ASA-SSM-20 recovery

[matthewmphc]

I have an ASA-SSM-20 IPS module in our ASA 5520 appliance. I was trying a password recovery and now the module seems to be stuck in recovery mode. When I issue the "show module 1" command, the status is recovery mode. I issued a "debug module-boot" command and it shows the following:

ASA(config)# Slot-1 99> Link is DOWN

Slot-1 100> MAC Address: 0013.c482.4daa

Slot-1 101> Link State is Down

Slot-1 102> Rebooting due to Autoboot error ...

Slot-1 103> Rebooting....

Slot-1 104> Cisco Systems ROMMON Version (1.0(10)0) #0: Fri Mar 25 23:02:10 PST

2005

Slot-1 105> Platform ASA-SSM-20

Slot-1 106> GigabitEthernet0/0

Slot-1 107> Link is DOWN

Slot-1 108> MAC Address: 0013.c482.4daa

Slot-1 109> Link State is Down

Slot-1 110> Rebooting due to Autoboot error ...

Slot-1 111> Rebooting....

Slot-1 112> Cisco Systems ROMMON Version (1.0(10)0) #0: Fri Mar 25 23:02:10 PST

2005

It just keeps looping through this message. I cannot get it out of this mode, even with a hw-module module 1 reload command. Any ideas?

[Rodrigo Gurriti]

try: hw-module module 1 recover stop

if the image already got erased (what looks like) you'll have to install an other one but if not try:hw-module module slot_number password-reset

that will reset the password w/out reimage the appliance

If you have to reimage try:hw-module module 1 recover configure

then you be in something like a rommon mode

and you will need to specify:

-ftfp

-image

-ip

-gateway

hw-module module 1 recover boot

then it will downlowad the new image,

once you done try:show module "X"

[matthewmphc]

I was able to stop the recovery process, thanks. However, I cannot use the password-reset option, as it tells me "The SSM application version does not support password reset. Failed to reset the password on the module in slot 1"

When I try the recover process again, I put in the tftp info and image, put in an ip that is on the same subnet as the tftp server, and then try the hw-module module 1 recover boot command. Then it doesn't do anything. No activity on the tftp server, and if I debug the boot, it gives me the same output as in my original post. I can ping the tftp server from the ASA, so I would assume the ip info I am putting in should work, but there appears to be no way to test the connectivity from the "port" ip address it asks me to define during the configure prompts. Any ideas?

[jcho]

If your tftp and the SSM are on the same subnet, do NOT specify the Gateway IP Address (just leave it as 0.0.0.0).  For some reason, if you specify the Gateway, it will try to connect the tftp server "via" the Gateway which will not work.

As for Vlan ID, in this case, keep the default value "0", which means no VLAN ID.

Example:

Image url:  tftp://192.168.6.131/IPS-SSM_10-K9-sys-1.1-a-7.0-7-E4.img

Port IP Address: 192.168.6.121

Gateway IP address: 0.0.0.0  (*** Very important. ***)

Vlan ID: 0