CISCO IOS Software Installation and Upgrade Procedure

 OS Software Installation and Upgrade Procedure

This procedure applies to the following Cisco products:

    Cisco 10001
    Cisco 14001
    Cisco 1600-R
    Cisco 1700
    Cisco 2600
    Cisco 3600

    Cisco 3700
    Cisco 4000
    Cisco 4500
    Cisco 4700
    Cisco AS53001
    Cisco MC3810

Introduction

This document explains the procedure for upgrading a Cisco IOS® Software image on Access router platforms. The examples provided from the 2600 and 3600 Series Routers also apply to the list of router platforms mentioned below. The Cisco IOS software file names may vary depending on the Cisco IOS software version, feature set, and platform.The following Cisco series routers are addressed in this document:

    Cisco 1000 Series Routers
    Cisco 1400Series Routers
    Cisco 1600-R Series Routers
    Cisco 1700 Series Routers
    Cisco 2600 Series Routers
    Cisco 3600 Series Routers
    Cisco 3700 Series Routers
    Cisco 4000 Series Routers
    Cisco 4700 Series Routers
    Cisco AS5300 Series Routers
    Cisco MC3810 Series Routers

The information in this document is based on Cisco IOS Software Release 12.0 or later.

The Field Engineer must receive permission from Cisco VISE that a software image upgrade is required, BEFORE carrying out any of these procedures.
Before You Begin

Step 1: Install a TFTP Server
A Trival File Transfer Protocol (TFTP) server or a Remote Copy Protocol (RCP) server application must be installed on a TCP/IP-ready workstation or PC. Once the application is installed, a minimal level of configuration must be performed.

    Note: Cisco no longer supply or support their own TFTP Server application, however searching within your favourite search engine for "TFTP Server" will locate a third party TFTP application for you. Alternatively, you may find Cisco's unsupported TFTP Server application on the COMPASS CD.

    First, the TFTP application must be configured to operate as a TFTP server as opposed to a TFTP client.

    The outbound file directory must be specified. This is the directory in which the Cisco IOS Software images are stored. Most TFTP applications provide a set-up routine to assist in these configuration tasks.

Step 2: Request which IOS Software Image is to be used.
The Field Engineer must ask the VISE engineer or the customer, which image is to be upgraded. It is not the responsibility of the Field Engineer to recommend software image versions. The software image may be provided by the customer, and so the Field Engineer must ask the Cisco VISE engineer for directions.

Step 3: Download the Cisco IOS Software Image
Download the Cisco IOS Software image into your workstation or PC from the Cisco website (http://www.cisco.com).
Software Installation and Upgrade Procedures

    Routers with Internal Flash (for example, 2600 Series Routers)
    Routers with PCMCIA Flash cards (for example, 3600 Series Routers)

Cisco 2600 Series Routers Upgrade Procedure

    Establish a console session to the router
    Verify that the TFTP server has IP connectivity to the router
    Copy the new image into the Flash memory of the 2600 Series Router through the TFTP server

Step 1: Establish a console session to the router

Even if it is possible to connect to the router through a telnet session, it is strongly recommended to be directly connected to the router using the console port. The reason is that if something goes wrong during the upgrade, it might be necessary to be physically located next to the router to power-cycle it. Moreover, the telnet connection will be lost while the router is rebooting during the upgrade procedure.

A rolled cable (usually a flat black cable) is used to connect the console port of the router to one of the COM ports of the PC.

Once the PC is connected to the console port of the router, you need to open Hyperterminal on the PC, and use the following settings:

         Speed 9600 bits per second

         8 databits

         0 parity bits

         1 stop bit

         No Flow Control

Note: If you are getting any garbage characters in the hyperterminal session, this means that you have not set the hyperterminal properties properly, or the config-register of the router is set to a non-standard value for which the console connection speed is higher than 9600 bps.  Check the value of the config-register using the show version command (shown in the last line of the output) and ensure it is set to 0x2102 or 0x102. It is necessary to reload the router for a configuration register change to take effect. Once you are sure the console speed is set to 9600 bps on the router side, you should check the hyperterminal properties as above .

Booting Problems

Once you are connected to the console port of the router, you might notice that the router is either in ROMmon or Boot mode. These two modes are used for recovery and/or diagnostic procedures. If you do not see the usual router prompt, you should follow the recommendations below to proceed with the upgrade procedure installation.

    Router boots in rommon mode, and the following message appears when you issue dir flash: command.

        rommon 1 > dir flash:
        device does not contain a valid magic number
        dir: cannot open device "flash:"
        rommon 2 >

    When you see the above error message, it means the Flash is empty or the filesystem is corrupted. A Xmodem console download procedure using ROMmon may then be necessary.
    Router boots in boot mode, with the following messages on the console:

        router(boot)>
        device does not contain a valid magic number
        boot: cannot open "flash:"
        boot: cannot determine first file name on device "flash:"

    When you get the above error messages on the console output, it means the Flash is empty or the file system is corrupted. Copy a valid image on the Flash by following the procedures provided in this document.

