• What is the estimated level of Risk of this occurring, i.e. best guestimate on the likelihood & frequency of these Bugs occurring? You have not described any bug, this is more of a hardware limitation as processing ACLs require memory and CPU and upgrades would also require CPU.
• If they did impact, what is required to Recover from such an incident? This depends on what happens during the upgrade, it is not good to power-cycle the firewall if the upgrade hangs, so I would suggest opening a TAC case and have them help with the recovery. Ideally you will have an HA setup so the upgrade will do one firewall at a time and therefore you should not have an impact on your users. Access control entries with several interfaces assigned to the source and destination zones as well as several source and destination networks and ports will compound the number of ACLs. The newer releases of FTD will address this issue so that there is one entry for each access control entry and there by adding more logic for match criteria when going through the ACLs to find a match.
• What is the likely timescale for that Recovery (loss of service This is difficult to say as it really depends on the type of issue. If it is deemed that it is OK to perform a power-cycle and the firewall comes up then we are talking a few minutes, or perhaps the power-cycle just helps kickstart the upgrade (I have seen this before also) then it could be 30 minutes until the firewall is back up. But in the worst case scenario where the firewall has died and you need to replace it, this depends on what type of support agreement you have with Cisco (could be any where from 4 hours to next day to 5 business days...or more).
--
Please remember to select a correct answer and rate helpful posts
