Step 1

In Secure Firewall chassis manager, choose System > Updates.

Step 2

Upload the new FXOS platform bundle image and ASA software image::

1. Click Upload Image.

2. Click Choose File to navigate to and select the image that you want to upload.

3. Click Upload.

   The selected image is uploaded to the chassis.

Step 3

After the new FXOS platform bundle image has successfully uploaded, click the Upgrade icon for the FXOS platform bundle to which you want to upgrade.

Step 4

Click Yes to confirm that you want to proceed with installation.

Step 5

Firepower Chassis Manager will be unavailable during upgrade. You can monitor the upgrade process using the FXOS CLI (see Monitor the Upgrade Progress).

Step 6

After all components have successfully upgraded, verify the status of the security modules/security engine and any installed applications before continuing (see Verify the Installation).

Step 7

Choose Logical Devices.

Step 8

For each ASA logical device that you want to upgrade:

1. Click the Set Version icon for the logical device that you want to update to open the Update Image Version dialog box.

2. For the New Version, choose the software version to which you want to upgrade.

3. Click OK.

Step 9

After the upgrade process finishes, verify that the applications are online and have upgraded successfully:

1. Choose Logical Devices.

2. Verify the application version and operational status.

Step 1

Connect to the FXOS CLI.

Step 2

Download the new FXOS platform bundle image to the chassis:

1. Enter firmware mode:

   scope firmware

2. Download the FXOS platform bundle software image:

   download image URL

   Specify the URL for the file being imported using one of the following syntax:

   • ftp://username@server/ path/ image_name

   • scp://username@server/ path/ image_name

   • sftp://username@server/ path/ image_name

   • tftp://server: port-num/ path/ image_name

3. To monitor the download process:

   scope download-task image_name

   show detail

Firepower-chassis # scope firmware
Firepower-chassis /firmware # download image scp://user@192.168.1.1/images/fxos-k9.2.3.1.58.SPA
Firepower-chassis /firmware # scope download-task fxos-k9.2.3.1.58.SPA
Firepower-chassis /firmware/download-task # show detail
Download task:
    File Name: fxos-k9.2.3.1.58.SPA
    Protocol: scp
    Server: 192.168.1.1
    Userid:
    Path:
    Downloaded Image Size (KB): 853688
    State: Downloading
    Current Task: downloading image fxos-k9.2.3.1.58.SPA from 192.168.1.1(FSM-STAGE:sam:dme:FirmwareDownloaderDownload:Local)

Step 3

After the new FXOS platform bundle image has successfully downloaded, upgrade the FXOS bundle:

1. If necessary, return to firmware mode:

   up

2. Make note of the version number for the FXOS platform bundle you are installing:

   show package

3. Enter auto-install mode:

   scope auto-install

4. Install the FXOS platform bundle:

   install platform platform-vers version_number

   version_number is the version number of the FXOS platform bundle you are installing--for example, 2.3(1.58).

5. The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently-installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade. As long as the ASA version is listed as upgradeable in the compatibility table, you can ignore these warnings.

   Enter yes to confirm that you want to proceed with verification.

6. Enter yes to confirm that you want to proceed with installation, or enter no to cancel the installation.

   FXOS unpacks the bundle and upgrades/reloads the components.

7. To monitor the upgrade process, see Monitor the Upgrade Progress.

Step 4

After all components have successfully upgraded, verify the status of the security modules/security engine and any installed applications before continuing (see Verify the Installation).

Step 5

Download the new ASA software image to the chassis:

1. Enter Security Services mode:

   top

   scope ssa

2. Enter Application Software mode:

   scope app-software

3. Download the logical device software image:

   download image URL

   Specify the URL for the file being imported using one of the following syntax:

   • ftp://username@server/path

   • scp://username@server/path

   • sftp://username@server/path

   • tftp://server:port-num/path

4. To monitor the download process:

   show download-task

5. To view the downloaded applications:

   up

   show app

   Make note of the ASA version for the software package you downloaded. You will need to use the exact version string to enable the application in a later step.

Firepower-chassis # scope ssa
Firepower-chassis /ssa # scope app-software
Firepower-chassis /ssa/app-software # download image scp://user@192.168.1.1/images/cisco-asa.9.4.1.65.csp
Firepower-chassis /ssa/app-software # show download-task

Downloads for Application Software:
    File Name                      Protocol   Server               Userid          State
    ------------------------------ ---------- -------------------- --------------- -----
    cisco-asa.9.4.1.65.csp         Scp        192.168.1.1          user            Downloaded

Firepower-chassis /ssa/app-software # up

Firepower-chassis /ssa # show app

Application:
    Name       Version    Description Author     Deploy Type CSP Type    Is Default App
    ---------- ---------- ----------- ---------- ----------- ----------- --------------
    asa        9.4.1.41   N/A                    Native      Application No
    asa        9.4.1.65   N/A                    Native      Application Yes

Step 6

For each ASA logical device that you want to upgrade:

1. Enter Security Services mode:

   top

   scope ssa

2. Set the scope to the security module you are updating:

   scope slotslot_number

3. Set the scope to the ASA application:

   scope app-instance asa instance_name

4. Set the Startup version to the new ASA software version:

   set startup-version version_number

Step 7

Commit the configuration:

Step 8

To verify the status of the security modules/security engine and any installed applications, see Verify the Installation.

Step 1

On the chassis that contains the standby ASA logical device, upload the new FXOS platform bundle image and ASA software image:

1. In Secure Firewall chassis manager, choose System > Updates.

   The Available Updates area shows a list of the packages available on the chassis.

2. Click Upload Image.

3. Click Choose File to navigate to and select the image that you want to upload.

4. Click Upload.

   The selected image is uploaded to the chassis.

Step 2

After the new FXOS platform bundle image has successfully uploaded, upgrade the FXOS bundle on the chassis that contains the standby ASA logical device:

1. Click the Upgrade icon for the FXOS platform bundle to which you want to upgrade.

   The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently-installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade. As long as the ASA version is listed as upgradeable in the compatibility table, you can ignore these warnings.

2. Click Yes to confirm that you want to proceed with installation.

   FXOS unpacks the bundle and upgrades/reloads the components.

Step 3

Secure Firewall chassis manager will be unavailable during upgrade. You can monitor the upgrade process using the FXOS CLI (see Monitor the Upgrade Progress).