Step 2: Verify that the TFTP server has IP connectivity to the router

The TFTP server must have a network connection to the router, and must be able to ping the IP address of the router targeted for a TFTP software upgrade. To achieve this, the router interface and the TFTP server must have:

        an IP address in the same range, or

        a default gateway configured.

To verify this, check the IP address of the TFTP server.
Step 3: Copy the new image into the Flash memory of the 2600 Series Router through the TFTP server

    Now that you have IP connectivity and can ping between the computer acting as a TFTP server and the router, you can copy the Cisco IOS Software image into the Flash.

    Note: Before copying, make sure you have started the TFTP server software on your PC and that you have the filename mentioned in the TFTP server root directory. We recommend that you keep a backup of the router/access server configuration before upgrading. The upgrade itself does not affect the configuration (which is stored in nonvolatile RAM (NVRAM). However, this might happen if the right steps are not followed properly.

    For RCP applications, substitute RCP for every occurrence of TFTP. For example, use the copy rcp flash command instead of the copy tftp flash command.

        2600> enable
        Password:xxxxx
        2600#
        2600# copy tftp flash

    If necessary, you can copy an image from one device to another.
    Specify the IP address of the TFTP server.

    When prompted, enter the IP address of the TFTP server as in the following example:

        Address or name of remote host []? 10.10.10.2

    Specify the filename of the new Cisco IOS Software image.

    When prompted, enter the filename of the Cisco IOS Software image to be installed, as in the following example:

        Source filename []? c2600-i-mz.121-14.bin

    Note: The filename is case sensitive, so be sure to enter it correctly.
    Specify the destination filename.

    This is the name the new software image will have when it is loaded onto the router. The image can be named anything, but common practice is to enter the same image filename.

        Destination filename []? c2600-i-mz.121-14.bin

    Note: If you see the below error message:

    %Error copying tftp://10.10.10.2/c2600-i-mz.121-14.bin
    (Not enough space on device) 

    This indicates that there is not enough room available in Flash to copy the image. You need to erase a file(s) before copying the new image from the TFTP server.
    Upgrade the new image from a TFTP server

    2610#copy tftp flash
    Address or name of remote host []? 10.10.10.2
    Source filename []? c2600-i-mz.121-14.bin
    Destination filename [c2600-i-mz.121-14.bin]?y
    Accessing tftp://10.10.10.2/c2600-i-mz.121-14.bin...
    Erase flash: before copying? [confirm]y !---If there is not enough
                                     !--- memory available, erase the Flash
    Erasing the flash filesystem will remove all files! Continue? [confirm]y
    Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
    eeeeeeeeee ...erased
    Erase of flash: complete
    Loading c2600-i-mz.121-14.bin from 10.10.10.2 (via Ethernet0/0): !!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    [OK - 4501480/9001984 bytes]

    Verifying checksum...  OK (0xAC8A)
    4501480 bytes copied in 56.88 secs (80383 bytes/sec)

    The copying process takes several minutes; the time differs from network to network. During the copy process, messages are displayed to indicate which file has been accessed.

    The exclamation point "!" indicates that the copy process is taking place. Each exclamation point indicates that ten packets have been transferred successfully. A checksum verification of the image occurs after the image is written to Flash memory.

After you have upgraded the Flash, you need to reload the router using the reload command.

Before you reload the router, you need to check two things:

    The value of the config-register - You can check this using the show version command. The value is shown in the last line of the show version output. It should be set to 0x2102.

        2610#configure terminal
        Enter configuration commands, one per line.  End with CNTL/Z.
        2610(config)#config-register 0x2102
        2610(config)#^Z

    The other files on the Flash - If the first file in the Flash is not the Cisco IOS Software image, but a configuration file or something else, then you need to configure a boot system statement in order to boot the specified image. Otherwise, the router will try to boot with the configuration file or the first file in the Flash; this will not work. If there is only one file in the Flash which is the Cisco IOS Software image, then this step is not necessary.

        2610#configure terminal
        Enter configuration commands, one per line.  End with CNTL/Z.
        2610(config)#no boot system
        2610(config)#boot system flash c2600-i-mz.121-14.bin
        2610(config)#^Z

Note: If you type the reload command, the router asks you if you want to save the configuration. You should be very cautious here. The reason is that if the router is in boot mode for instance, it is a subset of the full Cisco IOS software which is running and there is no routing functionality. Therefore, all the routing configuration is gone in the running configuration and if you save the configuration at this time, then you erase the good startup-configuration in NVRAM and replace it by the incomplete running-configuration. Save the configuration only if you are sure that you have the full configuration in the output of show run. It is NOT necessary to save the configuration to take into account the new config-register if this one has been changed previously. That is done automatically.

