24
- May
2011
Posted By : Gom Jabbar
The Continuing Adventures of Installing Flash Memory in a Cisco ASA

(This is a follow-up to my last two Cisco ASA-related posts:

Removing the Flash Memory from a Cisco ASA 5505

Displaying the Contents of the Cisco ASA Flash Memory )

The superhero origin story so far: I installed a new, blank 8 GB Compact Flash card in my pet ASA, booted the ASA into ROMMON mode and erased the Compact Flash card with the erase command. Then I booted off an image on a TFTP server.

The output of dir /recursive shows no ASA image file, and 0 bytes on disk. Something is definitely not kosher in the state of Denmark:


ciscoasa# dir /recursive

Directory of disk0:/*

2255   -rw-  196          01:12:30 May 20 2011  upgrade_startup_errors_201105200112.log
Directory of disk0:/coredumpinfo

2254   -rw-  59           01:12:30 May 20 2011  coredump.cfg

Directory of disk0:/crypto_archive

No files in directory

Directory of disk0:/log

No files in directory

0 bytes total (0 bytes free)

A sh ver command coughs up some additional info:


System image file is "tftp://10.0.0.1/asa841-k8.bin"
Config file at boot was "startup-config"

--REDACTED--

The Running Activation Key is not valid, using default settings:

Licensed features for this platform:
Maximum Physical Interfaces       : 8              perpetual
VLANs                             : 3              DMZ Restricted
Dual ISPs                         : Disabled       perpetual
VLAN Trunk Ports                  : 0              perpetual
Inside Hosts                      : 10             perpetual
Failover                          : Disabled       perpetual
VPN-DES                           : Enabled        perpetual
VPN-3DES-AES                      : Disabled       perpetual
AnyConnect Premium Peers          : 2              perpetual
AnyConnect Essentials             : Disabled       perpetual
Other VPN Peers                   : 10             perpetual
Total VPN Peers                   : 25             perpetual
Shared License                    : Disabled       perpetual
AnyConnect for Mobile             : Disabled       perpetual
AnyConnect for Cisco VPN Phone    : Disabled       perpetual
Advanced Endpoint Assessment      : Disabled       perpetual
UC Phone Proxy Sessions           : 2              perpetual
Total UC Proxy Sessions           : 2              perpetual
Botnet Traffic Filter             : Disabled       perpetual
Intercompany Media Engine         : Disabled       perpetual

This platform has a Base license.

Serial Number: JXXXXXXXXXX
Running Permanent Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
Configuration register is 0x1
Configuration last modified by enable_15 at 01:22:40.498 UTC Sat May 21 2011

So we’ve got a few issues here. No activation key, no licenses besides the default Base license, the ASA image is not on the local flash, no config and the flash shows 0 bytes total. And why does it say “perpetual” for all the licensed features? Is this something that the ASA 8.4.1 normally shows?

Son of a!

I power down the ASA, extract the Flash memory and stick it into a Compact Flash reader on my laptop. The disk is in RAW format, unreadable by Windows. It was originally FAT32, and when I stuck it in the ASA and used the erase command in ROMMON mode, looks like it got formatted to RAW by the ASA. That’s odd. The original 128 MB Compact Flash card that came with the ASA was formatted in FAT. But I suspect that the partition size limitations of FAT16 means that this 8 GB Compact Flash card aint gonna fly as-is.

OK, time to tweak it. I reformat the Flash card to FAT32 under Windows to see if it is readable by the ASA. On my laptop, I also have a copy of the files and directories that I’d copied off the original 128 MB Compact Flash card. In Windows, I copy the files and directories onto the Flash card and reinstall it in the ASA. This is what I get when I try to boot the ASA:


Evaluating BIOS Options ...
Launch BIOS Extension to setup ROMMON

Cisco Systems ROMMON Version (1.0(12)6) #0: Mon Aug 21 19:34:06 PDT 2006

Platform ASA5505

Use BREAK or ESC to interrupt boot.
Use SPACE to begin boot immediately.

Launching BootLoader...
Default configuration file contains 1 entry.

Searching / for images to boot.

No images in /
Error 15: File not found

unable to boot an image

Default configuration file contains 1 entry.

Searching / for images to boot.

No images in /
Error 15: File not found

unable to boot an image

Failsafe booting engaged.
Default configuration file contains 1 entry.

Searching / for images to boot.

No images in /
Error 15: File not found

unable to boot an image

No dice. The ASA isn’t reading the FAT32-formatted Flash memory correctly. OK, power down the ASA and mount the Compact Flash drive in my laptop again. I create a 4 GB FAT16 partition on the Flash drive with BootIt Next Generation. I copy over all the files I had saved from the original Compact Flash card and reinstall the Compact Flash card into my ASA. And it boots with the old config and boot image!

It sees all the boot images and ASDM images and seems to be able to detect the 4 GB FAT16 partition. Since it has the old config restored, it also has all the licenses and the activation key restored.

Righteous.

I realize that I am doing this for the lulz, and it would not be quite so easy if I did not have all the files and directories backed up on my laptop. All this little exercise proves is that you can replace the Compact Flash card in an ASA quite easily. You just have to format the new card to FAT16 and copy over all the files and directories (including hidden directories).

Additional Information:

Erase command in the Cisco ASA 8.4 Command Reference.

Dir command in the Cisco ASA 8.4 Command Reference.

Show version command in the Cisco ASA 8.4 Command Reference.