Cisco ASA Failover Firmware Update

Ian Taylor
Ian Taylor used Ask the Experts™
on
Hi

I need to upgrade the ads and ASDM on two firewalls which are setup as failover, are there any decent guides on this process?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
There sure is:
Zero downtime upgrade
Ian TaylorIT Infrastructure Architect .:|:.:|:.

Author

Commented:
Thanks for that, thats what I was looking for.

Just another question, we do have a few 5510 ASA firewalls with the latest version 9.1.7 which I believe is the latest I can get for the 5510 - at what stage do you consider replacing firewalls when no more updates are available?
They will probably keep patching the 5510 for a while still, but no new features are added. I would be looking at a replacement right now. ASA5508 probably fits the bill, if you haven't outgrown the 5510.
Technical Consultant
Commented:
Here's my walkthrough

Cisco ASA 5500 Active/Standby – Zero Downtime Upgrade

5510 was declared end of life in 2013, purchasable support is available till December 2017, and support will officially end in Dec 2018 REF:
Ian TaylorIT Infrastructure Architect .:|:.:|:.

Author

Commented:
Thanks,

I came across a strange problem when carrying out the upgrade, after upgrading the standby to ASA 9.1 (2) and ASDM 7.6 - it came back up fine I then failed over to the standby (which I just upgraded) I then noticed on the firewall which was the active was complaining about IPS version was different - I thought okay I upgraded the active to the same as the standby  the the same versions but the failover option on the active reported as disabled.

So atm everything is going via the standby

Any ideas

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial