Minor upgrade of FMC and FTD?

[CiscoBrownBelt]

See documentation about going from 6 to 7 version but course nothing from let's say 7.0.2 to .4,

Has anyone upgraded these before? Any potential issues to consider?

[buffkata]

Skip the .4 and go to .5 it is the current gold star version. We had some minor issues with 7.0.4 as soon as we upgraded from 7.0.1. Unfortunately.5 was not available at the time. 

[Marvin Rhoads · Accepted solution]

As long as the compatibility matrix doesn't show any issues, then a direct upgrade is fine. I've done dozens - just follow the release notes exactly and it normally works as it's supposed to.

Either 7.0.5 or the just-released 7.2.4 would be the best choice for most uses (again, after verifying compatibility).

[CiscoBrownBelt]

Yes the 7.2.4 is what I planned on. Does all the same apply to FTDv?

[Marvin Rhoads]

Yes it applies to all FTD types, including FTDv.

Note if you are using FMC, it must be upgraded first.

[CiscoBrownBelt]

Bit confusing, which actual file am I supposed to use within the package for physical FTD 2140 the .mf? How about FTDv?

[Marvin Rhoads]

Each platform architecture (virtual, 1k series, 2k series etc.) has its own upgrade file.

For FTDv, it is "Cisco_FTD_Upgrade-7.0.5-72.sh.REL.tar" located here: https://software.cisco.com/download/home/286306503/type/286306337/release/7.0.5

For other architectures and FMC, just navigate back up the tree a couple of levels and then back down to the desired branch.

[CiscoBrownBelt]

So I am just testing and trying to upload the SPA file from workstation to physical FTD but it keeps failing. I can ping between the FTD and PC. Using Solarwinds TFTP, allowed all programs through FW, etc. Never see any log of this in Solarwinds. Any ideas?

FTD2140 /firmware # download image
tftp://meuser@1.1.1.1/Desktop/cisco-ftd-fp2k.7.2.4-165.SPA
Please use the command 'show download-task' or 'show download-task
detail' to check download progress.
% Download-task cisco-ftd-fp2k.7.2.4-165.SPA : failed. Download
failure - timeout error (1)

tried removing the "Desktop" and using tftp instead of ftp in the path to no avail.

[Marvin Rhoads]

Why are you trying to download the SPA into fxos via cli?

FTD upgrade is done via GUI - either FMC or FDM depending on how it is managed. For a 2140 that would be using the file "Cisco_FTD_SSP_FP2K_Upgrade-7.0.5-72.sh.REL.tar" in your case.

SPA file would only be used if reimaging and using platform mode - a very uncommon use case.

[CiscoBrownBelt]

I figured out download issue. Did not properly allow program on laptop and had syntex incorrect.

Just testing with spare appliance I have so wanted upgrade that. What file would I use to do that?

Copy on using FMC and the tar.

[CiscoBrownBelt]

Yes so basically just want to test and upgrade a spare FTD I have not connected to anything.

[Marvin Rhoads]

Does the spare Firepower 2140 have an FTD instance running? If so, log into the relevant management address (local management address) to get to the current release and then upgrade using the FDM GUI. If not, what is running on it?

[CiscoBrownBelt]

Not sure what you mean but I just have a unused FTD sitting in a lab bench. So no GUI, no nothing is being used I am consoled in and connected laptop via management port.
Now I uploaded the tar file but get error "Download failure - unable to open downloaded image".

[Marvin Rhoads · Accepted solution]

A stand alone chassis is designed to be managed via the GUI. You can hack around in the fxos and get some things accomplished but it will be 10x as hard as going via the GUI.

If you really really want to, then follow this procedure: https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fp2100/firepower-2100-gsg/ftd-fdm.html#Cisco_Task.dita_3e142f03-3738-40ac-9b4d-ed9b5a5771c0

[CiscoBrownBelt]

Awesome Marvin thanks I will have look!