Guest

Cisco ASA 5500-X Series Next-Generation Firewalls

Upgrade to ASA 9.2 and ASDM 7.2

  • Viewing Options

  • EPUB (225.8 KB)
  • MOBI (289.3 KB)
  • PDF (331.8 KB)
  • Feedback

Table of Contents

Upgrade to ASA 9.3 and ASDM 7.3

Upgrade Path and Migrations

Viewing Your Current Version

Downloading the Software from Cisco.com

Upgrading a Standalone Unit

Upgrade Using the CLI

(ASDM) Upgrading from Your Local Computer

(ASDM) Upgrading Using the Cisco.com Wizard

Upgrading a Failover Pair or ASACluster

Upgrading an Active/Standby Failover Pair

Upgrading an Active/Active Failover Pair

Upgrading an ASA Cluster

Upgrade to ASA 9.3 and ASDM 7.3

Released: August 21, 2014

 

This section describes how to upgrade to the latest version and includes the following topics:

Upgrade Path and Migrations

  • If you are upgrading from a pre-9.0 release, because of ACL migration, you cannot later perform a downgrade; be sure to back up your configuration file in case you want to downgrade. See the ACL migration section in the 9.0 release notes for more information.
  • For a pre-9.1(2.8) version, to upgrade to 9.1(2.8) or later, you must be running one of the following versions:

8.4(5) or later

9.0(2) or later

9.1(2)

If you are running any earlier versions, you cannot upgrade directly to 9.1(2.8) or later without first upgrading to one of the above versions. For example:

 

Pre-9.1(2.8) ASA Version
First Upgrade to:
Then Upgrade to:

8.2(1)

8.4(7)

9.2(1) or later

8.4(4)

8.4(7)

9.2(1) or later

9.0(1)

9.0(4)

9.2(1) or later

9.1(1)

9.1(2)

9.2(1) or later

  • If you are upgrading from a pre-8.3 release:

See the Cisco ASA 5500 Migration Guide to Version 8.3 and Later for important information about migrating your configuration.

You cannot upgrade directly to 9.0 or later. You must first upgrade to Version 8.4 for a successful migration.

  • Software Version Requirements for Zero Downtime Upgrading:

The units in a failover configuration or ASA cluster should have the same major (first number) and minor (second number) software version. However, you do not need to maintain version parity on the units during the upgrade process; you can have different versions on the software running on each unit and still maintain failover support. To ensure long-term compatibility and stability, we recommend upgrading all units to the same version as soon as possible.

Table 1-1 shows the supported scenarios for performing zero-downtime upgrades.

 

Table 1-1 Zero-Downtime Upgrade Support

Type of Upgrade
Support

Maintenance Release

You can upgrade from any maintenance release to any other maintenance release within a minor release.

For example, you can upgrade from 8.4(1) to 8.4(6) without first installing the maintenance releases in between.

Minor Release

You can upgrade from a minor release to the next minor release. You cannot skip a minor release.

For example, you can upgrade from 8.2 to 8.3. Upgrading from 8.2 directly to 8.4 is not supported for zero-downtime upgrades; you must first upgrade to 8.3. For models that are not supported on a minor release, you can skip the minor release; for example, for the ASA 5585-X, you can upgrade from 8.2 to 8.4 (the model is not supported on 8.3).


Note Zero-downtime upgrades are possible, even when feature configuration is migrated, for example, from 8.2 to 8.3.


Major Release

You can upgrade from the last minor release of the previous version to the next major release.

For example, you can upgrade from 8.6 to 9.0, assuming that 8.6 is the last minor version in the 8.x release series for your model. Upgrading from 8.6 directly to 9.1 is not supported for zero-downtime upgrades; you must first upgrade to 9.0. For models that are not supported on a minor release, you can skip the minor release; for example, for the ASA 5585-X, you can upgrade from 8.4 to 9.0 (the model is not supported on 8.5 or 8.6).


Note Zero-downtime upgrades are possible, even when feature configuration is migrated, for example, from 8.4 to 9.0.


Viewing Your Current Version

(CLI) Use the show version command to verify the software version of your ASA. (ASDM) The software version appears on the ASDM home page; view the home page to verify the software version of your ASA.

