Getting Started

Is this Guide for You?

This guide explains how to use a Secure Firewall Management Center currently running Version 7.2 to prepare for and successfully complete:

  • Upgrade of currently managed Firewall Threat Defense devices as far as Version 7.2.

  • Upgrade of the Firewall Management Center to releases after Version 7.2.

Upgrades can be major (A.x), maintenance (A.x.y), or patch (A.x.y.z) releases. We also may provide hotfixes, which are minor updates that address particular, urgent issues.

Additional Resources

If you are upgrading a different platform/component, upgrading to/from a different version, or are using a cloud-based manager, see one of these resources.

Table 1. Upgrade Guides for Firewall Management Center

Current Firewall Management Center Version

Guide

7.2+

Cisco Secure Firewall Threat Defense Upgrade Guide for Management Center for your version

7.1

Cisco Firepower Threat Defense Upgrade Guide for Firepower Management Center, Version 7.1

7.0 or earlier

Cisco Firepower Management Center Upgrade Guide, Version 6.0–7.0
Table 2. Upgrade Guides for Firewall Threat Defense with Firewall Management Center

Current Firewall Management Center Version

Guide

Cloud-Delivered Firewall Management Center

Secure Firewall Threat Defense upgrade guides for Cloud-Delivered Firewall Management Center

7.2+

Cisco Secure Firewall Threat Defense Upgrade Guide for Management Center for your version

7.1

Cisco Firepower Threat Defense Upgrade Guide for Firepower Management Center, Version 7.1

7.0 or earlier

Cisco Firepower Management Center Upgrade Guide, Version 6.0–7.0
Table 3. Upgrade Guides for Firewall Threat Defense with Firewall Device Manager

Current Firewall Threat Defense Version

Guide

7.2+

Cisco Secure Firewall Threat Defense Upgrade Guide for Device Manager for your version

7.1

Cisco Firepower Threat Defense Upgrade Guide for Firepower Device Manager, Version 7.1

7.0 or earlier

Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager for your version: System Management

For the Firepower 4100/9300, also see the FXOS upgrade instructions in Cisco Firepower 4100/9300 Upgrade Guide, FTD 6.0.1–7.0.x or ASA 9.4(1)–9.16(x) with FXOS 1.1.1–2.10.1.

Version 6.4+, with Security Cloud Control

Cisco Security Cloud Control: FDM-Managed Firewall Threat Defense
Table 4. Upgrade Guides for NGIPS

Platform

Current Manager Version

Guide

Firepower 7000/8000 series with Firewall Management Center

6.0.0–7.0.x

Cisco Firepower Management Center Upgrade Guide, Version 6.0–7.0

NGIPSv with Firewall Management Center

6.0.0–7.1.x

7.2.0–7.2.5

7.3.x

7.4.0

Cisco Firepower Management Center Upgrade Guide, Version 6.0–7.0

7.2.6–7.2.x

7.4.1–7.4.x

Cisco Secure Firewall Threat Defense Upgrade Guide for Management Center for your version

ASA FirePOWER with Firewall Management Center

6.0.0–7.1.x

7.2.0–7.2.5

7.3.x

7.4.0

Cisco Firepower Management Center Upgrade Guide, Version 6.0–7.0

7.2.6–7.2.x

7.4.1–7.4.x

Cisco Secure Firewall Threat Defense Upgrade Guide for Management Center for your version

ASA FirePOWER with ASDM

Any

Cisco Secure Firewall ASA Upgrade Guide
Table 5. Upgrade Other Components

Version

Component

Guide

Any

ASA logical devices on the Firepower 4100/9300

Cisco Secure Firewall ASA Upgrade Guide

Latest

BIOS and firmware for Firewall Management Center

Secure Firewall Threat Defense/Firepower hotfix release notes

Latest

Firmware for the Firepower 4100/9300

Cisco Firepower 4100/9300 FXOS Firmware Upgrade Guide

Latest

ROMMON image for the ISA 3000

Cisco Secure Firewall ASA and Secure Firewall Threat Defense Reimage Guide

Planning Your Upgrade

Careful planning and preparation can help you avoid missteps. This table summarizes the upgrade planning process. For detailed checklists and procedures, see the upgrade chapters.

Table 6. Upgrade Planning Phases

Planning Phase

Includes

Planning and Feasibility

Assess your deployment.

Plan your upgrade path.

Read all upgrade guidelines and plan configuration changes.

Check appliance access.

Check bandwidth.

Schedule maintenance windows.

Backups

Back up configurations and events.

