The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Use this guide to plan and complete Firewall Threat Defense upgrades. Upgrades can be minor (A.x), maintenance (A.x.y), or vulnerability (A.x.y.z) releases. We also may provide hotfixes, which are minor updates that address particular, urgent issues.
Before you upgrade, make sure the target version is compatible with your deployment. If you cannot upgrade due to incompatibility, contact your Cisco representative or partner contact for refresh information. For compatibility, see Cisco Secure Firewall Threat Defense Compatibility Guide.
In addition to the guidelines and resource links in the following topics, see Reference for general information on time and disk space requirements, and for details on system behavior during upgrade, which can include interruptions to traffic flow and inspection.
For release-specific upgrade warnings and guidelines for Firewall Threat Defense, and for information on features and bugs with upgrade impact, check all release notes between your current and target version: http://www.cisco.com/go/ftd-notes.
In most cases, we recommend you use the latest build for your FXOS major version.
For release-specific FXOS upgrade warnings and guidelines, as well as features and bugs with upgrade impact, check all release notes between your current and target version: http://www.cisco.com/go/firepower9300-rns.
For firmware upgrade guidelines (for upgrades to FXOS 2.13 and earlier), see the firmware upgrade guide: Cisco Firepower 4100/9300 FXOS Firmware Upgrade Guide.
Upgrade does not change the serial number or UUID of Firewall Threat Defense Virtual instances.
Before you upgrade a cluster in the public cloud, copy the target version image to your cloud image repository and update the image ID in the cluster deployment template (we actually recommend replacing the existing template with a modified copy). This ensures that after the upgrade, new instances — for example, instances launched during cluster scaling — will use the correct version. If the marketplace does not have the image you need, such as when the cluster has been patched, create a custom image from a snapshot of a standalone Firewall Threat Defense Virtual instance running the correct version, with no instance-specific (day 0) configurations.
For Firewall Threat Defense Virtual for AWS, suspend the HealthCheck and ReplaceUnhealthy processes before autoscaled cluster upgrade. This ensures that instances are not terminated by the Auto Scaling group during the post-upgrade reboot. You can resume the suspended processes afterwards. For instructions, see the Amazon EC2 Auto Scaling user guide: Suspend and resume Amazon EC2 Auto Scaling processes.
Planning your upgrade path and order is especially important for large deployments, high availability/clustering, multi-hop upgrades, and situations where you need to coordinate chassis, hosting environment, or other upgrades.
Go directly to the latest release possible to minimize upgrade and other impact. This is because features, enhancements, and critical fixes can skip "future" releases that are ahead by version, but not by release date. For example, if you are up-to-date within major Version A, upgrading to dot-zero Version B can deprecate features and fixes.
If you cannot go to the latest release, at least make sure your current version was released on a date before your target version; see the Secure Firewall Threat Defense release notes for your target version.
Critical fixes in patches/vulnerability (fourth-digit) releases can also skip future releases. If you depend on these critical fixes, verify that your target version contains them. For a full list of release dates, see Cisco Secure Firewall Management Center New Features by Release.
This section summarizes upgrade and downgrade capability.
This table shows the supported direct upgrades for Firewall Threat Defense software.
 Note |
You can upgrade directly to any release except patches (fourth-digit releases). You cannot upgrade directly to a patch from a previous major or maintenance release. |
|
Current version |
Target Firewall Threat Defense version |
|||||
|---|---|---|---|---|---|---|
|
to 10.x |
to 7.7 |
to 7.6 |
to 7.4 |
to 7.3 |
to 7.2 |
|
|
from 10.x |
YES |
— |
— |
— |
— |
— |
|
from 7.7 |
YES |
YES |
— |
— |
— |
— |
|
from 7.6 |
YES |
YES |
YES |
— |
— |
— |
|
from 7.4 |
YES |
YES |
YES |
YES * |
— |
— |
|
from 7.3 |
YES |
YES |
YES |
YES |
YES |
— |
|
from 7.2 |
— |
YES |
YES |
YES |
YES |
YES |
* Firewall Threat Defense Version 7.4.0 is available as a fresh install on the Secure Firewall 4200 only. It removes significant features, enhancements, and critical fixes included in earlier versions. Upgrade to a later release.
