining a cluster, you will need to validate the SSH host key of the remote machine to which you are joining.  To get the public host key fingerprint of the remote host, connect to the cluster and run: logconfig -> hostkeyconfig -> fingerprint.

WARNING: All non-network settings will be lost. System will inherit the values set at the group or cluster mode for the non-network settings. Ensure that the cluster settings are compatible with your network settings (e.g. dnsconfig settings)

Exception:Centralized Policy, Virus, and Outbreak Quarantine settings are not inherited from the cluster.  These settings on this machine will remain intact.

Do you want to enable the Cluster Communication Service on esa.example.com? [N]> n

Enter the IP address of a machine in the cluster.
[]> 192.0.2.10

Enter the remote port to connect to.  This must be the normal admin ssh port, not the CCS port.
[22]>

Would you like to join this appliance to a cluster using pre-shared keys? Use this option if you have enabled two-factor authentication on the appliance. [Y]> n

Enter the name of an administrator present on the remote machine
[admin]>

Enter passphrase:
Please verify the SSH host key for 192.0.2.11:
Public host key fingerprint: 80:11:33:aa:bb:44:ee:ee:22:77:88:ff:77:88:88:bb
Is this a valid key for this host? [Y]> y

Joining cluster group Main_Group.
Joining a cluster takes effect immediately, there is no need to commit.
Cluster Cluster-1

Choose the operation you want to perform:
- ADDGROUP - Add a cluster group.
- SETGROUP - Set the group that machines are a member of.
- RENAMEGROUP - Rename a cluster group.
- DELETEGROUP - Remove a cluster group.
- REMOVEMACHINE - Remove a machine from the cluster.
- SETNAME - Set the cluster name.
- LIST - List the machines in the cluster.
- CONNSTATUS - Show the status of connections between machines in the cluster.
- COMMUNICATION - Configure how machines communicate within the cluster.
- DISCONNECT - Temporarily detach machines from the cluster.
- RECONNECT - Restore connections with machines that were previously detached.
- PREPJOIN - Prepare the addition of a new machine over CCS.
[]>

(Cluster Cluster-1)>

連線並同步裝置後，新的vESA與現有vESA具有相同的配置。

指令:集群檢查

預期輸出：不報告任何不一致情況且同步已完成。

步驟6.（僅適用於vSMA，適用於vESA跳過）

檢視SMA Administrator Guide中的SMA資料備份的前提條件：備份前提條件。

在要替換的裝置上運行backupconfig，以安排對新部署的vSMA的備份。

要啟動立即備份，請執行以下操作：

1. 以admin身份登入到原始SMA CLI。
2. Enterbackupconfig。
3. 選擇計劃。
4. 輸入要向其傳輸資料的新電腦的IP地址。
5. 源SMA驗證目標SMA的存在，並確保目標SMA具有足夠的空間來接受資料。
6. 選擇3（立即啟動單個備份）。
7. 輸入vieworstatus以驗證備份是否已成功計畫。

附註：完成資料備份所需的時間因資料大小、網路頻寬等而異。

備份完成後，新vSMA已從以前的SMA接收所有資料。

要將新電腦配置為主裝置，請參閱SMA管理員指南：將新電腦配置為主裝置。

步驟 7.

如果您需要部署多個ESA/SMA，請執行步驟1至6。

相關資訊

思科內容安全虛擬裝置安裝指南

ESA集群要求和設定

SMA最終使用手冊

修訂記錄

修訂	發佈日期	意見
4.0	23-Jun-2026	更新的技術內容、標題、簡介、機器翻譯、樣式要求和格式。
1.0	27-May-2021	初始版本