Chapter 1. Getting Started

Welcome to the Firepower Management Center upgrade guide. This guide explains how to prepare for and complete a successful upgrade of an FMC deployment where all appliances are running at least Firepower Version 5.4.0.2/5.4.1.1.

Note

This guide does not contain upgrade information for locally managed (FDM/ASDM) devices. Instead, see the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager or the Cisco ASA Upgrade Guide.

Upgrading a Firepower deployment can be a complex process. Careful planning and preparation can help you avoid missteps. These are as much a part of the upgrade process as actually performing the mechanical steps that invoke the upgrade scripts.

- Using This Guide

- Upgrade Checklists

- Freshly Install Firepower Software

Using This Guide

This guide has three main parts:

- Prepare to Upgrade: Deployment assessment, upgrade path planning, obtaining upgrade packages, and so on.

- Upgrade Firepower Appliances: Describes the actual process of upgrading Firepower appliances, including operating system upgrades where necessary. Includes checklists (see the next topic) and upgrade paths.

- Reference: Reference information that helps you plan and execute Firepower upgrades. If you are already familiar with the upgrade procedures, this allows you to quickly answer your most frequently asked questions.

Upgrade Checklists

This guide provides upgrade checklists for Firepower platforms. These checklists walk you through the upgrade process, including planning and preparation. Complete the checklist every time you upgrade. Skipping steps can result in an unsuccessful upgrade.

Platform

Checklist

Firepower Management Center, including FMCv and FMCv 300.

Upgrade Checklist: Firepower Management Centers

Firepower Threat Defense:

- Firepower 4100 series

- Firepower 9300

Upgrade Checklist: FTD on Firepower 4100/9300 Chassis

Firepower Threat Defense:

- Firepower 1000 series

- Firepower 2100 series

- ASA 5500-X series

- ISA 3000

- Firepower Threat Defense Virtual

Upgrade Checklist: Other FTD Devices

NGIPS software:

- Firepower 7000/8000 series

- NGIPSv

Upgrade Checklist: Firepower 7000/8000 Series and NGIPSv

ASA with FirePOWER Services:

- ASA 5500-X series

- ISA 3000

Upgrade Checklist: ASA with FirePOWER Services

Freshly Install Firepower Software

If you are unable to upgrade a Firepower appliance, or are disinclined to follow the required upgrade path, you can freshly install major Firepower releases. This is also called reimaging. To run a particular patch, install the major version, then upgrade.

If you think you might need to reimage, see the Cisco Firepower Release Notes for your version and review the fresh install chapter. Make sure you understand:

- Scenarios where you need to reimage.

- Important guidelines and limitations, including making backups, ensuring appliance access, addressing licensing concerns, and so on.

- Where to find installation instructions.

Part I. Prepare to Upgrade

Upgrading a Firepower deployment can be a complex process. Careful planning and preparation can help you avoid missteps. These are as much a part of the upgrade process as actually performing the mechanical steps that invoke the upgrade scripts.

For more information, see:

- Assess Your Deployment

- Plan Your Upgrade Path

- Obtain Firepower Software Upgrade Packages

- Run Firepower Software Readiness Checks

- Other Pre-Upgrade Actions and Checks

Chapter 2. Assess Your Deployment

Before you upgrade any Firepower appliance, determine the current state of your deployment. Understanding where you are determines how you get to where you want to go.

- Deployment Assessment Questions

- Find Current Version Information

Deployment Assessment Questions

- What appliances do you have, and what Firepower version are they running? What version do you want them to run, and can they run that version?

- Do any of your appliances require a separate operating system upgrade? Or, do you want to upgrade only the operating system?

- Do you have virtual appliances that require a hosting environment upgrade? Or, do you want to upgrade only the hosting environment?

- Are you using a standalone Firepower Management Center, or do you have a pair of high availability Firepower Management Centers?

- Are your devices standalone, or do you have clusters, stacks, and high availability pairs of devices?

- Are your devices deployed passively, as an IPS, as a firewall?

- Are you replacing an appliance or adding a new one to your deployment?

Find Current Version Information

This table lists where you can find information on the currently running versions of the upgradeable components of your Firepower deployment.

Finding the Current Firepower Version

Component

Platform

Version Information

Firepower software

Firepower Management Center

On the FMC, choose Help > About.

Device managed by an FMC

On the FMC, choose Devices > Device Management.

FXOS

Firepower 4100/9300 chassis

On the FXOS CLI, use the show version command.

ASA OS

ASA with FirePOWER Services

On the ASA CLI, use the show version command.

Virtual hosting environment

Firepower virtual appliance

See the documentation for your virtual hosting environment.

Chapter 3. Plan Your Upgrade Path

Use these guidelines to help you build your upgrade path.

- About Upgrade Paths: Can I Upgrade?

- Release Types

- Identify Preinstallation Packages (Versions 6.0, 6.0.1, 6.1)

- Identify When to Add New Devices

- Identify Interruptions in Traffic Flow and Inspection

- Identify Other Major Tasks

About Upgrade Paths: Can I Upgrade?

Your upgrade path is a detailed plan for what you will upgrade and when. In general, you upgrade the Firepower Management Center, then its managed devices. However, in some cases you may need to upgrade devices first. If you have assessed your deployment—that is, you know what you have and what you want—you are ready to build your upgrade path.

Tip

Upgrade paths that require intermediate versions can be time consuming. Especially in larger deployments where you must alternate FMC and device upgrades, consider reimaging older devices instead of upgrading. First, remove the devices from the FMC. Then, upgrade the FMC, reimage the devices, and re-add them to the FMC.

Answer 'Yes' to Two Important Questions

You must answer 'yes' to both of these questions, every time you upgrade either an FMC or a device:

- Is Direct Upgrade Possible?

- Can I Maintain FMC-Device Version Compatibility?

If the answer to either question is 'no,' your upgrade path is invalid.

- Is Direct Upgrade Possible?

- Can I Maintain FMC-Device Version Compatibility?

- Where Do I Begin?

Is Direct Upgrade Possible?

You can often upgrade from several versions back. However, if you are far "behind," you may require intermediate upgrades or strategic reimaging. These tables summarize upgrade capabilites for Firepower Management Centers and their managed devices. For more detailed upgrade paths for each appliance type, see the upgrade chapters: Upgrade Firepower Appliances.

Note

Patches change the fourth digit only. For example, you must be running Version 6.4.0 to patch to Version 6.4.0.1. You cannot jump directly to a patch level from any earlier major or maintenance release.

Direct Upgrades from Version 6.2.3 through 6.6.0

This table summarizes valid upgrade targets if you are currently running Version 6.2.3 or later.

Direct Upgrades from Version 6.2.3 through 6.6.0

Current Version

Target Version: Direct Upgrade Supported

to 6.7.0/6.7.x

6.6.0/6.6.x

6.5.0

6.4.0

6.3.0

from 6.6.0/6.6.x

YES

—

—

—

—

6.5.0

YES

YES

—

—

—

6.4.0

YES

YES

YES

—

—

6.3.0

YES

YES

YES

YES

—

6.2.3

—

YES

YES

YES

YES

Direct Upgrades from Version 5.4 through 6.2.2

This table summarizes valid upgrade targets if you are currently running Version 5.4 through 6.2.2.

Direct Upgrades from Version 5.4 through 6.2.2

Current Version

Target Version: Direct Upgrade Supported

to 6.4.0

6.3.0

6.2.3

6.2.2

6.2.1

6.2.0

6.1.0

6.0.1

6.0.0

from 6.2.2

YES

YES

YES

—

—

—

—

—

—

6.2.1

YES

YES

YES

YES

—

—

—

—

—

6.2.0

YES

YES

YES

YES

—

—

—

—

—

6.1.0

YES †

YES †

YES

—

—

YES

—

—

—

6.0.1

—

—

—

—

—

—

YES

—

—

6.0.0

—

—

—

—

—

—

—

YES

—

5.4.x

—

—

—

—

—

—

—

—

YES *

Direct Upgrades by Minimum Version to Upgrade

To put it another way, to directly upgrade to the target version in the left column, you must be running at least the version in the right column.

Direct Upgrades by Minimum Version to Upgrade

Target Version

Minimum Current Version for Direct Upgrade

6.7.0 or any 6.7.x maintenance release

6.3.0

6.6.0 or any 6.6.x maintenance release

6.2.3

6.5.0

6.2.3

6.4.0

6.1.0 †

6.3.0

6.1.0 †

6.2.3

6.1.0

6.2.2

6.2.0

6.2.1

Upgrades to Version 6.2.1 are not supported.

6.2.0

6.1.0

6.1.0

6.0.1

6.0.1

6.0.0

6.0.0

5.4.0.2 or 5.4.1.1

* You must be running at least Version 5.4.0.2/5.4.1.1 to upgrade to Version 6.0.

† Due to operating system incompatibilies, you cannot upgrade directly from Version 6.1 → 6.4 on a Firepower 4100/9300 series device. For similar reasons, we recommend that you not upgrade from Version 6.1 → 6.3. If you are running Version 6.1, we recommend upgrading to Version 6.2.3 on FXOS 2.3.1, and proceeding from there.

Can I Maintain FMC-Device Version Compatibility?

A Firepower Management Center must run the same or newer version as its managed devices. This means:

- You can manage older devices with a newer FMC, usually a few major versions back.

For example, a Version 6.7.0 FMC can manage a Version 6.3.0 device.

- You cannot upgrade a device past the FMC.

Before you upgrade an FMC, make sure the upgraded FMC will be able to manage its current devices. For example, a Version 6.7.1 FMC could manage a Version 6.7.0 device, but not a Version 6.7.2 device.

Below, we list FMC versions and the devices they can manage. Find your current version in the first column, then read across to determine which devices you can manage. Remember, within a major version, the FMC must be running the same or newer maintenance (third-digit) release as its managed devices.

FMC Management Capability: Versions 6.2.3+

FMC Version

Can Manage: Device Version

6.7.x

6.6.x

6.5.0

6.4.0

6.3.0

6.2.3

6.2.2

6.2.1

6.2.0

6.1.0

6.7.x

YES

YES

YES

YES

YES

—

—

—

—

—

6.6.x

—

YES

YES

YES

YES

YES

—

—

—

—

6.5.0

—

—

YES

YES

YES

YES

—

—

—

—

6.4.0

—

—

—

YES

YES

YES

YES

YES

YES

YES

6.3.0

—

—

—

—

YES

YES

YES

YES

YES

YES

6.2.3

—

—

—

—

—

YES

YES

YES

YES

YES

FMC Management Capability: Version 5.4.0 through 6.2.2

FMC Version

Can Manage: Device Version

6.2.2

6.2.1

6.2.0

6.1.0

6.0.1

6.0.0

5.4.1

5.4.0

6.2.2

YES

YES

YES

YES

—

—

—

—

6.2.1

—

YES

YES

YES

—

—

—

—

6.2.0

—

—

YES

YES

—

—

—

—

6.1.0

—

—

—

YES

YES

YES

YES *

YES *

6.0.1

—

—

—

—

YES

YES

YES *

YES *

6.0.0

—

—

—

—

—

YES

YES *

YES *

5.4.1

—

—

—

—

—

—

YES

YES

5.4.0

—

—

—

—

—

—

—

YES

* A device must be running at least Version 5.4.0.2/5.4.1.1 to be managed by a Version 6.0, 6.0.1, or 6.1 FMC.

Note that technically you can manage a patched device (fourth-digit release) with an unpatched FMC. However, we strongly recommend against it. You should always update your entire deployment. New features and resolved issues often require the latest release on both the FMC and its managed devices.

Where Do I Begin?

In most cases, you will upgrade the FMC first. You should upgrade as far as possible while still being able to maintain FMC-device compatibility. However, if the devices are too old, your first step is to upgrade the devices to the same major version as the FMC.

If you still do not know where to begin, refer to your deployment assessment and find your current FMC-device version combination below. These recommendations take into account direct upgrade capability as well as FMC-device compatibility.

This table assumes you want to upgrade to the latest major/maintenance release, which is currently Version 6.7.0/6.7.x.

Beginning a Firepower Upgrade to Version 6.7.x

Your Current Deployment

Recommended First Step

FMC

Devices

Upgrade

To

6.7.x

6.3.0 through 6.7.x

FMC

Any later 6.7.x maintenance release.

6.6.x

6.3.0 through 6.6.x

FMC

6.7.x

6.2.3

Devices

6.6.x

6.5.0

6.3.0 through 6.5.0

FMC

6.7.x

6.2.3

Devices

6.5.0

6.4.0

6.3.0 through 6.4.0

FMC

6.7.x

6.1.0 through 6.2.3

Devices

6.4.0

6.3.0

6.3.0

FMC

6.7.x

6.1.0 through 6.2.3

Devices

6.3.0

6.2.3

6.2.3

FMC

6.6.x

6.1.0 through 6.2.2

Devices

6.2.3

6.2.2

6.1.0 through 6.2.2

FMC

6.4.0

6.2.1

6.1.0 through 6.2.1

FMC

6.4.0

6.2.0

6.1.0 through 6.2.0

FMC

6.4.0

6.1.0

6.1.0

FMC

6.4.0

5.4.0 through 6.0.1

Devices

6.1.0

6.0.1

5.4.0 through 6.0.1

FMC

6.1.0

6.0.0

5.4.0 through 6.0.0

FMC

6.0.1

5.4.x

5.4.x

FMC

6.0.0

Release Types

We provide three levels of release: major, maintenance, and patch.

Note

Maintenance releases were introducted with Version 6.6.x. Versions 6.0.1, 6.2.1, 6.2.2, and 6.2.3 are considered major releases even though they are third-digit changes.

For more information, see the Cisco NGFW Product Line Software Release and Sustaining Bulletin.

Major Releases

Major releases contain new features, functionality, and enhancements. They may include infrastructure or architectural changes.

Major Releases

Characteristic

Details

Numbering scheme

Changes the first or second digit:

- 5.0, 6.0, 7.0 ...

- 5.3, 5.4 ...

- 6.1, 6.2 ...

Upgrade path

You can upgrade major releases from several versions back. If you are far "behind," you may require intermediate upgrades.

For example:

- 6.1 → 6.7 is not supported.

- 6.3 → 6.7 is supported.

For details, refer to the supported upgrade path for your platform.

Note

Before Version 6.1, you always had to go one at a time: 5.4 → 6.0 → 6.0.1 → 6.1.

Operating system upgrades

For the Firepower 4100/9300 chassis, FXOS upgrades are required.

For ASA FirePOWER, resolving issues may require an ASA upgrade.

FMC direct download

No.

Direct download is not supported for major upgrades. You must download from the Cisco Support & Download site.

Fresh installs (reimaging)

Yes.
You can reimage to a major release.

Uninstalling

No.

You cannot uninstall a major release. If you want to return to an earlier version, you must reimage. This is one reason why we strongly recommend you back up before upgrade.

Maintenance Releases

Maintenance release contain general bug and security related fixes. Behavior changes are rare, and are related to those fixes.

Maintenance Releases

Characteristic

Details

Numbering scheme

Changes the third digit:

- 6.6.1, 6.6.2 ...

- 6.7.1, 6.7.2 ...

Upgrade path

You can upgrade to maintenance releases from several versions back. If you are far "behind," you may require intermediate upgrades.

For example:

- 6.1 → 6.6.1 is not supported.

- 6.2.3 → 6.6.1 is supported.

For details, refer to the supported upgrade path for your platform.

Note

Before Version 6.1, you always had to go one at a time: 5.4 → 6.0 → 6.0.1 → 6.1.

Operating system upgrades

Resolving issues may require that you patch the operating system.

FMC direct download

Yes, after a delay.

The FMC can directly download a maintenance release about two weeks after it is available for manual download.

Fresh installs (reimaging)

Yes.
You can reimage to a maintenance release.

Uninstalling

No.

You cannot uninstall a maintenance release. If you want to return to an earlier version, you must reimage. This is one reason why we strongly recommend you back up before upgrade.

Patches

Patches are on-demand updates limited to critical fixes with time urgency.

Note

Before Version 6.6, most patches were not as specifically targeted.

Patches

Characteristic

Details

Numbering scheme

Changes the fourth digit:

- 6.6.0.1, 6.6.0.2 ...

- 6.6.1.1, 6.6.1.2 ...

Upgrade path

Patches can change the fourth digit only.

For example:

- 6.4.0 → 6.4.0.10 is supported.

Patches are cumulative. You can always install the latest patch to a major release or maintenance releases.

- 6.4.0 → 6.5.0.4 is not supported.

In this case, you must upgrade to 6.5.0 before you can patch.

Operating system upgrades

Resolving issues may require that you patch the operating system.

FMC direct download

Version dependent:

- 6.6.0 and later, no.

Special exceptions may be made.

- 6.5.0 and earlier, yes.

However, after mid-2020, we have implemented the same two-week delay as maintenance releases have.

Fresh installs (reimaging)

No.

You cannot reimage directly to a patch level.

Uninstalling

Yes.

When you uninstall patches from:

- 6.2.3 and later, you return to the patch level you upgraded from.

- 6.2.2 and earlier, you return to the previously released patch, regardless of where started.

Identify Preinstallation Packages (Versions 6.0, 6.0.1, 6.1)

For some upgrades on some platforms, we provide a preinstallation package or hotfix that optimizes the upgrade, enables specific upgrade functions, or fixes upgrade issues.

Preinstallation packages and hotfixes are available on the Cisco Support & Download site in the same location as the upgrade and installation packages. Just as with regular upgrade packages, use the System > Updates page on the FMC to run a preinstall or hotfix. We recommend you do this just before you upgrade.

Firepower Preinstallation Packages

Target Version

Platforms

Severity

Details

6.1.0

FMC & FMCv

All devices

Optional

Allows readiness checks for the Version 6.1.0 upgrade.

After Version 6.1.0, the readiness check is included with upgrade packages.

See: Firepower System Release Notes Version 6.1.0 Preinstallation Package

6.1.0

FTD devices in HA pairs

Optional

Allows hitless upgrades of FTD HA pairs.

Without the preinstall, you must break high availability before you upgrade to Version 6.1.0.

See: Firepower System Release Notes Version 6.1.0 Preinstallation Package

6.0.1

FMC & FMCv

Required

Optimizes the upgrade.

See: Firepower System Release Notes Version 6.0.1 Preinstallation

6.0.0

FMC & FMCv

All devices

Required from:

- 5.4.0.2 through 5.4.0.6

- 5.4.1.1 through 5.4.1.5

Recommended from:

- 5.4.0.7+

- 5.4.1.6+

Optimizes the upgrade. Allows you to upgrade appliances in STIG mode.

See: FireSIGHT System Release Notes Version 6.0.0 Preinstallation

Identify When to Add New Devices

If your upgrade path includes adding a new device, when you add it depends on the device type:

- Physical device: Determine which Firepower version the device is currently running. Add the device as soon as you can, then use the Firepower Management Center to upgrade the new device with the rest of your deployment. Do not upgrade your FMC past the point where it can no longer manage the out-of-the-box device.

- Virtual device: Create after you upgrade the FMC to its target version. When you add a new virtual device, you should never have to perform a major upgrade, only patches.

Identify Interruptions in Traffic Flow and Inspection

You must identify potential interruptions in traffic flow and inspection during the upgrade. This can occur:

- When a device is rebooted.

- When you upgrade the operating system or virtual hosting environment on a device.

- When you upgrade the Firepower software on a device, or uninstall a patch.

- When you deploy configuration changes as part of the upgrade or uninstall process (Snort process restarts).

Device type, deployment type (standalone, high availability, clustered), and interface configurations (passive, IPS, firewall, and so on) determine the nature of the interruptions. We strongly recommend performing any upgrade or uninstall in a maintenance window or at a time when any interruption will have the least impact on your deployment.

For more information, see Traffic Flow, Inspection, and Device Behavior.

Identify Other Major Tasks

Many steps in the upgrade process can take a significant amount of time. You should explicitly include these steps in your plan. These can include, but are not limited to:

- Backups—Perform Backups

- Downloads and pushes—Obtain Firepower Software Upgrade Packages

- Readiness checks—Run Firepower Software Readiness Checks

- Pre- and post-upgrade configuration changes—Plan Configuration Changes

Chapter 4. Obtain Firepower Software Upgrade Packages

To upgrade Firepower software, the software upgrade package must be on the appliance.

- About Firepower Software Upgrade Packages

- Guidelines and Limitations for Managing Upgrade Packages

- Downloading Firepower Software Upgrade Packages

- Upload Firepower Software Upgrade Packages to the FMC

- Get FTD Upgrade Packages from an Internal Server

- Push Upgrade Packages to FMC-Managed Devices

About Firepower Software Upgrade Packages

To upgrade Firepower software (or perform a readiness check), the software upgrade package must be on the appliance.

In Version 6.5.0 and earlier, FMC-managed devices must get their upgrade packages from the FMC. This means you must upload both FMC and device upgrade packages onto the FMC. Version 6.6.0 adds the ability to use your own internal web server instead of the FMC as the source for FTD upgrade packages. This means that FTD upgrade packages no longer have to 'go through' the FMC.

This table explains how to get upgrade packages onto the FMC.

Getting Firepower Software Upgrade Packages onto the FMC

Method

Details

Manual

Download from the Cisco Support & Download site, then upload to the FMC.

See Downloading Firepower Software Upgrade Packages and Upload Firepower Software Upgrade Packages to the FMC.

Direct from Cisco

An FMC with internet access can download Version 6.2.3–6.5.0 Firepower patches and all maintenance releases (third-digit upgrades) directly from Cisco, about two weeks after they become available for manual download. Direct download from Cisco is not supported for:

- Major releases.

- Most patches to Version 6.6 or later.

See Download Upgrade Packages Directly from Cisco.

This table explains how to get upgrade packages onto FMC-managed devices.

Getting Firepower Software Upgrade Packages onto FMC-Managed Devices

Method

Source

Details

Advantages

Supported Versions/Platforms

Copy (push) packages before upgrade.

Recommended.

FMC

Upload device upgrade packages to the FMC, but choose when to copy them to devices.

See Push Upgrade Packages to FMC-Managed Devices.

Reduces the length of your upgrade maintenance window.

Version 6.2.3 FMC

Internal web server

Configure an internal web server instead of the FMC as the source for FTD upgrade packages, and choose when to copy the packages to devices.

See Get FTD Upgrade Packages from an Internal Server and Push Upgrade Packages to FMC-Managed Devices.

Reduces the length of your upgrade maintenance window.

Useful if you have limited bandwidth between the FMC and its devices.
Saves space on the FMC.

Version 6.6.0+ FTD devices

Copy packages as part of upgrade.

When you start a device upgrade, the system copies the upgrade package to the device as the first task.

FMC

Upload device upgrade packages to the FMC before you upgrade the devices.

See the previous table.

—

Any.

If your FMC is Version 6.2.2 or earlier, this is your only choice.

Internal web server

Upload device upgrade packages to an internal web server. Then, configure your FTD devices to get upgrade packages from the server instead of the FMC.
See Get FTD Upgrade Packages from an Internal Server.

Useful if you have limited bandwidth between the FMC and its devices.

Saves space on the FMC.

Version 6.6.0+ FTD devices

Guidelines and Limitations for Managing Upgrade Packages

The following guidelines and limitations apply to obtaining and managing upgrade packages.

High Availability FMCs

In a FMC high availability deployment, you must transfer upgrades packages to both the active/primary FMC and the standby/secondary FMC. Additionally, you must pause synchronization before you transfer the package to the standby FMC.

To limit interruptions to HA synchronization during the upgrade process, we recommend that you:

- Active FMC: Transfer the package during the preparation stage of the upgrade.

- Standby FMC: Transfer the package as part of the actual upgrade process, after you pause synchronization.

For more information, see Upgrade High Availability FMCs.

Push Firepower Upgrade Package Before FXOS Upgrade

For Firepower 4100/9300 with FTD, best practice is to push the Firepower upgrade package before you begin the required companion FXOS upgrade.

Note

For upgrades from Version 6.1.0 directly to Version 6.3.0 or 6.4.0, a push from the FMC is required. You must push before you upgrade FXOS.

Check Bandwidth

Firepower upgrade package sizes vary. Make sure your management network has the bandwidth to perform large data transfers. For more information, see Guidelines for Downloading Data from the Firepower Management Center to Managed Devices (Troubleshooting TechNote).

Downloading Firepower Software Upgrade Packages

Firepower software upgrade packages are available on the Cisco Support & Download site:

- Firepower Management Center, including FMCv: https://www.cisco.com/go/firepower-software

- Firepower Threat Defense (ISA 3000): https://www.cisco.com/go/isa3000-software

- Firepower Threat Defense (all other models, including FTDv): https://www.cisco.com/go/ftd-software

- Firepower 7000 series: https://www.cisco.com/go/7000series-software

- Firepower 8000 series: https://www.cisco.com/go/8000series-software

- ASA with FirePOWER Services (ASA 5500-X series): https://www.cisco.com/go/asa-firepower-sw

- ASA with FirePOWER Services (ISA 3000): https://www.cisco.com/go/isa3000-software

- NGIPSv: https://www.cisco.com/go/ngipsv-software

To find an upgrade package, select or search for your Firepower appliance model, then browse to the Firepower software download page for your current version. Available upgrade packages are listed along with installation packages, hotfixes, and other applicable downloads.

You use the same upgrade package for all Firepower models in a family or series. Upgrade package file names reflect the platform, package type (upgrade, patch, hotfix), and Firepower version. Note that maintenance releases use the upgrade package type.

For example:

- Package: Cisco_Firepower_Mgmt_Center_Upgrade-6.6.0-90.sh.REL.tar

- Platform: Firepower Management Center

- Package type: Upgrade

- Version and build: 6.6.0-90

- File extension: sh.REL.tar

Upgrade packages from Version 6.2.1+ are signed tar archives (.tar). Do not untar. Do not transfer upgrade packages by email.

Firepower Software Upgrade Package Naming Schemes

Platform

Versions

Package

FMC/FMCv

6.3.0+

Cisco_Firepower_Mgmt_Center

5.4.0 to 6.2.3

Sourcefire_3D_Defense_Center_S3

Firepower 1000 series

Any

Cisco_FTD_SSP-FP1K

Firepower 2100 series

Any

Cisco_FTD_SSP-FP2K

Firepower 4100/9300 chassis

Any

Cisco_FTD_SSP

ASA 5500-X series with FTD

ISA 3000 with FTD

FTDv

Any

Cisco_FTD

Firepower 7000/8000 series

AMP models

6.3.0 to 6.4.0

Cisco_Firepower_NGIPS_Appliance

5.4.0 to 6.2.3

Sourcefire_3D_Device_S3

ASA FirePOWER

Any

Cisco_Network_Sensor

NGIPSv

6.3.0+

Cisco_Firepower_NGIPS_Virtual

6.2.2 to 6.2.3

Sourcefire_3D_Device_VMware

5.4.0 to 6.2.0

Sourcefire_3D_Device_Virtual64_VMware

Operating System Upgrade Packages

For information on operating system upgrade packages, see the Planning Your Upgrade chapters in the following guides:

- Cisco ASA Upgrade Guide, for ASA OS

- Cisco Firepower 4100/9300 Upgrade Guide, for FXOS

- Download Upgrade Packages Directly from Cisco

Download Upgrade Packages Directly from Cisco

An FMC with internet access can get selected upgrade packages directly from Cisco; see About Firepower Software Upgrade Packages.

Before you begin

If you are using the standby FMC in a high availability pair, pause synchronization. See Guidelines and Limitations for Managing Upgrade Packages.

Procedure

Step 1

On the FMC web interface, choose System > Updates.

Step 2

Click Download Updates.

The FMC downloads all eligible packages for your deployment, as well as the latest VDB if needed.

The number of upgrade packages retrieved, and therefore the time to retrieve them, depends on how up-to-date your current deployment is and how many different device types you have.

What to do next

Refer to your plan. Optionally but recommended, copy upgrade packages to managed devices. See Push Upgrade Packages to FMC-Managed Devices.

Upload Firepower Software Upgrade Packages to the FMC

Use the following procedure to manually upload upgrade packages to the FMC, for itself and the devices it manages.

Before you begin

- Download the appropriate upgrade package from the Cisco Support & Download site. See Downloading Firepower Software Upgrade Packages.

- If you are using the standby FMC in a high availability pair, pause synchronization. See Guidelines and Limitations for Managing Upgrade Packages.

Procedure

Step 1

On the FMC web interface, choose System > Updates.

Step 2

Click Upload Update.

Step 3

(Version 6.6.0+) For the Action, click the Upload local software update package radio button.

Step 4

Click Choose File.

Step 5

Browse to the package and click Upload.

What to do next

Refer to your plan. Optionally but recommended, copy device upgrade packages to managed devices. See Push Upgrade Packages to FMC-Managed Devices.

Get FTD Upgrade Packages from an Internal Server

Starting with Version 6.6.0, Firepower Threat Defense devices can get upgrade packages from an internal web server, rather than from the FMC. This is especially useful if you have limited bandwidth between the FMC and its devices. It also saves space on the FMC.

Note

This feature is supported only for FTD devices running Version 6.6.0+. It is not supported for upgrades to Version 6.6.0, nor is it supported for the FMC or Classic devices.

To configure this feature, you save a pointer (URL) to an upgrade package's location on the web server. The upgrade process will then get the upgrade package from the web server instead of the FMC. Or, you can use the push feature on the FMC to copy the package before you upgrade.

Repeat this procedure for each FTD upgrade package. You can configure only one location per upgrade package.

Before you begin

- Download the appropriate upgrade packages from the Cisco Support & Download site. See Downloading Firepower Software Upgrade Packages.

- Copy the upgrade packages to an internal web server that your FTD devices can access.

- For secure web servers (HTTPS), obtain the server's digital certificate (PEM format). You should be able to obtain the certificate from the server's administrator. You may also be able to use your browser, or a tool like OpenSSL, to view the server's certifcate details and export or copy the certificate.

Procedure

Step 1

On the FMC web interface, choose System > Updates.

Step 2

Click Upload Update.

Choose this option even though you will not upload anything. The next page will prompt you for a URL.

Step 3

For the Action, click the Specify software update source radio button.

Step 4

Enter a Source URL for the upgrade package.

Provide the protocol (HTTP/HTTPS) and full path, for example:

https://internal_web_server/upgrade_package.sh.REL.tar

Upgrade package file names reflect the platform, package type (upgrade, patch, hotfix), and the Firepower version you are upgrading to. Make sure you enter the correct file name.

Step 5

For HTTPS servers, provide a CA Certificate.

This is the server's digital certificate you obtained earlier. Copy and paste the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines.

Step 6

Click Save.

You are returned to the Product Updates page. Uploaded upgrade packages and upgrade package URLs are listed togther, but are labeled distinctly.

What to do next

Refer to your plan. Optionally but recommended, copy device upgrade packages to devices: Push Upgrade Packages to FMC-Managed Devices.

Push Upgrade Packages to FMC-Managed Devices

Starting with Version 6.2.3, you can copy (or push) upgrade packages from the FMC before the upgrade. This helps reduce the length of your upgrade maintenance window. Version 6.6.0 adds the ability to use an internal web server instead of the FMC as the source for FTD upgrade packages.

When you push, each device gets the upgrade package individually from the source—the system does not copy upgrade packages between cluster, stack, or HA member units.

If you do not push before upgrade, the device gets the upgrade package as the first step in the upgrade process.

Before you begin

Firepower upgrade package sizes vary. Make sure your management network has the bandwidth to perform large data transfers. For more information, see Guidelines for Downloading Data from the Firepower Management Center to Managed Devices (Troubleshooting TechNote).

Procedure

Step 1

On the FMC web interface, choose System > Updates.

Step 2

Put the upgrade package where the device can get it. Choose:

- FMC

Manually upload or directly retrieve the package to the FMC. See Upload Firepower Software Upgrade Packages to the FMC or Download Upgrade Packages Directly from Cisco.

- Internal web server (FTD Version 6.6.0+)

Upload to an internal web server and configure FTD devices to get the package from that server. See Get FTD Upgrade Packages from an Internal Server.

Step 3

Click the Push (Version 6.5.0 and earlier) or Push or Stage update (Version 6.6.0+) icon next to the upgrade package you want to push, then choose destination devices.

If the devices where you want to push the upgrade package are not listed, you chose the wrong upgrade package.

Step 4

Push the package. For:

- FMCs, click Push.

- Internal web servers, click Download Update to Device from Source.

What to do next

After the file transfer to the device completes, you can proceed with readiness checks and/or the actual upgrade. Refer to your plan.

Chapter 5. Run Firepower Software Readiness Checks

Readiness checks assess a Firepower appliance's preparedness for a software upgrade. They identify issues including database integrity, version inconsistencies, and device registration. Readiness checks are included in Firepower software upgrade packages after Version 6.1.0.

- Guidelines and Limitations for Readiness Checks

- Run the Readiness Check (Version 6.7+)

- Run the Readiness Check (Version 6.1–6.6.x)

Guidelines and Limitations for Readiness Checks

These guidelines and limitations apply to Firepower readiness checks.

Evaluates Firepower Software Readiness Only

The readiness check is for Firepower software readiness only. It does not assess preparedness for intrusion rule, VDB, or GeoDB updates. Readiness checks are not supported for hotfixes or patch uninstallers.

Version and Platform Requirements

Readiness Check Support by Version and Plafform

Current FMC Version

Readiness Check Support

5.4 – 6.0

Not supported.

6.0.1

Supported, with a preinstallation package.

If you want to run readiness checks on a Version 6.0.1 → 6.1 upgrade, first install the Version 6.1 preinstallation package. You must do this for the FMC and its managed devices. See the Firepower System Release Notes Version 6.1.0 Pre-Installation Package.

6.1 – 6.6.x

You can use a Version 6.1–6.6.x Firepower Management Center to perform the readiness check on itself and its standalone managed devices.

For clustered devices, stacked devices, and devices in high availability pairs, you can run the readiness check from the Linux shell, also called expert mode. To run the check, you must first push or copy the upgrade package to the correct location on each device, then use this command: sudo install_update.pl --detach --readiness-check /var/sf/updates/upgrade_package_name. For detailed instructions, contact Cisco TAC.

6.7.0+

You can use a Version 6.7.0+ Firepower Management Center to perform the readiness check on itself and the devices it manages, including FTD devices configured for high availabilty and scalability.

Time Requirements

The time required to run the readiness check varies depending on appliance model and database size. You may find it expedient to forgo readiness checks if your deployment is large.

Tip

For all device upgrades to 6.2.3–6.6.x, you can reduce the amount of time it takes to run readiness checks by copying (pushing) upgrade packages to devices before you begin.

Readiness checks for FTD device upgrades to Version 6.7.0+ no longer require the upgrade package to reside on the device. Although we still recommend you copy the upgrade package to the device before you begin the upgrade itself, you no longer have to do so before you run the readiness check.

During The Check/Failed Checks

Do not manually reboot, or shut down an appliance running readiness checks. If your appliance fails the readiness check, correct the issues and run the readiness check again. If the readiness check exposes issues that you cannot resolve, do not begin the upgrade. Instead, contact Cisco TAC.

Run the Readiness Check (Version 6.7+)

Use this procedure to perform readiness checks on a Version 6.7.0+ FMC and its managed devices, including devices running older versions (6.3.0–6.6.x), and FTD devices in high availabilty and scalability deployments.

Before you begin

- Upgrade the FMC to at least Version 6.7.0. If your FMC is currently running an older version, see Run the Readiness Check (Version 6.1–6.6.x).

- Upload the upgrade package to the FMC, for the appliance you want to check. If you want to check Version 6.6.0+ FTD devices, you can also specify the upgrade package location on an internal web server. This is required because readiness checks are included in upgrade packages.

- (Optional) If you are upgrading an ASA FirePOWER/NGIPSv device to any version, or an FTD device to Version 6.3.0.1–6.6.x, push the upgrade package to the device. This can reduce the time required to run the readiness check. If you are upgrading an FTD device to Version 6.7.0+, you can skip this step. Although we still recommend you push the upgrade package to the device before you begin the upgrade itself, you no longer have to do so before you run the readiness check.

Procedure

Step 1

On the FMC web interface, choose System > Updates.

Step 2

Under Available Updates, click the Install icon next to the appropriate upgrade package.

The system displays a list of eligible appliances, along with their pre-upgrade compatibility check results. Starting with Version 6.7.0, FTD devices must pass certain basic checks before you can run the more complex readiness check. This pre-check catches issues that will cause your upgrade to fail—but we now catch them earlier and block you from proceeding.

Step 3

Select the appliances you want to check and click Check Readiness.

If you cannot select an otherwise eligible appliance, make sure it passed its compatibility checks. You may need to upgrade an operating system, or deploy configuration changes.

Step 4

Monitor the progress of the readiness check in the Message Center.

If the check fails, the Message Center provides failure logs.

What to do next

On the System > Updates page, click Readiness Checks to view readiness check status for your FTD deployment, including checks in progress and failed checks. You can also use this page to easily re-run checks after a failure.

Run the Readiness Check (Version 6.1–6.6.x)

This procedure is valid for FMCs currently running Version 6.1–6.6.x, and their standalone managed devices.

Note

You can use this procedure to run readiness checks on a Version 6.0.1 → 6.1 upgrade, but you must first install the Version 6.1 preinstallation package. You must do this for the FMC and managed devices. See the Firepower System Release Notes Version 6.1.0 Pre-Installation Package.

Before you begin

- Upload the upgrade package to the FMC, for the appliance you want to check. If you want to check Version 6.6+ FTD devices, you can also specify the upgrade package location on an internal web server. This is required because readiness checks are included in upgrade packages.

- (Optional, Version 6.2.3+) Push the upgrade package to the managed device. This can reduce the time required to run the check.

- Deploy configurations to managed devices whose configurations are out of date. Otherwise, the readiness check may fail.

Procedure

Step 1

On the FMC web interface, choose System > Updates.

Step 2

Click the Install icon next to the appropriate upgrade package.

Step 3

Select the appliances you want to check and click Launch Readiness Check.

Step 4

Monitor the progress of the readiness check in the Message Center.

Chapter 6. Other Pre-Upgrade Actions and Checks

The following pre-upgrade actions and checks are also essential to a successful upgrade.

- Schedule Maintenance Windows

- Appliance Access, Communication, and Health

- Management Network Bandwidth

- Plan Configuration Changes

- Perform Backups

- Verify NTP Synchronization

Schedule Maintenance Windows

We recommend you schedule upgrades for at a time when any interruption will have the least impact on your deployment.

When you schedule a maintenance window, consider the upgrade's effect on traffic flow and inspection, and how long the upgrade is likely to take. Also consider the tasks you must perform in the window, and those you can perform ahead of time. Minimize disruption with careful planning and preparation. Do not wait until the maintenance window to obtain and push upgrade packages, run readiness checks, create backups, and so on.

Appliance Access, Communication, and Health

At all times during the upgrade process, make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor. Resolve minor issues before they become major.

Firepower devices can stop passing traffic during the upgrade (depending on interface configurations), or if the upgrade fails. Before you upgrade a Firepower device, make sure traffic from your location does not have to traverse the device itself to access the device's management interface. In FMC deployments, you should also able to access the FMC management interface without traversing the device.

Do not deploy changes to or from, manually reboot, or shut down an upgrading appliance. Do not restart an upgrade in progress. The upgrade process may appear inactive during prechecks; this is expected. If you encounter issues with the upgrade, including a failed upgrade or unresponsive appliance, contact Cisco TAC.

Management Network Bandwidth

To upgrade a Firepower appliance (or perform a readiness check), the upgrade package must be on the appliance. Firepower upgrade package sizes vary. Make sure your management network has the bandwidth to perform large data transfers.

If you transfer an upgrade package to a managed device at the time of upgrade, insufficient bandwidth can extend upgrade time or even cause the upgrade to time out. If you can, we recommend you manually push (copy) Firepower upgrade packages to managed devices before you upgrade, either from the FMC or, for FTD devices, from your own internal web server.

For more information, see:

- Obtain Firepower Software Upgrade Packages

- Guidelines for Downloading Data from the Firepower Management Center to Managed Devices (Troubleshooting TechNote)

Plan Configuration Changes

Especially with major upgrades, upgrading may cause or require significant configuration changes either before or after upgrade. For example, deprecated FlexConfig commands can cause post-upgrade deployment issues. Use the checklist in About Upgrade Guidelines for Firepower Software to identify potential issues.

Perform Backups

Back up Firepower appliances both before and after upgrade:

- Before upgrade: If an upgrade fails catastrophically, you may have to reimage and restore. Reimaging returns most settings to factory defaults, including the system password. If you have a recent backup, you can return to normal operations more quickly.

- After upgrade: This creates a snapshot of your freshly upgraded deployment. We recommend you back up the FMC after you upgrade its managed devices, so your new FMC backup file 'knows' that its devices have been upgraded.

Caution

We strongly recommend you back up Firepower appliances to a secure remote location and verify transfer success. Backups left on an appliance may be deleted, either manually or by the upgrade process, which purges locally stored backups.

Especially because backup files are unencrypted, do not allow unauthorized access. If backup files are modified, the restore process will fail. Keep in mind that anyone with the Admin/Maint role can access the Backup Management page, where they can move and delete files from remote storage.

Firepower backup capabilities vary by platform and version. For requirements, guidelines, limitations, best practices, and procedures, see the Firepower Management Center Configuration Guide.

Verify NTP Synchronization

Before you upgrade, make sure Firepower appliances are synchronized with any NTP server you are using to serve time. Being out of sync can cause upgrade failure. In FMC deployments, the Time Synchronization Status health module does alert if clocks are out of sync by more than 10 seconds, but you should still check manually.

To check time:

- FMC: Choose System > Configuration > Time.

- Devices: Use the show time CLI command.

Part II. Upgrade Firepower Appliances

The checklists in the following chapters guide you through the upgrade process. Every time you upgrade a Firepower appliance, use the appropriate checklist. Skipping any step can result in an unsuccessful upgrade.

- Upgrade Firepower Management Centers

- Upgrade Firepower Threat Defense: Firepower 4100/9300

- Upgrade Firepower Threat Defense: Other FTD Devices

- Upgrade Firepower 7000/8000 Series and NGIPSv

- Upgrade ASA with FirePOWER Services

Chapter 7. Upgrade Firepower Management Centers

- Upgrade Checklist: Firepower Management Centers

- Upgrade Path: Firepower Management Centers

- Upgrade a Standalone FMC

- Upgrade High Availability FMCs

Upgrade Checklist: Firepower Management Centers

Use this checklist to upgrade Firepower Management Centers, including FMCv. If you are upgrading FMCs in a high availability pair, complete the checklist for each peer.

Complete the checklist every time you upgrade. Skipping steps can result in an unsuccessful upgrade. At all times during the process, make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Plan the Upgrade

Maintain deployment compatibility at all times by correctly planning and following an upgrade path.

✓

Action/Check

Details

Verify Upgrade Path

Check your place in your upgrade path. Know which upgrade you just performed and which you are performing next.

Upgrade Path: Firepower Management Centers

Check Versions

Check current and target versions on the FMC:

- Firepower software

- Virtual hosting environment (FMCv)

Firepower Management Centers

Check FMC Compatibility

Check if the FMC will be able to manage the devices after it upgrades. If not, revise your upgrade path so you upgrade the devices first.

Can I Maintain FMC-Device Version Compatibility?

Read Release Notes

Read the release notes, paying special attention to the things that can affect upgrade, including:

- Version-specific upgrade guidelines and warnings.

- Known issues that affect upgrade.

- New/deprecated features and functionality.

Firepower Release Notes

Pre-Upgrade Actions and Checks

Minimize disruption by performing prechecks outside the maintenance window.

✓

Action/Check

Details

Make Required Configuration Changes

Make required pre-upgrade configuration changes, and be prepared to make required post-upgrade configuration changes.

Firepower Release Notes

Check Disk Space

Run a preliminary disk space check for the Firepower software upgrade.

Time Tests and Disk Space Requirements

Get Upgrade Package

Obtain the correct upgrade package and upload it to the FMC. Do not untar signed (.tar) packages.

Obtain Firepower Software Upgrade Packages

Run Firepower Software Readiness Check

Run a readiness check. Requires Version 6.1+.

Run Firepower Software Readiness Checks

Back Up Events & Configurations

Back up event and configuration data. Back up to an external location and verify transfer success. If you store device backups on the FMC, verify those are also backed up externally. When you upgrade the FMC, it purges locally stored backups.

Firepower Management Center Configuration Guide

Schedule Maintenance Window

Schedule a maintenance window when it will have the least impact, considering the tasks you must perform and the time the upgrade is likely to take.

Time Tests and Disk Space Requirements

Upgrade the Firepower Management Center

Perform the upgrade in a maintenance window.

✓

Action/Check

Details

Upgrade Hosting

If needed, upgrade the hosting environment (FMCv).

See the documentation for your hosting environment.

Upgrade Firepower Software

Upgrade the Firepower software.

