Best practice for Upgrading ASA

[YusufIssa]

Hi there!

We have HQ with with 4 branches, there're ASA HA (Active/Standby) in every location, and HQ and 3 branches are connected via MPLS and only one branch connected to HQ via site-to-site VPN. We're planning to upgrade ASA firmware to 9.12.

As I haven't done the upgrade before, I'm looking for the best practice to do the upgrade and what are the potential caveats that I might run into.

These are some info about the current ASAs:

HQ : ASA 5525,ASA Version 9.6(3)1,asdm_791.bin

Branch (S2S VPN to HQ): ASA5515, ASA Version 9.9(2), asdm-7101.bin

Branch 2:  ASA5525, ASA Version 9.2(2)4 , asdm-7221.bin

Branch 3 : ASA5516 ,  ASA Version 9.8(2)

Branch 4 : ASA5515, ASA Version 9.2(2)4 , asdm-7221.bin

Note: I will be doing the upgrade remotely (I'll have access via teamviewer to every ASA (ASDM/SSH) in every location)

[Rob Ingram]

Hi,

The ASA upgrade procedure is pretty straight forward, please reference cisco guides for Active/Standby HA pair.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/200142-ASA-9-x-Upgrade-a-Software-Image-using.html

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/111867-asa-failover-upgrade.html

Take a backup of your configuration before you upgrade.

HTH