Upgrade FTD HA Pair on Firepower Appliances

Available Languages

Download Options

  • PDF     (842.9 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (895.9 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (834.6 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:May 8, 2023
Document ID:200896

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes the upgrade process of Firepower Threat Defense (FTD) in High Availability (HA) mode on Firepower appliances.

    Prerequisites

    Requirements

    Cisco recommends knowledge of these topics:

    • Firepower Management Center (FMC)
    • FTD
    • Firepower appliances (FXOS)

    Components Used

    • 2 x FPR4150
    • 1 x FS4000
    • 1 x PC

    The software image versions before the upgrade:

    • FMC 6.1.0-330
    • FTD Primary 6.1.0-330
    • FTD Secondary 6.1.0-330
    • FXOS Primary 2.0.1-37
    • FXOS Secondary 2.0.1-37

    The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

    Configure

    Network Diagram

    Network topology

    Action Plan

    Task 1: Verify the prerequisites

    Task 2: Upload the images to FMC and SSP

    Task 3: Upgrade the first FXOS chassis (2.0.1-37 -> 2.0.1-86)

    Task 4: Swap the FTD failover

    Task 5: Upgrade the second FXOS chassis (2.0.1-37 -> 2.0.1-86)

    Task 6: Upgrade the FMC (6.1.0-330 -> 6.1.0.1)

    Task 7: Upgrade the FTD HA pair (6.1.0-330 -> 6.1.0.1)

    Task 8: Deploy a policy from FMC to the FTD HA pair

    Task 1. Verify the Prerequisites

    Consult the FXOS Compatibility Guide in order to determine the compatibility between:

    • Target FTD software version and FXOS software version
    • Firepower HW platform and FXOS software version

    Cisco Firepower 4100/9300 FXOS Compatibility

    Note: This step is not applicable to FP21xx and earlier platforms.

    Check the FXOS Release Notes of the target version in order to determine the FXOS upgrade path:

    Cisco Firepower 4100/9300 FXOS Release Notes, 2.0(1)

    Note: This step is not applicable to FP21xx and earlier platforms.

    Consult the FTD target version Release Notes in order to determine the FTD upgrade path:

    Firepower System Release Notes, Version 6.0.1.2

    Task 2. Upload the Software Images

    On the two FCMs, upload the FXOS images (fxos-k9.2.0.1.86.SPA).

    On the FMC, upload the FMC and FTD upgrade packages:

    • For the FMC upgrade: Sourcefire_3D_Defense_Center_S3_Patch-6.1.0.1-53.sh
    • For the FTD upgrade: Cisco_FTD_SSP_Patch-6.1.0.1-53.sh

    Task 3. Upgrade the first FXOS chassis

    Note: In case you upgrade FXOS from 1.1.4.x to 2.x, first shut down the FTD logical appliance, upgrade the FXOS, and then re-enable it.

    Note: This step is not applicable to FP21xx and earlier platforms.

    Before the upgrade:

    FPR4100-4-A /system # show firmware monitor
FPRM:
    Package-Vers: 2.0(1.37)
    Upgrade-Status: Ready

Fabric Interconnect A:
    Package-Vers: 2.0(1.37)
    Upgrade-Status: Ready

Chassis 1:
    Server 1:
        Package-Vers: 2.0(1.37)
        Upgrade-Status: Ready

    Start the FXOS upgrade:

    Available Updates

    The FXOS upgrade requires a chassis reboot:

    Update Bundle Image

    You can monitor the FXOS upgrade from the FXOS CLI. All three components (FPRM, fabric interconnect, and chassis) have to be upgraded:

    FPR4100-4-A# scope system
FPR4100-4-A /system # show firmware monitor
FPRM:
    Package-Vers: 2.0(1.37)
    Upgrade-Status: Upgrading

Fabric Interconnect A:
    Package-Vers: 2.0(1.37)
    Upgrade-Status: Ready

Chassis 1:
    Server 1:
        Package-Vers: 2.0(1.37)
        Upgrade-Status: Ready

    Note: A few minutes after you start the FXOS upgrade process, you are disconnected from both the FXOS CLI and the GUI. You must be able to log in again after a few minutes.