Upgrade a Standalone FMC

or

Upgrade High Availability FMCs

Upgrade Path: Firepower Management Centers

This table provides upgrade paths for Firepower Management Centers, including FMCv.

Note

Upgrading an FMC to Version 6.0.0 and Version 6.0.1 requires a preinstallation package. For more information, see Identify Preinstallation Packages (Versions 6.0, 6.0.1, 6.1).

Find your current Firepower version in the left column. You can upgrade directly to the versions listed in the right column. If you cannot perform a direct upgrade from your current to the target version, your upgrade path must include intermediate versions. For an alternate way of looking at this information, see Is Direct Upgrade Possible?.

FMC Direct Upgrades

Current Version

Target Version

6.7.0

6.7.x (maintenance releases)

Directly to:

→ Any later 6.7.x maintenance release

6.6.0

6.6.x (maintenance releases)

Last support for FMC 2000 and 4000.

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ Any later 6.6.x maintenance release

6.5.0

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

6.4.0

Last support for FMC 750, 1500, and 3500.

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

6.3.0

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

6.2.3

Directly to one of:

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

→ 6.4.0

→ 6.3.0

6.2.2

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

6.2.1

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

→ 6.2.2

6.2.0

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

→ 6.2.2

6.1.0

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

→ 6.2.0

6.0.1

Directly to:

→ 6.1.0

6.0.0

Directly to:

→ 6.0.1

5.4.1.1

Directly to:

→ 6.0.0

Upgrade a Standalone FMC

Use this procedure to upgrade a standalone Firepower Management Center, including Firepower Management Center Virtual.

Caution

Do not deploy changes to or from, manually reboot, or shut down an upgrading appliance. Do not restart an upgrade in progress. The upgrade process may appear inactive during prechecks; this is expected. If you encounter issues with the upgrade, including a failed upgrade or unresponsive appliance, contact Cisco TAC.

Before you begin

Check your place in the upgrade path, including hosting environment and managed device upgrades. Make sure you have fully planned and prepared for this step.

Procedure

Step 1

Deploy to managed devices whose configurations are out of date.

On the FMC menu bar, click Deploy. Choose devices, then click Deploy again. Deploying before you upgrade reduces the chance of failure.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts Snort, which interrupts traffic inspection and, depending on how your device handles traffic, may interrupt traffic until the restart completes. For more information, see Traffic Flow, Inspection, and Device Behavior.

Step 2

Perform final preupgrade checks.

- Check health: Use the Message Center (click the System Status icon on the menu bar). Make sure the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

- Running tasks: Also in the Message Center, make sure essential tasks are complete. Tasks running when the upgrade begins are stopped, become failed tasks, and cannot be resumed. You can manually delete failed status messages later.

- Check disk space: Perform a final disk space check. Without enough free disk space, the upgrade fails. For disk space requirements, see Time Tests and Disk Space Requirements.

Step 3

Choose System > Updates.

Step 4

Click the Install icon next to the upgrade package you want to use, then choose the FMC.

Step 5

Click Install to begin the upgrade.

Confirm that you want to upgrade and reboot the FMC.

Step 6

Monitor precheck progress in the Message Center until you are logged out.

Do not make configuration changes or deploy to any device while the FMC is upgrading. Even if the Message Center shows no progress for several minutes or indicates that the upgrade has failed, do not restart the upgrade or reboot the FMC. Instead, contact Cisco TAC.

Step 7

Log back into the FMC when you can.

- Minor upgrades (patches and hotfixes): You can log in after the upgrade completes and the FMC reboots.

- Major upgrades: You can log in before the upgrade completes. The FMC displays a page you can use to monitor the upgrade's progress and view the upgrade log and any error messages. You are logged out again when the upgrade completes and the FMC reboots. After the reboot, log back in again.

Step 8

If prompted, review and accept the End User License Agreement (EULA).

Step 9

Verify upgrade success.

If the FMC does not notify you of the upgrade's success when you log in, choose Help > About to display current software version information.

Step 10

Use the Message Center to recheck deployment health.

Step 11

Update intrusion rules (SRU) and the vulnerability database (VDB).

If the SRU or the VDB available on the Cisco Support & Downloads site is newer than the version currently running, install the newer version. For more information, see the Firepower Management Center Configuration Guide. Note that when you update intrusion rules, you do not need to automatically reapply policies. You will do that later.

Step 12

Complete any post-upgrade configuration changes described in the release notes.

Step 13

Redeploy configurations.

Redeploy to all managed devices. If you do not deploy to a device, its eventual upgrade may fail and you may have to reimage it.

Upgrade High Availability FMCs

Use this procedure to upgrade the Firepower software on Firepower Management Centers in a high availability pair.

You upgrade peers one at a time. With synchronization paused, first upgrade the standby, then the active. When the standby FMC starts prechecks, its status switches from standby to active, so that both peers are active. This temporary state is called split-brain and is not supported except during upgrade. Do not make or deploy configuration changes while the pair is split-brain. Your changes will be lost after you restart synchronization.

Caution

Do not deploy changes to or from, manually reboot, or shut down an upgrading appliance. Do not restart an upgrade in progress. The upgrade process may appear inactive during prechecks; this is expected. If you encounter issues with the upgrade, including a failed upgrade or unresponsive appliance, contact Cisco TAC.

Before you begin

Check your place in the upgrade path, including managed device upgrades. Make sure you have fully planned and prepared for this step.

Procedure

Step 1

On the active FMC, deploy to managed devices whose configurations are out of date.

On the FMC menu bar, click Deploy. Choose devices, then click Deploy again. Deploying before you upgrade reduces the chance of failure.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts Snort, which interrupts traffic inspection and, depending on how your device handles traffic, may interrupt traffic until the restart completes. For more information, see Traffic Flow, Inspection, and Device Behavior.

Step 2

Use the Message Center to check deployment health before you pause synchronization.

Click the System Status icon on the FMC menu bar to display the Message Center. Make sure the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Step 3

Pause synchronization.

1. Choose System > Integration.

2. On the High Availability tab, click Pause Synchronization.

Step 4

Upgrade the FMCs one at a time—first the standby, then the active.

Follow the instructions in Upgrade a Standalone FMC, but omit the initial deploy, and stop after you verify update success on each FMC. In summary, for each FMC:

1. Perform final preupgrade checks (health, running tasks, disk space).

2. On the System > Updates page, install the upgrade.

3. Monitor progress until you are logged out, then log back in when you can (this happens twice for major upgrades).

4. Verify upgrade success.

Do not make or deploy configuration changes while the pair is split-brain.

Step 5

On the FMC you want to make the active peer, restart synchronization.

1. Choose System > Integration.

2. On the High Availability tab, click Make-Me-Active.

3. Wait until synchronization restarts and the other FMC switches to standby mode.

Step 6

Use the Message Center to recheck deployment health.

Step 7

Update intrusion rules (SRU) and the vulnerability database (VDB).

If the SRU or the VDB available on the Cisco Support & Downloads site is newer than the version currently running, install the newer version. For more information, see the Firepower Management Center Configuration Guide. Note that when you update intrusion rules, you do not need to automatically reapply policies. You will do that later.

Step 8

Complete any post-upgrade configuration changes described in the release notes.

Step 9

Redeploy configurations.

Redeploy to all managed devices. If you do not deploy to a device, its eventual upgrade may fail and you may have to reimage it.

Chapter 8. Upgrade Firepower Threat Defense: Firepower 4100/9300

- Upgrade Checklist: FTD on Firepower 4100/9300 Chassis

- Upgrade Path: FTD on Firepower 4100/9300 Chassis

- Upgrade FXOS: Firepower 4100/9300 Chassis

- Upgrade FTD Software: Firepower 4100/9300 Chassis

Upgrade Checklist: FTD on Firepower 4100/9300 Chassis

Use this checklist to upgrade Firepower 4100/9300 chassis with FTD

Complete the checklist every time you upgrade. Skipping steps can result in an unsuccessful upgrade. At all times during the process, make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Plan the Upgrade

Maintain deployment compatibility at all times by correctly planning and following an upgrade path.

✓

Action/Check

Details

Verify Upgrade Path

Check your place in your upgrade path. Know which upgrade you just performed and which you are performing next.

Upgrade Path: FTD on Firepower 4100/9300 Chassis

Check Versions

Check current and target versions on the devices:

- Firepower software

- FXOS

Firepower 4100/9300 with FTD

Check FMC Compatibility

Check if the FMC will be able to manage the devices after you upgrade them. If not, revise your upgrade path so you upgrade the FMC first.

Can I Maintain FMC-Device Version Compatibility?

Read Release Notes

Read the release notes, paying special attention to the things that can affect upgrade, including:

- Version-specific upgrade guidelines and warnings.

- Known issues that affect upgrade.

- New/deprecated features and functionality.

Firepower Release Notes

and

FXOS Release Notes

Pre-Upgrade Actions and Checks

Minimize disruption by performing prechecks outside the maintenance window.

✓

Action/Check

Details

Make Required Configuration Changes

Make required pre-upgrade configuration changes, and be prepared to make required post-upgrade configuration changes.

Firepower Release Notes

and

FXOS Release Notes

Check Disk Space

Run a preliminary disk space check for the Firepower software upgrade.

Time Tests and Disk Space Requirements

Get FXOS Upgrade Package

Obtain the correct FXOS upgrade package.

FXOS for Firepower 4100/9300 Chassis Upgrade Packages

Get Firepower Software Upgrade Package

Obtain the correct Firepower software upgrade package. Do not untar signed (.tar) packages. You can either:

- Upload the package to the FMC.

- Configure an internal web server as the source for FTD upgrade packages. Requires Version 6.6.0.

Obtain Firepower Software Upgrade Packages

Check Bandwidth

Make sure you have the bandwidth to perform a large data transfer to your managed devices.

Guidelines for Downloading Data from the Firepower Management Center to Managed Devices (Troubleshooting TechNote)

Push Firepower Software Upgrade Package

Push the upgrade package to the devices. We strongly recommend (and sometimes require) you push before you begin the required companion FXOS upgrade. Requires Version 6.2.3+.

Push Upgrade Packages to FMC-Managed Devices

Run Firepower Software Readiness Check

Run a readiness check. Requires Version 6.1+.

Run Firepower Software Readiness Checks

Back Up Devices

Use the FMC to back up configuration data for supported FTD platforms (not all FTD platforms support backup). Back up to an external location and verify transfer success. Requires Version 6.3+.

Firepower Management Center Configuration Guide

Verify Appliance Access

Make sure your computer can connect to the FMC’s management interface and to the device’s management interface, both without traversing the device itself.

Appliance Access, Communication, and Health

Schedule Maintenance Window

Schedule a maintenance window when it will have the least impact, considering the tasks you must perform, the upgrade's effect on traffic flow and inspection, and the time the upgrade is likely to take.

FTD Upgrade Behavior: Firepower 4100/9300 Chassis

and

Time Tests and Disk Space Requirements

Upgrade the Devices

Because upgrades can cause interruptions in traffic flow or inspection, perform them in a maintenance window.

✓

Action/Check

Details

Upgrade FXOS

If needed, upgrade FXOS. To avoid interruptions in traffic flow and inspection, upgrade the chassis in high availability pairs and inter-chassis clusters one at a time.

Upgrade FXOS: Firepower 4100/9300 Chassis

Upgrade Firepower Software

Upgrade the Firepower software.

Upgrade FTD Software: Firepower 4100/9300 Chassis

Upgrade Path: FTD on Firepower 4100/9300 Chassis

This table provides upgrade paths for Firepower 4100/9300 chassis with FTD.

Find your current Firepower version in the left column. You can upgrade directly to the versions listed in the right column. If you cannot perform a direct upgrade from your current to the target version, your upgrade path must include intermediate versions. For an alternate way of looking at this information, see Is Direct Upgrade Possible?.

Direct Upgrades: Firepower 4100/9300 Chassis

Current Version

Target Version

6.7.0

6.7.x (maintenance releases)

Directly to:

→ Any later 6.7.x maintenance release

6.6.0

6.6.x (maintenance releases)

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ Any later 6.6.x maintenance release

6.5.0

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

6.4.0

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

6.3.0

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

→ 6.4.0

6.2.3

Directly to one of:

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

→ 6.4.0

→ 6.3.0

6.2.2

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

6.2.0

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

→ 6.2.2

6.1.0 *

Directly to one of:

→ 6.2.3

→ 6.2.0

6.0.1

Directly to:

→ 6.1.0

* Due to operating system incompatibilies, you cannot upgrade directly from Version 6.1 → 6.4 on a Firepower 4100/9300 series device. For similar reasons, we recommend that you not upgrade from Version 6.1 → 6.3. If you are running Version 6.1, we recommend upgrading to Version 6.2.3 on FXOS 2.3.1, and proceeding from there.

Upgrading FXOS

Major Firepower versions have a specially qualified companion FXOS version. Before you upgrade Firepower software, upgrade FXOS. In general, we recommend the latest FXOS build in the version sequence, but for required minimum builds see Firepower 4100/9300 with FTD.

FXOS Companion Versions

Firepower Version

FXOS Companion Version

6.7.0 and 6.7.x

2.9.1

6.6.0 and 6.6.x

2.8.1

6.5.0

2.7.1

6.4.0

2.6.1

6.3.0

2.4.1

6.2.3

2.3.1

6.2.2

2.2.2

6.2.0

2.1.1, 2.2.1, and 2.2.2

6.1.0

2.0.1

6.0.1

1.1.4

Although you upgrade the Firepower software on a device clusters or high availability pair as a unit, you upgrade FXOS on each chassis independently. This table outlines FXOS upgrade order for standalone and HA/scalability deployments. For more information, see Upgrade FXOS: Firepower 4100/9300 Chassis.

FXOS + FTD Upgrade Order

FTD Deployment

Upgrade Order

Standalone device

1. Upgrade FXOS.

2. Upgrade Firepower software.

High availability

To minimize disruption, always upgrade the standby.

1. Upgrade FXOS on the standby.

2. Switch roles.

3. Upgrade FXOS on the new standby.

4. Upgrade the Firepower software.

Intra-chassis cluster (Firepower 9300 only)

1. Upgrade FXOS.

2. Upgrade Firepower software.

Inter-chassis cluster (6.2+)

To minimize disruption, always upgrade an all-data unit chassis. For example, for a two-chassis cluster:

1. Upgrade FXOS on the all-data unit chassis.

2. Switch the control module to the chassis you just upgraded.

3. Upgrade FXOS on the new all-data unit chassis.

4. Upgrade Firepower software.

High Availability and Clustering Hitless Upgrade Requirements

Performing hitless upgrades have the following additional requirements.

Flow Offload: Due to bug fixes in the flow offload feature, some combinations of FXOS and FTD do not support flow offload; see the Cisco Firepower Compatibility Guide. To perform a hitless upgrade in a high availability or clustered deployment, you must make sure you are always running a compatible combination.

If your upgrade path includes upgrading FXOS to 2.2.2.91, 2.3.1.130, or later (including FXOS 2.4.1.x, 2.6.1.x, and so on) use this path:

1. Upgrade FTD to 6.2.2.2 or later.

2. Upgrade FXOS to 2.2.2.91, 2.3.1.130, or later.

3. Upgrade FTD to your final version.

For example, if you are running FXOS 2.2.2.17/FTD 6.2.2.0, and you want to upgrade to FXOS 2.6.1/FTD 6.4.0, then you can:

1. Upgrade FTD to 6.2.2.5.

2. Upgrade FXOS to 2.6.1.

3. Upgrade FTD to 6.4.0.

Version 6.1.0 Upgrades: Performing a hitless upgrade of an FTD high availability pair to Version 6.1.0 requires a preinstallation package. For more information, see Firepower System Release Notes Version 6.1.0 Preinstallation Package.

Upgrade FXOS: Firepower 4100/9300 Chassis

On the Firepower 4100/9300 chassis, you upgrade the FXOS operating system separately from the Firepower software. You upgrade FXOS on each chassis independently, even if you have Firepower inter-chassis clustering or high availability pairs configured.

Major Firepower versions have a companion FXOS version. You must be running that companion version of FXOS before you upgrade the Firepower software on the Firepower 4100/9300 chassis.

Upgrading FXOS reboots the chassis. Depending on your deployment, traffic can either drop or traverse the network without inspection; see FTD Upgrade Behavior: Firepower 4100/9300 Chassis.

- FXOS for Firepower 4100/9300 Chassis Upgrade Packages

- Upgrade FXOS for Standalone FTD Logical Devices or an FTD Intra-chassis Cluster

- Upgrade FXOS on a Firepower Threat Defense High Availability Pair

- Upgrade FXOS on a Firepower Threat Defense Inter-chassis Cluster

FXOS for Firepower 4100/9300 Chassis Upgrade Packages

For FXOS upgrade packages for the Firepower 4100/9300 chassis, browse to:

- Firepower 4100 series: http://www.cisco.com/go/firepower4100-software

- Firepower 9300: http://www.cisco.com/go/firepower9300-software

Choose your model > Firepower Extensible Operating System > version.

FXOS Upgrade Packages

Package Type

Package Name

FXOS image

fxos-k9.version.SPA

Recovery (kickstart)

fxos-k9-kickstart.version.SPA

Recovery (manager)

fxos-k9-manager.version.SPA

Recovery (system)

fxos-k9-system.version.SPA

MIBs

fxos-mibs-fp9k-fp4k.version.zip

Firmware: Firepower 4100 series

fxos-k9-fpr4k-firmware.version.SPA

Firmware: Firepower 9300

fxos-k9-fpr9k-firmware.version.SPA

Upgrade FXOS for Standalone FTD Logical Devices or an FTD Intra-chassis Cluster

Use the FXOS CLI or Firepower Chassis Manager to upgrade the FXOS platform bundle on a Firepower 4100/9300 Series security appliance that has standalone or intra-chassis clustered Firepower Threat Defense logical devices installed on the appliance.

- Upgrade FXOS for Standalone FTD Logical Devices or an FTD Intra-chassis Cluster Using Firepower Chassis Manager

- Upgrade FXOS for Standalone FTD Logical Devices or an FTD Intra-chassis Cluster Using the FXOS CLI

Upgrade FXOS for Standalone FTD Logical Devices or an FTD Intra-chassis Cluster Using Firepower Chassis Manager

This section describes how to upgrade the FXOS platform bundle for a standalone Firepower 4100/9300 chassis.

The section describes the upgrade process for the following types of devices:

- A Firepower 4100 series chassis that is configured with a FTD logical device and is not part of a failover pair or inter-chassis cluster.

- A Firepower 9300 chassis that is configured with one or more standalone FTD logical devices that are not part of a failover pair or inter-chassis cluster.

- A Firepower 9300 chassis that is configured with FTD logical devices in an intra-chassis cluster.

Before you begin

Before beginning your upgrade, make sure that you have already done the following:

- Download the FXOS platform bundle software package to which you are upgrading (see FXOS for Firepower 4100/9300 Chassis Upgrade Packages).

- Back up your FXOS and FTD configurations.

Note

The upgrade process typically takes between 20 and 30 minutes. Traffic will not traverse through the device while it is upgrading.

Procedure

Step 1

In Firepower Chassis Manager, choose System > Updates.

The Available Updates page shows a list of the Firepower eXtensible Operating System platform bundle images and application images that are available on the chassis.

Step 2

Upload the new platform bundle image:

1. Click Upload Image to open the Upload Image dialog box.

2. Click Choose File to navigate to and select the image that you want to upload.

3. Click Upload.

The selected image is uploaded to the Firepower 4100/9300 chassis.

4. For certain software images you will be presented with an end-user license agreement after uploading the image. Follow the system prompts to accept the end-user license agreement.

Step 3

After the new platform bundle image has been successfully uploaded, click Upgrade for the FXOS platform bundle to which you want to upgrade.

The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade.

Step 4

Click Yes to confirm that you want to proceed with installation, or click No to cancel the installation.

The Firepower eXtensible Operating System unpacks the bundle and upgrades/reloads the components. The upgrade process can take up to 30 minutes to complete.

Step 5

Firepower Chassis Manager will be unavailable during upgrade. You can monitor the upgrade process using the FXOS CLI:

1. Enter scope system .

2. Enter show firmware monitor .

3. Wait for all components (FPRM, Fabric Interconnect, and Chassis) to show Upgrade-Status: Ready.

Note

After the FPRM component is upgraded, the system will reboot and then continue upgrading the other components.

Example:

FP9300-A# scope system
FP9300-A /system # show firmware monitor
FPRM:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Fabric Interconnect A:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Chassis 1:
Server 1:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready
Server 2:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Step 6

After all components have successfully upgraded, enter the following commands to verify the status of the security modules/security engine and any installed applications:

1. Enter top .

2. Enter scope ssa .

3. Enter show slot .

4. Verify that the Admin State is Ok and the Oper State is Online for the security engine on a Firepower 4100 series appliance or for any security modules installed on a Firepower 9300 appliance.

5. Enter show app-instance .

6. Verify that the Oper State is Online for any logical devices installed on the chassis.

Upgrade FXOS for Standalone FTD Logical Devices or an FTD Intra-chassis Cluster Using the FXOS CLI

This section describes how to upgrade the FXOS platform bundle for a standalone Firepower 4100/9300 chassis.

The section describes the FXOS upgrade process for the following types of devices:

- A Firepower 4100 series chassis that is configured with a FTD logical device and is not part of a failover pair or inter-chassis cluster.

- A Firepower 9300 chassis that is configured with one or more standalone FTD devices that are not part of a failover pair or inter-chassis cluster.

- A Firepower 9300 chassis that is configured with FTD logical devices in an intra-chassis cluster.

Before you begin

Before beginning your upgrade, make sure that you have already done the following:

- Download the FXOS platform bundle software package to which you are upgrading (see FXOS for Firepower 4100/9300 Chassis Upgrade Packages).

- Back up your FXOS and FTD configurations.

- Collect the following information that you will need to download the software image to the Firepower 4100/9300 chassis:

- IP address and authentication credentials for the server from which you are copying the image.

- Fully qualified name of the image file.

Note

The upgrade process typically takes between 20 and 30 minutes. Traffic will not traverse through the device while it is upgrading.

Procedure

Step 1

Connect to the FXOS CLI.

Step 2

Download the new platform bundle image to the Firepower 4100/9300 chassis:

1. Enter firmware mode:

Firepower-chassis-a # scope firmware

2. Download the FXOS platform bundle software image:

Firepower-chassis-a /firmware # download image URL

Specify the URL for the file being imported using one of the following syntax:

- ftp://username@hostname/ path/ image_name

- scp://username@hostname/ path/ image_name

- sftp://username@hostname/ path/ image_name

- tftp://hostname: port-num/ path/ image_name

3. To monitor the download process:

Firepower-chassis-a /firmware # scope download-task image_name

Firepower-chassis-a /firmware/download-task # show detail

Example:

The following example copies an image using the SCP protocol:

Firepower-chassis-a # scope firmware
Firepower-chassis-a /firmware # download image scp://user@192.168.1.1/images/fxos-k9.2.3.1.58.SPA
Firepower-chassis-a /firmware # scope download-task fxos-k9.2.3.1.58.SPA
Firepower-chassis-a /firmware/download-task # show detail
Download task:
File Name: fxos-k9.2.3.1.58.SPA
Protocol: scp
Server: 192.168.1.1
Userid:
Path:
Downloaded Image Size (KB): 853688
State: Downloading
Current Task: downloading image fxos-k9.2.3.1.58.SPA from 192.168.1.1(FSM-STAGE:sam:dme:FirmwareDownloaderDownload:Local)

Step 3

If necessary, return to firmware mode:

Firepower-chassis-a /firmware/download-task # up

Step 4

Enter auto-install mode:

Firepower-chassis-a /firmware # scope auto-install

Step 5

Install the FXOS platform bundle:

Firepower-chassis-a /firmware/auto-install # install platform platform-vers version_number

version_number is the version number of the FXOS platform bundle you are installing--for example, 2.3(1.58).

Step 6

The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade.

Enter yes to confirm that you want to proceed with verification.

Step 7

Enter yes to confirm that you want to proceed with installation, or enter no to cancel the installation.

The Firepower eXtensible Operating System unpacks the bundle and upgrades/reloads the components.

Step 8

To monitor the upgrade process:

1. Enter scope system .

2. Enter show firmware monitor .

3. Wait for all components (FPRM, Fabric Interconnect, and Chassis) to show Upgrade-Status: Ready.

Note

After the FPRM component is upgraded, the system will reboot and then continue upgrading the other components.

Example:

FP9300-A# scope system
FP9300-A /system # show firmware monitor
FPRM:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Fabric Interconnect A:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Chassis 1:
Server 1:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready
Server 2:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

FP9300-A /system #

Step 9

After all components have successfully upgraded, enter the following commands to verify the status of the security modules/security engine and any installed applications:

1. Enter top .

2. Enter scope ssa .

3. Enter show slot .

4. Verify that the Admin State is Ok and the Oper State is Online for the security engine on a Firepower 4100 series appliance or for any security modules installed on a Firepower 9300 appliance.

5. Enter show app-instance .

6. Verify that the Oper State is Online for any logical devices installed on the chassis.

Upgrade FXOS on a Firepower Threat Defense High Availability Pair

Use the FXOS CLI or Firepower Chassis Manager to upgrade the FXOS platform bundle on Firepower 4100/9300 Series security appliances with Firepower Threat Defense logical devices configured as a high availability pair.

- Upgrade FXOS on a FTD High Availability Pair Using Firepower Chassis Manager

- Upgrade FXOS on an FTD High Availability Pair Using the FXOS CLI

Upgrade FXOS on a FTD High Availability Pair Using Firepower Chassis Manager

If you have Firepower 9300 or Firepower 4100 series security appliances that have FTD logical devices configured as a high availability pair, use the following procedure to update the FXOS platform bundle on your Firepower 9300 or Firepower 4100 series security appliances:

Before you begin

Before beginning your upgrade, make sure that you have already done the following:

- Download the FXOS platform bundle software package to which you are upgrading (see FXOS for Firepower 4100/9300 Chassis Upgrade Packages).

- Back up your FXOS and FTD configurations.

Note

The upgrade process typically takes between 20 and 30 minutes per chassis.

Procedure

Step 1

Connect to Firepower Chassis Manager on the Firepower security appliance that contains the standby Firepower Threat Defense logical device:

Step 2

In Firepower Chassis Manager, choose System > Updates.

The Available Updates page shows a list of the Firepower eXtensible Operating System platform bundle images and application images that are available on the chassis.

Step 3

Upload the new platform bundle image:

1. Click Upload Image to open the Upload Image dialog box.

2. Click Choose File to navigate to and select the image that you want to upload.

3. Click Upload.

The selected image is uploaded to the Firepower 4100/9300 chassis.

4. For certain software images you will be presented with an end-user license agreement after uploading the image. Follow the system prompts to accept the end-user license agreement.

Step 4

After the new platform bundle image has successfully uploaded, click Upgrade for the FXOS platform bundle to which you want to upgrade.

The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade.

Step 5

Click Yes to confirm that you want to proceed with installation, or click No to cancel the installation.

The Firepower eXtensible Operating System unpacks the bundle and upgrades/reloads the components. The upgrade process can take up to 30 minutes to complete.

Step 6

Firepower Chassis Manager will be unavailable during upgrade. You can monitor the upgrade process using the FXOS CLI:

1. Enter scope system .

2. Enter show firmware monitor .

3. Wait for all components (FPRM, Fabric Interconnect, and Chassis) to show Upgrade-Status: Ready.

Note

After the FPRM component is upgraded, the system will reboot and then continue upgrading the other components.

Example:

FP9300-A# scope system
FP9300-A /system # show firmware monitor
FPRM:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Fabric Interconnect A:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Chassis 1:
Server 1:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready
Server 2:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Step 7

After all components have successfully upgraded, enter the following commands to verify the status of the security modules/security engine and any installed applications:

1. Enter top .

2. Enter scope ssa .

3. Enter show slot .

4. Verify that the Admin State is Ok and the Oper State is Online for the security engine on a Firepower 4100 series appliance or for any security modules installed on a Firepower 9300 appliance.

5. Enter show app-instance .

6. Verify that the Oper State is Online for any logical devices installed on the chassis.

Step 8

Make the unit that you just upgraded the active unit so that traffic flows to the upgraded unit:

1. Connect to Firepower Management Center.

2. Choose Devices > Device Management.

3. Next to the high availability pair where you want to change the active peer, click the Switch Active Peer icon ().

4. Click Yes to immediately make the standby device the active device in the high availability pair.

Step 9

Connect to Firepower Chassis Manager on the Firepower security appliance that contains the new standby Firepower Threat Defense logical device:

Step 10

In Firepower Chassis Manager, choose System > Updates.

The Available Updates page shows a list of the Firepower eXtensible Operating System platform bundle images and application images that are available on the chassis.

Step 11

Upload the new platform bundle image:

1. Click Upload Image to open the Upload Image dialog box.

2. Click Choose File to navigate to and select the image that you want to upload.

3. Click Upload.

The selected image is uploaded to the Firepower 4100/9300 chassis.

4. For certain software images you will be presented with an end-user license agreement after uploading the image. Follow the system prompts to accept the end-user license agreement.

Step 12

After the new platform bundle image has successfully uploaded, click Upgrade for the FXOS platform bundle to which you want to upgrade.

The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade.

Step 13

Click Yes to confirm that you want to proceed with installation, or click No to cancel the installation.

The Firepower eXtensible Operating System unpacks the bundle and upgrades/reloads the components. The upgrade process can take up to 30 minutes to complete.

Step 14

Firepower Chassis Manager will be unavailable during upgrade. You can monitor the upgrade process using the FXOS CLI:

1. Enter scope system .

2. Enter show firmware monitor .

3. Wait for all components (FPRM, Fabric Interconnect, and Chassis) to show Upgrade-Status: Ready.

Note

After the FPRM component is upgraded, the system will reboot and then continue upgrading the other components.

Example:

FP9300-A# scope system
FP9300-A /system # show firmware monitor
FPRM:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Fabric Interconnect A:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Chassis 1:
Server 1:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready
Server 2:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Step 15

After all components have successfully upgraded, enter the following commands to verify the status of the security modules/security engine and any installed applications:

1. Enter top .

2. Enter scope ssa .

3. Enter show slot .

4. Verify that the Admin State is Ok and the Oper State is Online for the security engine on a Firepower 4100 series appliance or for any security modules installed on a Firepower 9300 appliance.

5. Enter show app-instance .

6. Verify that the Oper State is Online for any logical devices installed on the chassis.

Step 16

Make the unit that you just upgraded the active unit as it was before the upgrade:

1. Connect to Firepower Management Center.

2. Choose Devices > Device Management.

3. Next to the high availability pair where you want to change the active peer, click the Switch Active Peer icon ().

4. Click Yes to immediately make the standby device the active device in the high availability pair.

Upgrade FXOS on an FTD High Availability Pair Using the FXOS CLI

If you have Firepower 9300 or Firepower 4100 series security appliances that have FTD logical devices configured as a high availability pair, use the following procedure to update the FXOS platform bundle on your Firepower 9300 or Firepower 4100 series security appliances:

Before you begin

Before beginning your upgrade, make sure that you have already done the following:

- Download the FXOS platform bundle software package to which you are upgrading (see FXOS for Firepower 4100/9300 Chassis Upgrade Packages).

- Back up your FXOS and FTD configurations.

- Collect the following information that you will need to download the software image to the Firepower 4100/9300 chassis:

- IP address and authentication credentials for the server from which you are copying the image.

- Fully qualified name of the image file.

Note

The upgrade process typically takes between 20 and 30 minutes per chassis.

Procedure

Step 1

Connect to FXOS CLI on the Firepower security appliance that contains the standby Firepower Threat Defense logical device:

Step 2

Download the new platform bundle image to the Firepower 4100/9300 chassis:

1. Enter firmware mode:

Firepower-chassis-a # scope firmware

2. Download the FXOS platform bundle software image:

Firepower-chassis-a /firmware # download image URL

Specify the URL for the file being imported using one of the following syntax:

- ftp://username@hostname/ path/ image_name

- scp://username@hostname/ path/ image_name

- sftp://username@hostname/ path/ image_name

- tftp://hostname: port-num/ path/ image_name

3. To monitor the download process:

Firepower-chassis-a /firmware # scope download-task image_name

Firepower-chassis-a /firmware/download-task # show detail

Example:

The following example copies an image using the SCP protocol:

Firepower-chassis-a # scope firmware
Firepower-chassis-a /firmware # download image scp://user@192.168.1.1/images/fxos-k9.2.3.1.58.SPA
Firepower-chassis-a /firmware # scope download-task fxos-k9.2.3.1.58.SPA
Firepower-chassis-a /firmware/download-task # show detail
Download task:
File Name: fxos-k9.2.3.1.58.SPA
Protocol: scp
Server: 192.168.1.1
Userid:
Path:
Downloaded Image Size (KB): 853688
State: Downloading
Current Task: downloading image fxos-k9.2.3.1.58.SPA from 192.168.1.1(FSM-STAGE:sam:dme:FirmwareDownloaderDownload:Local)

Step 3

If necessary, return to firmware mode:

Firepower-chassis-a /firmware/download-task # up

Step 4

Enter auto-install mode:

Firepower-chassis-a /firmware # scope auto-install

Step 5

Install the FXOS platform bundle:

Firepower-chassis-a /firmware/auto-install # install platform platform-vers version_number

version_number is the version number of the FXOS platform bundle you are installing--for example, 2.3(1.58).

Step 6

The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade.

Enter yes to confirm that you want to proceed with verification.

Step 7

Enter yes to confirm that you want to proceed with installation, or enter no to cancel the installation.

The Firepower eXtensible Operating System unpacks the bundle and upgrades/reloads the components.

Step 8

To monitor the upgrade process:

1. Enter scope system .

2. Enter show firmware monitor .

3. Wait for all components (FPRM, Fabric Interconnect, and Chassis) to show Upgrade-Status: Ready.

Note

After the FPRM component is upgraded, the system will reboot and then continue upgrading the other components.

Example:

FP9300-A# scope system
FP9300-A /system # show firmware monitor
FPRM:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Fabric Interconnect A:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Chassis 1:
Server 1:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready
Server 2:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

FP9300-A /system #

Step 9

After all components have successfully upgraded, enter the following commands to verify the status of the security modules/security engine and any installed applications:

1. Enter top .

2. Enter scope ssa .

3. Enter show slot .

4. Verify that the Admin State is Ok and the Oper State is Online for the security engine on a Firepower 4100 series appliance or for any security modules installed on a Firepower 9300 appliance.

5. Enter show app-instance .

6. Verify that the Oper State is Online for any logical devices installed on the chassis.

Step 10

Make the unit that you just upgraded the active unit so that traffic flows to the upgraded unit:

1. Connect to Firepower Management Center.

2. Choose Devices > Device Management.

3. Next to the high availability pair where you want to change the active peer, click the Switch Active Peer icon ().

4. Click Yes to immediately make the standby device the active device in the high availability pair.

Step 11

Connect to FXOS CLI on the Firepower security appliance that contains the new standby Firepower Threat Defense logical device:

Step 12

Download the new platform bundle image to the Firepower 4100/9300 chassis:

1. Enter firmware mode:

Firepower-chassis-a # scope firmware

2. Download the FXOS platform bundle software image:

Firepower-chassis-a /firmware # download image URL

Specify the URL for the file being imported using one of the following syntax:

- ftp://username@hostname/ path/ image_name

- scp://username@hostname/ path/ image_name

- sftp://username@hostname/ path/ image_name

- tftp://hostname: port-num/ path/ image_name

3. To monitor the download process:

Firepower-chassis-a /firmware # scope download-task image_name

Firepower-chassis-a /firmware/download-task # show detail

Example:

The following example copies an image using the SCP protocol:

Firepower-chassis-a # scope firmware
Firepower-chassis-a /firmware # download image scp://user@192.168.1.1/images/fxos-k9.2.3.1.58.SPA
Firepower-chassis-a /firmware # scope download-task fxos-k9.2.3.1.58.SPA
Firepower-chassis-a /firmware/download-task # show detail
Download task:
File Name: fxos-k9.2.3.1.58.SPA
Protocol: scp
Server: 192.168.1.1
Userid:
Path:
Downloaded Image Size (KB): 853688
State: Downloading
Current Task: downloading image fxos-k9.2.3.1.58.SPA from 192.168.1.1(FSM-STAGE:sam:dme:FirmwareDownloaderDownload:Local)

Step 13

If necessary, return to firmware mode:

Firepower-chassis-a /firmware/download-task # up

Step 14

Enter auto-install mode:

Firepower-chassis-a /firmware # scope auto-install

Step 15

Install the FXOS platform bundle:

Firepower-chassis-a /firmware/auto-install # install platform platform-vers version_number

version_number is the version number of the FXOS platform bundle you are installing--for example, 2.3(1.58).

Step 16

The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade.

Enter yes to confirm that you want to proceed with verification.

Step 17

Enter yes to confirm that you want to proceed with installation, or enter no to cancel the installation.

The Firepower eXtensible Operating System unpacks the bundle and upgrades/reloads the components.

Step 18

To monitor the upgrade process:

1. Enter scope system .

2. Enter show firmware monitor .

3. Wait for all components (FPRM, Fabric Interconnect, and Chassis) to show Upgrade-Status: Ready.

Note

After the FPRM component is upgraded, the system will reboot and then continue upgrading the other components.

Example:

FP9300-A# scope system
FP9300-A /system # show firmware monitor
FPRM:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Fabric Interconnect A:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Chassis 1:
Server 1:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready
Server 2:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

FP9300-A /system #

Step 19

After all components have successfully upgraded, enter the following commands to verify the status of the security modules/security engine and any installed applications:

1. Enter top .

2. Enter scope ssa .

3. Enter show slot .

4. Verify that the Admin State is Ok and the Oper State is Online for the security engine on a Firepower 4100 series appliance or for any security modules installed on a Firepower 9300 appliance.

5. Enter show app-instance .

6. Verify that the Oper State is Online for any logical devices installed on the chassis.

Step 20

Make the unit that you just upgraded the active unit as it was before the upgrade:

1. Connect to Firepower Management Center.

2. Choose Devices > Device Management.

3. Next to the high availability pair where you want to change the active peer, click the Switch Active Peer icon ().

4. Click Yes to immediately make the standby device the active device in the high availability pair.

Upgrade FXOS on a Firepower Threat Defense Inter-chassis Cluster

Use the FXOS CLI or Firepower Chassis Manager to upgrade the FXOS platform bundle on Firepower 4100/9300 Series security appliances with Firepower Threat Defense logical devices configured as an inter-chassis cluster.

- Upgrade FXOS on an FTD Inter-chassis Cluster Using Firepower Chassis Manager

- Upgrade FXOS on a FTD Inter-chassis Cluster Using the FXOS CLI

Upgrade FXOS on an FTD Inter-chassis Cluster Using Firepower Chassis Manager

If you have Firepower 9300 or Firepower 4100 series security appliances that have FTD logical devices configured as an inter-chassis cluster, use the following procedure to update the FXOS platform bundle on your Firepower 9300 or Firepower 4100 series security appliances:

Before you begin

Before beginning your upgrade, make sure that you have already done the following:

- Download the FXOS platform bundle software package to which you are upgrading (see FXOS for Firepower 4100/9300 Chassis Upgrade Packages).

- Back up your FXOS and FTD configurations.

Note

The upgrade process typically takes between 20 and 30 minutes per chassis.

Procedure

Step 1

Enter the following commands to verify the status of the security modules/security engine and any installed applications:

1. Connect to the FXOS CLI on Chassis #2 (this should be a chassis that does not have the control unit).

2. Enter top .

3. Enter scope ssa .

4. Enter show slot .

5. Verify that the Admin State is Ok and the Oper State is Online for the security engine on a Firepower 4100 series appliance or for any security modules installed on a Firepower 9300 appliance.

6. Enter show app-instance .

7. Verify that the Oper State is Online and that the Cluster State is In Cluster for any logical devices installed on the chassis. Also verify that the correct FTD software version is shown as the Running Version.

Note

Verify that the control unit is not on this chassis. There should not be any Firepower Threat Defense instance with Cluster Role set to Master.

8. For any security modules installed on a Firepower 9300 appliance or for the security engine on a Firepower 4100 series appliance, verify that the FXOS version is correct:

scope server 1/slot_id , where slot_id is 1 for a Firepower 4100 series security engine.

show version .

Step 2

Connect to Firepower Chassis Manager on Chassis #2 (this should be a chassis that does not have the control unit).

Step 3

In Firepower Chassis Manager, choose System > Updates.

The Available Updates page shows a list of the Firepower eXtensible Operating System platform bundle images and application images that are available on the chassis.

Step 4

Upload the new platform bundle image:

1. Click Upload Image to open the Upload Image dialog box.

2. Click Choose File to navigate to and select the image that you want to upload.

3. Click Upload.

The selected image is uploaded to the Firepower 4100/9300 chassis.

4. For certain software images you will be presented with an end-user license agreement after uploading the image. Follow the system prompts to accept the end-user license agreement.

Step 5

After the new platform bundle image has successfully uploaded, click Upgrade for the FXOS platform bundle to which you want to upgrade.

The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade.

Step 6

Click Yes to confirm that you want to proceed with installation, or click No to cancel the installation.

The Firepower eXtensible Operating System unpacks the bundle and upgrades/reloads the components. The upgrade process can take up to 30 minutes to complete.

Step 7

Firepower Chassis Manager will be unavailable during upgrade. You can monitor the upgrade process using the FXOS CLI:

1. Enter scope system .

2. Enter show firmware monitor .

3. Wait for all components (FPRM, Fabric Interconnect, and Chassis) to show Upgrade-Status: Ready.

Note

After the FPRM component is upgraded, the system will reboot and then continue upgrading the other components.

4. Enter top .

5. Enter scope ssa .

6. Enter show slot .

7. Verify that the Admin State is Ok and the Oper State is Online for the security engine on a Firepower 4100 series appliance or for any security modules installed on a Firepower 9300 appliance.

8. Enter show app-instance .

9. Verify that the Oper State is Online, that the Cluster State is In Cluster and that the Cluster Role is Slave for any logical devices installed on the chassis.

Example:

FP9300-A# scope system
FP9300-A /system # show firmware monitor
FPRM:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Fabric Interconnect A:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Chassis 1:
Server 1:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready
Server 2:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

FP9300-A /system #
FP9300-A /system # top
FP9300-A# scope ssa
FP9300-A /ssa # show slot

Slot:
Slot ID    Log Level Admin State  Oper State
---------- --------- ------------ ----------
1          Info      Ok           Online
2          Info      Ok           Online
3          Info      Ok           Not Available
FP9300-A /ssa #

FP9300-A /ssa # show app-instance
App Name   Slot ID    Admin State Oper State       Running Version Startup Version Profile Name Cluster State   Cluster Role
---------- ---------- ----------- ---------------- --------------- --------------- ------------ --------------- ------------
ftd        1          Enabled     Online           6.2.2.81        6.2.2.81                     In Cluster      Slave
ftd        2          Enabled     Online           6.2.2.81        6.2.2.81                     In Cluster      Slave
ftd        3          Disabled    Not Available                    6.2.2.81                     Not Applicable  None
FP9300-A /ssa #

Step 8

Set one of the security modules on Chassis #2 as control.

After setting one of the security modules on Chassis #2 to control, Chassis #1 no longer contains the control unit and can now be upgraded.

Step 9

Repeat Steps 1-7 for all other Chassis in the cluster.

Step 10

To return the control role to Chassis #1, set one of the security modules on Chassis #1 as control.

Upgrade FXOS on a FTD Inter-chassis Cluster Using the FXOS CLI

If you have Firepower 9300 or Firepower 4100 series security appliances with FTD logical devices configured as an inter-chassis cluster, use the following procedure to update the FXOS platform bundle on your Firepower 9300 or Firepower 4100 series security appliances:

Before you begin

Before beginning your upgrade, make sure that you have already done the following:

- Download the FXOS platform bundle software package to which you are upgrading (see FXOS for Firepower 4100/9300 Chassis Upgrade Packages).

- Back up your FXOS and FTD configurations.

- Collect the following information that you will need to download the software image to the Firepower 4100/9300 chassis:

- IP address and authentication credentials for the server from which you are copying the image.

- Fully qualified name of the image file.

Note

The upgrade process typically takes between 20 and 30 minutes per chassis.

Procedure

Step 1

Connect to the FXOS CLI on Chassis #2 (this should be a chassis that does not have the control unit).

Step 2

Enter the following commands to verify the status of the security modules/security engine and any installed applications:

1. Enter top .

2. Enter scope ssa .

3. Enter show slot .

4. Verify that the Admin State is Ok and the Oper State is Online for the security engine on a Firepower 4100 series appliance or for any security modules installed on a Firepower 9300 appliance.

5. Enter show app-instance .

6. Verify that the Oper State is Online and that the Cluster State is In Cluster for any logical devices installed on the chassis. Also verify that the correct FTD software version is shown as the Running Version.

