Upgrade or Reimage Firepower 8300 Sensors

-

Recently I was tasked with upgrading some new Firepower 3D8350 sensors which would later be stacked into a 3D8360. These devices were shipped with software version 5.4.0.1 and I had a customer requirement to upgrade the sensors to version 6.2.


I would normally stack these devices and upgrade them using the FMC, however, I didn’t have this luxury with these new devices so each sensor had to be upgraded one by one. I had two ways in which I could perform the software upgrades, either upgrade each device following the upgrade path (the longest way) or system restore each device to version 6.2 (the fastest way). Just to give you an idea of the upgrade path from 5.4.0.1 I have included it below;

Version 5.4.0.2 > Version 6.0.0 PreInstallation Package > Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 PreInstallation Package > Version 6.1.0 > Version 6.2.0

As you can imagine this particular upgrade path will require some time and it’s also worth mentioning that often you can face failures at each stage, meaning that you could end up performing this upgrade for a lot longer than anticipated. Luckily for me, these were new devices and had no current configurations meaning I could save time and system restore each device to version 6.2.

To my surprise documentation for this process wasn’t best described so I thought it would be worth putting together this article to try and clearly explain how to system restore a sensor to the latest supported version.

Note: Please consult Cisco documentation to make sure your device supports the image/configurations presented in this article.
This article is based on the following device
  1. Firepower 3D8350 sensor
Equipment used to aid in the upgrade
  1. Ethernet which is connected to a Laptop
  2. KVM connection
Note: Typically the length of a reimage is 30/45 minutes
This article is for anybody interested in upgrading a Cisco Firepower 3D sensor by reimaging the device rather than following a specific upgrade path.

Step 1 – Verify connectivity to Firepower sensor

  1. With the Ethernet cable connected to the sensors management port (Eth0) and one to your computer, test device reachability by accessing the GUI. Enter the following settings on the computer.
  2. IP settings
  3. IP address: 192.168.45.2
  4. Subnet Mask: 255.255.255.0
  5. Default Gateway: 192.168.45.45
  6. Open up a web browser and enter http://192.168.45.45 – You will be presented with a notification telling you that the certificate for that device is not trusted, accept this and confirm you can access the GUI.
  7. If you wish to log in you can enter the following default credentials
  8. Username: Admin
  9. Password: Sourcefire
Connectivity is now confirmed via Ethernet, you will also be required to use Keyboard, Video and Mouse (KVM) for the restore process.

Step 2 – Download the following images

  1. The restore image for the version you wish to move to, the following is the image I used: Sourcefire_3D_Device_S3_Upgrade-6.2.0-362.sh
  2. Any relevant patch for the version you wish to install, here is a patch that I used: Sourcefire_3D_Device_S3_Patch-6.2.0.5-38.sh
  3. The latest rule update, here is an example that I used: Sourcefire_Rule_Update-2018-03-07-001-vrt.sh
  4. Visit www.software.cisco.com to download each file

Step 3 – Select the method of transfer for files to a sensor

So that you can restore your 3D sensor you will be asked to use one of three options;
  1. HTTP
  2. FTP
  3. SCP
Please select the best method for you and make sure the server is running on your computer that is connected to the sensor via Ethernet.

Step 4 – Reimage the 3D Sensor

Now we have everything set-up we can go ahead and start the reimaging process.
  1. Using the CLI or KVM reboot the sensor using the following commands
expert
sudo shutdown -r now
  1. If you are connected via ssh you will lose connection – from this point on please use the KVM. When the device reboots you need to press any arrow button to stop the device from booting back into the current image. Please select “System_Restore”
  2. When you get to the options screen you will need to give the 3Dsensor an IP address, subnet mask and default gateway. It is recommended that you configure this device so that it is on the same subnet as the computer and that the default gateway points to the computer that is running the server that will be used to transfer the files.
  3. In step 2 you will need to choose your preferred method of transport for files, at this point the device will try and display the files that are in the directory you’ve specified. Note: I have seen instances whereby when using FTP it fails if the following isn’t entered. You need to specify the username: anonymous and password: password
  4. In step 3 select your patches and move to Step 4 where the device will download the files from your computer. You will also be advised that you are about to repartition the disk with the new image, proceed if you are happy to continue with the reimaging process.
Note: If upgrading from one major version to another such as 5.4 to 6.2 you will need to run the above steps twice. When you have run the install once and the device has reloaded you simply just run through the IP and file transfer settings along with steps 4 & 5 again following the same process. You will notice that before the device reloads this time around, you’ll be asked if you want to keep some of the configurations or not, select the best option for you.

