Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Cisco Firepower Management Center Upgrade Guide

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco Firepower Management Center Upgrade Guide

Chapter Title

Upgrade Firepower Management Centers

Results

Updated:
October 11, 2019

Chapter: Upgrade Firepower Management Centers

Upgrade Firepower Management Centers

Upgrade Checklist: Firepower Management Centers

Use this checklist to upgrade Firepower Management Centers, including FMCv. If you are upgrading FMCs in a high availability pair, complete the checklist for each peer.

Complete the checklist every time you upgrade. Skipping steps can result in an unsuccessful upgrade. At all times during the process, make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Plan the Upgrade

Maintain deployment compatibility at all times by correctly planning and following an upgrade path.

✓ Action/Check Details

Verify Upgrade Path

Check your place in your upgrade path. Know which upgrade you just performed and which you are performing next.

Upgrade Path: Firepower Management Centers

Check Versions

Check current and target versions on the FMC:

  • Firepower software

  • Virtual hosting environment (FMCv)

Firepower Management Centers

Check FMC Compatibility

Check if the FMC will be able to manage the devices after it upgrades. If not, revise your upgrade path so you upgrade the devices first.

Can I Maintain FMC-Device Version Compatibility?

Read Release Notes

Read the release notes for the next upgrade/set of upgrades, paying special attention to version-specific warnings and guidelines.

Firepower Release Notes

Pre-Upgrade Actions and Checks

Minimize disruption by performing prechecks outside the maintenance window.

✓ Action/Check Details

Make Required Configuration Changes

Make required pre-upgrade configuration changes, and be prepared to make required post-upgrade configuration changes.

Firepower Release Notes

Check Disk Space

Run a preliminary disk space check for the Firepower software upgrade.

Time Tests and Disk Space Requirements

Get Upgrade Package

Obtain the correct upgrade package and upload it to the FMC. Do not untar signed (.tar) packages.

Obtain and Push Upgrade Packages

Run Readiness Check

Run a readiness check. Requires Version 6.1+.

Run Readiness Checks

Back Up Events & Configurations

Back up event and configuration data. Back up to an external location and verify transfer success. If you store device backups on the FMC, verify those are also backed up externally. When you upgrade the FMC, it purges locally stored backups.

Firepower Management Center Configuration Guide

Schedule Maintenance Window

Schedule a maintenance window when it will have the least impact, considering the tasks you must perform and the time the upgrade is likely to take.

Time Tests and Disk Space Requirements

Upgrade the Firepower Management Center

Perform the upgrade in a maintenance window.

✓ Action/Check Details

Upgrade Hosting

If needed, upgrade the hosting environment (FMCv).

See the documentation for your hosting environment.

Upgrade Firepower Software

Upgrade the Firepower software.

Upgrade a Standalone FMC

or

Upgrade High Availability FMCs

Upgrade Path: Firepower Management Centers

This table provides upgrade paths for Firepower Management Centers, including FMCv. If you cannot perform a direct upgrade from your current to the target version, your upgrade path must include intermediate versions as noted.


Note
Upgrading to Version 6.0.0 and Version 6.0.1 requires a preinstallation package, as does upgrading from Version 6.2.0–6.2.3.7 directly to Version 6.3.0+ on some models. For more information, see Identify Preinstallation Packages.
Table 1. Recommended Upgrade Paths: Firepower Management Centers

Current Version

Target Version

6.5.0

6.4.0

6.3.0

6.2.3

6.2.2

6.2.0

6.1.0

6.0.1

6.0.0

6.4.0

Last support for MC750, 1500, 3500.