Note

Verify that the control unit is not on this chassis. There should not be any Firepower Threat Defense instance with Cluster Role set to Master.

7. For any security modules installed on a Firepower 9300 appliance or for the security engine on a Firepower 4100 series appliance, verify that the FXOS version is correct:

scope server 1/slot_id , where slot_id is 1 for a Firepower 4100 series security engine.

show version .

Step 3

Download the new platform bundle image to the Firepower 4100/9300 chassis:

1. Enter top .

2. Enter firmware mode:

Firepower-chassis-a # scope firmware

3. Download the FXOS platform bundle software image:

Firepower-chassis-a /firmware # download image URL

Specify the URL for the file being imported using one of the following syntax:

- ftp://username@hostname/ path/ image_name

- scp://username@hostname/ path/ image_name

- sftp://username@hostname/ path/ image_name

- tftp://hostname: port-num/ path/ image_name

4. To monitor the download process:

Firepower-chassis-a /firmware # scope download-task image_name

Firepower-chassis-a /firmware/download-task # show detail

Example:

The following example copies an image using the SCP protocol:

Firepower-chassis-a # scope firmware
Firepower-chassis-a /firmware # download image scp://user@192.168.1.1/images/fxos-k9.2.3.1.58.SPA
Firepower-chassis-a /firmware # scope download-task fxos-k9.2.3.1.58.SPA
Firepower-chassis-a /firmware/download-task # show detail
Download task:
File Name: fxos-k9.2.3.1.58.SPA
Protocol: scp
Server: 192.168.1.1
Userid:
Path:
Downloaded Image Size (KB): 853688
State: Downloading
Current Task: downloading image fxos-k9.2.3.1.58.SPA from 192.168.1.1(FSM-STAGE:sam:dme:FirmwareDownloaderDownload:Local)

Step 4

If necessary, return to firmware mode:

Firepower-chassis-a /firmware/download-task # up

Step 5

Enter auto-install mode:

Firepower-chassis /firmware # scope auto-install

Step 6

Install the FXOS platform bundle:

Firepower-chassis /firmware/auto-install # install platform platform-vers version_number

version_number is the version number of the FXOS platform bundle you are installing—for example, 2.3(1.58).

Step 7

The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade.

Enter yes to confirm that you want to proceed with verification.

Step 8

Enter yes to confirm that you want to proceed with installation, or enter no to cancel the installation.

The Firepower eXtensible Operating System unpacks the bundle and upgrades/reloads the components.

Step 9

To monitor the upgrade process:

1. Enter scope system .

2. Enter show firmware monitor .

3. Wait for all components (FPRM, Fabric Interconnect, and Chassis) to show Upgrade-Status: Ready.

Note

After the FPRM component is upgraded, the system will reboot and then continue upgrading the other components.

4. Enter top .

5. Enter scope ssa .

6. Enter show slot .

7. Verify that the Admin State is Ok and the Oper State is Online for the security engine on a Firepower 4100 series appliance or for any security modules installed on a Firepower 9300 appliance.

8. Enter show app-instance .

9. Verify that the Oper State is Online, that the Cluster State is In Cluster and that the Cluster Role is Slave for any logical devices installed on the chassis.

Example:

FP9300-A# scope system
FP9300-A /system # show firmware monitor
FPRM:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Fabric Interconnect A:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

Chassis 1:
Server 1:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready
Server 2:
Package-Vers: 2.3(1.58)
Upgrade-Status: Ready

FP9300-A /system #
FP9300-A /system # top
FP9300-A# scope ssa
FP9300-A /ssa # show slot

Slot:
Slot ID    Log Level Admin State  Oper State
---------- --------- ------------ ----------
1          Info      Ok           Online
2          Info      Ok           Online
3          Info      Ok           Not Available
FP9300-A /ssa #

FP9300-A /ssa # show app-instance
App Name   Slot ID    Admin State Oper State       Running Version Startup Version Profile Name Cluster State   Cluster Role
---------- ---------- ----------- ---------------- --------------- --------------- ------------ --------------- ------------
ftd        1          Enabled     Online           6.2.2.81        6.2.2.81                     In Cluster      Slave
ftd        2          Enabled     Online           6.2.2.81        6.2.2.81                     In Cluster      Slave
ftd        3          Disabled    Not Available                    6.2.2.81                     Not Applicable  None
FP9300-A /ssa #

Step 10

Set one of the security modules on Chassis #2 as control.

After setting one of the security modules on Chassis #2 to control, Chassis #1 no longer contains the control unit and can now be upgraded.

Step 11

Repeat Steps 1-9 for all other Chassis in the cluster.

Step 12

To return the control role to Chassis #1, set one of the security modules on Chassis #1 as control.

Upgrade FTD Software: Firepower 4100/9300 Chassis

Use this procedure to upgrade the FTD software on the Firepower 4100/9300 chassis. You can upgrade multiple devices at once. You must upgrade the members of device clusters and high availability pairs at the same time.

Caution

Do not deploy changes to or from, manually reboot, or shut down an upgrading appliance. Do not restart an upgrade in progress. The upgrade process may appear inactive during prechecks; this is expected. If you encounter issues with the upgrade, including a failed upgrade or unresponsive appliance, contact Cisco TAC.

Before you begin

Check your place in the upgrade path, including FXOS and FMC upgrades. Make sure you have fully planned and prepared for this step.

Procedure

Step 1

Deploy configurations to the devices you are about to upgrade.

On the FMC menu bar, click Deploy. Choose devices, then click Deploy again. Deploying before you upgrade reduces the chance of failure.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts Snort, which interrupts traffic inspection and, depending on how your device handles traffic, may interrupt traffic until the restart completes. For more information, see FTD Upgrade Behavior: Firepower 4100/9300 Chassis.

Step 2

Perform final preupgrade checks.

- Check health: Use the Message Center (click the System Status icon on the menu bar). Make sure the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

- Running tasks: Also in the Message Center, make sure essential tasks are complete. Tasks running when the upgrade begins are stopped, become failed tasks, and cannot be resumed. You can manually delete failed status messages later.

- Check disk space: Perform a final disk space check. Without enough free disk space, the upgrade fails. For disk space requirements, see Time Tests and Disk Space Requirements.

Step 3

(Optional, high availability only) Switch the active/standby roles of your high availability device pairs.

The standby device in a high availability pair upgrades first. The devices switch roles, then the new standby upgrades. When the upgrade completes, the devices' roles remain switched. If you want to preserve the active/standby roles, manually switch the roles before you upgrade. That way, the upgrade process switches them back.

Choose Devices > Device Management, click the Switch Active Peer icon next to the pair, and confirm your choice.

Step 4

Choose System > Updates.

Step 5

Click the Install icon next to the upgrade package you want to use and choose the devices to upgrade.

If the devices you want to upgrade are not listed, you chose the wrong upgrade package.

Note

We strongly recommend upgrading no more than five devices simultaneously. The FMC does not allow you stop the upgrade until all selected devices complete the process. If there is an issue with any one device upgrade, all devices must finish upgrading before you can resolve the issue.

Step 6

Click Install, then confirm that you want to upgrade and reboot the devices.

Some devices may reboot twice during the upgrade; this is expected behavior.

Traffic either drops throughout the upgrade or traverses the network without inspection depending on how your devices are configured and deployed. For more information, see FTD Upgrade Behavior: Firepower 4100/9300 Chassis.

Step 7

Monitor upgrade progress in the Message Center.

Do not deploy configurations to the device while it is upgrading. Even if the Message Center shows no progress for several minutes or indicates that the upgrade has failed, do not restart the upgrade or reboot the device. Instead, contact Cisco TAC.

Step 8

Verify success.

After the upgrade completes, choose Devices > Device Management and confirm that the devices you upgraded have the correct software version.

Step 9

Use the Message Center to recheck deployment health.

Step 10

Update intrusion rules (SRU) and the vulnerability database (VDB).

If the SRU or the VDB available on the Cisco Support & Downloads site is newer than the version currently running, install the newer version. For more information, see the Firepower Management Center Configuration Guide. Note that when you update intrusion rules, you do not need to automatically reapply policies. You will do that later.

Step 11

Complete any post-upgrade configuration changes described in the release notes.

Step 12

Redeploy configurations to the devices you just upgraded.

Chapter 9. Upgrade Firepower Threat Defense: Other FTD Devices

- Upgrade Checklist: Other FTD Devices

- Upgrade Path: Other FTD Devices

- Upgrade FTD Software: Other FTD Devices

Upgrade Checklist: Other FTD Devices

Use this checklist to upgrade Firepower 1000/2100 series, ASA 5500-X series, ISA 3000, and FTDv devices.

Complete the checklist every time you upgrade. Skipping steps can result in an unsuccessful upgrade. At all times during the process, make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Plan the Upgrade

Maintain deployment compatibility at all times by correctly planning and following an upgrade path.

✓

Action/Check

Details

Verify Upgrade Path

Check your place in your upgrade path. Know which upgrade you just performed and which you are performing next.

Upgrade Path: Other FTD Devices

Check Versions

Check current and target versions on the devices:

- Firepower Threat Defense software

- Virtual hosting environment (FTDv)

Firepower Devices

Check FMC Compatibility

Check if the FMC will be able to manage the devices after you upgrade them. If not, revise your upgrade path so you upgrade the FMC first.

Can I Maintain FMC-Device Version Compatibility?

Read Release Notes

Read the release notes, paying special attention to the things that can affect upgrade, including:

- Version-specific upgrade guidelines and warnings.

- Known issues that affect upgrade.

- New/deprecated features and functionality.

Firepower Release Notes

Pre-Upgrade Actions and Checks

Minimize disruption by performing prechecks outside the maintenance window.

✓

Action/Check

Details

Make Required Configuration Changes

Make required pre-upgrade configuration changes, and be prepared to make required post-upgrade configuration changes.

Firepower Release Notes

Check Disk Space

Run a preliminary disk space check for the Firepower software upgrade.

Time Tests and Disk Space Requirements

Get Firepower Software Upgrade Package

Obtain the correct Firepower software upgrade package. Do not untar signed (.tar) packages. You can either:

- Upload the package to the FMC.

- Configure an internal web server as the source for FTD upgrade packages. Requires Version 6.6.0.

Obtain Firepower Software Upgrade Packages

Check Bandwidth

Make sure you have the bandwidth to perform a large data transfer to your managed devices.

Guidelines for Downloading Data from the Firepower Management Center to Managed Devices (Troubleshooting TechNote)

Push Firepower Software Upgrade Package

Push the upgrade package to the devices. Requires Version 6.2.3+.

Push Upgrade Packages to FMC-Managed Devices

Run Firepower Software Readiness Check

Run a readiness check. Requires Version 6.1+.

Run Firepower Software Readiness Checks

Back Up Devices

Use the FMC to back up configuration data for supported FTD platforms (not all FTD platforms support backup). Back up to an external location and verify transfer success. Requires Version 6.3+.

Firepower Management Center Configuration Guide

Verify Appliance Access

Make sure your computer can connect to the FMC’s management interface and to the device’s management interface, both without traversing the device itself.

Appliance Access, Communication, and Health

Schedule Maintenance Window

Schedule a maintenance window when it will have the least impact, considering the tasks you must perform, the upgrade's effect on traffic flow and inspection, and the time the upgrade is likely to take.

FTD Upgrade Behavior: Other Devices

and

Time Tests and Disk Space Requirements

Upgrade the Devices

Because upgrades can cause interruptions in traffic flow or inspection, perform them in a maintenance window.

✓

Action/Check

Details

Upgrade Hosting

If needed, upgrade the hosting environment (FTDv).

See the documentation for your hosting environment.

Upgrade Firepower Software

Upgrade the Firepower software.

Upgrade FTD Software: Other FTD Devices

Upgrade Path: Other FTD Devices

This table provides upgrade paths for FTD devices managed by a Firepower Management Center, where you do not have to update the operating system: Firepower 1000/2100 Series, ASA 5500-X Series, ISA 3000, FTDv.

Note

Performing a hitless upgrade of an FTD high availability pair to Version 6.1.0 requires a preinstallation package. For more information, see Firepower System Release Notes Version 6.1.0 Preinstallation Package.

Find your current Firepower version in the left column. You can upgrade directly to the versions listed in the right column. If you cannot perform a direct upgrade from your current to the target version, your upgrade path must include intermediate versions. For an alternate way of looking at this information, see Is Direct Upgrade Possible?.

Direct Upgrades: Firepower 1000/2100 Series, ASA 5500-X Series, ISA 3000, FTDv with FMC

Current Version

Target Version

6.7.0

6.7.x (maintenance releases)

Directly to:

→ Any later 6.7.x maintenance release

6.6.0

6.6.x (maintenance releases)

Last Firepower support for ASA 5525-X, 5545-X, and 5555-X.

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ Any later 6.6.x maintenance release

6.5.0

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

6.4.0

Last Firepower support for ASA 5515-X.

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

6.3.0

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

→ 6.4.0

6.2.3

Last Firepower support for ASA 5506-X series.

Directly to one of:

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

→ 6.4.0

→ 6.3.0

6.2.2

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

6.2.1

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

→ 6.2.2

6.2.0

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

→ 6.2.2

6.1.0

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

→ 6.2.0

6.0.1

Directly to:

→ 6.1.0

Upgrade FTD Software: Other FTD Devices

Use this procedure to upgrade Firepower 1000/2100 series, ASA 5500-X series, ISA 3000, and FTDv devices. You can upgrade multiple devices at once if they use the same upgrade package. You must upgrade the members of high availability pairs at the same time.

Caution

Do not deploy changes to or from, manually reboot, or shut down an upgrading appliance. Do not restart an upgrade in progress. The upgrade process may appear inactive during prechecks; this is expected. If you encounter issues with the upgrade, including a failed upgrade or unresponsive appliance, contact Cisco TAC.

Before you begin

Check your place in the upgrade path, including virtual hosting environment and FMC upgrades. Make sure you have fully planned and prepared for this step.

Procedure

Step 1

Deploy configurations to the devices you are about to upgrade.

On the FMC menu bar, click Deploy. Choose devices, then click Deploy again. Deploying before you upgrade reduces the chance of failure.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts Snort, which interrupts traffic inspection and, depending on how your device handles traffic, may interrupt traffic until the restart completes. For more information, see FTD Upgrade Behavior: Other Devices.

Step 2

Perform final preupgrade checks.

- Check health: Use the Message Center (click the System Status icon on the menu bar). Make sure the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

- Running tasks: Also in the Message Center, make sure essential tasks are complete. Tasks running when the upgrade begins are stopped, become failed tasks, and cannot be resumed. You can manually delete failed status messages later.

- Check disk space: Perform a final disk space check. Without enough free disk space, the upgrade fails. For disk space requirements, see Time Tests and Disk Space Requirements.

Step 3

(Optional, high availability only) Switch the active/standby roles of your high availability device pairs.

The standby device in a high availability pair upgrades first. The devices switch roles, then the new standby upgrades. When the upgrade completes, the devices' roles remain switched. If you want to preserve the active/standby roles, manually switch the roles before you upgrade. That way, the upgrade process switches them back.

Choose Devices > Device Management, click the Switch Active Peer icon next to the pair, and confirm your choice.

Step 4

Choose System > Updates.

Step 5

Click the Install icon next to the upgrade package you want to use and choose the devices to upgrade.

If the devices you want to upgrade are not listed, you chose the wrong upgrade package.

Note

We strongly recommend upgrading no more than five devices simultaneously. The FMC does not allow you stop the upgrade until all selected devices complete the process. If there is an issue with any one device upgrade, all devices must finish upgrading before you can resolve the issue.

Step 6

Click Install, then confirm that you want to upgrade and reboot the devices.

Some devices may reboot twice during the upgrade; this is expected behavior.

Traffic either drops throughout the upgrade or traverses the network without inspection depending on how your devices are configured and deployed. For more information, see FTD Upgrade Behavior: Other Devices.

Step 7

Monitor upgrade progress in the Message Center.

Do not deploy configurations to the device while it is upgrading. Even if the Message Center shows no progress for several minutes or indicates that the upgrade has failed, do not restart the upgrade or reboot the device. Instead, contact Cisco TAC.

Step 8

Verify success.

After the upgrade completes, choose Devices > Device Management and confirm that the devices you upgraded have the correct software version.

Step 9

Use the Message Center to recheck deployment health.

Step 10

Update intrusion rules (SRU) and the vulnerability database (VDB).

If the SRU or the VDB available on the Cisco Support & Downloads site is newer than the version currently running, install the newer version. For more information, see the Firepower Management Center Configuration Guide. Note that when you update intrusion rules, you do not need to automatically reapply policies. You will do that later.

Step 11

Complete any post-upgrade configuration changes described in the release notes.

Step 12

Redeploy configurations to the devices you just upgraded.

Chapter 10. Upgrade Firepower 7000/8000 Series and NGIPSv

- Upgrade Checklist: Firepower 7000/8000 Series and NGIPSv

- Upgrade Path: Firepower 7000/8000 Series

- Upgrade Path: NGIPSv

- Upgrade Firepower 7000/8000 Series and NGIPSv

Upgrade Checklist: Firepower 7000/8000 Series and NGIPSv

Use this checklist to upgrade Firepower 7000/8000 series and NGIPSv devices.

Complete the checklist every time you upgrade. Skipping steps can result in an unsuccessful upgrade. At all times during the process, make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Plan the Upgrade

Maintain deployment compatibility at all times by correctly planning and following an upgrade path.

✓

Action/Check

Details

Verify Upgrade Path

Check your place in your upgrade path. Know which upgrade you just performed and which you are performing next.

Upgrade Path: Firepower 7000/8000 Series

or

Upgrade Path: NGIPSv

Check Versions

Check current and target versions on the devices:

- Firepower software

- Virtual hosting environment (NGIPSv)

Firepower 7000/8000 Series and Legacy Devices

or

NGIPSv

Check FMC Compatibility

Check if the FMC will be able to manage the devices after you upgrade them. If not, revise your upgrade path so you upgrade the FMC first.

Can I Maintain FMC-Device Version Compatibility?

Read Release Notes

Read the release notes, paying special attention to the things that can affect upgrade, including:

- Version-specific upgrade guidelines and warnings.

- Known issues that affect upgrade.

- New/deprecated features and functionality.

Firepower Release Notes

Pre-Upgrade Actions and Checks

Minimize disruption by performing prechecks outside the maintenance window.

✓

Action/Check

Details

Make Required Configuration Changes

Make required pre-upgrade configuration changes, and be prepared to make required post-upgrade configuration changes.

Firepower Release Notes

Check Disk Space

Run a preliminary disk space check for the Firepower software upgrade.

Time Tests and Disk Space Requirements

Get Upgrade Package

Obtain the correct upgrade package and upload it to the FMC. Do not untar signed (.tar) packages.

Obtain Firepower Software Upgrade Packages

Check Bandwidth

Make sure you have the bandwidth to perform a large data transfer to your managed devices.

Guidelines for Downloading Data from the Firepower Management Center to Managed Devices (Troubleshooting TechNote)

Push Firepower Software Upgrade Package

Push the upgrade package to the devices. Requires Version 6.2.3+.

Push Upgrade Packages to FMC-Managed Devices

Run Firepower Software Readiness Check

Run a readiness check. Requires Version 6.1+.

Run Firepower Software Readiness Checks

Back Up Devices

Use the FMC to back up configuration data for 7000/8000 series devices. Back up to an external location and verify transfer success. Not supported for NGIPSv.

Firepower Management Center Configuration Guide

Verify Appliance Access

Make sure your computer can connect to the FMC’s management interface and to the device’s management interface, both without traversing the device itself.

Appliance Access, Communication, and Health

Schedule Maintenance Window

Schedule a maintenance window when it will have the least impact, considering the tasks you must perform, the upgrade's effect on traffic flow and inspection, and the time the upgrade is likely to take.

One of:

Firepower 7000/8000 Series Upgrade Behavior

NGIPSv Upgrade Behavior

and

Time Tests and Disk Space Requirements

Upgrade the Devices

Because upgrades can cause interruptions in traffic flow or inspection, perform them in a maintenance window.

✓

Action/Check

Details

Upgrade Hosting

If needed, upgrade the hosting environment (NGIPSv).

See the documentation for your hosting environment.

Upgrade Firepower Software

Upgrade the Firepower software.

Upgrade Firepower 7000/8000 Series and NGIPSv

Upgrade Path: Firepower 7000/8000 Series

This table provides upgrade paths for Firepower 7000/8000 series devices, managed by a Firepower Management Center.

Note

Upgrading a Firepower 7000/8000 series device to Version 6.0.0 requires a preinstallation package. For more information, see FireSIGHT System Release Notes Version 6.0.0 Preinstallation.

Find your current Firepower version in the left column. You can upgrade directly to the versions listed in the right column. If you cannot perform a direct upgrade from your current to the target version, your upgrade path must include intermediate versions. For an alternate way of looking at this information, see Is Direct Upgrade Possible?.

Direct Upgrades: Firepower 7000/8000 Series with FMC

Current Version

Target Version

6.4.0

None.

Version 6.4.0 is the last major release for Firepower 7000/8000 series devices.

6.3.0

Directly to:

→ 6.4.0

6.2.3

Directly to one of:

→ 6.4.0

→ 6.3.0

6.2.2

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

6.2.0

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

→ 6.2.2

6.1.0

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

→ 6.2.0

6.0.1

Directly to:

→ 6.1.0

6.0.0

Directly to:

→ 6.0.1

5.4.0.2

Directly to:

→ 6.0.0

Upgrade Path: NGIPSv

This table provides upgrade paths for NGIPSv, managed by a Firepower Management Center..

Note

Upgrading NGIPSv to Version 6.0.0 requires a preinstallation package. For more information, see FireSIGHT System Release Notes Version 6.0.0 Preinstallation.

Find your current Firepower version in the left column. You can upgrade directly to the versions listed in the right column. If you cannot perform a direct upgrade from your current to the target version, your upgrade path must include intermediate versions. For an alternate way of looking at this information, see Is Direct Upgrade Possible?.

Direct Upgrades: NGIPSv with FMC

Current Version

Target Version

6.7.0

6.7.x (maintenance releases)

Directly to:

→ Any later 6.7.x maintenance release

6.6.0

6.6.x (maintenance releases)

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ Any later 6.6.x maintenance release

6.5.0

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

6.4.0

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

6.3.0

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

→ 6.4.0

6.2.3

Directly to one of:

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

→ 6.4.0

→ 6.3.0

6.2.2

Directly to one of:

→ 6.4.0

→ 6.3.0

6.2.0

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

→ 6.2.2

6.1.0

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

→ 6.2.0

6.0.1

Directly to:

→ 6.1.0

6.0.0

Directly to:

→ 6.0.1

5.4.1.1

Directly to:

→ 6.0.0

Upgrade Firepower 7000/8000 Series and NGIPSv

Use this procedure to upgrade Firepower 7000/8000 series and NGIPSv devices. You can upgrade multiple devices at once if they use the same upgrade package. You must upgrade the members of device stacks and high availability pairs at the same time.

Caution

Do not deploy changes to or from, manually reboot, or shut down an upgrading appliance. Do not restart an upgrade in progress. The upgrade process may appear inactive during prechecks; this is expected. If you encounter issues with the upgrade, including a failed upgrade or unresponsive appliance, contact Cisco TAC.

Before you begin

Check your place in the upgrade path, including virtual hosting environment and FMC upgrades. Make sure you have fully planned and prepared for this step.

Procedure

Step 1

Deploy configurations to the devices you are about to upgrade.

On the FMC menu bar, click Deploy. Choose devices, then click Deploy again. Deploying before you upgrade reduces the chance of failure.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts Snort, which interrupts traffic inspection and, depending on how your device handles traffic, may interrupt traffic until the restart completes. For more information, see Firepower 7000/8000 Series Upgrade Behavior or NGIPSv Upgrade Behavior.

Step 2

Perform final preupgrade checks.

- Check health: Use the Message Center (click the System Status icon on the menu bar). Make sure the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

- Running tasks: Also in the Message Center, make sure essential tasks are complete. Tasks running when the upgrade begins are stopped, become failed tasks, and cannot be resumed. You can manually delete failed status messages later.

- Check disk space: Perform a final disk space check. Without enough free disk space, the upgrade fails. For disk space requirements, see Time Tests and Disk Space Requirements.

Step 3

(Optional, high availability only) Switch the active/standby roles of your high availability device pairs that perform switching/routing.

If your high availability pairs are deployed to perform access control only, the active upgrades first. When the upgrade completes, the active and standby maintain their old roles.

However, in a routed or switched deployment, the standby upgrades first. The devices switch roles, then the new standby upgrades. When the upgrade completes, the devices' roles remain switched. If you want to preserve the active/standby roles, manually switch the roles before you upgrade. That way, the upgrade process switches them back.

Choose Devices > Device Management, click the Switch Active Peer icon next to the pair, and confirm your choice.

Step 4

Choose System > Updates.

Step 5

Click the Install icon next to the upgrade package you want to use and choose the devices to upgrade.

If the devices you want to upgrade are not listed, you chose the wrong upgrade package.

Note

We strongly recommend upgrading no more than five devices simultaneously. The FMC does not allow you stop the upgrade until all selected devices complete the process. If there is an issue with any one device upgrade, all devices must finish upgrading before you can resolve the issue.

Step 6

Click Install, then confirm that you want to upgrade and reboot the devices.

Traffic either drops throughout the upgrade or traverses the network without inspection depending on how your devices are configured and deployed. For more information, see Firepower 7000/8000 Series Upgrade Behavior or NGIPSv Upgrade Behavior.

Step 7

Monitor upgrade progress in the Message Center.

Do not deploy configurations to the device while it is upgrading. Even if the Message Center shows no progress for several minutes or indicates that the upgrade has failed, do not restart the upgrade or reboot the device. Instead, contact Cisco TAC.

Step 8

Verify success.

After the upgrade completes, choose Devices > Device Management and confirm that the devices you upgraded have the correct software version.

Step 9

Use the Message Center to recheck deployment health.

Step 10

Update intrusion rules (SRU) and the vulnerability database (VDB).

If the SRU or the VDB available on the Cisco Support & Downloads site is newer than the version currently running, install the newer version. For more information, see the Firepower Management Center Configuration Guide. Note that when you update intrusion rules, you do not need to automatically reapply policies. You will do that later.

Step 11

Complete any post-upgrade configuration changes described in the release notes.

Step 12

Redeploy configurations to the devices you just upgraded.

Chapter 11. Upgrade ASA with FirePOWER Services

- Upgrade Checklist: ASA with FirePOWER Services

- Upgrade Path: ASA FirePOWER

- Upgrade the ASA

- Upgrade an ASA FirePOWER Module

Upgrade Checklist: ASA with FirePOWER Services

Use this checklist to upgrade ASA with FirePOWER Services.

Complete the checklist every time you upgrade. Skipping steps can result in an unsuccessful upgrade. At all times during the process, make sure that the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

Plan the Upgrade

Maintain deployment compatibility at all times by correctly planning and following an upgrade path.

✓

Action/Check

Details

Verify Upgrade Path

Check your place in your upgrade path. Know which upgrade you just performed and which you are performing next.

Upgrade Path: ASA FirePOWER

Check Versions

Check current and target versions on the devices:

- ASA FirePOWER module

- ASA OS

ASA 5500-X Series and ISA 3000 with FirePOWER Services

Check FMC Compatibility

Check if the FMC will be able to manage the devices after you upgrade them. If not, revise your upgrade path so you upgrade the FMC first.

Can I Maintain FMC-Device Version Compatibility?

Read Release Notes

Read the release notes, paying special attention to the things that can affect upgrade, including:

- Version-specific upgrade guidelines and warnings.

- Known issues that affect upgrade.

- New/deprecated features and functionality.

Firepower Release Notes

and

ASA Release Notes

Pre-Upgrade Actions and Checks

Minimize disruption by performing prechecks outside the maintenance window.

✓

Action/Check

Details

Make Required Configuration Changes

Make required pre-upgrade configuration changes, and be prepared to make required post-upgrade configuration changes.

Firepower Release Notes

and

Planning Your Upgrade in the Cisco ASA Upgrade Guide

Check Disk Space

Run a preliminary disk space check for the Firepower software upgrade.

Time Tests and Disk Space Requirements

Get Upgrade Package

Obtain the correct upgrade package and upload it to the FMC. Do not untar signed (.tar) packages.

Obtain Firepower Software Upgrade Packages

Check Bandwidth

Make sure you have the bandwidth to perform a large data transfer to your managed devices.

Guidelines for Downloading Data from the Firepower Management Center to Managed Devices (Troubleshooting TechNote)

Push Firepower Software Upgrade Package

Push the upgrade package to the devices. Requires Version 6.2.3+.

Push Upgrade Packages to FMC-Managed Devices

Run Firepower Software Readiness Check

Run a readiness check. Requires Version 6.1+.

Run Firepower Software Readiness Checks

Verify Appliance Access

Make sure your computer can connect to the FMC’s management interface and to the device’s management interface, both without traversing the device itself.

Appliance Access, Communication, and Health

Schedule Maintenance Window

Schedule a maintenance window when it will have the least impact, considering the tasks you must perform, the upgrade's effect on traffic flow and inspection, and the time the upgrade is likely to take.

ASA FirePOWER Upgrade Behavior

and

Time Tests and Disk Space Requirements

Upgrade ASA and ASA with FirePOWER Services

Because upgrades can cause interruptions in traffic flow or inspection, perform them in a maintenance window.

✓

Action/Check

Details

Upgrade Standalone ASA Devices

Upgrade the ASA FirePOWER module on standalone ASA devices.

If you are also upgrading ASA, use the FMC to upgrade the ASA FirePOWER module just after you upgrade ASA and reload.

Upgrade a Standalone Unit

and

Upgrade an ASA FirePOWER Module

Upgrade ASA Clusters & Failover Pairs

Upgrade the ASA FirePOWER module on ASA devices in clusters and failover pairs.

To avoid interruptions in traffic flow and inspection, fully upgrade these devices one at a time. If you are also upgrading ASA, use the FMC to upgrade the ASA FirePOWER module just before you reload each unit to upgrade ASA.

One of:

Upgrade an Active/Standby Failover Pair

Upgrade an Active/Active Failover Pair

Upgrade an ASA Cluster

and

Upgrade an ASA FirePOWER Module

Upgrade Path: ASA FirePOWER

This table provides upgrade paths for ASA FirePOWER modules, managed by a Firepower Management Center.

Note

Upgrading ASA FirePOWER to Version 6.0.0 requires a preinstallation package. For more information, see FireSIGHT System Release Notes Version 6.0.0 Preinstallation.

Find your current Firepower version in the left column. You can upgrade directly to the versions listed in the right column. If you cannot perform a direct upgrade from your current to the target version, your upgrade path must include intermediate versions. For an alternate way of looking at this information, see Is Direct Upgrade Possible?.

Direct Upgrades: ASA FirePOWER with FMC

Current Version

Target Version

6.7.0

6.7.x (maintenance releases)

Directly to:

→ Any later 6.7.x maintenance release

6.6.0

6.6.x (maintenance releases)

Last Firepower support for ASA 5525-X, 5545-X, and 5555-X.

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ Any later 6.6.x maintenance release

6.5.0

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

6.4.0

Last Firepower support for ASA 5585-X series and ASA 5515-X.

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

6.3.0

Directly to one of:

→ 6.7.0 or any 6.7.x maintenance release

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

→ 6.4.0

6.2.3

Last Firepower support for ASA 5506-X series and ASA 5512-X.

Directly to one of:

→ 6.6.0 or any 6.6.x maintenance release

→ 6.5.0

→ 6.4.0

→ 6.3.0

6.2.2

Directly to one of:

→ 6.4.0

→ 6.3.0

6.2.0

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

→ 6.2.2

6.1.0

Directly to one of:

→ 6.4.0

→ 6.3.0

→ 6.2.3

→ 6.2.0

6.0.1

Directly to:

→ 6.1.0

6.0.0

Directly to:

→ 6.0.1

5.4.0.2 or 5.4.1.1

Directly to:

→ 6.0.0

Upgrading ASA

There is wide compatibility between ASA and ASA FirePOWER versions. However, even if an ASA upgrade is not strictly required, resolving issues may require an upgrade to the latest supported version. For detailed compatibility information, see ASA 5500-X Series and ISA 3000 with FirePOWER Services.

You upgrade ASA on each device independently, even if you have ASA clustering or failover pairs configured. Exactly when you upgrade the ASA FirePOWER module (before or after ASA reload) depends on your deployment. This table outlines ASA upgrade order for standalone and HA/scalability deployments. For detailed instructions, see Upgrade the ASA.

ASA + ASA FirePOWER Upgrade Order

ASA Deployment

Upgrade Order

Standalone device

1. Upgrade ASA, including reload.

2. Upgrade ASA FirePOWER.

ASA failover: active/standby

Always upgrade the standby.

1. Upgrade ASA on the standby, but do not reload.

2. Upgrade ASA FirePOWER on the standby.

3. Reload ASA on the standby.

4. Fail over.

5. Upgrade ASA on the new standby.

6. Upgrade ASA FirePOWER on the new standby.

7. Reload ASA on the new standby.

ASA failover: active/active

Make both failover groups active on the unit you are not upgrading.

1. Make both failover groups active on the primary.

2. Upgrade ASA on the secondary, but do not reload.

3. Upgrade ASA FirePOWER on the secondary.

4. Reload ASA on the secondary.

5. Make both failover groups active on the secondary.

6. Upgrade ASA on the primary, but do not reload.

7. Upgrade ASA FirePOWER on the primary.

8. Reload ASA on the primary.

ASA cluster

Disable clustering on each unit before you upgrade. Upgrade one unit at a time, leaving the control unit for last.

1. On a data unit, disable clustering.

2. Upgrade ASA on that data unit, but do not reload.

3. Upgrade ASA FirePOWER on the unit.

4. Reload ASA.

5. Reenable clustering. Wait for the unit to rejoin the cluster.

6. Repeat for each data unit.

7. On the control unit, disable clustering. Wait for a new control to take over.

8. Upgrade ASA on the former control unit, but do not reload.

9. Upgrade ASA FirePOWER on the former control unit.

10. Reenable clustering.

Upgrade the ASA

Use the procedures in this section to upgrade ASA and ASDM for standalone, failover, or clustering deployments.

- Upgrade a Standalone Unit

- Upgrade an Active/Standby Failover Pair

- Upgrade an Active/Active Failover Pair

- Upgrade an ASA Cluster

Upgrade a Standalone Unit

Use the CLI or ASDM to upgrade the standalone unit.

- Upgrade a Standalone Unit Using the CLI

- Upgrade a Standalone Unit from Your Local Computer Using ASDM

- Upgrade a Standalone Unit Using the ASDM Cisco.com Wizard

Upgrade a Standalone Unit Using the CLI

This section describes how to install the ASDM and ASA images, and also when to upgrade the ASA FirePOWER module.

Before you begin

This procedure uses FTP. For TFTP, HTTP, or other server types, see the copy command in the ASA command reference.

Procedure

Step 1

In privileged EXEC mode, copy the ASA software to flash memory.

copy ftp://[[user[:password]@]server[/path]/asa_image_name diskn:/[path/]asa_image_name

Example:

ciscoasa# copy ftp://jcrichton:aeryn@10.1.1.1/asa-9-12-1-smp-k8.bin disk0:/asa-9-12-1-smp-k8.bin

Step 2

Copy the ASDM image to flash memory.

copy ftp://[[user[:password]@]server[/path]/asdm_image_name diskn:/[path/]asdm_image_name

Example:

ciscoasa# copy ftp://jcrichton:aeryn@10.1.1.1/asdm-7121.bin disk0:/asdm-7121.bin

Step 3

Access global configuration mode.

configure terminal

Example:

ciscoasa# configure terminal
ciscoasa(config)#

Step 4

Show the current boot images configured (up to 4):

show running-config boot system

The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to the next steps.

Example:

ciscoasa(config)# show running-config boot system
boot system disk0:/cdisk.bin
boot system disk0:/asa931-smp-k8.bin

Step 5

Remove any existing boot image configurations so that you can enter the new boot image as your first choice:

no boot system diskn:/[path/]asa_image_name

Example:

ciscoasa(config)# no boot system disk0:/cdisk.bin
ciscoasa(config)# no boot system disk0:/asa931-smp-k8.bin

Step 6

Set the ASA image to boot (the one you just uploaded):

boot system diskn:/[path/]asa_image_name

Repeat this command for any backup images that you want to use in case this image is unavailable. For example, you can re-enter the images that you previously removed.

Example:

ciscoasa(config)# boot system disk0:/asa-9-12-1-smp-k8.bin

Step 7

Set the ASDM image to use (the one you just uploaded):

asdm image diskn:/[path/]asdm_image_name

You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.

Example:

ciscoasa(config)# asdm image disk0:/asdm-7121.bin

Step 8

Save the new settings to the startup configuration:

write memory

Step 9

Reload the ASA:

reload

Step 10

If you are upgrading the ASA FirePOWER module, disable the ASA REST API or else the upgrade will fail.

no rest-api agent

You can reenable it after the upgrade:

rest-api agent

Note

The ASA 5506-X series does not support the ASA REST API if you are running the FirePOWER module Version 6.0 or later.

Step 11

Upgrade the ASA FirePOWER module.

Upgrade a Standalone Unit from Your Local Computer Using ASDM

The Upgrade Software from Local Computer tool lets you upload an image file from your computer to the flash file system to upgrade the ASA.

Procedure

Step 1

In the main ASDM application window, choose Tools > Upgrade Software from Local Computer.

The Upgrade Software dialog box appears.

Step 2

From the Image to Upload drop-down list, choose ASDM.

Step 3

In the Local File Path field, click Browse Local Files to find the file on your PC.

Step 4

In the Flash File System Path field, click Browse Flash to find the directory or file in the flash file system.

Step 5

Click Upload Image.

The uploading process might take a few minutes.

Step 6

You are prompted to set this image as the ASDM image. Click Yes.

Step 7

You are reminded to exit ASDM and save the configuration. Click OK.

You exit the Upgrade tool. Note: You will save the configuration and exit and reconnect to ASDM after you upgrade the ASA software.

Step 8

Repeat these steps, choosing ASA from the Image to Upload drop-down list. You can also use this procedure to upload other file types.

Step 9

Choose Tools > System Reload to reload the ASA.

A new window appears that asks you to verify the details of the reload.

1. Click the Save the running configuration at the time of reload radio button (the default).

2. Choose a time to reload (for example, Now, the default).

3. Click Schedule Reload.

Once the reload is in progress, a Reload Status window appears that indicates that a reload is being performed. An option to exit ASDM is also provided.

Step 10

After the ASA reloads, restart ASDM.

You can check the reload status from a console port, or you can wait a few minutes and try to connect using ASDM until you are successful.

Step 11

If you are upgrading an ASA FirePOWER module, disable the ASA REST API by choosing Tools > Command Line Interface, and entering no rest-api agent .

If you do not disable the REST API, the ASA FirePOWER module upgrade will fail. You can reenable it after the upgrade:

rest-api agent

Note

The ASA 5506-X series does not support the ASA REST API if you are running the FirePOWER module Version 6.0 or later.

Step 12

Upgrade the ASA FirePOWER module.

Upgrade a Standalone Unit Using the ASDM Cisco.com Wizard

The Upgrade Software from Cisco.com Wizard lets you automatically upgrade the ASDM and ASA to more current versions.

In this wizard, you can do the following:

- Choose an ASA image file and/or ASDM image file to upgrade.

Note

ASDM downloads the latest image version, which includes the build number. For example, if you are downloading 9.9(1), the download might be 9.9(1.2). This behavior is expected, so you can proceed with the planned upgrade.

- Review the upgrade changes that you have made.

- Download the image or images and install them.

- Review the status of the installation.

- If the installation completed successfully, reload the ASA to save the configuration and complete the upgrade.

Before you begin

Due to an internal change, the wizard is only supported using ASDM 7.10(1) and later; also, due to an image naming change, you must use ASDM 7.12(1) or later to upgrade to ASA 9.10(1) and later. Because ASDM is backwards compatible with earlier ASA releases, you can upgrade ASDM no matter which ASA version you are running.

Procedure

Step 1

Choose Tools > Check for ASA/ASDM Updates.

In multiple context mode, access this menu from the System.

The Cisco.com Authentication dialog box appears.

Step 2

Enter your Cisco.com username and password, and then click Login.

The Cisco.com Upgrade Wizard appears.

Note

If there is no upgrade available, a dialog box appears. Click OK to exit the wizard.

Step 3

Click Next to display the Select Software screen.

The current ASA version and ASDM version appear.

Step 4

To upgrade the ASA version and ASDM version, perform the following steps:

1. In the ASA area, check the Upgrade to check box, and then choose an ASA version to which you want to upgrade from the drop-down list.

2. In the ASDM area, check the Upgrade to check box, and then choose an ASDM version to which you want to upgrade from the drop-down list.

Step 5

Click Next to display the Review Changes screen.

Step 6

Verify the following items:

- The ASA image file and/or ASDM image file that you have downloaded are the correct ones.

- The ASA image file and/or ASDM image file that you want to upload are the correct ones.

- The correct ASA boot image has been selected.

Step 7

Click Next to start the upgrade installation.

You can then view the status of the upgrade installation as it progresses.

The Results screen appears, which provides additional details, such as the upgrade installation status (success or failure).

Step 8

If the upgrade installation succeeded, for the upgrade versions to take effect, check the Save configuration and reload device now check box to restart the ASA, and restart ASDM.

Step 9

Click Finish to exit the wizard and save the configuration changes that you have made.

Note

To upgrade to the next higher version, if any, you must restart the wizard.

Step 10

After the ASA reloads, restart ASDM.

You can check the reload status from a console port, or you can wait a few minutes and try to connect using ASDM until you are successful.

Step 11

If you are upgrading an ASA FirePOWER module, disable the ASA REST API by choosing Tools > Command Line Interface, and entering no rest-api agent .

If you do not disable the REST API, the ASA FirePOWER module upgrade will fail. You can reenable it after the upgrade:

rest-api agent

Note

The ASA 5506-X series does not support the ASA REST API if you are running the FirePOWER module Version 6.0 or later.

Step 12

Upgrade the ASA FirePOWER module.

Upgrade an Active/Standby Failover Pair

Use the CLI or ASDM to upgrade the Active/Standby failover pair for a zero downtime upgrade.

- Upgrade an Active/Standby Failover Pair Using the CLI

- Upgrade an Active/Standby Failover Pair Using ASDM

Upgrade an Active/Standby Failover Pair Using the CLI

To upgrade the Active/Standby failover pair, perform the following steps.

Before you begin

- Perform these steps on the active unit. For SSH access, connect to the active IP address; the active unit always owns this IP address. When you connect to the CLI, determine the failover status by looking at the ASA prompt; you can configure the ASA prompt to show the failover status and priority (primary or secondary), which is useful to determine which unit you are connected to. See the prompt command. Alternatively, enter the show failover command to view this unit's status and priority (primary or secondary).

- This procedure uses FTP. For TFTP, HTTP, or other server types, see the copy command in the ASA command reference.

Procedure

Step 1

On the active unit in privileged EXEC mode, copy the ASA software to the active unit flash memory:

copy ftp://[[user[:password]@]server[/path]/asa_image_name diskn:/[path/]asa_image_name

Example:

asa/act# copy ftp://jcrichton:aeryn@10.1.1.1/asa9829-15-1-smp-k8.bin disk0:/asa9829-15-1-smp-k8.bin

Step 2

Copy the software to the standby unit; be sure to specify the same path as for the active unit:

failover exec mate copy /noconfirm ftp://[[user[:password]@]server[/path]/asa_image_name diskn:/[path/]asa_image_name

Example:

asa/act# failover exec mate copy /noconfirm ftp://jcrichton:aeryn@10.1.1.1/asa9829-15-1-smp-k8.bin disk0:/asa9829-15-1-smp-k8.bin

Step 3

Copy the ASDM image to the active unit flash memory:

copy ftp://[[user[:password]@]server[/path]/asdm_image_name diskn:/[path/]asdm_image_name

Example:

asa/act# copy ftp://jcrichton:aeryn@10.1.1.1/asdm-77178271417151.bin disk0:/asdm-77178271417151.bin

Step 4

Copy the ASDM image to the standby unit; be sure to specify the same path as for the active unit:

failover exec mate copy /noconfirm ftp://[[user[:password]@]server[/path]/asdm_image_name diskn:/[path/]asdm_image_name

Example:

asa/act# failover exec mate copy /noconfirm ftp://jcrichton:aeryn@10.1.1.1/asdm-77178271417151.bin disk0:/asdm-77178271417151.bin

Step 5

If you are not already in global configuration mode, access global configuration mode:

configure terminal

Step 6

Show the current boot images configured (up to 4):

show running-config boot system

Example:

asa/act(config)# show running-config boot system
boot system disk0:/cdisk.bin
boot system disk0:/asa931-smp-k8.bin

The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to the next steps.