Step 4

After all components have successfully upgraded, verify the status of the security modules/security engine and any installed applications before continuing (see Verify the Installation).

Step 5

Upgrade the ASA logical device image:

1. Choose Logical Devices to open the Logical Devices page.

   The Logical Devices page opens to show a list of configured logical devices on the chassis.

2. Click the Set Version icon for the logical device that you want to update to open the Update Image Version dialog box.

3. For the New Version, choose the software version to which you want to update.

4. Click OK.

Step 6

After the upgrade process finishes, verify that the applications are online and have upgraded successfully:

1. Choose Logical Devices.

2. Verify the application version and operational status.

Step 7

Make the unit that you just upgraded the active unit so that traffic flows to the upgraded unit:

1. Launch ASDM on the standby unit by connecting to the standby ASA IP address.

2. Force the standby unit to become active by choosing Monitoring > Properties > Failover > Status, and clicking Make Active.

Step 8

On the chassis that contains the new standby ASA logical device, upload the new FXOS platform bundle image and ASA software image:

1. In Secure Firewall chassis manager, choose System > Updates.

   The Available Updates area shows a list of the packages available on the chassis.

2. Click Upload Image.

3. Click Choose File to navigate to and select the image that you want to upload.

4. Click Upload.

   The selected image is uploaded to the chassis.

Step 9

After the new FXOS platform bundle image has successfully uploaded, upgrade the FXOS bundle on the chassis that contains the new standby ASA logical device:

1. Click the Upgrade icon for the FXOS platform bundle to which you want to upgrade.

   The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently-installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade. As long as the ASA version is listed as upgradeable in the compatibility table, you can ignore these warnings.

2. Click Yes to confirm that you want to proceed with installation.

   FXOS unpacks the bundle and upgrades/reloads the components.

Step 10

Secure Firewall chassis manager will be unavailable during upgrade. You can monitor the upgrade process using the FXOS CLI (see Monitor the Upgrade Progress).

Step 11

After all components have successfully upgraded, verify the status of the security modules/security engine and any installed applications before continuing (see Verify the Installation).

Step 12

Upgrade the ASA logical device image:

1. Choose Logical Devices.

   The Logical Devices page opens to shows a list of configured logical devices on the chassis. If no logical devices have been configured, a message stating so is shown instead.

2. Click the Set Version icon for the logical device that you want to update to open the Update Image Version dialog box.

3. For the New Version, choose the software version to which you want to update.

4. Click OK.

Step 13

After the upgrade process finishes, verify that the applications are online and have upgraded successfully:

1. Choose Logical Devices.

2. Verify the application version and operational status.

Step 14

(Optional) Make the unit that you just upgraded the active unit as it was before the upgrade:

1. Launch ASDM on the standby unit by connecting to the standby ASA IP address.

2. Force the standby unit to become active by choosing Monitoring > Properties > Failover > Status, and clicking Make Active.

Step 1

On the chassis that contains the standby ASA logical device, download the new FXOS platform bundle image:

1. Connect to the FXOS CLI.

2. Enter firmware mode:

   scope firmware

3. Download the FXOS platform bundle software image:

   download image URL

   Specify the URL for the file being imported using one of the following syntax:

   • ftp://username@server/ path/ image_name

   • scp://username@server/ path/ image_name

   • sftp://username@server/ path/ image_name

   • tftp://server: port-num/ path/ image_name

4. To monitor the download process:

   scope download-task image_name

   show detail

Firepower-chassis # scope firmware
Firepower-chassis /firmware # download image scp://user@192.168.1.1/images/fxos-k9.2.3.1.58.SPA
Firepower-chassis /firmware # scope download-task fxos-k9.2.3.1.58.SPA
Firepower-chassis /firmware/download-task # show detail
Download task:
    File Name: fxos-k9.2.3.1.58.SPA
    Protocol: scp
    Server: 192.168.1.1
    Userid:
    Path:
    Downloaded Image Size (KB): 853688
    State: Downloading
    Current Task: downloading image fxos-k9.2.3.1.58.SPA from 192.168.1.1(FSM-STAGE:sam:dme:FirmwareDownloaderDownload:Local)

Step 2

After the new FXOS platform bundle image has successfully downloaded, upgrade the FXOS bundle:

1. If necessary, return to firmware mode:

   up

2. Make note of the version number for the FXOS platform bundle you are installing:

   show package

3. Enter auto-install mode:

   scope auto-install

4. Install the FXOS platform bundle:

   install platform platform-vers version_number

   version_number is the version number of the FXOS platform bundle you are installing--for example, 2.3(1.58).

5. The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently-installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade. As long as the ASA version is listed as upgradeable in the compatibility table, you can ignore these warnings.

   Enter yes to confirm that you want to proceed with verification.

6. Enter yes to confirm that you want to proceed with installation, or enter no to cancel the installation.

   FXOS unpacks the bundle and upgrades/reloads the components.

7. To monitor the upgrade process, see Monitor the Upgrade Progress.

Step 3

After all components have successfully upgraded, verify the status of the security modules/security engine and any installed applications before continuing (see Verify the Installation).

Step 4

Download the new ASA software image to the chassis:

1. Enter Security Services mode:

   top

   scope ssa

2. Enter Application Software mode:

   scope app-software

3. Download the logical device software image:

   download image URL

   Specify the URL for the file being imported using one of the following syntax:

   • ftp://username@server/path

   • scp://username@server/path

   • sftp://username@server/path

   • tftp://server:port-num/path

4. To monitor the download process:

   show download-task

5. To view the downloaded applications:

   up

   show app

   Make note of the ASA version for the software package you downloaded. You will need to use the exact version string to enable the application in a later step.

Firepower-chassis # scope ssa
Firepower-chassis /ssa # scope app-software
Firepower-chassis /ssa/app-software # download image scp://user@192.168.1.1/images/cisco-asa.9.4.1.65.csp
Firepower-chassis /ssa/app-software # show download-task

Downloads for Application Software:
    File Name                      Protocol   Server               Userid          State
    ------------------------------ ---------- -------------------- --------------- -----
    cisco-asa.9.4.1.65.csp         Scp        192.168.1.1          user            Downloaded

Firepower-chassis /ssa/app-software # up

Firepower-chassis /ssa # show app

Application:
    Name       Version    Description Author     Deploy Type CSP Type    Is Default App
    ---------- ---------- ----------- ---------- ----------- ----------- --------------
    asa        9.4.1.41   N/A                    Native      Application No
    asa        9.4.1.65   N/A                    Native      Application Yes

Step 5

Upgrade the ASA logical device image:

1. Enter Security Services mode:

   top

   scope ssa

2. Set the scope to the security module you are updating:

   scope slotslot_number

3. Set the scope to the ASA application:

   scope app-instance asa instance_name

4. Set the Startup version to the version you want to update:

   set startup-version version_number

5. Commit the configuration:

   commit-buffer

   Commits the transaction to the system configuration. The application image is updated and the application restarts.

