The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
If an upgrade succeeds but the system does not function to your expectations, you may be able to return to the previous version:
Revert is for major and maintenance upgrades to FTD with FDM.
Uninstall is for patches in FMC and ASDM deployments.
If neither of these methods will work for you and you still need to return to an earlier version, you must reimage. Note that neither revert nor uninstall is supported for hotfixes. For failed upgrades, see Unresponsive Upgrades.
Reverting a major or maintenance upgrade returns the software to its state just before the upgrade, also called a snapshot. Reverting after patching necessarily removes patches as well. To revert a successful FTD upgrade with FDM, see the System Management chapter in the Cisco Firepower Threat Defense Configuration Guide for Firepower Device Manager, Version 7.0.
Uninstalling a patch returns you to the version you upgraded from, and does not change configurations. Because the FMC must run the same or newer version as its managed devices, uninstall patches from devices first.
Uninstalling specific patches can cause issues, even when the uninstall itself succeeds. These issues include:
Inability to deploy configuration changes after uninstall.
Incompatibilities between the operating system and the software.
FSIC (file system integrity check) failure when the appliance reboots, if you patched with security certifications compliance enabled (CC/UCAPL mode).
 Caution |
If security certifications compliance is enabled and the FSIC fails, the software does not start, remote SSH access is disabled, and you can access the appliance only via local console. If this happens, contact Cisco TAC. |
Uninstall is currently supported for all Version 7.0 patches.
In high availability/scalability deployments, minimize disruption by uninstalling from one appliance at a time. Unlike upgrade, the system does not do this for you. Wait until the patch has fully uninstalled from one unit before you move on to the next.
|
Configuration |
Uninstall Order |
|---|---|
|
FMC high availability |
With synchronization paused, which is a state called split-brain, uninstall from peers one at a time. Do not make or deploy configuration changes while the pair is split-brain.
|
|
Configuration |
Uninstall Order |
|---|---|
|
FTD high availability |
You cannot uninstall a patch from devices configured for high availability. You must break high availability first.
|
|
FTD cluster |
Uninstall from one unit at a time, leaving the control unit for last. Clustered units operate in maintenance mode while the patch uninstalls.
|
|
Configuration |
Uninstall Order |
|---|---|
|
ASA active/standby failover pair, with ASA FirePOWER |
Always uninstall from the standby.
|
|
ASA active/active failover pair, with ASA FirePOWER |
Make both failover groups active on the unit you are not uninstalling.
|
|
ASA cluster, with ASA FirePOWER |
Disable clustering on each unit before you uninstall. Uninstall from one unit at a time, leaving the control unit for last.
|
We recommend you use the web interface to uninstall FMC patches. If you cannot use the web interface, you can use the Linux shell as
either the admin user for the shell, or as an external user with
shell access. If you disabled shell access, contact Cisco TAC to reverse the lockdown.
Caution |
Do not make or deploy configuration changes during uninstall. Even if the system appears inactive, do not manually reboot, shut down, or restart an uninstall in progress. You could place the system in an unusable state and require a reimage. If you encounter issues with the uninstall, including a failed uninstall or unresponsive appliance, contact Cisco TAC. |
If uninstalling will put the FMC at a lower patch level than its managed devices, uninstall patches from the devices first.
Make sure your deployment is healthy and successfully communicating.
| Step 1 |
Deploy to managed devices whose configurations are out of date. Deploying before you uninstall reduces the chance of failure. |
| Step 2 |
Under Available Updates, click the Install icon next to the uninstall package, then choose the FMC. Patch uninstallers are named like upgrade packages, but have Patch_Uninstaller instead of Patch in the file name. When you patch the FMC, the uninstaller for that patch is automatically created. If the uninstaller is not there, contact Cisco TAC. |
| Step 3 |
Click Install, then confirm that you want to uninstall and reboot. You can monitor uninstall progress in the Message Center until you are logged out. |
| Step 4 |
Log back in when you can and verify uninstall success. If the system does not notify you of the uninstall's success when you log in, choose to display current software version information. |
| Step 5 |
Redeploy configurations to all managed devices. |
We recommend you use the web interface to uninstall FMC patches. If you cannot use the web interface, you can use the Linux shell as
either the admin user for the shell, or as an external user with
shell access. If you disabled shell access, contact Cisco TAC to reverse the lockdown.
Uninstall from high availability peers one at a time. With synchronization paused, first uninstall from the standby, then the active. When the standby starts the uninstall, its status switches from standby to active, so that both peers are active. This temporary state is called split-brain and is not supported except during upgrade and uninstall.
Caution |
Do not make or deploy configuration changes while the pair is split-brain. Your changes will be lost after you restart synchronization. Do not make or deploy configuration changes during uninstall. Even if the system appears inactive, do not manually reboot, shut down, or restart an uninstall in progress. You could place the system in an unusable state and require a reimage. If you encounter issues with the uninstall, including a failed uninstall or unresponsive appliance, contact Cisco TAC. |
If uninstalling will put the FMCs at a lower patch level than their managed devices, uninstall patches from the devices first.