Step 7

Remove any existing boot image configurations so that you can enter the new boot image as your first choice:

no boot system diskn:/[path/]asa_image_name

Example:

asa/act(config)# no boot system disk0:/cdisk.bin
asa/act(config)# no boot system disk0:/asa931-smp-k8.bin

Step 8

Set the ASA image to boot (the one you just uploaded):

boot system diskn:/[path/]asa_image_name

Example:

asa/act(config)# boot system disk0://asa9829-15-1-smp-k8.bin

Repeat this command for any backup images that you want to use in case this image is unavailable. For example, you can re-enter the images that you previously removed.

Step 9

Set the ASDM image to use (the one you just uploaded):

asdm image diskn:/[path/]asdm_image_name

Example:

asa/act(config)# asdm image disk0:/asdm-77178271417151.bin

You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.

Step 10

Save the new settings to the startup configuration:

write memory

These configuration changes are automatically saved on the standby unit.

Step 11

If you are upgrading ASA FirePOWER modules, disable the ASA REST API or else the upgrade will fail.

no rest-api agent

Step 12

Upgrade the ASA FirePOWER module on the standby unit.

For an ASA FirePOWER module managed by ASDM, connect ASDM to the standby management IP address. Wait for the upgrade to complete.

Step 13

Reload the standby unit to boot the new image:

failover reload-standby

Wait for the standby unit to finish loading. Use the show failover command to verify that the standby unit is in the Standby Ready state.

Step 14

Force the active unit to fail over to the standby unit.

no failover active

If you are disconnected from your SSH session, reconnect to the main IP address, now on the new active/former standby unit.

Step 15

Upgrade the ASA FirePOWER module on the former active unit.

For an ASA FirePOWER module managed by ASDM, connect ASDM to the standby management IP address. Wait for the upgrade to complete.

Step 16

From the new active unit, reload the former active unit (now the new standby unit).

failover reload-standby

Example:

asa/act# failover reload-standby

Note

If you are connected to the former active unit console port, you should instead enter the reload command to reload the former active unit.

Upgrade an Active/Standby Failover Pair Using ASDM

To upgrade the Active/Standby failover pair, perform the following steps.

Before you begin

Place the ASA and ASDM images on your local management computer.

Procedure

Step 1

Launch ASDM on the standby unit by connecting to the standby IP address.

Step 2

In the main ASDM application window, choose Tools > Upgrade Software from Local Computer.

The Upgrade Software dialog box appears.

Step 3

From the Image to Upload drop-down list, choose ASDM.

Step 4

In the Local File Path field, enter the local path to the file on your computer or click Browse Local Files to find the file on your PC.

Step 5

In the Flash File System Path field, enter the path to the flash file system or click Browse Flash to find the directory or file in the flash file system.

Step 6

Click Upload Image. The uploading process might take a few minutes.

When you are prompted to set this image as the ASDM image, click No. You exit the Upgrade tool.

Step 7

Repeat these steps, choosing ASA from the Image to Upload drop-down list.

When you are prompted to set this image as the ASA image, click No. You exit the Upgrade tool.

Step 8

Connect ASDM to the active unit by connecting to the main IP address, and upload the ASDM software, using the same file location you used on the standby unit.

Step 9

When you are prompted to set the image as the ASDM image, click Yes.

You are reminded to exit ASDM and save the configuration. Click OK. You exit the Upgrade tool. Note: You will save the configuration and reload ASDM after you upgrade the ASA software.

Step 10

Upload the ASA software, using the same file location you used for the standby unit.

Step 11

When you are prompted to set the image as the ASA image, click Yes.

You are reminded to reload the ASA to use the new image. Click OK. You exit the Upgrade tool.

Step 12

Click the Save icon on the toolbar to save your configuration changes.

These configuration changes are automatically saved on the standby unit.

Step 13

If you are upgrading ASA FirePOWER modules, disable the ASA REST API by choosing Tools > Command Line Interface, and entering no rest-api enable .

If you do not disable the REST API, the ASA FirePOWER module upgrade will fail.

Step 14

Upgrade the ASA FirePOWER module on the standby unit.

For an ASA FirePOWER module managed by ASDM, connect ASDM to the standby management IP address. Wait for the upgrade to complete, and then connect ASDM back to the active unit.

Step 15

Reload the standby unit by choosing Monitoring > Properties > Failover > Status, and clicking Reload Standby.

Stay on the System pane to monitor when the standby unit reloads.

Step 16

After the standby unit reloads, force the active unit to fail over to the standby unit by choosing Monitoring > Properties > Failover > Status, and clicking Make Standby.

ASDM will automatically reconnect to the new active unit.

Step 17

Upgrade the ASA FirePOWER module on the former active unit.

For an ASA FirePOWER module managed by ASDM, connect ASDM to the standby management IP address. Wait for the upgrade to complete, and then connect ASDM back to the active unit.

Step 18

Reload the (new) standby unit by choosing Monitoring > Properties > Failover > Status, and clicking Reload Standby.

Upgrade an Active/Active Failover Pair

Use the CLI or ASDM to upgrade the Active/Active failover pair for a zero downtime upgrade.

- Upgrade an Active/Active Failover Pair Using the CLI

- Upgrade an Active/Active Failover Pair Using ASDM

Upgrade an Active/Active Failover Pair Using the CLI

To upgrade two units in an Active/Active failover configuration, perform the following steps.

Before you begin

- Perform these steps on the primary unit.

- Perform these steps in the system execution space.

- This procedure uses FTP. For TFTP, HTTP, or other server types, see the copy command in the ASA command reference.

Procedure

Step 1

On the primary unit in privileged EXEC mode, copy the ASA software to flash memory:

copy ftp://[[user[:password]@]server[/path]/asa_image_name diskn:/[path/]asa_image_name

Example:

asa/act/pri# copy ftp://jcrichton:aeryn@10.1.1.1/asa9829-15-1-smp-k8.bin disk0:/asa9829-15-1-smp-k8.bin

Step 2

Copy the software to the secondary unit; be sure to specify the same path as for the primary unit:

failover exec mate copy /noconfirm ftp://[[user[:password]@]server[/path]/asa_image_name diskn:/[path/]asa_image_name

Example:

asa/act/pri# failover exec mate copy /noconfirm ftp://jcrichton:aeryn@10.1.1.1/asa9829-15-1-smp-k8.bin disk0:/asa9829-15-1-smp-k8.bin

Step 3

Copy the ASDM image to the primary unit flash memory:

copy ftp://[[user[:password]@]server[/path]/asdm_image_name diskn:/[path/]asdm_image_name

Example:

asa/act/pri# ciscoasa# copy ftp://jcrichton:aeryn@10.1.1.1/asdm-77178271417151.bin disk0:/asdm-77178271417151.bin

Step 4

Copy the ASDM image to the secondary unit; be sure to specify the same path as for the primary unit:

failover exec mate copy /noconfirm ftp://[[user[:password]@]server[/path]/asdm_image_name diskn:/[path/]asdm_image_name

Example:

asa/act/pri# failover exec mate copy /noconfirm ftp://jcrichton:aeryn@10.1.1.1/asdm-77178271417151.bin disk0:/asdm-77178271417151.bin

Step 5

If you are not already in global configuration mode, access global configuration mode:

configure terminal

Step 6

Show the current boot images configured (up to 4):

show running-config boot system

Example:

asa/act/pri(config)# show running-config boot system
boot system disk0:/cdisk.bin
boot system disk0:/asa931-smp-k8.bin

The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to the next steps.

Step 7

Remove any existing boot image configurations so that you can enter the new boot image as your first choice:

no boot system diskn:/[path/]asa_image_name

Example:

asa/act/pri(config)# no boot system disk0:/cdisk.bin
asa/act/pri(config)# no boot system disk0:/asa931-smp-k8.bin

Step 8

Set the ASA image to boot (the one you just uploaded):

boot system diskn:/[path/]asa_image_name

Example:

asa/act/pri(config)# boot system disk0://asa9829-15-1-smp-k8.bin

Repeat this command for any backup images that you want to use in case this image is unavailable. For example, you can re-enter the images that you previously removed.

Step 9

Set the ASDM image to use (the one you just uploaded):

asdm image diskn:/[path/]asdm_image_name

Example:

asa/act/pri(config)# asdm image disk0:/asdm-77178271417151.bin

You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.

Step 10

Save the new settings to the startup configuration:

write memory

These configuration changes are automatically saved on the secondary unit.

Step 11

If you are upgrading ASA FirePOWER modules, disable the ASA REST API or else the upgrade will fail.

no rest-api agent

Step 12

Make both failover groups active on the primary unit:

failover active group 1

failover active group 2

Example:

asa/act/pri(config)# failover active group 1
asa/act/pri(config)# failover active group 2

Step 13

Upgrade the ASA FirePOWER module on the secondary unit.

For an ASA FirePOWER module managed by ASDM, connect ASDM to the failover group 1 or 2 standby management IP address. Wait for the upgrade to complete.

Step 14

Reload the secondary unit to boot the new image:

failover reload-standby

Wait for the secondary unit to finish loading. Use the show failover command to verify that both failover groups are in the Standby Ready state.

Step 15

Force both failover groups to become active on the secondary unit:

no failover active group 1

no failover active group 2

Example:

asa/act/pri(config)# no failover active group 1
asa/act/pri(config)# no failover active group 2
asa/stby/pri(config)#

If you are disconnected from your SSH session, reconnect to the failover group 1 IP address, now on the secondary unit.

Step 16

Upgrade the ASA FirePOWER module on the primary unit.

For an ASA FirePOWER module managed by ASDM, connect ASDM to the failover group 1 or 2 standby management IP address. Wait for the upgrade to complete.

Step 17

Reload the primary unit:

failover reload-standby

Example:

asa/act/sec# failover reload-standby

Note

If you are connected to the primary unit console port, you should instead enter the reload command to reload the primary unit.

You may be disconnected from your SSH session.

Step 18

If the failover groups are configured with the preempt command, they automatically become active on their designated unit after the preempt delay has passed.

Upgrade an Active/Active Failover Pair Using ASDM

To upgrade two units in an Active/Active failover configuration, perform the following steps.

Before you begin

- Perform these steps in the system execution space.

- Place the ASA and ASDM images on your local management computer.

Procedure

Step 1

Launch ASDM on the secondary unit by connecting to the management address in failover group 2.

Step 2

In the main ASDM application window, choose Tools > Upgrade Software from Local Computer.

The Upgrade Software dialog box appears.

Step 3

From the Image to Upload drop-down list, choose ASDM.

Step 4

In the Local File Path field, enter the local path to the file on your computer or click Browse Local Files to find the file on your PC.

Step 5

In the Flash File System Path field, enter the path to the flash file system or click Browse Flash to find the directory or file in the flash file system.

Step 6

Click Upload Image. The uploading process might take a few minutes.

When you are prompted to set this image as the ASDM image, click No. You exit the Upgrade tool.

Step 7

Repeat these steps, choosing ASA from the Image to Upload drop-down list.

When you are prompted to set this image as the ASA image, click No. You exit the Upgrade tool.

Step 8

Connect ASDM to the primary unit by connecting to the management IP address in failover group 1, and upload the ASDM software, using the same file location you used on the secondary unit.

Step 9

When you are prompted to set the image as the ASDM image, click Yes.

You are reminded to exit ASDM and save the configuration. Click OK. You exit the Upgrade tool. Note: You will save the configuration and reload ASDM after you upgrade the ASA software.

Step 10

Upload the ASA software, using the same file location you used for the secondary unit.

Step 11

When you are prompted to set the image as the ASA image, click Yes.

You are reminded to reload the ASA to use the new image. Click OK. You exit the Upgrade tool.

Step 12

Click the Save icon on the toolbar to save your configuration changes.

These configuration changes are automatically saved on the secondary unit.

Step 13

If you are upgrading ASA FirePOWER modules, disable the ASA REST API by choosing Tools > Command Line Interface, and entering no rest-api enable .

If you do not disable the REST API, the ASA FirePOWER module upgrade will fail.

Step 14

Make both failover groups active on the primary unit by choosing Monitoring > Failover > Failover Group #, where # is the number of the failover group you want to move to the primary unit, and clicking Make Active.

Step 15

Upgrade the ASA FirePOWER module on the secondary unit.

For an ASA FirePOWER module managed by ASDM, connect ASDM to the failover group 1 or 2 standby management IP address. Wait for the upgrade to complete, and then connect ASDM back to the primary unit.

Step 16

Reload the secondary unit by choosing Monitoring > Failover > System, and clicking Reload Standby.

Stay on the System pane to monitor when the secondary unit reloads.

Step 17

After the secondary unit comes up, make both failover groups active on the secondary unit by choosing Monitoring > Failover > Failover Group #, where # is the number of the failover group you want to move to the secondary unit, and clicking Make Standby.

ASDM will automatically reconnect to the failover group 1 IP address on the secondary unit.

Step 18

Upgrade the ASA FirePOWER module on the primary unit.

For an ASA FirePOWER module managed by ASDM, connect ASDM to the failover group 1 or 2 standby management IP address. Wait for the upgrade to complete, and then connect ASDM back to the secondary unit.

Step 19

Reload the primary unit by choosing Monitoring > Failover > System, and clicking Reload Standby.

Step 20

If the failover groups are configured with Preempt Enabled, they automatically become active on their designated unit after the preempt delay has passed. ASDM will automatically reconnect to the failover group 1 IP address on the primary unit.

Upgrade an ASA Cluster

Use the CLI or ASDM to upgrade the ASA Cluster for a zero downtime upgrade.

- Upgrade an ASA Cluster Using the CLI

- Upgrade an ASA Cluster Using ASDM

Upgrade an ASA Cluster Using the CLI

To upgrade all units in an ASA cluster, perform the following steps. This procedure uses FTP. For TFTP, HTTP, or other server types, see the copy command in the ASA command reference.

Before you begin

- Perform these steps on the control unit. If you are also upgrading the ASA FirePOWER module, then you need console or ASDM access on each data unit. You can configure the ASA prompt to show the cluster unit and state (control or data), which is useful to determine which unit you are connected to. See the prompt command. Alternatively, enter the show cluster info command to view each unit's role.

- You must use the console port; you cannot enable or disable clustering from a remote CLI connection.

- Perform these steps in the system execution space for multiple context mode.

Procedure

Step 1

On the control unit in privileged EXEC mode, copy the ASA software to all units in the cluster.

cluster exec copy /noconfirm ftp://[[user[:password]@]server[/path]/asa_image_name diskn:/[path/]asa_image_name

Example:

asa/unit1/master# cluster exec copy /noconfirm
ftp://jcrichton:aeryn@10.1.1.1/asa9829-15-1-smp-k8.bin disk0:/asa9829-15-1-smp-k8.bin

Step 2

Copy the ASDM image to all units in the cluster:

cluster exec copy /noconfirm ftp://[[user[:password]@]server[/path]/asdm_image_name diskn:/[path/]asdm_image_name

Example:

asa/unit1/master# cluster exec copy /noconfirm ftp://jcrichton:aeryn@10.1.1.1/asdm-77178271417151.bin disk0:/asdm-77178271417151.bin

Step 3

If you are not already in global configuration mode, access it now.

configure terminal

Example:

asa/unit1/master# configure terminal
asa/unit1/master(config)#

Step 4

Show the current boot images configured (up to 4).

show running-config boot system

Example:

asa/unit1/master(config)# show running-config boot system
boot system disk0:/cdisk.bin
boot system disk0:/asa931-smp-k8.bin

The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to the next steps.

Step 5

Remove any existing boot image configurations so that you can enter the new boot image as your first choice:

no boot system diskn:/[path/]asa_image_name

Example:

asa/unit1/master(config)# no boot system disk0:/cdisk.bin
asa/unit1/master(config)# no boot system disk0:/asa931-smp-k8.bin

Step 6

Set the ASA image to boot (the one you just uploaded):

boot system diskn:/[path/]asa_image_name

Example:

asa/unit1/master(config)# boot system disk0://asa9829-15-1-smp-k8.bin

Repeat this command for any backup images that you want to use in case this image is unavailable. For example, you can re-enter the images that you previously removed.

Step 7

Set the ASDM image to use (the one you just uploaded):

asdm image diskn:/[path/]asdm_image_name

Example:

asa/unit1/master(config)# asdm image disk0:/asdm-77178271417151.bin

You can only configure one ASDM image to use, so you do not need to first remove the existing configuration.

Step 8

Save the new settings to the startup configuration:

write memory

These configuration changes are automatically saved on the data units.

Step 9

If you are upgrading ASA FirePOWER modules, disable the ASA REST API or else the ASA FirePOWER module upgrade will fail.

no rest-api agent

Step 10

If you are upgrading ASA FirePOWER modules that are managed by ASDM, you will need to connect ASDM to the individual management IP addresses, so you need to note the IP addresses for each unit.

show running-config interface management_interface_id

Note the cluster-pool poolname used.

show ip[v6] local pool poolname

Note the cluster unit IP addresses.

Example:

asa/unit2/slave# show running-config interface gigabitethernet0/0
!
interface GigabitEthernet0/0
management-only
nameif inside
security-level 100
ip address 10.86.118.1 255.255.252.0 cluster-pool inside-pool
asa/unit2/slave# show ip local pool inside-pool
Begin           End             Mask            Free     Held     In use
10.86.118.16    10.86.118.17    255.255.252.0       0        0        2

Cluster Unit                    IP Address Allocated
unit2                           10.86.118.16
unit1                           10.86.118.17
asa1/unit2/slave#

Step 11

Upgrade the data units.

Choose the procedure below depending on whether you are also upgrading ASA FirePOWER modules. The ASA FirePOWER procedures minimize the number of ASA reloads when also upgrading the ASA FirePOWER module. You can choose to use the data Console or ASDM for these procedures. You may want to use ASDM instead of the Console if you do not have ready access to all of the console ports but can reach ASDM over the network.

Note

During the upgrade process, never use the cluster master unit command to force a data unit to become control; you can cause network connectivity and cluster stability-related problems. You must upgrade and reload all data units first, and then continue with this procedure to ensure a smooth transition from the current control unit to a new control unit.

If you do not have ASA FirePOWER module upgrades:

1. On the control unit, to view member names, enter cluster exec unit ? , or enter the show cluster info command.

2. Reload a data unit.

cluster exec unit data-unit reload noconfirm

Example:

asa/unit1/master# cluster exec unit unit2 reload noconfirm

3. Repeat for each data unit.

To avoid connection loss and allow traffic to stabilize, wait for each unit to come back up and rejoin the cluster (approximately 5 minutes) before repeating these steps for the next unit. To view when a unit rejoins the cluster, enter show cluster info .

If you also have ASA FirePOWER module upgrades (using the data Console):

1. Connect to the console port of a data unit, and enter global configuration mode.

enable

configure terminal

Example:

asa/unit2/slave> enable
Password:
asa/unit2/slave# configure terminal
asa/unit2/slave(config)#

2. Disable clustering.

cluster group name

no enable

Do not save this configuration; you want clustering to be enabled when you reload. You need to disable clustering to avoid multiple failures and rejoins during the upgrade process; this unit should only rejoin after all of the upgrading and reloading is complete.

Example:

asa/unit2/slave(config)# cluster group cluster1
asa/unit2/slave(cfg-cluster)# no enable
Cluster disable is performing cleanup..done.
All data interfaces have been shutdown due to clustering being disabled. To recover either enable clustering or remove cluster group configuration.

Cluster unit unit2 transitioned from SLAVE to DISABLED
asa/unit2/ClusterDisabled(cfg-cluster)#

3. Upgrade the ASA FirePOWER module on this data unit.

For an ASA FirePOWER module managed by ASDM, connect ASDM to the individual management IP address that you noted earlier. Wait for the upgrade to complete.

4. Reload the data unit.

reload noconfirm

5. Repeat for each data unit.

To avoid connection loss and allow traffic to stabilize, wait for each unit to come back up and rejoin the cluster (approximately 5 minutes) before repeating these steps for the next unit. To view when a unit rejoins the cluster, enter show cluster info .

If you also have ASA FirePOWER module upgrades (using ASDM):

1. Connect ASDM to the individual management IP address of this data unit that you noted earlier.

2. Choose Configuration > Device ManagementHigh Availability and Scalability > ASA Cluster > Cluster Configuration > .

3. Uncheck the Participate in ASA cluster check box.

You need to disable clustering to avoid multiple failures and rejoins during the upgrade process; this unit should only rejoin after all of the upgrading and reloading is complete.

Do not uncheck the Configure ASA cluster settings check box; this action clears all cluster configuration, and also shuts down all interfaces including the management interface to which ASDM is connected. To restore connectivity in this case, you need to access the CLI at the console port.

Note

Some older versions of ASDM do not support disabling the cluster on this screen; in this case, use the Tools > Command Line Interface tool, click the Multiple Line radio button, and enter cluster group name and no enable . You can view the cluster group name in the Home > Device Dashboard > Device Information > ASA Cluster area.

4. Click Apply.

5. You are prompted to exit ASDM. Reconnect ASDM to the same IP address.

6. Upgrade the ASA FirePOWER module.

Wait for the upgrade to complete.

7. In ASDM, choose Tools > System Reload.

8. Click the Reload without saving the running configuration radio button.

You do not want to save the configuration; when this unit reloads, you want clustering to be enabled on it.

9. Click Schedule Reload.

10. Click Yes to continue the reload.

11. Repeat for each data unit.

To avoid connection loss and allow traffic to stabilize, wait for each unit to come back up and rejoin the cluster (approximately 5 minutes) before repeating these steps for the next unit. To view when a unit rejoins the cluster, see the Monitoring > ASA Cluster > Cluster Summary pane on the control unit.

Step 12

Upgrade the control unit.

1. Disable clustering.

cluster group name

no enable

Wait for 5 minutes for a new control unit to be selected and traffic to stabilize.

Do not save this configuration; you want clustering to be enabled when you reload.

We recommend manually disabling cluster on the control unit if possible so that a new control unit can be elected as quickly and cleanly as possible.

Example:

asa/unit1/master(config)# cluster group cluster1
asa/unit1/master(cfg-cluster)# no enable
Cluster disable is performing cleanup..done.
All data interfaces have been shutdown due to clustering being disabled. To recover either enable clustering or remove cluster group configuration.

Cluster unit unit1 transitioned from MASTER to DISABLED
asa/unit1/ClusterDisabled(cfg-cluster)#

2. Upgrade the ASA FirePOWER module on this unit.

For an ASA FirePOWER module managed by ASDM, connect ASDM to the individual management IP address that you noted earlier. The main cluster IP address now belongs to the new control unit; this former control unit is still accessible on its individual management IP address.

Wait for the upgrade to complete.

3. Reload this unit.

reload noconfirm

When the former control unit rejoins the cluster, it will be a data unit.

Upgrade an ASA Cluster Using ASDM

To upgrade all units in an ASA cluster, perform the following steps.

Before you begin

- Perform these steps on the control unit. If you are also upgrading the ASA FirePOWER module, then you need ASDM access to each data unit.

- Perform these steps in the system execution space for multiple context mode.

- Place the ASA and ASDM images on your local management computer.

Procedure

Step 1

Launch ASDM on the control unit by connecting to the main cluster IP address.

This IP address always stays with the control unit.

Step 2

In the main ASDM application window, choose Tools > Upgrade Software from Local Computer.

The Upgrade Software from Local Computer dialog box appears.

Step 3

Click the All devices in the cluster radio button.

The Upgrade Software dialog box appears.

Step 4

From the Image to Upload drop-down list, choose ASDM.

Step 5

In the Local File Path field, click Browse Local Files to find the file on your computer.

Step 6

(Optional) In the Flash File System Path field, enter the path to the flash file system or click Browse Flash to find the directory or file in the flash file system.

By default, this field is prepopulated with the following path: disk0:/filename.

Step 7

Click Upload Image. The uploading process might take a few minutes.

Step 8

You are prompted to set this image as the ASDM image. Click Yes.

Step 9

You are reminded to exit ASDM and save the configuration. Click OK.

You exit the Upgrade tool. Note: You will save the configuration and reload ASDM after you upgrade the ASA software.

Step 10

Repeat these steps, choosing ASA from the Image to Upload drop-down list.

Step 11

Click the Save icon on the toolbar to save your configuration changes.

These configuration changes are automatically saved on the data units.

Step 12

Take note of the individual management IP addresses for each unit on Configuration > Device Management > High Availability and Scalability > ASA Cluster > Cluster Members so that you can connect ASDM directly to data units later.

Step 13

If you are upgrading ASA FirePOWER modules, disable the ASA REST API by choosing Tools > Command Line Interface, and entering no rest-api enable .

If you do not disable the REST API, the ASA FirePOWER module upgrade will fail.

Step 14

Upgrade the data units.

Choose the procedure below depending on whether you are also upgrading ASA FirePOWER modules. The ASA FirePOWER procedure minimizes the number of ASA reloads when also upgrading the ASA FirePOWER module.

Note

During the upgrade process, never change the control unit using the Monitoring > ASA Cluster > Cluster Summary page to force a data unit to become control; you can cause network connectivity and cluster stability-related problems. You must reload all data units first, and then continue with this procedure to ensure a smooth transition from the current control unit to a new control unit.

If you do not have ASA FirePOWER module upgrades:

1. On the control unit, choose Tools > System Reload.

2. Choose a data unit name from the Device drop-down list.

3. Click Schedule Reload.

4. Click Yes to continue the reload.

5. Repeat for each data unit.

To avoid connection loss and allow traffic to stabilize, wait for each unit to come back up and rejoin the cluster (approximately 5 minutes) before repeating these steps for the next unit. To view when a unit rejoins the cluster, see the Monitoring > ASA Cluster > Cluster Summary pane.

If you also have ASA FirePOWER module upgrades:

1. On the control unit, choose Configuration > Device Management > High Availability and Scalability > ASA Cluster > Cluster Members.

2. Select the data unit that you want to upgrade, and click Delete.

3. Click Apply.

4. Exit ASDM, and connect ASDM to the data unit by connecting to its individual management IP address that you noted earlier.

5. Upgrade the ASA FirePOWER module.

Wait for the upgrade to complete.

6. In ASDM, choose Tools > System Reload.

7. Click the Reload without saving the running configuration radio button.

You do not want to save the configuration; when this unit reloads, you want clustering to be enabled on it.

8. Click Schedule Reload.

9. Click Yes to continue the reload.

10. Repeat for each data unit.

To avoid connection loss and allow traffic to stabilize, wait for each unit to come back up and rejoin the cluster (approximately 5 minutes) before repeating these steps for the next unit. To view when a unit rejoins the cluster, see the Monitoring > ASA Cluster > Cluster Summary pane.

Step 15

Upgrade the control unit.

1. In ASDM on the control unit, choose Configuration > Device Management > High Availability and Scalability > ASA Cluster > Cluster Configuration pane.

2. Uncheck the Participate in ASA cluster check box, and click Apply.

You are prompted to exit ASDM.

3. Wait for up to 5 minutes for a new control unit to be selected and traffic to stabilize.

When the former control unit rejoins the cluster, it will be a data unit.

4. Re-connect ASDM to the former control unit by connecting to its individual management IP address that you noted earlier.

The main cluster IP address now belongs to the new control unit; this former control unit is still accessible on its individual management IP address.

5. Upgrade the ASA FirePOWER module.

Wait for the upgrade to complete.

6. Choose Tools > System Reload.

7. Click the Reload without saving the running configuration radio button.

You do not want to save the configuration; when this unit reloads, you want clustering to be enabled on it.

8. Click Schedule Reload.

9. Click Yes to continue the reload.

You are prompted to exit ASDM. Restart ASDM on the main cluster IP address; you will reconnect to the new control unit.

Upgrade an ASA FirePOWER Module

Use this procedure to upgrade an ASA FirePOWER module managed by an FMC. When you upgrade the module depends on whether you are upgrading ASA, and on your ASA deployment.

- Upgrading standalone ASA devices: If you are also upgrading ASA, use the FMC to upgrade the ASA FirePOWER module just after you upgrade ASA and reload.

- Upgrading ASA clusters and failover pairs: To avoid interruptions in traffic flow and inspection, fully upgrade these devices one at a time. If you are also upgrading ASA, use the FMC to upgrade the ASA FirePOWER module just before you reload each unit to upgrade ASA.

For more information, see Upgrade Path: ASA FirePOWER and the ASA upgrade procedures.

Caution

Do not deploy changes to or from, manually reboot, or shut down an upgrading appliance. Do not restart an upgrade in progress. The upgrade process may appear inactive during prechecks; this is expected. If you encounter issues with the upgrade, including a failed upgrade or unresponsive appliance, contact Cisco TAC.

Before you begin

Check your place in the upgrade path, including ASA and FMC upgrades. Make sure you have fully planned and prepared for this step.

Procedure

Step 1

Deploy configurations to the devices you are about to upgrade.

On the FMC menu bar, click Deploy. Choose devices, then click Deploy again. Deploying before you upgrade reduces the chance of failure.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts Snort, which interrupts traffic inspection and, depending on how your device handles traffic, may interrupt traffic until the restart completes. For more information, see ASA FirePOWER Upgrade Behavior.

Step 2

(Upgrading to Version 6.1+) Disable the ASA REST API.

If you do not disable the REST API, the upgrade will fail. Note that ASA 5506-X series devices do not support the ASA REST API if you are also running Version 6.0+ of the ASA FirePOWER module.

Use the CLI on the ASA to disable the REST API:

no rest-api agent

You can reenable it after the upgrade:

rest-api agent

Step 3

Perform final preupgrade checks.

- Check health: Use the Message Center (click the System Status icon on the menu bar). Make sure the appliances in your deployment are successfully communicating and that there are no issues reported by the health monitor.

- Running tasks: Also in the Message Center, make sure essential tasks are complete. Tasks running when the upgrade begins are stopped, become failed tasks, and cannot be resumed. You can manually delete failed status messages later.

- Check disk space: Perform a final disk space check. Without enough free disk space, the upgrade fails. For disk space requirements, see Time Tests and Disk Space Requirements.

Step 4

Choose System > Updates.

Step 5

Click the Install icon next to the upgrade package you want to use and choose the devices to upgrade.

If the devices you want to upgrade are not listed, you chose the wrong upgrade package.

Note

We strongly recommend upgrading no more than five devices simultaneously. The FMC does not allow you stop the upgrade until all selected devices complete the process. If there is an issue with any one device upgrade, all devices must finish upgrading before you can resolve the issue.

Step 6

Click Install, then confirm that you want to upgrade and reboot the devices.

Traffic either drops throughout the upgrade or traverses the network without inspection depending on how your devices are configured and deployed. For more information, see ASA FirePOWER Upgrade Behavior.

Step 7

Monitor upgrade progress in the Message Center.

Do not deploy configurations to the device while it is upgrading. Even if the Message Center shows no progress for several minutes or indicates that the upgrade has failed, do not restart the upgrade or reboot the device. Instead, contact Cisco TAC.

Step 8

Verify success.

After the upgrade completes, choose Devices > Device Management and confirm that the devices you upgraded have the correct software version.

Step 9

Use the Message Center to recheck deployment health.

Step 10

Update intrusion rules (SRU) and the vulnerability database (VDB).

If the SRU or the VDB available on the Cisco Support & Downloads site is newer than the version currently running, install the newer version. For more information, see the Firepower Management Center Configuration Guide. Note that when you update intrusion rules, you do not need to automatically reapply policies. You will do that later.

Step 11

Complete any post-upgrade configuration changes described in the release notes.

Step 12

Redeploy configurations to the devices you just upgraded.

Part III. Reference

- Compatibility

- Firepower Software Upgrade Guidelines by Version

- Time Tests and Disk Space Requirements

- Traffic Flow, Inspection, and Device Behavior

Chapter 12. Compatibility

The following topics provide Cisco Firepower software and hardware compatibility, including operating system and hosting environment requirements, for each supported Firepower version.

Note

This guide provides compatibility information relevant to the upgrade process. For additional information, see the Cisco Firepower Compatibility Guide.

- Firepower Management Centers

- Firepower Devices

Firepower Management Centers

- Firepower Management Centers: Physical

- Firepower Management Centers: Virtual

- BIOS and Firmware for FMCs

Firepower Management Centers: Physical

Firepower Management Center Compatibility

Firepower Version

FMC 1600

FMC 2600

FMC 4600

FMC 1000

FMC 2500

FMC 4500

FMC 2000

FMC 4000

FMC 750

FMC 1500

FMC 3500

DC 500

DC 1000

DC 3000

6.7.x

YES

YES

—

—

—

6.6.x

YES

YES

YES

—

—

6.5.0

YES

YES

YES

—

—

6.4.0

YES

YES

YES

YES

—

6.3.0

YES

YES

YES

YES

—

6.2.3

—

YES

YES

YES

—

6.2.2

—

YES

YES

YES

—

6.2.1

—

YES

YES

YES

—

6.2.0

—

YES

YES

YES

—

6.1.0

—

—

YES

YES

—

6.0.1

—

—

YES

YES

—

6.0.0

—

—

YES

YES

—

5.4.1

—

—

YES

YES

YES

5.4.0 *

—

—

YES

YES

YES

* 5.4.0 only. Use 5.4.1.x Defense Centers to manage 5.4.x devices.

Firepower Management Centers: Virtual

These tables lists Firepower compatibility and virtual hosting environment requirements for FMCv. Note that support for FMCv 300 on VMware begins in Version 6.5.0.

FMCv Compatibility: Firepower Version 6.2.3+ for VMware

Firepower Version

VMware vSphere/VMware ESXi

6.7

6.5

6.0

5.5

5.1

6.7.x

YES

YES

YES

—

—

6.6.x

YES

YES

YES

—

—

6.5.0

YES

YES

YES

—

—

6.4.0

—

YES

YES

—

—

6.3.0

—

YES

YES

—

—

6.2.3

—

YES

YES

YES

—

FMCv Compatibility: Firepower Version 5.4–6.2.2 for VMware

Firepower Version

VMware vSphere/VMware ESXi

VMware vCloud Director

6.0

5.5

5.1

5.0

6.2.2

YES

YES

—

—

—

6.2.1

YES

YES

—

—

—

6.2.0

YES

YES

—

—

—

6.1.0

YES

YES

—

—

—

6.0.1

—

YES

YES

—

—

6.0.0

—

YES

YES

—

—

5.4.1

—

YES

YES

YES

YES

5.4.0 *

—

YES

YES

YES

YES

* 5.4.0 only; use 5.4.1.x Defense Centers to manage 5.4.x devices.

FMCv Compatibility: Other Hypervisors

Firepower Version

Amazon Web Services (AWS)

Microsoft Azure

Oracle Cloud Infrastructure (OCI)

Google Cloud Platform (GCP)

Kernel-Based Virtual Machine (KVM)

6.7.x

YES

YES

YES

YES

YES

6.6.x

YES

YES

—

—

YES

6.5.0

YES

YES

—

—

YES

6.4.0

YES

YES

—

—

YES

6.3.0

YES

—

—

—

YES

6.2.3

YES

—

—

—

YES

6.2.2

YES

—

—

—

YES

6.2.1

YES

—

—

—

YES

6.2.0

YES

—

—

—

YES

6.1.0

YES

—

—

—

YES

6.0.1

YES

—

—

—

—

BIOS and Firmware for FMCs

We provide updates for BIOS and RAID controller firmware. If your FMC does not meet the requirements listed in the following table, apply the appropriate hotfix. If your FMC is not listed, the factory defaults meet the minimum requirements.

BIOS and Firmware Minimum Requirements

Platform

Firepower Version

BIOS

RAID Controller Firmware

Hotfix

FMC 1600, 2600, 4600

6.3.0+

C220M5.4.1.1c.0

51.10.0-2978

BIOS Update Hotfix EC

FMC 1000, 2500, 4500

6.2.3+

C220M4.4.0.2d.0

24.12.1-0433

BIOS Update Hotfix CJ

FMC 2000, 4000

6.2.3+

C220M3.2.0.8.0

23.33.0-0049

BIOS Update Hotfix CJ

Hotfixing is the only way to update the BIOS and RAID controller firmware. Upgrading the Firepower software does not accomplish this task, nor does reimaging to a later version. Note that hotfixing also updates the CIMC firmware. Although we do not support changing configurations on the FMC using CIMC, if you have concerns, apply the hotfix. If the FMC is already up to date, the hotfix has no effect.

Use the regular upgrade process to apply hotfixes. For hotfix release notes, which include quicklinks to the Cisco Support & Download site, see the Cisco Firepower Hotfix Release Notes.

Note

The FMC web interface may display BIOS update hotfixes with a version newer than the FMC's current version; for example, Hotfix EC Version 6.8.0. This is expected behavior and the hotfixes are safe to apply.

Determining BIOS and Firmware Versions

To determine the current versions on an FMC, run these commands from the Linux shell/expert mode:

- BIOS: sudo dmidecode -t bios -q

- RAID controller firmware (FMC 4500): sudo MegaCLI -AdpAllInfo -aALL | grep "FW Package"

- RAID controller firmware (all other models): sudo storcli /c0 show | grep "FW Package"

Firepower Devices

- Firepower 1000/2100 Series with FTD

- Firepower 4100/9300 with FTD

- ASA 5500-X Series and ISA 3000 with FTD

- Firepower Threat Defense Virtual

- Firepower 7000/8000 Series and Legacy Devices

- ASA 5500-X Series and ISA 3000 with FirePOWER Services

- NGIPSv

Firepower 1000/2100 Series with FTD

Firepower 1000 and Firepower 2100 series devices use the FXOS operating system. Upgrading Firepower Threat Defense automatically upgrades FXOS.

These devices can also run ASA instead of FTD. For more information, see Cisco ASA Compatibility.

Firepower 1000/2100 Series Compatibility

Firepower Version

Firepower 2110

Firepower 2120

Firepower 2130

Firepower 2140

Firepower 1010

Firepower 1120

Firepower 1140

Firepower 1150

6.7.x

YES

YES

YES

6.6.x

YES

YES

YES

6.5.0

YES

YES

YES

6.4.0

YES

YES

—

6.3.0

YES

—

—

6.2.3

YES

—

—

6.2.2

YES

—

—

6.2.1

YES

—

—

Firepower 4100/9300 with FTD

For the Firepower 4100/9300 chassis, major Firepower versions have a specially qualified and recommended companion FXOS version, listed below in bold. Use these combinations whenever possible, because we perform enhanced testing for them.

These devices can also run ASA instead of FTD. With ASA 9.12+ and FTD 6.4.0+, you can run both ASA and FTD on separate modules in the same Firepower 9300 chassis. For more information, see Cisco Firepower 4100/9300 FXOS Compatibility.

To resolve issues, you may need to upgrade FXOS to the latest build. To help you decide, see the Cisco Firepower 4100/9300 FXOS Release Notes.

Note

To perform flow offload in the following major version sequences, you must be running a specific combination of Firepower and FXOS:

- Version 6.2.2.x: Version 6.2.2.2+ on FXOS 2.3.1.130+

- Version 6.2.0.x: Version 6.2.0.3+ on either FXOS 2.2.1.x or FXOS 2.2.2, builds 17-86

Firepower 4100/9300 Compatibility

Firepower Version

FXOS Version

Firepower 9300

Firepower 4100 Series

SM-26

SM-36

SM-44

SM-40

SM-48

SM-56

4110

4120

4140

4150

4112

4115

4125

4145

6.7.x

2.9.1.131+

YES

YES

YES

YES

YES

YES

6.6.x

2.8.1.105+

2.9.1.131+

YES

YES

YES

YES

YES

YES

6.5.0

2.7.1.92+

2.8.1.105+

2.9.1.131+

YES

YES

YES

YES

—

YES

6.4.0

2.6.1.157+

2.7.1.92+

2.8.1.105+

2.9.1.131+

YES

YES

YES

YES

—

YES

6.3.0

2.4.1.214+

2.6.1.157+

2.7.1.92+

2.8.1.105+

2.9.1.131+

YES

—

YES

YES

—

—

6.2.3

2.3.1.73+

2.4.1.214+

2.6.1.157+

2.7.1.92+

2.8.1.105+

Note

Firepower 6.2.3.16+ requires FXOS 2.3.1.157+.

YES

—

YES

YES

—

—

6.2.2

2.2.2.x

2.3.1.73+

2.4.1.214+

2.6.1.157+

2.7.1.92+

YES

—

YES

YES

—

—

6.2.1

—

—

—

—

—

—

—

6.2.0

2.1.1.x, 2.2.1.x, 2.2.2.x

2.3.1.73+

2.4.1.214+

2.6.1.157+

YES

—

YES

YES

—

—

6.1.0

2.0.1.x

2.1.1.x

2.3.1.73+

YES

—

YES

YES

—

—

6.0.1

1.1.4.x

2.0.1.x

YES

—

YES

—

—

—

ASA 5500-X Series and ISA 3000 with FTD

ASA 5500-X series and ISA 3000 devices use the ASA operating system. Upgrading Firepower Threat Defense automatically upgrades ASA.

ASA 5500-X Series and ISA 3000 Compatibility

Firepower Version

ASA 5508-X

ASA 5516-X

ISA 3000

ASA 5525-X

ASA 5545-X

ASA 5555-X

ASA 5515-X

ASA 5506-X

ASA 5506H-X

ASA 5506W-X

ASA 5512-X

6.7.x

YES

YES

—

—

—

6.6.x

YES

YES

YES

—

—

6.5.0

YES

YES

YES

—

—

6.4.0

YES

YES

YES

YES

—

6.3.0

YES

YES

YES

YES

—

6.2.3

YES

YES

YES

YES

YES

6.2.2

YES

—

YES

YES

YES

6.2.1

—

—

—

—

—

6.2.0

YES

—

YES

YES

YES

6.1.0

YES

—

YES

YES

YES

6.0.1

YES

—

YES

YES

YES

Firepower Threat Defense Virtual

These tables list Firepower compatibility and virtual hosting environment requirements for FTDv.

FTDv Compatibility: VMware

Firepower Version

VMware vSphere/VMware ESXi

6.7

6.5

6.0

5.5

5.1

6.7.x

YES

YES

YES

—

—

6.6.x

YES

YES

YES

—

—

6.5.0

YES

YES

YES

—

—

6.4.0

—

YES

YES

—

—

6.3.0

—

YES

YES

—

—

6.2.3

—

YES

YES

YES

—

6.2.2

—

—

YES

YES

—

6.2.1

—

—

—

—

—

6.2.0

—

—

YES

YES

—

6.1.0

—

—

YES

YES

—

6.0.1

—

—

—

YES

YES

FTDv Compatibility: Other Hypervisors

Firepower Version

Amazon Web Services (AWS)

Microsoft Azure

Oracle Cloud Infrastructure (OCI)

Google Cloud Platform (GCP)

Kernel-Based Virtual Machine (KVM)

6.7.x

YES

YES

YES

YES

YES

6.6.x

YES

YES

—

—

YES

6.5.0

YES

YES

—

—

YES

6.4.0

YES

YES

—

—

YES

6.3.0

YES

YES

—

—

YES

6.2.3

YES

YES

—

—

YES

6.2.2

YES

YES

—

—

YES

6.2.1

—

—

—

—

—

6.2.0

YES

YES

—

—

YES

6.1.0

YES

—

—

—

YES

6.0.1

YES

—

—

—

—

Firepower 7000/8000 Series and Legacy Devices

This table lists Firepower compatibility with 7000/8000 series devices, AMP models, and legacy device platforms.

Firepower 7000/8000 Series Compatibility

Firepower Version

7000/8000 Series (Includes AMP)

Series 2 (Legacy)

Cisco NGIPS for Blue Coat X-Series (Legacy)

6.4.0

YES

—

—

6.3.0

YES

—

—

6.2.3

YES

—

—

6.2.2

YES

—

—

6.2.1

—

—

—

6.2.0

YES

—

—

6.1.0

YES

—

—

6.0.0

YES

—

—

5.4.0

YES

YES

5.4.0 and 5.4.0.2 - 5.4.0.5 only

Requires XOS 9.7.2.x or 10.x

ASA 5500-X Series and ISA 3000 with FirePOWER Services

The ASA FirePOWER module runs on the separately upgraded ASA operating system. There is wide compatibility between ASA and ASA FirePOWER versions. However, even if an ASA upgrade is not strictly required, resolving issues may require an upgrade to the latest supported version.

Note

ASA 9.14(x)/ASDM 7.14(x)/FirePOWER 6.6 was the final version for the ASA 5525-X, 5545-X, and 5555-X.

ASA 9.12(x)/ASDM 7.12(x)/FirePOWER 6.4 was the final version for the ASA 5515-X and 5585-X.

ASDM versions are backwards compatible with all previous ASA versions, unless otherwise stated. For example, ASDM 7.13(1) can manage an ASA 5516-X on ASA 9.10(1). ASDM 7.13(1) and ASDM 7.14(1) did not support ASA 5512-X, 5515-X, 5585-X, and ASASM; you must upgrade to ASDM 7.13(1.101) or 7.14(1.48) to restore ASDM support.