Downloading the Software from Cisco.com

If you are using the ASDM Upgrade Wizard, you do not have to pre-download the software. If you are manually upgrading, for example for a failover upgrade, download the images to your local computer.

If you have a Cisco.com login, you can obtain the OS and ASDM images from the following website:

http://www.cisco.com/go/asa-software

(CLI) This procedure assumes you put the images on a TFTP server, although other server types are supported.

Upgrading a Standalone Unit

This section describes how to install the ASDM and operating system (OS) images using TFTP. For FTP or HTTP, see the copy command.

Upgrade Using the CLI

Detailed Steps

 

Command
Purpose

Step 1

more system:running-config
 

hostname# more system:running-config

(If there is a configuration migration) The output shows the configuration on the terminal so that you can back up your configuration. Copy the output from this command, then paste the configuration in to a text file.

For other methods of backing up, see the configuration guide.

Step 2

copy tftp:// server [/ path ]/ asa_image_name { disk0:/ | disk1:/ }[ path /] asa_image_name

 

hostname# copy tftp://10.1.1.1/asa921-smp-k8.bin disk0:/asa921-smp-k8.bin

Copies the ASA software to the active unit flash memory. For other methods than TFTP, see the copy command.

Step 3

copy tftp:// server [/ path ]/ asdm_image_name { disk0:/ | disk1:/ }[ path /] asdm_image_name

 

hostname# copy tftp://10.1.1.1/asdm-721.bin disk0:/asdm-721.bin

Copies the ASDM image to the active unit flash memory.

Step 4

configure terminal

 

hostname(config)# configure terminal

If you are not already in global configuration mode, accesses global configuration mode.

Step 5

show running-config boot system

 

hostname(config)# show running-config boot system

boot system disk0:/cdisk.bin

boot system disk0:/asa914-smp-k8.bin

Shows the current boot images configured (up to 4). The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to Step 6 and Step 7.

Step 6

no boot system { disk0:/ | disk1:/ }[ path /] asa_image_name

 

hostname(config)# no boot system disk0:/cdisk.bin

hostname(config)# no boot system disk0:/asa914-smp-k8.bin

Removes any existing boot image configurations so that you can enter the new boot image as your first choice.

Step 7

boot system { disk0:/ | disk1:/ }[ path /] asa_image_name

 

hostname(config)# boot system disk0://asa921-smp-k8.bin

Sets the ASA image to boot (the one you just uploaded).

Repeat this command for any backup images that you want to use in case this image is unavailable. For example, you can re-enter the images that you previously removed in Step 6.

Step 8

asdm image { disk0:/ | disk1:/ }[ path / ] asdm_image_name

 

hostname(config)# asdm image disk0:/asdm-721.bin

Sets the ASDM image to use (the one you just uploaded). You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.

Step 9

write memory

 

hostname(config)# write memory

Saves the new settings to the startup configuration.

Step 10

reload

 

hostname# reload

Reloads the ASA.

(ASDM) Upgrading from Your Local Computer

The Upgrade Software from Local Computer tool lets you upload an image file from your computer to the flash file system to upgrade the ASA.

Detailed Steps


Step 1 (If there is a configuration migration) In ASDM, back up your existing configuration using the Tools > Backup Configurations tool.

Step 2 In the main ASDM application window, choose Tools > Upgrade Software from Local Computer .

The Upgrade Software dialog box appears.

 

Step 3 From the Image to Upload drop-down list, choose ASDM .

Step 4 In the Local File Path field, enter the local path to the file on your computer or click Browse Local Files to find the file on your PC.

Step 5 In the Flash File System Path field, enter the path to the flash file system or click Browse Flash to find the directory or file in the flash file system.

Step 6 Click Upload Image . The uploading process might take a few minutes.

Step 7 You are prompted to set this image as the ASDM image. Click Yes .

 

Step 8 You are reminded to exit ASDM and save the configuration. Click OK . You exit the Upgrade tool. Note: You will save the configuration and reload ASDM after you upgrade the ASA software.

 

Step 9 Repeat Step 2 through Step 8, choosing ASA from the Image to Upload drop-down list. You can also use this procedure to upload other file types.

Step 10 Choose Tools > System Reload to reload the ASA.

