Cisco | SourceFire expert mode Cisco ASA 5506-X

Recently I was updating a Cisco ASA 5506-X SourceFire. It was not the update for the ASA or ASDM, but an update for the SourceFire it self. Via the ASDM you can start an update for a local downloaded file or file downloaded from the internet. In my case i downloaded the file to my own system and up loaded it to the Cisco ASA 5506-X. In the beginning i could follow the upgrade process via a windows in the ASDM till the moment the update was on 31%. From that point my connection was limited and the pages were not available.
When I was looking for how to find a way to follow the process of the upgrade. I found a document at for the update and in the release notes.

FirePOWER services are unavailble during the update process if you update the following Cisco ASA devices with FirePOWER
services from Version 5.4.1 to Version ASA5506-X, ASA506H-X, ASA5506W-X, ASA5508-X, ASA5516-X. FirePOWER
services are available after updating your devices. As a workaround, use the tail –f /var/log/sf/Cisco_network_sensor_Patch- command via SSH to observe the update process and restart the Adaptive Security Device Manager (ASDM) on your ASA module after the update completes. (CSCut89599)

In the documentation you see the bold text to use to monitor the update process. Unfortunate this isn’t the correct file to view at. To get the correct file to use to monitor the update process. Logon with ssh to the SourceFire Devices IP address.
enter-expert-modeType expert in the CLI you see that the page will be changed to a Linux based CLI
list-dir-sourcefireList the files to see where you have to look use: ls -l /var/log/sf/ to have a better output as above. You see the file update.status.  that’s the file you need to use to look at.
update-process-sourcefireTo open the update.status file you need to use the following command: tail -f /var/log/sf/update.status you can leave this file open until the process is finishes. When finalization starts you see the following output.
finalizing-update-sourcefireWait till the reboot of the system starts. Your ssh connection will be lost, but you can review this also on the Cisco ASA 5506-X device with the following command: service sfr console. When the system is rebooted the update is finished.
Note: when you want to finish watching the update.status use CTRL+Z to close it

2 thoughts on “Cisco | SourceFire expert mode Cisco ASA 5506-X”

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.