Upgrading an HA FTD pair

[arisgiannakopoulos]

Hello,

in the ASA world, when you had to upgrade a failover pair, you would upgrade the Standby unit, once the upgrade is complete and everything looks fine in the "show failover" command, you would failover to that unit, do all your testing and if everything is successful, upgrade the remaining unit.

In the FTD world (I am referring to FTDs managed by an FMC and not running FDM), when you upgrade a failover pair of FTDs you no longer have the option to actually test everything out after the first unit gets upgraded, takes over the active role and BEFORE upgrading the remaining unit. So if during testing of the new OS you find that many things are broken, you don't have a quick back out (the second unit upgrade starts right after the first unit upgrade finishes).

My question is, if there is a way to "pause" the upgrade once you finish the upgrade of the first unit.

thank you

[Marvin Rhoads · Accepted solution]

No you cannot pause the HA upgrade (short of some drastic and unsupported cli surgery).

It may change in future releases but that's the state of things as of 6.2.3.5.

[arisgiannakopoulos]

Hi Marvin,

thank you for the reply.

I hope that in a future release they will introduce a timer that you can leverage in order to have some time to do some thorough testing before upgrading the next unit. As it stands right now, if your network is broken because of the upgrade, you don't have a quick roll back as to downgrade a unit takes the same amount of time as for the upgrade.

[Marvin Rhoads]

I agree - even simple policy deployments can take 6-7 minutes (if not longer). Break something with your policy change and you're looking at having to wait that long again to redeploy before it's fixed.

Cisco really needs to address that issue.