Direct upgrade from FTD 6.4.x to 6.6.1?

[ryan14]

Hi,

I am wondering if I can upgrade my 1120 and 2110 appliances directly to the minor revision of 6.6 or do I have to upgrade from 6.4.x to 6.6, then 6.6 to 6.6.1? The upgrade matrix isn't clear if this is supported or not. If trying to do an upgrade from the FMC, it does list the devices for upgrade (running 6.4) so it appears this is possible. Just making sure as I don't have a device to test with.

[Rob Ingram]

Hi @ryan14 

You need to upgrade to the major version (6.6) before patching to 6.6.1

Reference: "To patch Firepower, you must be running the base major version. You cannot upgrade directly to a patch from an previous major version."

https://www.cisco.com/c/en/us/td/docs/security/firepower/upgrade/fpmc-upgrade-guide/plan_upgrade_path.html

HTH

[ryan14]

Thanks.

[Marvin Rhoads · Accepted solution]

@Rob Ingram I believe this longstanding guidance was changed as of 6.6 and later releases.

See:

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/66x/relnotes/firepower-release-notes-66x/upgrade.html#id_88320

[ryan14]

I found it odd the system does show the FTD running 6.4 in the list of devices to upgrade to 6.6.1. Not sure if it will error out or go through. The idea is to help save time on upgrading over a dozen FTDs. Going to 6.6, waiting, then going to 6.6.1 is not fun.

[Rob Ingram]

Good to know, thanks for the update @Marvin Rhoads 

[Massimo Baschieri]

Hi guys,

I'm going to upgrade a quite etherogeneous deployment, which is currently at 6.4, directly to 6.6.1.

The deployment has a mix of FTDs, FPRs and ASA with firepower devices, there are also several ASA5506X, which stands on 6.2.3 release.

Someone has experienced this kind of upgrade on a similar environment?

Any issue? 

[Marvin Rhoads]

I've upgraded environments of mixed FTD and ASA with Firepower service modules to 6.6.1.

Your ASA 5506 of course must remain on the older release since it won't support 6.6.1.