Process and Considerations for Upgrading ASA and ASDM?

Good day folks

This month I am going to upgrade our Cisco ASA and ASDM.  I want to go from ASA version 9.6(1) and ASDM 7.6(1) to the latest stable version of both.  I have a few questions.

1.  What is the most current, stable and inter compatible versions of both the ASA and ASDM?  
2.  If I see ASA Firepower tab located in the ASDM, does that mean I also need to upgrade a corresponding file for this as well?
3.  Can I do a direct upgrade from the versions I have to the latest versions, or do I need some intermediary version?  I hope this is not the case.
(4).  If so, are there other considerations, like changing the startup and running configs in some way to be compatible with these newer versions?
5.  Is it as simple as logging into the ASDM, taking a full backup and then tools --> upgrade software from local computer, ASA and ASDM images separately and then setting them to boot images?  Note I prefer the GUI to command line as I am mild/moderately dyslexic, and if it can be done in the GUI, why not.  Save running to start up config, reboot, profit ?
6.  Is it ok to leave the old versions on there and is switching back to them as boot images in emergency ok to do?

I have only even done this once before and it was years ago, with an older now EOL version, with a non complicated running config, and I can't remember.  I do remember it was a non issue, but this is Cisco.

Thanks again for the advice and feedback.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Miles MCommented:
1. You can find the recommended releases by searching for your model and looking at the software download. For example I googled "asa 5506 download" and came upon this page:

the starred releases are the ones that you are looking for. As far as ASDM goes, you can find the compatibility of versions of asdm and asa here:   or by searching for "asa compatibility matrix"

2. since it is showing in asdm, I'm going to assume you have a firepower module. You can find compatibility information here:

In general, they are independent as firepower is a separate addon module that you redirect traffic to (you can confirm this by looking at your service policies).

3. Since you're already on 9.x, I do not foresee you having any trouble jumping directly to another version.  If you want to be safe you could upgrade a few versions at a time, but in my experience this hasn't been necessary.

4. you shouldn't need to modify anything specifically for the new version other than making the changes to tell it to boot to the new ASA and ASDM images.

5. Taking a full backup is not a bad idea, but usually that's not what I do. I usually just do a "more system:running-config" and copy the output to a txt file for backup. This is because anything else, I can either replicate or obtain a copy of easily (asa and asdm images, anyconnect profiles, etc). Do whatever makes you most comfortable. I've included a link below that is for asav but should still be relevant to you.

Here's exactly how I upgrade the many ASAs I work on.

1. Download the ASA and ASDM images from the cisco site.
2. login to asdm, and click tools.
3. under tools I click file management, and then file transfer between local pc and flash (I don't have one in front of me for exact wording).
4. Once the files are uploaded. I go to config > management. Under management there should be a image / software configuration tab.
5. In there there should be two options. One for asa and the other for asdm. I select the new image i'm booting into first, then I select the old asa version as a backup. (make sure that the new image is first).  
6. For asdm I pick the new asdm version that I want to use. (you can only use one at a time).
7. save the configuration (using save button).
8. click the tools > reload and then say reload now.
9. wait 5 minutes for it to reboot, and check to make sure everything is working as intended.

I'd probably do these upgrades onsite or at the very least make sure that you have another means other than asdm to access (ssh, telnet, console).

6. It is ok to leave the older versions in flash. They will not hurt anything, and yes if you need to boot back into them, you can do that without issue. Basically to roll back, go step 5 of my upgrade method, and change the old image to be first, then continue the steps. It's as simple as that.

Let me know if you have any other questions.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
CnicNVAuthor Commented:
Thanks Miles for the very detailed feedback, it was invaluable.  I was able to upgrade the device without too much issue.  Have a great week:-)
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Hardware Firewalls

From novice to tech pro — start learning today.