Solved

CISCO ASA 5510 ASA/ASDM upgrade

Posted on 2010-09-13
21
2,528 Views
Last Modified: 2012-05-10
I have a CISCO ASA 5510 with ASA version 7.0.4 and ASDM version 5.0.4. I need to upgrade this to ASA Version 8 and ASDM Version 6.

I know I am not supposed to upgrade directly to those versions. But do I have to upgrade to each available upgrade first before getting to versions 8 and 6 respectively?

Meaning do I have to first go to ASA 7.0.5 and then 7.0.6 and so on, before getting to 7.1.1 or can I go to 7.1.1 directly from 7.0.4 and then to 7.2.1 etc..?

The same for ASDM.

Thanks.
0
Comment
Question by:cfgchiran
  • 7
  • 5
  • 4
  • +1
21 Comments
 
LVL 16

Expert Comment

by:InteraX
Comment Utility
You have to upgrade between the minor version., so from 7.0.4, you go to any 7.1 then any 7.2 then any 8.0.

Once you have done that you can upgrade ASDM straight to 6.3
0
 
LVL 4

Assisted Solution

by:nuttytech
nuttytech earned 425 total points
Comment Utility
From Cisco's website:

ASDM does not work if you upgrade (or downgrade) the security appliance software from 7.0 to 7.2 directly or upgrade (or downgrade) the ASDM software from 5.0 to 5.2 directly. You need to do it in incremental order.

Example: In order to perform the ASDM software upgrade from 5.0 to 5.2, first upgrade from 5.0 to 5.1 and then upgrade from 5.1 to 5.2. Likewise, for the security appliance, first upgrade from 7.0 to 7.1 and then upgrade from 7.1 to 7.2.
0
 
LVL 1

Author Comment

by:cfgchiran
Comment Utility
Thanks for the prompt response. So If I upgrade 7.0.4 to 7.1 and 7.2 all the way to 8.0, do I not need to upgrade ASDM to 5.1 and 5.2 etc...before getting to 6.3?

Does ASDM 5.0.4 read ASA 8.0?

Thanks.
0
 
LVL 1

Author Comment

by:cfgchiran
Comment Utility
Nuttytech...based on what you're saying I would need to upgrade ASDM to each version as well, which is what I thought I had read.

I guess my main quesiton is whether or not I need to do all the inbetween upgrades such as 7.0.4 to 7.0.5 and 7.0.6 etc...before getting to 7.1.1. Can I go straight from 7.0.4 to 7.1.1 and then 7.2.1 and 8.0.5?
0
 
LVL 4

Expert Comment

by:nuttytech
Comment Utility
This is the link to Cisco which walks you through the entire process.
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008067e9f9.shtml

 I did not see anything that states that you can directly upgrade the ASDM. It does note however that ASDM 6.x is supported only on ASA software image 8.x and later.
0
 
LVL 4

Accepted Solution

by:
nuttytech earned 425 total points
Comment Utility
Yes, 7.0 to 7.1 and so on.....
0
 
LVL 1

Author Comment

by:cfgchiran
Comment Utility
Ok - thanks. I will try this and give points once I have confirmed this works.
0
 
LVL 16

Assisted Solution

by:InteraX
InteraX earned 75 total points
Comment Utility
You should not need to upgrade ADSM to each of the inbetween version as long as you do not plan on using it during the upgrade process.

ASDM is only a based management tool that reads the configs and enables you to configure the device via a web front end. You can run the devices without ASDM installed, If you want, you can delete the ASDM before starting the upgrade process, then load the new one once the OS upgrade has been completed.
0
 
LVL 5

Expert Comment

by:shirkan
Comment Utility
on another note, dont go all the way the the newst 8.3, as it has other memory requirements and major config changes.
Always read the readme for the image versions, they are on Cisco's website.

Backup your config before you do that and i mean by using shell and tftp

so even if you run into problems, you can always go back the same way
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 4

Expert Comment

by:nuttytech
Comment Utility
Comments posted were directly from Cisco.com and have been used, by myself and countless others, with NO problems. There are always different ways to do things and the shortest is not always the best for people without total experience working with Cisco's IOS. Telling folks what to do and how to do it are two totally differnent things. Remember, we are trying to help people with less experience than ourselves and comments like yours Shirkan are just totally uncalled for and you have been reported for abuse.
0
 
LVL 16

Expert Comment

by:InteraX
Comment Utility
Shirkan,

Taken from the 8.2.x release notes at http://www.cisco.com/en/US/docs/security/asa/asa82/release/notes/asarn82.pdf

Upgrading Between Major Releases
To ensure that your configuration updates correctly, you must upgrade to each major release in turn.
Therefore, to upgrade from Version 7.0 to Version 8.2, first upgrade from 7.0 to 7.1, then from 7.1 to 7.2,
and finally from Version 7.2 to Version 8.2 (8.1 was only available on the ASA 5580).

