FMC / FTD Update Routine

[florian.hanig1]

Hi.

We have 2 of "Firepower 1120" and 1 "Firepower Management Center (FMC)", all in Version "6.6.4".

We like to Upgrade to newer Release.

How is the update routine?
First FMC?
Then the FTD ?

Can I go directly to 6.6.7 and then to 7.0.4  ?...

Which intermediate steps have to be taken?

Can you help ?

[balaji.bandi]

Upgrade FMC first and FTD next.

- Make sure FMC is compatable FTD version - read the release notes and understand caveats.

- If this is Cluster and HA - check upgrade process standby first and active next part of upgrade.

https://www.cisco.com/c/en/us/td/docs/security/firepower/70/relnotes/firepower-release-notes-700/upgrade.html#Cisco_Generic_Topic.dita_f5e65f64-d2ac-4a1f-bdc5-4bd93d5d6def

[Marvin Rhoads]

6.6.7 to 7.0.4 is a single step upgrade.

As @balaji.bandi noted, it's always best to read and follow the release notes!

[Alan Inman]

You may also want to consider upgrading to whole steps (eg. 7.0) and then applying half steps (eg. 7.0.1, 7.0.2) afterward. This was the advice given to me by TAC after I had a bad update experience. Apparently, whole steps are easier to back out of than upgrades with patches. No further explanation was given by the TAC engineer. 

[Alan Inman]

Ah! Found it!

Choose rollback options.

"For major and maintenance upgrades, you can automatically cancel on upgrade failure and roll back to the previous version. With this option enabled, the device automatically returns to its pre-upgrade state upon upgrade failure. Disable this option if you want to be able to manually cancel or retry a failed upgrade. In a high availability or clustered deployment, auto-cancel applies to each device individually. That is, if the upgrade fails on one device, only that device is reverted."

This option is not supported for patches.