Back up FXOS on the Firepower 4100/9300.

Upgrade Packages

Download upgrade packages from Cisco.

Upload upgrade packages to the system.

Associated Upgrades

Upgrade virtual hosting in virtual deployments.

Upgrade firmware on the Firepower 4100/9300.

Upgrade FXOS on the Firepower 4100/9300.

Final Checks

Check configurations.

Check NTP synchronization.

Deploy configurations.

Run readiness checks.

Check disk space.

Check running tasks.

Check deployment health and communications.

Upgrade Feature History

Table 7. Device Upgrade Feature History

Feature

Minimum Management Center

Minimum Threat Defense

Details

Copy upgrade packages ("peer-to-peer sync") from device to device.

7.2.0

7.2.0

Instead of copying upgrade packages to each device from the Firewall Management Center or internal web server, you can use the Firewall Threat Defense CLI to copy upgrade packages between devices ("peer to peer sync"). This secure and reliable resource-sharing goes over the management network but does not rely on the Firewall Management Center. Each device can accommodate 5 package concurrent transfers.

This feature is supported for Version 7.2.x–7.4.x standalone devices managed by the same Version 7.2.x–7.4.x standalone Firewall Management Center. It is not supported for:

  • Container instances.

  • Device high availability pairs and clusters. These devices get the package from each other as part of their normal sync process. Copying the upgrade package to one group member automatically syncs it to all group members.

  • Devices managed by high availability Firewall Management Centers.

  • Devices in different domains, or devices separated by a NAT gateway.

  • Devices upgrading from Version 7.1 or earlier, regardless of Firewall Management Center version.

  • Devices running Version 7.6+.

New/modified CLI commands: configure p2psync enable , configure p2psync disable , show peers , show peer details , sync-from-peer , show p2p-sync-status

Auto-upgrade to Snort 3 after successful Firewall Threat Defense upgrade.

7.2.0

7.0.0

When you use a Version 7.2+ Firewall Management Center to upgrade Firewall Threat Defense to Version 7.2+, you can now choose whether to Upgrade Snort 2 to Snort 3.

After the software upgrade, eligible devices upgrade from Snort 2 to Snort 3 when you deploy configurations. For devices that are ineligible because they use custom intrusion or network analysis policies, we strongly recommend you manually upgrade to Snort 3 for improved detection and performance. For help, see the Custom Snort 3 Intrusion Policies for Access Control for your version.

Version restrictions: Not supported for Firewall Threat Defense upgrades to Version 7.0.x or 7.1.x.

Upgrade for single-node clusters.

7.2.0

Any

You can now use the device upgrade page (Devices > Device Upgrade) to upgrade clusters with only one active node. Any deactivated nodes are also upgraded. Previously, this type of upgrade would fail. This feature is not supported from the system updates page (System > Updates).

Hitless upgrades are also not supported in this case. Interruptions to traffic flow and inspection depend on the interface configurations of the lone active unit, just as with standalone devices.

Supported platforms: Firepower 4100/9300, Secure Firewall 3100

Revert a successful device upgrade.

7.1.0

7.1.0

You can now revert major and maintenance upgrades to FTD. Reverting returns the software to its state just before the last upgrade, also called a snapshot. If you revert an upgrade after installing a patch, you revert the patch as well as the major and/or maintenance upgrade.

Important

 

If you think you might need to revert, you must use System > Updates to upgrade FTD. The System Updates page is the only place you can enable the Enable revert after successful upgrade option, which configures the system to save a revert snapshot when you initiate the upgrade. This is in contrast to our usual recommendation to use the wizard on the Devices > Device Upgrade page.

This feature is not supported for container instances.

Minimum FTD: 7.1

Improvements to the upgrade workflow for clustered and high availability devices.

7.1.0

Any

We made the following improvements to the upgrade workflow for clustered and high availability devices:

  • The upgrade wizard now correctly displays clustered and high availability units as groups, rather than as individual devices. The system can identify, report, and preemptively require fixes for group-related issues you might have. For example, you cannot upgrade a cluster on the Firepower 4100/9300 if you have made unsynced changes on Firepower Chassis Manager.

  • We improved the speed and efficiency of copying upgrade packages to clusters and high availability pairs. Previously, the FMC copied the package to each group member sequentially. Now, group members can get the package from each other as part of their normal sync process.

  • You can now specify the upgrade order of data units in a cluster. The control unit always upgrades last.

Improved FTD upgrade performance and status reporting.

