Downgrade the ASA

In many cases, you can downgrade your ASA software and restore a backup configuration from the previous software version. The method of downgrading depends on your ASA platform.

Guidelines and Limitations for Downgrading

See the following guidelines before downgrading:

  • There is no official Zero Downtime Downgrade support for clustering—However, in some cases, Zero Downtime Downgrading will work. If you encounter issues, you need to reload your cluster units, which results in downtime.

  • For the ASA Virtual, you cannot downgrade from 9.24+ to a pre-9.24 version—After you upgrade to 9.24 or later, you cannot downgrade to a version earlier than 9.24.

  • Downgrade issue from 9.22 or later—If you disable the USB port using the usb-port disable command, but then downgrade to an earlier release, the port will remain disabled, and you cannot re-enable it without erasing the NVRAM (the FXOS local-mgmt erase secure all command).

  • Downgrade issue from 9.18 or later—There is a behavior change in 9.18 where the access-group command will be listed before its access-list commands. If you downgrade, the access-group command will be rejected because it has not yet loaded the access-list commands. This outcome occurs even if you had previously enabled the forward-reference enable command, because that command is now removed. Before you downgrade, be sure to copy all access-group commands manually, and then after downgrading, re-enter them.

  • VPN tunnels are replicated to the standby unit even if the standby unit is running a version of software that does not support the Ciphersuite that the original tunnel negotiated—This scenario occurs when downgrading. In this case, disconnect your VPN connection and reconnect.

  • Downgrade ASA Virtual with permanent license reservation from Version 9.20(4) to earlier versions —We recommend that you perform these steps to prevent the permanent license reservation from being unregistered:

    1. Unregister the permanent license reservation.

    2. Downgrade the ASA Virtual.

    3. Register the permanent license reservation again.

    You need to perform these steps as Smart Transport is the default from Version 9.20.4 and later, while Smart Call Home is default in Version 9.20.3 and earlier.

  • Downgrade ASA Virtual with flexible permanent license reservation from Version 9.23(1) to earlier versions —We recommend that you do not downgrade an ASA Virtual with Version 9.23(1) and flexible permanent license reservation. The license registration status will become Unregistered.

Incompatible Configuration Removed After Downgrading

When you downgrade to an old version, commands that were introduced in later versions will be removed from the configuration. There is no automated way to check the configuration against the target version before you downgrade. You can view when new commands were added in ASA new features by release.

You can view rejected commands after you downgrade using the show startup-config errors command. If you can perform a downgrade on a lab device, you can preview the effects using this command before you perform the downgrade on a production device.

In some cases, the ASA migrates commands to new forms automatically when you upgrade, so depending on your version, even if you did not manually configure new commands, the downgrade could be affected by configuration migrations. We recommend that you have a backup of your old configuration that you can use when you downgrade. In the case of upgrading to 8.3, a backup is automatically created (<old_version>_startup_cfg.sav). Other migrations do not create back-ups. See Version-Specific Guidelines and Migrations for more information about automatic command migrations that could affect downgrading.

See also known downgrade issues in Guidelines and Limitations for Downgrading.

For example, an ASA running version 9.8(2) includes the following commands:


access-list acl1 extended permit sctp 192.0.2.0 255.255.255.0 198.51.100.0 255.255.255.0
username test1 password $sha512$1234$abcdefghijklmnopqrstuvwxyz privilege 15
snmp-server user snmpuser1 snmpgroup1 v3 engineID abcdefghijklmnopqrstuvwxyz encrypted auth md5 12:ab:34 priv aes 128 12:ab:34

When you downgrade to 9.0(4), you will see the following errors on startup:


access-list acl1 extended permit sctp 192.0.2.0 255.255.255.0 198.51.100.0 255.255.255.0
                                 ^
ERROR: % Invalid input detected at '^' marker.

username test1 password $sha512$1234$abcdefghijklmnopqrstuvwxyz pbkdf2 privilege 15
                                                                ^
ERROR: % Invalid input detected at '^' marker.

snmp-server user snmpuser1 snmpgroup1 v3 engineID abcdefghijklmnopqrstuvwxyz encrypted auth md5 12:ab:34 priv aes 128 12:ab:34
                                         ^
ERROR: % Invalid input detected at '^' marker.

In this example, support for sctp in the access-list extended command was added in version 9.5(2), support for pbkdf2 in the username command was added in version 9.6(1), and support for engineID in the snmp-server user command was added in version 9.5(3).

Downgrade the ASA Appliance

You can downgrade the ASA software version by setting the ASA version to the old version, restoring the backup configuration to the startup configuration, and then reloading. This procedure applies to the following models:

  • Firewall 200

  • Firepower 1000

  • Secure Firewall 1200

  • Firepower 2100

  • Secure Firewall 3100

  • Secure Firewall 4200

  • Firewall 6100

Before you begin

This procedure requires a backup configuration of the ASA before you upgraded, so you can restore the old configuration. If you do not restore the old configuration, you may have incompatible commands representing new or changed features. Any new commands will be rejected when you load the old software version.

Procedure

Step 1

Load the old ASA software version using the upgrade procedure in Upgrade the ASA Appliance for standalone, failover, or clustering deployments. In this case, specify the old ASA version instead of a new version. Important: Do not reload the ASA yet.

