Important Update Notes

Before you begin the update process to Version 6.2.0.x, you should familiarize yourself with the behavior of the system during the update process, as well as with any compatibility issues or required pre- or post update configuration changes.


Caution

Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.

Update Paths to Version 6.2.0.x

Firepower Management Center Update Paths

The following table describes update paths for Firepower Management Centers, including Firepower Management Center Virtual:

Firepower Management Center Platform

Update Path

MC750, MC1000, MC1500, MC2000, MC2500, MC3500, MC4000, MC4500

Firepower Management Center Virtual: VMware

Version 5.4.1.1+ > Version 6.0.0 Pre-Installation Package > Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

Firepower Management Center Virtual: AWS

Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

Firepower Management Center Virtual: KVM

Version 6.1.0 > Version 6.2.0

Firepower Threat Defense Update Paths—With Firepower Management Center

This table describes update paths for Firepower Threat Defense devices managed by a Firepower Management Center.

Firepower Threat Defense Platform

Update Path

ASA 5506-X, ASAS 5506H-X, ASA 5506W-X, ASA 5508-X, 16-X

ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

Firepower Threat Defense Virtual: VMware

Firepower Threat Defense Virtual: AWS

Firepower 4110, 4120, 4140

Firepower 9300 with SM-24, SM-36, or SM-44 modules

Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

Firepower Threat Defense Virtual: KVM

Firepower 4150

Version 6.1.0 > Version 6.2.0

Firepower Threat Defense Virtual: Azure

Version 6.2.0

Firepower Threat Defense Update Paths—With Firepower Device Manager

This table describes update paths for Firepower Threat Defense devices managed by Firepower Device Manager.

Firepower Threat Defense Platform

Update Path

ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5516-X

ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

Version 6.1.0 > Version 6.2.0

NGIPS Update Paths—With Firepower Management Center

This table describes update paths for NGIPS devices (including ASA FirePOWER modules) managed by a Firepower Management Center.

NGIPS Platform

Update Path

Firepower 7010, 7020, 7030, 7050, 7110, 7115, 7120, 7125

Firepower 8120, 8130, 8140, 8250, 8260, 8270, 8290, 8350, 8360, 8370, 8390

AMP7150, AMP8050, AMP8150, AMP8350, AMP8360, AMP8370, AMP8390

ASA FirePOWER: ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

ASA FirePOWER: ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

NGIPSv: VMware

Version 5.4.0.2 > Version 6.0.0 Pre-Installation Package > Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

ASA FirePOWER: ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5516-X

Version 5.4.1.1 > Version 6.0.0 Pre-Installation Package > Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

NGIPS Update Paths—ASA FirePOWER with ASDM

This table describes update paths for ASA FirePOWER modules managed by ASDM.

ASA FirePOWER NGIPS Platform

Update Path

ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5516-X

Version 5.4.1.1 > Version 6.0.0 Pre-Installation Package > Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA 5555-X

ASA 5585-X-SSP-10, ASA 5585-X-SSP-20, ASA 5585-X-SSP-40, ASA 5585-X-SSP-60

Version 6.0.0 > Version 6.0.1 Preinstall > Version 6.0.1 > Version 6.1.0 Pre-Installation Package > Version 6.1.0 > Version 6.2.0

Update Interface Options

If you are locally managing the ASA FirePOWER module with ASDM, use the ASDM to perform the update. To configure the ASA FirePOWER module through ASDM, see the Cisco ASA with FirePOWER Services Local Management Configuration Guide.

If you are locally managing a Firepower Threat Defense device with the Firepower Device Manager, use the Firepower Device Manager to update your Firepower Threat Defense device. To configure the Firepower Device Manager, see the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.

Otherwise, use the Firepower Management Center to update first the Firepower Management Center and then the devices it manages. To configure the Firepower Management Center or its managed devices, see the Firepower Management Center Configuration Guide.

For more information about management, see Management Capability in Version 6.2.0.x.

Update Sequence Guidelines

Update your Firepower Management Center to at least Version 6.2.0 before updating the devices it manages. Then, use the Firepower Management Center to redeploy policies to all managed devices before updating those devices to Version 6.2.0.x.

