ASA Firewall

[SathishkumarSaravanan0348]

Hi Experts,

I have couple of doubt. I am planning to do IOS upgrade in ASA firewall. 

1. In the device primary is showing as Active and secondary as failed. In this case can I upgrade the IOS in secondary device?

2. Normally when I perform IOS upgrade in asa(primary-active, secondary-standyby), i will just write the boot in active as it reflect in standby. Then in standby I will reload and make as failover active. Then in Active I reload and come to standby and make as no failover active. My question is if the device as primary as standby and secondary as active, then in which device I need to write the config and perform the same ?

Thanks

[jj27 · Accepted solution]

1. If the secondary ASA is failed, it is likely offline. You will need to reboot or resolve the issue preventing it from communicating with the primary ASA.  When it is back online as standby,  you can perform the steps you illustrated in step 2 of your post.
2. You perform the config save on whichever firewall is the active firewall. Transfer the ASA software to both devices, then reload the standby firewall.  When it comes back, fail over to it and reboot the now secondary ASA.

Helpful link for the upgrade process: https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/asa-appliance-asav.html#concept_F0701C3A86854801958757CEF1E4D999

[SathishkumarSaravanan0348]

Thanks for the solution.