I'm seeing from multiple sources that reimaging is the best bet vs. the insane incremental path in some cases. Granted, we've seen lighter shades of incremental headaches on WLC, ACS and other systems not running a monolithic image but this is particularly cumbersome as you say. Compared to upgrading IOS, IOS XE, NX-OS, ASA, etc., it is quite obvious to customers that FirePOWER upgrades have a disproportionate work requirement. This is not only a friction point with customers in keeping these devices up to date but makes them think twice about getting deeper into FirePOWER implementation.
Our engineers have often been billing only a portion of the time spent on these upgrades, depending on what issues they run into, but even a few hours to upgrade one FMC VM & SFRs on an ASA pair raises a customer eyebrow. Telling a customer with just a dozen firewalls that we need to put an engineer on FirePOWER upgrades alone for a couple days has created billing issues and we've had some where we incurred a lump of time we couldn't bill or had to open TAC cases for upgrades that went off the rails for no good reason. It's not good from services value, scheduling or resource consumption aspects either.
We are anxious to see Cisco bundle these upgrades better, hopefully to the point that, like on IOS XE, a bundle image of several packages self-deploys, self-verifies and upgrades whatever previous version to current in one image & reboot, even if it needs to update file system, bootloader, microcode or whatever. Until such time, we struggle to upgrade these like everyone else looking for a better faster way.