    After approximately five minutes, the FPRM component upgrade completes:

    FPR4100-4-A /system # show firmware monitor
FPRM:
    Package-Vers: 2.0(1.86)
    Upgrade-Status: Ready

Fabric Interconnect A:
    Package-Vers: 2.0(1.37)
    Upgrade-Status: Upgrading

Chassis 1:
    Server 1:
        Package-Vers: 2.0(1.37)
        Upgrade-Status: Upgrading

    After approximately 10 minutes, and as a part of the FXOS upgrade process, the Firepower device restarts:

    Please stand by while rebooting the system...
    ...    
Restarting system.

    After the restart the upgrade process resumes:

    FPR4100-4-A /system # show firmware monitor
FPRM:
    Package-Vers: 2.0(1.86)
    Upgrade-Status: Ready

Fabric Interconnect A:
    Package-Vers: 2.0(1.37)
    Upgrade-Status: Upgrading

Chassis 1:
    Server 1:
        Package-Vers: 2.0(1.37)
        Upgrade-Status: Upgrading

    After a total of approximately 30 minutes the FXOS upgrade completes:

    FPR4100-4-A /system # show firmware monitor
FPRM:
    Package-Vers: 2.0(1.86)
    Upgrade-Status: Ready

Fabric Interconnect A:
    Package-Vers: 2.0(1.86)
    Upgrade-Status: Ready

Chassis 1:
    Server 1:
        Package-Vers: 2.0(1.86),2.0(1.37)
        Upgrade-Status: Ready

    Task 4. Swap the FTD Failover States

    Note: This step is not applicable to FP21xx and earlier platforms.

    Before you swap the failover states, ensure that the FTD module on the chassis is fully UP:

    FPR4100-4-A# connect module 1 console
Firepower-module1>connect ftd
Connecting to ftd console... enter exit to return to bootCLI

> show high-availability config
Failover On
Failover unit Secondary
Failover LAN Interface: FOVER Ethernet1/8 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 1041 maximum
MAC Address Move Notification Interval not set
failover replication http
Version: Ours 9.6(2), Mate 9.6(2)
Serial Number: Ours FLM2006EQFW, Mate FLM2006EN9U
Last Failover at: 15:08:47 UTC Dec 17 2016
        This host: Secondary - Standby Ready
                Active time: 0 (sec)
                slot 0: UCSB-B200-M3-U hw/sw rev (0.0/9.6(2)) status (Up Sys)
                  Interface inside (192.168.75.112): Normal (Monitored)
                  Interface outside (192.168.76.112): Normal (Monitored)
                  Interface diagnostic (0.0.0.0): Normal (Waiting)
                slot 1: snort rev (1.0)  status (up)
                slot 2: diskstatus rev (1.0)  status (up)
        Other host: Primary - Active
                Active time: 5163 (sec)
                  Interface inside (192.168.75.111): Normal (Monitored)
                  Interface outside (192.168.76.111): Normal (Monitored)
                  Interface diagnostic (0.0.0.0): Normal (Waiting)
                slot 1: snort rev (1.0)  status (up)
                slot 2: diskstatus rev (1.0)  status (up)

Stateful Failover Logical Update Statistics
        Link : FOVER Ethernet1/8 (up)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         65         0          68         4
        sys cmd         65         0          65         0
      ...

    Swap the FTD failover states. From the Active FTD CLI:

    > no failover active
        Switching to Standby

>

    Task 5. Upgrade the second FXOS chassis

    Similar to Task 2, upgrade the FXOS appliance where the new Standby FTD is installed. This can take approximately 30 minutes or more to complete.

    Note: This step is not applicable to FP21xx and earlier platforms.

    Task 6. Upgrade the FMC Software

    Upgrade the FMC, in this scenario from 6.1.0-330 to 6.1.0.1.

