upgrading code on pix

[ahensel]

any help is greatly appreciated. i have 2 pix 535 firewalls. neither have been configured yet. one has a UR license the other a FO license. both came with the 6.3(4) code. i would like to upgrade them to the 7.0 code. can i upgrade each seperately or do i first need to connect them in the stateful failover configuration and upgrade them then.

[travis-dennis_2]

You don't have to configure them before you upgrade the IOS. In fact I would recommend that you DO the upgrade before you put these boxes into production. This will help minimize downtime later on. Upgraading the code will not change the license at all. Just be sure to upgrade to the EXACT smae verion of code on each PIX to avoid any strange behvior.

Hope this helps.

Please remember to rate all replies

[ahensel]

That is what I thought. However I cannot seem to get the FO pix to finish the code upgrade. According to documentation, upgrading via monitor mode is required as going to 7.0 first reformats flash while only loading 7.0 code to RAM. At this point you are told to slap an IP address a FastE interface and perform a copy tftp: flash: to allow the new image to be written to flash. However, after configuring the IP address I am unable copy over the image from tftp to flash because I have no layer 3 connectivity. I've quadruple checked the ip/mask between the tftp server and the 535, same network. The error message I get is "No Route to Host" when trying first initiate a ping. I shouldn't need a route statement since it is a directly connected network. Even if I apply a route statement still same error message. All this was begining to make me think that it had something to do with the FO license. Any ideas? Thanks again for your replies.

[rsmith]

Not sure if this will help.... I had a similar issue, but with an older 515. Solution was to attach the TFTP server directly to the PIX interface (I used a laptop with the free SolarWinds TFTP server). Any switch ports between the PIX and TFTP, and the image would not load. Set the Gateway and Server IP address both to the same server IP address.

[thisisshanky]

rsmith,

I am having same problem with a 525 PIX which is licensed for only FO. This box is not yet configured in FO, but the other box (UR licensed) I did upgrade to 7.0 without any issues. The 525 with FO only license, doesnt respond to ping from a laptop cross connected to Ethernet 1(inside) interface. TFTP sessions time out and doesnt happen. Is it that FO boxes doesnt pass traffic due to which this is happening.

[thomas-schmitz]

Try to type in the command:

failover active

Then the stanby device should be able to access the network.

[Krystian9]

that solved my problem :-)