Go to Configuration Manager > Tools > Security Manager Administration.

Configure workflow settings:

1. Select Workflow.

2. To require that Install Jobs be approved explicitly by an assigned approver before they are installed on devices, select Require Deployment & Install Image Approval. If you select this option, make sure you configure appropriate email notification settings. For more information, see the Workflow Page.

   Note	To allow the submitter to approve deployment jobs, select Submitter can Approve Deployment Job.

3. Click Save.

Configure debug settings:

1. Select Debug Options and from the drop-down list for Image Manager Debug Level, select the debug level you want.

   Tip	The levels include: Severe, Error, Warning, Info and Debug. The default log level is Error.

   Note	The log files are stored as follows:

   • The server logs are located at: %NMSROOT%\MDC\log\operation\vmssharedsvcs.log and %NMSROOT%\MDC\tomcat\logs\stdout.log

   • The client logs are located at: <Client Install Dir>\logs\*.log

2. Click Save.

Configure Cisco.com credentials:

1. Select Image Manager.

   The Image Manager page appears.

2. If you have credentials to connect to Cisco.com configured already at Tools > Security Manager Administration > IPS Updates > Update Server and wish to reuse the same for Image Manager, then check the Use IPS Updates Settings check box. This is also the default behavior.

   Note	Only Cisco.com is supported, not Local Server.

3. On the Image Manager page, deselect the Use IPS Updates Settings check box if you want to specify a set of credentials for Image Manager explicitly.

   The fields on the Image Manager page become operable.

4. Complete the following fields:

   • Username

   • Password

   • Confirmation

5. Optionally, complete the Proxy Server Settings to configure a proxy, if required.

   1. Select the Enable Proxy check box.

   2. Complete the following fields to define the proxy:

   3. IP or Hostname

   4. Port

   5. Username

   6. Password

   7. Confirmation (of Password)

6. Click Test Connection test connectivity to Cisco.com with the configured settings.

7. Click Save.

Configure Purge Interval for Image Install Jobs

1. Select Image Manager.

2. Enter a purge value to specify how many days should pass between purges, in the Purge Jobs Older Than field.

   Note	Pressing the Purge Now button immediately purges the Image Installation jobs satisfying the Purge Interval criteria.

Configure Image Backup Settings

1. Select Image Manager.

2. To include the repository as part of the standard backup, select Include Repository.

   Caution

   Ensure that you have sufficient hard disk space on the Security Manager server as the image files consume a lot of space.

   Note	You can click the Reset button to reset the values to the last saved values before the current change.

3. Click Save.

Click Close to close the Administration window.

Configure HTTPS on the device(s) to manage ASA in Security Manager.

1. Ensure that the HTTP server is enabled.

2. Add the Security Manager server IP address as an allowed host for HTTP management on the device.

Ensure that the configuration register setting is set to boot with the image list in the running configuration.

1. Register value: 0x1,0x3,0x5, 0x7, 0x9

   Note	Register value: 0x1 is the recommended setting.

2. Do not set to boot to rommon mode. (Otherwise device will not be rebooted and the image upgrade will be aborted.)

In Security Manager, go to Tools > Security Manager Administration > Device Communication > SSL Certificate Parameters. In the SSL Certificate Parameters area, set PIX/ASA/FWSM Device Authentication Certificates to Do not use certificate authentication.

Ensure that there is sufficient space in the flash memory of the device(s) to hold the images you intend to load.

We recommend that you unmanage the Boot-Image/Configuration policy for ASA, as follows:

1. In Security Manager, navigate to Tools > Administration > Policy Management.

2. Uncheck the Boot Image/Configuration policy selection.

   Note

   Image Manager configures boot image and ASDM image as part of the image installation job. So, if the Boot Image/Configuration policy is not unmanaged, then any configuration deployment after the image installation will remove these boot commands added by Image Manager. To prevent this, the Boot Image/Configuration policy should be unmanaged in Security Manager. This can be done from Security Manager administration settings -> Device Exception Settings -> Firewall Policies node.

We recommend that the device not be set as a priority monitored device in HPM.

