Upgrade Firepower Threat Defense: Other FTD Devices

Upgrade Checklist: Other FTD Devices

Use this checklist to upgrade Firepower 1000/2100 series, ASA 5500-X series, ISA 3000, and FTDv devices.

Complete the checklist every time you upgrade. Skipping steps can result in an unsuccessful upgrade. At all times during the process, make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Plan the Upgrade

Maintain deployment compatibility at all times by correctly planning and following an upgrade path.


✓	Action/Check	Details
	Verify Upgrade Path Check your place in your upgrade path. Know which upgrade you just performed and which you are performing next.	Upgrade Path: Other FTD Devices
	Check Versions Check current and target versions on the devices: Firepower Threat Defense software Virtual hosting environment (FTDv)	Firepower Devices
	Check FMC Compatibility Check if the FMC will be able to manage the devices after you upgrade them. If not, revise your upgrade path so you upgrade the FMC first.	Can I Maintain FMC-Device Version Compatibility?
	Read Release Notes Read the release notes, paying special attention to the things that can affect upgrade, including: Version-specific upgrade guidelines and warnings. Known issues that affect upgrade. New/deprecated features and functionality.	Firepower Release Notes

Pre-Upgrade Actions and Checks

Minimize disruption by performing prechecks outside the maintenance window.


✓	Action/Check	Details
	Make Required Configuration Changes Make required pre-upgrade configuration changes, and be prepared to make required post-upgrade configuration changes.	Firepower Release Notes
	Check Disk Space Run a preliminary disk space check for the Firepower software upgrade.	Time Tests and Disk Space Requirements
	Get Firepower Software Upgrade Package Obtain the correct Firepower software upgrade package. Do not untar signed (.tar) packages. You can either: Upload the package to the FMC. Configure an internal web server as the source for FTD upgrade packages. Requires Version 6.6.0.	Obtain Firepower Software Upgrade Packages
	Check Bandwidth Make sure you have the bandwidth to perform a large data transfer to your managed devices.	Guidelines for Downloading Data from the Firepower Management Center to Managed Devices (Troubleshooting TechNote)
	Push Firepower Software Upgrade Package Push the upgrade package to the devices. Requires Version 6.2.3+.	Push Upgrade Packages to FMC-Managed Devices
	Run Firepower Software Readiness Check Run a readiness check. Requires Version 6.1+.	Run Firepower Software Readiness Checks
	Back Up Devices Use the FMC to back up configuration data for supported FTD platforms (not all FTD platforms support backup). Back up to an external location and verify transfer success. Requires Version 6.3+.	Firepower Management Center Configuration Guide
	Verify Appliance Access Make sure your computer can connect to the FMC’s management interface and to the device’s management interface, both without traversing the device itself.	Appliance Access, Communication, and Health
	Schedule Maintenance Window Schedule a maintenance window when it will have the least impact, considering the tasks you must perform, the upgrade's effect on traffic flow and inspection, and the time the upgrade is likely to take.	FTD Upgrade Behavior: Other Devices and Time Tests and Disk Space Requirements

Upgrade the Devices

Because upgrades can cause interruptions in traffic flow or inspection, perform them in a maintenance window.


✓	Action/Check	Details
	Upgrade Hosting If needed, upgrade the hosting environment (FTDv).	See the documentation for your hosting environment.
	Upgrade Firepower Software Upgrade the Firepower software.	Upgrade FTD Software: Other FTD Devices

Upgrade Path: Other FTD Devices

This table provides upgrade paths for FTD devices managed by a Firepower Management Center, where you do not have to update the operating system: Firepower 1000/2100 Series, ASA 5500-X Series, ISA 3000, FTDv.

Note

Performing a hitless upgrade of an FTD high availability pair to Version 6.1.0 requires a preinstallation package. For more information, see Firepower System Release Notes Version 6.1.0 Preinstallation Package.

Find your current Firepower version in the left column. You can upgrade directly to the versions listed in the right column. If you cannot perform a direct upgrade from your current to the target version, your upgrade path must include intermediate versions. For an alternate way of looking at this information, see Is Direct Upgrade Possible?.

