topic Re: ASA failover upgrade path question in Network Security

ASA failover upgrade path question

Matt Glosson — Fri, 21 Feb 2020 15:26:13 GMT

There are several questions on these support forums regarding upgrade paths. This link has been shared a lot. I have read it, but I still have a question/concern.

We have an active/standby failover pair of 5525-X ASAs currently running 9.4(4)16. Typically the way I have zero-downtime upgraded them is to put the new code on both and set it to boot from it, then reboot the standby so it comes up with the new version. Then make the standby active, and reboot the formerly-active one.

I read long ago that a running pair should always be within 0.1 versions of each other (notwithstanding the 8.4-to-9.0 upgrade ). Is that not true anymore? The link above indicates 9.4 can be upgraded directly to 9.9. That means that the standby can be running 9.9 while the active is running 9.4 for a time and still retain stateful failover?

Re: ASA failover upgrade path question

Philip D'Ath — Sun, 25 Feb 2018 18:53:07 GMT

If you are not doing state-full failover (aka you are doing stateless failover) you should be fine.

If you are doing statefull failover and you want to upgrade directly, I would go back to stateless, upgrade (like you have been doing) and then on statefull again.

Re: ASA failover upgrade path question

Matt Glosson — Sun, 25 Feb 2018 20:06:33 GMT

I have always only done it in stateful, not stateless mode. Just to be clear, by "stateful," I mean that when failover occurs it maintains the state of the TCP, UDP, ESP, etc sessions that are in place without disruption. My question is whether or not I can do that while upgrading directly from 9.4 to 9.9. I would love to be pointed to some official Cisco documentation that addresses that exact question, if such a document exists.

For the record, here is my failover configuration:

failover
failover lan unit primary
failover lan interface fo GigabitEthernet0/7
failover polltime unit 1 holdtime 5
failover key *****
failover replication http
failover link fo GigabitEthernet0/7
failover interface ip fo 1.1.1.245 255.255.255.252 standby 1.1.1.246

Re: ASA failover upgrade path question

drlbaluyut — Mon, 07 Jan 2019 14:19:08 GMT

May i know if you still achieve a zero downtime (TCP sessions not dropped) when you upgraded from 9.4 directly to 9.9? I'm planning to upgrade from 9.6(4)8 to 9.9.2 directly.

Re: ASA failover upgrade path question

Sheraz.Salim — Mon, 07 Jan 2019 14:40:36 GMT

you can upgrade from 9.4.x to 9.9x

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/release/notes/asarn99.html

Yes your config is correct.

failover
failover lan unit primary
failover lan interface fo GigabitEthernet0/7
failover polltime unit 1 holdtime 5
failover key *****
failover replication http
failover link fo GigabitEthernet0/7
failover interface ip fo 1.1.1.245 255.255.255.252 standby 1.1.1.246

also make sure you secondary box. the other asa have the following config.

failover
failover lan unit secondary
failover lan interface fo GigabitEthernet0/7
failover polltime unit 1 holdtime 5
failover key *****
failover replication http
failover link fo GigabitEthernet0/7
failover interface ip fo 1.1.1.245 255.255.255.252 standby 1.1.1.246

also bear in mind if you have a sub-interface on these firewall than you have to add them in monitor purpose

monitor-interface gigx.xxx

having said that. normal interface the one do not have a sub-interface are automatically added as monitor interface. than its depends which interface you want to monitor for failover.

Re: ASA failover upgrade path question

Matt Glosson — Mon, 07 Jan 2019 14:40:19 GMT

I know my configuration is correct--I wasn't asking for clarification on that. I was asking if anybody knows if you can upgrade from 9.4.4 to 9.9.x, which apparently nobody does.

Re: ASA failover upgrade path question

Sheraz.Salim — Mon, 07 Jan 2019 14:42:29 GMT

here is the cisco upgrade path recommendation.

seems you can easy do a upgrade to new version.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/release/notes/asarn99.html

Re: ASA failover upgrade path question

drlbaluyut — Mon, 07 Jan 2019 14:49:11 GMT

Hi Radio_City

Yes, but i'm confused about the zero downtime for failover pairs from this link

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/111867-asa-failover-upgrade.html#zerotime

So how can i achieve zero downtime when i upgrade from 9.6(x) to 9.9(x) directly?