Note the following update sequence complications when you have high availability or device stacking configured:

Update Sequence for Firepower Management Centers in High Availability

To ensure continuity of operations, do not simultaneously update Firepower Management Centers in a high availability pair. The following steps allow you to safely update the pair.

    Step 1   Pause the synchronization of the active Firepower Management Center of the high availability pair on the High Availability tab of the Integration page ( System > Integration) as described in the Pausing Communication Between Paired Firepower Management Centers topic in the Firepower Management Center Configuration Guide, Version 6.2.0.
    Step 2   Update the standby Firepower Management Center in the high availability pair.

    The Firepower Management Center switches from standby to active so both Firepower Management Centers in the high availability pair are active.

    The update completes.

    Step 3   Update the other Firepower Management Center within the pair.

    The update is complete.

    Step 4   Click Make-Me-Active on the High Availability tab of one of the Firepower Management Center web UIs.

    The Firepower Management Center you do not make active automatically switches to standby mode.

    Caution   

    Policy changes during the update process may be lost when reestablishing high availability depending on which appliance you choose to be active after upgrade.

    If you register a managed device and deploy policies to a Firepower Management Center in a high availability scenario where both appliances are active, this deployment is not supported. Before you resolve a pair of active Firepower Management Centers, you must export any policies and unregister any managed devices from the standby Firepower Management Center. You may then register the managed devices and import the policies to the active Firepower Management Center.

    Step 5   Restart the communication as described in the Restarting Communication Between Paired Firepower Management Centers topic of the Firepower Management Center Configuration Guide, Version 6.2.0.

    Update Sequence for Firepower Threat Defense Devices in High Availability

    Update the FXOS chassis of Firepower Threat Defense devices in a high availability pair to the most recent compatible FXOS version before installing the most recent Firepower version. For more information on FXOS versions, see the Firepower System Compatibility Guide.


    Caution
    You must always update the FXOS version on the standby device of a Firepower Threat Defense high availability pair. Do not update the FXOS version of the active device.
      Step 1   Update the FXOS version on the standby Firepower Threat Defense device within the high availability pair.
      Step 2   Switch the active peer, so the standby Firepower Threat Defense device is now the active device.
      Step 3   Update the FXOS version on the standby Firepower Threat Defense device within the high availability pair.
      What to Do Next

      Update the Firepower Threat Defense high availabiltiy pair to the most recent Firepower version.

      When you install a Firepower update on Firepower Threat Defense devices in a high availability pair, the devices update one at a time. When the update starts, Firepower first applies it to the standby device, which goes into maintenance mode until any necessary processes restart and the device is processing traffic again. Once the standby Firepower Threat Defense update is complete, the active Firepower Threat Defense automatically fails over to standby mode and then updates.

      Update Sequence for Clustered Firepower Threat Defense Devices

      When you update clustered Firepower 9300 or Firepower 4100 series devices running Firepower Threat Defense, the system updates the security modules one at a time—first the secondary security modules, then the primary security module. Modules operate in maintenance mode while they update.

      During the primary security module update, although traffic inspection and handling continues normally, the system stops logging events. Event logging resumes after the full update is completed.


      Caution

      Updating FXOS reboots the device, which can affect traffic in a clustered environment until at least one module comes online. In an intra-chassis cluster, traffic drops if the cluster does not use an optional hardware bypass (fail‑to‑wire) module or if bypass is disabled. Traffic passes without inspection if bypass is enabled. In an inter‑chassis cluster, traffic drops during the reboot if chassis reboots overlap before at least one module comes online; traffic is unaffected if there is no reboot overlap.

      For more information, see the Firepower Threat Defense Cluster for the FXOS Chassis chapter of the Firepower Management Center Configuration Guide and the About Clustering on the FXOS Chassis chapter of the Cisco FXOS Firepower Chassis Manager Configuration Guide.

      Events for traffic processed during the logging downtime appear with out-of-sync timestamps after the update is complete. However, if the logging downtime was significant, the system may prune the oldest events before they can be logged.

      Update Sequence for 7000 and 8000 Series Devices in High Availability


      Note

      You cannot locally update 7000 and 8000 Series devices in a high availability pair. You must update from the managing Firepower Management Center.