Step 2

At the ASA CLI, copy the backup ASA configuration to the startup configuration. For failover, perform this step on the active unit. This step replicates the command to the standby unit.

copy old_config_url startup-config

It's important that you do not save the running configuration to the startup configuration using write memory ; this command will overwrite your backup configuration.

Example:


ciscoasa# copy disk0:/9.13.1_cfg.sav startup-config

Step 3

Reload the ASA.

ASA CLI

reload

ASDM

Choose Tools > System Reload.

Downgrade the Firepower 2100 in Platform Mode

You can downgrade the ASA software version by restoring the backup configuration to the startup configuration, setting the ASA version to the old version, and then reloading.

Before you begin

This procedure requires a backup configuration of the ASA before you upgraded, so you can restore the old configuration. If you do not restore the old configuration, you may have incompatible commands representing new or changed features. Any new commands will be rejected when you load the old software version.

Procedure

Step 1

At the ASA CLI, copy the backup ASA configuration to the startup configuration. For failover, perform this step on the active unit. This step replicates the command to the standby unit.

copy old_config_url startup-config

It's important that you do not save the running configuration to the startup configuration using write memory ; this command will overwrite your backup configuration.

Example:


ciscoasa# copy disk0:/9.12.4_cfg.sav startup-config

Step 2

In FXOS, use the Firewall Chassis Manager or FXOS CLI to use the old ASA software version using the upgrade procedure in Upgrade the Firepower 2100 in Platform Mode for standalone, failover, or clustering deployments. In this case, specify the old ASA version instead of a new version.

Downgrade the Firepower 4100/9300

You can downgrade the ASA software version by restoring the backup configuration to the startup configuration, setting the ASA version to the old version, and then reloading.

Before you begin

  • This procedure requires a backup configuration of the ASA before you upgraded, so you can restore the old configuration. If you do not restore the old configuration, you may have incompatible commands representing new or changed features. Any new commands will be rejected when you load the old software version.

  • Make sure the old ASA version is compatibile with the current FXOS version. If not, downgrade FXOS as the first step before you restore the old ASA configuration. Just make sure the downgraded FXOS is also compatible with the current ASA version (before you downgrade it). If you cannot achieve compatibility, we suggest you do not perform a downgrade.

Procedure

Step 1

At the ASA CLI, copy the backup ASA configuration to the startup configuration. For failover or clustering, perform this step on the active/control unit. This step replicates the command to the standby/data units.

copy old_config_url startup-config

It's important that you do not save the running configuration to the startup configuration using write memory ; this command will overwrite your backup configuration.

Example:


ciscoasa# copy disk0:/9.8.4_cfg.sav startup-config

Step 2

In FXOS, use the Firewall Chassis Manager or FXOS CLI to use the old ASA software version using the upgrade procedure in Upgrade the Firepower 4100/9300 for standalone, failover, or clustering deployments. In this case, specify the old ASA version instead of a new version.

Step 3

If you are also downgrading FXOS, use the Firewall Chassis Manager or FXOS CLI to set the old FXOS software version to be the current version using the upgrade procedure in Upgrade the Firepower 4100/9300 for standalone, failover, or clustering deployments.

Downgrade the ISA 3000 or ASA 5500-X

The downgrade feature provides a shortcut for completing the following functions on ISA 3000 models:

  • Clearing the boot image configuration (clear configure boot ).

  • Setting the boot image to be the old image (boot system ).

  • (Optional) Entering a new activation key (activation-key ).

  • Saving the running configuration to startup (write memory ). This sets the BOOT environment variable to the old image, so when you reload, the old image is loaded.

  • Copying the old configuration backup to the startup configuration (copy old_config_url startup-config ).

  • Reloading (reload ).

Before you begin

  • This procedure requires a backup configuration of the ASA before you upgraded, so you can restore the old configuration.

Procedure

Step 1

ASA CLI: Downgrade the software and restore the old configuration.

downgrade [/noconfirm] old_image_url old_config_url [activation-key old_key]

Example:



ciscoasa(config)# downgrade /noconfirm disk0:/asa821-k8.bin disk0:/8_2_1_0_startup_cfg.sav

The /noconfirm option downgrades without prompting. The image_url is the path to the old image on disk0, disk1, tftp, ftp, or smb. The old_config_url is the path to the saved, pre-migration configuration. If you need to revert to a pre-8.3 activation key, then you can enter the old activation key.

Step 2

ASDM: Choose Tools > Downgrade Software .

The Downgrade Software dialog box appears.

Step 3

For the ASA Image, click Select Image File.

The Browse File Locations dialog box appears.

Step 4

Click one of the following radio buttons:

  • Remote Server—Choose ftp, smb, or http from the drop-down list, and type the path to the old image file.

  • Flash File System—Click Browse Flash to choose the old image file on the local flash file system.

Step 5

For the Configuration, click Browse Flash to choose the pre-migration configuration file.

Step 6

(Optional) In the Activation Key field, enter the old activation key if you need to revert to a pre-8.3 activation key.

Step 7

Click Downgrade.