Direct

—

—

—

—

—

—

—

—

6.3.0

Direct

Direct

—

—

—

—

—

—

—

6.2.3

Direct

Direct

Direct

—

—

—

—

—

—

6.2.2

→ 6.4.0

→ 6.5.0

Direct

Direct

Direct

—

—

—

—

—

6.2.1

→ 6.4.0

→ 6.5.0

Direct

Direct

Direct

Direct

—

—

—

—

6.2.0

→ 6.4.0

→ 6.5.0

Direct

Direct

Direct

Direct

—

—

—

—

6.1.0

→ 6.4.0

→ 6.5.0

Direct

Direct

Direct

→ 6.2.0

→ 6.2.2

Direct

—

—

—

6.0.1

→ 6.1.0

→ 6.4.0

→ 6.5.0

→ 6.1.0

→ 6.4.0

→ 6.1.0

→ 6.3.0

→ 6.1.0

→ 6.2.3

→ 6.1.0

→ 6.2.0

→ 6.2.2

→ 6.1.0

→ 6.2.0

Direct

—

—

6.0.0

→ 6.0.1

→ 6.1.0

→ 6.4.0

→ 6.5.0

→ 6.0.1

→ 6.1.0

→ 6.4.0

→ 6.0.1

→ 6.1.0

→ 6.3.0

→ 6.0.1

→ 6.1.0

→ 6.2.3

→ 6.0.1

→ 6.1.0

→ 6.2.0

→ 6.2.2

→ 6.0.1

→ 6.1.0

→ 6.2.0

→ 6.0.1

→ 6.1.0

Direct

—

5.4.x*

→ 6.0.0

→ 6.0.1

→ 6.1.0

→ 6.4.0

→ 6.5.0

→ 6.0.0

→ 6.0.1

→ 6.1.0

→ 6.4.0

→ 6.0.0

→ 6.0.1

→ 6.1.0

→ 6.3.0

→ 6.0.0

→ 6.0.1

→ 6.1.0

→ 6.2.3

→ 6.0.0

→ 6.0.1

→ 6.1.0

→ 6.2.0

→ 6.2.2

→ 6.0.0

→ 6.0.1

→ 6.1.0

→ 6.2.0

→ 6.0.0

→ 6.0.1

→ 6.1.0

→ 6.0.0

→ 6.0.1

Direct

* You must be running at least Version 5.4.1.1 to upgrade to Version 6.0.0.

Upgrade a Standalone FMC

Use this procedure to upgrade a standalone Firepower Management Center, including Firepower Management Center Virtual.


Caution
Do not deploy changes to or from, manually reboot, or shut down an upgrading appliance. Do not restart an upgrade in progress. The upgrade process may appear inactive during prechecks; this is expected. If you encounter issues with the upgrade, including a failed upgrade or unresponsive appliance, contact Cisco TAC.

Before you begin

Check your place in the upgrade path, including hosting environment and managed device upgrades. Make sure you have fully planned and prepared for this step.

Procedure

Step 1

Deploy to managed devices whose configurations are out of date.

On the FMC menu bar, click Deploy. Choose devices, then click Deploy again. Deploying before you upgrade reduces the chance of failure.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts Snort, which interrupts traffic inspection and, depending on how your device handles traffic, may interrupt traffic until the restart completes. For more information, see Traffic Flow, Inspection, and Device Behavior.

Step 2

Perform final preupgrade checks.

  • Check health: Use the Message Center (click the System Status icon on the menu bar). Make sure the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

  • Running tasks: Also in the Message Center, make sure essential tasks are complete. Tasks running when the upgrade begins are stopped, become failed tasks, and cannot be resumed. You can manually delete failed status messages later.

  • Check disk space: Perform a final disk space check. Without enough free disk space, the upgrade fails. For disk space requirements, see Time Tests and Disk Space Requirements.
Step 3

Choose System > Updates.

Step 4

Click the Install icon next to the upgrade package you want to use, then choose the FMC.

Step 5

Click Install to begin the upgrade.

Confirm that you want to upgrade and reboot the FMC.

Step 6

Monitor precheck progress in the Message Center until you are logged out.

Do not make configuration changes or deploy to any device while the FMC is upgrading. Even if the Message Center shows no progress for several minutes or indicates that the upgrade has failed, do not restart the upgrade or reboot the FMC. Instead, contact Cisco TAC.

Step 7

Log back into the FMC when you can.

  • Minor upgrades (patches and hotfixes): You can log in after the upgrade completes and the FMC reboots.

