REMOTE UPGRADE OF PIX

I have a couple of PIX upgrade questions.  I was planning to move our sites to the 6.3.3.124 image on all PIXes.  

1)  On my primary site, I have a failover pair.  Are there any tricks on upgrading process, or do I just upgrade the primary and then the secondary?

2)  I have a remote site with no server and only a perodic laptop.  Can I remotely upgrade the PIX over a WAN link?  How do I connect to TFTP Server?

Thanks for any help.

Steve
LVL 8
smeekAsked:
Who is Participating?
 
visioneerCommented:
Tim's link takes care of question 1.

Question 2 is no, I don't believe you can upgrade from the WAN link, and besides you probably shouldn't try it in case you lose your WAN connectivity during the upgrade! :-O
0
Increase Security & Decrease Risk with NSPM Tools

Analyst firm, Enterprise Management Associates (EMA) reveals significant benefits to enterprises when using Network Security Policy Management (NSPM) solutions, while organizations without, experienced issues including non standard security policies and failed cloud migrations

 
Tim HolmanCommented:
If you can get a console, telnet or ssh connection to the PIX, then I believe you can initiate the copy tftp flash command, so as long as your tftp server's up, and the image correct (double check it's md5 hash to ensure it's not corrupted), then away you go !!
0
 
smeekAuthor Commented:
I could SSH to it.  

How about open the PIX so that I can point the TFTP to a public IP with my TFTP server and copy the image across the Internet.

Ideas?

Steve
0
 
Tim HolmanCommented:
Yes - that's exactly how I'd do it.  By default, you'll be able to access anything on the Internet from the PIX itself, but you may need to setup TFTP rules at the other end (ie if you have a firewall protecting your TFTP server).
0
 
smeekAuthor Commented:
I got it.  I allowed port 69 through to a static mapping I created for my laptop and it worked like a charm.  I just wish the previous IT person had the foresight to setup SSH statements for the branches to main site.  Is there a way to connect through the VPN to change the remote PIXs SSH.

Steve  
0
 
Tim HolmanCommented:
If you have telnet access, then yes, you can generate SSH keys on the PIX and away you go...

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e71.shtml#sshinout
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.