Ensure that all configuration changes on the device are submitted and deployed.

Check for new images available on Cisco.com

1. Configure the credentials for reaching Cisco.com by navigating to Tools > Security Manager Administration > Image Manager.

2. In the upper right corner, click the double arrow Check for Updates icon.

3. Ensure that the CCO account has permissions to download crypto images. Otherwise, navigate to the link and accept the agreement, and then retry the operation.

   The system displays “Updating” while it checks for updates. When finished, it reads: Last updated at: <timestamp>, and you can view the new images available in the All Images view.

If you have not already accepted the most recently issued Cisco.com certification, the system notifies you that you must retieve, view, and accept the latest certificate before any communication with Cisco.com by Image Manager can occur.

Click All Images in the selector.

To re-order the list, click on any of the column headings.

To filter the list, use the Image Manager’s search window to enter a key string. For example, you could enter the digits of a version number.

To download images from Cisco.com, do the following:

1. From the All Images view double-click the Start Download icon in the first column.

   Tip	Ensure that the credentials to Cisco.com are configured and you have authorization to download the images.

   Note	Image Manager displays an error message if the image to be downloaded already exists in the repository. The system skips the download when the file name and checksum are identical.

   The Downloads window appears showing the progress of the download.

   Tip

   The progress icons may change as the download progresses. A green check icon with the word Deployed indicates success. A red X icon indicates failure. In case of failures, you can view the cause of the failure for that image in the Downloads window. You can double click the message to view the complete details of the error.

2. When completed, select Repository Images and view the image in the listing.

   Tip	You can also select multiple images and download them all at once by right-clicking them and using the context-sensitive menu.

   Tip	By sorting the list on Update Time, you can easily view the most recent image.

To download images from a local file system, do the following:

1. From the toolbar in the Repository Images view, click the Download image from file system icon (found on the far left).

   The Download from File System dialog box appears.

2. Use the Browse feature to select the Import location and to select the image to be imported.

3. Click OK.

4. Click OK in the Download image from file system dialog box.

5. Observe the progress of the download.

   Note	If the image to be downloaded already exists in the repository, the system displays an error.

6. When completed, select a device group in Security Manager and view the image in the listing.

   Tip	By sorting the list on Update Time, you can easily view the most recent image.

7. Alternatively, you can download an image file using the drag-and-drop method. For example, you can drag one or more files from your desktop and simply drop it on the Image Manager application.

From the Bundles heading in the selector, click the Add Bundle (plus sign) icon.

In the Create Bundle dialog box that opens, enter the name for the new bundle.

Click OK.

From the Images section of the selector, select an image to be bundled. Then click on the Release Notes tab. Finally, examine the compatibility table in the applicable release notes to ensure there are no conflicts with the other images to be bundled.

With compatibility determined, drag and drop each image onto the bundle.

To view the images contained within all bundles:

1. Under the Bundles heading in the selector, click the top-level Bundles folder.

   All the bundles are listed, together with the images contained within each.

2. You can expand or collapse any of the bundles to make viewing easier. To expand all bundles or collapse all bundles, use the Expand All and Collapse All buttons at the top of the main window.

To view the images for a specific bundle:

1. Under the Bundles heading in the selector, select a bundle.

   The list of images for the selected bundle is displayed in the main window.

To view a particular bundle:

1. In the Bundles section of the selector, click Search (the magnifier icon).

2. Enter the bundle name in the search field under the Bundles banner.

   The list of bundles displays only the specified bundle.

From the Bundles heading in the selector, select a bundle.

Right-click the bundle name and, from the drop-down list, select Rename Bundle.

Type the new bundle name.

Click OK.

Select the bundle.

From the Bundles heading in the selector, click Delete (the red X icon). Alternatively, right click on the selected bundle and select Delete Bundle.

Select the bundle.

Right-click on the image(s) to be removed.

Select Delete Image from Bundle. Alternatively, click the Delete button at the top of the table.

Select a device group from the Devices area of the selector panel.

From the upper pane of the Device Summary page, select a device.

