topic Re: ASA Upgrade in Network Security

ASA Upgrade

zietgiestt — Thu, 02 May 2024 19:12:27 GMT

Hello,

I have 3 ASAs I need to upgrade from 9.8(1)>9.16.4(57).
Can anyone tell me if I need to go 9.8(1)>9.16.4>9.16.4(57)?

Or can I just go straight to the (57)?

Thanks,

Re: ASA Upgrade

Rob Ingram — Thu, 02 May 2024 19:16:58 GMT

@zietgiestt you can upgrade directly from 9.8 to 9.16 (57) without an interim upgrade.

https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/planning.html#id_58680

Re: ASA Upgrade

zietgiestt — Thu, 02 May 2024 19:46:43 GMT

Thanks Rob

Re: ASA Upgrade

zietgiestt — Thu, 02 May 2024 20:20:26 GMT

Rob(or anyone that knows),

1 more quick question...according to Cisco documentation, when I set the new boot system command, I should see this:

ciscoasa(config)# boot system disk0:/cisco-asa-fp1k.9.14.1.SPA

The system is currently installed with security software package 9.13.1, which has:
- The platform version: 2.7.1
- The CSP (asa) version: 9.13.1
Preparing new image for install...
!!!!!!!!!!!!!
Image download complete (Successful unpack the image).
Installation of version 9.14.1 will do the following:
- upgrade to the new platform version 2.8.1
- upgrade to the CSP ASA version 9.14.1
After the installation is complete, reload to apply the new image.
Finalizing image install process...

Install_status: ready...........
Install_status: validating-images.....
Install_status: update-software-pack-completed
ciscoasa(config)#

However, I actually only see this:

ASA-PRI(config)# boot system flash:/asa9-16-4-57-lfbff-k8.SPA
INFO: Converting flash:/asa9-16-4-57-lfbff-k8.SPA to disk0:/asa9-16-4-57-lfbff-k8.SPA
ASA-PRI(config)#

Is this normal?

Thanks,

Re: ASA Upgrade

Rob Ingram — Thu, 02 May 2024 20:48:36 GMT

@zietgiestt you are using ASA hardware not Firepower hardware?

FYI, in version 9.13 weak crypto was depreciated. If you are using VPNs ensure you are not using weak DH groups, encryption and integrity before upgrading.

Re: ASA Upgrade

zietgiestt — Thu, 02 May 2024 21:09:34 GMT

asa 5506

Thanks for the heads up on the vpn tunnels. I'm actually using what will be a deprecated DH group in one of my tunnels

Re: ASA Upgrade

Rob Ingram — Thu, 02 May 2024 21:28:38 GMT

@zietgiestt the output is normal on ASA hardware.

You'd see that other output if using the newer Firepower hardware.

Re: ASA Upgrade

zietgiestt — Thu, 02 May 2024 21:30:37 GMT

Thanks again Rob...