topic Re: FMC/FTD Upgrade matrix question in Network Security

FMC/FTD Upgrade matrix question

benolyndav — Fri, 17 Feb 2023 09:45:49 GMT

see image below

I was planning on upgrading to 7.05 which looks now to be cisco reccomended version, but after double checking the matrix it seems that thats not an option as if I upgrade FMC to 7.05 it wont be able to manage the FTD's, version 7.2 looks to be the the first step, is this correct/ accurate.??

also not sure why the FMC isnt downloading the lates versions for the FTD's its downloading the lates FMC version, these devices are all in the same group for external access to cisco sites.? any idea

Thanks

Re: FMC/FTD Upgrade matrix question

Karsten Iwen — Fri, 17 Feb 2023 09:53:04 GMT

If your FMC is running 7.0 you can manage FTDs versions 7.0 down to 6.4. So your 6.6 firewalls are included.

Re: FMC/FTD Upgrade matrix question

Marius Gunnerud — Fri, 17 Feb 2023 12:17:37 GMT

What that means is that the Oldest version you can manage with FMC 7.0.x is 6.4. Meaning you can manage 6.4.x, 6.5.x, 6.6.x, 6.7, 7.0.x. You CANNOT mannage 6.3 with FMC 7.0.x

The same goes for 7.2.x. You can manage any FTD running a version between 6.6.x and 7.2.x, but you will not be able to manage 6.5 and older.

Re: FMC/FTD Upgrade matrix question

benolyndav — Fri, 17 Feb 2023 12:26:03 GMT

YesI understand that but what I'm asking is I cant upgrade to 7.0.5 like I was planning because based on the matrix I could only go to 7.02 so FMC can still manage the FTD's.??
Thanks

Re: FMC/FTD Upgrade matrix question

Karsten Iwen — Fri, 17 Feb 2023 12:29:50 GMT

Where do you see this stated? And yes, you will still be able to manage these older devices.

Re: FMC/FTD Upgrade matrix question

Marius Gunnerud — Fri, 17 Feb 2023 12:32:48 GMT

You lost me there a bit. From the looks of it your FTDs are running 6.6.5 correct? If that is the case, you are able to upgrade the FMC to 7.2.x. FMC 7.2.x is able to manage FTD running 6.6.x

Re: FMC/FTD Upgrade matrix question

benolyndav — Fri, 17 Feb 2023 13:57:24 GMT

its staed here on the screen shot of the matrix in my original post, I can only go to version 7.0.2 because the FTD;s are on 6.6.x so the matris states that when the manager is on 7.02 the oldest device it can manage is 6.6.x, hence why i cant go to 7.03, 7.04, 7.05, because according to the matrix the manager wouldnt be able to manage the FTD on version 6.6.x
thanks

Re: FMC/FTD Upgrade matrix question

Karsten Iwen — Fri, 17 Feb 2023 14:11:15 GMT

There is no 7.0.2 in the screenshot. The matrix lists major versions. And your conclusion is wrong.

Re: FMC/FTD Upgrade matrix question

Marius Gunnerud — Fri, 17 Feb 2023 14:16:09 GMT

Your screenshot is not indicating anything other than that you are able to manage a FTD 6.6.x version with a FMC 7.2.x.

We have deployments running 7.2 managing 6.6. So your understanding of the Compatibility matrix is incorrect.

Here is the compatibility guide for your reference.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/compatibility/management-center-compatibility.html

Re: FMC/FTD Upgrade matrix question

benolyndav — Fri, 17 Feb 2023 14:24:04 GMT

This why I am asking the experts I'm unsure, so on the cisco software page its 7.0.x, so does for instance 7.02 on the software page correlate to 7.2 on the matrix.

Thanks

Re: FMC/FTD Upgrade matrix question

benolyndav — Fri, 17 Feb 2023 14:31:13 GMT

Yes I understand that but my question originally was it looks like if I upgrade the FMC past 7.2 it wont be able to manage the FTD's based on the matrix, the matrix says the oldest device 7.3 can manage is 6.7, we are running 6.6 on the FTD.
Thanks

Re: FMC/FTD Upgrade matrix question

Marvin Rhoads — Fri, 17 Feb 2023 14:33:13 GMT

7.0.2 and 7.2.x are different versions altogether. The compatibility matrix only list major releases (7.0, 7.1, 7.2 etc). Minor releases (i.e., 7.0.4) are covered by the guidance issued for the parent major release (i.e., 7.0).

The "download updates" feature in FMC will only detect minor updates and patches. Major updates need to be uploaded manually. (This changes in 7.3 and later.)

Re: FMC/FTD Upgrade matrix question

Marius Gunnerud — Fri, 17 Feb 2023 14:35:59 GMT

7.0.2 is not the same as 7.2. If you are only seeing 7.0.2 it means you do not have entitlement to any of the other software versions at the moment.

Re: FMC/FTD Upgrade matrix question

benolyndav — Fri, 17 Feb 2023 14:46:37 GMT

Ah ha got you

So can I upgrade from 6.6.5 directly to 7.2 then, there used to be another matrix saying what you could upgrade to I cant find this now.

Thanks

Re: FMC/FTD Upgrade matrix question

benolyndav — Fri, 17 Feb 2023 15:18:00 GMT

Hi
Is this saying that FMC 1000 cant upgrade past 7.0 version ???

Re: FMC/FTD Upgrade matrix question

Marius Gunnerud — Fri, 17 Feb 2023 15:31:31 GMT

Correct

Re: FMC/FTD Upgrade matrix question

Marius Gunnerud — Wed, 14 Jun 2023 09:28:27 GMT

To anyone reading this post, avoid version that is 7.2.3 or lower in the 7.2.x release. There are a ton of nasty bugs in these versions and we have had some major issues among them FTDs that are removed sporadically from the FMC management. So far we have not had any issues with 7.2.4, but it is still early days.