  • Major upgrades: You can log in before the upgrade completes. The FMC displays a page you can use to monitor the upgrade's progress and view the upgrade log and any error messages. You are logged out again when the upgrade completes and the FMC reboots. After the reboot, log back in again.

Step 8

If prompted, review and accept the End User License Agreement (EULA).

Step 9

Verify upgrade success.

If the FMC does not notify you of the upgrade's success when you log in, choose Help > About to display current software version information.

Step 10

Use the Message Center to recheck deployment health.
Step 11

Update intrusion rules (SRU) and the vulnerability database (VDB).

If the SRU or the VDB available on the Cisco Support & Downloads site is newer than the version currently running, install the newer version. For more information, see the Firepower Management Center Configuration Guide. Note that when you update intrusion rules, you do not need to automatically reapply policies. You will do that later.

Step 12

Complete any post-upgrade configuration changes described in the release notes.
Step 13

Redeploy configurations.

Redeploy to all managed devices. If you do not deploy to a device, its eventual upgrade may fail and you may have to reimage it.

Upgrade High Availability FMCs

Use this procedure to upgrade the Firepower software on Firepower Management Centers in a high availability pair.

You upgrade peers one at a time. With synchronization paused, first upgrade the standby, then the active. When the standby FMC starts prechecks, its status switches from standby to active, so that both peers are active. This temporary state is called split-brain and is not supported except during upgrade. Do not make or deploy configuration changes while the pair is split-brain. Your changes will be lost after you restart synchronization.


Caution
Do not deploy changes to or from, manually reboot, or shut down an upgrading appliance. Do not restart an upgrade in progress. The upgrade process may appear inactive during prechecks; this is expected. If you encounter issues with the upgrade, including a failed upgrade or unresponsive appliance, contact Cisco TAC.

Before you begin

Check your place in the upgrade path, including managed device upgrades. Make sure you have fully planned and prepared for this step.

Procedure

Step 1

On the active FMC, deploy to managed devices whose configurations are out of date.

On the FMC menu bar, click Deploy. Choose devices, then click Deploy again. Deploying before you upgrade reduces the chance of failure.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts Snort, which interrupts traffic inspection and, depending on how your device handles traffic, may interrupt traffic until the restart completes. For more information, see Traffic Flow, Inspection, and Device Behavior.

Step 2

Use the Message Center to check deployment health before you pause synchronization.

Click the System Status icon on the FMC menu bar to display the Message Center. Make sure the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 3

Pause synchronization.

  1. Choose System > Integration.

  2. On the High Availability tab, click Pause Synchronization.

Step 4

Upgrade the FMCs one at a time—first the standby, then the active.

Follow the instructions in Upgrade a Standalone FMC, but omit the initial deploy, and stop after you verify update success on each FMC. In summary, for each FMC:

  1. Perform final preupgrade checks (health, running tasks, disk space).

  2. On the System > Updates page, install the upgrade.

  3. Monitor progress until you are logged out, then log back in when you can (this happens twice for major upgrades).

  4. Verify upgrade success.

Do not make or deploy configuration changes while the pair is split-brain.

Step 5

On the FMC you want to make the active peer, restart synchronization.

  1. Choose System > Integration.

  2. On the High Availability tab, click Make-Me-Active.

  3. Wait until synchronization restarts and the other FMC switches to standby mode.

Step 6

Use the Message Center to recheck deployment health.
Step 7

Update intrusion rules (SRU) and the vulnerability database (VDB).

If the SRU or the VDB available on the Cisco Support & Downloads site is newer than the version currently running, install the newer version. For more information, see the Firepower Management Center Configuration Guide. Note that when you update intrusion rules, you do not need to automatically reapply policies. You will do that later.

Step 8

Complete any post-upgrade configuration changes described in the release notes.
Step 9

Redeploy configurations.

Redeploy to all managed devices. If you do not deploy to a device, its eventual upgrade may fail and you may have to reimage it.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Cisco Community Discussions

About Us
Contact Us
Work with Us