Your comments do not match Cisco's recommended upgrade procedure.
0
 
LVL 5

Expert Comment

by:shirkan
Comment Utility
Sorry, forgot about the old 7.0 version, yes u r right till u get to 7.2 its a bit of a hassle.
Wasnt thinking bout that since 7.0 is like barely out of beta and thats how many years go ???
0
 
LVL 5

Expert Comment

by:shirkan
Comment Utility
Sorry for sounding a bit harsh, had a bad moment that minute cause some of my coworkers just messed up a big router configuration and client was on my butt chewing it
You can still go all the way directly, just gotta fix the incompatible parts afterwards manually
if that is not possible due to inexperience with the ASA, yes, going through the Cisco recommended steps is the better way
0
 
LVL 1

Author Comment

by:cfgchiran
Comment Utility
Thank you all for your comments. I am scheduled to do the upgrade overnight tonight, and will be back here with results after.

I prefer to use the ASDM for the upgrades, as I am definitely not that experienced in Cisco products. Even though it would take a little longer I would prefer to upgrade to each different version as recommended by Cisco.

You'll be hearing from me tomorrow, hopefully with good news. :-)

Thanks again.
0
 
LVL 16

Expert Comment

by:InteraX
Comment Utility
I feel that, given the question, the first answer I gave was correct. No mention was made in the original question about requiring to use ASDM to upgrade the device. As ASDM is not necessary to upgrade, it is possible to upgrade the os using the command line and then upgrade ASDM to the compatible version at a later point.
0
 
LVL 1

Author Comment

by:cfgchiran
Comment Utility
I disagree. InteraX's response almost led me to believe that I could simply upgrade ASDM to tha latest version. He assumed that I was not going to use ASDM, but why would you assume I would not want to use it? I am cleary not an expert at this, and therefore using ASDM is obviously the easiest option for me.

He also did not directly respond to my question, where I asked about needing to upgade from 7.0.4 to 7.0.5 before going to 7.1.1 etc.... He stated that I should upgrade between "minor" versions, but then says 7.0.4 to 7.1.1. To me that's a major version. Minor version was what I was asking for.

If you look at my follow up questions to the first two responses, I clearly did not get the answer I was looking and had to follow up with my additional questions.

I appreciate InteraX's response but chose not to give points largely because it was not a clear answer and almost led me down the incorrect path of upgrading directly to the latest version of ASDM, which would have been very troublesome to me.

Therefore I believe my previous awarding of points are accurate.

Thank you.
0
 
LVL 16

Expert Comment

by:InteraX
Comment Utility
cfgchiran,

If you re-read my initial answer, I mention the upgrade path as upgrading the os and then upgrading the ASDM. I agree there was an assumption of using the command line. That is a perfectly normal and the most widely used method for managing cisco devices. If you read Cisco's documentation about version numbers, they are as follows. major.minor.release. This info can also be found at http://en.wikipedia.org/wiki/Cisco_IOS#Versioning. Therefore, my original answer is I believe correct given the information supplied in the original question.

My original post is below for clarification.

You have to upgrade between the minor version., so from 7.0.4, you go to any 7.1 then any 7.2 then any 8.0.

Once you have done that you can upgrade ASDM straight to 6.3
0
 
LVL 1

Author Comment

by:cfgchiran
Comment Utility
InteraX,

While I appreciate the answer, if you look at the answer I chose for most points, it is the only that directly stated that I need not do the inbetween releases.

Your assumption of not using ASDM was incorrect. Among "masters" and "wizards" that maybe the case, but I am clearly neither. You should have at least stated that ASDM can be upgraded directly if using the CLI.

But I will give you some credit since it did lead to nuttytechs clarification of your answer, and thus providing me with the ultimate solution.
0
 
LVL 1

Author Comment

by:cfgchiran
Comment Utility
I would like to re
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Overview The Cisco PIX 501, PIX 506e, ASA 5505 and ASA 5510 (most if not all of this information will be relevant to the PIX 515e but I do not have a working configuration handy to verify the validity) are primarily used within small to medium busi…
Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now