We help IT Professionals succeed at work.

Check out our new AWS podcast with Certified Expert, Phil Phillips! Listen to "How to Execute a Seamless AWS Migration" on EE or on your favorite podcast platform. Listen Now

x

REMOTE UPGRADE OF PIX

smeek
smeek asked
on
Medium Priority
381 Views
Last Modified: 2013-11-16
I have a couple of PIX upgrade questions.  I was planning to move our sites to the 6.3.3.124 image on all PIXes.  

1)  On my primary site, I have a failover pair.  Are there any tricks on upgrading process, or do I just upgrade the primary and then the secondary?

2)  I have a remote site with no server and only a perodic laptop.  Can I remotely upgrade the PIX over a WAN link?  How do I connect to TFTP Server?

Thanks for any help.

Steve
Comment
Watch Question

CERTIFIED EXPERT
Commented:
Unlock this solution with a free trial preview.
(No credit card required)
Get Preview
CERTIFIED EXPERT

Commented:
Tim's link takes care of question 1.

Question 2 is no, I don't believe you can upgrade from the WAN link, and besides you probably shouldn't try it in case you lose your WAN connectivity during the upgrade! :-O
CERTIFIED EXPERT

Commented:
If you can get a console, telnet or ssh connection to the PIX, then I believe you can initiate the copy tftp flash command, so as long as your tftp server's up, and the image correct (double check it's md5 hash to ensure it's not corrupted), then away you go !!

Author

Commented:
I could SSH to it.  

How about open the PIX so that I can point the TFTP to a public IP with my TFTP server and copy the image across the Internet.

Ideas?

Steve
CERTIFIED EXPERT

Commented:
Yes - that's exactly how I'd do it.  By default, you'll be able to access anything on the Internet from the PIX itself, but you may need to setup TFTP rules at the other end (ie if you have a firewall protecting your TFTP server).

Author

Commented:
I got it.  I allowed port 69 through to a static mapping I created for my laptop and it worked like a charm.  I just wish the previous IT person had the foresight to setup SSH statements for the branches to main site.  Is there a way to connect through the VPN to change the remote PIXs SSH.

Steve  
CERTIFIED EXPERT

Commented:
If you have telnet access, then yes, you can generate SSH keys on the PIX and away you go...

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e71.shtml#sshinout
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a free trial preview!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.