Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Cisco Firepower Management Center Upgrade Guide

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco Firepower Management Center Upgrade Guide

Chapter Title

Upgrade Firepower Threat Defense: Other FTD Devices

Results

Updated:
April 24, 2019

Chapter: Upgrade Firepower Threat Defense: Other FTD Devices

Upgrade Firepower Threat Defense: Other FTD Devices

Upgrade Checklist: Other FTD Devices

Use this checklist to upgrade Firepower 2100 series, ASA 5500-X series, ISA 3000, and FTDv devices.

Complete the checklist every time you upgrade. Skipping steps can result in an unsuccessful upgrade. At all times during the process, make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Plan the Upgrade

Maintain deployment compatibility at all times by correctly planning and following an upgrade path.

✓ Action/Check Details

Verify Upgrade Path

Check your place in your upgrade path. Know which upgrade you just performed and which you are performing next.

Upgrade Path: Other FTD Devices

Check Versions

Check current and target versions on the devices:

  • Firepower Threat Defense software

  • Virtual hosting environment (FTDv)

Firepower Devices

Check FMC Compatibility

Check if the FMC will be able to manage the devices after you upgrade them. If not, revise your upgrade path so you upgrade the FMC first.

Can I Maintain FMC-Device Version Compatibility?

Read Release Notes

Read the release notes for the next upgrade/set of upgrades, paying special attention to version-specific warnings and guidelines.

Firepower Release Notes

Pre-Upgrade Actions and Checks

Minimize disruption by performing prechecks outside the maintenance window.

✓ Action/Check Details

Make Required Configuration Changes

Make required pre-upgrade configuration changes, and be prepared to make required post-upgrade configuration changes.

Firepower Release Notes

Check Disk Space

Run a preliminary disk space check for the Firepower software upgrade.

Time Tests and Disk Space Requirements

Get Upgrade Package

Obtain the correct upgrade package and upload it to the FMC. Do not untar signed (.tar) packages.

Obtain and Push Upgrade Packages

Check Bandwidth

Make sure you have the bandwidth to perform a large data transfer from the FMC to the devices.

Guidelines for Downloading Data from the Firepower Management Center to Managed Devices (Troubleshooting TechNote)

Push Upgrade Package

Push the upgrade package to the devices. Requires Version 6.2.3+.

Push the Upgrade Package to Managed Devices

Run Readiness Check

Run a readiness check. Requires Version 6.1+.

Run Readiness Checks

Back Up Devices

Use the FMC to back up configuration data for physical FTD devices and FTDv: VMware. Back up to an external location and verify transfer success. No support for other FTDv implementations. Requires Version 6.3+.

Firepower Management Center Configuration Guide

Verify Appliance Access

Make sure your computer can connect to the FMC’s management interface and to the device’s management interface, both without traversing the device itself.

Appliance Access During Upgrade

Schedule Maintenance Window

Schedule a maintenance window when it will have the least impact, considering the tasks you must perform, the upgrade's effect on traffic flow and inspection, and the time the upgrade is likely to take.

FTD Upgrade Behavior: Other Devices

and

Time Tests and Disk Space Requirements

Upgrade the Devices

Because upgrades can cause interruptions in traffic flow or inspection, perform them in a maintenance window.

✓ Action/Check Details

Upgrade Hosting

If needed, upgrade the hosting environment (FTDv).

See the documentation for your hosting environment.

Upgrade Firepower Software

Upgrade the Firepower software.

Upgrade FTD Software: Other FTD Devices

Upgrade Path: Other FTD Devices

This table provides upgrade paths for Firepower Threat Defense devices with bundled operating systems, managed by a Firepower Management Center: Firepower 2100 series, ASA 5500-X series, ISA 3000, and FTDv. If you cannot perform a direct upgrade from your current to the target version, your upgrade path must include intermediate versions as noted.


Note
Performing a hitless upgrade of an FTD high availability pair to Version 6.1.0 requires a preinstallation package. For more information, see Firepower System Release Notes Version 6.1.0 Preinstallation Package.
Table 1. Recommended Upgrade Paths: Firepower 2100 Series, ASA 5500-X Series, ISA 3000, FTDv with FMC

Current Version

Target Version

6.4.0

6.3.0

6.2.3

6.2.2

6.2.0

6.1.0

6.3.0

Direct

—

—

—

—

—

6.2.3

First support for ISA 3000.