Step 6

To verify the status of the security modules/security engine and any installed applications, see Verify the Installation.

Step 7

Make the unit that you just upgraded the active unit so that traffic flows to the upgraded unit:

1. On the chassis that contains the standby ASA logical device, connect to the module CLI using a console connection or a Telnet connection.

   connect module slot_number { console | telnet}

   To connect to the security engine of a device that does not support multiple security modules, always use 1 as the slot_number .

   Example:

   
   Firepower# connect module 1 console
   Telnet escape character is '~'.
   Trying 127.5.1.1...
   Connected to 127.5.1.1.
   Escape character is '~'.
   
   CISCO Serial Over LAN:
   Close Network Connection to Exit
   
   Firepower-module1> 
   
   

2. Connect to the application console.

   connect asa

   Example:

   
   Firepower-module1> connect asa
   Connecting to asa(asa1) console... hit Ctrl + A + D  to return to bootCLI
   [...]
   asa>
   
   

3. Make this unit active:

   failover active

4. Save the configuration:

   write memory

5. Verify that the unit is active:

   show failover

Step 8

Exit the application console to the FXOS module CLI.

Step 9

Return to the supervisor level of the FXOS CLI.

1. Enter ~

   You exit to the Telnet application.

2. To exit the Telnet application, enter:

   telnet>quit

1. Enter Ctrl-], .

Step 10

On the chassis that contains the new standby ASA logical device, download the new FXOS platform bundle image:

1. Connect to the FXOS CLI.

2. Enter firmware mode:

   scope firmware

3. Download the FXOS platform bundle software image:

   download image URL

   Specify the URL for the file being imported using one of the following syntax:

   • ftp://username@server/ path/ image_name

   • scp://username@server/ path/ image_name

   • sftp://username@server/ path/ image_name

   • tftp://server: port-num/ path/ image_name

4. To monitor the download process:

   scope download-task image_name

   show detail

Firepower-chassis # scope firmware
Firepower-chassis /firmware # download image scp://user@192.168.1.1/images/fxos-k9.2.3.1.58.SPA
Firepower-chassis /firmware # scope download-task fxos-k9.2.3.1.58.SPA
Firepower-chassis /firmware/download-task # show detail
Download task:
    File Name: fxos-k9.2.3.1.58.SPA
    Protocol: scp
    Server: 192.168.1.1
    Userid:
    Path:
    Downloaded Image Size (KB): 853688
    State: Downloading
    Current Task: downloading image fxos-k9.2.3.1.58.SPA from 192.168.1.1(FSM-STAGE:sam:dme:FirmwareDownloaderDownload:Local)

Step 11

After the new FXOS platform bundle image has successfully downloaded, upgrade the FXOS bundle:

1. If necessary, return to firmware mode:

   up

2. Make note of the version number for the FXOS platform bundle you are installing:

   show package

3. Enter auto-install mode:

   scope auto-install

4. Install the FXOS platform bundle:

   install platform platform-vers version_number

   version_number is the version number of the FXOS platform bundle you are installing--for example, 2.3(1.58).

5. The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently-installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade. As long as the ASA version is listed as upgradeable in the compatibility table, you can ignore these warnings.

   Enter yes to confirm that you want to proceed with verification.

6. Enter yes to confirm that you want to proceed with installation, or enter no to cancel the installation.

   FXOS unpacks the bundle and upgrades/reloads the components.

7. To monitor the upgrade process, see Monitor the Upgrade Progress.

Step 12

After all components have successfully upgraded, verify the status of the security modules/security engine and any installed applications before continuing (see Verify the Installation).

Step 13

Download the new ASA software image to the chassis:

1. Enter Security Services mode:

   top

   scope ssa

2. Enter Application Software mode:

   scope app-software

3. Download the logical device software image:

   download image URL

   Specify the URL for the file being imported using one of the following syntax:

   • ftp://username@server/path

   • scp://username@server/path

   • sftp://username@server/path

   • tftp://server:port-num/path

4. To monitor the download process:

   show download-task

5. To view the downloaded applications:

   up

   show app

   Make note of the ASA version for the software package you downloaded. You will need to use the exact version string to enable the application in a later step.

Firepower-chassis # scope ssa
Firepower-chassis /ssa # scope app-software
Firepower-chassis /ssa/app-software # download image scp://user@192.168.1.1/images/cisco-asa.9.4.1.65.csp
Firepower-chassis /ssa/app-software # show download-task

Downloads for Application Software:
    File Name                      Protocol   Server               Userid          State
    ------------------------------ ---------- -------------------- --------------- -----
    cisco-asa.9.4.1.65.csp         Scp        192.168.1.1          user            Downloaded

Firepower-chassis /ssa/app-software # up

Firepower-chassis /ssa # show app

Application:
    Name       Version    Description Author     Deploy Type CSP Type    Is Default App
    ---------- ---------- ----------- ---------- ----------- ----------- --------------
    asa        9.4.1.41   N/A                    Native      Application No
    asa        9.4.1.65   N/A                    Native      Application Yes

Step 14

Upgrade the ASA logical device image:

1. Enter Security Services mode:

   top

   scope ssa

2. Set the scope to the security module you are updating:

   scope slotslot_number

3. Set the scope to the ASA application:

   scope app-instance asa instance_name

4. Set the Startup version to the version you want to update:

   set startup-version version_number

5. Commit the configuration:

   commit-buffer

   Commits the transaction to the system configuration. The application image is updated and the application restarts.

Step 15

To verify the status of the security modules/security engine and any installed applications, see Verify the Installation.

Step 16

(Optional) Make the unit that you just upgraded the active unit as it was before the upgrade:

1. On the chassis that contains the standby ASA logical device, connect to the module CLI using a console connection or a Telnet connection.

   connect module slot_number { console | telnet}

   To connect to the security engine of a device that does not support multiple security modules, always use 1 as the slot_number .

