topic Re: Updating FP module 6.1.0.5 to 6.2.2.2, FMC in Network Security

Updating FP module 6.1.0.5 to 6.2.2.2, FMC

PX — Fri, 21 Feb 2020 15:29:23 GMT

Hi,

I just want to make sure i have the correct upgrade path in mind.

All are using ASA with NGIPS. Current FP build is 6.1.0.5

I have upgraded our FMC to 6.2.2.2-109

For the modules i would import the following updates into FMC to successfully upgrade them to 6.2.2-81

Cisco_Network_Sensor_Upgrade-6.2.0-362.sh

then

Cisco_Network_Sensor_Upgrade-6.2.2-81.sh (Is there a 6.2.2.2.sh file i can only see Cisco_Network_Sensor_Patch-6.2.2.2-109.sh.REL.tar .Extension is different or is this a change implemented from 6.2.2.2)

Correct? Further would i need to remove the 6.1 boot image and replace it with the 6.2 version.

Thank you

Re: Updating FP module 6.1.0.5 to 6.2.2.2, FMC

Marvin Rhoads — Thu, 08 Mar 2018 14:56:36 GMT

That's the correct path.

The release notes confirm:

https://www.cisco.com/c/en/us/td/docs/security/firepower/622/622x/relnotes/Firepower_Relase_Notes_622x/Firepower_Relase_Notes_622x_chapter_01011.html#concept_kc4_qvb_yz

Be sure to run the Readiness Check for each upgrade. That resolves most potential issues that would cause an upgrade to fail.

Generally once all your managed sensors are upgraded OK you can remove the old packages from your FMC repository. The boot image on the ASA itself is no longer needed once you have moved beyond the initial installation of a Firepower module.

Re: Updating FP module 6.1.0.5 to 6.2.2.2, FMC

PX — Thu, 08 Mar 2018 19:05:05 GMT

Hi Marvin,

Appreciate your response.

Regarding the boot image, are there any performance or stability related gains with wiping the existing 6.1 boot image, applying the 6.2 boot image and 6.2.2 sh file compared to leaving the existing 6.1 boot image then applying the network sensor upgrades 6.2.0 and 6.2.2?

I know the former would be a longer process and thus i have decided on the latter method although i liaise often with a credited Cisco firewall networking specialist who prefers this method than keeping the existing 6.1 boot image.

Thoughts?

Re: Updating FP module 6.1.0.5 to 6.2.2.2, FMC

Marvin Rhoads — Fri, 09 Mar 2018 02:40:05 GMT

The boot image is only ever used when initially installing the Firepower service module.

Once it has been installed the first time it is never needed again unless you want to wipe it out (i.e., uninstall the module altogether) and start from scratch.

In normal operations (including upgrades and any sort of restart) it doesn't matter whether you have the 6.1 boot image, 6.2 boot image or none at all.

Re: Updating FP module 6.1.0.5 to 6.2.2.2, FMC

PX — Mon, 12 Mar 2018 01:46:25 GMT

Thank you,

Curious is it possible to apply the .sh upgrade sensor file using cli while ssh'd onto the module?

We do use FMC to maintain and manage although this module is located in an area where there is high latency (330ms) and when i initialize the update from FMC it times out at exactly an hour. I have raised a TAC case in the past and it is a known issue.

I have read documentation to how you would install a new boot image and pkg file although not merely upgrading the sensor. Possible?

Re: Updating FP module 6.1.0.5 to 6.2.2.2, FMC

Marvin Rhoads — Mon, 12 Mar 2018 17:32:26 GMT

You can install an upgrade package manually from the cli. You'd have to copy the file manually in that case (use something like ftp or scp from the sensor cli) vs the normal method of installing from the FMC.

Here's a blog posting describing the process in detail:

https://ciscoskills.net/2017/07/12/update-firepower-devices-manually/