    2610#reload
    
    System configuration has been modified. Save? [yes/no]: y
    Building configuration...
    [OK]
    Proceed with reload? [confirm]y

Verify that the router is running with the proper image. After the reload is complete, the router should be running the desired Cisco IOS Software image. Use the show version command to verify.

    2610#show version
    00:22:25: %SYS-5-CONFIG_I: Configured from console by console
    Cisco Internetwork Operating System Software
    IOS (tm) C2600 Software (C2600-I-M), Version 12.1(14), RELEASE SOFTWARE (fc1)
    Copyright (c) 1986-2002 by cisco Systems, Inc.
    Compiled Mon 25-Mar-02 20:33 by kellythw
    Image text-base: 0x80008088, data-base: 0x80828788

    ROM: System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1)

    2610 uptime is 22 minutes
    System returned to ROM by reload
    System image file is "flash:c2600-i-mz.121-14.bin"

What is EndPoint Connect

Check Point`s Endpoint Connect software provides a number of client side security based features such as Anti-virus/Anti-spyware. Firewall/Email Protection, Program Control and Remote Access VPN. This document will only details and discuss the Remote Access VPN section of the Endpoint Connect Software. Note : This document will refer to the Endpoint Connect Remote Access VPN as just Endpoint Connect.

Endpoint Connect is built into the software for mangers and gateways running R70 and above. For R65 gateways that require Endpoint Connect a few additional configuration steps are required which are included within this document.

Please note : This testing and documentation is based on the Endpoint Connect R73 Client.

Advantages

• Lightweight Client if you are using a single site or single entry point setup.
• Can be installed onto Windows 7 64-bit.

Disadvantages

• An additional SNX (SSL Network Extender License) is required due to that in which it authenticates across HTTPS (vistor mode)
• Link Selection is disabled (this is due to sites being defined via a single IP address).
• MEP configurations can only be achieved by using Geo-Cluster DNS name resolution.

Installation on an R65 Gateway

Upgrading a R65 Gateway to R65 Endpoint Connect:

1. Ensure that you are running HFA40 or higher.
2. Ensure that you are managing the gateway with R70 or higher.

You will now be able to configure the required Endpoint Connect settings via the Smart Dashboard.

Configuration

To enable Endpoint Connect configure/enable the following settings :

Under the Check Point Gateway Object

1. Enable VPN

2. Create a VPN domain

3. Enable NAT-T

4. Enable Visitor Mode :

5. Enable Office mode

6. Enable SSL Network Extender

7. Endpoint connect doesn`t support DES. If this is set please re-configure.

Additional Settings

Further settings can be set within the Global Properties:

Troubleshooting

Issue : Authenticating failed: GEN_application_error(0)

You may receive this error when trying to login.

This is down to your client being unable to authenticate with the VPN gateway using HTTPS. This can be caused by the following:

            1.      Port 443/tcp on the firewall is assigned to a web management GUI (WEBUI/Voyuger) instead of VPND.
            2.      Port 443/tcp is not listening due to no SNX (SSL Network Extender) License being present.

Issue : Failed to download topology

Endpoint Connect fails to connect to NGX R65 Security Gateways that are managed by an R70 Security Management server with error: "failed to download topology".

To resolve this run through the following steps :
          1.      On the R70 Security Management server, edit the file:

1./opt/CPNGXCMP-R70/lib/vpn_table.def

         2.      Scroll down to the section that starts with:

1./* Slim Client gateway tables */

         3.      Add the entry for the ccc_sessions table below it:

1.ccc_sessions            = dynamic expires 900 keep sync kbuf 1;

         4.      After adding this entry to the vpn_table.def file, open SmartDashboard and re-install policy to the NGX R65 Security Gateway(s).

How to troubleshoot SSHd problems

1. Is sshd wrapped with tcp-wrappers? Assuming the sshd daemon is invoked from inetd, your /etc/hosts.allow should list acceptable addresses from which connections are allowed.

2. Is sshd running on the standard port 22 or another? If running on a non-standard
port, make sure that your ssh client is specifying the target port.

3. Which sshd version is running? There are many problems with sshd2 used in
conjunction with tcp-wrappers. sshd1 runs with fewer difficulties wrapped. Also, the
ssh1 client has difficulty connecting to a sshd2 server.

4. Make sure that your /etc/services reflects the ssh service on the designated
port! /etc/services and tcp-wrappers work together when invoking the sshd daemon.

