Solved

upgrade the ASAs running failover

Posted on 2011-02-17
13
361 Views
Last Modified: 2012-06-27
hi experts
i have 2 ASA which they are running failover, everything is fine.
currently i want upgrade the software of them, i already copy new "BIN" file to both, so what is the next we should do?
i mean can i reboot it one by one without service down ? and what the detail steps?

thanks
0
Comment
Question by:beardog1113
  • 7
  • 5
13 Comments
 
LVL 16

Expert Comment

by:btassure
ID: 34926068
From Cisco:
http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/mswlicfg.html#wp1053398

tl;dr upgrade the fialover, fail it over, upgrade primary and fail it back.
0
 
LVL 28

Expert Comment

by:bgoering
ID: 34926073
Take a look at this EE thread: http://www.experts-exchange.com/Hardware/Networking_Hardware/Firewalls/Q_25008732.html

Pretty much the same question solved there

Good Luck
0
 

Author Comment

by:beardog1113
ID: 34926577
hi btassure
whats your mena tl and dr you mentioned ?

thanks
0
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 

Author Comment

by:beardog1113
ID: 34926585
hi bgoering
does there is a way not causing down time for the upgrade?

thanks
0
 
LVL 28

Expert Comment

by:bgoering
ID: 34926616
I would think that would depend on the type of upgrade. If you or going across major version like 7.x to 8.x I would probably allow for a short down time. Minor versions like 8.1 to 8.2 you should be able to just upgrade a node, fail to the new node, upgrade the remaining node and fail back if desired.

When in doubt look at the release notes - they typically will tell you. What version are you going to? What is the old version?
0
 
LVL 28

Expert Comment

by:bgoering
ID: 34926644
I would probably make an exception to my "rule of thumb" above. 8.x to 8.3 requires a significant migration of the configuration. I would try to get some downtime for that also just in case.
0
 
LVL 28

Expert Comment

by:bgoering
ID: 34926668
that link that btassure posted above covers the rules pretty well as well as the procedure (I was just working from memory).
0
 

Author Comment

by:beardog1113
ID: 34926677
i want upgrade from 8.2(1) to 8.2(2)4, seem it like as your said minor version.

right ?
0
 
LVL 28

Expert Comment

by:bgoering
ID: 34926714
Yes that should be a trivial upgrade. The number in parenthisis is a maintenance release... you appear to be statying with in the same major "8" and minor "2" and just upgrade maintenance level from (1) to (4).

 In your case it would be a simple as

1. Upgrade the secondary
2. Fail primary over to secondary
3. Upgrade the primary
4. Fail back if desired
0
 

Author Comment

by:beardog1113
ID: 34941818
hi bgoering
first sorry for late response
does your steps more detail as below ?
1. upgrade the secondary
2. restart secondary
3. fail primary over to secondary( could you let me know what the command is ?)
4. upgrade the primary
5.restart primary
6. fail back

and that will not causing service down, right ?

thanks
0
 
LVL 28

Accepted Solution

by:
bgoering earned 250 total points
ID: 34943409
Yes, that would be the steps. for (3) log onto the secondary and issue command

fail active

that will make it active, same thing for step (60 except you log on to primary.

Try "fail ?" for more options
0
 
LVL 28

Expert Comment

by:bgoering
ID: 34943427
Assuming you have set up a link between them for state information then there will be absolutly no downtime. If you haven't set up that link then connections in flight will be reset - often this is handled transparently by the application with a retry or retransmit, but some applications may be affected.
0
 

Author Closing Comment

by:beardog1113
ID: 34976045
perfect
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Setup NAT/PAT question 3 48
Getting locked out and can't access Cisco via the web 18 64
Cisco ASA dns and browsing 20 32
Cisco switch suggestion 5 47
This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question