Planning Your Upgrade

Use this guide to plan and complete Firewall Threat Defense and Firewall Management Center upgrades. Upgrades can be major (A.x), maintenance (A.x.y), or patch (A.x.y.z) releases. We also may provide hotfixes, which are minor updates that address particular, urgent issues.

Is This Guide for You?

The procedures in this guide are for:

  • Upgrading a Firewall Management Center that is currently running Version 7.2.6–7.2.x.

  • Upgrading an older Firewall Threat Defense device using a Version 7.2.6–7.2.x Firewall Management Center.

This means that after you use this guide to upgrade the Firewall Management Center, you will use a different guide to upgrade Firewall Threat Defense.

Upgrade Guidelines

In addition to the guidelines and resource links in the following topics, see Reference for general information on time and disk space requirements, and for details on system behavior during upgrade, which can include interruptions to traffic flow and inspection.

Software Upgrade Guidelines

For release-specific upgrade warnings and guidelines for Firewall Management Center and Firewall Threat Defense, and for information on features and bugs with upgrade impact, check all release notes between your current and target version: http://www.cisco.com/go/ftd-notes.

Upgrade Guidelines for the Firepower 4100/9300 Chassis

In most cases, we recommend you use the latest build for your FXOS major version.

For release-specific FXOS upgrade warnings and guidelines, as well as features and bugs with upgrade impact, check all release notes between your current and target version: http://www.cisco.com/go/firepower9300-rns.

For firmware upgrade guidelines (for upgrades to FXOS 2.13 and earlier), see the firmware upgrade guide: Cisco Firepower 4100/9300 FXOS Firmware Upgrade Guide.

Upgrade Guidelines for Firewall Threat Defense Virtual

Upgrade does not change the serial number or UUID of Firewall Threat Defense Virtual instances.

Update base image and template image ID before cluster upgrade

Before you upgrade a cluster in the public cloud, copy the target version image to your cloud image repository and update the image ID in the cluster deployment template (we actually recommend replacing the existing template with a modified copy). This ensures that after the upgrade, new instances — for example, instances launched during cluster scaling — will use the correct version. If the marketplace does not have the image you need, such as when the cluster has been patched, create a custom image from a snapshot of a standalone Firewall Threat Defense Virtual instance running the correct version, with no instance-specific (day 0) configurations.

Suspend health checks before autoscaled cluster upgrade

For Firewall Threat Defense Virtual for AWS, suspend the HealthCheck and ReplaceUnhealthy processes before autoscaled cluster upgrade. This ensures that instances are not terminated by the Auto Scaling group during the post-upgrade reboot. You can resume the suspended processes afterwards. For instructions, see the Amazon EC2 Auto Scaling user guide: Suspend and resume Amazon EC2 Auto Scaling processes.

Upgrade Path

Planning your upgrade path and order is especially important for large deployments, high availability/clustering, multi-hop upgrades, and situations where you need to coordinate chassis, hosting environment, or other upgrades.

Choosing your upgrade target

Go directly to the latest Version 7.2 release possible to minimize upgrade and other impact. This is because features, enhancements, and critical fixes can skip "future" releases that are ahead by version, but not by release date. For example, if you are up-to-date within major Version A, upgrading to dot-zero Version B can deprecate features and fixes.

If you cannot go to the latest release, at least make sure your current version was released on a date before your target version; see the Release Notes for Secure Firewall Threat Defense for your target version.

Upgrading a patched deployment

Critical fixes in patches/vulnerability (fourth-digit) releases can also skip future releases. If you depend on these critical fixes, verify that your target version contains them. For a full list of release dates, see Cisco Secure Firewall Management Center New Features by Release.

Supported upgrades and downgrades

This section summarizes upgrade and downgrade capability.

Supported upgrades

This table shows the supported direct upgrades for Firewall Management Center and Firewall Threat Defense software.