   Example:

   
   Firepower# connect module 1 console
   Telnet escape character is '~'.
   Trying 127.5.1.1...
   Connected to 127.5.1.1.
   Escape character is '~'.
   
   CISCO Serial Over LAN:
   Close Network Connection to Exit
   
   Firepower-module1> 
   
   

2. Connect to the application console.

   connect asa

   Example:

   
   Firepower-module1> connect asa
   Connecting to asa(asa1) console... hit Ctrl + A + D  to return to bootCLI
   [...]
   asa>
   
   

3. Make this unit active:

   failover active

4. Save the configuration:

   write memory

5. Verify that the unit is active:

   show failover

Step 1

Make both failover groups active on the primary unit.

1. Launch ASDM on the primary unit (or the unit with failover group 1 active) by connecting to the management address in failover group 1.

2. Choose Monitoring > Failover > Failover Group 2, and click Make Active.

3. Stay connected to ASDM on this unit for later steps.

Step 2

On the chassis that contains the secondary ASA logical device, upload the new FXOS platform bundle image and ASA software image:

1. Connect to the Secure Firewall chassis manager on the secondary unit.

2. Choose System > Updates.

   The Available Updates area shows a list of the packages available on the chassis.

3. Click Upload Image.

4. Click Choose File to navigate to and select the image that you want to upload.

5. Click Upload.

   The selected image is uploaded to the chassis.

Step 3

After the new FXOS platform bundle image has successfully uploaded, upgrade the FXOS bundle on the chassis that contains the secondary ASA logical device:

1. Click the Upgrade icon for the FXOS platform bundle to which you want to upgrade.

   The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently-installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade. As long as the ASA version is listed as upgradeable in the compatibility table, you can ignore these warnings.

2. Click Yes to confirm that you want to proceed with installation.

   FXOS unpacks the bundle and upgrades/reloads the components.

Step 4

Secure Firewall chassis manager will be unavailable during upgrade. You can monitor the upgrade process using the FXOS CLI (see Monitor the Upgrade Progress).

Step 5

After all components have successfully upgraded, verify the status of the security modules/security engine and any installed applications before continuing (see Verify the Installation).

Step 6

Upgrade the ASA logical device image:

1. Choose Logical Devices.

   The Logical Devices page opens to show a list of configured logical devices on the chassis.

2. Click the Set Version icon for the logical device that you want to update to open the Update Image Version dialog box.

3. For the New Version, choose the software version to which you want to update.

4. Click OK.

Step 7

After the upgrade process finishes, verify that the applications are online and have upgraded successfully:

1. Choose Logical Devices.

2. Verify the application version and operational status.

Step 8

Make both failover groups active on the secondary unit.

1. Launch ASDM on the primary unit (or the unit with failover group 1 active) by connecting to the management address in failover group 1.

2. Choose Monitoring > Failover > Failover Group 1, and click Make Standby.

3. Choose Monitoring > Failover > Failover Group 2, and click Make Standby.

Step 9

On the chassis that contains the primary ASA logical device, upload the new FXOS platform bundle image and ASA software image:

1. Connect to the Secure Firewall chassis manager on the primary unit.

2. Choose System > Updates.

   The Available Updates area shows a list of the packages available on the chassis.

3. Click Upload Image to open the Upload Image dialog box.

4. Click Choose File to navigate to and select the image that you want to upload.

5. Click Upload.

   The selected package is uploaded to the chassis.

6. For certain software images you will be presented with an end-user license agreement after uploading the image. Follow the system prompts to accept the end-user license agreement.

Step 10

After the new FXOS platform bundle image has successfully uploaded, upgrade the FXOS bundle on the chassis that contains the primary ASA logical device:

1. Click the Upgrade icon for the FXOS platform bundle to which you want to upgrade.

   The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently-installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade. As long as the ASA version is listed as upgradeable in the compatibility table, you can ignore these warnings.

2. Click Yes to confirm that you want to proceed with installation.

   FXOS unpacks the bundle and upgrades/reloads the components.

Step 11

Secure Firewall chassis manager will be unavailable during upgrade. You can monitor the upgrade process using the FXOS CLI (see Monitor the Upgrade Progress).

Step 12

After all components have successfully upgraded, verify the status of the security modules/security engine and any installed applications before continuing (see Verify the Installation).

Step 13

Upgrade the ASA logical device image:

1. Choose Logical Devices.

   The Logical Devices page opens to show a list of configured logical devices on the chassis.

2. Click the Set Version icon for the logical device that you want to update to open the Update Image Version dialog box.

3. For the New Version, choose the software version to which you want to update.

4. Click OK.

Step 14

After the upgrade process finishes, verify that the applications are online and have upgraded successfully:

1. Choose Logical Devices.

2. Verify the application version and operational status.

Step 15

If the failover groups are configured with Preempt Enabled, they automatically become active on their designated unit after the preempt delay has passed. If the failover groups are not configured with Preempt Enabled, you can return them to active status on their designated units using the ASDM Monitoring > Failover > Failover Group # pane.

Step 1

Connect to the FXOS CLI on the secondary unit, either the console port (preferred) or using SSH.

Step 2

Make both failover groups active on the primary unit.

1. Connect to the module CLI using a console connection or a Telnet connection.

   connect module slot_number { console | telnet}

   To connect to the security engine of a device that does not support multiple security modules, always use 1 as the slot_number .

   Example:

   
   Firepower# connect module 1 console
   Telnet escape character is '~'.
   Trying 127.5.1.1...
   Connected to 127.5.1.1.
   Escape character is '~'.
   
   CISCO Serial Over LAN:
   Close Network Connection to Exit
   
   Firepower-module1> 
   
   

2. Connect to the application console.

   connect asa

   Example:

   
   Firepower-module1> connect asa
   Connecting to asa(asa1) console... hit Ctrl + A + D  to return to bootCLI
   [...]
   asa>
   
   

3. Make both failover groups active on the primary unit.

   enable

   The enable password is blank by default.

   no failover active group 1

   no failover active group 2

   Example:

   asa> enable
   Password: <blank>
   asa# no failover active group 1
   asa# no failover active group 2
   
   

Step 3

Exit the application console to the FXOS module CLI.

Step 4

Return to the supervisor level of the FXOS CLI.

1. Enter ~

   You exit to the Telnet application.

