?
Solved

upgrade the ASAs running failover

Posted on 2011-02-17
13
Medium Priority
?
380 Views
Last Modified: 2012-06-27
hi experts
i have 2 ASA which they are running failover, everything is fine.
currently i want upgrade the software of them, i already copy new "BIN" file to both, so what is the next we should do?
i mean can i reboot it one by one without service down ? and what the detail steps?

thanks
0
Comment
Question by:beardog1113
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 5
13 Comments
 
LVL 16

Expert Comment

by:btassure
ID: 34926068
From Cisco:
http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/mswlicfg.html#wp1053398

tl;dr upgrade the fialover, fail it over, upgrade primary and fail it back.
0
 
LVL 28

Expert Comment

by:bgoering
ID: 34926073
Take a look at this EE thread: http://www.experts-exchange.com/Hardware/Networking_Hardware/Firewalls/Q_25008732.html

Pretty much the same question solved there

Good Luck
0
 

Author Comment

by:beardog1113
ID: 34926577
hi btassure
whats your mena tl and dr you mentioned ?

thanks
0
Veeam Disaster Recovery in Microsoft Azure

Veeam PN for Microsoft Azure is a FREE solution designed to simplify and automate the setup of a DR site in Microsoft Azure using lightweight software-defined networking. It reduces the complexity of VPN deployments and is designed for businesses of ALL sizes.

 

Author Comment

by:beardog1113
ID: 34926585
hi bgoering
does there is a way not causing down time for the upgrade?

thanks
0
 
LVL 28

Expert Comment

by:bgoering
ID: 34926616
I would think that would depend on the type of upgrade. If you or going across major version like 7.x to 8.x I would probably allow for a short down time. Minor versions like 8.1 to 8.2 you should be able to just upgrade a node, fail to the new node, upgrade the remaining node and fail back if desired.

When in doubt look at the release notes - they typically will tell you. What version are you going to? What is the old version?
0
 
LVL 28

Expert Comment

by:bgoering
ID: 34926644
I would probably make an exception to my "rule of thumb" above. 8.x to 8.3 requires a significant migration of the configuration. I would try to get some downtime for that also just in case.
0
 
LVL 28

Expert Comment

by:bgoering
ID: 34926668
that link that btassure posted above covers the rules pretty well as well as the procedure (I was just working from memory).
0
 

Author Comment

by:beardog1113
ID: 34926677
i want upgrade from 8.2(1) to 8.2(2)4, seem it like as your said minor version.

right ?
0
 
LVL 28

Expert Comment

by:bgoering
ID: 34926714
Yes that should be a trivial upgrade. The number in parenthisis is a maintenance release... you appear to be statying with in the same major "8" and minor "2" and just upgrade maintenance level from (1) to (4).

 In your case it would be a simple as

1. Upgrade the secondary
2. Fail primary over to secondary
3. Upgrade the primary
4. Fail back if desired
0
 

Author Comment

by:beardog1113
ID: 34941818
hi bgoering
first sorry for late response
does your steps more detail as below ?
1. upgrade the secondary
2. restart secondary
3. fail primary over to secondary( could you let me know what the command is ?)
4. upgrade the primary
5.restart primary
6. fail back

and that will not causing service down, right ?

thanks
0
 
LVL 28

Accepted Solution

by:
bgoering earned 1000 total points
ID: 34943409
Yes, that would be the steps. for (3) log onto the secondary and issue command

fail active

that will make it active, same thing for step (60 except you log on to primary.

Try "fail ?" for more options
0
 
LVL 28

Expert Comment

by:bgoering
ID: 34943427
Assuming you have set up a link between them for state information then there will be absolutly no downtime. If you haven't set up that link then connections in flight will be reset - often this is handled transparently by the application with a retry or retransmit, but some applications may be affected.
0
 

Author Closing Comment

by:beardog1113
ID: 34976045
perfect
0

Featured Post

Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question