      When you install an update on 7000 and 8000 Series devices in a high availability pair, the system updates the devices one at a time. When the update starts, the system first applies it to the standby device, which goes into maintenance mode until any necessary processes restart and the device is processing traffic again. The system then updates the active device, which follows the same process.

      Update Sequence for Stacked 8000 Series Devices

      When you install an update on 8000 Series stacked devices, Firepower updates the stacked devices simultaneously. Each device resumes normal operation when the update is complete. Note the following scenarios:

      • If the active device completes the update before all of the standby devices, the stack operates in a limited, mixed-version state until all devices have completed the update.

      • If the active device completes the update after all of the standby devices, the stack resumes normal operation when the update is complete on the active device.

      Preupdate Readiness Checks

      System update readiness checks contain a series of robustness checks that assess the preparedness of the system for an update. The readiness check identifies issues with the system, including issues with the integrity of the database, version inconsistencies, and device registration.

      While the readiness check is optional, we strongly recommend launching a readiness check before you update.


      Note

      The readiness check cannot assess your preparedness for VDB, SRU, or GeoDB updates; the readiness check is a system update readiness check.

      You must upload the update package and run the readiness check through the shell or Firepower Management Center web interface BEFORE updating the appliances. The readiness check cannot execute if the update package is not uploaded to the managing Firepower Management Center. If your appliance fails the readiness check, correct the issues and run the readiness check again. See Run a Readiness Check through the Shell and Run a Readiness Check through the Firepower Management Center Web Interface for more information.


      Caution

      Do not reboot or shut down your appliance during the readiness check.


      Caution

      If you encounter issues with the readiness check that you cannot resolve, do not begin the update. Instead, contact Cisco TAC.

      Run a Readiness Check through the Shell

      You can run a readiness check through the shell on any appliance running Version 6.1.0 and later. Note that you cannot update directly from Version 6.1.0 to Version 6.2.0.x. For more information, see the Update Paths to Version 6.2.0.x. The time required to run the readiness check varies depending on your appliance model and database size.

        Step 1   Download the update from the Support site.
        Note   

        Download the update package directly from the Support site. If you transfer an update file by email, it may become corrupted.

        Step 2   Upload the update package to the appliance.
        Step 3   Redeploy configuration changes to any managed devices. Otherwise, the eventual update of the managed devices may fail.
        Step 4   Access the shell through the CLI for your appliance as a user with administrator privileges.
        Step 5   At the prompt, run the readiness check as the root user, where updatefilename is the name of the update you downloaded:

        sudo install_update.pl --readiness-check /var/sf/updates/updatefilename

        Step 6   Monitor the progress of the readiness check in the command prompt window. When the readiness check is complete, the system reports the success or failure in the command prompt window.
        Step 7   Access the full readiness check report in /var/log/sf/$rpm_name/upgrade_readiness, where $rpm_name is the truncated update package name.

        Run a Readiness Check through the Firepower Management Center Web Interface

        You can use the web interface on a Firepower Management Center running Version 6.1.0 and later to run a readiness check to assess the preparedness of the Firepower Management Center's managed devices for the update.


        Note

        The readiness check feature does not support clustered, stacked, clustered stacks, or devices in high availability pairs.

        The time required to run the readiness check varies depending on your appliance model and database size.

          Step 1   Download the update from the Support site.
          Note   

          Download the update package directly from the Support site. If you transfer an update file by email, it may become corrupted.

          Step 2   Upload the update package to the Firepower Management Center.
          Step 3   Redeploy configuration changes to any managed devices. Otherwise, the eventual update of the managed devices may fail.
          Step 4   On the Firepower Management Center's System > Updates window, click the install icon next to the update you want to run the readiness check.
          Step 5   Choose the appliances you want to, and click Launch Readiness Check.
          Step 6   Monitor the progress of the readiness check in the command prompt window. When the readiness check is complete, the system reports the success or failure in the Readiness Check Status window.
          Step 7   Access the full readiness check report in /var/log/sf/$rpm_name/upgrade_readiness.