2. To exit the Telnet application, enter:

   telnet>quit

1. Enter Ctrl-], .

Step 5

On the chassis that contains the secondary ASA logical device, download the new FXOS platform bundle image and ASA software image:

1. Connect to the FXOS CLI.

2. Enter firmware mode:

   scope firmware

3. Download the FXOS platform bundle software image:

   download image URL

   Specify the URL for the file being imported using one of the following syntax:

   • ftp://username@server/ path/ image_name

   • scp://username@server/ path/ image_name

   • sftp://username@server/ path/ image_name

   • tftp://server: port-num/ path/ image_name

4. To monitor the download process:

   scope download-task image_name

   show detail

Firepower-chassis # scope firmware
Firepower-chassis /firmware # download image scp://user@192.168.1.1/images/fxos-k9.2.3.1.58.SPA
Firepower-chassis /firmware # scope download-task fxos-k9.2.3.1.58.SPA
Firepower-chassis /firmware/download-task # show detail
Download task:
    File Name: fxos-k9.2.3.1.58.SPA
    Protocol: scp
    Server: 192.168.1.1
    Userid:
    Path:
    Downloaded Image Size (KB): 853688
    State: Downloading
    Current Task: downloading image fxos-k9.2.3.1.58.SPA from 192.168.1.1(FSM-STAGE:sam:dme:FirmwareDownloaderDownload:Local)

Step 6

After the new FXOS platform bundle image has successfully downloaded, upgrade the FXOS bundle:

1. If necessary, return to firmware mode:

   top

   scope firmware

2. Make note of the version number for the FXOS platform bundle you are installing:

   show package

3. Enter auto-install mode:

   scope auto-install

4. Install the FXOS platform bundle:

   install platform platform-vers version_number

   version_number is the version number of the FXOS platform bundle you are installing--for example, 2.3(1.58).

5. The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently-installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade. As long as the ASA version is listed as upgradeable in the compatibility table, you can ignore these warnings.

   Enter yes to confirm that you want to proceed with verification.

6. Enter yes to confirm that you want to proceed with installation, or enter no to cancel the installation.

   FXOS unpacks the bundle and upgrades/reloads the components.

7. To monitor the upgrade process, see Monitor the Upgrade Progress.

Step 7

After all components have successfully upgraded, verify the status of the security modules/security engine and any installed applications before continuing (see Verify the Installation).

Step 8

Download the new ASA software image to the chassis:

1. Enter Security Services mode:

   top

   scope ssa

2. Enter Application Software mode:

   scope app-software

3. Download the logical device software image:

   download image URL

   Specify the URL for the file being imported using one of the following syntax:

   • ftp://username@server/path

   • scp://username@server/path

   • sftp://username@server/path

   • tftp://server:port-num/path

4. To monitor the download process:

   show download-task

5. To view the downloaded applications:

   up

   show app

   Make note of the ASA version for the software package you downloaded. You will need to use the exact version string to enable the application in a later step.

Firepower-chassis # scope ssa
Firepower-chassis /ssa # scope app-software
Firepower-chassis /ssa/app-software # download image scp://user@192.168.1.1/images/cisco-asa.9.4.1.65.csp
Firepower-chassis /ssa/app-software # show download-task

Downloads for Application Software:
    File Name                      Protocol   Server               Userid          State
    ------------------------------ ---------- -------------------- --------------- -----
    cisco-asa.9.4.1.65.csp         Scp        192.168.1.1          user            Downloaded

Firepower-chassis /ssa/app-software # up

Firepower-chassis /ssa # show app

Application:
    Name       Version    Description Author     Deploy Type CSP Type    Is Default App
    ---------- ---------- ----------- ---------- ----------- ----------- --------------
    asa        9.4.1.41   N/A                    Native      Application No
    asa        9.4.1.65   N/A                    Native      Application Yes

Step 9

Upgrade the ASA logical device image:

1. Enter Security Services mode:

   top

   scope ssa

2. Set the scope to the security module you are updating:

   scope slotslot_number

3. Set the scope to the ASA application:

   scope app-instance asa instance_name

4. Set the Startup version to the version you want to update:

   set startup-version version_number

5. Commit the configuration:

   commit-buffer

   Commits the transaction to the system configuration. The application image is updated and the application restarts.

Step 10

To verify the status of the security modules/security engine and any installed applications, see Verify the Installation.

Step 11

Make both failover groups active on the secondary unit.

1. Connect to the module CLI using a console connection or a Telnet connection.

   connect module slot_number { console | telnet}

   To connect to the security engine of a device that does not support multiple security modules, always use 1 as the slot_number .

   Example:

   
   Firepower# connect module 1 console
   Telnet escape character is '~'.
   Trying 127.5.1.1...
   Connected to 127.5.1.1.
   Escape character is '~'.
   
   CISCO Serial Over LAN:
   Close Network Connection to Exit
   
   Firepower-module1> 
   
   

2. Connect to the application console.

   connect asa

   Example:

   
   Firepower-module1> connect asa
   Connecting to asa(asa1) console... hit Ctrl + A + D  to return to bootCLI
   [...]
   asa>
   
   

3. Make both failover groups active on the secondary unit.

   enable

   The enable password is blank by default.

   failover active group 1

   failover active group 2

   Example:

   asa> enable
   Password: <blank>
   asa# failover active group 1
   asa# failover active group 2
   
   

Step 12

Exit the application console to the FXOS module CLI.

Step 13

Return to the supervisor level of the FXOS CLI.

1. Enter ~

   You exit to the Telnet application.

2. To exit the Telnet application, enter:

   telnet>quit

1. Enter Ctrl-], .

Step 14

On the chassis that contains the primary ASA logical device, download the new FXOS platform bundle image and ASA software image:

1. Connect to the FXOS CLI.

2. Enter firmware mode:

   scope firmware

3. Download the FXOS platform bundle software image:

   download image URL

   Specify the URL for the file being imported using one of the following syntax:

   • ftp://username@server/ path/ image_name

   • scp://username@server/ path/ image_name

   • sftp://username@server/ path/ image_name

   • tftp://server: port-num/ path/ image_name

4. To monitor the download process:

   scope download-task image_name

   show detail

Firepower-chassis # scope firmware
Firepower-chassis /firmware # download image scp://user@192.168.1.1/images/fxos-k9.2.3.1.58.SPA
Firepower-chassis /firmware # scope download-task fxos-k9.2.3.1.58.SPA
Firepower-chassis /firmware/download-task # show detail
Download task:
    File Name: fxos-k9.2.3.1.58.SPA
    Protocol: scp
    Server: 192.168.1.1
    Userid:
    Path:
    Downloaded Image Size (KB): 853688
    State: Downloading
    Current Task: downloading image fxos-k9.2.3.1.58.SPA from 192.168.1.1(FSM-STAGE:sam:dme:FirmwareDownloaderDownload:Local)

Step 15

After the new FXOS platform bundle image has successfully downloaded, upgrade the FXOS bundle:

1. If necessary, return to firmware mode:

   up

2. Make note of the version number for the FXOS platform bundle you are installing:

   show package

3. Enter auto-install mode:

   scope auto-install

4. Install the FXOS platform bundle:

   install platform platform-vers version_number

   version_number is the version number of the FXOS platform bundle you are installing--for example, 2.3(1.58).