    Task 7. Upgrade the FTD HA Pair

    Before the upgrade:

    > show high-availability config
Failover On
Failover unit Primary
Failover LAN Interface: FOVER Ethernet1/8 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 1041 maximum
MAC Address Move Notification Interval not set
failover replication http
Version: Ours 9.6(2), Mate 9.6(2)
Serial Number: Ours FLM2006EN9U, Mate FLM2006EQFW
Last Failover at: 15:51:08 UTC Dec 17 2016
        This host: Primary - Standby Ready
                Active time: 0 (sec)
                slot 0: UCSB-B200-M3-U hw/sw rev (0.0/9.6(2)) status (Up Sys)
                  Interface inside (192.168.75.112): Normal (Monitored)
                  Interface outside (192.168.76.112): Normal (Monitored)
                  Interface diagnostic (0.0.0.0): Normal (Waiting)
                slot 1: snort rev (1.0)  status (up)
                slot 2: diskstatus rev (1.0)  status (up)
        Other host: Secondary - Active
                Active time: 1724 (sec)
                  Interface inside (192.168.75.111): Normal (Monitored)
                  Interface outside (192.168.76.111): Normal (Monitored)
                  Interface diagnostic (0.0.0.0): Normal (Waiting)
                slot 1: snort rev (1.0)  status (up)
                slot 2: diskstatus rev (1.0)  status (up)

Stateful Failover Logical Update Statistics
        Link : FOVER Ethernet1/8 (up)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         6          0          9          0
        sys cmd         6          0          6          0
    ...

    From the FMC System > Updates menu, initiate the FTD HA upgrade process:

    Updates

    Updates

    First, the Primary/Standby FTD is upgraded:

    System

    The Standby FTD module reboots with the new image:

    Remote Install

    You can verify the FTD status from the FXOS BootCLI mode:

    FPR4100-3-A# connect module 1 console
Firepower-module1> show services status
Services currently running:
Feature   | Instance ID    |     State  |          Up Since
-----------------------------------------------------------
ftd     | 001_JAD201200R4WLYCWO6 |   RUNNING  | :00:00:33

    The Secondary/Active FTD CLI shows a warning message due to a software version mismatch between the FTD modules:

    firepower#
************WARNING****WARNING****WARNING********************************
Mate version 9.6(2) is not identical with ours 9.6(2)4
************WARNING****WARNING****WARNING********************************
Beginning configuration replication: Sending to mate.
End Configuration Replication to mate

    The FMC shows that the FTD device was successfully upgraded:

    Remote Install

    The upgrade of the second FTD module starts:

    Remote Install

    At the end of the process the FTD boots with the new image:

    Remote Install

    In the background, the FMC uses the internal user enable_1, swaps the FTD failover states, and temporarily removes the failover configuration from the FTD:

    firepower# show logging
Dec 17 2016 16:40:14: %ASA-5-111008: User 'enable_1' executed the 'no failover active' command.
Dec 17 2016 16:40:14: %ASA-5-111010: User 'enable_1', running 'N/A' from IP 0.0.0.0, executed 'no failover active'
Dec 17 2016 16:41:19: %ASA-5-111008: User 'enable_1' executed the 'clear configure failover' command.
Dec 17 2016 16:41:19: %ASA-5-111010: User 'enable_1', running 'N/A' from IP 0.0.0.0, executed 'clear configure failover'
Dec 17 2016 16:41:19: %ASA-5-111008: User 'enable_1' executed the 'copy /noconfirm running-config disk0:/modified-config.cfg' command.
Dec 17 2016 16:41:19: %ASA-5-111010: User 'enable_1', running 'N/A' from IP 0.0.0.0, executed 'copy /noconfirm running-config
     disk0:/modified-config.cfg'
        
firepower#
        Switching to Standby

firepower#

    In this case the whole FTD upgrade (both units) took approximately 30 minutes.