          Pre-Update Configuration and Event Backups

          Before you begin the update, we strongly recommend that you back up current event and configuration data to an external location. If you back up to an external location, verify the external backup is successful before updating the system.

          The Firepower Management Center purges locally stored backups from previous updates. To retain archived backups, store the backups externally. Use the Firepower Management Center to back up event and configuration data for itself and the devices it manages. For more information on the backup and restore feature, see the Firepower Management Center Configuration Guide.

          Use the Firepower Device Manager to back up event and configuration data for the device it manages. For more information on the backup and restore feature, see the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.

          Traffic Flow and Inspection During the Update

          When you update your sensing devices, traffic either drops throughout the update or traverses the network without inspection depending on how your devices are configured and deployed: routed or transparent, inline vs passive, bypass mode settings, and so on. We strongly recommend performing the update in a maintenance window or at a time when the interruption will have the least impact on your deployment.


          Note

          When you update devices in a high availability pair, the system performs the update one device at a time to avoid traffic interruption.

          This section discusses traffic behavior during the followng update stages:

          • The update itself, including related reboots

          • FXOS updates on clustered Firepower Threat Defense devices

          • Configuration deployments after the update

          Traffic Behavior During the Update

          The following table describes how updates, including related device reboots, affect traffic flow for different deployments. Note that switching, routing, NAT, and VPN are not performed during the update process, regardless of how you configure any inline sets.

          Table 1 Update Traffic Behavior

          Device

          Deployment

          Traffic Behavior

          Firepower Threat Defense

          inline with optional hardware bypass module, bypass enabled (Bypass: Standby or Bypass‑Force)

          passed without inspection

          inline with optional hardware bypass module, bypass disabled (Bypass: Disabled)

          dropped

          Firepower Threat Defense

          Firepower Threat Defense Virtual

          inline with no hardware bypass module

          dropped

          inline in tap mode

          egress packet immediately, copy not inspected

          passive

          uninterrupted, not inspected

          7000 and 8000 Series

          inline with optional hardware bypass module, bypass enabled (Bypass Mode: Bypass)

          passed without inspection

          Note that traffic is interrupted briefly at two points:

          • At the beginning of the update process as link goes down and up (flaps) and the network card switches into hardware bypass.

          • After the update finishes as link flaps and the network card switches out of bypass. Inspection resumes after the endpoints reconnect and reestablish link with the device interfaces.

          The hardware bypass option is not supported on nonbypass network modules on Firepower 8000 Series devices, or SFP transceivers on Firepower 7000 Series.

          inline with optional hardware bypass module, bypass disabled (Bypass Mode: Non‑Bypass)

          dropped

          7000 and 8000 Series

          NGIPSv

          inline with no hardware bypass module

          		 dropped

          inline in tap mode

          egress packet immediately, copy not inspected

          passive

          uninterrupted, not inspected

          routed, switched

          dropped

          ASA FirePOWER

          routed or transparent, fail-open (Permit Traffic)

          passed without inspection

          (requires the latest supported ASA OS version; otherwise, traffic dropped)

          routed or transparent, fail-close (Close Traffic)

          dropped

          Caution

          Rebooting the ASA FirePOWER module on an ASA 5585-X, including a reboot that occurs during a module upgrade, causes traffic to drop for up to thirty seconds on the interfaces on the ASA FirePOWER hardware module while the module reboots.

          Traffic Behavior When Updating FXOS on Clustered Firepower Threat Defense Devices

          Updating FXOS reboots the chassis, which can affect traffic in a clustered environment until at least one module comes online. Whether and how traffic is affected depends on the cluster type:

          • Intra-chassis cluster—Traffic drops if the cluster does not use an optional hardware bypass (fail‑to‑wire) module or if bypass is disabled. Traffic passes without inspection if bypass is enabled.

          • Inter-chassis cluster—Traffic drops during the overlap if multiple chassis reboots overlap before at least one module comes online. Traffic is unaffected if there is no reboot overlap.

            For example, there would be no reboot overlap, and no dropped traffic, if you complete the FXOS update first on one chassis and then on another. Depending on when each update is initiated, there could be reboot overlap (and dropped traffic) if you update multiple chassis simultaneously.