5. The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently-installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade. As long as the ASA version is listed as upgradeable in the compatibility table, you can ignore these warnings.

   Enter yes to confirm that you want to proceed with verification.

6. Enter yes to confirm that you want to proceed with installation, or enter no to cancel the installation.

   FXOS unpacks the bundle and upgrades/reloads the components.

7. To monitor the upgrade process, see Monitor the Upgrade Progress.

Step 16

After all components have successfully upgraded, verify the status of the security modules/security engine and any installed applications before continuing (see Verify the Installation).

Step 17

Download the new ASA software image to the chassis:

1. Enter Security Services mode:

   top

   scope ssa

2. Enter Application Software mode:

   scope app-software

3. Download the logical device software image:

   download image URL

   Specify the URL for the file being imported using one of the following syntax:

   • ftp://username@server/path

   • scp://username@server/path

   • sftp://username@server/path

   • tftp://server:port-num/path

4. To monitor the download process:

   show download-task

5. To view the downloaded applications:

   up

   show app

   Make note of the ASA version for the software package you downloaded. You will need to use the exact version string to enable the application in a later step.

Firepower-chassis # scope ssa
Firepower-chassis /ssa # scope app-software
Firepower-chassis /ssa/app-software # download image scp://user@192.168.1.1/images/cisco-asa.9.4.1.65.csp
Firepower-chassis /ssa/app-software # show download-task

Downloads for Application Software:
    File Name                      Protocol   Server               Userid          State
    ------------------------------ ---------- -------------------- --------------- -----
    cisco-asa.9.4.1.65.csp         Scp        192.168.1.1          user            Downloaded

Firepower-chassis /ssa/app-software # up

Firepower-chassis /ssa # show app

Application:
    Name       Version    Description Author     Deploy Type CSP Type    Is Default App
    ---------- ---------- ----------- ---------- ----------- ----------- --------------
    asa        9.4.1.41   N/A                    Native      Application No
    asa        9.4.1.65   N/A                    Native      Application Yes

Step 18

Upgrade the ASA logical device image:

1. Enter Security Services mode:

   top

   scope ssa

2. Set the scope to the security module you are updating:

   scope slotslot_number

3. Set the scope to the ASA application:

   scope app-instance asa instance_name

4. Set the Startup version to the version you want to update:

   set startup-version version_number

5. Commit the configuration:

   commit-buffer

   Commits the transaction to the system configuration. The application image is updated and the application restarts.

Step 19

To verify the status of the security modules/security engine and any installed applications, see Verify the Installation.

Step 20

If the failover groups are configured with Preempt Enabled, they automatically become active on their designated unit after the preempt delay has passed. If the failover groups are not configured with Preempt Enabled, you can return them to active status on their designated units using the ASDM Monitoring > Failover > Failover Group # pane.

Step 1

Determine which chassis has the control node. You will upgrade this chassis last.

1. Connect to Secure Firewall chassis manager.

2. Choose Logical Devices.

3. Click the plus sign (+) to see the attributes for the security modules included in the cluster.

4. Verify that the control node is on this chassis. There should be an ASA instance with CLUSTER-ROLE set to "Control".

Step 2

Connect to Secure Firewall chassis manager on a chassis in the cluster that does not have the control node.

Step 3

Upload the new FXOS platform bundle image and ASA software image:

1. In Secure Firewall chassis manager, choose System > Updates.

   The Available Updates area shows a list of the packages available on the chassis.

2. Click Upload Image.

3. Click Choose File to navigate to and select the image that you want to upload.

4. Click Upload.

   The selected image is uploaded to the chassis.

5. Wait for the images to successfully upload before continuing.

Step 4

Upgrade the FXOS bundle:

1. Choose System > Updates.

2. Click the Upgrade icon for the FXOS platform bundle to which you want to upgrade.

   The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently-installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade. As long as the ASA version is listed as upgradeable in the compatibility table, you can ignore these warnings.

3. Click Yes to confirm that you want to proceed with installation.

   FXOS unpacks the bundle and upgrades/reloads the components.

Step 5

Secure Firewall chassis manager will be unavailable during upgrade. You can monitor the upgrade process using the FXOS CLI (see Monitor the Upgrade Progress).

Step 6

After all components have successfully upgraded, verify the status of the security modules/security engine and any installed applications before continuing (see Verify the Installation).

Step 7

Upgrade the ASA logical device image on each security module:

1. Choose Logical Devices.

   The Logical Devices page opens to show a list of configured logical devices on the chassis.

2. Click the Set Version icon for the logical device that you want to update to open the Update Image Version dialog box.

3. For the New Version, choose the software version to which you want to update.

4. Click OK.

Step 8

After the upgrade process finishes, verify that the applications are online and have upgraded successfully:

1. Choose Logical Devices.

2. Verify the application version and operational status.

Step 9

Repeat steps Step 2-Step 8 for all remaining chassis in the cluster that do not have the control node.

Step 10

After all chassis in the cluster that do not have the control node have been upgraded, repeat steps Step 2-Step 8 on the chassis with the control node.

Step 11

For distributed VPN clustering mode, after the cluster has stabilized you can redistribute active sessions among all modules in the cluster using the ASA console on the control node.

Step 1

Determine which chassis has the control node. You will upgrade this chassis last.

1. Connect to the FXOS CLI.

2. Verify that the control node is on this chassis. There should be an ASA instance with Cluster Role set to “Control”:

   scope ssa

   show app-instance

Step 2

Connect to the FXOS CLI on a chassis in the cluster that does not have the control node.

