Hello,
due to CVE-2016-1287 we are forced to update our 5550's from 9.1.1 to 9.1.7.
The 5550's are running in active-standby-failover.
Fortunately we have a pair of them for test-purposes.
Steps i took:
1. Copied Image 9.1.2 to both nodes
2. Set boot image to 9.1.2 in config on both nodes
3. Removed boot image 9.1.1 from config on both nodes
4. Reloaded standby-unit
5. Forced standby-unit to become the active one
Until this point everything worked fine, no interruption in the communication via Asa's detected, also all vpnclients stayed connected.
Now i reloaded the newly standby-unit. As the unit came up it became the active one, directly after syncing the config. The formerly active unit reloaded again, for me at a point where not all connection-entries or vpn-sessions were synced. This caused a loss of all connections and vpn-sessions.
At this time my first thought was "ok, maybe the one unit was marked as failed to often", so i reset the failover and started same procedure with image 9.1.7
During upgrade same was happening again: after reloading second unit the context was switched again, causing again the loss of all connections and vpn-session.
Does anyone run into similar problems during upgrade or can give me some hints whre to look in detail to solve this, before we take this into production!?
Also chekced the bugs, but can't really find one describing the problem.
Regrads Uwe
