Contents

Introduction

Prerequisites

Requirements

Components Used

Background Information

Before Appliance Upgrade Important Steps

Upgrade Process through WUI

Upgrade Process through CLI

Verify

Troubleshoot

Unable to Reach Update Servers

Related Information

Introduction

This document describes the process to Upgrade Cisco Secure Email and Web Manager (SMA).

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

- Physical or Virtual SMA Installed

- License activated or installed

- Secure Shell (SSH) Client

- Internet reachability for the SMA appliance

- Setup wizard is completed

- Administrative Access to the SMA

- Check the release notes to find the upgrade path

- Review the Compatibility Matrix for Cisco Secure Email (SEG) and Secure Web Appliances (SWA)

- Check the release notes to find the latest features and defects for your target version

- Check for any additional prerequisites on the release notes

Components Used

This document is not restricted to specific software and hardware versions.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

SMA is delivered with the least supported version. One of the first steps to be done once the appliance is installed is to get it upgraded to the right version that meets your environment. This document describes the steps required to get the appliance to the target version.

Before Appliance Upgrade Important Steps

1. Take steps to prevent or minimize data loss:

1. Make sure the new appliance has sufficient disk capacity and the same or greater size allocations for each data type to be transferred.

2. If you have received any disk space alerts, resolve any disk space issues before upgrade.

2. Save the XML configuration file off of the appliance. See caveats at Save and Export the Current Configuration File. If the appliance reverts to the pre-upgrade release for any reason, this file is needed.

3. If the Safelist/Blocklist feature is enabled, export the list off of the appliance.

1. Click Management Appliance > System Administration > Configuration File and scroll down.

4. Suspend the listeners through the command suspendlistener if CLI upgrade is used. If you perform the upgrade from the GUI, listener suspension occurs automatically.

5. Drain the mail queue and the delivery queue.

6. Verify that the upgrade settings are configured as you want them. See Configuring Upgrade and Service Update Settings.

Upgrade Process through WUI

Review the Prerequisites and Before Appliance Upgrade Important Steps sections and go through these steps to upgrade from current to target release:

1. Log in to the SMA Web User Interface (WUI) through admin credentials.

2. From the main menu tab, choose System Administration, then click System Upgrade as shown in this image.

Figure 1: System Upgrade

3. Click the Upgrade Options as shown in this image.

Figure 2: Select upgrade options

4. From the Displayed settings, select Download and install or Download only as shown in this image.

Figure 3: Select download and install, or download only

5. From the list of the available upgrade images, select the target version as shown in the image.

Figure 4: Select Target version

6. Select a method to save a backup for your configuration from the Upgrade Preparation section as shown in this image.

Figure 5: Configuration Backup options

7. Click on Proceed.

8. A progress bar shows the upgrade or download process. You can close the page and come back to it after the upgrade is completed.

Figure 6: Upgrade progress status bar

Note: If you have upstream proxies, make sure to configure proxy settings on System Administration > Update and Upgrade Settings.

Upgrade Process through CLI

Review the Prerequisites and Before Appliance Upgrade Important Steps sections and go through these steps to upgrade from current to target release:

1. Access the SMA Command Line Interface (CLI) through SSH Client.

2. Type the command upgrade.

3. Some versions offer the options (otherwise move to step 5):

DOWNLOAD: Downloads the version, and you can go back through steps (1-3) and select INSTALL to install the version.

DOWNLOADINSTALL: Downloads and installs the version in the same step.

INSTALL: Installs the version if it was downloaded before (This option is available if the version was downloaded before).

STATUS: Displays the status of the download if the DOWNLOAD option was chosen previously.

4. Select the appropriate option based on the current state of the upgrade.

5. Select the target version.

6. Press Enter Key to start the upgrade process.

7. After the upgrade is completed a reboot is required to apply the upgrade.

Verify

Use this section to confirm that your configuration works properly.

After the upgrade and restart are complete. Use the CLI command version to verify the system is now on the correct target release.

Troubleshoot

This section provides the information you can use to troubleshoot your configuration.

The upgrade can fail due to multiple reasons; most of these issues are related to network connectivity or drops at the time of the upgrade process.

Unable to Reach Update Servers

SMA_CLI> upgrade

Choose the operation you want to perform:

- DOWNLOADINSTALL - Downloads and installs the upgrade image (needs reboot).

- DOWNLOAD - Downloads the upgrade image.

[]> download

Upgrades available.

1. AsyncOS 14.1.0 build 239 upgrade For Management, 2022-01-17 is a release available as Maintenance Deployment.

2. AsyncOS 14.1.0 build 250 upgrade For Management, 2022-03-17, is a release available as Maintenance Deployment.

3. AsyncOS 14.2.0 build 203 upgrade For Management, 2022-05-26 is a release available as General Deployment.

[3]>3

Download error: http://updates.ironport.com/asyncos/zeus-14-2-0-203/hints/default/1

The Error message is caused due to unable to reach the update servers

Verify the SMA appliance has the correct resolution for the update servers, for detailed steps review this article.

Note: Attempt to upgrade from the WUI if the CLI fails or the SSH session times out.

Note: Firewalls need to allow idle connections to stay active, especially for the upgrade process.

Related Information

- WSA AsyncOS Release Notes

- Upgrade Process for Secure Web Appliance

- ESA AsyncOS Upgrade and Troubleshoot Procedure

- Compatibility Matrix for Cisco Secure Email and Web Manager

- Upgrades and Updates Connectivity Check

- Technical Support & Documentation - Cisco Systems