Hi,
Please review the release notes for the two releases from the below links to determine what's new and what's changed in these releases.
http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa9-7/ESA_9-7-1_Release_Notes.pdf
http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa9-1/ESA_9-1_Release_Notes.pdf
Release notes for all releases are available below:
http://www.cisco.com/c/en/us/support/security/email-security-appliance/products-release-notes-list.html
It is always preferred to upgrade to a newer general deployment release due to the enhanced scanning capabilities, bug fixes, etc.
The device always uses the Cisco Ironport Update servers for updates and upgrades by default, the local update servers are only used by organizations with strict firewall requirements and use a local https server to fetch updates from Cisco.
As an alternative to the use of standard update or upgrade servers, you also have the option to configure a local (or streaming) upgrade server. With this local upgrade server, the CIsco appliances can retrieve the needed upgrade data from a local source without access to the remote HTTP/HTTPS hosts.
A local upgrade server can be configured on any Microsoft IIS or Apache-based web server that is reached via HTTP (or HTTPS) from your appliances. The appliance(s) performs a simple HTTP GET for the upgrade or update manifest file, which provides the available version data and the relevant URLs for the images themselves. Once the manifest is obtained, all of the required data is retrieved for installation.
Cisco recommends that you have knowledge of these topics to use local update servers:
Cisco ESA standard upgrade procedures
Microsoft Internet Information Services (IIS) web servers
Apache-based web servers
Regards,
Libin Varghese