Note

Patches can change the fourth digit only. You cannot upgrade directly to a patch from a previous major or maintenance release. Although a patched device can be managed with an unpatched Firewall Management Center, fully patched deployments undergo enhanced testing.
Table 1. Supported direct upgrades

Current version

Target software version

to 10.x

7.7

7.6

7.4

7.3

7.2

7.1

7.0

from 10.x

YES

—

—

—

—

—

—

—

from 7.7

YES

YES

—

—

—

—

—

—

from 7.6

YES

YES

YES

—

—

—

—

—

from 7.4

YES

YES

YES

YES

—

—

—

—

from 7.3

YES

YES

YES

YES

YES

—

—

—

from 7.2

—

YES

YES

YES

YES

YES

—

—

from 7.1

—

—

YES

YES

YES

YES

YES

—

from 7.0

—

—

—

YES

YES

YES

YES

YES

from 6.4

—

—

—

—

—

—

—

YES

Supported FXOS versions for Firepower 4100/9300 upgrades

For the Firepower 4100/9300, this table lists companion FXOS versions. If a chassis upgrade is required, Firewall Threat Defense upgrade is blocked. In most cases we recommend the latest build in each version; for minimum builds see the Cisco Secure Firewall Threat Defense Compatibility Guide.

Table 2. Supported FXOS versions for Firepower 4100/9300 upgrades

Target Firewall Threat Defense version

Minimum FXOS version

10.x

2.18.0

7.7

2.17.0

7.6

2.16.0

7.4.1–7.4.x

2.14.1

7.4.0

—

7.3

2.13.0

7.2

2.12.0

7.1

2.11.1

7.0

2.10.1

6.7

2.9.1

6.6

2.8.1

6.4

2.6.1

Supported downgrades

If an upgrade succeeds but the system does not function to your expectations, you may be able to return to a previous version; see Revert or Uninstall.

Upgrade Order

Firewall Management Center Before Devices

The Firewall Management Center should run the same or newer version as its devices. This is because features and resolved issues often require the latest version on both the Firewall Management Center and its devices, including patches.

Upgrade the Firewall Management Center first—you will still be able to manage older devices, usually a few major versions back. If you begin with devices running a much older version than the Firewall Management Center, further Firewall Management Center upgrades can be blocked. In this case perform a three (or more) step upgrade: devices first, then the Firewall Management Center, then devices again.


Note

You cannot upgrade a device past the Firewall Management Center to a newer major or maintenance version. Although a patched device (fourth-digit) can be managed with an unpatched Firewall Management Center, fully patched deployments undergo enhanced testing.

Chassis Before Firewall Threat Defense

For the Firepower 4100/9300, major versions require a FXOS upgrade. You should also check for firmware upgrades.

Because you upgrade the chassis first, you will briefly run a supported—but not recommended—combination, where the operating system is "ahead" of Firewall Threat Defense. If the chassis is already well ahead of its devices, further chassis upgrades can be blocked. In this case perform a three (or more) step upgrade: devices first, then the chassis, then devices again. Or, perform a full reimage. In high availability or clustered deployments, upgrade one chassis at a time.

Chassis with High Availability/Clustered Firewall Threat Defense

When a chassis upgrade is required in high availability or clustered deployments, upgrade one chassis at a time. For high availability, although it is best practice to always upgrade the standby, a chassis could have both standby and active instances (belonging to different high availabilty pairs). In that case, any active units on the upgrading chassis automatically fail over. For clustering, the same applies: it is always best to upgrade an all-data unit chassis.

Before upgrade, high availability pairs and clusters should be in sync, not split brain, and so on. Firewall Threat Defense upgrades will not proceed for most issues of this type, but the chassis is not aware of the status of its instances. This means that even if you upgrade the chassis one at a time, you can still experience disruption if you do not make sure your deployment is healthy before each chassis upgrade.

Table 3. Chassis Upgrade Order for the Firepower 4100/9300

Firewall Threat Defense Deployment

Upgrade Order

Standalone

  1. Upgrade chassis.

  2. Upgrade Firewall Threat Defense.

High availability

Upgrade both chassis before you upgrade Firewall Threat Defense. To minimize disruption, always upgrade the standby.