This table lists ASA FirePOWER compatibility with ASA device models, ASA OS versions, and ASDM. If you are using an FMC to manage ASA FirePOWER, you can ignore the ASDM requirements. Note that the Firepower captive portal feature requires at least ASA FirePOWER Version 6.0.0 on ASA 9.5(2).

ASA and ASA FirePOWER Compatibility

ASA FirePOWER Version

ASDM Version (for local mgmt)

ASA Version

ASA Model

5506-X Series

5508-X

5516-X

5512-X

5515-X

5525-X

5545-X

5555-X

5585-X (See below for SSP notes)

ISA 3000

6.7.x

ASDM 7.15(1)

ASA 9.15(x)

ASA 9.14(x)

ASA 9.13(x)

ASA 9.12(x)

ASA 9.10(x)

ASA 9.9(x)

ASA 9.8(x)

ASA 9.7(x)

ASA 9.6(x)

ASA 9.5(2), 9.5(3)

—

YES

—

—

—

—

YES

6.6.x

ASDM 7.14(1)

ASA 9.15(x) (No 5525-X, 5545-X, 5555-X)

ASA 9.14(x)

ASA 9.13(x)

ASA 9.12(x)

ASA 9.10(x)

ASA 9.9(x)

ASA 9.8(x)

ASA 9.7(x)

ASA 9.6(x)

ASA 9.5(2), 9.5(3)

—

YES

—

—

YES

—

YES

6.5.0

ASDM 7.13(1)

ASA 9.15(x) (No 5525-X, 5545-X, 5555-X)

ASA 9.14(x)

ASA 9.13(x)

ASA 9.12(x)

ASA 9.10(x)

ASA 9.9(x)

ASA 9.8(x)

ASA 9.7(x)

ASA 9.6(x)

ASA 9.5(2), 9.5(3)

—

YES

—

—

YES

—

YES

6.4.0

ASDM 7.12(1)

ASA 9.15(x) (No 5515-X, 5525-X, 5545-X, 5555-X, 5585-X)

ASA 9.14(x) (No 5515-X, 5585-X)

ASA 9.13(x) (No 5515-X, 5585-X)

ASA 9.12(x)

ASA 9.10(x)

ASA 9.9(x)

ASA 9.8(x)

ASA 9.7(x)

ASA 9.6(x)

ASA 9.5(2), 9.5(3)

—

YES

—

YES

YES

YES

YES

6.3.0

ASDM 7.10(1)

ASA 9.15(x) (No 5515-X, 5525-X, 5545-X, 5555-X, 5585-X)

ASA 9.14(x) (No 5515-X, 5585-X)

ASA 9.13(x) (No 5515-X, 5585-X)

ASA 9.12(x)

ASA 9.10(x)

ASA 9.9(x)

ASA 9.8(x)

ASA 9.7(x)

ASA 9.6(x)

ASA 9.5(2), 9.5(3)

—

YES

—

YES

YES

YES

YES

6.2.3

ASDM 7.9(2)

ASA 9.15(x) (No 5506-X, 5512-X,5515-X, 5525-X, 5545-X, 5555-X, 5585-X)

ASA 9.14(x) (No 5506-X, 5512-X, 5515-X, 5585-X)

ASA 9.13(x) (No 5506-X, 5512-X, 5515-X, 5585-X)

ASA 9.12(x) (No 5506-X, 5512-X)

ASA 9.10(x) (No 5506-X, 5512-X)

ASA 9.9(x)

ASA 9.8(x)

ASA 9.7(x)

ASA 9.6(x)

ASA 9.5(2), 9.5(3) (No 5506-X)

YES

YES

YES

YES

YES

YES

—

6.2.2

ASDM 7.8(2)

ASA 9.15(x) (No 5506-X, 5512-X,5515-X, 5525-X, 5545-X, 5555-X, 5585-X)

ASA 9.14(x) (No 5506-X, 5512-X, 5515-X, 5585-X)

ASA 9.13(x) (No 5506-X, 5512-X, 5515-X, 5585-X)

ASA 9.12(x) (No 5506-X, 5512-X)

ASA 9.10(x) (No 5506-X, 5512-X)

ASA 9.9(x)

ASA 9.8(x)

ASA 9.7(x)

ASA 9.6(x)

ASA 9.5(2), 9.5(3) (No 5506-X)

YES

YES

YES

YES

YES

YES

—

6.2.0

ASDM 7.7(1)

ASA 9.15(x) (No 5506-X, 5512-X,5515-X, 5525-X, 5545-X, 5555-X, 5585-X)

ASA 9.14(x) (No 5506-X, 5512-X, 5515-X, 5585-X)

ASA 9.13(x) (No 5506-X, 5512-X, 5515-X, 5585-X)

ASA 9.12(x) (No 5506-X, 5512-X)

ASA 9.10(x) (No 5506-X, 5512-X)

ASA 9.9(x)

ASA 9.8(x)

ASA 9.7(x)

ASA 9.6(x)

ASA 9.5(2), 9.5(3) (No 5506-X)

YES

YES

YES

YES

YES

YES

—

6.1.0

ASDM 7.6(2)

ASA 9.15(x) (No 5506-X, 5512-X,5515-X, 5525-X, 5545-X, 5555-X, 5585-X)

ASA 9.14(x) (No 5506-X, 5512-X, 5515-X, 5585-X)

ASA 9.13(x) (No 5506-X, 5512-X, 5515-X, 5585-X)

ASA 9.12(x) (No 5506-X, 5512-X)

ASA 9.10(x) (No 5506-X, 5512-X)

ASA 9.9(x)

ASA 9.8(x)

ASA 9.7(x)

ASA 9.6(x)

ASA 9.5(2), 9.5(3) (No 5506-X)

YES

YES

YES

YES

YES

YES

—

6.0.1

ASDM 7.6(1) (no ASA 9.4(x) support with ASDM; only FMC)

ASA 9.6(x)

ASA 9.5(1.5), 9.5(2), 9.5(3)

ASA 9.4(x)

Due to CSCuv91730, we recommend that you upgrade to 9.4(2) and later.

YES

YES

YES

YES

YES

YES

—

6.0.0

ASDM 7.5(1.112) (no ASA 9.4(x) support with ASDM; only FMC)

ASA 9.6(x)

ASA 9.5(1.5), 9.5(2), 9.5(3)

ASA 9.4(x)

Due to CSCuv91730, we recommend that you upgrade to 9.4(2) and later.

YES

YES

YES

YES

YES

YES

—

5.4.1.7+

ASDM 7.5(1.112) (no ASA 9.4(x) support with ASDM; only FMC)

ASA 9.15(x) (No 5506-X, 5512-X,5515-X, 5525-X, 5545-X, 5555-X, 5585-X)

ASA 9.14(x) (No 5506-X)

ASA 9.13(x) (No 5506-X)

ASA 9.12(x) (No 5506-X)

ASA 9.10(x) (No 5506-X)

ASA 9.9(x)

ASA 9.8(x)

ASA 9.7(x)

ASA 9.6(x)

ASA 9.5(2), 9.5(3)

ASA 9.4(x)

ASA 9.4(1.225) (ISA 3000 only)

ASA 9.3(2), 9.3(3) (no 5508-X or 5516-X)

Due to CSCuv91730, we recommend that you upgrade to 9.3(3.8) or 9.4(2) and later.

YES

YES

—

—

—

—

YES

5.4.1

ASDM 7.3(3)

ASA 9.15(x) (No 5506-X)

ASA 9.14(x) (No 5506-X)

ASA 9.13(x) (No 5506-X)

ASA 9.12(x) (No 5506-X)

ASA 9.10(x) (No 5506-X)

ASA 9.9(x)

ASA 9.8(x)

ASA 9.7(x)

ASA 9.6(x)

ASA 9.5(1.5), 9.5(2), 9.5(3)

ASA 9.4(x)

ASA 9.3(2), 9.3(3) (5506-X only)

Due to CSCuv91730, we recommend that you upgrade to 9.3(3.8) or 9.4(2) and later.

YES

YES

—

—

—

—

—

5.4.0.2+

—

ASA 9.14(x) (No 5512-X, 5515-X, 5585-X)

ASA 9.13(x) (No 5512-X, 5515-X, 5585-X)

ASA 9.12(x)

ASA 9.10(x)

ASA 9.9(x)

ASA 9.8(x)

ASA 9.7(x)

ASA 9.6(x)

ASA 9.5(1.5), 9.5(2), 9.5(3)

ASA 9.4(x)

ASA 9.3(2), 9.3(3)

Due to CSCuv91730, we recommend that you upgrade to 9.3(3.8) or 9.4(2) and later.

—

—

YES

YES

YES

YES

—

5.4.0.1

—

ASA 9.2(2.4), 9.2(3), 9.2(4)

Due to CSCuv91730, we recommend that you upgrade to 9.2(4.5) and later.

—

—

YES

YES

YES

YES

—

5.3.1

—

ASA 9.2(2.4), 9.2(3), 9.2(4)

Due to CSCuv91730, we recommend that you upgrade to 9.2(4.5) and later.

—

—

YES

YES

YES

YES

—

ASA 5585-X SSP Compatibility

Same level SSPs

ASA FirePOWER SSP -10, -20, -40, and -60

Requirements: Install in slot 1, with matching-level ASA SSP in slot 0

Mixed level SSPs

Support for the following combinations starts with version 5.4.0.1.

- ASA SSP-10/ASA FirePOWER SSP-40

- ASA SSP-20/ASA FirePOWER SSP-60

- ASA SSP-40/ASA FirePOWER SSP-60

Requirements: ASA SSP in slot 0, ASA FirePOWER SSP in slot 1

Note

For the SSP40/60 combination, you might see an error message that this combination is not supported. You can ignore the message.

NGIPSv

This table lists Firepower compatibility and virtual hosting environment requirements for NGIPSv (virtual NGIPS devices running on VMware).

NGIPSv Compatibility

Firepower Version

VMware vSphere/VMware ESXi

VMware vCloud Director

6.7

6.5

6.0

5.5

5.1

5.0

5.1

6.7.x

YES

YES

YES

—

—

—

—

6.6.x

YES

YES

YES

—

—

—

—

6.5.0

YES

YES

YES

—

—

—

—

6.4.0

—

YES

YES

—

—

—

—

6.3.0

—

YES

YES

—

—

—

—

6.2.3

—

YES

YES

YES

—

—

—

6.2.2

—

—

YES

YES

—

—

—

6.2.1

—

—

—

—

—

—

—

6.2.0

—

—

YES

YES

—

—

—

6.1.0

—

—

YES

YES

—

—

—

6.0.1

—

—

—

YES

YES

—

—

6.0.0

—

—

—

YES

YES

—

—

5.4.0

—

—

—

YES

YES

YES

YES

Chapter 13. Firepower Software Upgrade Guidelines by Version

This upgrade guide duplicates the deprecated features and version-specific upgrade guidelines in the Cisco Firepower Release Notes.

- About Upgrade Guidelines for Firepower Software

- Version 6.7.0 Guidelines

- Version 6.6.0 Guidelines

- Version 6.5.0 Guidelines

- Version 6.4.0 Guidelines

- Version 6.3.0 Guidelines

- Version 6.2.3 Guidelines

- Version 6.2.2 Guidelines

- Version 6.2.0 Guidelines

- Version 6.1.0 Guidelines

- Version 6.0.0 Guidelines

- Patch Guidelines by Version

- Date-Based Guidelines

- Deprecated Features for Major Versions

- Deprecated Features for Patches

About Upgrade Guidelines for Firepower Software

For your convenience, this upgrade guide duplicates the deprecated features and version-specific upgrade guidelines in the Cisco Firepower Release Notes. However, this guide does not replace the release notes. You should always read the release notes for your target version, and for any other major or maintenance releases you are skipping.

Important

Upgrade guidelines can appear in multiple places. Use this checklist to make sure you read them all.

Index to Upgrade Guidelines for Firepower Software

✓

Release Notes Resource

Details

Guidelines for Version x.x.x

and

Previously Published Guidelines

This upgrade guide duplicates the version-specific guidelines in the Upgrade chapter of the Firepower release notes.

Note

If your upgrade skips Firepower versions, guidelines for intermediate releases can apply. The checklists will help you identify all applicable guidelines—then follow the cross references/links to read about them. In this chapter, upgrade guidelines appear under the version where they first apply.

General Guidelines

The general guidelines in the Upgrade chapter of the Firepower release notes are a condensed version of the upgrade planning information in this upgrade guide. We recommend you read them even if you are familiar with the upgrade process.

Known Issues

The Firepower release notes for each major version provides a list of known issues. Read the list and be prepared to work around any bugs that affect upgrade.

Although we do not list known issues for maintenance releases or patches, you can use the Cisco Bug Search Tool to obtain an up-to-date list of open bugs for Firepower products.

Features and Functionality

This upgrade guide duplicates the deprecated features in the Features and Functionality chapter of the Firepower release notes, because deprecated features are the most likely to require pre-upgrade configuration changes.

However, this guide does not duplicate new feature descriptions. Especially for major releases, new features, functionality, and enhancements may change system behavior on upgrade. And although maintenance releases and patches only contain functionality and behavior changes related to urgent or resolved issues, we still recommend you check.

Version 6.7.0 Guidelines

This checklist contains upgrade guidelines that are new or specific to Version 6.7.0. Review these guidelines if you are currently running Version 6.3.0 through 6.6.x.

Version 6.7.0 New Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Upgrade Failure with Invalid VLAN IDs on Firepower 1010 Switch Ports

Firepower 1010

6.4.0 through 6.6.x

6.7.0+

This checklist contains upgrade guidelines that apply to intermediate releases. Review these guidelines if you are currently running Version 6.3.0 through 6.5.0.

Version 6.7.0 Previously Published Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

FMCv Requires 28 GB RAM for Upgrade

FMCv

6.2.3 through 6.5.0.x

6.6.0+

Events Temporarily Unavailable After FMC Upgrade

FMC

6.2.3 through 6.5.0.x

6.6.0+

Firepower 1000 Series Devices Require Post-Upgrade Power Cycle

Firepower 1000 series

6.4.0.x

6.5.0+

New URL Categories and Reputations

Any

6.2.3 through 6.4.0.x

6.5.0+

TLS Crypto Acceleration Enabled/Cannot Disable

Firepower 2100 series

Firepower 4100/9300

6.2.3 through 6.3.0.x

6.4.0+

Upgrade Failure with Invalid VLAN IDs on Firepower 1010 Switch Ports

Deployments: Firepower 1010

Upgrading from: Version 6.4.0 through 6.6.x

Directly to: Version 6.7.0+

For the Firepower 1010, FTD upgrades to Version 6.7.0+ will fail if you configured switch ports with a VLAN ID in the 3968–4047 range. These IDs are for internal use only.

Version 6.6.0 Guidelines

This checklist contains upgrade guidelines that are new or specific to Version 6.6.0. Review these guidelines if you are currently running Version 6.2.3 through 6.5.0.

Version 6.6.0 New Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

FMCv Requires 28 GB RAM for Upgrade

FMCv

6.2.3 through 6.5.0.x

6.6.0+

Events Temporarily Unavailable After FMC Upgrade

FMC

6.2.3 through 6.5.0.x

6.6.0+

This checklist contains upgrade guidelines that apply to intermediate releases. Review these guidelines if you are currently running Version 6.2.3 through 6.4.0.

Version 6.6.0 Previously Published Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Firepower 1000 Series Devices Require Post-Upgrade Power Cycle

Firepower 1000 series

6.4.0.x

6.5.0+

New URL Categories and Reputations

Any

6.2.3 through 6.4.0.x

6.5.0+

TLS Crypto Acceleration Enabled/Cannot Disable

Firepower 2100 series

Firepower 4100/9300

6.2.3 through 6.3.0.x

6.4.0+

Readiness Check May Fail on FMC, 7000/8000 Series, NGIPSv

FMC

Firepower 7000/8000 series

NGIPSv

6.1.0 through 6.1.0.6

6.2.0 through 6.2.0.6

6.2.1

6.2.2 through 6.2.2.4

6.2.3 through 6.2.3.4

6.3.0+

RA VPN Default Setting Change Can Block VPN Traffic

FTD with FMC

6.2.0 through 6.2.3.x

6.3.0+

Security Intelligence Enables Application Identification

FMC deployments

6.1.0 through 6.2.3.x

6.3.0+

Update VDB after Upgrade to Enable CIP Detection

Any

6.1.0 through 6.2.3.x

6.3.0+

Invalid Intrusion Variable Sets Can Cause Deploy Failure

Any

6.1.0 through 6.2.3.x

6.3.0+

FMCv Requires 28 GB RAM for Upgrade

Deployments: FMCv

Upgrading from: Version 6.2.3 through 6.5.0.x

Directly to: Version 6.6.0+

All FMCv implementations now have the same RAM requirements: 32 GB recommended, 28 GB required (64 GB for FMCv 300). Upgrades to Version 6.6.0+ will fail if you allocate less than 28 GB to the virtual appliance. After upgrade, the health monitor will alert if you lower the memory allocation.

These new memory requirements enforce uniform requirements across all virtual environments, improve performance, and allow you to take advantage of new features and functionality. We recommend you do not decrease the default settings. To improve performance, you can increase a virtual appliance’s memory and number of CPUs, depending on your available resources. For details on FMCv memory requirements, see the Cisco Firepower Management Center Virtual Getting Started Guide.

Note

As of the Version 6.6.0 release, lower-memory instance types for cloud-based FMCv deployments (AWS, Azure) are fully deprecated. You cannot create new FMCv instances using them, even for earlier Firepower versions. You can continue running existing instances.

This table summarizes pre-upgrade requirements for lower-memory FMCv deployments.

FMCv Memory Requirements for Version 6.6.0+ Upgrades

Platform

Pre-Upgrade Action

Details

VMware

Allocate 28 GB minimum/32 GB recommended.

Power off the virtual machine first.

For instructions, see the VMware documentation.

KVM

Allocate 28 GB minimum/32 GB recommended.

For instructions, see the documentation for your KVM environment.

AWS

Resize instances:

- From c3.xlarge to c3.4xlarge.

- From c3.2.xlarge to c3.4xlarge.

- From c4.xlarge to c4.4xlarge.

- From c4.2xlarge to c4.4xlarge.

We also offer a c5.4xlarge instance for new deployments.

Stop the instance before you resize. Note that when you do this, data on the instance store volume is lost, so migrate your instance store-backed instance first. Additionally, if your management interface does not have an Elastic IP address, its public IP address is released.

For instructions, see the documentation on changing your instance type in the AWS user guide for Linux instances.

Azure

Resize instances:

- From Standard_D3_v2 to Standard_D4_v2.

Use the Azure portal or PowerShell. You do not need to stop the instance before you resize, but stopping may reveal additional sizes. Resizing restarts a running virtual machine.

For instructions, see the Azure documentation on resizing a Windows VM.

Events Temporarily Unavailable After FMC Upgrade

Deployments: FMC

Upgrading from: Version 6.2.3 through 6.5.0.x

Directly to: Version 6.6.0+

Version 6.6.0 uses a new datastore for connection and Security Intelligence events.

After the upgrade finishes and the FMC reboots, historical connection and Security Intelligence events are migrated in the background, resource constrained. Depending on FMC model, system load, and how many events you have stored, this can take from a few hours up to a day.

Historical events are migrated by age, newest events first. Events that have not been migrated do not appear in query results or dashboards. If you reach the connection event database limit before the migration completes, for example, because of post-upgrade events, the oldest historical events are not migrated.

Tip

Monitor event migration progress in the Message Center by clicking the System Status icon on the menu bar.

Version 6.5.0 Guidelines

This checklist contains upgrade guidelines are new or specific to Version 6.5.0. Review these guidelines if you are currently running Version 6.2.3 through 6.4.0.

Version 6.5.0 New Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Firepower 1000 Series Devices Require Post-Upgrade Power Cycle

Firepower 1000 series

6.4.0.x

6.5.0+

Disable Egress Optimization for Version 6.5.0

FTD

6.2.3 through 6.4.0.x

6.5.0 only

New URL Categories and Reputations

Any

6.2.3 through 6.4.0.x

6.5.0+

This checklist contains upgrade guidelines that apply to intermediate releases. Review these guidelines if you are currently running Version 6.2.3 or 6.3.0.

Version 6.5.0 Previously Published Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Upgrade Failure: Insufficient Disk Space on Container Instances

Firepower 4100/9300

6.3.0 through 6.4.0.x

6.3.0.1 through 6.5.0

TLS Crypto Acceleration Enabled/Cannot Disable

Firepower 2100 series

Firepower 4100/9300

6.2.3 through 6.3.0.x

6.4.0+

Readiness Check May Fail on FMC, 7000/8000 Series, NGIPSv

FMC

Firepower 7000/8000 series

NGIPSv

6.1.0 through 6.1.0.6

6.2.0 through 6.2.0.6

6.2.1

6.2.2 through 6.2.2.4

6.2.3 through 6.2.3.4

6.3.0+

RA VPN Default Setting Change Can Block VPN Traffic

FTD with FMC

6.2.0 through 6.2.3.x

6.3.0+

Security Intelligence Enables Application Identification

FMC deployments

6.1.0 through 6.2.3.x

6.3.0+

Update VDB after Upgrade to Enable CIP Detection

Any

6.1.0 through 6.2.3.x

6.3.0+

Invalid Intrusion Variable Sets Can Cause Deploy Failure

Any

6.1.0 through 6.2.3.x

6.3.0+

Firepower 1000 Series Devices Require Post-Upgrade Power Cycle

Deployments: Firepower 1000 series

Upgrading from: Version 6.4.0.x

Directly to: Version 6.5.0+

Version 6.5.0 introduces an FXOS CLI 'secure erase' feature for Firepower 1000/2100 and Firepower 4100/9300 series devices.

For Firepower 1000 series devices, you must power cycle the device after you upgrade to Version 6.5.0+ for this feature to work properly. The automatic reboot is not sufficient. Other supported devices do not require the power cycle.

Disable Egress Optimization for Version 6.5.0

Deployments: FTD

Upgrading from: Version 6.2.3 through 6.4.0.x

Directly to: Version 6.5.0 only

To mitigate CSCvq34340, patching an FTD device to Version 6.4.0.7+ or Version 6.5.0.2+ turns off egress optimization processing. This happens regardless of whether the egress optimization feature is enabled or disabled.

Upgrading to Version 6.5.0:

- From Version 6.2.3.x: Enables and turns on egress optimization.

- From Version 6.3.0.x: Enables and turns on egress optimization.

- From Version 6.4.0.x: Respects your current settings. However, if the Version 6.4.0.x patch turned off egress optimization but the feature is still enabled, the upgrade to Version 6.5.0 turns it on again.

Note

We recommend you patch to Version 6.5.0.2+ or upgrade to Version 6.6.0. If you remain at Version 6.5.0 or 6.5.0.1, you should manually disable egress optimization from the FTD CLI: no asp inspect-dp egress-optimization .

This issue is fixed in Version 6.6.0, where egress optimization works as expected. For more information, see the software advisory: FTD traffic outage due to 9344 block size depletion caused by the egress optimization feature.

New URL Categories and Reputations

Deployments: Any

Upgrading from: Version 6.2.3 through 6.4.0.x

Directly to: Version 6.5.0+

Cisco Talos Intelligence Group (Talos) has introduced new categories and renamed reputations to classify and filter URLs. For detailed lists of category changes, see the Cisco Firepower Release Notes, Version 6.5.0. For descriptions of the new URL categories, see the Talos Intelligence Categories site.

Also new are the concepts of uncategorized and reputationless URLs, although rule configuration options stay the same:

- Uncategorized URLs can have a Questionable, Neutral, Favorable, or Trusted reputation.

You can filter Uncategorized URLs but you cannot further constrain by reputation. These rules will match all uncategorized URLs, regardless of reputation.

Note that there is no such thing as an Untrusted rule with no category. Otherwise uncategorized URLs with an Untrusted reputation are automatically assigned to the new Malicious Sites threat category.

- Reputationless URLs can belong to any category.

You cannot filter reputationless URLs. There is no option in the rule editor for 'no reputation.' However, you can filter URLs with Any reputation, which includes reputationless URLs. These URLs must also be constrained by category. There is no utility to an Any/Any rule.

The following table summarizes the changes on upgrade. Although they are designed for minimal impact and will not prevent post-upgrade deploy for most customers, we strongly recommend you review these release notes and your current URL filtering configuration. Careful planning and preparation can help you avoid missteps, as well as reduce the time you spend troubleshooting post-upgrade.

Deployment Changes on Upgrade

Change

Details

Modifies URL rule categories.

The upgrade modifies URL rules to use the nearest equivalents in the new category set, in the following policies:

- Access control

- SSL

- QoS (FMC only)

- Correlation (FMC only)

These changes may create redundant or preempted rules, which can slow performance. If your configuration includes merged categories, you may experience minor changes to the URLs that are allowed or blocked.

Renames URL rule reputations.

The upgrade modifies URL rules to use the new reputation names:

1. Untrusted (was High Risk)

2. Questionable (was Suspicious sites)

3. Neutral (was Benign sites with security risks)

4. Favorable (was Benign sites)

5. Trusted (was Well Known)

Clears the URL cache.

The upgrade clears the URL cache, which contains results that the system previously looked up in the cloud. Your users may temporarily experience slightly longer access times for URLs that are not in the local data set.

Labels 'legacy' events.

For already-logged events, the upgrade labels any associated URL category and reputation information as Legacy. These legacy events will age out of the database over time.

Pre-Upgrade Actions for URL Categories and Reputations

Before upgrade, take the following actions.

Pre-Upgrade Actions

Action

Details

Make sure your appliances can reach Talos resources.

The system must be able to communicate with the following Cisco resources after the upgrade:

- https://regsvc.sco.cisco.com/ — Registration

- https://est.sco.cisco.com/ — Obtain certificates for secure communications

- https://updates-talos.sco.cisco.com/ — Obtain client/server manifests

- http://updates.ironport.com/ — Download database (note: uses port 80)

- https://v3.sds.cisco.com/ — Cloud queries

The cloud query service also uses the following IP address blocks:

- IPv4 cloud queries:

- 146.112.62.0/24

- 146.112.63.0/24

- 146.112.255.0/24

- 146.112.59.0/24

- IPv6 cloud queries:

- 2a04:e4c7:ffff::/48

- 2a04:e4c7:fffe::/48

Identify potential rule issues.

Understand the upcoming changes. Examine your current URL filtering configuration and determine what post-upgrade actions you will need to take (see the next section).

Note

You may want to modify URL rules that use deprecated categories now. Otherwise, rules that use them will prevent deploy after the upgrade.

In FMC deployments, we recommend you generate an access control policy report, which provides details on the policy's current saved configuration, including access control rules and rules in subordinate policies (such as SSL). For each URL rule, you can see the current categories, reputations, and associated rule actions. On the FMC, choose Policies > Access Control , then click the report icon () next to the appropriate policy.

Post-Upgrade Actions for URL Categories and Reputations

After upgrade, you should reexamine your URL filtering configuration and take the following actions as soon as possible. Depending on deployment type and the changes made by the upgrade, some — but not all — issues may be marked in the GUI. For example, in access control policies on FMC/FDM, you can click Show Warnings (FMC) or Show Problem Rules (FDM).

Post-Upgrade Actions

Action

Details

Remove deprecated categories from rules. Required.

The upgrade does not modify URL rules that use deprecated categories. Rules that use them will prevent deploy.

On the FMC, these rules are marked.

Create or modify rules to include the new categories.

Most of the new categories identify threats. We strongly recommend you use them.

On the FMC, these new categories are not marked after this upgrade, but Talos may add additional categories in the future. When that happens, new categories are marked.

Evaluate rules changed as a result of merged categories.

Each rule that included any of the affected categories now include all of the affected categories. If the original categories were associated with different reputations, the new rule is associated with the broader, more inclusive reputation. To filter URLs as before, you may have to modify or delete some configurations; see Guidelines for Rules with Merged URL Categories.

Depending on what changed and how your platform handles rule warnings, changes may be marked. For example, the FMC marks wholly redundant and wholly preempted rules, but not rules that have partial overlap.

Evaluate rules changed as a result of split categories.

The upgrade replaces each old, single category in URL rules with all the new categories that map to the old one. This will not change the way you filter URLs, but you can modify affected rules to take advantage of the new granularity.

These changes are not marked.

Understand which categories were renamed or are unchanged.

Although no action is required, you should be aware of these changes.

These changes are not marked.

Evaluate how you handle uncategorized and reputationless URLs.

Even though it is now possible to have uncategorized and reputationless URLs, you cannot still cannot filter uncategorized URLs by reputation, nor can you filter reputationless URLs.

Make sure that rules that filter by the Uncategorized category, or by Any reputation, will behave as you expect.

Guidelines for Rules with Merged URL Categories

When you examine your URL filtering configuration before the upgrade, determine which of the following scenarios and guidelines apply to you. This will ensure that your post-upgrade configuration is as you expect, and that you can take quick action to resolve any issues.

Guidelines for Rules with Merged URL Categories

Guideline

Details

Rule Order Determines Which Rule Matches Traffic

When considering rules that include the same category, remember that traffic matches the first rule in the list that includes the condition.

Categories in the Same Rule vs Categories in Different Rules

Merging categories in a single rule will merge into a single category in the rule. For example, if Category A and Category B are merging to become Category AB, and you have a rule with both Category A and Category B, then after merge the rule will have a single Category AB.

Merging categories in different rules will result in separate rules with the same category in each rule after the merge. For example, if Category A and Category B are merging to become Category AB, and you have Rule 1 with Category A and Rule 2 with Category B, then after merge Rule 1 and Rule 2 will each include Category AB. How you choose to resolve this situation depends on the rule order, on the actions and reputation levels associated with the rules, on the other URL categories included in the rule, and on the non-URL conditions that are included in the rule.

Associated Action

If merged categories in different rules were associated with different actions, then after merge you may have two or more rules with different actions for the same category.

Associated Reputation Level

If a single rule includes categories that were associated with different reputation levels before merging, the merged category will be associated with the more inclusive reputation level. For example, if Category A was associated in a particular rule with Any reputation and Category B was associated in the same rule with reputation level 3 - Benign sites with security risks, then after merge Category AB in that rule will be associated with Any reputation.

Duplicate and Redundant Categories and Rules

After merge, different rules may have the same category associated with different actions and reputation levels.

Redundant rules may not be exact duplicates, but they may no longer match traffic if another rule earlier in the rule order matches instead. For example, if you have pre-merge Rule 1 with Category A that applies to Any Reputation, and Rule 2 with Category B that applies only to Reputation 1-3, then after merge, both Rule 1 and Rule 2 will have Category AB, but Rule 2 will never match if Rule 1 is higher in the rule order.

On the FMC, rules with an identical category and reputation will show a warning. However, these warnings will not indicate rules that include the same category but a different reputation.

Caution: Consider all conditions in the rule when determining how to resolve duplicate or redundant categories.

Other URL Categories in a Rule

Rules with merged URLs may also include other URL categories. Therefore, if a particular category is duplicated after merge, you may want to modify rather than delete these rules.

Non-URL Conditions in a Rule

Rules with merged URL categories may also include other rule conditions, such as application conditions. Therefore, if a particular category is duplicated after merge, you may want to modify rather than delete these rules.

The examples in the following table use Category A and Category B, now merged into Category AB. In two-rule examples, Rule 1 comes before Rule 2.

Examples of Rules with Merged URL Categories

Scenario

Before Upgrade

After Upgrade

Merged categories in the same rule

Rule 1 has Category A and Category B.

Rule 1 has Category AB.

Merged categories in different rules

Rule 1 has Category A.

Rule 2 has Category B.

Rule 1 has Category AB.

Rule 2 has Category AB.

The specific result varies by the rules' order in the list, reputation levels, and associated actions. You should also consider all other conditions in the rule when determining how to resolve any redundancy.

Merged categories in different rules have different actions

(Reputation is the same)

Rule 1 has Category A set to Allow.

Rule 2 has Category B set to Block.

(Reputation is the same)

Rule 1 has Category AB set to Allow.

Rule 2 has Category AB set to Block.

Rule 1 will match all traffic for this category.

Rule 2 will never match traffic, and will display a warning indicator if you show warnings after merge, because both category and reputation are the same.

Merged categories in the same rule have different reputation levels

Rule 1 includes:

Category A with Reputation Any

Category B with Reputation 1-3

Rule 1 includes Category AB with Reputation Any.

Merged categories in different rules have different reputation levels

Rule 1 includes Category A with Reputation Any.

Rule 2 includes Category B with Reputation 1-3.

Rule 1 includes Category AB with Reputation Any.

Rule 2 includes Category AB with Reputation 1-3.

Rule 1 will match all traffic for this category.

Rule 2 will never match traffic, but you will not see a warning indicator because the reputations are not identical.

Version 6.4.0 Guidelines

This checklist contains upgrade guidelines are new or specific to Version 6.4.0. Review these guidelines if you are currently running Version 6.1.0 through 6.3.0.

Version 6.4.0 New Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

EtherChannels on Firepower 1010 Devices Can Blackhole Egress Traffic

Firepower 1010

6.4.0

6.4.0.3 through 6.4.0.5

Upgrade Failure: Insufficient Disk Space on Container Instances

Firepower 4100/9300

6.3.0 through 6.4.0.x

6.3.0.1 through 6.5.0

Upgrade Failure: NGIPS Devices Previously at Version 6.2.3.12

Firepower 7000/8000 series

ASA FirePOWER

NGIPSv

6.2.3 through 6.3.0.x

6.4.0 only

TLS Crypto Acceleration Enabled/Cannot Disable

Firepower 2100 series

Firepower 4100/9300

6.1.0 through 6.3.0.x

6.4.0+

This checklist contains upgrade guidelines that apply to intermediate releases. Review these guidelines if you are currently running Version 6.1 through 6.2.3.

Version 6.4.0 Previously Published Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Readiness Check May Fail on FMC, 7000/8000 Series, NGIPSv

FMC

Firepower 7000/8000 series

NGIPSv

6.1.0 through 6.1.0.6

6.2.0 through 6.2.0.6

6.2.1

6.2.2 through 6.2.2.4

6.2.3 through 6.2.3.4

6.3.0+

RA VPN Default Setting Change Can Block VPN Traffic

FTD with FMC

6.2.0 through 6.2.3.x

6.3.0+

Security Intelligence Enables Application Identification

FMC deployments

6.1.0 through 6.2.3.x

6.3.0+

Update VDB after Upgrade to Enable CIP Detection

Any

6.1.0 through 6.2.3.x

6.3.0+

Invalid Intrusion Variable Sets Can Cause Deploy Failure

Any

6.1.0 through 6.2.3.x

6.3.0+

Changes to Result Limits in Reports

FMC

6.1.0 through 6.2.2.x

6.2.3 through 6.4.0

Remove Site IDs from Version 6.1.x FTD Clusters Before Upgrade

FTD clusters

6.1.0.x

6.2.3 through 6.4.0

Access Control Can Get Latency-Based Performance Settings from SRUs

FMC

6.1.0.x

6.2.0 through 6.4.0

'Snort Fail Open' Replaces 'Failsafe' on FTD

FTD with FMC

6.1.0.x

6.2.0 through 6.4.0

EtherChannels on Firepower 1010 Devices Can Blackhole Egress Traffic

Deployments: Firepower 1010 with FTD

Affected Versions: Version 6.4.0 to 6.4.0.5

Related Bug: CSCvq81354

We strongly recommend you do not configure EtherChannels on Firepower 1010 devices running FTD Version 6.4.0 to Version 6.4.0.5. (Note that Versions 6.4.0.1 and 6.4.0.2 are not supported on this model.)

Due to an internal traffic hashing issue, some EtherChannels on Firepower 1010 devices may blackhole some egress traffic. The hashing is based on source/destination IP address so the behavior will be consistent for a given source/destination IP pair. That is, some traffic consistently works and some consistently fails.

We will fix this issue in an upcoming 6.4.0.x patch. It is also fixed in Version 6.5.0.

Upgrade Failure: Insufficient Disk Space on Container Instances

Deployments: Firepower 4100/9300 with FTD

Upgrading from: Version 6.3.0 through 6.4.0.x

Directly to: Version 6.3.0.1 through Version 6.5.0

Most often during major upgrades — but possible while patching — FTD devices configured with container instances can fail in the precheck stage with an erroneous insufficient-disk-space warning.

If this happens to you, you can try to free up more disk space. If that does not work, contact Cisco TAC.

Upgrade Failure: NGIPS Devices Previously at Version 6.2.3.12

Deployments: 7000/8000 series, ASA FirePOWER, NGIPSv

Related bug: CSCvp42398

Upgrading from: Version 6.2.3 through 6.3.0.x

Directly to: Version 6.4.0 only

You cannot upgrade an NGIPS device to Version 6.4.0 if:

- The device previously ran Version 6.2.3.12, and then

- You uninstalled the Version 6.2.3.12 patch, or upgraded to Version 6.3.0.x.

This also includes scenarios where you uninstalled the Version 6.2.3.12 patch and then upgraded to Version 6.3.0.x.

If this is your current situation, contact Cisco TAC.

TLS Crypto Acceleration Enabled/Cannot Disable

Deployments: Firepower 2100 series, Firepower 4100/9300 chassis

Upgrading from: Version 6.1.0 through 6.3.x

Directly to: Version 6.4.0+

SSL hardware acceleration has been renamed TLS crypto acceleration.

Depending on the device, TLS crypto acceleration might be performed in software or in hardware. The upgrade automatically enables acceleration on all eligible devices, even if you previously disabled the feature manually. In most cases you cannot configure this feature; it is automatically enabled and you cannot disable it.

Upgrading to Version 6.4.0: If you are using the multi-instance capability of the Firepower 4100/9300 chassis, you can use the FXOS CLI to enable TLS crypto acceleration for one container instance per module/security engine. Acceleration is disabled for other container instances, but enabled for native instances.

Upgrading to Version 6.5.0+: If you are using the multi-instance capability of the Firepower 4100/9300 chassis, you can use the FXOS CLI to enable TLS crypto acceleration for multiple container instances (up to 16) on a Firepower 4100/9300 chassis. New instances have this feature enabled by default. However, the upgrade does not enable acceleration on existing instances. Instead, use the config hwCrypto enable CLI command.

Version 6.3.0 Guidelines

This checklist contains upgrade guidelines are new or specific to Version 6.3.0. Review these guidelines if you are currently running Version 6.1.0 through 6.2.3.

Version 6.3.0 New Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Renamed Upgrade and Installation Packages

FMC

Firepower 7000/8000 series

NGIPSv

Any

6.3.0+

Reimaging to Version 6.3+ Disables LOM on Most Appliances

FMC (physical)

Firepower 7000/8000 series

Any

6.3.0+

Readiness Check May Fail on FMC, 7000/8000 Series, NGIPSv

FMC

Firepower 7000/8000 series

NGIPSv

6.2.3 through 6.2.3.4

6.2.2 through 6.2.2.4

6.2.1

6.2.0 through 6.2.0.6

6.1.0 through 6.1.0.6

6.3.0+

RA VPN Default Setting Change Can Block VPN Traffic

FTD with FMC

6.2.0 through 6.2.3.x

6.3.0+

TLS/SSL Hardware Acceleration Enabled on Upgrade

Firepower 2100 series

Firepower 4100/9300

6.1.0 through 6.2.3.x

6.3.0 only

Upgrade Failure: Version 6.3.0-83 Upgrades to FMC and ASA FirePOWER

FMC

ASA FirePOWER with ASDM

6.1.0 through 6.2.3.x

6.3.0 only

Security Intelligence Enables Application Identification

FMC deployments

6.1.0 through 6.2.3.x

6.3.0+

Update VDB after Upgrade to Enable CIP Detection

Any

6.1.0 through 6.2.3.x

6.3.0+

Invalid Intrusion Variable Sets Can Cause Deploy Failure

Any

6.1.0 through 6.2.3.x

6.3.0+

Firepower 4100/9300 Requires FTD Push Before FXOS Upgrade

Firepower 4100/9300

6.1.0.x

6.3.0 only

This checklist contains upgrade guidelines that apply to intermediate releases. Review these guidelines if you are currently running Version 6.1 through 6.2.2.

Version 6.3.0 Previously Published Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Changes to Result Limits in Reports

FMC

6.1.0 through 6.2.2.x

6.2.3 through 6.4.0

Remove Site IDs from Version 6.1.x FTD Clusters Before Upgrade

FTD clusters

6.1.0.x

6.2.3 through 6.4.0

Access Control Can Get Latency-Based Performance Settings from SRUs

FMC

6.1.0.x

6.2.0 through 6.4.0

'Snort Fail Open' Replaces 'Failsafe' on FTD

FTD with FMC

6.1.0.x

6.2.0 through 6.4.0

Renamed Upgrade and Installation Packages

Deployments: FMC, 7000/8000 series, NGIPSv

Upgrading from: Version 6.1.0 through 6.2.3.x

Directly to: Version 6.3+

The naming scheme (that is, the first part of the name) for upgrade, patch, hotfix, and installation packages changed starting with Version 6.3.0, on select platforms.

Note

This change causes issues with reimaging older physical appliances: DC750, 1500, 2000, 3500, and 4000, as well as 7000/8000 series devices and AMP models. If you are currently running Version 5.x and need to freshly install Version 6.3.0 or 6.4.0 on one of these appliances, rename the installation package to the "old" name after you download it from the Cisco Support & Download site. You cannot reimage these appliances to Version 6.5+.

Naming Schemes: Upgrade, Patch, and Hotfix Packages

Platform

Naming Schemes

FMC

New: Cisco_Firepower_Mgmt_Center

Old: Sourcefire_3D_Defense_Center_S3

Firepower 7000/8000 series

New: Cisco_Firepower_NGIPS_Appliance

Old: Sourcefire_3D_Device_S3

NGIPSv

New: Cisco_Firepower_NGIPS_Virtual

Old: Sourcefire_3D_Device_VMware

Old: Sourcefire_3D_Device_Virtual64_VMware

Naming Schemes: Installation Packages

Platform

Naming Schemes

FMC (physical)

New: Cisco_Firepower_Mgmt_Center

Old: Sourcefire_Defense_Center_M4

Old: Sourcefire_Defense_Center_S3

FMCv: VMware

New: Cisco_Firepower_Mgmt_Center_Virtual_VMware

Old: Cisco_Firepower_Management_Center_Virtual_VMware

FMCv: KVM

New: Cisco_Firepower_Mgmt_Center_Virtual_KVM

Old: Cisco_Firepower_Management_Center_Virtual

Firepower 7000/8000 series

New: Cisco_Firepower_NGIPS_Appliance

Old: Sourcefire_3D_Device_S3

NGIPSv

New: Cisco_Firepower_NGIPSv_VMware

Old: Cisco_Firepower_NGIPS_VMware

Reimaging to Version 6.3+ Disables LOM on Most Appliances

Deployments: Physical FMCs, 7000/8000 series devices

Reimaging from: Version 6.0+

Directly to: Version 6.3+

Freshly installing Version 6.3+ now automatically deletes Lights-Out Management (LOM) settings on most appliances, for security reasons. On a few older FMC models, you have the option of retaining LOM settings along with your management network settings.

If you delete network settings during a Version 6.3+ reimage, you must make sure you have physical access to the appliance to perform the initial configuration. You cannot use LOM. After you perform the initial configuration, you can reenable LOM and LOM users.

Reimage Effect on LOM Settings

Platform

Reimage to Version 6.2.3 or earlier

Reimage to Version 6.3+

MC1600, 2600, 4600

MC1000, 2500, 4500

MC2000, 4000

Never deleted

Always deleted

MC750, 1500, 3500

Deleted if you delete network settings

Deleted if you delete network settings

7000/8000 series

Always deleted

Always deleted

Readiness Check May Fail on FMC, 7000/8000 Series, NGIPSv

Deployments: FMC, 7000/8000 series devices, NGIPSv

Upgrading from: Version 6.1.0 through 6.1.0.6, Version 6.2.0 through 6.2.0.6, Version 6.2.1, Version 6.2.2 through 6.2.2.4, and Version 6.2.3 through 6.2.3.4

Directly to: Version 6.3.0+

You cannot run the readiness check on the listed models when upgrading from one of the listed Firepower versions. This occurs because the readiness check process is incompatible with newer upgrade packages.

Patches with Readiness Checks for Version 6.3.0+

Readiness Check Not Supported

First Patch with Fix

6.1.0 through 6.1.0.6

6.1.0.7

6.2.0 through 6.2.0.6

6.2.0.7

6.2.1

None. Upgrade to Version 6.2.3.5+.