Select the Storage tab in the lower pane and then check the amount of free space listed under Disk Usage.

Note the available disk space on the device.

To remove one or more images from the device to free up space, select one or more images in the Storage Tab and click Delete at the top of the Storage Tab.

To download an image from the device, select the image and click Download at the top of the Storage tab. Select the location on the local file system to which to download the image and click OK.

Select the Compatible Images tab in the lower pane.

To install the compatible image(s) onto the device do the following:

1. Select the image to be added to the device.

2. Double-click the download icon.

   The image is downloaded to the repository.

3. Select the image and then select Install from the context menu.

   The Install wizard appears and the system installs the image. Please see Install Compatible Images on Devices for details.

From the Devices area of the selector panel, choose the device to examine.

In the upper panel, examine the RAM listing.

Select the device from the Devices area of the selector.

View the Summary information on the right pane.

Select the external disk, disk1, from the Image Install Location drop-down list and click Apply. For a user context device, you can select shared or private label to apply the default Install location.

From the File menu, select Validate.

Click Add Assignment.

In the Image Assignment window, from the drop-down list, select either:

Select one or more items (images or devices) by moving them to the window on the right.

Click Next and assign the other item (images or devices).

Examine and confirm the assignments that you have specified.

Click Finish.

Click Start Validation.

Click on the display of Warning or Successful or Error.

According to the validation status, do one of the following:

After addressing the warnings or errors shown, you can proceed to create the job using the Image Install wizard.

Optionally, you can right-click on an assignment element in the Validate Image Assignments window and modify or delete it before proceeding.

You can also right-click on an assignment and select Copy Table. This copies the assignment details and the validation status and notes. You can then paste the contents to Notepad or another program as a CSV file to be used as reference.

Go to Files > Open Image Installation Wizard.

On the lower left, click Add Assignment.

From the drop-down list on the top, select whether you want to assign images to devices, or devices to images.

Move items (devices or images) from the list on the left to the selected items list on the right. Then click Next. You can also select bundles, instead of images, by clicking the Bundles tab.

Review the assignment definition in the Confirm Assignments dialog box and click Finish.

When you are finished defining assignments, click Start Validation. Wait until the system displays Validation Complete.

Examine the status in the Validation column on the Assignments tab of the Wizard dialog box. It shows either Warning or Successful or Error.

Determine what steps are necessary according to the status:

Right-click on the assignment for more options:

If you want the installation job scheduled for a particular time, select the Schedule tab and specify the date and time.

To set properties of the installation job, select the Properties tab.

1. Edit the Name, if desired. (The default is Image install Job—<timestamp>)

2. Edit the Description, if desired.

3. Select a Ticket ID, if desired.

   Tip

   Starting from release 4.4, Ticket ID field in Image Manager has been decoupled from Config Manager. It is now just a ‘tag’ and can be any arbitrary string. Ticket ID field is an editable combo box with auto completion that shows tickets created earlier both in Image Manager and Configuration Manager. Also, there is no dependency on Ticketing mode in Configuration Manager for Ticket ID field. Ticket ID is an optional field and can be left blank. Global search in Configuration Manager also supports tickets used in Image Manager and lists the Image Installation jobs with which the ticket is associated.

4. Set the On Error option. (Default is Stop Installation, alternative is Continue Operation.)

5. Set the Backup Current Image option. (Default is Yes, alternative is No.)

   Tip	This is only applicable for system software images

6. Set the Install images to devices in option. (Default is parallel, alternative is Sequential.)

7. Select one of three operations:

   • Install image and reboot device

   • Install image but do not reboot device

   • Only copy image onto devices

     • Select the Non-Intrusive: Does not trigger failover check box to copy the image without switching the failover devices.

8. If you are using Workflow, you can optionally configure the following approval options:

   Tip	These are located in the top frame in Job properties for the job.

   • Action—

   • Approve

   • Reject

   • Deploy

   • Submit

   If you reject a job, the status is set to Rejected, after which you discard the job. When you discard a job the status is shown as Discarded and all the job’s action buttons are disabled.