Table 1. Direct Upgrades: Firepower 1000/2100 Series, ASA 5500-X Series, ISA 3000, FTDv with FMC
Current Version	Target Version
6.7.0 6.7.x (maintenance releases)	Directly to: → Any later 6.7.x maintenance release
6.6.0 6.6.x (maintenance releases) Last Firepower support for ASA 5525-X, 5545-X, and 5555-X.	Directly to one of: → 6.7.0 or any 6.7.x maintenance release → Any later 6.6.x maintenance release
6.5.0	Directly to one of: → 6.7.0 or any 6.7.x maintenance release → 6.6.0 or any 6.6.x maintenance release
6.4.0 Last Firepower support for ASA 5515-X.	Directly to one of: → 6.7.0 or any 6.7.x maintenance release → 6.6.0 or any 6.6.x maintenance release → 6.5.0
6.3.0	Directly to one of: → 6.7.0 or any 6.7.x maintenance release → 6.6.0 or any 6.6.x maintenance release → 6.5.0 → 6.4.0
6.2.3 Last Firepower support for ASA 5506-X series.	Directly to one of: → 6.6.0 or any 6.6.x maintenance release → 6.5.0 → 6.4.0 → 6.3.0
6.2.2	Directly to one of: → 6.4.0 → 6.3.0 → 6.2.3
6.2.1	Directly to one of: → 6.4.0 → 6.3.0 → 6.2.3 → 6.2.2
6.2.0	Directly to one of: → 6.4.0 → 6.3.0 → 6.2.3 → 6.2.2
6.1.0	Directly to one of: → 6.4.0 → 6.3.0 → 6.2.3 → 6.2.0
6.0.1	Directly to: → 6.1.0

Upgrade FTD Software: Other FTD Devices

Use this procedure to upgrade Firepower 1000/2100 series, ASA 5500-X series, ISA 3000, and FTDv devices. You can upgrade multiple devices at once if they use the same upgrade package. You must upgrade the members of high availability pairs at the same time.

Caution

Do not deploy changes to or from, manually reboot, or shut down an upgrading appliance. Do not restart an upgrade in progress. The upgrade process may appear inactive during prechecks; this is expected. If you encounter issues with the upgrade, including a failed upgrade or unresponsive appliance, contact Cisco TAC.

Before you begin

Check your place in the upgrade path, including virtual hosting environment and FMC upgrades. Make sure you have fully planned and prepared for this step.

Procedure

Step 1

Deploy configurations to the devices you are about to upgrade.

On the FMC menu bar, click Deploy. Choose devices, then click Deploy again. Deploying before you upgrade reduces the chance of failure.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts Snort, which interrupts traffic inspection and, depending on how your device handles traffic, may interrupt traffic until the restart completes. For more information, see FTD Upgrade Behavior: Other Devices.

Step 2

Perform final preupgrade checks.

Check health: Use the Message Center (click the System Status icon on the menu bar). Make sure the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.
Running tasks: Also in the Message Center, make sure essential tasks are complete. Tasks running when the upgrade begins are stopped, become failed tasks, and cannot be resumed. You can manually delete failed status messages later.
Check disk space: Perform a final disk space check. Without enough free disk space, the upgrade fails. For disk space requirements, see Time Tests and Disk Space Requirements.

Step 3

(Optional, high availability only) Switch the active/standby roles of your high availability device pairs.

The standby device in a high availability pair upgrades first. The devices switch roles, then the new standby upgrades. When the upgrade completes, the devices' roles remain switched. If you want to preserve the active/standby roles, manually switch the roles before you upgrade. That way, the upgrade process switches them back.

Choose Devices > Device Management, click the Switch Active Peer icon next to the pair, and confirm your choice.

Step 4

Choose System > Updates.

Step 5

Click the Install icon next to the upgrade package you want to use and choose the devices to upgrade.

If the devices you want to upgrade are not listed, you chose the wrong upgrade package.

Note

We strongly recommend upgrading no more than five devices simultaneously. The FMC does not allow you stop the upgrade until all selected devices complete the process. If there is an issue with any one device upgrade, all devices must finish upgrading before you can resolve the issue.

Step 6

Click Install, then confirm that you want to upgrade and reboot the devices.

Some devices may reboot twice during the upgrade; this is expected behavior.

Traffic either drops throughout the upgrade or traverses the network without inspection depending on how your devices are configured and deployed. For more information, see FTD Upgrade Behavior: Other Devices.

Step 7

Monitor upgrade progress in the Message Center.

Do not deploy configurations to the device while it is upgrading. Even if the Message Center shows no progress for several minutes or indicates that the upgrade has failed, do not restart the upgrade or reboot the device. Instead, contact Cisco TAC.

Step 8

Verify success.

After the upgrade completes, choose Devices > Device Management and confirm that the devices you upgraded have the correct software version.

Step 9

Use the Message Center to recheck deployment health.

Step 10

Update intrusion rules (SRU) and the vulnerability database (VDB).

If the SRU or the VDB available on the Cisco Support & Downloads site is newer than the version currently running, install the newer version. For more information, see the Firepower Management Center Configuration Guide. Note that when you update intrusion rules, you do not need to automatically reapply policies. You will do that later.

Step 11

Complete any post-upgrade configuration changes described in the release notes.

Step 12

Redeploy configurations to the devices you just upgraded.

Cisco Firepower Management Center Upgrade Guide

Book Title

Chapter Title

Results

Chapter: Upgrade Firepower Threat Defense: Other FTD Devices