Your upgrade path is a detailed plan for which appliances you will upgrade, what components you will upgrade, and in what order.

If you have assessed your deployment—that is, you know what you have and what you want—you are ready to build your upgrade path. For a quick reference to supported upgrade paths for each appliance type, as well as high-level example upgrade paths for various types of deployment, see Upgrade Paths.

Use the following guidelines to help you build your upgrade path.

Understand Firepower Major Versions/Upgrades vs Patches

A Firepower major upgrade changes the first, second, or third number of the version. Major upgrades include new features and functionality, and may entail large-scale changes to the product. For devices where you upgrade the operating system separately, major Firepower upgrades are likely to have companion operating system upgrades.

Note

In many cases, you can upgrade an appliance's operating system (or virtual hosting environment) without upgrading the Firepower software, and the other way around. For example, an operating system patch may resolve issues unrelated to the Firepower software. Or, you may want to take advantage of new Firepower features without upgrading your hypervisor. Just make sure that the target version of the component you want to upgrade is compatible with the components you are not upgrading.

A Firepower patch changes the fourth number of the version. Patches usually contain a limited range of fixes.

If your upgrade path spans multiple major Firepower versions (for example, from Version 6.0.1 to Version 6.2.3), you can skip patches in the intermediate version (Version 6.1). That is, you can upgrade directly from one major version to the next. Apply the latest patch after you reach the target major version.

Maintain Manager-Device Compatibility

You upgrade Firepower Management Centers and their devices separately. You upgrade high availability Firepower Management Centers one at a time, manually.

To maintain manager-device compatibility, and depending on how far you need to upgrade your deployment, you may need to:

• Perform intermediate upgrades.

• Upgrade the Firepower Management Center and its devices in alternating steps.

For more information, see Firepower Management Center and Managed Device Version Compatibility.

Include FXOS Upgrades (Firepower 4100/9300 Chassis)

Firepower 4100 series and Firepower 9300 devices use the FXOS operating system.

Major Firepower versions have a companion FXOS version. You must be running that companion version of FXOS before you upgrade the Firepower software on the Firepower 4100/9300 chassis.

You upgrade FXOS on each chassis independently, even if you have Firepower Threat Defense high availability or clustering configured. To minimize disruption, always upgrade the standby unit of a high availability pair, or an all-slave chassis in an inter-chassis cluster.

For more information, see Firepower Threat Defense Upgrade Path—With Firepower Management Center.

Include ASA Upgrades (ASA with FirePOWER Services)

ASA with FirePOWER Services devices use the ASA operating system.

There is wide compatibility between ASA and ASA FirePOWER versions. However, even if an ASA upgrade is not strictly required, resolving issues may require an upgrade to the latest supported version.

You upgrade ASA on each chassis independently, even if you have ASA clustering or failover pairs configured. To minimize disruption, fail over or disable clustering on each unit before you upgrade, upgrading ASA FirePOWER modules one at a time as you upgrade ASA.

For more information, see ASA FirePOWER Module Upgrade Path—With Firepower Management Center.

Include Virtual Hosting Environment Upgrades

Virtual Firepower appliances run in a variety of hosting environments. The Firepower software must remain compatible with its hosting environment. Your upgrade path depends on compatibility:

• Upgrade hosting environment first—For example, if you are running NGIPSv Version 5.4.x on VMware ESXi 5.0, you must upgrade VMware ESXi to Version 5.1 or Version 5.5 before you upgrade NGIPSv to Firepower 6.0.

• Upgrade Firepower software first—For example, if you are running Firepower Threat Defense Virtual Version 6.1.x on VMware ESXi 6.0, upgrade the Firepower software to Version 6.2.3 before you upgrade VMware ESXi to Version 6.5.

Identify When to Add New Devices

If your upgrade path includes adding a new device, when you add it depends on the device type:

• Physical device—Determine which Firepower version the device is currently running. Add the device as soon as you can, then use the Firepower Management Center to upgrade the new device with the rest of your deployment. Do not upgrade your Firepower Management Center past the point where it can no longer manage the out-of-the-box device.

• Virtual device—Create after you upgrade the Firepower Management Center to its target version. When you add a new virtual device, you should never have to perform a major upgrade, only patches.

Identify Other Major Tasks

Many steps in the upgrade process can take a significant amount of time. You should explicitly include these steps in your plan. For example:

• Backups

• Downloads and pushes

• Readiness checks

• Pre- and post-upgrade configuration changes

Identify Interruptions in Traffic Flow and Inspection

You must identify potential interruptions in traffic flow and inspection during the upgrade. This can occur:

• When you upgrade the operating system or virtual hosting environment on a managed device.

• When you upgrade the Firepower software on a managed device.

• When you deploy configuration changes as part of the upgrade process.

Device type, deployment type (standalone, high availability, clustered), and interface configurations (passive, IPS, firewall, and so on) determine the nature of the interruptions.

Note	We strongly recommend performing any upgrade in a maintenance window or at a time when any interruption will have the least impact on your deployment.

Where Do I Start?

Refer to your deployment assessment. In general, your first upgrade depends on what Firepower versions your managed devices are running.

In Version 6.2.3+, you can copy (or push) upgrade packages to managed devices before you run the actual upgrade. This helps reduce the length of your upgrade maintenance window. (Before Version 6.2.3, the Firepower Management Center copies the package to managed devices as part of the installation, and you cannot separate the tasks.)

When you push an upgrade package to a device cluster or stack, the Firepower Management Center first pushes to one unit, then to the others. When you push to a high availability pair, the Firepower Management Center pushes to the primary unit, which then synchronizes with the secondary.

Guidelines and Limitations for the Readiness Check

• Checks Firepower software readiness only—The readiness check does not assess preparedness for intrusion rule, VDB, or GeoDB updates.

• Version 6.1+ required—The readiness check was introduced in Version 6.1. A readiness check on the upgrade to Version 6.1 may not return accurate results.

• Web interface vs shell—You can use the Firepower Management Center web interface to perform the readiness check on itself and its standalone managed devices only. For clustered devices, stacked devices, and devices in high availability pairs, run the readiness check from each device's shell.

• Time requirements—The time required to run the readiness check varies depending on your appliance model and database size. You may find it expedient to forgo readiness checks if your deployment is large (for example, if your Firepower Management Center manages more than 100 devices).

Verify Appliance Communication and Health

At all times during the upgrade process, make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor. Resolve minor issues before they become major.

Review Release Notes

Always read the release notes for critical and release-specific information:

• Firepower Release Notes

• ASA Release Notes

• FXOS Release Notes

Plan Pre- and Post-Upgrade Configuration Changes

Especially with major upgrades, upgrading may cause or require significant configuration changes that you must address.

For example, Version 6.0 removes support for Firepower Management Center high availability. You must break any pairs before you begin the upgrade. As another example, Version 6.2.3 limits the number of results you can use or include in a report section. The upgrade process can lower your results limits and disable PDF reports, depending on your pre-upgrade configurations. Post upgrade, you may want to adjust your report templates to accommodate the new limits and reenable PDF reports.

For more information on pre- and post-upgrade configuration changes, see the release notes as well as Version-Specific Guidelines for Firepower Software Upgrades.

Check Time and Disk Space

To upgrade a Firepower appliance, you must have enough free disk space or the upgrade fails. You must also have enough time to perform the upgrade. Depending on your deployment, upgrades may take longer than the provided estimates. For example, lower-memory appliances and appliances under heavy load may take longer to upgrade. The provided estimates also do not include the time required to complete a readiness check.

For lists of time and disk space per release, see Time and Disk Space for Firepower Software Upgrades.

Check Bandwidth

Before Version 6.2.3, the Firepower Management Center copies upgrade packages to managed devices as part of the installation, and you cannot separate the tasks. In Version 6.2.3+, you can copy (or push) upgrade packages to managed devices before you run the actual upgrade. This helps reduce the length of your upgrade maintenance window.

In either case, you must make sure you have the bandwidth to perform a large data transfer from the Firepower Management Center to the devices. For more information, see Guidelines for Downloading Data from the Firepower Management Center to Managed Devices (Troubleshooting TechNote).

Verify Connection Route to Management Interfaces Before Upgrade

Before you upgrade a Firepower device, make sure your computer can connect to the Firepower Management Center’s management interface and to the device’s management interface, both without traversing the device itself. This is because Firepower devices can stop passing traffic during the upgrade (depending on interface configurations), or if the upgrade fails.

Back Up Configurations and Event Data

Before you begin an upgrade, back up event and configuration data to an external location:

• Firepower Management Center—Use the Firepower Management Center to back up configuration and event data for itself.

• Most managed devices—Use the Firepower Management Center to back up events from managed devices. There is no way to create individual configuration and event backup files for most managed devices.

• 7000 and 8000 series devices only—Use the Firepower Management Center or the local device GUI to back up configuration and event data.

For more information, see the Firepower Management Center Configuration Guide.

Note	We strongly recommend you back up to an external location and verify transfer success. When you upgrade the Firepower Management Center, it purges locally stored backups.

Schedule Maintenance Windows

When you schedule a maintenance window, consider the upgrade's effect on traffic flow and inspection, and how long the upgrade is likely to take. Also consider the tasks you must perform in the window, and those you can perform ahead of time. Minimize disruption with careful planning and preparation. Do not wait until the maintenance window to obtaining and push upgrade packages, running readiness checks, create backups, and so on.