   If you approve a job, the status is set to Approved. Then, you must click Deploy to start the image upgrade job.

9. Beginning with version 4.12, Security Manager provides an option to select the Storage URL for ASA multi-context devices running the software version 9.6(2) or later. You can select either Shared or Private Storage URL for the selected user context. By default, Shared is selected.

   Tip	You can the check running commentary by selecting the Details tab. and clicking Show Progress.

   After you deploy a job, the job status is shown as either Deployed or Failed. The History tab in the bottom pane (for the selected job) only is activated in WF mode and displays one of two job action flows:

   • Creating/ Edit-In-use/ Submitted/ Rejected/ Discarded

   • Creating/Edit-In-use/ Submitted/ Approved/ Deploying/ Deployed (or Failed)

   • Submit the job—This is checked by default

   • Approver email—The email address list of approvers

   • Submitter email—The email address of the person submitting the job

10. You can change job properties by clicking Edit.

11. Refer to Viewing Install Jobs for additional job viewing options.

Click Install.

When the job starts deploying, notice the change in the state of the devices to Update in progress state in the device tree in Configuration Manager and Image Manager. A green progress icon appears beside the device in the device tree.

View the details of the job and its progress while it is in deploying state. Please see Viewing Install Jobs for details.

Wait for the job to complete.

Notice the change in state of the device(s) in the device tree after the job is complete.

Verifying the image update:

1. Click on the device in the device tree in Image Manager.

2. Go to the Summary tab to view the updated Running OS version.

3. Go to the Running Images tab to view the new running images after the image update.

4. Select the device in Configuration Manager.

5. Right-click the device and select Device Properties.

6. Notice the new image version updated in Running OS Version field.

7. Go to Configuration Manager > Manage > Configuration Archive.

8. From the device CLI, enter sh ver

   The updated OS version should be displayed.

9. Select the device in the left device tree.

10. View the Configuration Archive versions in the right pane and notice the latest entry with the Archival Source as Image Manager .

11. Select the archived entry and click View.

12. Compare this entry with the previous archived version to view the configuration changes made by Image Manager during image update. You can view the boot commands being prepended for the new ASA system software image and/or ASDM image command being added for the new ASDM image.

13. Email notification will be sent to configured recipients with the status of the Image Upgrade job if email notification is configured in Image Manager administration settings.

If the device is set to Configuration Required or Maintenance state after the image update operation, follow the steps below to complete the post-image update requirements to make the device functional from Configuration Manager:

1. Click on the device in the device tree in Configuration Manager or Image Manager.

   A balloon tip appears showing the device information.

2. View the contents of the balloon tip. Review the reason for the device being set to the Configuration Required or Maintenance state. Review also the recommended actions to be taken.

3. Perform the recommended actions.

4. Right-click the device in the device tree and select Make Device(s) Operational.

   The device is moved to Operational state and the icon beside the device in the device tree is removed.

   Note	Before initiating an install job for Cisco Firepower 1000 and 2000 series devices operating in Appliance Mode, you must ensure to select the No option for the Backup Current Image field in the Properties panel.

Drag and drop the bundle onto a device or device group.

Investigate any assignment validation errors or warnings listed in the Install images on devices dialog box.

When your warnings are corrected (or you determine them to be insignificant), click Install.

Select a device in the Devices area of the selector and navigate to the Compatible Images tab.

Select one or more Repository images in the Compatible Images tab.

Right-click a selected image and click Install.

Click Next.

Select the devices to which you want to install, and then click Next.

Confirm the devices and images assignments, and then click Finish.

Click Start Validation in the upper-right corner of the Assignments tab. Investigate any assignment validation errors or warnings listed in the Install images on devices dialog box.

When your warnings are corrected (or you determine them to be insignificant), click Install.

Select a device group in the Devices area of the selector.

View the listing of devices in the group in the right pane.

Select one or more devices from the list.

Right-click a selected device and click Install.

Click Next.

Select the images you want to install, and then click Next.

Confirm the devices and images assignments, and then click Finish.

Click Start Validation in the upper-right corner of the Assignments tab. Investigate any assignment validation errors or warnings listed in the Install images on devices dialog box.

When your warnings are corrected (or you determine them to be insignificant), click Install.

In the selector, under Jobs, click Install Jobs.

Examine the details of the Jobs list, which may include:

Optionally, you can find and select a single job about which more information is then displayed in the lower pane. This includes:

In the selector, under Jobs, click Install Jobs.

Select a job to examine.

Examine job summary information by clicking Summary in the lower pane.

Examine job summary details by clicking Details in the lower pane.

Examine the Commentary on the devices in the job by clicking on the vertical Commentary tab on the far right. This shows the progress of the image install operation on the device.

Examine the Transcript of the devices in the job by clicking on the vertical Transcript tab on the far right. This shows the chronology of the commands executed on the device and their responses.

Examine job history details by clicking History in the lower pane. This shows the history of the transition in the job state.

To determine that an installation job has failed, go to the Jobs section in the selector and click Install Jobs.

Determine the status of the job in question by examining the Status column.

Investigate possible reasons for job failure.

Select the failed image install job from the job list and click Retry from the toolbar atop the upper pane.

As required, you can change the images, devices, schedule, or job properties to be used.

From within the Install Images on Devices window click Install.

Determine that the retried attempt is successful by observing the newly created job.

From the job list, select the image install job to be rolled back and click Rollback from the toolbar atop the upper pane.

As required, you can change the images, devices, schedule, or job properties to be used in the rollback.

From within the Install Images on Devices window click Install.

Determine that the rollback attempt is successful by monitoring the newly created job.

Enable workflow for image installation jobs:

1. In Configuration Manager, select Tools > Security Manager Administration > Workflow.

2. If workflow is not already enabled, select Enable Workflow.

3. Select Require Deployment & Install Image Approval.

4. Configure the email address of the person responsible for approving the image installation job in the Job/Schedule Approver field. For more information, see Workflow Page.

5. Click Save and then Close.

6. Launch Image Manager and navigate to Install Jobs. Notice the new buttons available in the Menu bar for job state transitions in workflow mode: Submit, Approve, Reject, and Deploy.

To create and execute an image installation job with workflow enabled:

1. Use any of the previously documented procedures to create an image installation job. See About Image Updates on Devices Using Image Manager.

   Note	There is an additional option in the Properties tab to Submit the Job. Check this option to automatically submit the job for approval after creation of the job.

2. Once the image installation job is created, note the state of the job in the Image Install Jobs View.

3. Select the job and click Submit to submit the job for approval if automatic submit option was not selected while creating the job.

   The job Approver (user with Approver role/privileges) receives an email notification to approve the job.

4. The Approver can log in to Security Manager, launch Image Manager, and navigate to the job.

5. The Approver clicks Approve to approve the job after reviewing the details of the upgrade, that is, image being upgraded to, job properties, schedule, and so on.

   Job state is changed to Approved . The creator of the job receives an email that the job has been approved. Now the job can be deployed.

6. If the Approver is not convinced after reviewing the job details, he can choose to reject the job by clicking Reject.

   The job state is moved to Rejected . The creator of the job receives an email that job has been rejected. A rejected job will not be deployed.

   Note	A rejected job will not be deployed. It can be edited and resubmitted for approval or it has to be discarded.

7. Once the job is approved, the job can be deployed by clicking Deploy.

   The job state is changed to Deploying and image install job execution is started.

8. If the job is rejected or any other changes are required to be made for a job, the job can be edited by clicking Edit.

   The Image Assignments page of the wizard showing all the devices and images is displayed. The user can modify the Job Properties, schedule and even delete some device-to-image assignments and submit the job for approval again by clicking Submit.

9. If a job has not started executing, then the user can dismiss the job by clicking Discard.

   The job is moved to Discarded state. A discarded job does not execute and cannot be edited or moved to any other state.

10. If the changed job is acceptable to the approver, he can approve the job this time and the job can be deployed as mentioned above.

11. Once the deploying job completes execution it will be moved to Deployed state if the image installation is successful or it will be moved to Failed state if the image installation operation fails.