          The following table summarizes this behavior.

          Table 2 Traffic Behavior During an FXOS Update of Clustered Firepower Threat Defense Devices

          Device Model

          Deployment

          Traffic Behavior

          Firepower 9300

          intra-chassis cluster without optional hardware bypass module

          dropped

          intra-chassis cluster with optional hardware bypass module, bypass disabled

          dropped

          intra-chassis cluster with optional hardware bypass module, bypass enabled

          passed without inspection

          Firepower 9300

          Firepower 4100 Series

          inter-chassis cluster with no reboot overlap

          unaffected

          inter-chassis cluster with reboot overlap before at least one module comes online

          dropped

          Traffic Behavior During Configuration Deployment

          During the upgrade process, you deploy configurations either twice (standalone devices) or three times (devices managed by the Firepower Management Center). When you deploy, resource demands may result in a small number of packets dropping without inspection. In most cases, the deployment immediately after the upgrade restarts the Snort process. During subsequent deployments, the Snort process restarts only if, before deploying, you modify specific policy or device configurations that always restart the process when deployed. See the configuration guide for your platform for configurations that restart the Snort process.

          The following table describes how different devices handle traffic during Snort process restarts. Note that traffic during the restart is handled essentially the same as during an upgrade. An exception is that whether traffic drops or passes in inline deployments is influenced by software bypass settings instead of hardware bypass settings.

          Table 3 Restart Traffic Effects by Managed Device Model

          Device Model

          Interface Configuration

          Restart Traffic Behavior

          7000 and 8000 Series, NGIPSv

          inline, Failsafe enabled or disabled

          passed without inspection

          A few packets might drop if Failsafe is disabled and Snort is busy but not down.

          inline, tap mode

          egress packet immediately, copy bypasses Snort

          passive

          uninterrupted, not inspected

          7000 and 8000 Series

          routed, switched, transparent

          dropped

          Firepower Threat Defense, Firepower Threat Defense Virtual

          inline, Snort Fail Open: Down: disabled

          dropped

          inline, Snort Fail Open: Down: enabled

          passed without inspection

          routed, transparent (including EtherChannel, redundant, subinterface)

          dropped

          ASA FirePOWER

          routed or transparent with fail-open (Permit Traffic)

          passed without inspection

          routed or transparent with fail-close (Close Traffic)

          dropped

          Time and Disk Space Requirements for Updating to Version 6.2.0.3

          The following table provides disk space and time guidelines for the update. Note that when you use the Firepower Management Center to update a managed device, the Firepower Management Center requires additional disk space on its /Volume partition.


          Caution

          Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.


          Note

          The following guidelines do not include the time required to complete the readiness check. For more information about the readiness check, see Preupdate Readiness Checks.

          If you encounter issues with the progress of your update, contact Cisco TAC.

          Table 4 Time and Disk Space Requirements

          Appliance

          Space on /

          Space on /Volume

          Space on /Volume on Manager

          Time to Update From Version 6.2.0

          Time to Update from Version 6.2.0.2

          Firepower Management Center

          18 MB

          3352 MB

          668 MB

          75 minutes

          37 minutes

          Firepower Management Center Virtual

          19 MB

          3342 MB

          668 MB

          hardware dependent

          7000 and 8000 Series managed device

          17 MB

          3526 MB

          554 MB

          38 minutes

          19 minutes

          NGIPSv device

          17 MB

          842 MB

          202 MB

          hardware dependent

          ASA FirePOWER module

          3361 MB

          15 MB

          521 MB

          3 hours

          97 minutes

          Cisco ASA with Firepower Threat Defense

          2302 MB

          131 MB

          384 MB

          118 minutes

          76 minutes

          Firepower 9300 appliance running Firepower Threat Defense

          1355 MB

          —

          319 MB

          18 minutes

          12 minutes

          Firepower 4100 series security appliance running Firepower Threat Defense

          1361

          —

          319 MB

          20 minutes

          12 minutes

          Firepower Threat Defense Virtual device

          17 MB

          842 MB

          384 MB

          hardware dependent

          Time and Disk Space Requirements for Updating to Version 6.2.0.2

          The following table provides disk space and time guidelines for the update. Note that when you use the Firepower Management Center to update a managed device, the Firepower Management Center requires additional disk space on its /Volume partition.