Step 3

Download the new FXOS platform bundle image to the chassis:

1. Enter firmware mode:

   scope firmware

2. Download the FXOS platform bundle software image:

   download image URL

   Specify the URL for the file being imported using one of the following syntax:

   • ftp://username@server/ path/ image_name

   • scp://username@server/ path/ image_name

   • sftp://username@server/ path/ image_name

   • tftp://server: port-num/ path/ image_name

3. To monitor the download process:

   scope download-task image_name

   show detail

Firepower-chassis # scope firmware
Firepower-chassis /firmware # download image scp://user@192.168.1.1/images/fxos-k9.2.3.1.58.SPA
Firepower-chassis /firmware # scope download-task fxos-k9.2.3.1.58.SPA
Firepower-chassis /firmware/download-task # show detail
Download task:
    File Name: fxos-k9.2.3.1.58.SPA
    Protocol: scp
    Server: 192.168.1.1
    Userid:
    Path:
    Downloaded Image Size (KB): 853688
    State: Downloading
    Current Task: downloading image fxos-k9.2.3.1.58.SPA from 192.168.1.1(FSM-STAGE:sam:dme:FirmwareDownloaderDownload:Local)

Step 4

Upgrade the FXOS bundle:

1. If necessary, return to firmware mode:

   top

   scope firmware

2. Make note of the version number for the FXOS platform bundle you are installing:

   show package

3. Enter auto-install mode:

   scope auto-install

4. Install the FXOS platform bundle:

   install platform platform-vers version_number

   version_number is the version number of the FXOS platform bundle you are installing--for example, 2.3(1.58).

5. The system will first verify the software package that you want to install. It will inform you of any incompatibility between currently-installed applications and the specified FXOS platform software package. It will also warn you that any existing sessions will be terminated and that the system will need to be rebooted as part of the upgrade. As long as the ASA version is listed as upgradeable in the compatibility table, you can ignore these warnings.

   Enter yes to confirm that you want to proceed with verification.

6. Enter yes to confirm that you want to proceed with installation, or enter no to cancel the installation.

   FXOS unpacks the bundle and upgrades/reloads the components.

7. To monitor the upgrade process, see Monitor the Upgrade Progress.

Step 5

After all components have successfully upgraded, verify the status of the security modules/security engine and any installed applications before continuing (see Verify the Installation).

Step 6

Download the new ASA software image to the chassis:

1. Enter Security Services mode:

   top

   scope ssa

2. Enter Application Software mode:

   scope app-software

3. Download the logical device software image:

   download image URL

   Specify the URL for the file being imported using one of the following syntax:

   • ftp://username@server/path

   • scp://username@server/path

   • sftp://username@server/path

   • tftp://server:port-num/path

4. To monitor the download process:

   show download-task

5. To view the downloaded applications:

   up

   show app

   Make note of the ASA version for the software package you downloaded. You will need to use the exact version string to enable the application in a later step.

Firepower-chassis # scope ssa
Firepower-chassis /ssa # scope app-software
Firepower-chassis /ssa/app-software # download image scp://user@192.168.1.1/images/cisco-asa.9.4.1.65.csp
Firepower-chassis /ssa/app-software # show download-task

Downloads for Application Software:
    File Name                      Protocol   Server               Userid          State
    ------------------------------ ---------- -------------------- --------------- -----
    cisco-asa.9.4.1.65.csp         Scp        192.168.1.1          user            Downloaded

Firepower-chassis /ssa/app-software # up

Firepower-chassis /ssa # show app

Application:
    Name       Version    Description Author     Deploy Type CSP Type    Is Default App
    ---------- ---------- ----------- ---------- ----------- ----------- --------------
    asa        9.4.1.41   N/A                    Native      Application No
    asa        9.4.1.65   N/A                    Native      Application Yes

Step 7

Upgrade the ASA logical device image:

1. Enter Security Services mode:

   top

   scope ssa

2. Set the scope to the security module you are updating:

   scope slotslot_number

3. Set the scope to the ASA application:

   scope app-instance asa instance_name

4. Set the Startup version to the version you want to update:

   set startup-version version_number

5. Commit the configuration:

   commit-buffer

   Commits the transaction to the system configuration. The application image is updated and the application restarts.

Step 8

To verify the status of the security modules/security engine and any installed applications, see Verify the Installation.

Step 9

Repeat steps Step 2-Step 8 for all remaining chassis in the cluster that do not have the control node.

Step 10

After all chassis in the cluster that do not have the control node have been upgraded, repeat steps Step 2-Step 8 on the chassis with the control node.

Step 11

For distributed VPN clustering mode, after the cluster has stabilized you can redistribute active sessions among all modules in the cluster using the ASA console on the control node.

Step 1

In privileged EXEC mode, copy the ASA software to flash memory.

ciscoasa# copy ftp://jcrichton:aeryn@10.1.1.1/asa-9-12-1-smp-k8.bin disk0:/asa-9-12-1-smp-k8.bin

Step 2

Copy the ASDM image to flash memory.

ciscoasa# copy ftp://jcrichton:aeryn@10.1.1.1/asdm-7121.bin disk0:/asdm-7121.bin

Step 3

Access global configuration mode.

ciscoasa# configure terminal
ciscoasa(config)#

Step 4

Show the current boot images configured (up to 4):

ciscoasa(config)# show running-config boot system
boot system disk0:/cdisk.bin
boot system disk0:/asa931-smp-k8.bin

Step 5

Remove any existing boot image configurations so that you can enter the new boot image as your first choice:

ciscoasa(config)# no boot system disk0:/cdisk.bin
ciscoasa(config)# no boot system disk0:/asa931-smp-k8.bin

Step 6

Set the ASA image to boot (the one you just uploaded):

ciscoasa(config)# boot system disk0:/asa-9-12-1-smp-k8.bin

Step 7

Set the ASDM image to use (the one you just uploaded):

ciscoasa(config)# asdm image disk0:/asdm-7121.bin

Step 8

Save the new settings to the startup configuration:

Step 9

Reload the ASA:

Step 10

If you are upgrading the ASA FirePOWER module, disable the ASA REST API or else the upgrade will fail.

Step 11

Upgrade the ASA FirePOWER module.

Step 1

In the main ASDM application window, choose Tools > Upgrade Software from Local Computer.

Step 2

From the Image to Upload drop-down list, choose ASDM.

Step 3

In the Local File Path field, click Browse Local Files to find the file on your PC.

