topic Re: HA pair cannot see each other after upgrade to 7.0.3 in Network Security

HA pair cannot see each other after upgrade to 7.0.3

Valkyrie3 — Thu, 02 May 2024 17:17:31 GMT

I have a pair of FMC 2500s running 6.6.7.1 in an HA pair which I've upgraded previously without issue. I upgraded the standby unit to 7.0.3 successfully but when it rebooted, neither FMC can see each other although I can log into either one without issue. I assume this is due to one being on 6.6.7.1 and one on 7.0.3 but when I try to update the 6.6.7.1 unit, it gives the following error:

Error

Update can not be run because FMC HA peer is not accessible. Make sure both FMC peers are connected and try again.

Both FMCs show as being in split brain but I can't perform any HA actions on either FMC because they just error saying the other peer is not available. I've been trying to find if there's a different process for this type of upgrade but I've not had any luck.

Is there something I've done wrong here that I can correct or am I going to need to raise a TAC case for it?

Thanks for any help

Edit: As I found there's no support for the FMC 2500s even though they're still within EoL, I proceeded with breaking the HA, updating the primary FMC and then recreating the HA which seems to have worked ok

Re: HA pair cannot see each other after upgrade to 7.0.3

MHM Cisco World — Fri, 03 May 2024 10:59:19 GMT

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-management-center/220602-upgrade-fmc-in-high-availability.html

Check this guide

MHM

Re: HA pair cannot see each other after upgrade to 7.0.3

Valkyrie3 — Fri, 03 May 2024 14:49:22 GMT

That is the process I followed but it didn't work in this case. I took the backups, paused synchronisation and then updated the standby unit however when I proceeded to upgrade the primary (step 5 in the guide) it failed with the error I mentioned because it couldn't contact the standby FMC. I'm not sure what's gone wrong here, I followed this process previously without issue although those were smaller updates so I don't know if the process differs for going up to version 7 (although I can't find any different process) or it was some fault with the system.