6.2.2 through 6.2.2.4

6.2.2.5

6.2.3 through 6.2.3.4

6.2.3.5

RA VPN Default Setting Change Can Block VPN Traffic

Deployments: Firepower Threat Defense configured for remote access VPN

Upgrading from: Version 6.2.x

Directly to: Version 6.3+

Version 6.3 changes the default setting for a hidden option, sysopt connection permit-vpn . Upgrading can cause your remote access VPN to stop passing traffic. If this happens, use either of these techniques:

- Create a FlexConfig object that configures the sysopt connection permit-vpn command. The new default for this command is no sysopt connection permit-vpn .

This is the more secure method to allow traffic in the VPN, because external users cannot spoof IP addresses in the remote access VPN address pool. The downside is that the VPN traffic will not be inspected, which means that intrusion and file protection, URL filtering, or other advanced features will not be applied to the traffic.

- Create access control rules to allow connections from the remote access VPN address pool.

This method ensures that VPN traffic is inspected and advanced services can be applied to the connections. The downside is that it opens the possibility for external users to spoof IP addresses and thus gain access to your internal network.

TLS/SSL Hardware Acceleration Enabled on Upgrade

Deployments: Firepower 2100 series, Firepower 4100/9300 chassis

Upgrading from: Version 6.1.0 through 6.2.3.x

Directly to: Version 6.3.0 only

The upgrade process automatically enables TLS/SSL hardware acceleration (sometimes called TLS crypto acceleration) on eligible devices. When it was introduced in Version 6.2.3, this feature was disabled by default on Firepower 4100/9300 chassis, and was not available on Firepower 2100 series devices.

Using TLS/SSL hardware acceleration on a managed device that is not decrypting traffic can affect performance. In Version 6.3.0.x, we recommend you disable this feature on devices that are not decrypting traffic.

To disable, use this CLI command:

system support ssl-hw-offload disable

Upgrade Failure: Version 6.3.0-83 Upgrades to FMC and ASA FirePOWER

Deployments: Firepower Management Center, ASA FirePOWER (locally managed)

Upgrading from: Version 6.1.0 through 6.2.3.x

Directly to: Version 6.3.0-83

Some Firepower Management Centers and locally (ASDM) managed ASA FirePOWER modules experienced upgrade failures with Version 6.3.0, build 83. This issue was limited to a subset of customers who upgraded from Version 5.4.x. For more information, see CSCvn62123 in the Cisco Bug Search Tool.

A new upgrade package is now available. If you downloaded the Version 6.3.0-83 upgrade package, do not use it. If you already experienced an upgrade failure due to this issue, contact Cisco TAC.

Security Intelligence Enables Application Identification

Deployments: Firepower Management Center

Upgrading from: Version 6.1 through 6.2.3.x

Directly to: Version 6.3+

In Version 6.3, Security Intelligence configurations enable application detection and identification. If you disabled discovery in your current deployment, the upgrade process may enable it again. Disabling discovery if you don't need it (for example, in an IPS-only deployment) can improve performance.

To disable discovery you must:

- Delete all rules from your network discovery policy.

- Use only simple network-based conditions to perform access control: zone, IP address, VLAN tag, and port. Do not perform any kind of application, user, URL, or geolocation control.

- (NEW) Disable network and URL-based Security Intelligence by deleting all whitelists and blacklists from your access control policy's Security Intelligence configuration, including the default Global lists.

- (NEW) Disable DNS-based Security Intelligence by deleting or disabling all rules in the associated DNS policy, including the default Global Whitelist for DNS and Global Blacklist for DNS rules.

Update VDB after Upgrade to Enable CIP Detection

Deployments: Any

Upgrading from: Version 6.1.0 through 6.2.3.x, with VDB 299+

Directly to: Version 6.3.0+

If you upgrade while using vulnerability database (VDB) 299 or later, an issue with the upgrade process prevents you from using CIP detection post-upgrade. This includes every VDB released from June 2018 to now, even the latest VDB.

Although we always recommend you update the vulnerability database (VDB) to the latest version after you upgrade, it is especially important in this case.

To check if you are affected by this issue, try to configure an access control rule with a CIP-based application condition. If you cannot find any CIP applications in the rule editor, manually update the VDB.

Invalid Intrusion Variable Sets Can Cause Deploy Failure

Deployments: Any

Upgrading from: Version 6.1 through 6.2.3.x

Directly to: Version 6.3.0+

For network variables in an intrusion variable set, any IP addresses you exclude must be a subset of the IP addresses you include. This table shows you examples of valid and invalid configurations.

Valid

Invalid

Include: 10.0.0.0/8

Exclude: 10.1.0.0/16

Include: 10.1.0.0/16

Exclude: 172.16.0.0/12

Exclude: 10.0.0.0/8

Before Version 6.3.0, you could successfully save a network variable with this type of invalid configuration. Now, these configurations block deploy with the error: Variable set has invalid excluded values.

If this happens, identify and edit the incorrectly configured variable set, then redeploy. Note that you may have to edit network objects and groups referenced by your variable set.

Firepower 4100/9300 Requires FTD Push Before FXOS Upgrade

Deployments: Firepower 4100/9300 with FTD

Upgrading from: Version 6.1.x on FXOS 2.0.1, 2.1.1, or 2.3.1

Directly to: Version 6.3.0 on FXOS 2.4.1

If your Firepower Management Center is running Version 6.2.3+, we strongly recommend you push (copy) Firepower upgrade packages to managed devices before you upgrade. This helps reduce the length of your upgrade maintenance window.

For Firepower 4100/9300 with FTD, best practice is to push before you begin the required companion FXOS upgrade. And, if you are upgrading from Version 6.1 directly to Version 6.3, this push is required. You must push before you upgrade FXOS.

This is because upgrading FXOS to Version 2.4.1 while still running Firepower 6.1 causes the device management port to flap, which in turn causes intermittent communication problems between the device and the FMC. You may see 'sftunnel daemon exited' alarms, and any task that involves sustained communications—such as pushing a large upgrade package—may fail.

To upgrade Firepower 4100/9300 with FTD, always follow this sequence:

1. Upgrade the FMC to the target version.

2. Obtain the device upgrade package from the Cisco Support & Download site and upload it to the FMC.

3. Use the FMC to push the upgrade package to the device.

4. After the push completes, upgrade FXOS to the target version.

5. Immediately, use the FMC to upgrade the Firepower software on the device.

Remember, until you upgrade the Firepower software, you may continue to experience management port flaps.

Version 6.2.3 Guidelines

This checklist contains upgrade guidelines are new or specific to Version 6.2.3. Review these guidelines if you are currently running Version 6.1.0 through 6.2.2.

Version 6.2.3 New Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Sharing Data with Cisco

Any

Any

6.2.3+

Edit/Resave Access Control Policies After Upgrade

Any

6.1.0 through 6.2.2.x

6.2.3 only

Changes to Result Limits in Reports

FMC

6.1.0 through 6.2.2.x

6.2.3 through 6.4.0

Remove Site IDs from Version 6.1.x FTD Clusters Before Upgrade

FTD clusters

6.1.0.x

6.2.3 through 6.4.0

This checklist contains upgrade guidelines that apply to intermediate releases. Review these guidelines if you are currently running Version 6.1 through 6.2.1.

Version 6.2.3 Previously Published Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Access Control Can Get Latency-Based Performance Settings from SRUs

FMC

6.1.0.x

6.2.0 through 6.4.0

'Snort Fail Open' Replaces 'Failsafe' on FTD

FTD with FMC

6.1.0.x

6.2.0 through 6.4.0

Sharing Data with Cisco

Deployments: Any

Upgrading from: Version 6.1.0+

Directly to: Version 6.2.3+

Some features involve sharing data with Cisco.

Cisco Success Network

In Version 6.2.3+, Cisco Success Network sends usage information and statistics to Cisco, which are essential to provide you with technical support.

During initial setup and upgrades, you may be asked to accept or decline participation. You can also opt in or out at any time.

Web Analytics tracking

In Version 6.2.3+, Web analytics tracking sends non-personally-identifiable usage data to Cisco, including but not limited to page interactions, browser versions, product versions, user location, and management IP addresses or hostnames of your FMCs.

Web analytics tracking is on by default (and by accepting the Version 6.5.0+ EULA you consent to web analytics tracking), but you can opt out at any time after you complete initial setup.

Note

Upgrades to Version 6.2.3 through 6.6.x can enable (or reenable) web analytics tracking. This can occur even if your current setting is to opt out. If you do not want Cisco to collect this data, opt out after upgrading. Upgrades to 6.7.0+ respect your current setting.

Cisco Support Diagnostics

In Version 6.5.0+, Cisco Support Diagnostics (sometimes called Cisco Proactive Support) sends configuration and operational health data to Cisco, and processes that data through our automated problem detection system, allowing us to proactively notify you of issues. This feature also allows Cisco TAC to collect essential information from your devices during the course of a TAC case.

During initial setup and upgrades, you may be asked to accept or decline participation. You can also opt in or out at any time.

Edit/Resave Access Control Policies After Upgrade

Deployments: Any

Upgrading from: Version 6.1 through 6.2.2.x

Directly to: Version 6.2.3 only

If you configured network or port objects that are used only in intrusion policy variable sets, deploying associated access control policies after the upgrade fails. If this happens, edit the access control policy, make a change (such as editing the description), save, and redeploy.

Changes to Result Limits in Reports

Deployments: Firepower Management Center

Upgrading from: Version 6.1.0 through 6.2.2.x

Directly to: Version 6.2.3 through 6.4.0

Version 6.2.3 limits the number of results you can use or include in a report section, as follows. For table and detail views, you can include fewer records in a PDF report than in an HTML/CSV report.

New Result Limits in Reports

Report Section Type

Max Records: HTML/CSV Report Section

Max Records: PDF Report Section

Bar chart

Pie chart

100 (top or bottom)

100 (top or bottom)

Table view

400,000

100,000

Detail view

1,000

500

If, before you upgrade a Firepower Management Center, a section in a report template specifies a larger number of results than the HTML/CSV maximum, the upgrade process lowers the setting to the new maximum value.

For report templates that generate PDF reports, if you exceed the PDF limit in any template section, the upgrade process changes the output format to HTML. To continue generating PDFs, lower the results limit to the PDF maximum. If you do this after the upgrade, set the output format back to PDF.

Remove Site IDs from Version 6.1.x FTD Clusters Before Upgrade

Deployments: Firepower Threat Defense clusters

Upgrading from: Version 6.1.x

Directly to: Version 6.2.3 through 6.4.0

Firepower Threat Defense Version 6.1.x clusters do not support inter-site clustering (you can configure inter-site features using FlexConfig starting in Version 6.2.0).

If you deployed or redeployed a Version 6.1.x cluster in FXOS 2.1.1, and you entered a value for the (unsupported) site ID, remove the site ID (set to 0) on each unit in FXOS before you upgrade. Otherwise, the units cannot rejoin the cluster after the upgrade.

If you already upgraded, remove the site ID from each unit, then reestablish the cluster. To view or change the site ID, see the Cisco FXOS CLI Configuration Guide.

Version 6.2.2 Guidelines

This checklist contains upgrade guidelines are new or specific to Version 6.2.2. Review these guidelines if you are currently running Version 6.2.0 or 6.2.1.

Version 6.2.2 New Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Security Enhancement: Signed Upgrade Packages

Any

Any

6.2.2+

Version 6.2.2.1+ Required for 8000 Series Security Certs Compliance

Firepower 8000 series

6.2.0.x

6.2.2 only

Security Enhancement: Signed Upgrade Packages

Deployments: Any

Upgrading from: Version 6.2.1+

Directly to: Version 6.2.2+

So that Firepower can verify that you are using the correct files, upgrade packages from (and hotfixes to) Version 6.2.1+ are signed tar archives (.tar). Upgrades from earlier versions continue to use unsigned packages.

When you manually download upgrade packages from the Cisco Support & Download site—for example, for a major upgrade or in an air-gapped deployment—make sure you download the correct package. Do not untar signed (.tar) packages.

Note

After you upload a signed upgrade package, the GUI can take several minutes to load as the system verifies the package. Remove signed packages after you no longer need them to speed up the display.

Version 6.2.2.1+ Required for 8000 Series Security Certs Compliance

Deployments: Firepower 8000 series devices

Upgrading from: Version 6.2.0.x

Directly to: Version 6.2.2 only

Enabling security certifications compliance (CC/UCAPL mode) on 8000 series devices running Version 6.2.2 can cause a FSIC (file system integrity check) failure. Wait until you upgrade the device to Version 6.2.2.1+.

Caution

Because the FSIC fails, Firepower software does not start, remote SSH access is disabled, and you can access the appliance only via local console. If this happens, contact Cisco TAC.

Version 6.2.0 Guidelines

This checklist contains upgrade guidelines are new or specific to Version 6.2.0. Review these guidelines if you are currently running Version 6.1.0.

Version 6.2.0 New Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Access Control Can Get Latency-Based Performance Settings from SRUs

FMC

6.1.0.x

6.2.0 through 6.4.0

'Snort Fail Open' Replaces 'Failsafe' on FTD

FTD with FMC

6.1.0.x

6.2.0 through 6.4.0

IAB 'All Applications' Option Removed on Upgrade

FMC

ASA FirePOWER with ASDM

6.1.0.3 or later patch

6.2.0 only

URL Filtering Sub-site Lookups for Low-Memory Devices Disabled on Upgrade

Any

6.1.0.1 or later patch

6.2.0 only

Access Control Can Get Latency-Based Performance Settings from SRUs

Deployments: FMC

Upgrading from: 6.1.x

Directly to: 6.2.0+

New access control policies in Version 6.2.0+ by default get their latency-based performance settings from the latest intrusion rule update (SRU). This behavior is controlled by a new Apply Settings From option. To configure this option, edit or create an access control policy, click Advanced, and edit the Latency-Based Performance Settings.

When you upgrade to Version 6.2.0+, the new option is set according to your current (Version 6.1.x) configuration. If your current settings are:

- Default: The new option is set to Installed Rule Update. When you deploy after the upgrade, the system uses the latency-based performance settings from the latest SRU. It is possible that traffic handling could change, depending on what the latest SRU specifies.

- Custom: The new option is set to Custom. The system retains its current performance settings. There should be no behavior change due to this option.

We recommend you review your configurations before you upgrade. From the Version 6.1.x FMC web interface, view your policies' Latency-Based Performance Settings as described earlier, and see whether the Revert to Defaults button is dimmed. If the button is dimmed, you are using the default settings. If it is active, you have configured custom settings.

'Snort Fail Open' Replaces 'Failsafe' on FTD

Deployments: FTD with FMC

Upgrading from: Version 6.1.x

Directly to: Version 6.2+

In Version 6.2, the Snort Fail Open configuration replaces the Failsafe option on FMC-managed Firepower Threat Defense devices. While Failsafe allows you to drop traffic when Snort is busy, traffic automatically passes without inspection when Snort is down. Snort Fail Open allows you to drop this traffic.

When you upgrade an FTD device, its new Snort Fail Open setting depends on its old Failsafe setting, as follows. Although the new configuration should not change traffic handling, we still recommend that you consider whether to enable or disable Failsafe before you upgrade.

Migrating Failsafe to Snort Fail Open

Version 6.1 Failsafe

Version 6.2 Snort Fail Open

Behavior

Disabled (default behavior)

Busy: Disabled

Down: Enabled

New and existing connections drop when the Snort process is busy and pass without inspection when the Snort process is down.

Enabled

Busy: Enabled

Down: Enabled

New and existing connections pass without inspection when the Snort process is busy or down.

Note that Snort Fail Open requires Version 6.2 on the device. If you are managing a Version 6.1.x device, the FMC web interface displays the Failsafe option.

IAB 'All Applications' Option Removed on Upgrade

Deployments: FMC, ASA FirePOWER with ASDM

Upgrading from: 6.1.0.3 or later patch

Directly to: 6.2.0 only

The Intelligent Application Bypass (IAB) option 'All applications including unidentified applications' trusts any application that exceeds any flow bypass threshold, regardless of application type, if one of the IAB inspection performance thresholds is met. The option is available in the following versions:

- Version 6.0.1.4 and later patches

- Version 6.1.0.3 and later patches

- Version 6.2.0.1 and later patches

- Version 6.2.2 and all later patches and major versions

If you upgrade from a version where the option is supported to one where it is not, the option is removed. Also, if you actually enabled the option and your access control policy does not contain IAB bypassable application and filter configurations, the upgraded user interface exhibits the following unexpected behaviors:

- IAB is enabled, but the All applications including unidentified applications option is no longer present.

- The IAB configuration page displays 1 Applications/Filters, incorrectly indicating that you have configured one application or filter.

- The Selected Applications and Filters window in the applications and filters editor displays either deleted (FMC) or Any Application (ASDM). We recommend you delete this selection.

To restore the option, apply any Version 6.2.0.x patch, or upgrade to Version 6.2.2+ (recommended).

URL Filtering Sub-site Lookups for Low-Memory Devices Disabled on Upgrade

Deployments: Lower-memory devices performing URL filtering

Upgrading from: Version 6.1.0.3 or later patch

Directly to: Version 6.2.0 only

Due to memory limitations, some device models perform URL filtering with a smaller database of categories and reputations. This can become an issue if a URL's subsites have different URL categories and reputations than the parent site, but the device only has the parent site's data.

In Version 6.1.0.3, we changed the system's behavior so that instead of relying on the parent URL's category and reputation, the device considers these subsites to have an 'unknown' category and reputation. This forces the device to perform a cloud lookup for the subsite's data (and cache the results for next time).

Version 6.2.0 discontinues support for these subsite cloud lookups. Affected devices are:

- Firepower 7010, 7020, and 7030

- ASA 5506-X series, 5508-X, 5516-X

- ASA 5512-X, 5515-X, 5525-X

Support is reintroduced in Version 6.2.0.1.

Version 6.1.0 Guidelines

These important guidelines apply to Version 6.1.0.

Disable the ASA REST API Before Upgrading ASA FirePOWER Modules

Deployments: ASA FirePOWER

Note

This warning applies to all future releases. The upgrade procedures now explicitly include this step.

Before you upgrade an ASA FirePOWER module, use the ASA CLI to disable the ASA REST API:

no rest-api agent

If you do not disable the REST API, the upgrade fails. You can reenable it after the upgrade:

rest-api agent

ASA 5506-X series devices do not support the ASA REST API if you are also running Version 6.0+ of the ASA FirePOWER module.

STIG Mode Changed to UCAPL Mode

Deployments: Firepower Management Center

In Version 6.1, the security certifications compliance mode known as Security Technical Implementation Guide (STIG) mode is renamed to Unified Capabilities Approved Products List (UCAPL) mode. After the upgrade, a Firepower appliance that was in STIG mode will be in UCAPL mode. All of the restrictions and changes in system functionality associated with UCAPL mode will be in effect.

For more information, including information on hardening your system for UCAPL compliance, see the Security Certifications Compliance chapter of the Firepower Management Center Configuration Guide, and the guidelines for this product provided by the certifying entity.

Restore Classic Licenses After Upgrade

Deployments: Firepower Management Center

Upgrading the Firepower Management Center to Version 6.1 may delete or disable Classic licenses for managed NGIPSv, ASA FirePOWER, 7000 series, and 8000 series devices. Before you begin the update, contact Cisco TAC for a script you can run to prevent this issue.

If you do not run the pre-upgrade script, after the update:

- Check and reinstall deleted licenses: Choose System > Licenses > Classic Licenses.

- Edit affected devices and reenable licenses: Choose Devices > Device Management.

Version 6.0.0 Guidelines

These important guidelines apply to Version 6.0.0.

Terminology and Branding

Version 6.0 has major terminology and branding changes, including:

- FireSIGHT System → Firepower

- FireSIGHT Defense Center → Firepower Management Center (FMC)

- Series 3 device → 7000 series device or 8000 series device

- virtual managed device → NGIPSv

For more information, see the Cisco Firepower Terminology Guide.

Version 6.0 Preinstallation Package

For upgrades from Version 5.4.x to Version 6.0, Cisco provides a preinstallation package that optimizes the upgrade.

In some cases you must use the preinstallation package, as listed in the following table. And even when it is not required, we strongly recommend you include and use the Version 6.0 preinstallation package in your upgrade path. For more information, see FireSIGHT System Release Notes Version 6.0.0 Preinstallation.

Platform

Min. Version to Upgrade

Package Required

Package Recommended

FireSIGHT Defense Center (FMC)

5.4.1.1

5.4.1.1 to 5.4.1.5

5.4.1.6+

7000/8000 series

5.4.0.2

5.4.0.2 to 5.4.0.6

5.4.0.7+

NGIPSv

5.4.0.2

5.4.0.2 to 5.4.0.6

5.4.0.7+

ASA FirePOWER: 5.4.1.x

5.4.1.1

5.4.1.1 to 5.4.1.5

5.4.1.6+

ASA FirePOWER: 5.4.0.x

5.4.0.2

5.4.0.2 to 5.4.0.6

5.4.0.7+

Upgrade Memory for DC750, DC1500, DC3500 and Virtual Defense Center

The following FireSIGHT Defense Center models may require additional memory to run Version 6.0:

- DC750

- DC1500

- DC3500

- Virtual Defense Center

Because the increase in memory is driven by Cisco product requirements, Cisco makes memory upgrade kits available at no cost for customers who are entitled to run Version 6.0 on a qualifying DC750 or DC1500:

- Order the kit—See Field Notice: FN - 64077 - Cisco FireSIGHT and Sourcefire Defense Center Management Appliances - Memory Upgrade Required for FirePOWER Software V6.0 and Later

- Upgrade the memory—See Memory Upgrade Instructions for Firepower Management Centers in the Firepower Management Center Installation Guide.

Break Defense Center High Availability Pairs

Version 6.0.x does not support high availability for Firepower Management Centers.

You cannot upgrade a Version 5.4.x high availability pair of Defense Centers to a Version 6.0 high availability pair of Firepower Management Centers. You must break the pair and upgrade each Defense Center individually. You can reestablish high availability with Version 6.1.

Disable "Retry URL Cache Miss Lookup" Option

Upgrading a Firepower Management Center to Version 6.0 when you are managing devices running Version 5.4.0.6, Version 5.4.1.5, or earlier may cause traffic outages and system issues.

Before you upgrade the Defense Center, disable the Retry URL cache miss lookup option, which you set on the Advanced tab in the access control policies deployed to your devices. Then, redeploy. You can reenable the option after you upgrade your managed devices to Version 5.4.0.7+ or Version 5.4.1.6+ (or Version 6.0).

Update Defense Center HTTPS Certificates

If you upgrade a Version 5.4.x Defense Center that is using one of these HTTPS certificates to a Version 6.0 Firepower Management Center, you will not be able to log in and must contact Cisco TAC:

- Certificates generated with an RSASSA-PSS signature algorithm.

Before you upgrade, replace with a certificate generated with either a sha1WithRSAEncryption algorithm or sha256WithRSAEncryption algorithm, or with the Defense Center default certificate. Reboot.

- Certificates generated using a public server key larger than 2048 bits.

Before you upgrade, replace with a certificate generated with a server certificate request (CSR). Reboot.

Also, do not upload either of these types of certificates after you upgrade. To generate a certificate on a Version 5.4.x appliance, see Using Custom HTTPS Certificates in the FireSIGHT System User Guide, Version 5.4.1.

No Private AMP Cloud Support

Version 6.0 does not support AMP for Firepower signature lookups with the private AMP cloud. In Version 6.0, the system automatically submits SHA-256 signatures to the public AMP cloud. If you have a private AMP cloud and are receiving events from endpoints, the Version 6.0 Defense Center will continue to receive those events without any additional changes to your configuration.

Patch Guidelines by Version

These checklists contain important upgrade guidelines and warnings for Firepower patches.

- Version 6.6.x.x Guidelines

- Version 6.4.0.x Guidelines

- Version 6.3.0.x Guidelines

- Version 6.2.3.x Guidelines

- Version 6.2.2.x Guidelines

- Version 6.2.0.x Guidelines

Version 6.6.x.x Guidelines

This checklist contains upgrade guidelines for Version 6.6.x patches.

Version 6.6.x.x Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Version 6.6.0.1 FTD Upgrade with FDM Suspends HA

FTD with FDM

6.6.0

6.6.0.1

Version 6.6.0.1 FTD Upgrade with FDM Suspends HA

Deployments: FTD with FDM, configured as a high availability pair

Upgrading from: Version 6.6.0

Directly to: Version 6.6.0.1

Related bug: CSCvv45500

After you upgrade an FDM-managed FTD device in high availability (HA) to Version 6.6.0.1, the device enters Suspended mode after the post-upgrade reboot. You must manually resume HA.

FMC deployments are not affected.

To upgrade an FDM-managed FTD HA pair to Version 6.6.0.1:

1. Upgrade the standby device.

2. When the upgrade completes and the device reboots, manually resume HA. You can use FDM or the CLI:

- FDM: Click Device > High Availability, then select Resume HA from the gear menu ().

- CLI: configure high-availability resume

The HA status of the freshly upgraded device should return to normal, as the standby unit, after the unit negotiates with the peer.

3. Switch the active and standby peers (force failover) so the freshly upgraded device is now the active peer.

4. Repeat this procedure for the new standby peer.

For more information on configuring and managing high availability with FDM, see the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager.

Version 6.4.0.x Guidelines

This checklist contains upgrade guidelines for Version 6.4.0 patches.

Version 6.4.0.x Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Upgrade Failure: Insufficient Disk Space on Container Instances

Firepower 4100/9300

6.4.0.x

Later patches

6.5.0

EtherChannels on Firepower 1010 Devices Can Blackhole Egress Traffic

Firepower 1010

6.4.0 only

6.4.0.3 through 6.4.0.5

Version 6.3.0.x Guidelines

This checklist contains upgrade guidelines for Version 6.3.0 patches.

Version 6.3.0.x Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Upgrade Failure: Insufficient Disk Space on Container Instances

Firepower 4100/9300

6.3.0.x

Later patches

6.4.0 and 6.5.0

Version 6.2.3.x Guidelines

This checklist contains upgrade guidelines for Version 6.2.3 patches.

Version 6.2.3.x Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Version 6.2.3.10 FTD Upgrade with CC Mode Causes FSIC Failure

FTD

6.2.3 through 6.2.3.9

6.2.3.10 only

Version 6.2.3.3 FTD Device Cannot Switch to Local Management

FTD with FMC

6.2.3 through 6.2.3.2

6.2.3.3

Hotfix Before Upgrading Version 6.2.3-88 FMCs

FMC

6.2.3-88

6.2.3.1 through 6.2.3.3

Version 6.2.3.10 FTD Upgrade with CC Mode Causes FSIC Failure

Deployments: Firepower Threat Defense

Upgrading from: Version 6.2.3 through 6.2.3.9

Directly to: Version 6.2.3.10 only

Known issue: CSCvo39052

Upgrading an FTD device to Version 6.2.3.10 with CC mode enabled causes a FSIC (file system integrity check) failure when the device reboots.

Caution

If security certifications compliance is enabled and the FSIC fails, Firepower software does not start, remote SSH access is disabled, and you can access the appliance only via local console. If this happens, contact Cisco TAC.

If your FTD deployment requires security certifications compliance (CC mode), we recommend you upgrade directly to Version 6.2.3.13+. For Firepower 4100/9300 devices, we also recommend that you upgrade to FXOS 2.3.1.130+.

Version 6.2.3.3 FTD Device Cannot Switch to Local Management

Deployments: FTD wth FMC

Upgrading from: Version 6.2.3 through Version 6.2.3.2

Directly to: Version 6.2.3.3 only

In Version 6.2.3.3, you cannot switch Firepower Threat Defense device management from FMC to FDM. This happens even if you uninstall the Version 6.2.3.3 patch. If you want to switch to local management at that point, either freshly install Version 6.2.3, or contact Cisco TAC.

As a workaround, switch management before you upgrade to Version 6.2.3.3. Or, upgrade to the latest patch. Keep in mind that you lose device configurations when you switch management.

Note that you can switch management from FDM to FMC in Version 6.2.3.3.

Hotfix Before Upgrading Version 6.2.3-88 FMCs

Deployments: FMC

Upgrading from: Version 6.2.3-88

Directly to: Version 6.2.3.1, Version 6.2.3.2, or Version 6.2.3.3

Sometimes Cisco releases updated builds of Firepower upgrade packages. Version 6.2.3-88 has been replaced by a later build. If you upgrade an FMC running Version 6.2.3-88 to Version 6.2.3.1, Version 6.2.3.2, or Version 6.2.3.3, the SSE cloud connection continuously drops and generates errors. Uninstalling the patch does not resolve the issue.

If you are running Version 6.2.3-88, install Hotfix T before you upgrade.

Version 6.2.2.x Guidelines

This checklist contains upgrade guidelines for Version 6.2.2 patches.

Version 6.2.2.x Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Cannot Upgrade Firepower 2100 Series HA Pair from Version 6.2.2 to 6.2.2.4

Firepower 2100 series HA pair

6.2.2 only

6.2.2.4 only

Cannot Upgrade Firepower 2100 Series HA Pair from Version 6.2.2 to 6.2.2.4

Deployments: Firepower 2100 series devices configured as an FTD high availability pair

Upgrading from: Version 6.2.2 only

Directly to: Version 6.2.2.4 only

The upgrade from Version 6.2.2 to Version 6.2.2.4 fails for Firepower 2100 devices in high availability. If you are running Version 6.2.2 and really need to be at Version 6.2.2.4, upgrade to Version 6.2.2.1 first. Otherwise, we recommend you skip this version.

If you already started the upgrade and it has failed, we recommend you reimage.

Version 6.2.0.x Guidelines

This checklist contains upgrade guidelines for Version 6.2.0 patches.

Version 6.2.0.x Guidelines

✓

Guideline

Platforms

Upgrading From

Directly To

Apply Hotfix BH to Version 6.2.0.3 FMCs

FMC

6.2.0 through 6.2.0.2

6.2.0.3 only

Apply Hotfix BH to Version 6.2.0.3 FMCs

Deployments: FMC

Upgrading from: Version 6.2 through 6.2.0.2

Directly to: Version 6.2.0.3 only

Resolves: CSCvg32885

After you upgrade to Version 6.2.0.3, you must apply Hotfix BH. If you do not apply Hotfix BH, you cannot edit access control rules or deploy configuration changes.

For more information, see the Firepower Hotfix Release Notes.

Date-Based Guidelines

Sometimes Cisco issues date-based upgrade guidelines and warnings.

- Expired CA Certificates for Dynamic Analysis

Expired CA Certificates for Dynamic Analysis

Deployments: AMP for Networks (malware detection) deployments where you submit files for dynamic analysis

Affected Versions: Version 6.0+

Resolves: CSCvj07038

On June 15, 2018, some Firepower deployments stopped being able to submit files for dynamic analysis. This occurred due to an expired CA certificate that was required for communications with the AMP Threat Grid cloud. Version 6.3.0 is the first major version with the new certificate.

Note

If you do not want to upgrade to Version 6.3.0+, you must patch or hotfix to obtain the new certificate and reenable dynamic analysis. However, subsequently upgrading a patched or hotfixed deployment to either Version 6.2.0 or Version 6.2.3 reverts to the old certificate and you must patch or hotfix again.

If this is your first time installing the patch or hotfix, make sure your firewall allows outbound connections to fmc.api.threatgrid.com (replacing panacea.threatgrid.com) from both the FMC and its managed devices. Managed devices submit files to the cloud for dynamic analysis; the FMC queries for results.

This table lists the versions with the old certificates, as well as the patches and hotfixes that contain the new certificates, for each major version sequence and platform. Patches and hotfixes are available on the Cisco Support & Download site.

Patches and Hotfixes with New CA Certificates

Versions with Old Cert

First Patch with New Cert

Hotfix with New Cert

6.2.3 through 6.2.3.3

6.2.3.4

Hotfix G

FTD devices

Hotfix H

FMC, NGIPS devices

6.2.2 through 6.2.2.3

6.2.2.4

Hotfix BN

All platforms

6.2.1

None. You must upgrade.

None. You must upgrade.

6.2.0 through 6.2.0.5

6.2.0.6

Hotfix BX

FTD devices

Hotfix BW

FMC, NGIPS devices

6.1.0 through 6.1.0.6

6.1.0.7

Hotfix EM

All platforms

6.0.x

None. You must upgrade.

None. You must upgrade.

Deprecated Features for Major Versions

- Version 6.7.0 Deprecated Features

- Version 6.6.0 Deprecated Features

- Version 6.5.0 Deprecated Features

- Version 6.4.0 Deprecated Features

- Version 6.3.0 Deprecated Features

- Version 6.2.3 Deprecated Features

- Version 6.2.1 Deprecated Features

- Version 6.2.0 Deprecated Features

Version 6.7.0 Deprecated Features

These features were deprecated in Version 6.7.0 FMC deployments.

Version 6.7.0 Deprecated Features: FMC Deployments

Feature

Upgrade Impact

Platforms

Description

Cisco Firepower User Agent software and identity source

Prevents FMC upgrade.

FMC

You cannot upgrade an FMC with user agent configurations to Version 6.7.0.

Version 6.6.0/6.6.x is the last release to support the Cisco Firepower User Agent software as an identity source. You should switch to Cisco Identity Services Engine/Passive Identity Connector (ISE/ISE-PIC). To convert your license, contact Sales.

Deprecated FTD CLI commands: configure user agent

For more information, see the appropriate Cisco Firepower User Agent Configuration Guide on the Cisco Firepower Management Center Configuration Guides page.

Cisco ISE Endpoint Protection Services (EPS) remediation

ISE remediations can stop working.

FMC

The Cisco ISE Endpoint Protection Services (EPS) remediation does not work with pxGrid 2.0. Configure and use the new Cisco ISE Adaptive Network Control (ANC) remediation instead.

ISE remediations will not launch if you are using the 'wrong' pxGrid to connect the FMC to an ISE/ISE-PIC identity source. The ISE Connection Status Monitor health module alerts you to mismatches.

Less secure Diffie-Hellman groups, and encryption and hash algorithms

Prevents upgrade.

FTD

You may not be able to upgrade an FMC if you use any of the following FTD features:

- Diffie-Hellman groups: 2, 5, and 24.

Group 5 continues to be supported in FMC deployments for IKEv1, but we recommend you change to a stronger option.

- Encryption algorithms for users who satisfy export controls for strong encryption: DES, 3DES, AES-GMAC, AES-GMAC-192, AES-GMAC-256. DES continues to be supported (and is the only option) for users who do not satisfy export controls.

- The NULL "encryption algorithm" (authentication without encryption, for testing purposes) continues to be supported in FMC deployments for both IKEv1 and IKEv2 IPsec proposals. However, it is no longer supported in IKEv2 policies.

- Hash algorithms: MD5.

If you are still using these features in IKE proposals or IPsec policies, change and verify your VPN configuration before you upgrade.

Health modules

None.

FMC

Version 6.7.0 deprecates the following health modules:

- CPU Usage: Replaced by four new modules.

- Local Malware Analysis: This module was replaced by the Threat Data Updates on Devices module in Version 6.3.0. A Version 6.7.0+ FMC can no longer manage any devices where the older module applies.

- User Agent Status Monitor: Cisco Firepower User Agent is no longer supported.

FMC walkthroughs with the Classic theme

None.

FMC

Version 6.7.0 discontinues FMC walkthroughs (how-tos) for the Classic theme. You can switch themes in your user preferences.

Bugtraq

If you export vulnerability data, make sure any integrations are working as expected after the upgrade.

FMC

Version 6.7.0 removes database fields and options for Bugtraq. Bugtraq vulnerability data is no longer available. Most vulnerability data now comes from the National Vulnerability Database (NVD).

Microsoft Internet Explorer

You should switch browsers.

Any

We no longer test Firepower web interfaces using Microsoft Internet Explorer. We recommend you switch to Google Chrome, Mozilla Firefox, or Microsoft Edge.

ASA 5525-X, 5545-X, and 5555-X devices with Firepower software

Upgrade prohibited.

ASA 5525-X, 5545-X, 5555-X

You cannot upgrade to or freshly install Version 6.7.0+ of the Firepower software (both FTD and ASA FirePOWER) on ASA 5525-X, 5545-X, and 5555-X devices.

These features were deprecated in Version 6.7.0 FDM deployments.

Version 6.7.0 Deprecated Features: FDM Deployments

Feature

Upgrade Impact

Platforms

Description

Less secure Diffie-Hellman groups, and encryption and hash algorithms

Prevents post-upgrade deploy.

FTD

You may not be able to deploy post-upgrade with if you use any of the following FTD features:

- Diffie-Hellman groups: 2, 5, and 24.

- Encryption algorithms for users who satisfy export controls for strong encryption: DES, 3DES, AES-GMAC, AES-GMAC-192, AES-GMAC-256. DES continues to be supported (and is the only option) for users who do not satisfy export controls.

- Hash algorithms: MD5.

If you are still using these features in IKE proposals or IPsec policies, change and verify your VPN configuration before you upgrade.

Microsoft Internet Explorer

You should switch browsers.

Any

We no longer test Firepower web interfaces using Microsoft Internet Explorer. We recommend you switch to Google Chrome, Mozilla Firefox, or Microsoft Edge.

ASA 5525-X, 5545-X, and 5555-X devices with Firepower software

Upgrade prohibited.

ASA 5525-X, 5545-X, 5555-X

You cannot upgrade to or freshly install Version 6.7.0+ of the FTD software on ASA 5525-X, 5545-X, and 5555-X devices.

Version 6.6.0 Deprecated Features

These features were deprecated in Version 6.6.0.

Version 6.6.0 Deprecated Features

Feature

Upgrade Impact

Platforms

Description

Lower-memory instances for cloud-based FMCv deployments

Upgrade prohibited.

FMCv for AWS

FMCv for Azure

For performance reasons, the following FMCv instances are no longer supported:

- c3.xlarge on AWS

- c3.2xlarge on AWS

- c4.xlarge on AWS

- c4.2xlarge on AWS

- Standard_D3_v2 on Azure

You must resize before you upgrade to Version 6.6.0+. For more information, see FMCv Requires 28 GB RAM for Upgrade.

Additionally, as of the Version 6.6.0 release, lower-memory instance types for cloud-based FMCv deployments are fully deprecated. You cannot create new FMCv instances using them, even for earlier Firepower versions. You can continue running existing instances.

e1000 Interfaces on FTDv for VMware

Prevents upgrade.

FTDv for VMware

Version 6.6.0 ends support for e1000 interfaces on FTDv for VMware. You cannot upgrade until you switch to vmxnet3 or ixgbe interfaces. Or, you can deploy a new device.

For more information, see the Cisco Firepower Threat Defense Virtual for VMware Getting Started Guide.

Less secure Diffie-Hellman groups, and encryption and hash algorithms

None, but you should switch now.

FTD

Version 6.6.0 deprecates the following features:

- Diffie-Hellman groups: 2, 5, and 24.

- Encryption algorithms for users who satisfy export controls for strong encryption: DES, 3DES, AES-GMAC, AES-GMAC-192, AES-GMAC-256. DES continues to be supported (and is the only option) for users who do not satisfy export controls.

- Hash algorithms: MD5.

These features are removed in Version 6.7.0. Avoid configuring them in IKE proposals or IPSec policies for use in VPNs. Change to stronger options as soon as possible.

Custom tables for connection events

You should delete unsupported custom tables.

FMC

Version 6.6.0 ends support for custom tables for connection and Security Intelligence events. After you upgrade, existing custom tables for those events are still 'available' but return no results. We recommend you delete them.

There is no change to other types of custom tables.

Deprecated options:

- Analysis > Advanced > Custom Tables > click Create Custom Table > Tables drop-down list > Connection Events and Security Intelligence Events

Ability to delete connection events from the event viewer

None.

FMC

Version 6.6.0 ends support for deleting connection and Security Intelligence events from the event viewer. To purge the database, select System > Tools > Data Purge.

Deprecated options:

- Analysis > Connections > Events > Delete and Delete All

- Analysis > Connections > Security Intelligence Events > Delete and Delete All

Version 6.5.0 Deprecated Features

These features were deprecated in Version 6.5.0.

Version 6.5.0 Deprecated Features

Feature

Upgrade Impact

Platforms

Description

Ability to disable the FMC CLI

None.

FMC

Version 6.3.0 introduced the FMC CLI, which you had to explicitly enable. In Version 6.5.0, the FMC CLI is automatically enabled, for both new and upgraded deployments. If you want to access the Linux shell (also called expert mode), you must log in to the CLI and then use the expert command.

Caution

We recommend you do not access Firepower appliances using the shell, unless directed by Cisco TAC.

Deprecated options: System > Configuration > Console Configuration > Enable CLI access check box

TLS 1.0 & 1.1

Client may fail to connect with an upgraded appliance.

FMC

To enhance security:

- Captive portal (active authentication) has removed support for TLS 1.0.

- Host input has removed support for TLS 1.0 and TLS 1.1.

If your client fails to connect with a Firepower appliance, we recommend you upgrade your client to support TLS 1.2.

TLS crypto acceleration FXOS CLI commands for Firepower 4100/9300

None.

Firepower 4100/9300

As part of allowing TLS crypto acceleration for multiple container instances on Firepower 4100/9300, we removed the following FXOS CLI commands:

- show hwCrypto

- config hwCrypto

And this FTD CLI command:

- show crypto accelerator status

For information on their replacements, see the new feature documentation.

Cisco Security Packet Analyzer integration

None, but integration is no longer supported.

FMC

Version 6.5.0 ends support for FMC integration with Cisco Security Packet Analyzer.

Deprecated screens/options:

- System > Integration > Packet Analyzer

- Analysis > Advanced > Packet Analyzer Queries

- Query Packet Analyzer when right-clicking on an event in the dashboard or event viewer

Default HTTPS server certificates

None.

FMC

If you are upgrading from Version 6.4.0.9+, the default HTTPS server certificate's lifespan-on-renew returns to 3 years, but this is again updated to 800 days in Version 6.6.0+.

Your current default HTTPS server certificate is set to expire depending on when it was generated, as follows:

- 6.4.0.9 and later patches: 800 days

- 6.4.0 to 6.4.0.8: 3 years

- 6.3.0 and all patches: 3 years

- 6.2.3: 20 years

Supported platforms: FMC/FMCv, FDM

Firepower Management Center models FMC 750, 1500, 3500

Upgrade prohibited.

FMC 750, 1500, 3500

You cannot upgrade to or freshly install Version 6.5.0+ of the Firepower Management Center software on the FMC 750, FMC 1500, and FMC 3500. You cannot manage Version 6.5.0+ devices with these FMCs.

ASA 5515-X and ASA 5585-X series devices with Firepower software

Upgrade prohibited.

ASA 5515-X, ASA 5585-X series

You cannot upgrade to or freshly install Version 6.5.0+ of the Firepower software (both FTD and ASA FirePOWER) on ASA 5515-X and ASA 5585-X series devices (SSP-10, -20, -40, and -60).

Firepower 7000/8000 series devices

Upgrade prohibited.

Firepower 7000/8000 series

You cannot upgrade to or freshly install Version 6.5.0+ of the Firepower software on Firepower 7000/8000 series devices, including AMP models.

Version 6.4.0 Deprecated Features

These features were deprecated in Version 6.4.0.

Version 6.4.0 Deprecated Features

Feature

Upgrade Impact

Platforms

Description

SSL hardware acceleration FTD CLI commands

None.

FTD

As part of the TLS crypto acceleration feature, we removed the following FTD CLI commands:

- system support ssl-hw-accel enable

- system support ssl-hw-accel disable

- system support ssl-hw-status

For information on their replacements, see the new feature documentation.

Affected platforms: FTD

FMC menu changes

None.

FMC

These FMC pages have changed location in Version 6.4.0.

System > Integration > Cloud Services

is now

System > Integration > Cisco CSI

Version 6.3.0 Deprecated Features

These features were deprecated in Version 6.3.0.

Version 6.3.0 Deprecated Features

Feature

Upgrade Impact

Platforms

Description

EMS extension support for decryption

EMS extension support discontinued until you patch or upgrade.

Any

Version 6.3.0 discontinues EMS extension support, which was introduced in Version 6.2.3.8/6.2.3.9. This means that the Decrypt-Resign and Decrypt-Known Key SSL policy actions no longer support the EMS extension during ClientHello negotiation, which would enable more secure communications. The EMS extension is defined by RFC 7627.

In FMC deployments, this feature depends on the device version. Upgrading the FMC to Version 6.3.0 does not discontinue support, as long as the device is running a supported version. However, upgrading the device to Version 6.3.0 does discontinue support.

Support is reintroduced in Version 6.3.0.1.

Decryption on passive and inline tap Interfaces

The system stops decrypting traffic in passive deployments.

Any

Version 6.3.0 ends support for decrypting traffic on interfaces in passive or inline tap mode, even though the GUI allows you to configure it. Any inspection of encrypted traffic is necessarily limited.

Default DNS group FlexConfig objects

You should redo your configurations after upgrade.

FTD with FMC

Version 6.3.0 deprecates this FlexConfig object for FTD with FMC:

- Default_DNS_Configure

And these associated text objects:

- defaultDNSNameServerList

- defaultDNSParameters

These allowed you to configure the Default DNS group, which defines the DNS servers that can be used when resolving fully qualified domain names on the data interfaces. This allowed you to use commands in the CLI, such as ping , using host names rather than IP addresses.