Re: ASA failover upgrade path question

Sheraz.Salim — Mon, 07 Jan 2019 14:57:31 GMT

Here an official upgrade guide:

https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/asa-appliance-asav.html#concept_F0701C3A86854801958757CEF1E4D999

To summarize, upgrade for failover asa is straight forward:

- copy new image to active and standby devices.

- change the boot config to boot using new image.

- reload standby with the new image.

- when reloaded, force a failover from active to new reloaded standby.

- reload old active with new software.

- force back active role if you want.

during this process when you reload the standby firewall with new image it will come online. and it will tell you its version does not match with peer ASA.

this is explained in previous thread.

the link you shared i have used in past. its very accurate you can follow the same process. there will be no downtime to your network.

Re: ASA failover upgrade path question

drlbaluyut — Mon, 07 Jan 2019 14:57:49 GMT

So to achieve zero downtime during upgrade for failover pairs from 9.6(x) to 9.9(x), i don't need to do 9.6(x)->9.7(x)->9.8(x)->9.9(x)? Because the link below suggested it. I don't know if that's outdated or not

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/111867-asa-failover-upgrade.html#zerotime

Re: ASA failover upgrade path question

Matt Glosson — Mon, 07 Jan 2019 14:58:22 GMT

I never did. We're still at 9.4.x and I've just been doing the incremental security updates. It's still a “suggested release” on Cisco's ASA software page.

Re: ASA failover upgrade path question

Sheraz.Salim — Mon, 07 Jan 2019 15:03:35 GMT

here is the link

Release Notes for the Cisco ASA Series, 9.9(x)

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/release/notes/asarn99.html

you can go from 9.6 to 9.9

Re: ASA failover upgrade path question

Matt Glosson — Mon, 07 Jan 2019 15:05:24 GMT

My personal frustration is that there is no single document that indicates both a zero-downtime upgrade AND version-specific info in regards to 9.x upgrades beyond a "point one" version. The one you sent a few times indicates one can upgrade from 9.4 to 9.9 (as well as a whole bunch of other options in the grid), but it does not indicate zero downtime during that upgrade. Anyway, I'll eventually just have to bite the bullet when Cisco discontinues support for 9.4.x, but until then, I'm in no rush. I wish I had a spare failover pair, but we don't have that luxury (I do have spare 5510 ASAs, but those won't run anything newer than 9.1).

Re: ASA failover upgrade path question

Sheraz.Salim — Mon, 07 Jan 2019 15:11:01 GMT

i have some spare box 5516-x i shall check and let you know if there is a jump available in 9.4 to 9.9

Re: ASA failover upgrade path question

Sheraz.Salim — Tue, 08 Jan 2019 17:07:06 GMT

Hi I did setup a test lab failover on 2x5516-x from version 9.6 to 9.9. It was successful upgrade.

Re: ASA failover upgrade path question

drlbaluyut — Wed, 09 Jan 2019 05:18:58 GMT

That's good to know. Specifically i will upgrade from 9.6(4)3 to 9.9(2). Thanks for your confirmation.

Re: ASA failover upgrade path question

Marvin Rhoads — Wed, 09 Jan 2019 08:38:13 GMT

There is zero downtime when upgrading an HA pair of ASA appliances from ASA 9.4(x) to ASA 9.9(x) software.

Re: ASA failover upgrade path question

Sheraz.Salim — Wed, 09 Jan 2019 08:46:58 GMT

This is what i said Marin after looking at cisco asa software matrix. but this gentleman was not very convince so to clear his doubts i run this test on my ASA-X series 9.6 to 9.9 in HA pair the upgrade was a success.

also reading the documentation 9.4 to going to 9.9 is also a zero downtime.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/release/notes/asarn99.html

@drlbaluyutkinldy please mark this as answered so other tech guy can find this useful post.

Re: ASA failover upgrade path question

drlbaluyut — Wed, 09 Jan 2019 09:19:29 GMT

Hi Radio_City

I would like to mark this as answered but i'm not the thread starter.

Re: ASA failover upgrade path question

Sheraz.Salim — Wed, 09 Jan 2019 09:22:19 GMT

no worries. I hope you find the community supportive and beneficial. we all here to help each other and learn. This is a great place to contribute in order to enhance knowledge. hope you find it helpful. all the best.

Feel free to post any question.