A new window appears that asks you to verify the details of the reload.

a. Click the Save the running configuration at the time of reload radio button (the default).

b. Choose a time to reload (for example, Now , the default).

c. Click Schedule Reload .

Once the reload is in progress, a Reload Status window appears that indicates that a reload is being performed. An option to exit ASDM is also provided.

Step 11 After the ASA reloads, restart ASDM.


 

(ASDM) Upgrading Using the Cisco.com Wizard

The Upgrade Software from Cisco.com Wizard lets you automatically upgrade the ASDM and ASA to more current versions.

In this wizard, you can do the following:

  • Choose an ASA image file and/or ASDM image file to upgrade.

Note ASDM downloads the latest image version, which includes the build number. For example, if you are downloading 9.2(1), the download might be 9.2(1.2). This behavior is expected, so you may proceed with the planned upgrade.


  • Review the upgrade changes that you have made.
  • Download the image or images and install them.
  • Review the status of the installation.
  • If the installation completed successfully, restart the ASA to save the configuration and complete the upgrade.

Detailed Steps


Step 1 (If there is a configuration migration) In ASDM, back up your existing configuration using the Tools > Backup Configurations tool.

Step 2 Choose Tools > Check for ASA/ASDM Updates .

In multiple context mode, access this menu from the System.

The Cisco.com Authentication dialog box appears.

Step 3 Enter your Cisco.com username and password, and then click Login .

The Cisco.com Upgrade Wizard appears.


Note If there is no upgrade available, a dialog box appears. Click OK to exit the wizard.


Step 4 Click Next to display the Select Software screen.

The current ASA version and ASDM version appear.

Step 5 To upgrade the ASA version and ASDM version, perform the following steps:

a. In the ASA area, check the Upgrade to check box, and then choose an ASA version to which you want to upgrade from the drop-down list.

b. In the ASDM area, check the Upgrade to check box, and then choose an ASDM version to which you want to upgrade from the drop-down list.

Step 6 Click Next to display the Review Changes screen.

Step 7 Verify the following items:

    • The ASA image file and/or ASDM image file that you have downloaded are the correct ones.
    • The ASA image file and/or ASDM image file that you want to upload are the correct ones.
    • The correct ASA boot image has been selected.

Step 8 Click Next to start the upgrade installation.

You can then view the status of the upgrade installation as it progresses.

The Results screen appears, which provides additional details, such as the upgrade installation status (success or failure).

Step 9 If the upgrade installation succeeded, for the upgrade versions to take effect, check the Save configuration and reload device now check box to restart the ASA, and restart ASDM.

Step 10 Click Finish to exit the wizard and save the configuration changes that you have made.


Note To upgrade to the next higher version, if any, you must restart the wizard.



 

Upgrading an Active/Standby Failover Pair

To upgrade the Active/Standby failover pair, perform the following steps.

Requirements

(CLI) Perform these steps on the active unit.

Detailed Steps

For CLI:

 

Command
Purpose

Step 1

more system:running-config
 

active# more system:running-config

(If there is a configuration migration) The output shows the configuration on the terminal so that you can back up your configuration. Copy the output from this command, then paste the configuration in to a text file.

For other methods of backing up, see the configuration guide.

Step 2

copy tftp:// server [/ path ]/ asa_image_name { disk0:/ | disk1:/ }[ path /] asa_image_name

 

active# copy tftp://10.1.1.1/asa921-smp-k8.bin disk0:/asa921-smp-k8.bin

Copies the ASA software to the active unit flash memory. For other methods than TFTP, see the copy command.

Step 3

failover exec mate copy /noconfirm tftp:// server [/ path ]/f ilename { disk0:/ | disk1:/ }[ path /] filename

 

active# failover exec mate copy /noconfirm tftp://10.1.1.1/asa921-smp-k8.bin disk0:/asa921-smp-k8.bin

Copies the software to the standby unit; be sure to specify the same path as for the active unit.

Step 4

copy tftp:// server [/ path ]/ asdm_image_name { disk0:/ | disk1:/ }[ path /] asdm_image_name

 

active# copy tftp://10.1.1.1/asdm-721.bin disk0:/asdm-721.bin

Copies the ASDM image to the active unit flash memory.

