topic Re: Asa HA with Firepower services upgrade - run with different versions for 24 hour period in Network Security

Asa HA with Firepower services upgrade - run with different versions for 24 hour period

evan.chadwick1 — Fri, 21 Feb 2020 14:19:17 GMT

Hi Folks,

I wanted to upgrade ASA running firepower services.
I had the idea to only upgrade one ASA/FIrepower SErvices and monitor for 24 hours, then upgrade the second ASA/firepower services.

Is it possible to operate like this for a short period?

FMC will be upgraded from 6.0.1.2 to 6.1.3

Failover over from Primary ASA to Secondary ASA, and upgrade from 6.0.1.2 to 6.1.3

After upgrade fail back to Primary ASA now running 6.1.3. Monitor for 24 hours

ASA/Firepower Services Primary upgraded to 6.1.3

ASA/Firepower Serivces Secondary stay on 6.0.1.2 - for 24 hours incase rollback required.
After 24 hours

Upgrade ASA/Firepower Serivces Secondary to 6.1.3

Regards,

Re: Asa HA with Firepower services upgrade - run with different versions for 24 hour period

Philip D'Ath — Mon, 18 Sep 2017 22:47:45 GMT

I would upgrade both the the ASA first, and keep them at the same level.

Then seperately do the Firepower's, and you can run them at different levels for 24 hours.

Re: Asa HA with Firepower services upgrade - run with different versions for 24 hour period

evan.chadwick1 — Mon, 18 Sep 2017 22:50:48 GMT

i'm not planning to upgrade the ASA code, i'm only focusing on upgrading the Firepower module.

Re: Asa HA with Firepower services upgrade - run with different versions for 24 hour period

Philip D'Ath — Mon, 18 Sep 2017 22:55:22 GMT

Then yes, you can run them at different codes levels for 24 hours without an issue.

Re: Asa HA with Firepower services upgrade - run with different versions for 24 hour period

Philip D'Ath — Mon, 18 Sep 2017 22:56:03 GMT

ps. I would jump directly to the 6.2 train of Firepower.

Re: Asa HA with Firepower services upgrade - run with different versions for 24 hour period

evan.chadwick1 — Mon, 18 Sep 2017 22:57:43 GMT

Thanks.
Was thinking to issue the 'no monitor-interface service-module' as well in order to safeguard unwanted failover of the ASA's.

Re: Asa HA with Firepower services upgrade - run with different versions for 24 hour period

Philip D'Ath — Mon, 18 Sep 2017 23:00:09 GMT

Just remember if you do that and Firepower really does fail then the ASA may stop forwarding traffic ...

Re: Asa HA with Firepower services upgrade - run with different versions for 24 hour period

evan.chadwick1 — Mon, 18 Sep 2017 23:01:18 GMT

yeah.

I have SFR-FailOpen applied 🙂

Re: Asa HA with Firepower services upgrade - run with different versions for 24 hour period

evan.chadwick1 — Mon, 18 Sep 2017 23:12:55 GMT

I can't jump straight as i'm coming from 6.0.1.2

The fmc running 6.2.2 only supports 6.1 and up.

So i plan to get to 6.1.3, then keep going one more time to 6.2.x (most stable version)

Re: Asa HA with Firepower services upgrade - run with different versions for 24 hour period

Philip D'Ath — Mon, 18 Sep 2017 23:22:06 GMT

I would scratch the module upgrade procedure. I would upgrade the FMC, and then re-image the modules and re-deploy the policy.

Re-imaging always works. Upgrading - well it can be a bit hit and miss.