Asa HA with Firepower services upgrade - run with different versions for 24 hour period

[evan.chadwick1]

Hi Folks, 

I wanted to upgrade ASA running firepower services. 
I had the idea to only upgrade one ASA/FIrepower SErvices and monitor for 24 hours, then upgrade the second ASA/firepower services. 

Is it possible to operate like this for a short period?

FMC will be upgraded from 6.0.1.2 to 6.1.3

Failover over from Primary ASA to Secondary ASA, and upgrade from 6.0.1.2 to 6.1.3

After upgrade fail back to Primary ASA now running 6.1.3. Monitor for 24 hours

ASA/Firepower Services Primary upgraded to 6.1.3

ASA/Firepower Serivces Secondary stay on 6.0.1.2 - for 24 hours incase rollback required.
After 24 hours

Upgrade ASA/Firepower Serivces Secondary to 6.1.3

Regards, 

[Philip D'Ath]

I would upgrade both the the ASA first, and keep them at the same level.

Then seperately do the Firepower's, and you can run them at different levels for 24 hours.

[evan.chadwick1]

i'm not planning to upgrade the ASA code, i'm only focusing on upgrading the Firepower module.

[Philip D'Ath · Accepted solution]

Then yes, you can run them at different codes levels for 24 hours without an issue.

[evan.chadwick1]

Thanks. 
Was thinking to issue the 'no monitor-interface service-module' as well in order to safeguard unwanted failover of the ASA's. 

[Philip D'Ath]

Just remember if you do that and Firepower really does fail then the ASA may stop forwarding traffic ...

[evan.chadwick1]

yeah. 

I have SFR-FailOpen applied :)

[Philip D'Ath]

ps. I would jump directly to the 6.2 train of Firepower.

[evan.chadwick1]

I can't jump straight as i'm coming from 6.0.1.2

The fmc running 6.2.2 only supports 6.1 and up.

So i plan to get to 6.1.3, then keep going one more time to 6.2.x (most stable version)

[Philip D'Ath]

I would scratch the module upgrade procedure. I would upgrade the FMC, and then re-image the modules and re-deploy the policy.

Re-imaging always works. Upgrading - well it can be a bit hit and miss.