For the Firepower 4100/9300, this table lists companion FXOS versions. If a chassis upgrade is required, Firewall Threat Defense upgrade is blocked. In most cases we recommend the latest build in each version; for minimum builds see the Cisco Secure Firewall Threat Defense Compatibility Guide.
|
Target Firewall Threat Defense version |
Minimum FXOS version |
|---|---|
|
10.x |
2.18.0 |
|
7.7 |
2.17.0 |
|
7.6 |
2.16.0 |
|
7.4.1–7.4.x |
2.14.1 |
|
7.4.0 |
— |
|
7.3 |
2.13.0 |
|
7.2 |
2.12.0 |
If an upgrade succeeds but the system does not function to your expectations, you may be able to return to a previous version; see Revert Firewall Threat Defense.
Some devices may require a chassis upgrade (FXOS and firmware) before you upgrade the software:
Secure Firewall 3100/4200 in multi-instance mode: Any upgrade can require a chassis upgrade.
Although you upgrade the chassis and Firewall Threat Defense separately, one package contains the chassis and Firewall Threat Defense upgrades and you perform both from the Cloud-Delivered Firewall Management Center. The compatibility work is done for you. It is possible to have a chassis-only upgrade or a Firewall Threat Defense-only upgrade.
Firepower 4100/9300: Major versions require a chassis upgrade.
Because you upgrade the chassis first, you will briefly run a supported—but not recommended—combination, where the operating system is "ahead" of Firewall Threat Defense. If the chassis is already well ahead of its devices, further chassis upgrades can be blocked. In this case perform a three (or more) step upgrade: devices first, then the chassis, then devices again. Or, perform a full reimage. In high availability or clustered deployments, upgrade one chassis at a time.
When a chassis upgrade is required in high availability or clustered deployments, upgrade one chassis at a time. For high availability, although it is best practice to always upgrade the standby, a chassis could have both standby and active instances (belonging to different high availabilty pairs). In that case, any active units on the upgrading chassis automatically fail over. For clustering, the same applies: it is always best to upgrade an all-data unit chassis.
Before upgrade, high availability pairs and clusters should be in sync, not split brain, and so on. Firewall Threat Defense upgrades will not proceed for most issues of this type, but the chassis is not aware of the status of its instances. This means that even if you upgrade the chassis one at a time, you can still experience disruption if you do not make sure your deployment is healthy before each chassis upgrade.
|
Firewall Threat Defense Deployment |
Upgrade Order |
|---|---|
|
Standalone |
|
|
High availability |
Upgrade both chassis before you upgrade Firewall Threat Defense. To minimize disruption, always upgrade the standby.
|
|
Intra-chassis cluster (units on the same chassis) |
|
|
Inter-chassis cluster (units on different chassis) |
Upgrade all chassis before you upgrade Firewall Threat Defense. To minimize disruption, always upgrade an all-data unit chassis.
|
|
Firewall Threat Defense Deployment |
Upgrade Order |
|---|---|
|
Standalone |
|
|
High availability |
Upgrade both chassis before you upgrade Firewall Threat Defense.
|
lists all upgrades that apply to you, with suggested releases specially marked. You can easily choose and direct-download packages from the internet to the Cloud-Delivered Firewall Management Center, or upload packages you manually downloaded. For details, see the following table. For answers to common issues, see Troubleshooting upgrade packages.