  1. Upgrade chassis with the standby.

  2. Switch roles.

  3. Upgrade chassis with the new standby.

  4. Upgrade Firewall Threat Defense.

Intra-chassis cluster (units on the same chassis)

  1. Upgrade chassis.

  2. Upgrade Firewall Threat Defense.

Inter-chassis cluster (units on different chassis)

Upgrade all chassis before you upgrade Firewall Threat Defense. To minimize disruption, always upgrade an all-data unit chassis.

  1. Upgrade the all-data unit chassis.

  2. Switch the control module to the chassis you just upgraded.

  3. Upgrade all remaining chassis.

  4. Upgrade Firewall Threat Defense.

Upgrade Packages

Managing upgrade packages with the Firewall Management Center

If the Firewall Management Center can reach the internet, System (system gear icon) > Product Upgrades lists all upgrades that apply to you, with suggested releases specially marked. You can easily choose and direct-download packages from the internet to the Firewall Management Center, or upload packages you manually downloaded. For details, see the following table. For answers to common issues, see Troubleshooting upgrade packages.

Table 4. Managing upgrade packages with the Firewall Management Center

To...

Do This...

Refresh the list of available upgrades.

Click Refresh (refresh icon) at the bottom left of the page.

Download an upgrade package to the Firewall Management Center from the internet.

Click Download next to the upgrade package or version you want to download.

Each family of devices has its own upgrade packages, so depending on your deployment you may need to download more than one upgrade package.

Manually upload an upgrade package to the Firewall Management Center.

Click Add upgrade package at the bottom right of the page, then Choose file.

See: Manually Downloading Upgrade Packages

Configure devices to get upgrade packages from an internal server.

Click Add upgrade package at the bottom right of the page, then Specify remote location.

See: Copying Upgrade Packages to Devices from an Internal Server

Delete upgrade packages from the Firewall Management Center.

Click the Ellipsis (…) next to the package or package version you want to delete and select Delete.

This deletes the packages (or the pointer to the package) from the Firewall Management Center. It does not delete packages from any devices where you already copied them. For Firewall Management Center in high availability, it does not delete the package from the peer.

In most cases, upgrading removes the related package from the upgraded appliance.

Copying Upgrade Packages to Devices

To upgrade, the upgrade package must be on the device.

Copying Firewall Threat Defense Upgrade Packages

After you select devices to upgrade, the upgrade wizard prompts you to copy upgrade packages. Devices try the following sources.

Internal server.

When configured, this takes priority. Recommended when it is not possible or practical to get the upgrade package from the Firewall Management Center, for example, if there is not enough disk space on the Firewall Management Center, or there is poor bandwidth between devices and the Firewall Management Center.

See: Copying Upgrade Packages to Devices from an Internal Server

Firewall Management Center.

Recommended when there is enough disk space on the Firewall Management Center, and there is good bandwidth between the Firewall Management Center and devices.

The Firewall Management Center can get most device upgrade packages directly from the internet. If the Firewall Management Center cannot reach the internet, or you are applying a hotfix, manually upload upgrade packages.

See: Managing upgrade packages with the Firewall Management Center


Note

Version 7.2.0–7.4.x standalone devices managed by the same standalone Firewall Management Center can copy devices to each other without relying on the Firewall Management Center to mediate the transfer; see Copy Firewall Threat Defense Upgrade Packages between Devices.

Copying Chassis Upgrade Packages

For the Secure Firewall 3100 in multi-instance mode, use the Firewall Threat Defense methods above. Note that these chassis upgrade packages are stored outside any application instances. This allows you to upgrade the chassis while also making the Firewall Threat Defense upgrade accessible to all instances. However, this means that you must manually remove unneeded chassis upgrade packages (instead of the upgrade process automatically removing them).

For Firepower 4100/9300 chassis upgrade packages, manually download the upgrade package from the Cisco Support & Download site, then use the Firewall Chassis Manager or CLI (FTP, SCP, SFTP, or TFTP) to copy the package to the device. See Manually Downloading Upgrade Packages and the upgrade procedure for your deployment.

Copying Upgrade Packages to Devices from an Internal Server

Managed devices must get upgrade packages from either the Firewall Management Center or an internal server. An internal server is especially useful if you have limited bandwidth between the Firewall Management Center and its devices. It also saves space on the Firewall Management Center.