Step 5

failover exec mate copy /noconfirm tftp:// server [/ path ]/ asdm_image_name { disk0:/ | disk1:/ }[ path /] asdm_image_name

 

active# failover exec mate copy /noconfirm tftp://10.1.1.1/asdm-721.bin disk0:/asdm-721.bin

Copies the ASDM image to the standby unit; be sure to specify the same path as for the active unit.

Step 6

configure terminal

 

active(config)# configure terminal

If you are not already in global configuration mode, accesses global configuration mode.

Step 7

show running-config boot system

 

hostname(config)# show running-config boot system

boot system disk0:/cdisk.bin

boot system disk0:/asa912-smp-k8.bin

Shows the current boot images configured (up to 4). The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to Step 8 and Step 9.

Step 8

no boot system { disk0:/ | disk1:/ }[ path /] asa_image_name

 

hostname(config)# no boot system disk0:/cdisk.bin

hostname(config)# no boot system disk0:/asa912-smp-k8.bin

Removes any existing boot image configurations so that you can enter the new boot image as your first choice.

Step 9

boot system { disk0:/ | disk1:/ }[ path /] asa_image_name

 

hostname(config)# boot system disk0://asa921-smp-k8.bin

Sets the ASA image to boot (the one you just uploaded).

Repeat this command for any backup images that you want to use in case this image is unavailable. For example, you can re-enter the images that you previously removed in Step 8.

Step 10

asdm image { disk0:/ | disk1:/ }[ path / ] asdm_image_name

 

hostname(config)# asdm image disk0:/asdm-721.bin

Sets the ASDM image to use (the one you just uploaded). You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.

Step 11

write memory

 

active(config)# write memory

Saves the new settings to the startup configuration.

Step 12

failover reload-standby

 

active# failover reload-standby

Reloads the standby unit to boot the new image.

Wait for the standby unit to finish loading. Use the show failover command to verify that the standby unit is in the Standby Ready state.

Step 13

no failover active

 

active# no failover active

Forces the active unit to fail over to the standby unit.

Step 14

reload

 

active# reload

Reloads the former active unit (now the new standby unit). If you want to restore this unit to be active after it reloads, enter the failover active command.

For ASDM:


Step 1 (If there is a configuration migration) In ASDM, back up your existing configuration using the Tools > Backup Configurations tool.

Step 2 On the active unit, in the main ASDM application window, choose Tools > Upgrade Software from Local Computer .

The Upgrade Software dialog box appears.

 

Step 3 From the Image to Upload drop-down list, choose ASDM .

Step 4 In the Local File Path field, enter the local path to the file on your computer or click Browse Local Files to find the file on your PC.

Step 5 In the Flash File System Path field, enter the path to the flash file system or click Browse Flash to find the directory or file in the flash file system.

Step 6 Click Upload Image . The uploading process might take a few minutes.

Step 7 You are prompted to set this image as the ASDM image. Click Yes .

 

Step 8 You are reminded to exit ASDM and save the configuration. Click OK . You exit the Upgrade tool. Note: You will save the configuration and reload ASDM after you upgrade the ASA software.

 

Step 9 Repeat Step 2 through Step 8, choosing ASA from the Image to Upload drop-down list.

Step 10 Click the Save icon on the toolbar to save your configuration changes.

Step 11 Connect ASDM to the standby unit, and upload the ASA and ASDM software according to Step 2 through Step 9, using the same file locations you used on the active unit.

Step 12 Choose Tools > System Reload to reload the standby ASA.

A new window appears that asks you to verify the details of the reload.

a. Click the Save the running configuration at the time of reload radio button (the default).

b. Choose a time to reload (for example, Now , the default).

c. Click Schedule Reload .

Once the reload is in progress, a Reload Status window appears that indicates that a reload is being performed. An option to exit ASDM is also provided.

Step 13 After the standby ASA reloads, restart ASDM and connect to the standby unit to make sure it is running.

Step 14 Connect ASDM to the active unit again.

Step 15 Force the active unit to fail over to the standby unit by choosing Monitoring > Properties > Failover > Status , and clicking Make Standby .

Step 16 Choose Tools > System Reload to reload the (formerly) active ASA.

A new window appears that asks you to verify the details of the reload.

a. Click the Save the running configuration at the time of reload radio button (the default).

b. Choose a time to reload (for example, Now , the default).

c. Click Schedule Reload .