Note |
Devices with internet access can be upgraded without the package on the Cloud-Delivered Firewall Management Center. The device will get the package at the appropriate time; see Copying Upgrade Packages to Devices. |
|
To... |
Do This... |
|---|---|
|
Refresh the list of available upgrades. |
Click Refresh ( |
|
Download an upgrade package to the Cloud-Delivered Firewall Management Center from the internet. |
Click Download next to the upgrade package or version you want to download. Each family of devices has its own upgrade packages, so depending on your deployment you may need to download more than one upgrade package. |
|
Manually upload an upgrade package to the Cloud-Delivered Firewall Management Center. |
Click Add upgrade package at the bottom right of the page, then Choose file. |
|
Configure devices to get upgrade packages from an internal server. |
Click Add upgrade package at the bottom right of the page, then Specify remote location. See: Copying Upgrade Packages to Devices from an Internal Server |
|
Force devices to get upgrade packages from the Cloud-Delivered Firewall Management Center instead of the internet. |
Click Global upgrade settings, then disable the option to Allow devices to download from the support site. By default, a device with internet access downloads upgrade packages from the internet before the Cloud-Delivered Firewall Management Center, including as fallback when download from an internal server fails. |
|
Configure the retry length for partial downloads. |
Click Global upgrade settings, then choose an option from the Retry failed downloads for drop-down list. Partial downloads from the internet (Cloud-Delivered Firewall Management Center and device) or internal server (device only) are saved and retried for the interval you specify. The default is 24 hours. This setting does not apply to device downloads from the Cloud-Delivered Firewall Management Center over the management network. For device downloads, retry requires at least Version 7.4.3, 7.6.1, or 7.7.0. |
|
Delete upgrade packages from the Cloud-Delivered Firewall Management Center. |
Click the Ellipsis (…) next to the package or package version you want to delete and select Delete. This deletes the packages (or the pointer to the package) from the Cloud-Delivered Firewall Management Center. It does not delete packages from any devices where you already copied them. In most cases, upgrading removes the related package from the upgraded appliance. However, for the Secure Firewall 3100/4200 in multi-instance mode, chassis upgrade packages must be removed manually. See Deleting Chassis Upgrade Packages from the Secure Firewall 3100/4200. |
To upgrade, the upgrade package must be on the device.
After you select devices to upgrade, the upgrade wizard prompts you to copy upgrade packages. Devices try the following sources in order. If one fails, in most cases the device tries the next one.
When configured, this takes priority. Recommended when it is not possible or practical to get the upgrade package from the internet or Cloud-Delivered Firewall Management Center, for example, if devices do not have internet access, there is not enough disk space on the Cloud-Delivered Firewall Management Center, or there is poor bandwidth between devices and the download location. The Cloud-Delivered Firewall Management Center in particular has limited disk space for device upgrade packages.
If download from the internal server fails, newer devices (Firewall Threat Defense 7.6+ or chassis 7.4.1+) with internet access try that next. Older devices and devices without internet access try the Cloud-Delivered Firewall Management Center.
See: Copying Upgrade Packages to Devices from an Internal Server
Recommended when devices have internet access, with good bandwidth between devices and the download location. Internet access is tested weekly. Not supported for hotfixes.
By default, a device with internet access tries the internet before the Cloud-Delivered Firewall Management Center, but if devices have slow or unreliable internet access you can use the Global upgrade settings to force devices to get upgrade packages from the Cloud-Delivered Firewall Management Center. If internet download fails, the device tries the Cloud-Delivered Firewall Management Center.
See: Managing upgrade packages with the Cloud-Delivered Firewall Management Center
Recommended when devices cannot reach the internet or have slow or unreliable internet access, but there is enough disk space on the Cloud-Delivered Firewall Management Center, and there is good bandwidth between the Cloud-Delivered Firewall Management Center and devices. You can also keep device upgrade packages on the Cloud-Delivered Firewall Management Center as a fallback in case internal server or direct download fails.
The Cloud-Delivered Firewall Management Center can get most device upgrade packages directly from the internet. If you are applying a hotfix, manually upload upgrade packages.
See: Managing upgrade packages with the Cloud-Delivered Firewall Management Center
For the Secure Firewall 3100/4200 in multi-instance mode, use the Firewall Threat Defense methods above. Note that these chassis upgrade packages are stored outside any application instances. This allows you to upgrade the chassis while also making the Firewall Threat Defense upgrade accessible to all instances. However, this means that you must manually remove unneeded chassis upgrade packages (instead of the upgrade process automatically removing them).
