ASA 5500x Upgrade question

[benolyndav]

current 5545X version
asa984-41-smp-k8.bin

would i be better upgrading to asa984-48-smp-k8.bin which is a jump of 5 versions, is this the safest way, or could i jump straight to asa992-85-smp-k8.bin,

or even to asa9-10-1-44-smp-k8.bin, then keep jumping up steadily after this.??

much appreciated as always

Thanks

[Rob Ingram]

@benolyndav refer to this guide, the section ASA Upgrade Path, but from 9.8 you can jump up without interim upgrades.

https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/planning.html

9.14 is the latest supported by your hardware.

[benolyndav]

Hi Rob

Thanks for that, the link you provided seems to say that I can go to 9.12 from 9.8 just wondering if this is usual practice and why I dont see an early version in the list to jump to.??

Thanks

[Rob Ingram · Accepted solution]

@benolyndav possibly because ASA 9.9 and 9.10 are older versions and end of software support etc. Even if you upgraded to the very latest version 9.14.x supported by your hardware, that is end of software maintenance this week (02/03/23), so no new bug fixes and Cisco will no longer develop, repair, maintain, or test the product software.

You may need to look at replacing the hardware if you have a requirement to keep your software versions up to date.

[Aref Alsouqi]

One thing I would keep in mind when you upgrade to the recent releases would be the change of the SSH stack that will be applied by default, and the weak ciphers that would be removed from the SNMPv3 config. Regarding the SSH change it would be enough to revert it back to the normal SSH stack with the command "no ssh stack ciscossh". However for SNMP you would need to configure the SNMP user as well as the servers as they will be removed from the original config.