Make sure your deployment is healthy and successfully communicating.
| Step 1 |
On the active FMC, deploy to managed devices whose configurations are out of date. Deploying before you uninstall reduces the chance of failure. |
| Step 2 |
On the active FMC, pause synchronization.
|
| Step 3 |
Uninstall the patch from peers one at a time — first the standby, then the active. Follow the instructions in Uninstall Standalone FMC Patches, but omit the initial deploy, stopping after you verify uninstall success on each peer. In summary, for each peer:
|
| Step 4 |
On the FMC you want to make the active peer, restart synchronization.
|
| Step 5 |
Redeploy configurations to all managed devices. |
Use the Linux shell (expert mode) to uninstall device patches. You must have
access to the device shell as the admin user for the device, or as
another local user with CLI configuration access. You cannot use an FMC user
account. If you disabled shell access, contact Cisco TAC to reverse the lockdown.
Caution |
Do not make or deploy configuration changes during uninstall. Even if the system appears inactive, do not manually reboot, shut down, or restart an uninstall in progress. You could place the system in an unusable state and require a reimage. If you encounter issues with the uninstall, including a failed uninstall or unresponsive appliance, contact Cisco TAC. |
Break FTD high availability pairs. In other high availability/scalability deployments, make sure you are uninstalling from the correct device; see Uninstall Order for High Availability/Scalability.
Make sure your deployment is healthy and successfully communicating.
| Step 1 |
If the device's configurations are out of date, deploy now from the FMC. Deploying before you uninstall reduces the chance of failure. Make sure the deployment and other essential tasks are completed. Tasks running when the uninstall begins are stopped, become failed tasks, and cannot be resumed. You can manually delete failed status messages later. Exception: Do not deploy to mixed-version clusters or high availability pairs. In a high availability/scalability deployment, deploy before you uninstall from the first unit, but then not again until you have uninstalled the patch from all units. |
||||||||
| Step 2 |
Access the Firepower CLI on the device. Log in as You can either SSH to the device's management interface (hostname or IP address) or use the console. If you use the console, some devices default to the operating system CLI, and require an extra step to access the Firepower CLI.
|
||||||||
| Step 3 |
Use the |
||||||||
| Step 4 |
Verify the uninstall package is in the upgrade directory.
Patch uninstallers are named like upgrade packages, but have Patch_Uninstaller instead of Patch in the file name. When you patch a device, the uninstaller for that patch is automatically created in the upgrade directory. If the uninstaller is not there, contact Cisco TAC. |
||||||||
| Step 5 |
Run the uninstall command, entering your password when prompted.
|
||||||||
| Step 6 |
Monitor the uninstall until you are logged out. For a detached uninstall, use
Otherwise, monitor progress in the console or terminal. |
||||||||
| Step 7 |
Verify uninstall success. After the uninstall completes, confirm that the device has the correct software version. On the FMC, choose . |
||||||||
| Step 8 |
Redeploy configurations. Exception: Do not deploy to mixed-version clusters or high availability pairs. Deploy only after you repeat this procedure for all units. |
In high availability/scalability deployments, repeat this procedure for each unit in your planned sequence. Then, make any final adjustments. For example:
For FTD high availability, reestablish high availability.
For FTD clusters, if you have preferred roles for specific devices, make those changes now.
Use the Linux shell (expert mode) to uninstall device patches. You must have
access to the device shell as the admin user for the device, or as
another local user with CLI configuration access. If you disabled shell access,
contact Cisco TAC to reverse the lockdown.
Caution |
Do not make or deploy configuration changes during uninstall. Even if the system appears inactive, do not manually reboot, shut down, or restart an uninstall in progress. You could place the system in an unusable state and require a reimage. If you encounter issues with the uninstall, including a failed uninstall or unresponsive appliance, contact Cisco TAC. |
In ASA failover/cluster deployments, make sure you are uninstalling from the correct device; see Uninstall Order for High Availability/Scalability.
Make sure your deployment is healthy and successfully communicating.
| Step 1 |
If the device's configurations are out of date, deploy now from ASDM. Deploying before you uninstall reduces the chance of failure. Make sure the deployment and other essential tasks are completed. Tasks running when the uninstall begins are stopped, become failed tasks, and cannot be resumed. You can manually delete failed status messages later. |
||
| Step 2 |
Access the Firepower CLI on the ASA FirePOWER module. Log in as
You can either SSH to the module's management interface (hostname or IP
address) or use the console. Note that the console port defaults to the ASA
CLI and you must use the |
||
| Step 3 |
Use the |
||
| Step 4 |
Verify the uninstall package is in the upgrade directory.
Patch uninstallers are named like upgrade packages, but have Patch_Uninstaller instead of Patch in the file name. When you patch a device, the uninstaller for that patch is automatically created in the upgrade directory. If the uninstaller is not there, contact Cisco TAC. |
||
| Step 5 |
Run the uninstall command, entering your password when prompted.
|
||
| Step 6 |
Monitor the uninstall until you are logged out. tail or tailf
to display logs:
Otherwise, monitor progress in the console or terminal. |
||
| Step 7 |
Verify uninstall success. After the uninstall completes, confirm that the module has the correct software version. Choose . |
||
| Step 8 |
Redeploy configurations. |
In ASA failover/cluster deployments, repeat this procedure for each unit in your planned sequence.
Feedback