topic Re: Minor upgrade of FMC and FTD? in Network Security

Minor upgrade of FMC and FTD?

CiscoBrownBelt — Fri, 05 May 2023 14:25:03 GMT

See documentation about going from 6 to 7 version but course nothing from let's say 7.0.2 to .4,

Has anyone upgraded these before? Any potential issues to consider?

Re: Minor upgrade of FMC and FTD?

buffkata — Fri, 05 May 2023 14:38:08 GMT

Skip the .4 and go to .5 it is the current gold star version. We had some minor issues with 7.0.4 as soon as we upgraded from 7.0.1. Unfortunately.5 was not available at the time.

Re: Minor upgrade of FMC and FTD?

Marvin Rhoads — Fri, 05 May 2023 14:59:08 GMT

As long as the compatibility matrix doesn't show any issues, then a direct upgrade is fine. I've done dozens - just follow the release notes exactly and it normally works as it's supposed to.

Either 7.0.5 or the just-released 7.2.4 would be the best choice for most uses (again, after verifying compatibility).

Re: Minor upgrade of FMC and FTD?

CiscoBrownBelt — Fri, 05 May 2023 18:44:14 GMT

Yes the 7.2.4 is what I planned on. Does all the same apply to FTDv?

Re: Minor upgrade of FMC and FTD?

Marvin Rhoads — Fri, 05 May 2023 19:02:53 GMT

Yes it applies to all FTD types, including FTDv.

Note if you are using FMC, it must be upgraded first.

Re: Minor upgrade of FMC and FTD?

CiscoBrownBelt — Mon, 08 May 2023 12:53:14 GMT

Bit confusing, which actual file am I supposed to use within the package for physical FTD 2140 the .mf? How about FTDv?

Re: Minor upgrade of FMC and FTD?

Marvin Rhoads — Mon, 08 May 2023 13:13:35 GMT

Each platform architecture (virtual, 1k series, 2k series etc.) has its own upgrade file.

For FTDv, it is "Cisco_FTD_Upgrade-7.0.5-72.sh.REL.tar" located here: https://software.cisco.com/download/home/286306503/type/286306337/release/7.0.5

For other architectures and FMC, just navigate back up the tree a couple of levels and then back down to the desired branch.

Re: Minor upgrade of FMC and FTD?

CiscoBrownBelt — Mon, 08 May 2023 14:40:41 GMT

So I am just testing and trying to upload the SPA file from workstation to physical FTD but it keeps failing. I can ping between the FTD and PC. Using Solarwinds TFTP, allowed all programs through FW, etc. Never see any log of this in Solarwinds. Any ideas?

FTD2140 /firmware # download image
tftp://meuser@1.1.1.1/Desktop/cisco-ftd-fp2k.7.2.4-165.SPA
Please use the command 'show download-task' or 'show download-task
detail' to check download progress.
% Download-task cisco-ftd-fp2k.7.2.4-165.SPA : failed. Download
failure - timeout error (1)

tried removing the "Desktop" and using tftp instead of ftp in the path to no avail.

Re: Minor upgrade of FMC and FTD?

Marvin Rhoads — Mon, 08 May 2023 14:48:45 GMT

Why are you trying to download the SPA into fxos via cli?

FTD upgrade is done via GUI - either FMC or FDM depending on how it is managed. For a 2140 that would be using the file "Cisco_FTD_SSP_FP2K_Upgrade-7.0.5-72.sh.REL.tar" in your case.

SPA file would only be used if reimaging and using platform mode - a very uncommon use case.

Re: Minor upgrade of FMC and FTD?

CiscoBrownBelt — Mon, 08 May 2023 15:16:24 GMT

I figured out download issue. Did not properly allow program on laptop and had syntex incorrect.

Just testing with spare appliance I have so wanted upgrade that. What file would I use to do that?

Copy on using FMC and the tar.

Re: Minor upgrade of FMC and FTD?

CiscoBrownBelt — Mon, 08 May 2023 15:56:43 GMT

Yes so basically just want to test and upgrade a spare FTD I have not connected to anything.

Re: Minor upgrade of FMC and FTD?

Marvin Rhoads — Mon, 08 May 2023 16:02:36 GMT

Does the spare Firepower 2140 have an FTD instance running? If so, log into the relevant management address (local management address) to get to the current release and then upgrade using the FDM GUI. If not, what is running on it?

Re: Minor upgrade of FMC and FTD?

CiscoBrownBelt — Mon, 08 May 2023 16:27:12 GMT

Not sure what you mean but I just have a unused FTD sitting in a lab bench. So no GUI, no nothing is being used I am consoled in and connected laptop via management port.
Now I uploaded the tar file but get error "Download failure - unable to open downloaded image".

Re: Minor upgrade of FMC and FTD?

Marvin Rhoads — Mon, 08 May 2023 17:17:54 GMT

A stand alone chassis is designed to be managed via the GUI. You can hack around in the fxos and get some things accomplished but it will be 10x as hard as going via the GUI.

If you really really want to, then follow this procedure: https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp2100/firepower-2100-gsg/ftd-fdm.html#Cisco_Task.dita_3e142f03-3738-40ac-9b4d-ed9b5a5771c0

Re: Minor upgrade of FMC and FTD?

CiscoBrownBelt — Mon, 08 May 2023 18:43:21 GMT

Awesome Marvin thanks I will have look!

Re: Minor upgrade of FMC and FTD?

CiscoBrownBelt — Tue, 09 May 2023 12:27:52 GMT

So I have FMC on 7.0.4 and a test FTDv on 7.0.4. I believe docs say as long as FMC is on 7.0.X I can upgrade FTDv to 7.0.2 or do they both have to be same exact version or something will not work properly?

References to FXOS only apply to 4100/9300 platforms?

Re: Minor upgrade of FMC and FTD?

CiscoBrownBelt — Tue, 09 May 2023 12:51:57 GMT

Also, in the FMC I don't see a readiness option. Is it because there is a current Upgrade entry (for same version that is in use)? Option to Delete, Install, or Push or Stage Update. Can I just delete this or leave it and upload the 7.2.4?

Re: Minor upgrade of FMC and FTD?

Marvin Rhoads — Tue, 09 May 2023 12:55:15 GMT

FMC must be at or above the version of the managed devices. There's not good reason to have FMC at 7.0.5 but not bring the managed devices up to the same level.

FXOS is only upgraded separately when FTD is on 4100 and 9300 series. Other architectures include the FXOS bundled into the FTD software.

7.2.4. would be a good choice for now - it will likely be the next Gold Star suggested release soon.

Re: Minor upgrade of FMC and FTD?

CiscoBrownBelt — Tue, 09 May 2023 13:36:38 GMT

Oh ok I see.

Reason I ask, is so I could upgrade a test FTDv and not make any changes to the FMC which is used in prod. That FTDv is just managed under the prod FMC but it is really not used for anything. Basically just want to upgrade it to test and prove no issues.

Re: Minor upgrade of FMC and FTD?

CiscoBrownBelt — Fri, 23 Jun 2023 17:54:53 GMT

@Marvin Rhoads Can you upgrade the FMC 4600 appliance that currently has 7.0.4 software with Cisco_Secure_FW_Mgmt_Center_Upgrade-7.2.4-169.sh.REL.tar?

I noticed current 7.0.4 is not Secure (does not show Cisco Secure). Any negatives about doing so? I don't even see any software options that does not reference Secure.

Also, is the VDM updated as well when upgrading with the 7.2.4 software?