Note: It is important not to press any buttons while the reimaging is taking place as you may restart the system and you will need to perform the reimaging again. You will know when the re-imaging is complete when you are presented with the login prompt. I have also noticed even when you choose to keep some of the configurations, the password is reset to: Admin123

Thanks for reading.

#Cisco #ciscofirepower #reimagecisco8350 #UpgradeCiscoFirepower8300 #cisco3dsensor #reimagecisco8300 #FirePOWER #FMC #upgradecisco8300
Kelvin Charles - Network and Cyber Security Professional.

Popular Posts

Capturing EAPOL and RADIUS Using Wireshark

-
Image
In this article we are going to take a look at how to capture Extensible Authentication Protocol Over LAN (EAPOL) and Remote Authentication Dial-In User Service (RADIUS) packets using Wireshark. This article can be useful for troubleshooting 802.1x within your environment and can also be used for learning purposes. The following topology has been used to gather the required output for this article. Note: This article will only cover the switch configurations that are required to gather EAPOL and RADIUS configuration. Overview of the Topology The supplicant is configured to perform 802.1x using EAP-TLS as the authentication method The user certificate on the supplicant will be used for authentication The supplicant has Wireshark installed Cisco ISE is used for authentication and authorisation The supplicant is assigned to VLAN 10 upon authentication and all other endpoint ports are assigned to VLAN 99 Sniffer device is running Wireshark in order to capture RADIUS flows via SPAN 802.1x
Read more

Configuring Cisco Smart License Software

-
In this article, I would like to demonstrate how to configure Cisco Smart Licensing on the virtual Cisco Adaptive Security Appliance (ASAv). This post assumes that readers already have access to there own Smart Account and would like to know the process of applying licenses. Step 1: Generate ID Token Sign into your Cisco Software Portal: software.cisco.com and navigate to “Smart Software Licensing” You will now need to create an ID token for your device, this is required for communication between the device and the licensing authority. Follow the steps below to create a new token. Click Inventory >>> General >>> New Token and select your preferred options and enter a description for your token. Once you are happy with your token settings click Create Token . You should now have a token created which can be copied over to the device you wish to license. All commands and output from this point will be related to the ASA so please seek out further advice if you wish
Read more

Cisco :: FXOS Authentication Using TACACS

-
In this article, I will describe how to enable authentication and authorization for Firepower eXtensible Operating System (FXOS) devices. The use case presented in this document illustrates how Cisco Identity Services Engine (ISE) can be utilised with attribute-value pairs (AV-Pairs) to authenticate and authorize users accessing the Firepower Chassis Manager (FCM) or FXOS platforms via TACACS+. At the time of writing this post, I found that limited documentation existed and of that documentation that did exist, the examples given weren’t as straightforward. In an effort to make this process easier for my colleagues and customers to understand I have put together the following instructions based on a previous use case given to me. Extracts of this document have been taken from a wider document I am currently creating. I will update this article with the complete document when it has been finalized. Requirements A ‘Device Administration’ license is required in order to use TACACS+ with
Read more

Configuring Remote Access VPN on Firepower

-
Image
In this article we are going to take a look at how to configure remote access VPN's on Firepower devices. This demonstration is based on the following lab environment: Cisco Virtual Firepower Management Center Cisco Virtual Firepower Threat Defense Cisco ISE 2.6 Windows host with AnyConnect VPN Windows Server 2019 (CA Server) All Firepower devices are running version 6.5 Note: ISE is used for authentication and authorization in the following lab however the configuration elements of ISE are out of scope for this demonstration. Generate a CSR for Remote Access VPN's Those accessing your network remotely need to trust the service you're running. Without the correct trust users could face issues connecting via VPN. With access to the FMC navigate to Objects > Object Management > PKI > Cert Enrollment Assuming you are opting for manual enrollment, select 'Manual' in Enrollment Type and copy the CA Certificate BASE-64 into the field. Now select the 'Certifi
Read more

Kali Linux :: CAM Table Overflow Attack Demonstration

-
Image
As part of my on-going studying for the CCNA Security 210 – 260 certification I have been exploring different types of network attacks, one of which is CAM table overflow attacks. In this article I would like to share what I have learnt and provide a demonstration of the attack carried out in a lab environment. To understand my demonstration, you first need to understand how a CAM table overflow attack works and what happens as a result of the attack.   Switches build Content Addressable Memory (CAM) tables based on mac-addresses and port numbers. When a switch receives a frame it checks the table to see if the source mac-address is already known, if the source mac-address is unknown the switch will add the mac-address to the table along with the port number. The switch then checks the destination layer two frame and if no entry exists the switch broadcasts the frame out of all ports except the port in which the frame was received. Presuming the destination mac-address wants to respond
Read more