topic Re: Upgrading an HA FTD pair in Network Security

Upgrading an HA FTD pair

arisgiannakopoulos — Fri, 21 Feb 2020 16:16:38 GMT

Hello,

in the ASA world, when you had to upgrade a failover pair, you would upgrade the Standby unit, once the upgrade is complete and everything looks fine in the "show failover" command, you would failover to that unit, do all your testing and if everything is successful, upgrade the remaining unit.

In the FTD world (I am referring to FTDs managed by an FMC and not running FDM), when you upgrade a failover pair of FTDs you no longer have the option to actually test everything out after the first unit gets upgraded, takes over the active role and BEFORE upgrading the remaining unit. So if during testing of the new OS you find that many things are broken, you don't have a quick back out (the second unit upgrade starts right after the first unit upgrade finishes).

My question is, if there is a way to "pause" the upgrade once you finish the upgrade of the first unit.

thank you

Re: Upgrading an HA FTD pair

Marvin Rhoads — Tue, 25 Sep 2018 13:07:46 GMT

No you cannot pause the HA upgrade (short of some drastic and unsupported cli surgery).

It may change in future releases but that's the state of things as of 6.2.3.5.

Re: Upgrading an HA FTD pair

arisgiannakopoulos — Tue, 25 Sep 2018 13:45:57 GMT

Hi Marvin,

thank you for the reply.

I hope that in a future release they will introduce a timer that you can leverage in order to have some time to do some thorough testing before upgrading the next unit. As it stands right now, if your network is broken because of the upgrade, you don't have a quick roll back as to downgrade a unit takes the same amount of time as for the upgrade.

Re: Upgrading an HA FTD pair

Marvin Rhoads — Tue, 25 Sep 2018 13:53:09 GMT

I agree - even simple policy deployments can take 6-7 minutes (if not longer). Break something with your policy change and you're looking at having to wait that long again to redeploy before it's fixed.

Cisco really needs to address that issue.