Once the reload is in progress, a Reload Status window appears that indicates that a reload is being performed. An option to exit ASDM is also provided.

After the ASA comes up, it will now be the standby unit.


 

Upgrading an Active/Active Failover Pair

To upgrade two units in an Active/Active failover configuration, perform the following steps.

Requirements

Perform these steps in the system execution space. (CLI) Also perform these steps on the primary unit.

Detailed Steps

For CLI:

 

Command
Purpose

Step 1

more system:running-config
 

primary# more system:running-config

(If there is a configuration migration) The output shows the configuration on the terminal so that you can back up your configuration. Copy the output from this command, then paste the configuration in to a text file.

For other methods of backing up, see the configuration guide.

Step 2

copy tftp:// server [/ path ]/ asa_image_name { disk0:/ | disk1:/ }[ path /] asa_image_name

 

primary# copy tftp://10.1.1.1/asa921-smp-k8.bin disk0:/asa921-smp-k8.bin

Copies the ASA software to the primary unit flash memory. For other methods than TFTP, see the copy command.

Step 3

failover exec mate copy /noconfirm tftp:// server [/ path ]/f ilename { disk0:/ | disk1:/ }[ path /] filename

 

primary# failover exec mate copy /noconfirm tftp://10.1.1.1/asa921-smp-k8.bin disk0:/asa921-smp-k8.bin

Copies the software to the secondary unit; be sure to specify the same path as for the primary unit.

Step 4

copy tftp:// server [/ path ]/ asdm_image_name { disk0:/ | disk1:/ }[ path /] asdm_image_name

 

primary# copy tftp://10.1.1.1/asdm-721.bin disk0:/asdm-721.bin

Copies the ASDM image to the primary unit flash memory.

Step 5

failover exec mate copy /noconfirm tftp:// server [/ path ]/ asdm_image_name { disk0:/ | disk1:/ }[ path /] asdm_image_name

 

primary# failover exec mate copy /noconfirm tftp://10.1.1.1/asdm-721.bin disk0:/asdm-721.bin

Copies the ASDM image to the secondary unit; be sure to specify the same path as for the active unit.

Step 6

failover active group 1

failover active group 2

 

primary# failover active group 1

primary# failover active group 2

Makes both failover groups active on the primary unit.

Step 7

configure terminal

 

primary(config)# configure terminal

If you are not already in global configuration mode, accesses global configuration mode.

Step 8

show running-config boot system

 

hostname(config)# show running-config boot system

boot system disk0:/cdisk.bin

boot system disk0:/asa912-smp-k8.bin

Shows the current boot images configured (up to 4). The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to Step 9 and Step 10.

Step 9

no boot system { disk0:/ | disk1:/ }[ path /] asa_image_name

 

hostname(config)# no boot system disk0:/cdisk.bin

hostname(config)# no boot system disk0:/asa912-smp-k8.bin

Removes any existing boot image configurations so that you can enter the new boot image as your first choice.

Step 10

boot system { disk0:/ | disk1:/ }[ path /] asa_image_name

 

hostname(config)# boot system disk0://asa921-smp-k8.bin

Sets the ASA image to boot (the one you just uploaded).

Repeat this command for any backup images that you want to use in case this image is unavailable. For example, you can re-enter the images that you previously removed in Step 9.

Step 11

asdm image { disk0:/ | disk1:/ }[ path / ] asdm_image_name

 

hostname(config)# asdm image disk0:/asdm-721.bin

Sets the ASDM image to use (the one you just uploaded). You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.

Step 12

write memory

 

primary(config)# write memory

Saves the new settings to the startup configuration.

Step 13

failover reload-standby

 

primary# failover reload-standby

Reloads the secondary unit to boot the new image.

Wait for the secondary unit to finish loading. Use the show failover command to verify that both failover groups are in the Standby Ready state.

Step 14

no failover active group 1

no failover active group 2

 

primary# no failover active group 1

primary# no failover active group 2

Forces both failover groups to become active on the secondary unit.

Step 15

reload

 

primary# reload

Reloads the primary unit. If the failover groups are configured with the preempt command, they automatically become active on their designated unit after the preempt delay has passed. If the failover groups are not configured with the preempt command, you can return them to active status on their designated units using the failover active group command.