You can now configure DNS for the data interfaces in the FTD platform settings policy: Devices > Platform Settings > create or edit FTD policy > DNS.

Embryonic connection limit and timeout FlexConfig objects

Post-upgrade deployment issues.

You should redo your configurations after upgrade.

FTD with FMC

Version 6.3.0 deprecates these FlexConfig objects for FTD with FMC:

- TCP_Embryonic_Conn_Limit

- TCP_Embryonic_Conn_Timeout

And these associated text objects:

- tcp_conn_misc

- tcp_conn_limit

- tcp_conn_timeout

These allowed you to configure embryonic connection limits and timeouts to protect against SYN Flood Denial of Service (DoS) attacks.

You can now configure these features in the FTD service policy: Policies > Access Control > add/edit policy > Advanced tab > Threat Defense Service Policy.

Caution

If you used set connection commands to implement connection-related service rules, you should remove the associated objects and implement the features through the FTD service policy. Failure to do so can cause deployment issues.

FMC menu options

None.

FMC

Version 6.3.0 changes these menu options:

Analysis > Advanced > Whois

is now

Analysis > Lookup > Whois

Analysis > Advanced > Geolocation

is now

Analysis > Lookup > Geolocation

Analysis > Advanced > URL

is now

Analysis > Lookup > URL

Analysis > Advanced > Custom Workflows

is now

Analysis > Custom > Custom Workflows

Analysis > Advanced > Custom Tables

is now

Analysis > Custom > Custom Tables

Analysis > Hosts > Vulnerabilities

is now

Analysis > Vulnerabilities > Vulnerabilities

Analysis > Hosts > Third-Party Vulnerabilities

is now

Analysis > Vulnerabilities > Third-Party Vulnerabilities

Affected platforms: FMC

VMware 5.5 hosting

Upgrade the hosting environment before you upgrade the Firepower software.

FMCv for VMware

FTDv for VMware

NGIPSv

Version 6.3.0+ virtual deployments have not been tested on VMware vSphere/VMware ESXi 5.5.

ASA 5506-X series and ASA 5512-X devices with Firepower software

Upgrade prohibited.

ASA 5506-X series, ASA 5512-X

You cannot upgrade to or freshly install Version 6.3.0+ of the Firepower software (both FTD and ASA FirePOWER) on ASA 5506-X, 5506H-X, 5506W-X, and 5512-X devices.

Version 6.2.3 Deprecated Features

These features were deprecated in Version 6.2.3.

Version 6.2.3 Deprecated Features

Feature

Upgrade Impact

Platforms

Description

Expired CA certificates for dynamic analysis

None, but you should patch or upgrade.

AMP for Networks

On June 15, 2018, some Firepower deployments stopped being able to submit files for dynamic analysis. See Expired CA Certificates for Dynamic Analysis.

Version 6.2.1 Deprecated Features

These features were deprecated in Version 6.2.1.

Version 6.2.1 Deprecated Features

Feature

Upgrade Impact

Platforms

Description

Release removed.

None, but you should upgrade.

FMC

Firepower 2100 series

Version 6.2.1 was removed from the Cisco Support & Download site on 2017-11-17. This version is replaced by Version 6.2.2, which offers the same functionality and supports the full set of Firepower platforms.

Version 6.2.0 Deprecated Features

These features were deprecated in Version 6.2.0.

Version 6.2.0 Deprecated Features

Feature

Upgrade Impact

Platforms

Description

Nested correlation rules

Upgrade can fail.

FMC

Version 6.2.0 ends support for nested correlation rules. A correlation rule is nested if it serves as a trigger for another correlation rule. For example, if you create Rule A and Rule B, which both trigger on an intrusion event, you can use 'Rule A is true' as a constraint for Rule B. In this configuration, Rule A is nested inside Rule B.

Automatic Configuration Changes

The upgrade process "flattens" certain nested correlation rules by copying settings from the nested rule (Rule A) to the nesting rule (Rule B), then deleting the nested rule. The upgrade also copies the host profile/user qualifications and the snooze/inactive periods from the nested rule to the nesting rule.

For all of these settings except inactive periods, the system can copy the settings from the nested rule to the nesting rule only if the settings are absent from the nesting rule. When the system copies inactive periods from the nested rule to the nesting rule, it retains inactive periods from the nesting rule, so that the resulting rule uses settings from both rules originally involved in the nesting configuration.

Avoiding Upgrade Failure

Before you upgrade, make sure that any nested correlation rules can be "flattened." Otherwise, the upgrade will fail. Note that the upgrade cannot flatten nested rules if the nested and nesting rule have specific conflicts. To avoid upgrade failure, modify your correlation rules before the upgrade:

- Remove the host profile qualification, user qualification, and snooze period settings from either the nested rule or the nesting rule, so that only one rule in the nested configuration specifies these settings.

- Remove connection trackers from any nested rules.

- Remove host profile qualifications, user qualifications, snooze periods, and inactive periods from nested rules that do not have to be true; that is, remove those elements from nested rules that are linked to other rule conditions using the OR operator, within the nesting rule.

Deprecated Features for Patches

Patches deprecate features only when related to urgent or resolved issues.

Version 6.5.0.x Deprecated Features

These features were deprecated in Version 6.5.0.x patches.

Version 6.5.0.x Deprecated Features

Feature

Upgrade Impact

Platforms

Description

Version 6.5.0.3

Patch removed.

None.

Any

Version 6.5.0.3 was removed from the Cisco Support & Download site on 2019-02-04 (for FMCs) and 2020-03-02 (for devices). If you are running this version, it is safe to continue.

Related bugs: CSCvs86257

Version 6.5.0.2

Egress optimization

Patching turns off egress optimization processing.

FTD

Patching an FTD device to Version 6.5.0.2+ turns off egress optimization processing. This happens regardless of whether the egress optimization feature is enabled or disabled.

Note

We recommend you patch to Version 6.5.0.2+. If you remain at Version 6.5.0 or 6.5.0.1, you should manually disable egress optimization from the FTD CLI: no asp inspect-dp egress-optimization .

For more information, see the software advisory: FTD traffic outage due to 9344 block size depletion caused by the egress optimization feature.

Related bugs: CSCvq34340

Version 6.5.0.1

Patch removed.

None, but do not remain at Version 6.5.0.1.

Any

Version 6.5.0.1 was removed from the Cisco Support & Download site on 2019-12-19. If you are running this version, we recommend you upgrade.

If you upgrade from Version 6.5.0.1 to a later patch, and then uninstall that patch, you return to Version 6.5.0.1. At that point, you should either immediately upgrade, or uninstall Version 6.5.0.1.

Version 6.4.0.x Deprecated Features

These features were deprecated in Version 6.4.0.x patches.

Version 6.4.0.x Deprecated Features

Feature

Version

Platforms

Description

Version 6.4.0.7

Egress optimization

Patching turns off egress optimization processing.

FTD

To mitigate CSCvq34340, patching an FTD device to Version 6.4.0.7 turns off egress optimization processing. This happens regardless of whether the egress optimization feature is enabled or disabled.

Note

Upgrading to Version 6.5.0 will turn egress optimization back on, if you left the feature 'enabled.' We recommend you patch to Version 6.5.0.2+. If you remain at Version 6.5.0 or 6.5.0.1, you should manually disable egress optimization from the FTD CLI: no asp inspect-dp egress-optimization .

For more information, see the software advisory: FTD traffic outage due to 9344 block size depletion caused by the egress optimization feature.

Version 6.4.0.6

Patch removed.

None, but do not remain at Version 6.4.0.6.

Any

Version 6.4.0.6 was removed from the Cisco Support & Download site on 2019-12-19. If you are running this version, we recommend you upgrade.

If you upgrade from Version 6.4.0.6 to a later patch, and then uninstall that patch, you return to Version 6.4.0.6. At that point, you should either immediately upgrade, or uninstall Version 6.4.0.6.

Version 6.2.3.x Deprecated Features

These features were deprecated in Version 6.2.3.x patches.

Version 6.2.3.x Deprecated Features

Feature

Upgrade Impact

Platforms

Description

Version 6.2.3.8

Patch removed.

None, but do not remain at Version 6.2.3.8.

Any

Version 6.2.3.8 was removed from the Cisco Support & Download site on 2019-01-07. If you are running this version, we strongly recommend you upgrade. Devices running Version 6.2.3.8 may stop passing traffic after a certain amount of time.

If you upgrade from Version 6.2.3.8 to a later patch, and then uninstall that patch, you return to Version 6.2.3.8. At that point, you should either immediately upgrade, or uninstall Version 6.2.3.8. Do not remain at Version 6.2.3.8.

Related bugs: CSCvn82378

Versions 6.2.3.1–6.2.3.3

Expired CA certificates for dynamic analysis

None, but you should patch.

AMP for Networks

On June 15, 2018, some Firepower deployments stopped being able to submit files for dynamic analysis. See Expired CA Certificates for Dynamic Analysis.

Chapter 14. Time Tests and Disk Space Requirements

To upgrade a Firepower appliance, you must have enough free disk space or the upgrade fails. When you use the Firepower Management Center to upgrade a managed device, the FMC requires additional disk space in its /Volume partition, for the device upgrade package. You must also have enough time to perform the upgrade.

We provide reports of in-house time and disk space tests for reference purposes.

- About Time Tests

- About Disk Space Requirements

- Version 6.7.0 Time and Disk Space

- Version 6.6.1 Time and Disk Space

- Version 6.6.0.1 Time and Disk Space

- Version 6.6.0 Time and Disk Space

- Version 6.5.0.4 Time and Disk Space

- Version 6.5.0.3 Time and Disk Space

- Version 6.5.0.2 Time and Disk Space

- Version 6.5.0.1 Time and Disk Space

- Version 6.5.0 Time and Disk Space

- Version 6.4.0.10 Time and Disk Space

- Version 6.4.0.9 Time and Disk Space

- Version 6.4.0.8 Time and Disk Space

- Version 6.4.0.7 Time and Disk Space

- Version 6.4.0.6 Time and Disk Space

- Version 6.4.0.5 Time and Disk Space

- Version 6.4.0.4 Time and Disk Space

- Version 6.4.0.3 Time and Disk Space

- Version 6.4.0.2 Time and Disk Space

- Version 6.4.0.1 Time and Disk Space

- Version 6.4.0 Time and Disk Space

- Version 6.3.0.5 Time and Disk Space

- Version 6.3.0.4 Time and Disk Space

- Version 6.3.0.3 Time and Disk Space

- Version 6.3.0.2 Time and Disk Space

- Version 6.3.0.1 Time and Disk Space

- Version 6.3.0 Time and Disk Space

- Version 6.2.3.16 Time and Disk Space

- Version 6.2.3.15 Time and Disk Space

- Version 6.2.3.14 Time and Disk Space

- Version 6.2.3.13 Time and Disk Space

- Version 6.2.3.12 Time and Disk Space

- Version 6.2.3.11 Time and Disk Space

- Version 6.2.3.10 Time and Disk Space

- Version 6.2.3.9 Time and Disk Space

- Version 6.2.3.8 Time and Disk Space

- Version 6.2.3.7 Time and Disk Space

- Version 6.2.3.6 Time and Disk Space

- Version 6.2.3.5 Time and Disk Space

- Version 6.2.3.4 Time and Disk Space

- Version 6.2.3.3 Time and Disk Space

- Version 6.2.3.2 Time and Disk Space

- Version 6.2.3.1 Time and Disk Space

- Version 6.2.3 Time and Disk Space

- Version 6.2.2.5 Time and Disk Space

- Version 6.2.2.4 Time and Disk Space

- Version 6.2.2.3 Time and Disk Space

- Version 6.2.2.2 Time and Disk Space

- Version 6.2.2.1 Time and Disk Space

- Version 6.2.2 Time and Disk Space

- Version 6.2.0.6 Time and Disk Space

- Version 6.2.0.5 Time and Disk Space

- Version 6.2.0.4 Time and Disk Space

- Version 6.2.0.3 Time and Disk Space

- Version 6.2.0.2 Time and Disk Space

- Version 6.2.0.1 Time and Disk Space

- Version 6.2.0 Time and Disk Space

- Version 6.1.0.7 Time and Disk Space

- Version 6.1.0.6 Time and Disk Space

- Version 6.1.0.5 Time and Disk Space

- Version 6.1.0.4 Time and Disk Space

- Version 6.1.0.3 Time and Disk Space

- Version 6.1.0.2 Time and Disk Space

- Version 6.1.0.1 Time and Disk Space

- Version 6.1.0 Time and Disk Space

- Version 6.0.1.4 Time and Disk Space

- Version 6.0.1.3 Time and Disk Space

- Version 6.0.1.2 Time and Disk Space

- Version 6.0.1.1 Time and Disk Space

- Version 6.0.1 Time and Disk Space

- Version 6.0.0.1 Time and Disk Space

- Version 6.0 Time and Disk Space

About Time Tests

Time values given here are based on in-house tests.

Note

Although we report the slowest time of all upgrades tested for a particular platform/series, your upgrade will likely take longer than the provided times for multiple reasons, provided below.

Test Conditions

- Deployment: Values are from tests in a Firepower Management Center deployment. This is because raw upgrade times for remotely and locally managed devices are similar, given similar conditions.

- Versions: For major upgrades, we test upgrades from all eligible previous major versions. For patches, we test upgrades from the base version.

- Models: In most cases, we test on the lowest-end models in each series, and sometimes on multiple models in a series.

- Virtual settings: We test with the default settings for memory and resources.

- High availability and scalability: We test on standalone devices.

In a high availability or clustered configuration, devices upgrade one at a time to preserve continuity of operations, with each device operating in maintenance mode while it upgrades. Upgrading a device pair or entire cluster, therefore, takes longer than upgrading a standalone device. Note that stacked 8000 series devices upgrade simultaneously, with the stack operating in limited, mixed-version state until all devices complete the upgrade. This should not take significantly longer than upgrading a standalone device.

- Configurations: We test on appliances with minimal configurations and traffic load.

Upgrade time can increase with the complexity of your configurations, size of event databases, and whether/how those things are affected by the upgrade. For example, if you use a lot of access control rules and the upgrade needs to make a backend change to how those rules are stored, the upgrade can take longer.

Time Is For Upgrade Only

Values represent only the time it takes for the Firepower upgrade script to run on each platform. They do not include time for:

- Transferring upgrade packages to managed devices, whether before or during upgrade.

- Readiness checks.

- VDB and SRU updates.

- Deploying configurations.

- Reboots (values may be provided separately).

About Disk Space Requirements

Space estimates are the largest reported for all upgrades. For releases after early 2020, they are:

- Not rounded up (under 1 MB).

- Rounded up to the next 1 MB (1 MB - 100 MB).

- Rounded up to the next 10 MB (100 MB - 1GB).

- Rounded up to the next 100 MB (greater than 1 GB).

Version 6.7.0 Time and Disk Space

Version 6.7.0 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Upgrade Time

Reboot Time

FMC

13.6 GB

70 MB

—

46 min

9 min

FMCv: VMware 6.0

15.5 GB

64 MB

—

35 min

8 min

Firepower 1000 series

430 MB

11 GB

2 GB

17 min

16 min

Firepower 2100 series

500 MB

11 GB

1.1 GB

15 min

16 min

Firepower 4100 series

10 MB

10 GB

1.1 GB

10 min

12 min

Firepower 4100 series container instance

8 MB

9.5 GB

1.1 GB

10 min

9 min

Firepower 9300

64 MB

11.1 GB

1.1 GB

13 min

12 min

ASA 5500-X series with FTD

8.7 GB

96 KB

1.1 GB

26 min

13 min

FTDv: VMware 6.0

8.1 GB

26 KB

1.1 GB

14 min

18 min

ASA FirePOWER

10.3 GB

64 MB

1.3 GB

62 min

11 min

NGIPSv: VMware 6.0

5.5 GB

54 MB

840 MB

10 min

6 min

Version 6.6.1 Time and Disk Space

Version 6.6.1 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Upgrade Time

Reboot Time

FMC

18.6 GB

23 MB

—

54 min

14 min

FMCv: VMware 6.0

15.8 GB

58 MB

—

56 min

13 min

Firepower 1000 series

10.8 GB

400 MB

1.1 GB

20 min

17 min

Firepower 2100 series

10.9 GB

450 MB

1.1 GB

16 min

21 min

Firepower 4100 series

9.7 GB

10 MB

1 GB

15 min

14 min

Firepower 4100 series container instance

11.2 GB

9 MB

1 GB

10 min

13 min

Firepower 9300

9.8 GB

11 MB

1 GB

15 min

15 min

ASA 5500-X series with FTD

9.3 GB

1 MB

1.2 GB

21 min

24 min

FTDv: VMware 6.0

9.3 GB

1 MB

1.2 GB

18 min

19 min

ASA FirePOWER

12.3 GB

26 MB

1.4 GB

72 min

23 min

NGIPSv: VMware 6.0

7.1 GB

54 MB

860 MB

14 min

20 min

Version 6.6.0.1 Time and Disk Space

In this table, the upgrade time includes reboot.

Version 6.6.0.1 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Upgrade Time from 6.6.0

FMCv: VMware 6.0

1.1 GB

23 MB

—

17 min

Firepower 1000 series

450 MB

450 MB

240 MB

21 min

Firepower 2100 series

260 MB

260 MB

270 MB

17 min

Firepower 4100 series

470 MB

470 MB

46 MB

11 min

Firepower 9300

460 MB

460 MB

46 MB

33 min

ASA 5500-X series with FTD

440 MB

120 MB

46 MB

17 min

ISA 3000 with FTD

440 MB

120 MB

46 MB

21 min

FTDv: VMware 6.0

430 MB

120 MB

46 MB

11 min

ASA FirePOWER

80 MB

20 MB

15 MB

18 min

NGIPSv: VMware 6.0

64 MB

28 MB

15 MB

9 min

Version 6.6.0 Time and Disk Space

Note

For ASA 5545-X with FirePOWER Services, if the SRU on the device is the same as or newer than the SRU in the Version 6.6.0 upgrade package (2020-01-16-001-vrt), the upgrade can take longer than expected—more than an hour longer. To determine if this will affect you, log into the Firepower CLI on the device and use the show version command to display the Rules update version.

Version 6.6.0 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Upgrade Time

Reboot Time

FMC

16.5 GB

71 MB

—

46 min

15 min

FMCv: VMware 6.0

16.7 GB

57 MB

—

36 min

7 min

Firepower 1000 series

410 MB

11.5 GB

1.1 GB

20 min

17 min

Firepower 2100 series

470 MB

10.3 GB

1 GB

14 min

14 min

Firepower 4100 series

61 MB

9.3 GB

980 MB

11 min

9 min

Firepower 4100 series container instance

46 MB

11.3 GB

980 MB

11 min

6 min

Firepower 9300

64 MB

10.5 GB

980 MB

15 min

12 min

ASA 5500-X series with FTD

8.7 GB

70 KB

1.2GB

23 min

26 min

FTDv: VMware 6.0

8.7 GB

70 KB

1.2 GB

14 min

17 min

ASA FirePOWER

11.4 GB

63 MB

1.4 GB

93 min

10 min

NGIPSv: VMware 6.0

6.1 GB

53 MB

860 MB

10 min

5 min

Version 6.5.0.4 Time and Disk Space

Version 6.5.0.4 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

Firepower 1000 series

2.6 GB

2.6 GB

500 MB

20 min

Firepower 2100 series

2.5 GB

2.5 GB

530 MB

18 min

Firepower 4100 series

2.5 GB

2.5 GB

360 MB

13 min

Firepower 9300

2.5 GB

2.5 GB

360 MB

17 min

ASA 5500-X series with FTD

1.9 GB

110 MB

310 MB

16 min

FTDv: VMware 6.0

1.9 GB

110 MB

310 MB

9 min

ASA FirePOWER

2.6 GB

20 MB

340 MB

72 min

NGIPSv: VMware 6.0

740 MB

20 MB

230 MB

8 min

Version 6.5.0.3 Time and Disk Space

Version 6.5.0.3 was removed from the Cisco Support & Download site on 2019-02-04 (for FMCs) and 2020-03-02 (for devices). If you are running this version, it is safe to continue.

Version 6.5.0.2 Time and Disk Space

Version 6.5.0.2 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

2.6 GB

20 MB

—

42 min

FMCv: VMware 6.0

2.7 GB

23 MB

—

34 min

Firepower 1000 series

2.5 GB

2.5 GB

480 MB

12 min

Firepower 2100 series

2.3 GB

2.3 GB

500 MB

17 min

Firepower 4100 series

2.3 GB

2.3 GB

340 MB

13 min

Firepower 9300

2.3 GB

2.3 GB

340 MB

17 min

ASA 5500-X series with FTD

1.9 GB

110 MB

280 MB

22 min

FTDv: VMware 6.0

1.7 GB

110 MB

280 MB

10 min

ASA FirePOWER

2.5 GB

20 MB

320 MB

56 min

NGIPSv: VMware 6.0

680 MB

18 MB

210 MB

9 min

Version 6.5.0.1 Time and Disk Space

Version 6.5.0.1 was removed from the Cisco Support & Download site on 2019-12-19. If you are running this version, we recommend you upgrade.

Version 6.5.0 Time and Disk Space

Version 6.5.0 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

18.6 GB

24 MB

—

47 min

FMCv: VMware 6.0

18.7 GB

30 MB

—

35 min

Firepower 1000 series

1 GB

11.3 GB

1.1 GB

10 min

Firepower 2100 series

1.1 GB

12.3 GB

1 GB

12 min

Firepower 4100 series

20 MB

10.8 GB

990 MB

8 min

Firepower 9300

23 MB

10.9 GB

990 MB

8 min

ASA 5500-X series with FTD

10.4 GB

120 KB

1.1 GB

17 min

FTDv: VMware 6.0

10 GB

120 KB

1.1 GB

10 min

ASA FirePOWER

12.2 GB

26 MB

1.3 GB

81 min

NGIPSv: VMware 6.0

6.6 GB

22 MB

870 MB

9 min

Version 6.4.0.10 Time and Disk Space

Version 6.4.0.10 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Upgrade Time from 6.4.0

Reboot Time

FMC

3.8 GB

170 MB

—

30 min

8 min

FMCv: VMware 6.0

4.1 GB

170 MB

—

27 min

7 min

Firepower 1000 series

2.9 GB

2.9 GB

560 MB

11 min

14 min

Firepower 2100 series

2.5 GB

2.5 GB

530 MB

8 min

13 min

Firepower 4100 series

1.8 GB

1.8 GB

330 MB

5 min

11 min

Firepower 9300

1.8 GB

1.8 GB

330 MB

5 min

17 min

ASA 5500-X series with FTD

1.9 GB

110 MB

310 MB

12 min

31 min

FTDv: VMware 6.0

2 GB

110 MB

310 MB

8 min

8 min

Firepower 7000/8000 series

3.6 GB

170 MB

680 MB

11 min

97 min

ASA FirePOWER

4.2 GB

36 MB

630 MB

54 min

51 min

NGIPSv: VMware 6.0

2.4 GB

150 MB

470 MB

11 min

15 min

Version 6.4.0.9 Time and Disk Space

Version 6.4.0.9 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Upgrade Time from 6.4.0

Reboot Time

FMC

3.7 GB

170 MB

—

41 min

10 min

FMCv: VMware 6.0

3.7 GB

170 MB

—

28 min

6 min

Firepower 1000 series

2.9 GB

2.9 GB

530 MB

11 min

14 min

Firepower 2100 series

2.6 GB

2.6 GB

510 MB

10 min

13 min

Firepower 4100 series

1.8 GB

1.8 GB

310 MB

4 min

10 min

Firepower 9300

1.8 GB

1.8 GB

310 MB

4 min

10 min

ASA 5500-X series with FTD

1.9 GB

290 MB

290 MB

12 min

42 min

FTDv: VMware 6.0

1.9 GB

290 MB

290 MB

7 min

9 min

Firepower 7000/8000 series

3.7 GB

170 MB

650 MB

20 min

6 min

ASA FirePOWER

4.2 GB

36 MB

600 MB

48 min

48 min

NGIPSv: VMware 6.0

2.1 GB

150 MB

450 MB

6 min

4 min

Version 6.4.0.8 Time and Disk Space

Version 6.4.0.8 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.4.0

FMC

5 GB

170 MB

—

44 min

FMCv: VMware 6.0

5.1 GB

170 MB

—

32 min

Firepower 1000 series

3 GB

3 GB

530 MB

18 min

Firepower 2100 series

2.5 GB

2.5 GB

510 MB

18 min

Firepower 4100 series

1.8 GB

1.8 GB

310 MB

14 min

Firepower 9300

2 GB

2 GB

310 MB

11 min

ASA 5500-X series with FTD

1.8 GB

110 MB

290 MB

17 min

FTDv: VMware 6.0

1.9 GB

110 MB

290 MB

12 min

Firepower 7000/8000 series

3.7 GB

190 MB

650 MB

25 min

ASA FirePOWER

2.2 GB

110 MB

590 MB

16 min

NGIPSv: VMware 6.0

2.1 GB

150 MB

450 MB

9 min

Version 6.4.0.7 Time and Disk Space

Version 6.4.0.7 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.4.0

FMC

4.9 GB

170 MB

—

41 min

FMCv: VMware 6.0

5.1 GB

170 MB

—

32 min

Firepower 1000 series

2.9 GB

2.9 GB

530 MB

17 min

Firepower 2100 series

2.4 GB

2.4 GB

500 MB

17 min

Firepower 4100 series

1.7 GB

1.7 GB

310 MB

15 min

Firepower 9300

2.4 GB

2.4 GB

310 MB

12 min

ASA 5500-X series with FTD

1.9 GB

110 MB

290 MB

18 min

FTDv: VMware 6.0

1.8 GB

110 MB

290 MB

9 min

Firepower 7000/8000 series

3.7 GB

190 MB

650 MB

28 min

ASA FirePOWER

4.2 GB

36 MB

590 MB

54 min

NGIPSv: VMware 6.0

2.3 GB

150 MB

450 MB

9 min

Version 6.4.0.6 Time and Disk Space

Version 6.4.0.6 was removed from the Cisco Support & Download site on 2019-12-19. If you are running this version, we recommend you upgrade.

Version 6.4.0.5 Time and Disk Space

Version 6.4.0.5 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.4.0

FMC

5 GB

170 MB

—

39 min

FMCv: VMware 6.0

3.7 GB

170 MB

—

27 min

Firepower 1000 series

2.9 GB

2.9 GB

530 MB

26 min

Firepower 2100 series

2.5 GB

2.5 GB

500 MB

16 min

Firepower 4100 series

1.8 GB

1.8 GB

310 MB

12 min

Firepower 9300

1.8 GB

1.8 GB

310 MB

11 min

ASA 5500-X series with FTD

1.8 GB

110 MB

290 MB

20 min

FTDv: VMware 6.0

1.8 GB

110 MB

290 MB

10 min

Firepower 7000/8000 series

3.6 GB

170 MB

650 MB

26 min

ASA FirePOWER

4.1 GB

36 MB

590 MB

45 min

NGIPSv: VMware 6.0

2.1 GB

150 MB

450 MB

10 min

Version 6.4.0.4 Time and Disk Space

Version 6.4.0.4 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.4.0

FMC

4.4 GB

170 MB

—

35 min

FMCv: VMware 6.0

4.8 GB

170 MB

—

31 min

Firepower 1000 series

2.9 GB

2.9 GB

520 MB

28 min

Firepower 2100 series

2.4 GB

2.4 GB

500 MB

10 min

Firepower 4100 series

2 GB

2 GB

310 MB

12 min

Firepower 9300

1.7 GB

1.7 GB

310 MB

10 min

ASA 5500-X series with FTD

1.8 GB

110 MB

290 MB

29 min

FTDv: VMware 6.0

1.8 GB

110 MB

290 MB

8 min

Firepower 7000/8000 series

3.6 GB

170 MB

650 MB

24 min

ASA FirePOWER

4.2 GB

36 MB

600 MB

55 min

NGIPSv: VMware 6.0

2.1 GB

150 MB

550 MB

10 min

Version 6.4.0.3 Time and Disk Space

Version 6.4.0.3 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.4.0

FMC

3.2 GB

24 MB

—

34 min

FMCv: VMware 6.0

2.5 GB

23 MB

—

25 min

Firepower 1000 series

2.9 GB

2.9 GB

520 MB

22 min

Firepower 2100 series

2.4 GB

2.4 GB

500 MB

19 min

Firepower 4100 series

1.7 GB

1.7 GB

310 MB

12 min

Firepower 9300

1.7 GB

1.7 GB

310 MB

14 min

ASA 5500-X series with FTD

1.8 GB

110 MB

290 MB

18 min

FTDv: VMware 6.0

1.8 GB

110 MB

290 MB

12 min

Firepower 7000/8000 series

1.9 GB

21 MB

370 MB

20 min

ASA FirePOWER

2.5 GB

2.5 GB

320 MB

28 min

NGIPSv: VMware 6.0

690 MB

21 MB

210 MB

8 min

Version 6.4.0.2 Time and Disk Space

Version 6.4.0.2 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.4.0

FMC

3.1 GB

24 MB

—

39 min

FMCv: VMware 6.0

2.5 GB

23 MB

—

24 min

Firepower 2100 series

1.9 GB

1.9 GB

480 MB

19 min

Firepower 4100 series

2.3 GB

2.3 GB

290 MB

11 min

Firepower 9300

1.7 GB

1.7 GB

290 MB

11 min

ASA 5500-X series with FTD

1.8 GB

110 MB

270 MB

21 min

FTDv: VMware 6.0

1.2 GB

110 MB

270 MB

10 min

Firepower 7000/8000 series

1.9 GB

36 MB

350 MB

20 min

ASA FirePOWER

2 GB

21 MB

300 MB

34 min

NGIPSv: VMware 6.0

630 MB

21 MB

190 MB

10 min

Version 6.4.0.1 Time and Disk Space

Version 6.4.0.1 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.4.0

FMC

1.8 GB

24 MB

—

50 min

FMCv: VMware 6.0

1.8 GB

23 MB

—

20 min

Firepower 2100 series

1.4 GB

1.4 GB

300 MB

17 min

Firepower 4100 series

1.1 GB

1.1 GB

95 MB

9 min

Firepower 9300

1.1 GB

1.1 GB

95 MB

10 min

ASA 5500-X series with FTD

550 MB

110 MB

76 MB

16 min

FTDv: VMware 6.0

550 MB

110 MB

76 MB

15 min

Firepower 7000/8000 series

59 MB

21 MB

2 MB

14 min

ASA FirePOWER

85 MB

20 MB

2 MB

30 min

NGIPSv: VMware 6.0

45 MB

21 MB

2 MB

10 min

Version 6.4.0 Time and Disk Space

Version 6.4.0 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

13.3 GB

26 MB

—

41 min

FMCv: VMware 6.0

13.6 GB

29 MB

—

30 min

Firepower 2100 series

12 MB

8.9 GB

950 MB

20 min

Firepower 4100 series

10 MB

7.5 GB

920 MB

6 min

Firepower 9300

10 MB

7.7 GB

920 MB

7 min

ASA 5500-X series with FTD

9 GB

110 KB

1.1 GB

24 min

FTDv: VMware 6.0

7.5 GB

100 KB

1.1 GB

12 min

Firepower 7000/8000 series

7.7 GB

19 MB

980 MB

34 min

ASA FirePOWER

11.5 GB

22 MB

1.3 GB

66 min

NGIPSv: VMware 6.0

6.5 GB

19 MB

840 MB

16 min

Version 6.3.0.5 Time and Disk Space

Version 6.3.0.5 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.3.0

FMC

4.9 GB

200 MB

—

46 min

FMCv: VMware 6.0

4.5 GB

180 MB

—

41 min

Firepower 2100 series

2.3 GB

2.3 GB

480 MB

21 min

Firepower 4100 series

1.6 GB

1.6 GB

280 MB

13 min

Firepower 9300

1.6 GB

1.6 GB

280 MB

17 min

ASA 5500-X series with FTD

1.7 GB

110 MB

270 MB

26 min

FTDv: VMware 6.0

1.7 GB

110 MB

270 MB

17 min

Firepower 7000/8000 series

2.6 GB

210 MB

600 MB

23 min

ASA FirePOWER

3.6 GB

47 MB

540 MB

74 min

NGIPSv: VMware 6.0

2.1 GB

160 MB

440 MB

17 min

Version 6.3.0.4 Time and Disk Space

Version 6.3.0.4 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.3.0

FMC

3.4 GB

180 MB

—

34 min

FMCv: VMware 6.0

4.4 GB

180 MB

—

38 min

Firepower 2100 series

2.3 GB

2.3 GB

480 MB

17 min

Firepower 4100 series

1.6 GB

1.6 GB

280 MB

12 min

Firepower 9300

1.8 GB

1.8 GB

280 MB

12 min

ASA 5500-X series with FTD

1.7 GB

110 MB

270 MB

23 min

FTDv: VMware 6.0

1.7 GB

110 MB

270 MB

18 min

Firepower 7000/8000 series

3.3 GB

170 MB

600 MB

21 min

ASA FirePOWER

3.5 GB

31 MB

530 MB

48 min

NGIPSv: VMware 6.0

2.1 GB

160 MB

430 MB

16 min

Version 6.3.0.3 Time and Disk Space

Version 6.3.0.3 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.3.0

FMC

3.7 GB

180 MB

—

33 min

FMCv: VMware 6.0

3.2 GB

180 MB

—

24 min

Firepower 2100 series

1.2 GB

1.2 GB

290 MB

18 min

Firepower 4100 series

990 MB

990 MB

99 MB

11 min

Firepower 9300

990 MB

990 MB

99 MB

12 min

ASA 5500-X series with FTD

620 MB

110 MB

79 MB

18 min

FTDv: VMware 6.0

240 MB

110 MB

79 MB

7 min

Firepower 7000/8000 series

2.6 GB

170 MB

400 MB

20 min

ASA FirePOWER

2.9 GB

30 MB

340 MB

45 min

NGIPSv: VMware 6.0

1.5 GB

160 MB

250 MB

4 min

Version 6.3.0.2 Time and Disk Space

Version 6.3.0.2 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.3.0

FMC

3.5 GB

180 MB

—

53 min

FMCv: VMware 6.0

3.2 GB

180 MB

—

28 min

Firepower 2100 series

1.2 GB

1.2 GB

100 MB

17 min

Firepower 4100 series

970 MB

970 MB

100 MB

12 min

Firepower 9300

970 MB

970 MB

100 MB

11 min

ASA 5500-X series with FTD

570 MB

110 MB

80 MB

12 min

FTDv: VMware 6.0

600 MB

110 MB

80 MV

10 min

Firepower 7000/8000 series

2.5 GB

170 MB

400 MB

20 min

ASA FirePOWER

3 GB

30 MB

340 MB

45 min

NGIPSv: VMware 6.0

1.5 GB

160 MB

250 MB

10 min

Version 6.3.0.1 Time and Disk Space

Version 6.3.0.1 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.3.0

FMC

3 GB

170 MB

—

31 min

FMCv: VMware 6.0

2.4 GB

170 MB

—

25 min

Firepower 2100 series

1.2 GB

1.2 GB

290 MB

18 min

Firepower 4100 series

740 MB

740 MB

100 MB

12 min

Firepower 9300

740 MB

740 MB

100 MB

12 min

ASA 5500-X series with FTD

400 MB

150 MB

72 MB

17 min

FTDv: VMware 6.0

400 MB

150 MB

72 MB

10 min

Firepower 7000/8000 series

2.1 GB

170 MB

350 MB

20 min

ASA FirePOWER

2.4 GB

28 MB

270 MB

44 min

NGIPSv: VMware 6.0

1.5 GB

150 MB

350 MB

10 min

Version 6.3.0 Time and Disk Space

Version 6.3.0 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

12.7 GB

29 MB

—

47 min

FMCv on: VMware 6.0

12.7 GB

29 MB

—

29 min

Firepower 2100 series

13 MB

8.8 GB

930 MB

20 min

Firepower 4100/9300 chassis

10 MB

7.6 GB

930 MB

6 min

ASA 5500-X series with FTD

7.9 GB

100 KB

1.1 GB

25 min

FTDv: VMware 6.0

7.3 GB

100 KB

1.1 GB

12 min

Firepower 7000/8000 series

7.0 GB

19 MB

920 MB

32 min

ASA FirePOWER

11.3 GB

22 MB

1.2 GB

63 min

NGIPSv

5.7 GB

19 MB

810 MB

16 min

Version 6.2.3.16 Time and Disk Space

Version 6.2.3.16 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Upgrade Time from 6.2.3

Reboot Time

FMC

3.6 GB

250 MB

—

40 min

9 min

FMCv: VMware 6.0

3.3 GB

220 MB

—

25 min

4 min

Firepower 2100 series

2.6 GB

2.6 GB

620 MB

11 min

12 min

Firepower 4100 series

1.7 GB

1.7 GB

410 MB

5 min

5 min

Firepower 9300

1.8 GB

1.8 GB

410 MB

5 min

9 min

ASA 5500-X series with FTD

2 GB

200 MB

430 MB

18 min

33 min

FTDv: VMware 6.0

2 GB

190 MB

430 MB

8 min

5 min

Firepower 7000/8000 series

3.5 GB

200 MB

670 MB

31 min

14 min

ASA FirePOWER

3.8 GB

58 MB

600 MB

74 min

77 min

NGIPSv: VMware 6.0

2.3 GB

180 MB

500 MB

6 min

4 min

Version 6.2.3.15 Time and Disk Space

Version 6.2.3.15 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

4.7 GB

260 MB

—

50 min

FMCv: VMware 6.0

4.7 GB

210 MB

—

Hardware dependent

Firepower 2100 series

2.3 GB

2.3 GB

590 MB

27 min

Firepower 4100 series

1.7 GB

1.7 GB

390 MB

10 min

Firepower 9300

2.4 GB

2.4 GB

390 MB

11 min

ASA 5500-X series with FTD

2 GB

190 MB

410 MB

38 min

FTDv: VMware 6.0

2.4 GB

190 MB

410 MB

Hardware dependent

Firepower 7000/8000 series

3.5 GB

210 MB

640 MB

19 min

ASA FirePOWER

3.9 GB

56 MB

580 MB

100 min

NGIPSv: VMware 6.0

2.7 GB

180 MB

470 MB

Hardware dependent

Version 6.2.3.14 Time and Disk Space

Version 6.2.3.14 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

4.5 GB

260 MB

—

58 min

FMCv: VMware 6.0

4.7 GB

190 MB

—

Hardware dependent

Firepower 2100 series

1.9 GB

1.9 GB

590 MB

23 min

Firepower 4100 series

1.7 GB

1.7 GB

390 MB

11 min

Firepower 9300

1.7 GB

1.7 GB

390 MB

10 min

ASA 5500-X series with FTD

2 GB

200 MB

410 MB

32 min

FTDv: VMware 6.0

2.4 GB

190 MB

410 MB

Hardware dependent

Firepower 7000/8000 series

3.4 GB

200 MB

630 MB

19 min

ASA FirePOWER

3.7 GB

53 MB

560 MB

106 min

NGIPSv: VMware 6.0

2.6 GB

190 MB

470 MB

Hardware dependent

Version 6.2.3.13 Time and Disk Space

Version 6.2.3.13 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

4.7 GB

290 MB

—

50 min

FMCv: VMware 6.0

4.6 GB

190 MB

—

Hardware dependent

Firepower 2100 series

2.6 GB

2.6 GB

590 MB

25 min

Firepower 4100 series

1.7 GB

1.7 GB

390 MB

11 min

Firepower 9300

1.8 GB

1.8 GB

390 MB

11 min

ASA 5500-X series with FTD

2.4 GB

190 MB

410 MB

32 min

FTDv: VMware 6.0

2.3 GB

190 MB

410 MB

Hardware dependent

Firepower 7000/8000 series

3.8 GB

190 MB

620 MB

18 min

ASA FirePOWER

3.7 GB

51 MB

560 MB

105 min

NGIPSv: VMware 6.0

2.6 GB

180 MB

470 MB

Hardware dependent

Version 6.2.3.12 Time and Disk Space

Version 6.2.3.12 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

3.9 GB

220 MB

—

49 min

FMCv: VMware 6.0

4.6 GB

160 MB

—

Hardware dependent

Firepower 2100 series

1.9 GB

1.9 GB

390 MB

21 min

Firepower 4100 series

970 MB

970 MB

190 MB

14 min

Firepower 9300

1.7 GB

1.7 GB

190 MB

11 min

ASA 5500-X series with FTD

1.4 GB

96 MB

210 MB

30 min

FTDv: VMware 6.0

2.4 GB

200 MB

210 MB

Hardware dependent

Firepower 7000/8000 series

3.6 GB

160 MB

540 MB

19 min

ASA FirePOWER

3.5 GB

31 MB

480 MB

104 min

NGIPSv: VMware 6.0

2.6 GB

130 MB

400 MB

Hardware dependent

Version 6.2.3.11 Time and Disk Space

Version 6.2.3.11 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

4.5 GB

250 MB

—

39 min

FMCv: VMware 6.0

4.6 GB

35 MB

—

Hardware dependent

Firepower 2100 series

2.8 GB

2.8 GB

590 MB

40 min

Firepower 4100 series

2 GB

2 GB

380 MB

10 min

Firepower 9300

1.6 GB

1.6 GB

380 MB

11 min

ASA 5500-X series with FTD

1.8 GB

230 MB

410 MB

33 min

FTDv: VMware 6.0

2.2 GB

230 MB

410 MB

Hardware dependent

Firepower 7000/8000 series

3.3 GB

170 MB

600 MB

23 min

ASA FirePOWER

3.6 GB

50 MB

530 MB

110 min

NGIPSv: VMware 6.0

2.6 GB

130 MB

450 MB

Hardware dependent

Version 6.2.3.10 Time and Disk Space

Version 6.2.3.10 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

4.2 GB

200 MB

—

40 min

FMCv

4.5 GB

230 MB

—

Hardware dependent

Firepower 2100 series

1.8GB

1.8 GB

390 MB

21 min

Firepower 4100/9300 chassis

1.3 GB

1.3 GB

190 MB

11 min

ASA 5500-X series with FTD

1.3 GB

140 MB

210 MB

25 min

FTDv

1.6 GB

140 MB

210 MB

Hardware dependent

Firepower 7000/8000 series

3.2 GB

190 MB

560 MB

25 min

ASA FirePOWER

3.4 GB

31 MB

480 MB

100 min

NGIPSv

2.1 GB

160 MB

400 MB

Hardware dependent

Version 6.2.3.9 Time and Disk Space

Version 6.2.3.9 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

3630 MB

190 MB

—

35 min

FMCv

3596 MB

172 MB

—

Hardware dependent

Firepower 2100 series

1677 MB

1677 MB

385 MB

21 min

Firepower 4100/9300 chassis

779 MB

779 MB

184 MB

9 min

ASA 5500-X series with FTD

1105 MB

130 MB

206 MB

12 min

ISA 3000 with FTD

1071 MB

130 MB

206 MB

25 min

FTDv

1094 MB

130 MB

206 MB

Hardware dependent

Firepower 7000/8000 series

2975 MB

161 MB

538 MB

30 min

ASA FirePOWER

3211 MB

27 MB

462 MB

38 min

NGIPSv

1883 MB

146 MB

378 MB

Hardware dependent

Version 6.2.3.8 Time and Disk Space

Version 6.2.3.8 was removed from the Cisco Support & Download site on 2019-01-07. If you are running this version, we recommend you upgrade.

