topic Re: upgrading code on pix in Network Security

upgrading code on pix

ahensel — Fri, 21 Feb 2020 08:21:52 GMT

any help is greatly appreciated. i have 2 pix 535 firewalls. neither have been configured yet. one has a UR license the other a FO license. both came with the 6.3(4) code. i would like to upgrade them to the 7.0 code. can i upgrade each seperately or do i first need to connect them in the stateful failover configuration and upgrade them then.

Re: upgrading code on pix

travis-dennis_2 — Thu, 01 Sep 2005 02:49:00 GMT

You don't have to configure them before you upgrade the IOS. In fact I would recommend that you DO the upgrade before you put these boxes into production. This will help minimize downtime later on. Upgraading the code will not change the license at all. Just be sure to upgrade to the EXACT smae verion of code on each PIX to avoid any strange behvior.

Hope this helps.

Please remember to rate all replies

Re: upgrading code on pix

ahensel — Thu, 01 Sep 2005 09:42:44 GMT

That is what I thought. However I cannot seem to get the FO pix to finish the code upgrade. According to documentation, upgrading via monitor mode is required as going to 7.0 first reformats flash while only loading 7.0 code to RAM. At this point you are told to slap an IP address a FastE interface and perform a copy tftp: flash: to allow the new image to be written to flash. However, after configuring the IP address I am unable copy over the image from tftp to flash because I have no layer 3 connectivity. I've quadruple checked the ip/mask between the tftp server and the 535, same network. The error message I get is "No Route to Host" when trying first initiate a ping. I shouldn't need a route statement since it is a directly connected network. Even if I apply a route statement still same error message. All this was begining to make me think that it had something to do with the FO license. Any ideas? Thanks again for your replies.

Re: upgrading code on pix

rsmith — Fri, 02 Sep 2005 20:00:48 GMT

Not sure if this will help.... I had a similar issue, but with an older 515. Solution was to attach the TFTP server directly to the PIX interface (I used a laptop with the free SolarWinds TFTP server). Any switch ports between the PIX and TFTP, and the image would not load. Set the Gateway and Server IP address both to the same server IP address.

Re: upgrading code on pix

thisisshanky — Fri, 09 Sep 2005 18:22:01 GMT

rsmith,

I am having same problem with a 525 PIX which is licensed for only FO. This box is not yet configured in FO, but the other box (UR licensed) I did upgrade to 7.0 without any issues. The 525 with FO only license, doesnt respond to ping from a laptop cross connected to Ethernet 1(inside) interface. TFTP sessions time out and doesnt happen. Is it that FO boxes doesnt pass traffic due to which this is happening.

Re: upgrading code on pix

thomas-schmitz — Mon, 31 Oct 2005 13:48:49 GMT

Try to type in the command:

failover active

Then the stanby device should be able to access the network.

Re: upgrading code on pix

Krystian9 — Fri, 04 Nov 2005 15:08:52 GMT

that solved my problem 🙂