Direct

Direct

—

—

—

—

6.2.2

Direct

Direct

Direct

—

—

—

6.2.1

First support for Firepower 2100 series.

Direct

Direct

Direct

Direct

—

—

6.2.0

First support for FTDv: Azure.

Direct

Direct

Direct

Direct

—

—

6.1.0

First support for FTDv: KVM.

Direct

Direct

Direct

→ 6.2.0

→ 6.2.2

Direct

—

6.0.1

→ 6.1.0

→ 6.4.0

→ 6.1.0

→ 6.3.0

→ 6.1.0

→ 6.2.3

→ 6.1.0

→ 6.2.0

→ 6.2.2

→ 6.1.0

→ 6.2.0

Direct

Upgrade FTD Software: Other FTD Devices

Use this procedure to upgrade Firepower 2100 series, ASA 5500-X series, ISA 3000, and FTDv devices. You can upgrade multiple devices at once if they use the same upgrade package. You must upgrade the members of high availability pairs at the same time.


Caution
Do not deploy changes to or from, manually reboot, or shut down an upgrading appliance. Do not restart an upgrade in progress. The upgrade process may appear inactive during prechecks; this is expected. If you encounter issues with the upgrade, including a failed upgrade or unresponsive appliance, contact Cisco TAC.

Before you begin

Check your place in the upgrade path, including virtual hosting environment and FMC upgrades. Make sure you have fully planned and prepared for this step.

Procedure

Step 1

Deploy configurations to the devices you are about to upgrade.

On the FMC menu bar, click Deploy. Choose devices, then click Deploy again. Deploying before you upgrade reduces the chance of failure.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts Snort, which interrupts traffic inspection and, depending on how your device handles traffic, may interrupt traffic until the restart completes. For more information, see FTD Upgrade Behavior: Other Devices.

Step 2

Perform final preupgrade checks.

  • Check health: Use the Message Center (click the System Status icon on the menu bar). Make sure the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

  • Running tasks: Also in the Message Center, make sure essential tasks are complete. Tasks running when the upgrade begins are stopped, become failed tasks, and cannot be resumed. You can manually delete failed status messages later.

  • Check disk space: Perform a final disk space check. Without enough free disk space, the upgrade fails. For disk space requirements, see Time Tests and Disk Space Requirements.
Step 3

(Optional, high availability only) Switch the active/standby roles of your high availability device pairs.

The standby device in a high availability pair upgrades first. The devices switch roles, then the new standby upgrades. When the upgrade completes, the devices' roles remain switched. If you want to preserve the active/standby roles, manually switch the roles before you upgrade. That way, the upgrade process switches them back.

Choose Devices > Device Management, click the Switch Active Peer icon next to the pair, and confirm your choice.

Step 4

Choose System > Updates.

Step 5

Click the Install icon next to the upgrade package you want to use and choose the devices to upgrade.

If the devices you want to upgrade are not listed, you chose the wrong upgrade package.

Note 
We strongly recommend upgrading no more than five devices simultaneously. The FMC does not allow you stop the upgrade until all selected devices complete the process. If there is an issue with any one device upgrade, all devices must finish upgrading before you can resolve the issue.
Step 6

Click Install, then confirm that you want to upgrade and reboot the devices.

Some devices may reboot twice during the upgrade; this is expected behavior.

Traffic either drops throughout the upgrade or traverses the network without inspection depending on how your devices are configured and deployed. For more information, see FTD Upgrade Behavior: Other Devices.

Step 7

Monitor upgrade progress in the Message Center.

Do not deploy configurations to the device while it is upgrading. Even if the Message Center shows no progress for several minutes or indicates that the upgrade has failed, do not restart the upgrade or reboot the device. Instead, contact Cisco TAC.

Step 8

Verify success.

After the upgrade completes, choose Devices > Device Management and confirm that the devices you upgraded have the correct software version.

Step 9

Use the Message Center to recheck deployment health.
Step 10

Update intrusion rules (SRU) and the vulnerability database (VDB).

If the SRU or the VDB available on the Cisco Support & Downloads site is newer than the version currently running, install the newer version. For more information, see the Firepower Management Center Configuration Guide. Note that when you update intrusion rules, you do not need to automatically reapply policies. You will do that later.

Step 11

Complete any post-upgrade configuration changes described in the release notes.
Step 12

Redeploy configurations to the devices you just upgraded.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Cisco Community Discussions

About Us
Contact Us
Work with Us