    Verification

    This example shows FTD CLI verification from the Primary FTD device:

    > show high-availability config
Failover On
Failover unit Primary
Failover LAN Interface: FOVER Ethernet1/8 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 1041 maximum
MAC Address Move Notification Interval not set
failover replication http
Version: Ours 9.6(2)4, Mate 9.6(2)4
Serial Number: Ours FLM2006EN9U, Mate FLM2006EQFW
Last Failover at: 16:40:14 UTC Dec 17 2016
        This host: Primary - Active
                Active time: 1159 (sec)
                slot 0: UCSB-B200-M3-U hw/sw rev (0.0/9.6(2)4) status (Up Sys)
                  Interface inside (192.168.75.111): Normal (Monitored)
                  Interface outside (192.168.76.111): Normal (Monitored)
                  Interface diagnostic (0.0.0.0): Normal (Waiting)
                slot 1: snort rev (1.0)  status (up)
                slot 2: diskstatus rev (1.0)  status (up)
        Other host: Secondary - Standby Ready
                Active time: 0 (sec)
                slot 0: UCSB-B200-M3-U hw/sw rev (0.0/9.6(2)4) status (Up Sys)
                  Interface inside (192.168.75.112): Normal (Monitored)
                  Interface outside (192.168.76.112): Normal (Monitored)
                  Interface diagnostic (0.0.0.0): Normal (Waiting)
                slot 1: snort rev (1.0)  status (up)
                slot 2: diskstatus rev (1.0)  status (up)

Stateful Failover Logical Update Statistics
        Link : FOVER Ethernet1/8 (up)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         68         0          67         0
...
>

    This example shows FTD CLI verification from the Secondary/Standby FTD device:

    > show high-availability config
Failover On
Failover unit Secondary
Failover LAN Interface: FOVER Ethernet1/8 (up)
Reconnect timeout 0:00:00
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 3 of 1041 maximum
MAC Address Move Notification Interval not set
failover replication http
Version: Ours 9.6(2)4, Mate 9.6(2)4
Serial Number: Ours FLM2006EQFW, Mate FLM2006EN9U
Last Failover at: 16:52:43 UTC Dec 17 2016
        This host: Secondary - Standby Ready
                Active time: 0 (sec)
                slot 0: UCSB-B200-M3-U hw/sw rev (0.0/9.6(2)4) status (Up Sys)
                  Interface inside (192.168.75.112): Normal (Monitored)
                  Interface outside (192.168.76.112): Normal (Monitored)
                  Interface diagnostic (0.0.0.0): Normal (Waiting)
                slot 1: snort rev (1.0)  status (up)
                slot 2: diskstatus rev (1.0)  status (up)
        Other host: Primary - Active
                Active time: 1169 (sec)
                  Interface inside (192.168.75.111): Normal (Monitored)
                  Interface outside (192.168.76.111): Normal (Monitored)
                  Interface diagnostic (0.0.0.0): Normal (Waiting)
                slot 1: snort rev (1.0)  status (up)
                slot 2: diskstatus rev (1.0)  status (up)

Stateful Failover Logical Update Statistics
        Link : FOVER Ethernet1/8 (up)
        Stateful Obj    xmit       xerr       rcv        rerr
        General         38         0          41         0
    ...
>

    Task 8. Deploy a Policy to the FTD HA Pair

    After the upgrade is completed, you need to deploy a policy to the HA pair. This is shown in the FMC UI:

    Apply Update

    Deploy the policies:

    Deploy Policies

    Verification

    The upgraded FTD HA pair as it seen from the FMC UI:

    Device Management

    The upgraded FTD HA pair as it seen from the FCM UI:

    Logical Devices

    Related Information

    Revision History

    Revision Publish Date Comments
    2.0
    08-May-2023
    Recertification
    1.0
    17-Dec-2016
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    • Mikis Zafeiroudis
      Cisco TAC Engineer
    • Dinkar Sharma
      Cisco TAC Engineer
    • Edited by Olha Yakovenko
      Cisco TAC Engineer

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products