ASA failover upgrade path question

[Matt Glosson]

There are several questions on these support forums regarding upgrade paths. This link has been shared a lot. I have read it, but I still have a question/concern.

We have an active/standby failover pair of 5525-X ASAs currently running 9.4(4)16. Typically the way I have zero-downtime upgraded them is to put the new code on both and set it to boot from it, then reboot the standby so it comes up with the new version. Then make the standby active, and reboot the formerly-active one.

I read long ago that a running pair should always be within 0.1 versions of each other (notwithstanding the 8.4-to-9.0 upgrade ). Is that not true anymore? The link above indicates 9.4 can be upgraded directly to 9.9. That means that the standby can be running 9.9 while the active is running 9.4 for a time and still retain stateful failover?

[Philip D'Ath]

If you are not doing state-full failover (aka you are doing stateless failover) you should be fine.

If you are doing statefull failover and you want to upgrade directly, I would go back to stateless, upgrade (like you have been doing) and then on statefull again.

[Matt Glosson]

I have always only done it in stateful, not stateless mode. Just to be clear, by "stateful," I mean that when failover occurs it maintains the state of the TCP, UDP, ESP, etc sessions that are in place without disruption. My question is whether or not I can do that while upgrading directly from 9.4 to 9.9. I would love to be pointed to some official Cisco documentation that addresses that exact question, if such a document exists.

For the record, here is my failover configuration:

failover
failover lan unit primary
failover lan interface fo GigabitEthernet0/7
failover polltime unit 1 holdtime 5
failover key *****
failover replication http
failover link fo GigabitEthernet0/7
failover interface ip fo 1.1.1.245 255.255.255.252 standby 1.1.1.246

[drlbaluyut]

Hi

May i know if you still achieve a zero downtime (TCP sessions not dropped) when you upgraded from 9.4 directly to 9.9? I'm planning to upgrade from 9.6(4)8 to 9.9.2 directly.

[Matt Glosson]

I never did. We're still at 9.4.x and I've just been doing the incremental security updates. It's still a “suggested release” on Cisco's ASA software page.

[Sheraz.Salim]

you can upgrade from 9.4.x to 9.9x

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/release/notes/asarn99.html

Yes your config is correct.

failover
failover lan unit primary
failover lan interface fo GigabitEthernet0/7
failover polltime unit 1 holdtime 5
failover key *****
failover replication http
failover link fo GigabitEthernet0/7
failover interface ip fo 1.1.1.245 255.255.255.252 standby 1.1.1.246

 also make sure you secondary box. the other asa have the following config.

failover
failover lan unit secondary
failover lan interface fo GigabitEthernet0/7
failover polltime unit 1 holdtime 5
failover key *****
failover replication http
failover link fo GigabitEthernet0/7
failover interface ip fo 1.1.1.245 255.255.255.252 standby 1.1.1.246

also bear in mind if you have a sub-interface on these firewall than you have to add them in monitor purpose

monitor-interface gigx.xxx

 having said that. normal interface the one do not have a sub-interface are automatically added as monitor interface. than its depends which interface you want to monitor for failover.

[Matt Glosson]

I know my configuration is correct--I wasn't asking for clarification on that. I was asking if anybody knows if you can upgrade from 9.4.4 to 9.9.x, which apparently nobody does.

[Sheraz.Salim]

here is the cisco upgrade path recommendation.

seems you can easy do a upgrade to new version.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/release/notes/asarn99.html

[drlbaluyut]

Hi Radio_City


Yes, but i'm confused about the zero downtime for failover pairs from this link

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/111867-asa-failover-upgrade.html#zerotime

So how can i achieve zero downtime when i upgrade from 9.6(x) to 9.9(x) directly?

[Sheraz.Salim]

Here an official upgrade guide:

https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/asa-appliance-asav.html#concept_F0701C3A86854801958757CEF1E4D999

To summarize, upgrade for failover asa is straight forward:

- copy new image to active and standby devices.

- change the boot config to boot using new image.

- reload standby with the new image. 

- when reloaded, force a failover from active to new reloaded standby.

- reload old active with new software.

- force back active role if you want.

during this process when you reload the standby firewall with new image it will come online. and it will tell you its version does not match with peer ASA.

this is explained in previous thread. 

the link you shared i have used in past. its very accurate you can follow the same process. there will be no downtime to your network. 

[drlbaluyut]

So to achieve zero downtime during upgrade for failover pairs from 9.6(x) to 9.9(x), i don't need to do 9.6(x)->9.7(x)->9.8(x)->9.9(x)? Because the link below suggested it. I don't know if that's outdated or not

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/111867-asa-failover-upgrade.html#zerotime

[Sheraz.Salim]

here is the link 

Release Notes for the Cisco ASA Series, 9.9(x)

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/release/notes/asarn99.html

you can go from 9.6 to 9.9

[Matt Glosson]

My personal frustration is that there is no single document that indicates both a zero-downtime upgrade AND version-specific info in regards to 9.x upgrades beyond a "point one" version. The one you sent a few times indicates one can upgrade from 9.4 to 9.9 (as well as a whole bunch of other options in the grid), but it does not indicate zero downtime during that upgrade. Anyway, I'll eventually just have to bite the bullet when Cisco discontinues support for 9.4.x, but until then, I'm in no rush. I wish I had a spare failover pair, but we don't have that luxury (I do have spare 5510 ASAs, but those won't run anything newer than 9.1).

[Sheraz.Salim]

i have some spare box 5516-x i shall check and let you know if there is a jump available in 9.4 to 9.9

[Sheraz.Salim · Accepted solution]

Hi I did setup a test lab  failover on 2x5516-x from version 9.6 to 9.9. It was successful upgrade.