7.0.0

7.0.0

FTD upgrades are now easier faster, more reliable, and take up less disk space. A new Upgrades tab in the Message Center provides further enhancements to upgrade status and error reporting.

Easy-to-follow upgrade workflow for FTD devices.

7.0.0

Any

A new device upgrade page (Devices > Device Upgrade) on the FMC provides an easy-to-follow wizard for upgrading Version 6.4+ FTD devices. It walks you through important pre-upgrade stages, including selecting devices to upgrade, copying the upgrade package to the devices, and compatibility and readiness checks.

To begin, use the new Upgrade Firepower Software action on the Device Management page Devices > Device Management > Selection.

As you proceed, the system displays basic information about your selected devices, as well as the current upgrade-related status. This includes any reasons why you cannot upgrade. If a device does not "pass" a stage in the wizard, it does not appear in the next stage.

If you navigate away from wizard, your progress is preserved, although other users with Administrator access can reset, modify, or continue the wizard.

Note

 

You must still use System > Updates to upload or specify the location of FTD upgrade packages. You must also use the System Updates page to upgrade the FMC itself, as well as all non-FTD managed devices.

Note

 

In Version 7.0, the wizard does not correctly display devices in clusters or high availability pairs. Even though you must select and upgrade these devices as a unit, the wizard displays them as standalone devices. Device status and upgrade readiness are evaluated and reported on an individual basis. This means it is possible for one unit to appear to "pass" to the next stage while the other unit or units do not. However, these devices are still grouped. Running a readiness check on one, runs it on all. Starting the upgrade on one, starts it on all.

To avoid possible time-consuming upgrade failures, manually ensure all group members are ready to move on to the next step of the wizard before you click Next.

Upgrade more FTD devices at once.

7.0.0

Any (source)

6.7.0 (target)

The number of devices you can upgrade at once is now limited by your management network bandwidth—not the system's ability to manage simultaneous upgrades. Previously, we recommended against upgrading more than five devices at a time.

Important

 

Only upgrades to FTD Version 6.7+ using the FTD upgrade wizard see this improvement. If you are upgrading devices to an older FTD release—even if you are using the new upgrade wizard—we still recommend you limit to five devices at a time.

Upgrade different device models together.

7.0.0

Any

You can now use the FTD upgrade wizard to queue and invoke upgrades for all FTD models at the same time, as long as the system has access to the appropriate upgrade packages.

Previously, you would choose an upgrade package, then choose the devices to upgrade using that package. That meant that you could upgrade multiple devices at the same time only if they shared an upgrade package. For example, you could upgrade two Firepower 2100 series devices at the same time, but not a Firepower 2100 series and a Firepower 1000 series.

Upgrades remove PCAP files to save disk space.

6.7.0

6.7.0

Upgrades now remove locally stored PCAP files. To upgrade, you must have enough free disk space or the upgrade fails.

Improved FTD upgrade status reporting and cancel/retry options.

6.7.0

6.7.0

You can now view the status of FTD device upgrades and readiness checks in progress on the Device Management page, as well as a 7-day history of upgrade success/failures. The Message Center also provides enhanced status and error messages.

A new Upgrade Status pop-up, accessible from both Device Management and the Message Center with a single click, shows detailed upgrade information, including percentage/time remaining, specific upgrade stage, success/failure data, upgrade logs, and so on.

Also on this pop-up, you can manually cancel failed or in-progress upgrades (Cancel Upgrade), or retry failed upgrades (Retry Upgrade). Canceling an upgrade reverts the device to its pre-upgrade state.

Note

 

To be able to manually cancel or retry a failed upgrade, you must disable the new auto-cancel option, which appears when you use the FMC to upgrade an FTD device: Automatically cancel on upgrade failure and roll back to the previous version. With the option enabled, the device automatically reverts to its pre-upgrade state upon upgrade failure.

Auto-cancel is not supported for patches. In an HA or clustered deployment, auto-cancel applies to each device individually. That is, if the upgrade fails on one device, only that device is reverted.

New/modified screens:

  • System > Updates > Product Updates > Available Updates > Install icon for the FTD upgrade package

  • Devices > Device Management > Upgrade

  • Message Center > Tasks

New/modified CLI commands: show upgrade status detail , show upgrade status continuous , show upgrade status , upgrade cancel , upgrade retry

Get FTD upgrade packages from an internal web server.

6.6.0

6.6.0

FTD devices can now get upgrade packages from your own internal web server, rather than from the FMC. This is especially useful if you have limited bandwidth between the FMC and its devices. It also saves space on the FMC.