For ASDM:


Step 1 (If there is a configuration migration) In ASDM, back up your existing configuration using the Tools > Backup Configurations tool.

Step 2 On the primary unit, in the main ASDM application window, choose Tools > Upgrade Software from Local Computer .

The Upgrade Software dialog box appears.

 

Step 3 From the Image to Upload drop-down list, choose ASDM .

Step 4 In the Local File Path field, enter the local path to the file on your computer or click Browse Local Files to find the file on your PC.

Step 5 In the Flash File System Path field, enter the path to the flash file system or click Browse Flash to find the directory or file in the flash file system.

Step 6 Click Upload Image . The uploading process might take a few minutes.

Step 7 You are prompted to set this image as the ASDM image. Click Yes .

 

Step 8 You are reminded to exit ASDM and save the configuration. Click OK . You exit the Upgrade tool. Note: You will save the configuration and reload ASDM after you upgrade the ASA software.

 

Step 9 Repeat Step 2 through Step 8, choosing ASA from the Image to Upload drop-down list.

Step 10 Click the Save icon on the toolbar to save your configuration changes.

Step 11 Make both failover groups active on the primary unit by choosing Monitoring > Failover > Failover Group # , where # is the number of the failover group you want to move to the primary unit, and clicking Make Active .

Step 12 Connect ASDM to the secondary unit, and upload the ASA and ASDM software according to Step 2 through Step 9, using the same file locations you used on the active unit.

Step 13 Choose Tools > System Reload to reload the secondary ASA.

A new window appears that asks you to verify the details of the reload.

a. Click the Save the running configuration at the time of reload radio button (the default).

b. Choose a time to reload (for example, Now , the default).

c. Click Schedule Reload .

Once the reload is in progress, a Reload Status window appears that indicates that a reload is being performed. An option to exit ASDM is also provided.

Step 14 Connect ASDM to the primary unit, and check when the secondary unit reloads by choosing Monitoring > Failover > System .

Step 15 After the secondary unit comes up, force the primary unit to fail over to the secondary unit by choosing Monitoring > Properties > Failover > System , and clicking Make Standby .

Step 16 Choose Tools > System Reload to reload the (formerly) active ASA.

A new window appears that asks you to verify the details of the reload.

a. Click the Save the running configuration at the time of reload radio button (the default).

b. Choose a time to reload (for example, Now , the default).

c. Click Schedule Reload .

Once the reload is in progress, a Reload Status window appears that indicates that a reload is being performed. An option to exit ASDM is also provided.

If the failover groups are configured with Preempt Enabled, they automatically become active on their designated unit after the preempt delay has passed. If the failover groups are not configured with Preempt Enabled, you can return them to active status on their designated units using the Monitoring > Failover > Failover Group # pane.


 

Upgrading an ASA Cluster

To upgrade all units in an ASA cluster, perform the following steps on the master unit. For multiple context mode, perform these steps in the system execution space.

Detailed Steps

For CLI:

 

Command
Purpose

Step 1

more system:running-config
 

master# more system:running-config

(If there is a configuration migration) Backs up your configuration file. Copy the output from this command, then paste the configuration in to a text file.

For other methods of backing up, see the configuration guide.

Step 2

cluster exec copy /noconfirm tftp:// server [/ path ]/ asa_image_name { disk0:/ | disk1:/ }[ path /] asa_image_name

 

master# cluster exec copy /noconfirm tftp://10.1.1.1/asa921-smp-k8.bin disk0:/asa921-smp-k8.bin

Copies the ASA software to all units in the cluster. For other methods than TFTP, see the copy command.

Step 3

cluster exec copy /noconfirm tftp:// server [/ path ]/ asdm_image_name { disk0:/ | disk1:/ }[ path /] asdm_image_name

 

master# cluster exec copy /noconfirm tftp://10.1.1.1/asdm-721.bin disk0:/asdm-721.bin

Copies the ASDM image to all units in the cluster.

Step 4

configure terminal

 

master(config)# configure terminal

If you are not already in global configuration mode, accesses global configuration mode.

Step 5

show running-config boot system

 

hostname(config)# show running-config boot system

boot system disk0:/cdisk.bin

boot system disk0:/asa912-smp-k8.bin

Shows the current boot images configured (up to 4). The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to Step 6 and Step 7.