Step 4

In the Flash File System Path field, click Browse Flash to find the directory or file in the flash file system.

Step 5

Click Upload Image.

Step 6

You are prompted to set this image as the ASDM image. Click Yes.

Step 7

You are reminded to exit ASDM and save the configuration. Click OK.

Step 8

Repeat these steps, choosing ASA from the Image to Upload drop-down list. You can also use this procedure to upload other file types.

Step 9

Choose Tools > System Reload to reload the ASA.

1. Click the Save the running configuration at the time of reload radio button (the default).

2. Choose a time to reload (for example, Now, the default).

3. Click Schedule Reload.

Step 10

After the ASA reloads, restart ASDM.

Step 11

If you are upgrading an ASA FirePOWER module, disable the ASA REST API by choosing Tools > Command Line Interface, and entering no rest-api agent .

Step 12

Upgrade the ASA FirePOWER module.

Step 1

Choose Tools > Check for ASA/ASDM Updates.

Step 2

Enter your Cisco.com username and password, and then click Login.

Step 3

Click Next to display the Select Software screen.

Step 4

To upgrade the ASA version and ASDM version, perform the following steps:

1. In the ASA area, check the Upgrade to check box, and then choose an ASA version to which you want to upgrade from the drop-down list.

2. In the ASDM area, check the Upgrade to check box, and then choose an ASDM version to which you want to upgrade from the drop-down list.

Step 5

Click Next to display the Review Changes screen.

Step 6

Verify the following items:

Step 7

Click Next to start the upgrade installation.

Step 8

If the upgrade installation succeeded, for the upgrade versions to take effect, check the Save configuration and reload device now check box to restart the ASA, and restart ASDM.

Step 9

Click Finish to exit the wizard and save the configuration changes that you have made.

Step 10

After the ASA reloads, restart ASDM.

Step 11

If you are upgrading an ASA FirePOWER module, disable the ASA REST API by choosing Tools > Command Line Interface, and entering no rest-api agent .

Step 12

Upgrade the ASA FirePOWER module.

Step 1

On the active unit in privileged EXEC mode, copy the ASA software to the active unit flash memory:

asa/act# copy ftp://jcrichton:aeryn@10.1.1.1/asa9-15-1-smp-k8.bin disk0:/asa9-15-1-smp-k8.bin

Step 2

Copy the software to the standby unit; be sure to specify the same path as for the active unit:

asa/act# failover exec mate copy /noconfirm ftp://jcrichton:aeryn@10.1.1.1/asa9-15-1-smp-k8.bin disk0:/asa9-15-1-smp-k8.bin

Step 3

Copy the ASDM image to the active unit flash memory:

asa/act# copy ftp://jcrichton:aeryn@10.1.1.1/asdm-77171417151.bin disk0:/asdm-77171417151.bin

Step 4

Copy the ASDM image to the standby unit; be sure to specify the same path as for the active unit:

asa/act# failover exec mate copy /noconfirm ftp://jcrichton:aeryn@10.1.1.1/asdm-77171417151.bin disk0:/asdm-77171417151.bin

Step 5

If you are not already in global configuration mode, access global configuration mode:

Step 6

Show the current boot images configured (up to 4):

asa/act(config)# show running-config boot system
boot system disk0:/cdisk.bin
boot system disk0:/asa931-smp-k8.bin

Step 7

Remove any existing boot image configurations so that you can enter the new boot image as your first choice:

asa/act(config)# no boot system disk0:/cdisk.bin
asa/act(config)# no boot system disk0:/asa931-smp-k8.bin

Step 8

Set the ASA image to boot (the one you just uploaded):

asa/act(config)# boot system disk0://asa9-15-1-smp-k8.bin

Step 9

Set the ASDM image to use (the one you just uploaded):

asa/act(config)# asdm image disk0:/asdm-77171417151.bin

Step 10

Save the new settings to the startup configuration:

Step 11

If you are upgrading ASA FirePOWER modules, disable the ASA REST API or else the upgrade will fail.

Step 12

Upgrade the ASA FirePOWER module on the standby unit.

Step 13

Reload the standby unit to boot the new image:

Step 14

Force the active unit to fail over to the standby unit.

Step 15

Upgrade the ASA FirePOWER module on the former active unit.

Step 16

From the new active unit, reload the former active unit (now the new standby unit).

asa/act# failover reload-standby

Step 1

Launch ASDM on the standby unit by connecting to the standby IP address.

Step 2

In the main ASDM application window, choose Tools > Upgrade Software from Local Computer.

Step 3

From the Image to Upload drop-down list, choose ASDM.

Step 4

In the Local File Path field, enter the local path to the file on your computer or click Browse Local Files to find the file on your PC.

Step 5

In the Flash File System Path field, enter the path to the flash file system or click Browse Flash to find the directory or file in the flash file system.

Step 6

Click Upload Image. The uploading process might take a few minutes.

Step 7

Repeat these steps, choosing ASA from the Image to Upload drop-down list.

Step 8

Connect ASDM to the active unit by connecting to the main IP address, and upload the ASDM software, using the same file location you used on the standby unit.

Step 9

When you are prompted to set the image as the ASDM image, click Yes.

Step 10

Upload the ASA software, using the same file location you used for the standby unit.

Step 11

When you are prompted to set the image as the ASA image, click Yes.

Step 12

Click the Save icon on the toolbar to save your configuration changes.

Step 13

If you are upgrading ASA FirePOWER modules, disable the ASA REST API by choosing Tools > Command Line Interface, and entering no rest-api enable .

Step 14

Upgrade the ASA FirePOWER module on the standby unit.

Step 15

Reload the standby unit by choosing Monitoring > Properties > Failover > Status, and clicking Reload Standby.

Step 16

After the standby unit reloads, force the active unit to fail over to the standby unit by choosing Monitoring > Properties > Failover > Status, and clicking Make Standby.

Step 17

Upgrade the ASA FirePOWER module on the former active unit.

Step 18

Reload the (new) standby unit by choosing Monitoring > Properties > Failover > Status, and clicking Reload Standby.

Step 1

On the primary unit in privileged EXEC mode, copy the ASA software to flash memory:

asa/act/pri# copy ftp://jcrichton:aeryn@10.1.1.1/asa9-15-1-smp-k8.bin disk0:/asa9-15-1-smp-k8.bin

Step 2

Copy the software to the secondary unit; be sure to specify the same path as for the primary unit: