Software Upgrade Guidelines

For your convenience, this document duplicates the critical and release-specific software upgrade guidelines published in the threat defense release notes. For FXOS upgrade guidelines for the Firepower 4100/9300, see Upgrade Guidelines for FXOS.


Important

You must still read the release notes, which can contain additional critical and version-specific information. For example, new and deprecated features can require pre- or post-upgrade configuration changes, or even prevent upgrade. Or, known issues (open bugs) can affect upgrade.

Minimum Version to Upgrade

Minimum Version to Upgrade

You can upgrade directly to Version 7.3, including maintenance releases, as follows.

Table 1. Minimum Version to Upgrade to Version 7.3

Platform

Minimum Version

Threat Defense

7.0

FXOS 2.13.0.198 is required for the Firepower 4100/9300. In most cases, we recommend you use the latest FXOS build in each major version. To help you decide, see the Cisco Firepower 4100/9300 FXOS Release Notes, 2.13.

Minimum Version to Patch

Patches change the fourth digit only. You cannot upgrade directly to a patch from a previous major or maintenance release.

Upgrade Guidelines for Version 7.3

These checklists provide new and/or previously published upgrade guidelines that may apply to you.

Table 2. Upgrade Guidelines for Threat Defense with Device Manager Version 7.3

✓

Guideline

Platforms

Upgrading From

Directly To

Cisco Secure Firewall Device Manager New Features by Release, for new and deprecated features that have upgrade impact. Check all versions between your current and target version.

Any

Any

Any

Cisco Secure Firewall Threat Defense Release Notes, in the Open and Resolved Bugs chapter, for bugs that have upgrade impact. Check all versions of the release notes between your current and target version.

Any

Any

Any

Minimum Version to Upgrade

Any

Any

Any

Upgrade Guidelines for FXOS

Firepower 4100/9300

Any

Any

Unresponsive Upgrades

Do not make or deploy configuration changes during upgrade. Even if the system appears inactive, do not manually reboot or shut down during upgrade. You could place the system in an unusable state and require a reimage.

For major and maintenance upgrades, you can manually cancel failed or in-progress upgrades, and retry failed upgrades. Use the System Upgrade panel or the threat defense CLI. Note that this feature is only supported for upgrades from (not to) Version 6.7.0 or later.


Note

By default, threat defense automatically reverts to its pre-upgrade state upon upgrade failure ("auto-cancel"). To be able to manually cancel or retry a failed upgrade, disable the auto-cancel option when you initiate the upgrade. Auto-cancel is not supported for patches. In a high availability deployment, auto-cancel applies to each device individually. That is, if the upgrade fails on one device, only that device is reverted.

This feature is not supported for patches or for upgrades from Version 6.6 and earlier.

Traffic Flow and Inspection for Threat Defense Upgrades

Software Upgrades

Traffic is dropped while you upgrade. In a high availability deployment, you can minimize disruption by upgrading devices one at a time.

For the ISA 3000 only, if you configured hardware bypass for power failure, traffic is dropped during the upgrade but is passed without inspection while the device completes its post-upgrade reboot.

Software Revert (Major/Maintenance Releases)

Traffic is dropped while you revert. In a high availability deployment, revert is more successful when you revert both units simultaneously. Traffic flow and inspection resume when the first unit comes back online.

Deploying Configuration Changes

Restarting the Snort process briefly interrupts traffic flow and inspection on all devices, including those configured for high availability. When you deploy without restarting Snort, resource demands may result in a small number of packets dropping without inspection.

Snort typically restarts during the first deployment immediately after the upgrade. It does not restart during other deployments unless, before deploying, you modify specific policy or device configurations.

Time and Disk Space Tests

For reference purposes, we provide reports of in-house time and disk space tests for software upgrades.

Time Tests

We report the slowest tested time of all software upgrades tested on a particular platform/series. Your upgrade will likely take longer than the provided times for multiple reasons, as explained in the following table. We recommend you track and record your own upgrade times so you can use them as future benchmarks.


