Upgrading ASA5520 from asa708-k8.bin and asdm-508.bin to asa822-k8.bin and asdm-641.bin.

I have a two ASA5520's as failover and need to upgrade them from asa708-k8.bin and asdm-508.bin to asa822-k8.bin and asdm-641.bin. Can i just go to asdm-508.bin to asa822-k8.bin and asdm-641.bin or is their a way do do this upgrade? any help would be great.
remus91Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jan SpringerCommented:
I believe that you first have to upgrade to 7.23 before going to version 8.  That and the memory required going from v7 to v8 should be your biggest hurdles.
0
remus91Author Commented:
I just upgraded my ASA's to 2gigs this past weekend that should do it for the memory. so if I go to 7.23 then I can go right to 8.22? Also do you know the process to upgrade ASA failover?
0
Jan SpringerCommented:
Failover is nothing more than a cross-connect ethernet cable between an ethernet interface of each ASA.  You can use a switch, if you choose, and then use a regular cable to connect them.  Substitute the failover subnet used and the failover interfaces in the example below.

Primary:
       failover
       failover lan unit primary
       failover lan interface failover Ethernet0/3  
       failover key <put a key here>
       failover link failover Ethernet0/3
       failover interface ip failover 192.168.222.1 255.255.255.0 standby 192.168.223.1

Standy:
       failover
       failover lan unit secondary
       failover lan interface failover Ethernet0/3  
       failover key <put a key here>
       failover link failover Ethernet0/3
       failover interface ip failover 192.168.222.1 255.255.255.0 standby 192.168.223.1

According to Cisco's web site, "All Cisco ASA Software Releases (7.0, 7.2, 8.0, and 8.1) can be upgraded to Release 8.2.":
  http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_bulletin_c25-526545.html
0
Choose an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

remus91Author Commented:
My 2 ASA are hookup and running in production already so what would be the process to upgrade failover?
0
Jan SpringerCommented:
Choose an interface off of each -- preferably the same interface number.

Connect a cross-connect ethernet cable between the two interfaces used for failover.

Configure the failover information (this is an active/standby config) as shown above.

BUT before you do any failover configuration, you need to identify how you are using both actively in production today.  That tells me that the configurations of the two boxes are different.

Once you configure failover  and make changes, on the primary ASA you issue the command to save the config to the standby.  If you have two different configurations today, you cannot expect to run in failover mode in either active/active or active/standby.
0
remus91Author Commented:
My 2 ASA are up and running in production and in a failover pair already. The question I have is how do I upgrade to a new IOS in a failover pair?
0
Jan SpringerCommented:
This is how I would handle it:

Remove the failover configuration from the standby.   At this point, all traffic should be routing to the primary.

Upgrade the standby.  Verify that it doesn't complain about changes in command syntax and that it boots up without error.

If all looks good, tftp the image to the primary.

Put the failover configuration back on the standby and shut the external port down to the primary so that traffic flows to the standby.

Reboot the primary and bring the external interface back on-line.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
remus91Author Commented:
Ok thanks.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.