After you get upgrade packages (Manually Downloading Upgrade Packages) and set up your server, configure pointers. On the Firewall Management Center, start like you are uploading a package: on the Product Upgrades page (System (system gear icon) > Product Upgrades), click Add upgrade package. But instead of choosing a file on your computer, click Specify remote location and provide the appropriate details. When it is time to get the package, the device will copy it from the internal server.

Table 5. Options for Copying Firewall Threat Defense Upgrade Packages from an Internal Server

Field

Description

URL

The source URL, including protocol (HTTP/HTTPS) and full path to the upgrade package; for example:

https://internal_web_server/upgrade_package.sh.REL.tar.

CA certificates

For secure web servers (HTTPS), the server's digital certificate (PEM format).

Copy and paste the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines. You should be able to obtain the certificate from the server's administrator. You may also be able to use your browser, or a tool like OpenSSL, to view the server's certificate details and export or copy the certificate.

Copy Firewall Threat Defense Upgrade Packages between Devices

Instead of copying upgrade packages to each device from the Firewall Management Center or internal web server, you can use the Firewall Threat Defense CLI to copy upgrade packages between devices ("peer to peer sync"). This secure and reliable resource-sharing goes over the management network but does not rely on the Firewall Management Center. Each device can accommodate 5 package concurrent transfers.

This feature is supported for Version 7.2.x–7.4.x standalone devices managed by the same Version 7.2.x–7.4.x standalone Firewall Management Center. It is not supported for:

  • Container instances.

  • Device high availability pairs and clusters. These devices get the package from each other as part of their normal sync process. Copying the upgrade package to one group member automatically syncs it to all group members.

  • Devices managed by high availability Firewall Management Centers.

  • Devices managed by the , but added to an on-prem Firewall Management Center in analytics mode.

  • Devices in different domains, or devices separated by a NAT gateway.

  • Devices upgrading from Version 7.0.x.

  • Devices upgrading from Version 7.1 or earlier, regardless of Firewall Management Center version.

  • Devices running Version 7.6+.

Repeat the following procedure for all devices that need the upgrade package.

Before you begin

  • Upload the Firewall Threat Defense upgrade package to the Firewall Management Center or to an internal server.

  • Copy the upgrade package to at least one device.

Procedure

Step 1

As admin, SSH to any device that needs the package.

Step 2

Enable the feature.

configure p2psync enable

Step 3

If you do not already know, determine where you can get the upgrade package you need.

show peers : Lists the other eligible devices that also have this feature enabled.

show peer details ip_address: For the device at the IP address you specify, list the available upgrade packages and their paths.

Step 4

Copy the package from any device that has the package you need, by specifying the IP address and path you just discovered.

sync-from-peer ip_address package_path

After you confirm that you want to copy the package, the system displays a sync status UUID that you can use to monitor this transfer.

Step 5

Monitor transfer status from the CLI.

show p2p-sync-status : Shows the sync status for the last five transfers to this device, including completed and failed transfers.

show p2p-sync-status sync_status_UUID: Shows the sync status for a particular transfer to this device.

Manually Downloading Upgrade Packages

Manually download upgrade packages when the system cannot reach the internet, or when you cannot or do not want to direct-download for another reason; for example, for hotfixes, Firepower 4100/9300 chassis upgrades, or if you use an internal server.

Packages are available on the Cisco Support & Download site:

Software Packages

You use the same upgrade package for all models in a family or series. To find the correct one, select or search for your model, then browse to the software download page for the appropriate version. Available upgrade packages are listed along with installation packages, hotfixes, and other applicable downloads. Upgrade package file names reflect the platform, software version, and build. Upgrade packages are signed, and terminate in .sh.REL.tar. Do not untar or rename them.

Note that a newer Firewall Management Center can manage older devices (and apply maintenance releases and patches to them). For older devices not listed here, see the Firewall Management Center upgrade guide corresponding to the last supported device version.