Caution

Do not make or deploy configuration changes during upgrade. Even if the system appears inactive, do not manually reboot or shut down. In most cases, do not restart an upgrade in progress. You could place the system in an unusable state and require a reimage. If you encounter issues with the upgrade, including a failed upgrade or unresponsive appliance, see Unresponsive Upgrades.
Table 3. Time Test Conditions for Software Upgrades

Condition

Details

Deployment

Times for device upgrades are from tests in a management center deployments. Raw upgrade times for remotely and locally managed devices are similar, given similar conditions.

Versions

For major and maintenance releases, we test upgrades from all eligible previous major versions. For patches, we test upgrades from the base version. Upgrade time usually increases if your upgrade skips versions.

Models

In most cases, we test on the lowest-end models in each series, and sometimes on multiple models in a series.

Virtual appliances

We test with the default settings for memory and resources. However, note that upgrade time in virtual deployments is highly hardware dependent.

High availability/scalability

Unless otherwise noted, we test on standalone devices.

In a high availability configuration, devices upgrade one at a time to preserve continuity of operations, with each device operating in maintenance mode while it upgrades. Upgrading a device pair, therefore, takes longer than upgrading a standalone device.

Configurations

We test on appliances with minimal configurations and traffic load.

Upgrade time can increase with the complexity of your configurations and whether/how those things are affected by the upgrade. For example, if you use a lot of access control rules and the upgrade needs to make a backend change to how those rules are stored, the upgrade can take longer.

Components

We report times for the software upgrade itself and the subsequent reboot only. This does not include time for operating system upgrades, transferring upgrade packages, readiness checks, VDB and intrusion rule (SRU/LSP) updates, or deploying configurations.

Disk Space Tests

We report the most disk space used of all software upgrades tested on a particular platform/series. This includes the space needed to copy the upgrade package to the device.

We also report the space needed on the management center (in either /Volume or /var) for the device upgrade package. If you are using device manager, ignore those values.

When we report disk space estimates for a particular location (for example, /var or /ngfw), we are reporting the disk space estimate for the partition mounted in that location. On some platforms, these locations may be on the same partition.

Without enough free disk space, the upgrade fails.

To check disk space, use the show disk CLI command.

Time and Disk Space for Version 7.3.1

Table 4. Time and Disk Space for Version 7.3.1

Platform

Space in /Volume

Space in /

Space on Mgmt Ctr

Upgrade Time

Reboot Time

Firepower 1000 series

—

7.8 GB in /ngfw

930 MB

17 min

18 min

Firepower 2100 series

—

8.1 GB in /ngfw

1.0 GB

12 min

20 min

Secure Firewall 3100 series

—

10.8 GB in /ngfw

1.3 GB

9 min

27 min

Firepower 4100 series

—

8.4 GB in /ngfw

940 MB

12 min

14 min

Firepower 9300

—

8.1 GB in /ngfw

940 MB

13 min

15 min

ISA 3000

5.9 GB in /ngfw/var

410 MB in /ngfw/bin

1.1 GB

29 min

27 min

Threat Defense Virtual: VMware

6.1 GB in /ngfw/var

380 MB in /ngfw/bin

1.1 GB

18 min

16 min

Time and Disk Space for Version 7.3.0

Table 5. Time and Disk Space for Version 7.3.0

Platform

Space in /Volume

Space in /

Space on Mgmt Ctr

Upgrade Time

Reboot Time

Firepower 1000 series

—

7.1 GB in /ngfw

930 MB

17 min

19 min

Firepower 2100 series

—

7.4 GB in /ngfw

1.0 GB

12 min

17 min

Secure Firewall 3100 series

—

9.8 GB in /ngfw

1.3 GB

7 min

17 min

Firepower 4100 series

—

8.0 GB in /ngfw

940 MB

12 min

8 min

Firepower 9300

—

11.1 GB in /ngfw

940 MB

11 min

12 min

ISA 3000

9.5 GB in /ngfw/var

270 KB in /ngfw/bin

1.1 GB

22 min

8 min

Threat Defense Virtual: VMware

400 MB in /ngfw/var

350 KB in /ngfw/bin

1.1 GB

10 min

9 min