For Firepower 4100/9300 chassis upgrade packages, manually download the upgrade package from the Cisco Support & Download site, then use the Firewall Chassis Manager or CLI (FTP, SCP, SFTP, or TFTP) to copy the package to the device. See Manually Downloading Upgrade Packages and the upgrade procedure for your deployment.
Managed devices without internet access must get upgrade packages from either the Cloud-Delivered Firewall Management Center or an internal server. An internal server is especially useful if you have limited bandwidth between the Cloud-Delivered Firewall Management Center and its devices (or, between the devices and the internet download location). It also saves space on the Cloud-Delivered Firewall Management Center. The Cloud-Delivered Firewall Management Center in particular has limited disk space for device upgrade packages.
After you get upgrade packages (Manually Downloading Upgrade Packages) and set up your server, configure pointers. On the Cloud-Delivered Firewall Management Center, start like you are uploading a package: on the Product Upgrades page (), click Add upgrade package. But instead of choosing a file on your computer, click Specify remote location and provide the appropriate details. When it is time to get the package, the device will copy it from the internal server.
Note |
When configured, an internal server takes priority. If copying from the internal server fails, newer devices (Firewall Threat Defense 7.6+ or chassis 7.4.1+) with internet access try the internet, then the Cloud-Delivered Firewall Management Center, unless you disabled support-site downloads in the global upgrade settings. Older devices and devices without internet access just try the Cloud-Delivered Firewall Management Center. |
|
Field |
Description |
|---|---|
|
URL |
The source URL, including protocol (HTTP/HTTPS) and full path to the upgrade package; for example: https://internal_web_server/upgrade_package.sh.REL.tar. |
|
CA certificates |
For secure web servers (HTTPS), the server's digital certificate (PEM format). Copy and paste the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines. You should be able to obtain the certificate from the server's administrator. You may also be able to use your browser, or a tool like OpenSSL, to view the server's certificate details and export or copy the certificate. |
For the Secure Firewall 3100/4200 in multi-instance mode, chassis upgrade packages are stored outside any application instances. This allows you to upgrade the chassis while also making the Firewall Threat Defense upgrade accessible to all instances. However, this means that you must manually remove unneeded chassis upgrade packages (instead of the upgrade process automatically removing them).
Note |
You must remove unneeded chassis upgrade packages in the context of a chassis upgrade workflow. The best time to do this is when you are upgrading to the next version. |
Use this procedure to delete chassis upgrade packages when you are not actively upgrading the chassis.
Download (or configure a pointer to) at least one chassis upgrade package other than the one corresponding to the package you want to delete.
|
Step 1 |
Choose . |
|
Step 2 |
Select the chassis that have the unneeded packages and under Select Action or Select Bulk Action, choose Upgrade FXOS and Firmware (Chassis Only). The chassis upgrade wizard appears. |
|
Step 3 |
Choose a target version from the Upgrade to menu. Choose any version other than the one corresponding to the package you want to delete. You will not be upgrading to this version so it doesn't matter which you choose. The Details column indicates which chassis have packages that might not be needed. |
|
Step 4 |
Use the Warning filter to display the affected chassis. |
|
Step 5 |
In the filtered view, click View and clean up packages next to a chassis, select the packages you want to remove, and click Delete selected packages. Repeat this step for each chassis you want to clean up. Note that you cannot delete a package for the version the chassis is currently running, nor a package for the "target version" you selected. Only chassis with packages other than these are counted. |
|
Step 6 |
Back in the chassis upgrade wizard, click Reset to reset the workflow. |
Manually download upgrade packages when you cannot or do not want to direct-download for another reason; for example, for hotfixes, Firepower 4100/9300 chassis upgrades, or if you use an internal server.
