topic Re: ASA zero downtime upgrade in Network Security

ASA zero downtime upgrade

Edwin Summers — Fri, 21 Feb 2020 12:49:55 GMT

I have a pair of ASA-5585-X in an active-standby failover configuration. Currently they are running software version 8.4.3. I'm looking to upgrade to 9.1.1. From the release notes I understand that in order to perform a "zero downtime" upgrade I need to upgrade from the last minor release in a major release to the next major release. Based on this, my understanding is that the upgrade would require three steps: Version 8.4.5, 9.0.1, 9.1.1. Is this correct?

Is it possible to upgrade directly from 8.4.3 to 9.1.1, and if so, what are the operational considerations of this upgrade? My reading of the release notes didn't indicate any special procedures that would need to be followed other than performing the upgrade steps. I assume there may be a period of service interruption, but I did not see any special requirements for performing a direct upgrade.

Any information on the perils of a direct upgrade are appreciated. Operational experience (such as "it set my network on fire and killed three kittens") greatly appreciated. Save the kittens!

Thanks, -Ed

Re: ASA zero downtime upgrade

Marvin Rhoads — Wed, 06 Feb 2013 12:51:08 GMT

You can do the upgrade directly from 8.4(3) to 9.1(1). Yes the release notes recommend going via 8.4(5) and 9.0(1) but that's not really necessary.

Standard procedure applies. In a nutshell:

load the image on both units' disk0:
change the boot variable
save the config with that change
from the active unit, "failover reload-standby"
wait for successful reload and verify configuration is synced OK. You should expect a message that mate software version is different.
"no failover active" on active unit
log into newly active unit and "failover reload-standby"
wait for succeful reload and verify configuration is synced OK. Both units are now on 9.1(1).

Optionally change your primary unit back to active if that bothers you. I like to delete the old image once things are looking OK after a couple of days. You should also update your ASDM image (and the variable pointing to it) while you're in there.

No kittens are harmed in this process.

ASA zero downtime upgrade

Edwin Summers — Wed, 06 Feb 2013 12:51:09 GMT

Appreciate the response! And also glad to see someone else that pays attention to proper system hygiene (removing old image after stabilization).

Best regards,

ASA zero downtime upgrade

snimmaga — Wed, 01 May 2013 07:48:28 GMT

Good detail. A much simpler way to upgrade would be to use Cisco Security Manager which introduced "image upgrade" for ASA with its 4.3 release. Note that "no downtime upgrade" is supported for ASA failover pairs

Hello MarvinIs there any way

Mukesh Kumar — Sat, 14 Feb 2015 11:14:39 GMT

Hello Marvin

Is there any way to upgrade from 8.2 to 9.1.5 with zero downtime?

Regards,
Mukesh Kumar
Network Engineer
Spooster IT Services

As long as you have an HA

Marvin Rhoads — Sun, 15 Feb 2015 18:03:19 GMT

As long as you have an HA pair, yes.

You have to do in in at least two separate upgrades - first go to ASA 8.4(6) and then 9.1(5) as noted in the Release Notes.

hi marvin,

johnlloyd_13 — Fri, 17 Feb 2017 07:08:00 GMT

hi marvin,

i'm about to do an ASA HA pair zero downtime upgrade and your post is very insightful!

referring to the steps you gave (particular step #1), do you TFTP the image from active ASA to standby ASA using the command:

active# failover exec mate copy /noconfirm tftp://10.1.1.1/asa931-smp-k8.bin disk0:/asa931-smp-k8.bin

i was initially thinking to SSH to the internal IP of the standby ASA and issue the copy tftp command from there. is there any difference between the two approach? or you get same end result with any method?

refer to link:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa93/upgrade/upgrade93.html#73860

John,

Marvin Rhoads — Fri, 17 Feb 2017 08:29:50 GMT

John,

I prefer to copy the image from an external repository like my laptop.

I've never tried tftp FROM the active ASA as I don't think the ASA will act as a tftp (or http or ftp or scp) server. In fact I just tried one in the lab it it does not.

So - yes - ssh directly to the standby ASA and initiate a copy (I prefer ftp) from there. The source of the image should be a tftp (or ftp etc.) server.

marvin +5

johnlloyd_13 — Fri, 17 Feb 2017 08:29:51 GMT

marvin +5

In fact I just tried one in the lab it it does not

what do you mean by this? did you try the said command and it did NOT work?

active# failover exec mate copy /noconfirm tftp://10.1.1.1/asa931-smp-k8.bin disk0:/asa931-smp-k8.bin

John,

Marvin Rhoads — Fri, 17 Feb 2017 09:20:53 GMT

John,

I tried to copy a file to a switch from an ASA using tftp.

I picked a small file I knew to be there (my profile.xml in this case).

The ASA did not respond to the tftp request initiated from the switch.

hi marvin,

johnlloyd_13 — Mon, 20 Feb 2017 04:00:12 GMT

hi marvin,

The ASA did not respond to the tftp request initiated from the switch.

did you TFTP the image from the active ASA (not a switch or PC) to the standby ASA using the command failover exec command?

ACTIVE-ASA-FW# failover exec mate copy /noconfirm tftp://10.1.1.1/asa931-smp-k8.bin disk0:/asa931-smp-k8.bin

No. I don't believe that's a

Marvin Rhoads — Mon, 20 Feb 2017 04:12:53 GMT

No. I don't believe that's a supported operation.

hi marvin,

johnlloyd_13 — Mon, 20 Feb 2017 04:20:26 GMT

hi marvin,

i think i understand now the cisco doc and the said command.

Step 2 Copy the ASA software to the active unit flash memory:

copy tftp://server[/path]/asa_image_name {disk0:/ | disk1:/}[path/]asa_image_name

Example:

active# copy tftp://10.1.1.1/asa931-smp-k8.bin disk0:/asa931-smp-k8.bin

For other methods than TFTP, see the copy command.

Step 3 Copy the software to the standby unit; be sure to specify the same path as for the active unit:

failover exec mate copy /noconfirm tftp://server[/path]/filename {disk0:/ | disk1:/}[path/]filename

Example:

active# failover exec mate copy /noconfirm tftp://10.1.1.1/asa931-smp-k8.bin disk0:/asa931-smp-k8.bin

i believe both active and standby gets the image from a remote TFTP server. the command just allows executing commands from active asa without the need to jump or SSH to the standby asa.

ciscoasa/pri/act/admin# failover ?

exec Execute command on the designated unit
ciscoasa/pri/act/admin# failover exec ?

active Execute command on the active unit
mate Execute command on the peer unit
standby Execute command on the standby unit
ciscoasa/pri/act/admin# failover exec mate ?

LINE Command String

Correct - both the active and

Marvin Rhoads — Mon, 20 Feb 2017 04:27:32 GMT

Correct - both the active and standby units are tftp clients only.

The tftp server is off on an external computer.

Re: ASA zero downtime upgrade

MILTON MENEGHINI — Thu, 28 Oct 2021 14:14:08 GMT

Marvin, do you think that if I follow those steps but skip the last 2 steps ( log into newly active unit and "failover reload-standby" and wait for succeful reload and verify configuration is synced OK. Both units are now on 9.1(1).), leaving the Active ASA in 9.1(1) and Standby ASA in 8.4(3) can generate problems with NAT flows, considering both units on?