topic Re: FMC HA Pair reboot after update in Network Security

FMC HA Pair reboot after update

tgillon — Thu, 21 Jul 2022 18:47:08 GMT

I have 2 new Firepower devices in a HA Pair scenario, and I want to install an update on them through my FMC GUI. It states that reboots of the firewalls are necessary to complete the update. I have to assume that the reboots will not occur simultaneously, taking down my Internet connection. Am I correct in that thinking?

Re: FMC HA Pair reboot after update

Rob Ingram — Thu, 21 Jul 2022 19:00:56 GMT

@tgillon I assume you are referring to upgrading an FTD HA pair via the FMC?

Yes, you can upgrade the FTD's without disrupting traffic flow.

"You can upgrade the system software running on the devices in a high availability pair without disrupting traffic in your network. Basically, you upgrade the standby device, so that the active device continues handling traffic. After the upgrade completes, you switch roles and again upgrade the standby unit"

Re: FMC HA Pair reboot after update

tgillon — Thu, 21 Jul 2022 18:55:39 GMT

Thanks for the quick reply, Rob. That's the way I used to do it with my ASA's. But, with the FMC and the firewalls being in a HA-PAIR, I can't individually select the separate devices, it's both or none.

Re: FMC HA Pair reboot after update

Rob Ingram — Thu, 21 Jul 2022 19:00:34 GMT

@tgillon ignore the first guide provided it was for FDM, below is the correct guide. It has the procedure to upgrade from the FMC. https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/upgrade/management-center/710/upgrade-fmc-710/upgrade-threat-defense.html

Re: FMC HA Pair reboot after update

Marvin Rhoads — Fri, 22 Jul 2022 03:46:21 GMT

@tgillon with FMC-managed HA pairs, FMC has the orchestration built-in to copy the image to both units, upgrade the standby unit first and - only after it succeeds - to do the role switch and upgrade the formerly active unit. With ASAs we had to do all that manually.

Re: FMC HA Pair reboot after update

tgillon — Fri, 22 Jul 2022 13:09:28 GMT

Thanks Marvin, that was the answer I was looking and hoping for!