Packages are available on the Cisco Support & Download site: https://www.cisco.com/go/ftd-software
You use the same upgrade package for all models in a family or series. To find the correct one, select or search for your model, then browse to the software download page for the appropriate version. Available upgrade packages are listed along with installation packages, hotfixes, and other applicable downloads. Upgrade package file names reflect the platform, software version, and build. Upgrade packages are signed, and terminate in .sh.REL.tar. Do not untar or rename them.
|
Platform |
Package |
|---|---|
|
Firepower 1000 |
Cisco_FTD_SSP-FP1K_Upgrade-Version-build.sh.REL.tar |
|
Firepower 2100 Last support: Version 7.4.x |
Cisco_FTD_SSP-FP2K_Upgrade-Version-build.sh.REL.tar |
|
Firepower 4100/9300 |
Cisco_FTD_SSP_Upgrade-Version-build.sh.REL.tar |
|
Secure Firewall 200 |
Cisco_Secure_FW_TD_200-Version-build.sh.REL.tar |
|
Secure Firewall 1200 |
Cisco_Secure_FW_TD_1200-Version-build.sh.REL.tar |
|
Secure Firewall 3100 |
Cisco_FTD_SSP-FP3K_Upgrade-Version-build.sh.REL.tar |
|
Secure Firewall 4200 |
Cisco_Secure_FW_TD_4200-Version-build.sh.REL.tar |
|
Secure Firewall 6100 |
Cisco_Secure_FW_TD_6100-Version-build.sh.REL.tar |
|
ISA 3000 with FTD |
Cisco_FTD_Upgrade-Version-build.sh.REL.tar |
| Threat defense virtual |
Cisco_FTD_Upgrade-Version-build.sh.REL.tar |
For the Secure Firewall 3100/4200 in multi-instance mode, the threat defense and chassis upgrades share a package.
To find the correct FXOS package, select or search for your device model and browse to the Firepower Extensible Operating System download page for your target FXOS version and build. The FXOS package is listed along with recovery and MIB packages. Firmware is included in FXOS upgrades to 2.14.1+.
|
Platform |
Package |
|---|---|
|
Firepower 4100/9300 |
fxos-k9.fxos_version.SPA |
|
Issue |
Solution |
|---|---|
|
No available upgrades even after I refresh. |
You are already running the latest version available for your deployment, and you have no upgrade packages loaded/configured. |
|
Suggested release is not marked. |
The suggested release is listed only if you are eligible for it. It is not listed if you are already running the suggested release or higher, or if you cannot upgrade that far. Note that patches to suggested releases are not marked as suggested, although we do recommend you apply them. |
|
I don't see the packages I want. |
Only major, maintenance, and patch upgrades that apply to your deployment right now are listed and available for direct download. These are not listed unless manually uploaded:
|
|
A package was deleted from the page. |
When your Cloud-Delivered Firewall Management Center instance is upgraded, locally saved upgrade packages are deleted. This includes packages that you cannot directly download again; for example, deprecated releases, releases that no longer apply to your deployment, and hotfixes that you may still need to apply to managed devices. Upload the supported packages you still need. To see if your instance has been upgraded, check What's New for Security Cloud Control. |
|
Copying upgrade packages from the Cloud-Delivered Firewall Management Center to devices times out. |
This often happens when there is limited bandwidth between the Cloud-Delivered Firewall Management Center and its devices. You can try one of:
|
After you check compatibility, plan your upgrade path and order, and review upgrade guidelines, you need to assess upgrade readiness. The system does some of these checks for you, but you still need to perform additional checks (and actions) yourself, like deploying configuration changes and making backups.
Use the following sections to perform last minute-tasks and confirm upgrade readiness.
Devices can stop passing traffic during the upgrade or if the upgrade fails. Before you upgrade, make sure traffic from your location does not have to traverse the device itself to access the device's management interface. You should also able to access the Cloud-Delivered Firewall Management Center's management interface without traversing the device.
Make sure your management network has the bandwidth to perform large data transfers. Whenever possible, upload upgrade packages ahead of time. If you transfer an upgrade package to a device at the time of upgrade, insufficient bandwidth can extend upgrade time or even cause the upgrade to time out. See Guidelines for Downloading Data from the Firepower Management Center to Managed Devices (Troubleshooting TechNote).
Make any required pre-upgrade configuration changes, and prepare to make required post-upgrade configuration changes. Resolve any change management workflows. Deploy configuration changes. You will need to deploy again after upgrade. Deploying typically restarts Snort, which can affect traffic flow and inspection; see Traffic Flow and Inspection when Deploying Configurations.
Make sure your deployment is healthy and successfully communicating. If there are any issues reported by the health monitor or on the Device Management page, resolve them before continuing.
Some failed health tests can prevent you from upgrading or cause upgrade failure. With the exception of NTP issues that you can resolve yourself, contact Cisco TAC if your deployment is failing any of the following tests. Results are reported on the Health Status (Home) page of the health monitor: Troubleshooting.
Note |
Disabling these regular health tests does not prevent the system from enforcing them before upgrade. If there are no existing results, readiness checks will run as part of the upgrade, increasing upgrade time. |
|
Health Test |
Description |
|---|---|
|
Database |
Monitors database schema and configuration data (EO) integrity. |
|
Disk Status |
Monitors disk and RAID controller health for hardware devices. |
|
Disk Usage |
Monitors device disk usage. The upgrade calculates how much disk space it needs; not having enough will prevent upgrade. If this module is alerting before you begin upgrade, you probably do not have enough. On device health dashboards, the Disk Usage widget has a Clear disk space button that safely removes unneeded files such as old backups, content updates, and troubleshooting files. |
|
Firewall Threat Defense HA (Cloud-Delivered Firewall Management Center and devices) Cluster/HA Failure Status (devices) |
High availability pairs and clusters should be in sync, not split brain, and so on. Firewall Threat Defense upgrades will not proceed for most issues of this type. However, for the Firepower 4100/9300 and Secure Firewall 3100/4200 in multi-instance mode, the chassis is not aware of the status of its instances. This means that even if you upgrade the chassis one at a time, you can still experience disruption if you do not make sure your deployment is healthy before each chassis upgrade. |
|
FXOS Health |
Monitors the FXOS httpd service on FXOS-based devices. Upgrade will fail without this service running. |
|
Time Synchronization Status |
Monitors device NTP synchronization. Being out of sync can cause upgrade failure. The system only alerts when you are offset by more than 10 seconds, so we recommend you manually check for a smaller offset (click see more next to the test results). |
With the exception of hotfixes, upgrade deletes all backups stored on the system. We strongly recommend you back up to a secure remote location and verify transfer success, both before and after any upgrade:
Before upgrade: If an upgrade fails catastrophically, you may have to reimage and restore. Reimaging returns most settings to factory defaults, including the system password. If you have a recent backup, you can return to normal operations more quickly.
After upgrade: This creates a snapshot of your freshly upgraded deployment.
|
Backup |
Guide |
|---|---|
|
Firewall Threat Defense |
Cisco Security Cloud Control: Cloud-Delivered Firewall Management Center for Firewall Threat Defense: Backup/Restore Note that backup is not supported in all cases, for example, for Firewall Threat Defense Virtual in the public cloud. But if you can back up, you should. |
|
Secure Firewall 3100/4200 chassis |
Cisco Security Cloud Control: Cloud-Delivered Firewall Management Center for Firewall Threat Defense: Multi-Instance Mode for the Secure Firewall 3100/4200 |
|
Firepower 4100/9300 chassis |
Cisco Firepower 4100/9300 FXOS Configuration Guide: Configuration Import/Export |
|
ASA on a Firepower 9300 chassis |
Cisco ASA Series General Operations Configuration Guide: Software and Configurations For a Firepower 9300 chassis with Firewall Threat Defense and ASA logical devices, use ASDM or the ASA CLI to back up ASA configurations and other critical files, especially if there is an ASA configuration migration. |
Feedback