Table 6. Upgrade Packages

Platform

Package

Firewall Management Center Packages

Firewall Management Center hardware

Firewall Management Center Virtual

Cisco_Secure_FW_Mgmt_Center_Upgrade-Version-build.sh.REL.tar

Firewall Threat Defense Packages

Firepower 1000

Cisco_FTD_SSP-FP1K_Upgrade-Version-build.sh.REL.tar

Firepower 2100

Cisco_FTD_SSP-FP2K_Upgrade-Version-build.sh.REL.tar

Firepower 4100/9300

Cisco_FTD_SSP_Upgrade-Version-build.sh.REL.tar

Secure Firewall 1200

Cisco_Secure_FW_TD_1200-Version-build.sh.REL.tar

Secure Firewall 3100

Cisco_FTD_SSP-FP3K_Upgrade-Version-build.sh.REL.tar

Secure Firewall 4200

Cisco_Secure_FW_TD_4200-Version-build.sh.REL.tar

ISA 3000 with FTD

Cisco_FTD_Upgrade-Version-build.sh.REL.tar

Firewall Threat Defense Virtual

Cisco_FTD_Upgrade-Version-build.sh.REL.tar

Chassis Packages for the Firepower 4100/9300

To find the correct FXOS package, select or search for your device model and browse to the Firepower Extensible Operating System download page for your target FXOS version and build. The FXOS package is listed along with recovery and MIB packages.

Table 7. FXOS Packages

Platform

Package

Firepower 4100/9300

fxos-k9.fxos_version.SPA

Firmware is included in FXOS upgrades to 2.14.1+ (companion to threat defense 7.4.1). If you are upgrading older devices, select or search for your device model and browse to the Firepower Extensible Operating System download page. Firmware packages are under All Releases > Firmware.

Table 8. Firmware Packages

Platform

Package

Firepower 4100

fxos-k9-fpr4k-firmware.firmware_version.SPA

Firepower 9300

fxos-k9-fpr9k-firmware.firmware_version.SPA

Internet Access Requirements

By default, the system is configured to connect to the internet on ports 443/tcp (HTTPS) and 80/tcp (HTTP). If you do not want your appliances to have direct access to the internet, you can configure a proxy server.

Upgrade package download location depends on the Firewall Management Center's current version. Note that download capability can further depend on release type (major, maintenance, patch, hotfix) and package type (Firewall Management Center, device).

Firewall Threat Defense Download Location

With a Version 7.6.1+ Firewall Management Center, managed devices can get their own upgrade packages from the internet.
Table 9. Where devices get software upgrades

Devices with this Management Center Version

Download From

7.6.1+

https://cdo-ftd-images.s3-us-west-2.amazonaws.com/

The Firewall Management Center must also have access to this resource.

7.6.0 and earlier

Managed devices must get upgrade packages from the Firewall Management Center or an internal server.

Firewall Management Center Download Location

The Firewall Management Center can get upgrade packages from the internet. This includes upgrade packages for devices they manage.

Table 10. Where the Firewall Management Center gets software upgrades

Management Center Version

Downloads From

7.4.1+

https://cdo-ftd-images.s3-us-west-2.amazonaws.com/

7.4.0

7.3.x

One of:

  • https://support.sourcefire.com/

    For on-demand or scheduled downloads of applicable new releases. Used when you click the Download Upgrades button on the top right of System (system gear icon) > Updates > Product Updates. This immediately downloads the latest VDB, latest maintenance release, and the latest critical patches for your deployment. Also used by the task scheduler.

  • http://cdo-ftd-images.s3-us-west-2.amazonaws.com/

    For on-demand downloads of specific Firewall Threat Defense upgrade packages. Used when you choose packages to download, then click the Download Major Upgrades button on the Download Updates sub-tab of System (system gear icon) > Updates > Product Updates.

7.2.6 to 7.2.x

https://cdo-ftd-images.s3-us-west-2.amazonaws.com/

7.2.5 and earlier

https://support.sourcefire.com/

High Availability and Clustering Considerations

If not all appliances in your deployment have internet access, use the following table to determine what to do.

Table 11. High Availability/Clustering Considerations for Downloading Software Upgrades

Package Type

Management Center Version

Considerations

Firewall Management Center upgrade

7.6.0+

Downloading the package on one HA Firewall Management Center attempts the download on both. If only one peer has internet access, you can sync the package during the upgrade process.

7.4.1 to 7.4.x

7.2.6 to 7.2.x

Packages do not sync. For each HA Firewall Management Center with internet access, you can direct-download any applicable package.

7.4.0

7.3.x

7.2.5 and earlier

Packages do not sync. For each HA Firewall Management Center with internet access, you can direct-download the latest maintenance release and critical patches. You must manually upload all other packages.

Firewall Threat Defense upgrade

Any

Firewall Threat Defense upgrade packages do not sync between HA Firewall Management Centers, nor between high availability and clustered devices. Each device or unit must get its own upgrade package from the internet (with Firewall Management Center 7.6.1+), the active Firewall Management Center, or an internal server.

Troubleshooting upgrade packages

Table 12. Troubleshooting upgrade packages

Issue

Solution

No available upgrades even after I refresh.

Direct-downloading upgrade packages to the Firewall Management Center requires internet access. You will also see a blank list if you are already running the latest version available for your deployment and you have no upgrade packages loaded/configured.

Suggested release is not marked.

The suggested release is listed only if you are eligible for it. It is not listed if you are already running the suggested release or higher, or if you cannot upgrade that far. Note that patches to suggested releases are not marked as suggested, although we do recommend you apply them.

I don't see the packages I want.

Only major, maintenance, and patch upgrades that apply to your deployment right now are listed and available for direct download. These are not listed unless manually uploaded:

  • Device upgrades (major and maintenance) to a particular version, unless the Firewall Management Center is running that version or higher, and you have a device that supports that version.

  • Device patches, unless you have at least one device at the appropriate maintenance release.

  • Firewall Management Center patches, unless you are running the appropriate maintenance release.

  • Hotfixes. You must manually upload these.

A package was deleted from the page when I upgraded the Firewall Management Center.

When the Firewall Management Center is upgraded, some locally saved upgrade packages may be deleted, including device upgrade packages for versions that can no longer be managed.

I see available, undownloaded packages that don't apply to my devices.

The system lists the downloadable upgrades that apply to all devices managed by this Firewall Management Center. In a multidomain deployment, this can include devices that you cannot access right now.

Copying upgrade packages from the Firewall Management Center to devices times out.

This often happens when there is limited bandwidth between the Firewall Management Center and its devices.

You can try one of:

  • Configure devices to get upgrade packages directly from an internal web server.

    To do this, delete the upgrade package from the Firewall Management Center (optional but saves disk space), then re-add the upgrade package except this time specify a pointer (URL) to its location instead. See Copying Upgrade Packages to Devices from an Internal Server.

  • Copy upgrade packages from another device.

    If you can get the upgrade package to at least one standalone device, you can then use the device CLI to copy upgrade packages ("peer to peer sync") to the other standalone devices managed by the same standalone Firewall Management Center. See Copy Firewall Threat Defense Upgrade Packages between Devices.

Upgrade Readiness

After you check compatibility, plan your upgrade path and order, and review upgrade guidelines, you need to assess upgrade readiness. The system does some of these checks for you, but you still need to perform additional checks (and actions) yourself, like deploying configuration changes and making backups.

Use the following sections to perform last minute-tasks and confirm upgrade readiness.

Network and Infrastructure Checks

Appliance Access

Devices can stop passing traffic during the upgrade or if the upgrade fails. Before you upgrade, make sure traffic from your location does not have to traverse the device itself to access the device's management interface. You should also able to access the Firewall Management Center's management interface without traversing the device.

Bandwidth

Make sure your management network has the bandwidth to perform large data transfers. Whenever possible, upload upgrade packages ahead of time. If you transfer an upgrade package to a device at the time of upgrade, insufficient bandwidth can extend upgrade time or even cause the upgrade to time out. See Guidelines for Downloading Data from the Firepower Management Center to Managed Devices (Troubleshooting TechNote).

Configuration and Deployment Checks

Configurations

Make any required pre-upgrade configuration changes, and prepare to make required post-upgrade configuration changes. Deploy configuration changes. You will need to deploy again after upgrade. Deploying typically restarts Snort, which can affect traffic flow and inspection; see Traffic Flow and Inspection when Deploying Configurations.

