Wednesday, November 4, 2009

How to use ROMON to recover from a bad boot image on a Cisco ASA

Note that this can be applied to other Cisco devices, but commands will vary from device to device. The specific commands here apply to the Cisco ASA 5500 series.
Connect a computer to the console port of the device using a Cisco console cable. Use a terminal emulator such as Putty set for 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.
Power cycle the device.
During startup, press the Escape key when you see the prompt to enter ROMMON mode.
It is always a good idea to retain the previous boot image on the device during an upgrade, if space permits. If there is an alternative image available on the flash memory you can issue the boot command as follows:
rommon #1> boot asa821-k8.bin
Launching BootLoader...
Boot configuration file contains 1 entry.

Loading disk0:/asa821-k8.bin... Booting...
Platform ASA5505
Loading...


If you don't have a local copy of an alternative boot image and need to copy an image from a network location, define the interface settings as follows:

rommon #1> ADDRESS=172.31.255.1rommon #2> SERVER=10.200.4.29rommon #3> GATEWAY=172.31.255.4rommon #4> IMAGE=asa821-k8.binrommon #5> PORT=GigabitEthernet0/1GigabitEthernet0/1 Link is UP
MAC Address: 0021.a09a.bf89

Test connectivity using the ping server command.
rommon #6> ping serverSending 20, 100-byte ICMP Echoes to server 10.200.4.29, timeout is 4 seconds:

Success rate is 100 percent (20/20)

Load the software image using the tftp command. This assumes that you have a TFTP server running on the target address and a copy of the required image in the target directory.
rommon #7> tftpROMMON Variable Settings:
ADDRESS=172.31.255.1
SERVER=10.200.4.29
GATEWAY=172.31.255.4
PORT=GigabitEthernet0/1
VLAN=untagged
IMAGE=asa821-k8.bin
CONFIG=
LINKTIMEOUT=20
PKTTIMEOUT=4
RETRY=20

tftp
asa821-k8.bin@10.200.4.29 via 172.31.255.4
Received 16275456 bytes
Launching TFTP Image...

After the image is loaded the device automatically exits ROMMON.


1 comment:

  1. Thanks Sean. But what if you already have several images already loaded in the device? . Image1, Image2 and Image3. Then you changed your boot command to load Image3 in normal mode. Then you proceed to reload and it happens exactly what you described. Is there a way to tell the ASA in RONMON mode to load Image2 for example? without having to point to a TFTP server since the images are all loaded in Flash memory.

    ReplyDelete