Example: sshd1 running on port 700 should have an entry in /etc/services as such:

ssh1        700/tcp    #ssh1
ssh1        700/udp

While in inetd.conf, the invoking line should read:

ssh1    stream  tcp     nowait  root    /usr/sbin/tcpd /usr/local/sbin/sshd1 -i -p 700

How to perform a clean installation of firewall-1 on a Nokia Platform

   1) In the Voyager interface, use the Manage Installed Packages to turn off the package, then reboot
    2)In the Voyager interface, on the Manage Installed Packages page, there is a link to a page to delete packages. Follow this link and delete the package
    3)Use a console connection to delete any remaining log files. For example, FireWall-1 maintains its logs in the /var/fw/log directory. Simply issue an
    # rm /var/fw/log/*
    4)command to remove all log files.
    Use the "newpkg" command to reinstall the package.
 

How to switch logs on a Nokia system

Here below is an example of log rotation for IPSO

#!/bin/sh
#
# Set environment variables
sh /var/etc/rcm_profile
#
cd /var/fw/log
#
# Switch CheckPoint log into dated file for saving
# Surpress resolving of IP/names
PERIOD=`date "+%d%m%y"`
$FWDIR/bin/fw logswitch $PERIOD 2> /dev/null
#
# output logfile to comma seperated variable file
$FWDIR/bin/fw logexport -d , -i $PERIOD.log -o yesterday -n 2> /dev/null
#
# search for all dropped packets
ATTACK=$PERIOD.attack
grep "drop" yesterday >> $ATTACK
#
# uuencoded files will be interpreted as an attachment by most mail clients
uuencode $ATTACK $PERIOD.csv > $PERIOD.csv
#
# mail attack to system administrator
mail -s "Fire Log Switch" fwadmin@corp.com < $PERIOD.csv

How to perform a local simulation for a remote module in order to configure it before shipment

Simulation is usefull when you are preparing equipments for remote locations. From the management module you can prepare the policy. But then you will need to download it on the remote module. If you can simulate the remote network locally you will find it easier to prepare and troubleshoot configurations.

External interface is ethernet and will be connected to a router

For the simulation you will need to change the configuration of your Internet router. You will assign a secondary interface to the router's ethernet interface. This address is the one of the remote site Internet router.

!
interface Ethernet0
ip address 192.168.10.253 255.255.255.0 secondary
ip address 194.191.78.36 255.255.255.224

By extending the number of secondary addresses you can simulate several remote locations at the same time.

External interface is on serial Interface

You will need to simulate the serial connection locally. That kind of serial connection can be of type Cisco HDLC, Frame Relay or PPP. For the simulation you will need to use a local cisco router with an available serial port

If your external interface is serial 0 on a cisco router, you will configure it in DCE mode. For this use Cisco DCE cable. The fact to have a DCE cable put the cisco serial interface in a DCE mode. Then configure the serial interface to give a clock rate to the connection. The NAP cannot work in a DCE mode itself. The nokia V.35/X.21 cable will be connected to the cisco DCE cable, and bothe connected to their respectiv serial ports. The IP address given to the serial interface of the router is the one of the remote site Internet router.


!
interface Serial0
ip address 194.193.192.254 255.255.255.252
clockrate 64000

How to SYNC on Solaris 2.6/cluster patches and FW1-v3.0b 3064 patch

I want to pass on some info about SYNC on Solaris 2.6/cluster patches
and FW1-v3.0b 3064 patch. This is undocumented but a must!

This seems to be crucial on systems where the control module and pfm
are not on the same system...

Our config has three systems. Non-vpn and no NAT just packet
filtering...

control
pfm
pfm

Creating /etc/fw/sync.conf and putkey on the pfm modules is not enough!

Modify the file below table.def and comment out the "#define sync"
command.
Then recompile and download your rule sets to the pfm modules...

This seems to be crucial on systems where the control module and pfm
are not on the same system...so if you have two systems

control/pfm
pfm

you will need to do this table.def mod...

$ more /etc/fw/lib/table.def
#ifndef __table_def__
#define __table_def__

//
// (c) Copyright 1993-1997 Check Point Software Technologies Ltd.
// All rights reserved.
//
// This is proprietary information of Check Point Software Technologies
// Ltd., which is provided for informational purposes only and for use
// solely in conjunction with the authorized use of Check Point Software
// Technologies Ltd. products. The viewing and use of this information
is
// subject, to the extent appropriate, to the terms and conditions of
the
// license agreement that authorizes the use of the relevant product.
//
//
// $Header: /fw/cvs/fw-1/fwlib/table.def,v 1.42.2.20 1998/01/01 08:09:47
ofer Ex
p $
//

// The following #define should be removed to enable FW-1
synchronization
//#define sync