Version 6.2.3.7 Time and Disk Space

Version 6.2.3.7 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

2909 MB

137 MB

—

25 min

FMCv

3972 MB

211 MB

—

Hardware dependent

Firepower 2100 series

1668 MB

1668 MB

384 MB

19 min

Firepower 4100/9300 chassis

795 MB

795 MB

183 MB

8 min

ASA 5500-X series with FTD

1067 MB

130 MB

205 MB

9 min

ISA 3000 with FTD

1080 MB

130 MB

205 MB

20 min

FTDv

1146 MB

130 MB

205 MB

Hardware dependent

Firepower 7000/8000 series

3300 MB

136 MB

477 MB

20 min

ASA FirePOWER

2291 MB

26 MB

411 MB

80 min

NGIPSv

1588 MB

121 MB

327 MB

Hardware dependent

Version 6.2.3.6 Time and Disk Space

Version 6.2.3.6 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

2524 MB

47 MB

—

30 min

FMCv

2315 MB

101 MB

—

Hardware dependent

Firepower 2100 series

1673 MB

1673 MB

383 MB

10 min

Firepower 4100/9300 chassis

790 MB

790 MB

182 MB

17 min

ASA 5500-X series with FTD

1220 MB

130 MB

205 MB

21 min

ISA 3000 with FTD

1087 MB

130 MB

205 MB

21 min

FTDv

1133 MB

130 MB

205 MB

Hardware dependent

Firepower 7000/8000 series

1196 MB

17 MB

204 MB

30 min

ASA FirePOWER

1844 MB

16 MB

226 MB

106 min

NGIPSv

364 MB

17 MB

142 MB

Hardware dependent

Version 6.2.3.5 Time and Disk Space

Version 6.2.3.5 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

1566 MB

24 MB

—

28 min

FMCv

2266 MB

80 MB

—

Hardware dependent

Firepower 2100 series

1001 MB

1001MB

257 MB

20 min

Firepower 4100/9300 chassis

370 MB

370 MB

56 MB

7 min

ASA 5500-X series with FTD

587 MB

130 MB

78 MB

20 min

ISA 3000 with FTD

379 MB

130 MB

78 MB

20 min

Firepower 7000/8000 series

806 MB

17 MB

78 MB

22 min

ASA FirePOWER

1465 MB

15 MB

100 MB

70 min

NGIPSv

120 MB

17 MB

16 MB

Hardware dependent

Version 6.2.3.4 Time and Disk Space

Version 6.2.3.4 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

2191 MB

107 MB

—

80 min

FMCv

1760 MB

35 MB

—

Hardware dependent

Firepower 2100 series

1014 MB

1014 MB

261 MB

17 min

Firepower 4100/9300 chassis

334 MB

334 MB

59 MB

7 min

ASA 5500-X series with FTD

411 MB

128 MB

82 MB

20 min

ISA 3000 with FTD

393 MB

128 MB

82 MB

20 min

FTDv

411 MB

128 MB

82 MB

Hardware dependent

Firepower 7000/8000 series

800 MB

17 MB

82 MB

23 min

ASA FirePOWER

1385 MB

15 MB

103 MB

25 min

NGIPSv

191 MB

17 MB

20 MB

Hardware dependent

Version 6.2.3.3 Time and Disk Space

Version 6.2.3.3 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

1879 MB

88 MB

—

26 min

FMCv

2093 MB

90 MB

—

Hardware dependent

Firepower 2100 series

987 MB

987 MB

255 MB

15 min

Firepower 4100/9300 chassis

313 MB

313 MB

54 MB

5 min

ASA 5500-X series with FTD

553 MB

128 MB

77 MB

16 min

ISA 3000 with FTD

307 MB

90 MB

77 MB

15 min

FTDv

307 MB

90 MB

77 MB

Hardware dependent

Firepower 7000/8000 series

825 MB

17 MB

77 MB

15 min

ASA FirePOWER

634 MB

16 MB

98 MB

40 min

NGIPSv

102 MB

17 MB

77 MB

Hardware dependent

Version 6.2.3.2 Time and Disk Space

Version 6.2.3.2 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

1743 MB

27 MB

—

24 min

FMCv

1976 MB

70 MB

—

Hardware dependent

Firepower 2100 series

977 MB

977 MB

252 MB

17 min

Firepower 4100/9300 chassis

374 MB

374 MB

51 MB

4 min

ASA 5500-X series with FTD

585 MB

126 MB

73 MB

16 min

ISA 3000 with FTD

676 MB

126 MB

73 MB

17 min

FTDv

585 MB

126 MB

73 MB

Hardware dependent

Firepower 7000/8000 series

688 MB

11 MB

76 MB

13 min

ASA FirePOWER

1440 MB

15 MB

98 MB

40 min

NGIPSv

96 MB

17 MB

14 MB

Hardware dependent

Version 6.2.3.1 Time and Disk Space

Version 6.2.3.1 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.3

FMC

1361.8 MB

59.67 MB

—

25 min

FMCv

1240.8 MB

40.8 MB

—

Hardware dependent

Firepower 2100 series

948.3 MB

948.3 MB

246 MB

81 min

Firepower 4100/9300 chassis

278 MB

278 MB

45 MB

8 min

ASA 5500-X series with FTD

275.5 MB

89.9 MB

68 MB

16 min

ISA 3000 with FTD

343.4 MB

127.5 MB

68 MB

15 min

FTDv

275.5 MB

89.9 MB

67 MB

Hardware dependent

Firepower 7000/8000 series

99.8 MB

36 MB

10 MB

19 min

ASA FirePOWER

867.9 MB

15.45 MB

32 MB

60 min

NGIPSv

101.9 MB

17.18 MB

9 MB

Hardware dependent

Version 6.2.3 Time and Disk Space

Version 6.2.3 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

From 6.1.0: 7415 MB

From 6.2.0: 8863 MB

From 6.2.1: 8263 MB

From 6.2.2: 11860 MB

From 6.1.0: 17 MB

From 6.2.0: 24 MB

From 6.2.1: 23 MB

From 6.2.2: 24 MB

—

From 6.1.0: 38 min

From 6.2.0: 43 min

From 6.2.1: 37 min

From 6.2.2: 37 min

FMCv

From 6.1.0: 7993 MB

From 6.2.0: 9320 MB

From 6.2.1: 11571 MB

From 6.2.2: 11487 MB

From 6.1.0: 23 MB

From 6.2.0: 28 MB

From 6.2.1: 24 MB

From 6.2.2: 24 MB

—

Hardware dependent

Firepower 2100 series

From 6.2.1: 7356 MB

From 6.2.2: 11356 MB

From 6.2.1: 7356 MB

From 6.2.2: 11356 MB

1000 MB

From 6.2.1: 15 min

From 6.2.2: 15 min

Firepower 4100/9300 chassis

From 6.1.0: 5593 MB

From 6.2.0: 5122 MB

From 6.2.2: 7498 MB

From 6.1.0: 5593 MB

From 6.2.0: 5122 MB

From 6.2.2: 7498 MB

795 MB

From 6.1.0: 10 min

From 6.2.0: 12 min

From 6.2.2: 15 min

ASA 5500-X series with FTD

From 6.1.0: 4322 MB

From 6.2.0: 6421 MB

From 6.2.2: 6450 MB

From 6.1.0: .088 MB

From 6.2.0: .092 MB

From 6.2.2: .088 MB

1000 MB

From 6.1.0: 54 min

From 6.2.0: 53 min

From 6.2.2: 50 min

FTDv

From 6.1.0: 4225 MB

From 6.2.0: 5179 MB

From 6.2.2: 6450 MB

From 6.1.0: .076 MB

From 6.2.0: .092 MB

From 6.2.2: .092 MB

1000 MB

Hardware dependent

Firepower 7000/8000 series

From 6.1.0: 5145 MB

From 6.2.0: 5732 MB

From 6.2.2: 6752 MB

From 6.1.0: 18 MB

From 6.2.0: 18 MB

From 6.2.2: 18 MB

840 MB

From 6.1.0: 29 min

From 6.2.0: 31 min

From 6.2.2: 31 min

ASA FirePOWER

From 6.1.0: 7286 MB

From 6.2.0: 7286 MB

From 6.2.2: 10748 MB

From 6.1.0: 16 MB

From 6.2.0: 16 MB

From 6.2.2: 16 MB

From 6.1.0: 1200 MB

From 6.2.0: 1200 MB

From 6.1.0: 94 min

From 6.2.0: 104 min

From 6.2.2: 96 min

NGIPSv

From 6.1.0: 4115 MB

From 6.2.0: 5505 MB

From 6.2.2: 5871 MB

From 6.1.0: 18 MB

From 6.2.0: 19 MB

From 6.2.2: 19 MB

741 MB

Hardware dependent

Version 6.2.2.5 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

5271 MB

25 MB

—

From 6.2.2: 60 min

From 6.2.2.4: 42 min

FMCv

5292 MB

33 MB

—

Hardware dependent

Firepower 2100 series

9113 MB

9113 MB

2 GB

From 6.2.2: 87 min

From 6.2.2.4: 32 min

Firepower 4100/9300 chassis

3325 MB

3325 MB

612 MB

From 6.2.2: 28 min

From 6.2.2.4: 12 min

ASA 5500-X series with FTD

3809 MB

226 MB

724 MB

From 6.2.2: 49 min

From 6.2.2.4: 25 min

FTDv

3809 MB

226 MB

724 MB

Hardware dependent

Firepower 7000/8000 series

566 MB

28 MB

419 MB

From 6.2.2: 54 min

From 6.2.2.4: 12 min

ASA FirePOWER

3714 MB

28 MB

432 MB

From 6.2.2: 215 min

From 6.2.2.4: 105 min

NGIPSv

3799 MB

24 MB

98 MB

Hardware dependent

Version 6.2.2.4 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

4435 MB

217 MB

—

From 6.2.2: 85 min

From 6.2.2.3: 42 min

FMCv

3691 MB

48 MB

—

Hardware dependent

Firepower 2100 series

6965 MB

6965 MB

1 GB

From 6.2.2: 58 min

From 6.2.2.3: 34 min

Firepower 4100/9300 chassis

1676 MB

1676 MB

339 MB

From 6.2.2: 24 min

From 6.2.2.3: 13 min

ASA 5500-X series with FTD

1695 MB

225 MB

427 MB

From 6.2.2: 142 min

From 6.2.2.3: 68 min

FTDv

1695 MB

225 MB

427 MB

Hardware dependent

Firepower 7000/8000 series

3343 MB

36 MB

414 MB

From 6.2.2: 45 min

From 6.2.2.3: 19 min

ASA FirePOWER

3192 MB

27 MB

405 MB

From 6.2.2: 182 min

From 6.2.2.3: 80 min

NGIPSv

444 MB

28 MB

94 MB

Hardware dependent

Version 6.2.2.3 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

3766.6 MB

205 MB

—

From 6.2.2: 66 min

From 6.2.2.2: 41 min

FMCv

3485 MB

17.5 MB

—

Hardware dependent

Firepower 2100 series

4486.64 MB

4486.64 MB

132 MB

From 6.2.2: 61 min

From 6.2.2.2: 36 min

Firepower 4100/9300 chassis

811.7 MB

811.7 MB

132 MB

From 6.2.2: 20 min

From 6.2.2.2: 12 min

ASA 5500-X series with FTD

1636.6 MB

125.1 MB

199 MB

From 6.2.2: 35 min

From 6.2.2.2: 20 min

FTDv

1810.7 MB

125 MB

199 MB

Hardware dependent

Firepower 7000/8000 series

2775 MB

17 MB

339 MB

From 6.2.2: 80 min

From 6.2.2.2: 42 min

ASA FirePOWER

2301.5 MB

15.69 MB

308 MB

From 6.2.2: 184 min

From 6.2.2.2: 100 min

NGIPSv

576.3 MB

17.5 MB

20 MB

Hardware dependent

Version 6.2.2.2 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

1656 MB

18 MB

—

From 6.2.2: 34 min

From 6.2.2.1: 27 min

FMCv

2356 MB

19 MB

—

Hardware dependent

Firepower 2100 series

2377 MB

2377 MB

497 MB

From 6.2.2: 41 min

From 6.2.2.1: 20 min

Firepower 4100/9300 chassis

561 MB

561 MB

41 MB

From 6.2.2: 21 min

From 6.2.2.1: 13 min

ASA 5500-X series with FTD

984 MB

122 MB

136 MB

From 6.2.2: 110 min

From 6.2.2.1: 70 min

FTDv

984 MB

122 MB

136 MB

Hardware dependent

Firepower 7000/8000 series

1706 MB

16 MB

310 MB

From 6.2.2: 56 min

From 6.2.2.1: 40 min

ASA FirePOWER

1602 MB

15 MB

190 MB

From 6.2.2: 113 min

From 6.2.2.1: 80 min

NGIPSv

170 MB

17 MB

16 MB

Hardware dependent

Version 6.2.2.1 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.2

FMC

480 MB

18 MB

—

52 min

FMCv

775 MB

30 MB

—

Hardware dependent

Firepower 2100 series

1003 MB

1003 MB

47 MB

28 min

Firepower 4100/9300 chassis

299 MB

299 MB

47 MB

35 min

ASA 5500-X series with FTD

674 MB

121 MB

69 MB

72 min

FTDv

674 MB

121 MB

69 MB

Hardware dependent

Firepower 7000/8000 series

664 MB

14 MB

61 MB

33 min

ASA FirePOWER

758 MB

15 MB

83 MB

90 min

NGIPSv

106 MB

17 MB

10 MB

Hardware dependent

Version 6.2.2 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

From 6.2.0: 6467 MB

From 6.2.1: 6916 MB

From 6.2.0: 22 MB

From 6.2.1: 21 MB

—

From 6.2.0: 52 min

From 6.2.1: 61 min

FMCv

From 6.2.0: 6987 MB

From 6.2.1: 5975 MB

From 6.2.0: 24 MB

From 6.2.1: 24 MB

—

Hardware dependent

Firepower 2100 series

5613 MB

5613 MB

925 MB

57 min

Firepower 4100/9300 chassis

4635 MB

4635 MB

743 MB

14 min

FTDv

3586 MB

.92 MB

987 MB

Hardware dependent

ASA 5500-X series with FTD

3683 MB

.16 MB

987 MB

80 min

Firepower 7000/8000 series

6745 MB

18 MB

1300 MB

27 min

ASA FirePOWER

7021 MB

16 MB

1200 MB

131 min

NGIPSv

7261 MB

18 MB

1300 MB

Hardware dependent

Version 6.2.0.6 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

8547 MB

104 MB

—

From 6.2.0: 97 min

From 6.2.0.5: 36 min

FMCv

8543 MB

30 MB

—

Hardware dependent

Firepower 4100/9300 chassis

4085 MB

4085 MB

789 MB

From 6.2.0: 23 min

From 6.2.0.5: 13 min

FTDv

4526 MB

226 MB

918 MB

Hardware dependent

ASA 5500-X series with FTD

4960 MB

227 MB

918 MB

From 6.2.0: 56 min

From 6.2.0.5:27 min

Firepower 7000/8000 series

7464 MB

29 MB

944 MB

From 6.2.0: 60 min

From 6.2.0.5: 24 min

ASA FirePOWER

7191 MB

28 MB

878 MB

From 6.2.0: 75 min

From 6.2.0.5: 49 min

NGIPSv

1658 MB

29 MB

284 MB

Hardware dependent

Version 6.2.0.5 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

6009 MB

180 MB

—

From 6.2.0: 72 min

From 6.2.0.4: 34 min

FMCv

6943 MB

20 MB

—

Hardware dependent

Firepower 4100/9300 chassis

3009 MB

3009 MB

441 MB

From 6.2.0: 28 min

From 6.2.0.4: 16 min

FTDv

2805 MB

135 MB

548 MB

Hardware dependent

ASA 5500-X series with FTD

4316 MB

135 MB

548 MB

From 6.2.0: 46 min

From 6.2.0.4: 22 min

Firepower 7000/8000 series

5806 MB

18 MB

693 MB

From 6.2.0: 51 min

From 6.2.0.4: 18 min

ASA FirePOWER

5945 MB

16 MB

703 MB

From 6.2.0: 66 min

From 6.2.0.4: 27 min

NGIPSv

1301 MB

18 MB

211 MB

Hardware dependent

Version 6.2.0.4 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

5271 MB

167 MB

—

From 6.2.0: 84 min

From 6.2.0.3: 50 min

FMCv

5346 MB

20 MB

—

Hardware dependent

Firepower 4100/9300 chassis

1828 MB

1828 MB

325 MB

From 6.2.0: 23 min

From 6.2.0.3: 12 min

ASA 5500-X series with FTD

3593 MB

134 MB

448 MB

From 6.2.0: 2 hr 28 min

From 6.2.0.3: 69 min

FTDv

275 MB

136 MB

448 MB

Hardware dependent

Firepower 7000/8000 series

4614 MB

18 MB

608 MB

From 6.2.0: 45 min

From 6.2.0.3: 17 min

ASA FirePOWER

4585 MB

16 MB

597 MB

From 6.2.0: 3 hr 34 min

From 6.2.0.3: 83 min

NGIPSv

1067 MB

18 MB

208 MB

Hardware dependent

Version 6.2.0.3 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

3352 MB

18 MB

—

From 6.2.0: 75 min

From 6.2.0.2: 37 min

FMCv

3342 MB

19 MB

—

Hardware dependent

Firepower 4100/9300 chassis

—

1355 MB

319 MB

From 6.2.0: 18 min

From 6.2.0.2: 12 min

ASA 5500-X series with FTD

131 MB

2302 MB

384 MB

From 6.2.0: 118 min

From 6.2.0.2: 76 min

FTDv

842 MB

17 MB

384 MB

Hardware dependent

Firepower 7000/8000 series

3526 MB

17 MB

554 MB

From 6.2.0: 38 min

From 6.2.0.2: 19 min

ASA FirePOWER

15 MB

3361 MB

521 MB

From 6.2.0: 3 hr

From 6.2.0.2: 97 min

NGIPSv

842 MB

17 MB

202 MB

Hardware dependent

Version 6.2.0.2 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

1665 MB

35 MB

—

From 6.2.0: 36 min

From 6.2.0.1: 30 min

FMCv

2834 MB

21 MB

—

Hardware dependent

Firepower 4100/9300 chassis

1060 MB

1060 MB

274 MB

From 6.2.0: 12 min

From 6.2.0.1: 9 min

ASA 5500-X series with FTD

1808 MB

144 MB

295 MB

From 6.2.0: 95 min

From 6.2.0.1: 59 min

FTDv

998 MB

143 MB

295 MB

Hardware dependent

Firepower 7000/8000 series

2110 MB

17 MB

458 MB

From 6.2.0: 54 min

From 6.2.0.1: 35 min

ASA FirePOWER

2014 MB

17 MB

383 MB

From 6.2.0: 40 min

From 6.2.0.1: 80 min

NGIPSv

612 MB

19 MB

195 MB

Hardware dependent

Version 6.2.0.1 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.2.0

FMC

1237 MB

50 MB

—

28 min

FMCv

1488 MB

23 MB

—

Hardware dependent

Firepower 4100/9300 chassis

524 MB

524 MB

137 MB

12 min

ASA 5500-X series with FTD

945 MB

144 MB

159 MB

62 min

FTDv

144 MB

10 MB

159 MB

Hardware dependent

Firepower 7000/8000 series

1134 MB

18 MB

186 MB

22 min

ASA FirePOWER

97 MB

17 MB

206 MB

69 min

NGIPSv

721 MB

19 MB

98 MB

Hardware dependent

Version 6.2.0 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

10207 MB

17 MB

—

57 min

FMCv

10207 MB

17 MB

—

Hardware dependent

Firepower 4100/9300 chassis

5234 MB

5234 MB

734 MB

21 min

ASA 5500-X series with FTD

5213 MB

.096 MB

938 MB

83 min

FTDv

5663 MB

1 MB

936 MB

Hardware dependent

Firepower 7000/8000 series

6129 MB

17 MB

1200 MB

27 min

ASA FirePOWER

6619 MB

16 MB

1100 MB

165 min

NGIPSv

7028 MB

18 MB

1300 MB

Hardware dependent

Version 6.1.0.7 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

1941 MB

187 MB

—

From 6.1.0: 111 min

From 6.1.0.5: 41 min

FMCv

12435 MB

218 MB

—

Hardware dependent

Firepower 4100/9300 chassis

9881 MB

9881 MB

1400 MB

From 6.1.0: 43 min

From 6.1.0.5: 13 min

ASA 5500-X series with FTD

8846 MB

1033 MB

1480 MB

From 6.1.0: 251 min

From 6.1.0.5: 75 min

FTDv

1339 MB

185 MB

1480 MB

Hardware dependent

Firepower 7000/8000 series

5896 MB

33 MB

159 MB

From 6.1.0: 39 min

From 6.1.0.5: 25 min

ASA FirePOWER

13061 MB

45 MB

1390 MB

From 6.1.0: 156 min

From 6.1.0.5: 28 min

NGIPSv

5477 MB

185 MB

717 MB

Hardware dependent

Version 6.1.0.6 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

10503 MB

215 MB

—

From 6.1.0: 66 min

From 6.1.0.5: 27 min

FMCv

1367 MB

196 MB

—

Hardware dependent

Firepower 4100/9300 chassis

8140 MB

8140 MB

1126 MB

From 6.1.0: 270 min

From 6.1.0.5: 75 min

ASA 5500-X series with FTD

8540 MB

1034 MB

1229 MB

From 6.1.0: 40 min

From 6.1.0.5: 15 min

FTDv

7414 MB

1033 MB

1229 MB

Hardware dependent

Firepower 7000/8000 series

12725 MB

237 MB

1434 MB

From 6.1.0: 136 min

From 6.1.0.5: 34 min

ASA FirePOWER

11189 MB

31 MB

1131 MB

From 6.1.0: 257 min

From 6.1.0.5: 60 min

NGIPSv

4606 MB

196 MB

644 MB

Hardware dependent

Version 6.1.0.5 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

7673 MB

46 MB

—

From 6.1.0: 56 min

From 6.1.0.4: 28 min

FMCv

10790 MB

216 MB

—

Hardware dependent

Firepower 4100/9300 chassis

7680 MB

7680 MB

1060 MB

From 6.1.0: 30 min

From 6.1.0.4: 10 min

ASA 5500-X series with FTD

7952 MB

137 MB

1141 MB

From 6.1.0: 186 min

From 6.1.0.4: 70 min

FTDv

7453 MB

1140 MB

1141 MB

Hardware dependent

Firepower 7000/8000 series

11877 MB

259 MB

1403 MB

From 6.1.0: 115 min

From 6.1.0.4: 25 min

ASA FirePOWER

8955 MB

34 MB

1217 MB

From 6.1.0: 208 min

From 6.1.0.4: 105 min

NGIPSv

4298 MB

215 MB

640 MB

Hardware dependent

Version 6.1.0.4 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

6739516 MB

218808 MB

—

From 6.1.0: 65 min

From 6.1.0.3: 30 min

FMCv

675984 MB

200748 MB

—

Hardware dependent

Firepower 4100/9300 chassis

6010092 MB

6010092 MB

1020 MB

From 6.1.0: 26 min

From 6.1.0.3: 10 min

ASA 5500-X series with FTD

6155828 MB

1058968 MB

1100 MB

From 6.1.0: 49 min

From 6.1.0.3: 20 min

FTDv

1059632 MB

1059632 MB

1100 MB

Hardware dependent

Firepower 7000/8000 series

8713068 MB

240940 MB

1200 MB

From 6.1.0: 48 min

From 6.1.0.3: 17 min

ASA FirePOWER

7442808 MB

31740 MB

1100 MB

From 6.1.0: 63 min

From 6.1.0.3: 45 min

NGIPSv

3367536 MB

20120 MB

636 MB

Hardware dependent

Version 6.1.0.3 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

5537816 MB

218676 MB

—

From 6.1.0: 46 min

From 6.1.0.2: 35 min

FMCv

6611148 MB

200904 MB

—

Hardware dependent

Firepower 4100/9300 chassis

5014020 MB

5014020 MB

929 MB

From 6.1.0: 22 min

From 6.1.0.2: 13 min

ASA 5500-X series with FTD

1057776 MB

1057776 MB

1000 MB

From 6.1.0: 40 min

From 6.1.0.2: 23 min

FTDv

1059932 MB

1059932 MB

1000 MB

Hardware dependent

Firepower 7000/8000 series

7357340 MB

228728 MB

1100 MB

From 6.1.0: 43 min

From 6.1.0.2: 25 min

ASA FirePOWER

4782384 MB

31792 MB

1000 MB

From 6.1.0: 160 min

From 6.1.0.2: 80 min

NGIPSv

2710540 MB

200896 MB

635 MB

Hardware dependent

Version 6.1.0.2 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

3872 MB

235 MB

—

From 6.1.0: 44 min

From 6.1.0.1: 22 min

FMCv

3871 MB

219 MB

—

Hardware dependent

Firepower 4100/9300 chassis

4046 MB

4046 MB

886 MB

From 6.1.0: 20 min

From 6.1.0.1: 14 min

ASA 5500-X series with FTD

2291 MB

96 MB

918 MB

From 6.1.0: 74 min

From 6.1.0.1: 106 min

FTDv

2797 MB

1137 MB

918 MB

Hardware dependent

Firepower 7000/8000 series

4130 MB

260 MB

965 MB

From 6.1.0: 62 min

From 6.1.0.1: 24 min

ASA FirePOWER

4549 MB

40 MB

816 MB

From 6.1.0: 139 min

From 6.1.0.1: 34 min

NGIPSv

2710540 MB

200896 MB

635 MB

Hardware dependent

Version 6.1.0.1 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.1.0

FMC

1893 MB

140 MB

—

23 min

FMCv

2144 MB

207 MB

—

Hardware dependent

Firepower 4100 series

2580 MB

580 MB

600 MB

15 min

Firepower 9300

1877 MB

1877 MB

600 MB

20 min

ASA 5500-X series with FTD

1377 MB

846 MB

600 MB

10 min

FTDv

1377 MB

846 MB

600 MB

Hardware dependent

Firepower 7000/8000 series

2094 MB

156 MB

513 MB

47 min

ASA FirePOWER

1728 MB

34 MB

433 MB

76 min

NGIPSv

793 MB

130 MB

295 MB

Hardware dependent

Version 6.1.0 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

10722 MB

18 MB

—

47 min

FMCv

10128 MB

17 MB

—

Hardware dependent

ASA 5500-X series with FTD

5213 MB

.096 MB

914 MB

21 min

FTDv

5403 MB

.096 MB

914 MB

Hardware dependent

Firepower 7000/8000 series

7108 MB

61 MB

1740 MB

39 min

ASA FirePOWER

8392 MB

47 MB

1300 MB

59 min

NGIPSv

6368 MB

54 MB

1229 MB

Hardware dependent

Version 6.0.1.4 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

3428 MB

201 MB

—

From 6.0.0: 92 min

From 6.0.1.3: 39 min

FMCv

3108 MB

95 MB

—

Hardware dependent

Firepower 4100 series

5237 MB

5237 MB

1000 MB

From 6.0.0: 30 min

From 6.0.1.3: 18 min

Firepower 9300

1360 MB

5434 MB

1000 MB

From 6.0.0: 26 min

From 6.0.1.3: 14 min

ASA 5500-X series with FTD

3416 MB

1017 MB

1000 MB

From 6.0.0: 26 min

From 6.0.1.3: 14 min

FTDv

3619 MB

1020 MB

1000 MB

Hardware dependent

Firepower 7000/8000 series

7891 MB

222 MB

1270 MB

From 6.0.0: 47 min

From 6.0.1.3: 23 min

ASA FirePOWER

6049 MB

45 MB

990 MB

From 6.0.0: 95 min

From 6.0.1.3: 43 min

NGIPSv

2916 MB

192 MB

990 MB

Hardware dependent

Version 6.0.1.3 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

2419 MB

110 MB

—

58 min

FMCv

2419 MB

101 MB

—

Hardware dependent

Firepower 4100/9300 chassis

2781 MB

2781 MB

473 MB

22 min

ASA 5500-X series with FTD

2641 MB

813 MB

473 MB

24 min

FTDv

2651 MB

813 MB

473 MB

Hardware dependent

Firepower 7000/8000 series

4757 MB

125 MB

926 MB

55 min

ASA FirePOWER

3883 MB

58 MB

685 MB

184 min

NGIPSv

1695 MB

107 MB

430 MB

Hardware dependent

Version 6.0.1.2 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

272 MB

54 MB

—

7 min

FMCv

368 MB

54 MB

—

Hardware dependent

Firepower 4100/9300 chassis

2101 MB

56 MB

302 MB

16 min

ASA 5500-X series with FTD

740 MB

807 MB

302 MB

13 min

FTDv

2101 MB

56 MB

302 MB

Hardware dependent

Firepower 7000/8000 series

3190 MB

63 MB

412 MB

17 min

ASA FirePOWER

2027 MB

54 MB

577 MB

99 min

NGIPSv

602 MB

56 MB

243 MB

Hardware dependent

Version 6.0.1.1 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.0.1

FMC

14 MB

54 MB

—

23 min

FMCv

14 MB

54 MB

—

Hardware dependent

Firepower 4100/9300 chassis

54 MB

54 MB

2 MB

6 min

ASA 5500-X series with FTD

54 MB

54 MB

2 MB

7 min

FTDv

14 MB

54 MB

2 MB

Hardware dependent

Firepower 7000/8000 series

944 MB

61 MB

166 MB

39 min

ASA FirePOWER

824 MB

54 MB

84 MB

46 min

NGIPSv

54 MB

56 MB

1 MB

Hardware dependent

Version 6.0.1 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

8959 MB

18 MB

—

66 min

FMCv

—

—

—

—

Firepower 7000/8000 series

3683 MB

227 MB

614 MB

30 min

ASA FirePOWER

2966 MB

54 MB

429 MB

91 min

NGIPSv

2090 MB

196 MB

3050 MB

Hardware dependent

Version 6.0.0.1 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time from 6.0

FMC

976 MB

120 MB

—

25 min

FMCv

969 MB

119 MB

—

Hardware dependent

Firepower 7000/8000 series

1568 MB

134 MB

273 MB

25 min

ASA FirePOWER

1101 MB

56 MB

181 MB

56 min

NGIPSv

929 MB

26 MB

174 MB

Hardware dependent

Version 6.0 Time and Disk Space

Platform

Space on /Volume

Space on /

Space on FMC

Time

FMC

8022 MB

16 MB

—

58 min

FMCv

8022 MB

16 MB

—

Hardware dependent

Firepower 7000/8000 series

6496 MB

16 MB

1200 MB

94 min

ASA FirePOWER

7644 MB

32 MB

1200 MB

41 min

NGIPSv

6046 MB

17 MB

102000 MB

Hardware dependent

Chapter 15. Traffic Flow, Inspection, and Device Behavior

You must identify potential interruptions in traffic flow and inspection during the upgrade. This can occur:

- When a device is rebooted.

- When you upgrade the operating system or virtual hosting environment on a device.

- When you upgrade the Firepower software on a device, or uninstall a patch.

- When you deploy configuration changes as part of the upgrade or uninstall process (Snort process restarts).

Device type, deployment type (standalone, high availability, clustered), and interface configurations (passive, IPS, firewall, and so on) determine the nature of the interruptions. We strongly recommend performing any upgrade or uninstall in a maintenance window or at a time when any interruption will have the least impact on your deployment.

- FTD Upgrade Behavior: Firepower 4100/9300 Chassis

- FTD Upgrade Behavior: Other Devices

- Firepower 7000/8000 Series Upgrade Behavior

- ASA FirePOWER Upgrade Behavior

- NGIPSv Upgrade Behavior

FTD Upgrade Behavior: Firepower 4100/9300 Chassis

This section describes device and traffic behavior when you upgrade a Firepower 4100/9300 chassis with FTD.

Firepower 4100/9300 Chassis: FXOS Upgrade

Upgrade FXOS on each chassis independently, even if you have inter-chassis clustering or high availability pairs configured. How you perform the upgrade determines how your devices handle traffic during the FXOS upgrade.

Traffic Behavior During FXOS Upgrade

Deployment

Method

Traffic Behavior

Standalone

—

Dropped.

High availability

Best Practice: Update FXOS on the standby, switch active peers, upgrade the new standby.

Unaffected.

Upgrade FXOS on the active peer before the standby is finished upgrading.

Dropped until one peer is online.

Inter-chassis cluster (6.2+)

Best Practice: Upgrade one chassis at a time so at least one module is always online.

Unaffected.

Upgrade chassis at the same time, so all modules are down at some point.

Dropped until at least one module is online.

Intra-chassis cluster (Firepower 9300 only)

Hardware bypass enabled: Bypass: Standby or Bypass‑Force. (6.1+)

Passed without inspection.

Hardware bypass disabled: Bypass: Disabled. (6.1+)

Dropped until at least one module is online.

No hardware bypass module.

Dropped until at least one module is online.

Standalone FTD Device: Firepower Software Upgrade

Firepower devices/security modules operate in maintenance mode while they upgrade. Entering maintenance mode at the beginning of the upgrade causes a 2-3 second interruption in traffic inspection. Interface configurations determine how a standalone device handles traffic both then and during the upgrade.

Traffic Behavior During Firepower Software Upgrade: Standalone FTD Device

Interface Configuration

Traffic Behavior

Firewall interfaces

Routed or switched including EtherChannel, redundant, subinterfaces.

Switched interfaces are also known as bridge group or transparent interfaces.

Dropped.

IPS-only interfaces

Inline set, hardware bypass force-enabled: Bypass: Force (6.1+).

Passed without inspection until you either disable hardware bypass, or set it back to standby mode.

Inline set, hardware bypass standby mode: Bypass: Standby (6.1+).

Dropped during the upgrade, while the device is in maintenance mode. Then, passed without inspection while the device completes its post-upgrade reboot.

Inline set, hardware bypass disabled: Bypass: Disabled (6.1+).

Dropped.

Inline set, no hardware bypass module.

Dropped.

Inline set, tap mode.

Egress packet immediately, copy not inspected.

Passive, ERSPAN passive.

Uninterrupted, not inspected.

High Availability Pairs: Firepower Software Upgrade

You should not experience interruptions in traffic flow or inspection while upgrading the Firepower software on devices in high availability pairs. To ensure continuity of operations, they upgrade one at a time. Devices operate in maintenance mode while they upgrade.

The standby device upgrades first. The devices switch roles, then the new standby upgrades. When the upgrade completes, the devices' roles remain switched. If you want to preserve the active/standby roles, manually switch the roles before you upgrade. That way, the upgrade process switches them back.

Clusters: Firepower Software Upgrade

You should not experience interruptions in traffic flow or inspection while upgrading the Firepower software on devices in Firepower Threat Defense clusters. To ensure continuity of operations, they upgrade one at a time. The data security module or modules upgrade first, then the control module. Security modules operate in maintenance mode while they upgrade.

During the control security module upgrade, although traffic inspection and handling continues normally, the system stops logging events. Events for traffic processed during the logging downtime appear with out-of-sync timestamps after the upgrade is completed. However, if the logging downtime is significant, the system may prune the oldest events before they can be logged.

Note

Upgrading an inter-chassis cluster from Version 6.2.0, 6.2.0.1, or 6.2.0.2 causes a 2-3 second traffic interruption in traffic inspection when each module is removed from the cluster.

High Availability and Clustering Hitless Upgrade Requirements

Performing hitless upgrades have the following additional requirements.

Flow Offload: Due to bug fixes in the flow offload feature, some combinations of FXOS and FTD do not support flow offload; see the Cisco Firepower Compatibility Guide. To perform a hitless upgrade in a high availability or clustered deployment, you must make sure you are always running a compatible combination.

If your upgrade path includes upgrading FXOS to 2.2.2.91, 2.3.1.130, or later (including FXOS 2.4.1.x, 2.6.1.x, and so on) use this path:

1. Upgrade FTD to 6.2.2.2 or later.

2. Upgrade FXOS to 2.2.2.91, 2.3.1.130, or later.

3. Upgrade FTD to your final version.

For example, if you are running FXOS 2.2.2.17/FTD 6.2.2.0, and you want to upgrade to FXOS 2.6.1/FTD 6.4.0, then you can:

1. Upgrade FTD to 6.2.2.5.

2. Upgrade FXOS to 2.6.1.

3. Upgrade FTD to 6.4.0.

Version 6.1.0 Upgrades: Performing a hitless upgrade of an FTD high availability pair to Version 6.1.0 requires a preinstallation package. For more information, see Firepower System Release Notes Version 6.1.0 Preinstallation Package.

Traffic Behavior During Deployment

You deploy configurations multiple times during the upgrade process. Snort typically restarts during the first deployment immediately after the upgrade. It does not restart during other deployments unless, before deploying, you modify specific policy or device configurations. For more information, see Configurations that Restart the Snort Process when Deployed or Activated in the Firepower Management Center Configuration Guide.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, restarting the Snort process interrupts traffic inspection on all Firepower devices, including those configured for HA/scalability. Interface configurations determine whether traffic drops or passes without inspection during the interruption.

Traffic Behavior During FTD Deployment

Interface Configuration

Traffic Behavior

Firewall interfaces

Routed or switched including EtherChannel, redundant, subinterfaces.

Switched interfaces are also known as bridge group or transparent interfaces.

Dropped.

IPS-only interfaces

Inline set, Failsafe enabled or disabled (6.0.1–6.1).

Passed without inspection.

A few packets might drop if Failsafe is disabled and Snort is busy but not down.

Inline set, Snort Fail Open: Down: disabled (6.2+).

Dropped.

Inline set, Snort Fail Open: Down: enabled (6.2+).

Passed without inspection.

Inline set, tap mode.

Egress packet immediately, copy not inspected.

Passive, ERSPAN passive.

Uninterrupted, not inspected.

FTD Upgrade Behavior: Other Devices

This section describes device and traffic behavior when you upgrade Firepower Threat Defense on Firepower 1000/2100 series, ASA 5500-X series, ISA 3000, and FTDv.

Standalone FTD Device: Firepower Software Upgrade

Firepower devices operate in maintenance mode while they upgrade. Entering maintenance mode at the beginning of the upgrade causes a 2-3 second interruption in traffic inspection. Interface configurations determine how a standalone device handles traffic both then and during the upgrade.

Traffic Behavior During Firepower Software Upgrade: Standalone FTD Device

Interface Configuration

Traffic Behavior

Firewall interfaces

Routed or switched including EtherChannel, redundant, subinterfaces.

Switched interfaces are also known as bridge group or transparent interfaces.

Dropped.

IPS-only interfaces

Inline set, hardware bypass force-enabled: Bypass: Force (Firepower 2100 series, 6.3+).

Passed without inspection until you either disable hardware bypass, or set it back to standby mode.

Inline set, hardware bypass standby mode: Bypass: Standby (Firepower 2100 series, 6.3+).

Dropped during the upgrade, while the device is in maintenance mode. Then, passed without inspection while the device completes its post-upgrade reboot.

Inline set, hardware bypass disabled: Bypass: Disabled (Firepower 2100 series, 6.3+).

Dropped.

Inline set, no hardware bypass module.

Dropped.

Inline set, tap mode.

Egress packet immediately, copy not inspected.

Passive, ERSPAN passive.

Uninterrupted, not inspected.

High Availability Pairs: Firepower Software Upgrade

You should not experience interruptions in traffic flow or inspection while upgrading the Firepower software on devices in high availability pairs. To ensure continuity of operations, they upgrade one at a time. Devices operate in maintenance mode while they upgrade.

The standby device upgrades first. The devices switch roles, then the new standby upgrades. When the upgrade completes, the devices' roles remain switched. If you want to preserve the active/standby roles, manually switch the roles before you upgrade. That way, the upgrade process switches them back.

Traffic Behavior During Deployment

You deploy configurations multiple times during the upgrade process. Snort typically restarts during the first deployment immediately after the upgrade. It does not restart during other deployments unless, before deploying, you modify specific policy or device configurations. For more information, see Configurations that Restart the Snort Process when Deployed or Activated in the Firepower Management Center Configuration Guide.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, restarting the Snort process interrupts traffic inspection on all Firepower devices, including those configured for HA/scalability. Interface configurations determine whether traffic drops or passes without inspection during the interruption.

Traffic Behavior During FTD Deployment

Interface Configuration

Traffic Behavior

Firewall interfaces

Routed or switched including EtherChannel, redundant, subinterfaces.

Switched interfaces are also known as bridge group or transparent interfaces.

Dropped.

IPS-only interfaces

Inline set, Failsafe enabled or disabled (6.0.1–6.1).

Passed without inspection.

A few packets might drop if Failsafe is disabled and Snort is busy but not down.

Inline set, Snort Fail Open: Down: disabled (6.2+).

Dropped.

Inline set, Snort Fail Open: Down: enabled (6.2+).

Passed without inspection.

Inline set, tap mode.

Egress packet immediately, copy not inspected.

Passive, ERSPAN passive.

Uninterrupted, not inspected.

Firepower 7000/8000 Series Upgrade Behavior

The following sections describe device and traffic behavior when you upgrade Firepower 7000/8000 series devices.

Standalone 7000/8000 Series: Firepower Software Upgrade

Interface configurations determine how a standalone device handles traffic during the upgrade.

Traffic Behavior During Upgrade: Standalone 7000/8000 Series

Interface Configuration

Traffic Behavior

Inline, hardware bypass enabled (Bypass Mode: Bypass)

Passed without inspection, although traffic is interrupted briefly at two points:

- At the beginning of the upgrade process as link goes down and up (flaps) and the network card switches into hardware bypass.

- After the upgrade finishes as link flaps and the network card switches out of bypass. Inspection resumes after the endpoints reconnect and reestablish link with the device interfaces.

Inline, no hardware bypass module,or hardware bypass disabled (Bypass Mode: Non‑Bypass)

Dropped

Inline, tap mode

Egress packet immediately, copy not inspected

Passive

Uninterrupted, not inspected

Routed, switched

Dropped

7000/8000 Series High Availability Pairs: Firepower Software Upgrade

You should not experience interruptions in traffic flow or inspection while upgrading devices (or device stacks) in high availability pairs. To ensure continuity of operations, they upgrade one at a time. Devices operate in maintenance mode while they upgrade.

Which peer upgrades first depends on your deployment:

- Routed or switched: Standby upgrades first. The devices switch roles, then the new standby upgrades. When the upgrade completes, the devices' roles remain switched. If you want to preserve the active/standby roles, manually switch the roles before you upgrade. That way, the upgrade process switches them back.

- Access control only: Active upgrades first. When the upgrade completes, the active and standby maintain their old roles.

8000 Series Stacks: Firepower Software Upgrade

In an 8000 series stack, devices upgrade simultaneously. Until the primary device completes its upgrade and the stack resumes operation, traffic is affected as if the stack were a standalone device. Until all devices complete the upgrade, the stack operates in a limited, mixed-version state.

Traffic Behavior During Deployment

You deploy configurations multiple times during the upgrade process. Snort typically restarts during the first deployment immediately after the upgrade. It does not restart during other deployments unless, before deploying, you modify specific policy or device configurations. For more information, see Configurations that Restart the Snort Process when Deployed or Activated in the Firepower Management Center Configuration Guide.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, restarting the Snort process interrupts traffic inspection on all Firepower devices, including those configured for HA/scalability. Interface configurations determine whether traffic drops or passes without inspection during the interruption.

Traffic Behavior During Deployment: 7000/8000 Series

Interface Configuration

Traffic Behavior

Inline, Failsafe enabled or disabled

Passed without inspection

A few packets might drop if Failsafe is disabled and Snort is busy but not down.

Inline, tap mode

Egress packet immediately, copy bypasses Snort

Passive

Uninterrupted, not inspected

Routed, switched

Dropped

ASA FirePOWER Upgrade Behavior

Your ASA service policies for redirecting traffic to the ASA FirePOWER module determine how the module handles traffic during the Firepower software upgrade, including when you deploy certain configurations that restart the Snort process.

Traffic Behavior During ASA FirePOWER Upgrade

Traffic Redirection Policy

Traffic Behavior

Fail open (sfr fail-open )

Passed without inspection

Fail closed (sfr fail-close )

Dropped

Monitor only (sfr {fail-close}|{fail-open} monitor-only )

Egress packet immediately, copy not inspected

Traffic Behavior During ASA FirePOWER Deployment

Traffic behavior while the Snort process restarts is the same as when you upgrade the ASA FirePOWER module.

You deploy configurations multiple times during the upgrade process. Snort typically restarts during the first deployment immediately after the upgrade. It does not restart during other deployments unless, before deploying, you modify specific policy or device configurations. For more information, see Configurations that Restart the Snort Process when Deployed or Activated in the Firepower Management Center Configuration Guide.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, restarting the Snort process interrupts traffic inspection. Your service policies determine whether traffic drops or passes without inspection during the interruption.

NGIPSv Upgrade Behavior

This section describes device and traffic behavior when you upgrade NGIPSv.

Firepower Software Upgrade

Interface configurations determine how NGIPSv handles traffic during the upgrade.

Traffic Behavior During NGIPSv Upgrade

Interface Configuration

Traffic Behavior

Inline

Dropped

Inline, tap mode

Egress packet immediately, copy not inspected

Passive

Uninterrupted, not inspected

Traffic Behavior During Deployment

You deploy configurations multiple times during the upgrade process. Snort typically restarts during the first deployment immediately after the upgrade. It does not restart during other deployments unless, before deploying, you modify specific policy or device configurations. For more information, see Configurations that Restart the Snort Process when Deployed or Activated in the Firepower Management Center Configuration Guide.

When you deploy, resource demands may result in a small number of packets dropping without inspection. Additionally, restarting the Snort process interrupts traffic inspection. Interface configurations determine whether traffic drops or passes without inspection during the interruption.

Traffic Behavior During NGIPSv Deployment

Interface Configuration

Traffic Behavior

Inline, Failsafe enabled or disabled

Passed without inspection

A few packets might drop if Failsafe is disabled and Snort is busy but not down.

Inline, tap mode

Egress packet immediately, copy bypasses Snort

Passive

Uninterrupted, not inspected