Installation Guidelines
These guidelines can prevent common reimage issues, but are not comprehensive. For detailed checklists and procedures, see the appropriate installation guide.
Backups
Before you reimage, we strongly recommend you back up to a secure remote location and verify transfer success. Reimaging returns most settings to factory defaults, including the system password. It deletes any backups left on the appliance.
 Note |
If you want to reimage so that you don't have to upgrade, due to version restrictions you cannot use a backup to import your old configurations. You must recreate your configurations manually. |
Appliance Access
If you do not have physical access to an appliance, reimaging to the current major or maintenance release lets you keep management network settings. This allows you to connect to the appliance after you reimage to perform the initial configuration. Note that if you delete network settings or if you reimage to an earlier release, you must have physical access to the appliance. You cannot use Lights-Out Management (LOM).
For devices, make sure traffic from your location does not have to traverse the device itself to access the device's management interface. In FMC deployments, you should also able to access the FMC's management interface without traversing the device.
Unregistering from Smart Software Manager
Before you reimage any appliance or switch device management, you may need to unregister from the Cisco Smart Software Manager (CSSM). This is to avoid accruing orphan entitlements, which can prevent you from reregistering.
Unregistering removes an appliance from your virtual account, unregisters it from the cloud and cloud services, and releases associated licenses so they can be can be reassigned. When you unregister an appliance, it enters Enforcement mode. Its current configuration and policies continue to work as-is, but you cannot make or deploy any changes.
If you plan to restore from backup, do not unregister before you reimage and do not remove devices from the FMC. Instead, manually revert any licensing changes made since you took the backup. After the restore completes, reconfigure licensing. If you notice licensing conflicts or orphan entitlements, contact Cisco TAC.
|
Scenario |
Action |
|---|---|
|
Reimage the FMC. |
Unregister manually. |
|
Model migration for the FMC. |
Unregister manually, before you shut down the source FMC. |
|
Reimage FTD with FMC. |
Unregister automatically, by removing the device from the FMC. |
|
Reimage FTD with FDM. |
Unregister manually. |
|
Switch FTD from FMC to FDM. |
Unregister automatically, by removing the device from the FMC. |
|
Switch FTD from device manager to FMC. |
Unregister manually. |
Removing Devices from the FMC
In FMC deployments, if you plan to manually configure the reimaged appliance, remove devices from the FMC before you reimage either. If you plan to restore from backup, you do not need to do this.
|
Scenario |
Action |
|---|---|
|
Reimage the FMC. |
Remove all devices from management. |
|
Reimage FTD. |
Remove the one device from management. |
|
Switch FTD from FMC to FDM. |
Remove the one device from management. |
Fully Reimaging FTD Hardware to Downgrade FXOS
For FTD hardware models that use the FXOS operating system, reimaging to an earlier software version may require a full reimage, regardless of whether FXOS is bundled with the software or upgraded separately.
|
Model |
Details |
|---|---|
|
Firepower 1000 series Firepower 2100 series Secure Firewall 3100 series |
If you use the erase configuration method to reimage, FXOS may not downgrade along with the software. This can cause failures, especially in high availability deployments. We recommend that you perform full reimages of these devices. |
|
Firepower 4100/9300 |
Reverting FTD does not downgrade FXOS. For the Firepower 4100/9300, major FTD versions have a specially qualified and recommended companion FXOS version. After you return to the earlier version of FTD, you may be running a non-recommended version of FXOS (too new). Although newer versions of FXOS are backwards compatible with older FTD versions, we do perform enhanced testing for the recommended combinations. You cannot manually downgrade FXOS, so if you find yourself in this situation and you want to run a recommended combination, you will need a full reimage. |
Feedback