          Caution

          Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.


          Note

          The following guidelines do not include the time required to complete the readiness check. For more information about the readiness check, see Preupdate Readiness Checks.

          If you encounter issues with the progress of your update, contact Cisco TAC.

          Table 5 Time and Disk Space Requirements

          Appliance

          Space on /

          Space on /Volume

          Space on /Volume on Manager

          Time to Update From Version 6.2.0

          Time to Update from Version 6.2.0.1

          Firepower Management Center

          35 MB

          1665 MB

          428 MB

          36 minutes

          30 minutes

          Firepower Management Center Virtual

          21 MB

          2834 MB

          428 MB

          hardware dependent

          7000 and 8000 Series managed device

          17 MB

          2110 MB

          458 MB

          54 minutes

          35 minutes

          NGIPSv device

          19 MB

          612 MB

          195 MB

          hardware dependent

          ASA FirePOWER module

          17 MB

          2014 MB

          383 MB

          40 minutes

          80 minutes

          Cisco ASA with Firepower Threat Defense

          144 MB

          1808 MB

          295 MB

          95 minutes

          59 minutes

          Firepower 9300 appliance or Firepower 4100 series security appliance running Firepower Threat Defense

          1060 MB

          1060 MB

          274 MB

          12 minutes

          9 minutes

          Firepower Threat Defense Virtual device

          143 MB

          998 MB

          295 MB

          hardware dependent

          Time and Disk Space Requirements for Updating to Version 6.2.0.1

          The following table provides disk space and time guidelines for the update. Note that when you use the Firepower Management Center to update a managed device, the Firepower Management Center requires additional disk space on its /Volume partition.


          Caution

          Do not reboot or shut down your appliance during the update until you see the login prompt. The system may appear inactive during the prechecks; this is expected behavior and does not require you to reboot or shut down your appliance.


          Note

          The following guidelines do not include the time required to complete the readiness check. For more information about the readiness check, see Preupdate Readiness Checks.

          If you encounter issues with the progress of your update, contact Cisco TAC.

          Table 6 Time and Disk Space Requirements

          Appliance

          Space on /

          Space on /Volume

          Space on /Volume on Manager

          Time to Update From Version 6.2.0

          Firepower Management Center

          49.5 MB

          1236.9 MB

          218.3 MB

          28 minutes

          Firepower Management Center Virtual

          22.8 MB

          1488 MB

          218.3 MB

          hardware dependent

          7000 and 8000 Series managed device

          17.32 MB

          1134 MB

          184.4 MB

          22 minutes

          NGIPSv device

          18.80 MB

          720.8 MB

          97.6 MB

          hardware dependent

          ASA FirePOWER module

          16.78 MB

          96.17 MB

          205.8 MB

          69 minutes

          Cisco ASA with Firepower Threat Defense

          143.33 MB

          944.8 MB

          158.2 MB

          62 minutes

          Firepower 9300 appliance or Firepower 4100 series security appliance running Firepower Threat Defense

          524 MB

          524 MB

          136.8 MB

          12 minutes

          Firepower Threat Defense Virtual device

          9.6 MB

          143.6 MB

          158.2 MB

          hardware dependent

          Post Update Tasks

          After you perform the update on the Firepower Management Center or managed devices, you must deploy configuration changes to the devices.


          Note

          You must deploy configuration changes first after updating the Firepower Management Center and then again after updating its managed devices.

          When you deploy configuration changes, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations requires the Snort process to restart, which temporarily interrupting traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on the model of the managed device and how it handles traffic. For more information, see the Firepower Management Center Configuration Guide.

          There are several additional post update steps you should take to ensure that your deployment is performing properly, which include the following include:

          • Verify that the update succeeded.

          • Make sure that all appliances in your deployment are communicating successfully.

          • Update your intrusion rules and vulnerability database (VDB) and deploy configuration changes.

          • Make configuration changes based on new features and functionality.

          • Redeploy policies and configuration.