Prepration for ASA Firewall Firmware Upgrade
Before upgrading the ASA, you should perform the following preparation:
- Check compatibility between different versions of operating systems; for example, make sure that the ASA version is compatible with the ASA Firepower module version.
- Check the upgrade path for the current version to the target version; ensure you plan for any intermediate versions required for each operating system.
- Check for guidelines and limitations that affect your intermediate and target versions, or that affect failover and clustering zero downtime upgrading.
- Download all software packages required from Cisco.com.
- Back up your configurations, especially if there is a configuration migration.
ASA Firewall Firmware Upgrade – Steps
Upgrading the firmware on a Cisco ASA (Adaptive Security Appliance) firewall involves several steps to ensure a smooth and successful update process. Here’s a summary of the key steps:
Step 1: Check current running version of ASA and ASDM.
Go to device and type command “Show version”
It will show the ASA and ASDM version as above.
You can also check available images in device itself
“Show Disk0:”
It will show all available images
Check on ASDM > Tools > File Management
Step 2: Check the latest release from Cisco. Always check with cisco TAC for stable version.
Note: Please always refer release notes for know errors and bug fixes.
Follow the ASA upgrade path
https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/planning.html#id_59039
Need to check following:
- Any interim version requires to upgrade from current to proposed version or you can directly go to proposed version
- Any configuration migration requires or not
Note: This only require if you are going for major release changes like, 8.x to 9.x version
- ASDM version compatibility with proposed version.
Step 3: Once you finalize the target version of ASA and ASDM, download the latest images from the cisco portal.
https://software.cisco.com/download/home
Select a Product -> enter ASA – > Select Adaptive Security Appliances
Select product model (I’m using the ASA virtual appliances)
click on ASA software to download latest version of ASA software image.
Or click on ASA Device Manager to download ASDM image
Download the .bin file
Hover the file and copy MD5 checksum for intigrity checks in later part.Download ASDM image
Download ASDM image
Step 4: Upload images to device
Note: Please upload same image on both the devices if it is in HA mode
- Using CLI
You can upload images using the CLI, you need TFTP, FTP and HTTP server in case of if you are uploading the images using the CLI.
In privileged EXEC mode, copy the ASA software to flash memory.
Copy ftp://[[user[:password]@]server[/path]/asa_image_name diskn:/[path/]asa_image_name
Via ASDM
Tools > File Management > File transfer > Between > Between Local PC and Flash
to check image integrity, you can run below command
verify /md5 disk0:/image name
Compare the MD5 checksum with provided checksum. If it not matching with Cisco image checksum it means image is got corrupted, please remove the file and upload new image.
Set Boot Image
To check boot image “show running-config boot system”
To set new boot image “boot system disk0:/image name”
Set ASDM image if require
asdm image diskn:/[path/]asdm_image_name
You can only configure one ASDM image to use; in this case, you do not need to first remove the existing configuration.
Example:
ciscoasa(config)# asdm image disk0:/asdm-7141.bin
To apply new image, reload your firewall after reload you can see new image has been successfully install on this ASA firewall.
Additional Considerations – ASA Firewall Firmware Upgrade
- Release Notes: Always review the release notes for the new firmware version to understand new features, bug fixes, and any potential issues.
- Maintenance Window: Perform the upgrade during a maintenance window to minimize disruption, as the ASA will reboot during the process.
- Rollback Plan: Have a rollback plan in place in case the new firmware causes issues, which may involve restoring the previous configuration or reloading the previous firmware image.
By following these steps, you can ensure a smooth firmware upgrade process for your Cisco ASA firewall, enhancing its performance and security with the latest updates.
ASA Firewall Firmware Upgrade – Release Notes
Useful Links
Your feedback matters
Was this post helpful?
Discussion
0 approved comments
No approved comments yet. You can start the discussion below.
Leave a Comment
No login is required. Name and email are used for moderation/security. Your email is never displayed publicly. All comments require administrator approval.
Discover more from SanchitGurukul
Subscribe to get the latest posts sent to your email.
