Using the ROMMON to load a new image on Cisco ASA Firewall
If for any reason the software image on your Cisco ASA appliance is corrupted and the device does not boot to normal operating mode, then you can load a new image using ROMMON (ROM monitor mode) and TFTP. Follow the steps below to get into ROMMON mode and then assign all necessary settings for uploading the new image file:
Step1: Connect to the ASA firewall using a console cable.
Step2: Power off the appliance and then power it on.
Step3: When the appliance starts, press the Escape key on your keyboard to force the appliance to enter ROMMON mode.
Step4: In ROMMON mode, configure all necessary settings for connecting to the TFTP server to load the new image. You need to connect a PC with TFTP server on a firewall port (e.g Ethernet0/0). Then enter the following commands on the ASA.
rommon #1> ADDRESS=192.168.1.10
rommon #2> SERVER=192.168.1.1
rommon #3> GATEWAY=192.168.1.1
rommon #4> IMAGE=asa800-232-k8.bin
rommon #5> PORT=Ethernet0/0
The above configuration will assign an IP address of 192.168.1.10 to interface Ethernet0/0 of the firewall appliance. It will also tell the firewall that the TFTP SERVER is at address 192.168.1.1 and the image to load is asa800-232-k8.bin
Step5: Execute the TFTP upload from the ASA using:
rommon #6> tftp
The above instructs the firewall to start uploading the image file from TFTP.
After the firewall reboots, login and check that the new image has been installed (show version)
Related posts:
- Password Recovery for the Cisco ASA 5500 Firewall
- IP Phones behind a Cisco ASA 5505 Firewall
- How to upgrade the Cisco ASA 5505 software
- Block Attacks with a Cisco ASA Firewall and IDS using the shun command
- Configuring AAA Authentication on Cisco ASA Firewall
Tagged with: asa rommon • asa tftp image • how to load new image using rommon
Filed under: Cisco ASA General
Like this post? Subscribe to my RSS feed and get loads more!
Thank you for your time writing this guide, it was very helpful. It works perfectly on my ASA5505.
James
Hello James,
Thanks for your feedback. I’m glad the guide was helpful to you.
Harris
Tried this but Ethernet0/0 link is down. Do you know how I can bring it up?
Which ASA model are you using? If its a higher end model (5520 and up) then the interface is Gigabitethernet and not Ethernet, so you need to specify the correct interface name in ROMMON
It’s the 5510. the commands work but the ethernet0/0 link is down.
Hello Alan,
Connect your PC with the TFTP server on a different Ethernet port (e.g Ethernet0/1) and use that in the ROMMON command.
My bad, I didn’t have the ip for my pc set correctly. This worked great. Thanks from us that are just learning and shoot ourselves in the foot.
Thnx Man, That helped a lot!!!!