ASA failover upgrade path question

[Matt Glosson]

There are several questions on these support forums regarding upgrade paths. This link has been shared a lot. I have read it, but I still have a question/concern.

We have an active/standby failover pair of 5525-X ASAs currently running 9.4(4)16. Typically the way I have zero-downtime upgraded them is to put the new code on both and set it to boot from it, then reboot the standby so it comes up with the new version. Then make the standby active, and reboot the formerly-active one.

I read long ago that a running pair should always be within 0.1 versions of each other (notwithstanding the 8.4-to-9.0 upgrade ). Is that not true anymore? The link above indicates 9.4 can be upgraded directly to 9.9. That means that the standby can be running 9.9 while the active is running 9.4 for a time and still retain stateful failover?

[drlbaluyut]

Hi

That's good to know. Specifically i will upgrade from 9.6(4)3 to 9.9(2). Thanks for your confirmation.

[Marvin Rhoads]

There is zero downtime when upgrading an HA pair of ASA appliances from ASA 9.4(x) to ASA 9.9(x) software.

[Sheraz.Salim]

This is what i said Marin after looking at cisco asa software matrix. but this gentleman was not very convince so to clear his doubts i run this test on my ASA-X series 9.6 to 9.9 in HA pair the upgrade was a success.

also reading the documentation 9.4 to going to 9.9 is also a zero downtime.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa99/release/notes/asarn99.html

@drlbaluyutkinldy please mark this as answered so other tech guy can find this useful post.

[drlbaluyut]

Hi Radio_City

I would like to mark this as answered but i'm not the thread starter.

[Sheraz.Salim]

no worries. I hope you find the community supportive and beneficial. we all here to help each other and learn. This is a great place to contribute in order to enhance knowledge. hope you find it helpful. all the best.

Feel free to post any question.