Step 6

no boot system { disk0:/ | disk1:/ }[ path /] asa_image_name

 

hostname(config)# no boot system disk0:/cdisk.bin

hostname(config)# no boot system disk0:/asa912-smp-k8.bin

Removes any existing boot image configurations so that you can enter the new boot image as your first choice.

Step 7

boot system { disk0:/ | disk1:/ }[ path /] asa_image_name

 

hostname(config)# boot system disk0://asa921-smp-k8.bin

Sets the ASA image to boot (the one you just uploaded).

Repeat this command for any backup images that you want to use in case this image is unavailable. For example, you can re-enter the images that you previously removed in Step 6.

Step 8

asdm image { disk0:/ | disk1:/ }[ path / ] asdm_image_name

 

hostname(config)# asdm image disk0:/asdm-721.bin

Sets the ASDM image to use (the one you just uploaded). You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.

Step 9

write memory

 

master(config)# write memory

Saves the new settings to the startup configuration.

Step 10

cluster exec unit slave-unit reload noconfirm

 

master# cluster exec unit unit2 reload noconfirm

Reloads each slave unit when you repeat this command for each unit name. To avoid connection loss and allow traffic to stabilize, wait for each unit to come back up (approximately 5 minutes) before reloading the next unit.

To view member names, enter cluster exec unit ? , or enter the show cluster info command.

Step 11

no enable

 

master(config)# no enable

Disables clustering on the master unit. Wait for 5 minutes for a new master to be selected and traffic to stabilize.

Do not enter write memory ; when the master unit reloads, you want clustering to be enabled on it.

Step 12

reload noconfirm

 

master# reload noconfirm

Reloads the master unit. A new election takes place for a new master unit. When the former master unit rejoins the cluster, it will be a slave.

For ASDM:


Step 1 Launch ASDM on the master unit.

Step 2 (If there is a configuration migration) In ASDM, back up your existing configuration using the Tools > Backup Configurations tool.

Step 3 In the main ASDM application window, choose Tools > Upgrade Software from Local Computer .

The Upgrade Software from Local Computer dialog box appears.

Step 4 Click the All devices in the cluster radio button.

The Upgrade Software dialog box appears.

 

Step 5 From the Image to Upload drop-down list, choose ASDM .

Step 6 In the Local File Path field, enter the local path to the file on your computer or click Browse Local Files to find the file on your PC.

Step 7 In the Flash File System Path field, enter the path to the flash file system or click Browse Flash to find the directory or file in the flash file system.

Step 8 Click Upload Image . The uploading process might take a few minutes.

Step 9 You are prompted to set this image as the ASDM image. Click Yes .

 

Step 10 You are reminded to exit ASDM and save the configuration. Click OK . You exit the Upgrade tool. Note: You will save the configuration and reload ASDM after you upgrade the ASA software.

 

Step 11 Repeat Step 3 through Step 10, choosing ASA from the Image to Upload drop-down list.

Step 12 Click the Save icon on the toolbar to save your configuration changes.

Step 13 Choose Tools > System Reload .

The System Reload dialog box appears.

Step 14 Reload each slave unit one at a time by choosing a slave unit name from the Device drop-down list, and then clicking Schedule Reload to reload the unit now.

 

To avoid connection loss and allow traffic to stabilize, wait for each unit to come back up (approximately 5 minutes) before reloading the next unit. To view when a unit rejoins the cluster, see the Monitoring > ASA Cluster > Cluster Summary pane.

Step 15 After all slave units have reloaded, disable clustering on the master unit by choosing Configuration > Device Management > High Availability and Scalability > ASA Cluster , uncheck the Participate in ASA cluster check box, and click Apply .

Wait for 5 minutes for a new master to be selected and traffic to stabilize. When the former master unit rejoins the cluster, it will be a slave.

Do not save the configuration; when the master unit reloads, you want clustering to be enabled on it.

Step 16 Choose Tools > System Reload and reload the master unit from the System Reload dialog box by choosing --This Device-- from the Device drop-down list.

Step 17 Quit and restart ASDM; you will reconnect to the new master unit.


 

Copyright © 2014 Cisco Systems, Inc. All rights reserved.