Note

 

This feature is supported only for FTD devices running Version 6.6+. It is not supported for upgrades to Version 6.6, nor is it supported for the FMC or Classic devices.

New/modified screens: We added a Specify software update source option to the page where you upload upgrade packages.

Copy upgrade packages to managed devices before the upgrade.

6.2.3

Any

You can now copy (or push) an upgrade package from the FMC to a managed device before you run the actual upgrade. This is useful because you can push during times of low bandwidth use, outside of the upgrade maintenance window.

When you push to high availability, clustered, or stacked devices, the system sends the upgrade package to the active/control/primary first. Then, it sends the package to the standby/data/secondary.

New/modified screens: System > Updates
Table 8. Firewall Management Center Upgrade Feature History

Feature

Minimum Management Center

Minimum Threat Defense

Details

Firewall Management Center upgrade does not automatically generate troubleshooting files.

7.2.0

Any

To save time and disk space, the Firewall Management Center upgrade process no longer automatically generates troubleshooting files before the upgrade begins. Note that device upgrades are unaffected and continue to generate troubleshooting files.

To manually generate troubleshooting files for the Firewall Management Center, choose System(system gear icon) > Health > Monitor, click Firewall Management Center in the left panel, then View System & Troubleshoot Details, then Generate Troubleshooting Files.

Upgrades postpone scheduled tasks.

6.4.0

Any

The Firewall Management Center upgrade process now postpones scheduled tasks. Any task scheduled to begin during the upgrade will begin five minutes after the post-upgrade reboot.

Note

 

Before you begin any upgrade, you must still make sure running tasks are complete. Tasks running when the upgrade begins are stopped, become failed tasks, and cannot be resumed.

Note that this feature is supported for all upgrades from a supported version. This includes Version 6.4.0.10 and later patches, Version 6.6.3 and later maintenance releases, and Version 6.7.0+. This feature is not supported for upgrades to a supported version from an unsupported version.

For Assistance

Upgrade Guides

In Firewall Management Center deployments, the Firewall Management Center must run the same or newer maintenance (third-digit) release as its managed devices. Upgrade the Firewall Management Center first, then devices. Use the upgrade guide for the version you are currently running—not your target version.

Table 9. Upgrade Guides

Platform

Upgrade Guide

Link

Firewall Management Center

Firewall Management Center version you are currently running.

https://cisco.com/go/fmc-upgrade

Firewall Threat Defense with Firewall Management Center

Firewall Management Center version you are currently running.

https://cisco.com/go/ftd-fmc-upgrade

Firewall Threat Defense with device manager

Firewall Threat Defense version you are currently running.

https://cisco.com/go/ftd-fdm-upgrade

Firewall Threat Defense with Cloud-Delivered Firewall Management Center

Cloud-Delivered Firewall Management Center.

https://cisco.com/go/ftd-cdfmc-upgrade

Install Guides

If you cannot or do not want to upgrade, you can freshly install major and maintenance releases. This is also called reimaging. You cannot reimage to a patch. Install the appropriate major or maintenance release, then apply the patch. If you are reimaging to an earlier Firewall Threat Defense version on an FXOS device, perform a full reimage—even for devices where the operating system and software are bundled.

Table 10. Install Guides

Platform

Install Guide

Link

Firewall Management Center hardware

Getting started guide for your Firewall Management Center hardware model.

https://cisco.com/go/fmc-install

Firewall Management Center Virtual

Getting started guide for the Firewall Management Center Virtual.

https://cisco.com/go/fmcv-quick

Firewall Threat Defense hardware

Getting started or reimage guide for your device model.

https://cisco.com/go/ftd-quick

Firewall Threat Defense Virtual

Getting started guide for your Firewall Threat Defense Virtual version.

https://cisco.com/go/ftdv-quick

FXOS for the Firepower 4100/9300

Configuration guide for your FXOS version, in the Image Management chapter.

https://cisco.com/go/firepower9300-config

FXOS for the Firepower 1000/2100 and Secure Firewall 3100

Troubleshooting guide, in the Reimage Procedures chapter.

Cisco FXOS Troubleshooting Guide for the Firewall Threat Defense

More Online Resources

Cisco provides the following online resources to download documentation, software, and tools; to query bugs; and to open service requests. Use these resources to install and configure Cisco software and to troubleshoot and resolve technical issues.

Access to most tools on the Cisco Support & Download site requires a Cisco.com user ID and password.

Contact Cisco

If you cannot resolve an issue using the online resources listed above, contact Cisco TAC: