Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Cisco Firepower Management Center Upgrade Guide

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco Firepower Management Center Upgrade Guide

Chapter Title

Run Firepower Software Readiness Checks

Results

Updated:
November 10, 2020

Chapter: Run Firepower Software Readiness Checks

Run Firepower Software Readiness Checks

Readiness checks assess a Firepower appliance's preparedness for a software upgrade. They identify issues including database integrity, version inconsistencies, and device registration. Readiness checks are included in Firepower software upgrade packages after Version 6.1.0.

Guidelines and Limitations for Readiness Checks

These guidelines and limitations apply to Firepower readiness checks.

Evaluates Firepower Software Readiness Only

The readiness check is for Firepower software readiness only. It does not assess preparedness for intrusion rule, VDB, or GeoDB updates. Readiness checks are not supported for hotfixes or patch uninstallers.

Version and Platform Requirements

Table 1. Readiness Check Support by Version and Plafform

Current FMC Version

Readiness Check Support

5.4 – 6.0

Not supported.

6.0.1

Supported, with a preinstallation package.

If you want to run readiness checks on a Version 6.0.1 → 6.1 upgrade, first install the Version 6.1 preinstallation package. You must do this for the FMC and its managed devices. See the Firepower System Release Notes Version 6.1.0 Pre-Installation Package.

6.1 – 6.6.x

You can use a Version 6.1–6.6.x Firepower Management Center to perform the readiness check on itself and its standalone managed devices.

For clustered devices, stacked devices, and devices in high availability pairs, you can run the readiness check from the Linux shell, also called expert mode. To run the check, you must first push or copy the upgrade package to the correct location on each device, then use this command: sudo install_update.pl --detach --readiness-check /var/sf/updates/upgrade_package_name. For detailed instructions, contact Cisco TAC.

6.7.0+

You can use a Version 6.7.0+ Firepower Management Center to perform the readiness check on itself and the devices it manages, including FTD devices configured for high availabilty and scalability.

Time Requirements

The time required to run the readiness check varies depending on appliance model and database size. You may find it expedient to forgo readiness checks if your deployment is large.


Tip

For all device upgrades to 6.2.3–6.6.x, you can reduce the amount of time it takes to run readiness checks by copying (pushing) upgrade packages to devices before you begin.

Readiness checks for FTD device upgrades to Version 6.7.0+ no longer require the upgrade package to reside on the device. Although we still recommend you copy the upgrade package to the device before you begin the upgrade itself, you no longer have to do so before you run the readiness check.

During The Check/Failed Checks

Do not manually reboot, or shut down an appliance running readiness checks. If your appliance fails the readiness check, correct the issues and run the readiness check again. If the readiness check exposes issues that you cannot resolve, do not begin the upgrade. Instead, contact Cisco TAC.

Run the Readiness Check (Version 6.7+)

Use this procedure to perform readiness checks on a Version 6.7.0+ FMC and its managed devices, including devices running older versions (6.3.0–6.6.x), and FTD devices in high availabilty and scalability deployments.

Before you begin

  • Upgrade the FMC to at least Version 6.7.0. If your FMC is currently running an older version, see Run the Readiness Check (Version 6.1–6.6.x).

  • Upload the upgrade package to the FMC, for the appliance you want to check. If you want to check Version 6.6.0+ FTD devices, you can also specify the upgrade package location on an internal web server. This is required because readiness checks are included in upgrade packages.

  • (Optional) If you are upgrading an ASA FirePOWER/NGIPSv device to any version, or an FTD device to Version 6.3.0.1–6.6.x, push the upgrade package to the device. This can reduce the time required to run the readiness check. If you are upgrading an FTD device to Version 6.7.0+, you can skip this step. Although we still recommend you push the upgrade package to the device before you begin the upgrade itself, you no longer have to do so before you run the readiness check.

Procedure

Step 1

On the FMC web interface, choose System > Updates.

Step 2

Under Available Updates, click the Install icon next to the appropriate upgrade package.

The system displays a list of eligible appliances, along with their pre-upgrade compatibility check results. Starting with Version 6.7.0, FTD devices must pass certain basic checks before you can run the more complex readiness check. This pre-check catches issues that will cause your upgrade to fail—but we now catch them earlier and block you from proceeding.

Step 3

Select the appliances you want to check and click Check Readiness.

If you cannot select an otherwise eligible appliance, make sure it passed its compatibility checks. You may need to upgrade an operating system, or deploy configuration changes.
Step 4

Monitor the progress of the readiness check in the Message Center.

If the check fails, the Message Center provides failure logs.

What to do next

On the System > Updates page, click Readiness Checks to view readiness check status for your FTD deployment, including checks in progress and failed checks. You can also use this page to easily re-run checks after a failure.

Run the Readiness Check (Version 6.1–6.6.x)

This procedure is valid for FMCs currently running Version 6.1–6.6.x, and their standalone managed devices.


Note

You can use this procedure to run readiness checks on a Version 6.0.1 → 6.1 upgrade, but you must first install the Version 6.1 preinstallation package. You must do this for the FMC and managed devices. See the Firepower System Release Notes Version 6.1.0 Pre-Installation Package.

Before you begin

  • Upload the upgrade package to the FMC, for the appliance you want to check. If you want to check Version 6.6+ FTD devices, you can also specify the upgrade package location on an internal web server. This is required because readiness checks are included in upgrade packages.

  • (Optional, Version 6.2.3+) Push the upgrade package to the managed device. This can reduce the time required to run the check.

  • Deploy configurations to managed devices whose configurations are out of date. Otherwise, the readiness check may fail.

Procedure

Step 1

On the FMC web interface, choose System > Updates.

Step 2

Click the Install icon next to the appropriate upgrade package.

Step 3

Select the appliances you want to check and click Launch Readiness Check.

Step 4

Monitor the progress of the readiness check in the Message Center.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Cisco Community Discussions

About Us
Contact Us
Work with Us