Upgrade IronPort C360 from 7.6.3-019 to 8.5.6 build 106?

[DISmekalin]

Good day! Tell me, please, is it possible to upgrade c360 immediately to the new version through the GUI, from 7.6.3-019 to 8.5.6?

Is there a recommended order for this upgrade?

Or is it strongly recommended to do this from the command line (CLI)?

It is not clustered.

Thanks in advance.

[Robert Sherwin · Accepted solution]

You should be able to upgrade your appliance.  Recommendation is always to do it via the CLI, as this generates a better understanding and visual cues as to where you are at in the download and install process during the upgrade.  But - you can do it via the GUI as well.  In the end, it is the administrator's choice.

See the following TechNote, which may aide, answer questions:

http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118547-technote-esa-00.html

-Robert

[DISmekalin]

Thank you for the answer.

Сould you tell me whether such a sharp transition between versions safely? May it make sense to first upgrade to any intermediate version?

[DISmekalin]

I found the answer.

You can upgrade to release 8.5.6-106 from the following versions: • 7.6.3-019

From:

http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa8-5-6/ESA_8-5-6_HP3_Release_Notes.pdf

[DISmekalin]

Is there a chance that after updating it will not work?

[exMSW4319]

Given that "not work" could cover a multitude of sins, yes.

If your ESA is important to you then you already have a plan if it suffers unexpected physical failure. That plan needs to be checked to ensure that if something goes wrong, you have an acceptable path to recovery. An out-of-hours change window may be popular with your recipients but isn't much good if you have no dealer support until the next working day.

I've been through a number of upgrades with lower-series models and they've never gone disastrously wrong. However, for a major upgrade don't depend on a simple config restoration to get you out of trouble as some upgrades are one-way trips. Your config backup may be valid but it won't necessarily restore to a half or completely upgraded machine.

More practically, read all of the intervening release notes looking for minor changes to functionality as these can catch you out. In doing so, look for useful tips such as "this can be tight for disk space so empty out your quarantines".

[DISmekalin]

Finally, i updated successfully our C360. Thanks to all.

My plan:

1. In GUI save the configuration file

2. Connect using putty to ironport

3. Test connections to the following dynamic servers (hardware appliance):

• telnet update-manifests.ironport.com:443
• telnet updates.ironport.com:80
• telnet downloads.ironport.com:80  

4. Disable reporting (diagnostic > reporting > disable)

5. I did not suspend the listeners, because we have only one ESA

6. Enter upgrade

7. On the questions i used the default answers.

8. Enable reporting (diagnostic > reporting > enable)

I updated to 8.5.6-106, and then to 8.5.7-043 (version for maintenance).

C360 is fully updated and antivirus is updating now.

Materials:

Upgrade AsyncOS Basic Procedure and Common Scenarios

ESA Upgrade Procedures

Upgrading two C370's in a cluster from 7.6.3-019 t0 8.5.6

[Robert Sherwin]

Great - thank you for the update - happy to hear all worked out for you!

-Robert

[DISmekalin]

Sorry, i have one problem after update. There is no one report on overview page. It writes:"Data is currently unavailable".

Now i have used reinitialization of the reporting database. But this procedure lasts for almost 12 hours with the status:"Reseting reporting data......"

[Raed Boshmaf]

Hi!

What browser are you using? if you are using internet explorer please implement the following workaround:

From the webUI(GUI) > System Administration > General Settings > Override IE Compatibility Mode > set it as enable.

Regards,

Raed

[DISmekalin]

I have tried from the Google Chrome and Internet Explorer. There is the same reaction.

Override IE Compatibility Mode set as enabled.

[Raed Boshmaf]

Could you provide me with ipcheck command from the CLI

[DISmekalin]

Ipcheck Rev 1
Date Fri May 13 15:57:07 2016
Model C360
Platform PE2950 (805C)
LCD Setting default
LCD Text IronPort C360
MGA Version Version: 8.5.7-043
Build Date 2015-08-28
Install Date 2016-05-10 21:22:30
Burn-in Date Unknown
Serial No. ...
BIOS Version 2.2.8I
RAID Version 1.11.52-0349, NT13-2, 1.01-010B
RAID Status Optimal
RAID Type 1
RAID Chunk Unknown
BMC Version 1.77

Disk 0 278GB HITACHI HUS153030VLS300 A4C2J8XHNLUC
Disk 1 278GB HITACHI HUS153030VLS300 A4C2J8XH96XC
Disk Total 556GB

Root 400MB 53%
Nextroot 400MB 56%
Var 400MB 0%
Log 222GB 25%
DB 12GB 0%
Swap 8GB
Mail Queue 35GB

RAM 1 1024M ECC 667MHz
RAM 2 1024M ECC 667MHz
RAM 3 1024M ECC 667MHz
RAM 4 1024M ECC 667MHz
RAM 1 1024M ECC 667MHz
RAM 2 1024M ECC 667MHz
RAM 3 1024M ECC 667MHz
RAM 4 1024M ECC 667MHz
RAM 5 Empty
RAM 6 Empty
RAM 7 Empty
RAM 8 Empty
RAM Total 8G

CPU 1 Xeon 2.333G 1333FSB 0.125M, 12.0M, 0.0M Cache
CPU 2 Empty

PCI 1 PCI-e 8x Empty
PCI 2 PCI-e 8x Empty
PCI 3 PCI-e 4x Installed

NIC Management 00:10:18:34:ed:e5, NetXtreme BCM5721 Gigabit Ethernet PC I Express
NIC Data 1 00:1e:c9:58:2f:fc, NetXtreme II BCM5708 Gigabit Ethernet
NIC Data 2 00:1e:c9:58:2f:fe, NetXtreme II BCM5708 Gigabit Ethernet

PS1 Unknown
PS2 Unknown

Key 222day, IronPort Anti-Spam
Key 222day, Outbreak Filters
Key 222day, Sophos
Key Perpetua, Bounce Verification
Key Perpetua, Incoming Mail Handling

[Raed Boshmaf]

i was suspecting the following field notice FN - 63931 but you already have 8G of RAM

[DISmekalin]

Tell me, please, what to do with a hung session on re-initialization of the system reports?

Can I close this session?

May be, will it take some time to report worked after the updates?