topic Re: ASA 5500x version query in Network Security

ASA 5500x version query

benolyndav — Tue, 28 Feb 2023 10:38:43 GMT

currently on 9.8

Hello another ASA 5500x question, so no interim upgrade required, but target version because it as the x in brackets does this mean I can upgrade to any version in the major version.?? and also whats the best/safest practice for this senario please.

Thanks

Re: ASA 5500x version query

Sheraz.Salim — Tue, 28 Feb 2023 10:55:44 GMT

correct your understanding is right. do you have HA pair then upgrade the secondary appliance.

https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/planning.html

Re: ASA 5500x version query

benolyndav — Tue, 28 Feb 2023 11:01:06 GMT

Thanks for that, so I have decided to do a stepped upgrade approach from current version 9.8(x) up to 9.14(x) how would you approach this please?, i was thinking of maybe

step 1, 9.9(x)

step 2, 9.10(x)

step 3, 9.12(x)

step 4, 9.13(x)

step 5 9.14(x)

Thanks

Re: ASA 5500x version query

Sheraz.Salim — Tue, 28 Feb 2023 11:06:47 GMT

Cisco documentation is clear you can jump from 9.8x to 9.14x here however, bear in mind if you have a site to site vpn some of the DH group are not supported therefore there is some plan work required with remote side to upgrade the DH-group. but apart from that your approach is right. Yes I would take this path in order to upgrade the ASA.

Also do you use firepower SFR module in your ASA?

also side note upgrade your ASDM too.

Re: ASA 5500x version query

Sheraz.Salim — Tue, 28 Feb 2023 11:09:28 GMT

here if you plan to upgrade your SFR module.

Re: ASA 5500x version query

benolyndav — Wed, 01 Mar 2023 10:05:44 GMT

Thanks
is there a way just looking at the image and not documentaion of telling if its a maintenace releas or an interim
e.g asa992-85-smp-k8.bin
eg asa9-12-2-smp-k8.bin

Re: ASA 5500x version query

Sheraz.Salim — Wed, 01 Mar 2023 11:07:20 GMT

interim release means they are bug/s fix. the cisco document is very clear on this.

for exmaple

Cisco ASA Interim Release Notes

The software images listed below are Interim releases. They contain bug fixes which address specific issues found since the last Feature or Maintenance release. The images are fully supported by Cisco TAC and will remain on the download site only until the next Maintenance release is available. If you do not have a specific problem which is resolved by an Interim release, we recommend that you use the Feature or Maintenance release images.

https://www.cisco.com/web/software/280775065/160775/ASA-9144-Interim-Release-Notes.html

but yes there is a tab on the website to see the interim software however in ASA you do not see .ED (Early Deployment)