Deployment Health

Make sure your deployment is healthy and successfully communicating. If there are any issues reported by the health monitor or on the Device Management page, resolve them before continuing.

Some failed health tests can prevent you from upgrading or cause upgrade failure. With the exception of NTP issues that you can resolve yourself, contact Cisco TAC if your deployment is failing any of the following tests. Results are reported on the Health Status (Home) page of the health monitor: System (system gear icon) > Health > Monitor.

Table 13. Upgrade-Related Health Tests

Health Test

Description

Disk Status

Monitors disk and RAID controller health for hardware devices.

Disk Usage

Monitors disk usage. The upgrade calculates how much disk space it needs; not having enough will prevent upgrade. If this module is alerting before you begin upgrade, you probably do not have enough.

Firewall Threat Defense HA (Firewall Management Center and devices)

Cluster/HA Failure Status (devices)

High availability pairs and clusters should be in sync, not split brain, and so on. Firewall Threat Defense upgrades will not proceed for most issues of this type. However, for the Firepower 4100/9300 and Secure Firewall 3100 in multi-instance mode, the chassis is not aware of the status of its instances. This means that even if you upgrade the chassis one at a time, you can still experience disruption if you do not make sure your deployment is healthy before each chassis upgrade.

Time Server Status (Firewall Management Center)

Time Synchronization Status (devices)

Monitors NTP synchronization. Being out of sync can cause upgrade failure. The system only alerts when you are offset by more than 10 seconds, so we recommend you manually check for a smaller offset (click see more next to the test results).

Running Tasks and Scheduled Tasks

Make sure essential tasks are complete. Tasks running when the upgrade begins are stopped and cannot be resumed; they become failed tasks.

Upgrades from Version 6.6.3+ automatically postpone scheduled tasks. Any task scheduled to begin during the upgrade will begin five minutes after the post-upgrade reboot. If you do not want this to happen (or if you are upgrading from an earlier version), check for tasks that are scheduled to run during the upgrade and cancel or postpone them.

Backups

With the exception of hotfixes, upgrade deletes all backups stored on the system. We strongly recommend you back up to a secure remote location and verify transfer success, both before and after any upgrade:

  • Before upgrade: If an upgrade fails catastrophically, you may have to reimage and restore. Reimaging returns most settings to factory defaults, including the system password. If you have a recent backup, you can return to normal operations more quickly.

  • After upgrade: This creates a snapshot of your freshly upgraded deployment. Back up the Firewall Management Center after you upgrade its managed devices, so your new Firewall Management Center backup file 'knows' that its devices have been upgraded.

Table 14. Backups

Backup

Guide

Firewall Management Center

Cisco Secure Firewall Management Center Administration Guide: Backup/Restore

We recommend you back up configurations and events.

Firewall Threat Defense

Cisco Secure Firewall Management Center Administration Guide: Backup/Restore

Note that backup is not supported in all cases, for example, for Firewall Threat Defense Virtual in the public cloud. But if you can back up, you should.

Firepower 4100/9300 chassis

Cisco Firepower 4100/9300 FXOS Configuration Guide: Configuration Import/Export

ASA on a Firepower 9300 chassis

Cisco ASA Series General Operations Configuration Guide: Software and Configurations

For a Firepower 9300 chassis with Firewall Threat Defense and ASA logical devices, use ASDM or the ASA CLI to back up ASA configurations and other critical files, especially if there is an ASA configuration migration.

Software Upgrade Readiness Checks

Besides the checks you perform yourself, the system can also check its own upgrade readiness. The Firewall Threat Defense and Firewall Management Center upgrade wizards prompt you to run the checks at the appropriate time. For the Firewall Management Center, passing readiness checks is not optional. If you fail readiness checks, you cannot upgrade. For Firewall Threat Defense, you can disable this requirement although we recommend against it. Passing all checks greatly reduces the chance of upgrade failure. If the checks expose issues that you cannot resolve, do not begin the upgrade.

You can run readiness checks outside a maintenance window. The time required to run a readiness check varies depending on model and database size. Do not manually reboot or shut down during readiness checks. For high availability Firewall Management Centers, do not run readiness checks on both peers at the same time.