topic Re: ASA 5500x Upgrade question in Network Security

ASA 5500x Upgrade question

benolyndav — Tue, 21 Feb 2023 15:53:10 GMT

current 5545X version
asa984-41-smp-k8.bin

would i be better upgrading to asa984-48-smp-k8.bin which is a jump of 5 versions, is this the safest way, or could i jump straight to asa992-85-smp-k8.bin,

or even to asa9-10-1-44-smp-k8.bin, then keep jumping up steadily after this.??

much appreciated as always

Thanks

Re: ASA 5500x Upgrade question

Rob Ingram — Tue, 21 Feb 2023 15:57:33 GMT

@benolyndav refer to this guide, the section ASA Upgrade Path, but from 9.8 you can jump up without interim upgrades.

https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/planning.html

9.14 is the latest supported by your hardware.

Re: ASA 5500x Upgrade question

Aref Alsouqi — Tue, 21 Feb 2023 16:05:13 GMT

One thing I would keep in mind when you upgrade to the recent releases would be the change of the SSH stack that will be applied by default, and the weak ciphers that would be removed from the SNMPv3 config. Regarding the SSH change it would be enough to revert it back to the normal SSH stack with the command "no ssh stack ciscossh". However for SNMP you would need to configure the SNMP user as well as the servers as they will be removed from the original config.

Re: ASA 5500x Upgrade question

benolyndav — Mon, 27 Feb 2023 13:53:00 GMT

Hi Rob

Thanks for that, the link you provided seems to say that I can go to 9.12 from 9.8 just wondering if this is usual practice and why I dont see an early version in the list to jump to.??

Thanks

Re: ASA 5500x Upgrade question

Rob Ingram — Mon, 27 Feb 2023 14:04:15 GMT

@benolyndav possibly because ASA 9.9 and 9.10 are older versions and end of software support etc. Even if you upgraded to the very latest version 9.14.x supported by your hardware, that is end of software maintenance this week (02/03/23), so no new bug fixes and Cisco will no longer develop, repair, maintain, or test the product software.

You may need to look at replacing the hardware if you have a requirement to keep your software versions up to date.