Prework
It is assumed that you have a active Cisco Support contract in place to cover your equipment.
To get the latest NXOS version, go to: https://software.cisco.com/download/home. Login and then browse to your specific firewall model. Then download the latest or your desired NXOS version.
Move the *.bin file to your TFTP server. Check out our Windows - Setup a TFTP Server article.
Update Process
Health Check
Verify that everything is healthy before proceeding. Verify standby is done reloading before rebooting active system. When the output says: "Standby Ready State," it is safe to reboot the active system.
Create a Backup Config
Before we get to ahead of ourselves, it is a good idea to create a backup of the startup config for both firewalls before we make any changes. To do this, use a console cable or SSH into the firewall, then run the following command:
Repeat the backup process on the second firewall.
Firmware Copy process
Engineers or Sys Admins like to leave an old copy of a firmware or config files on the firewalls storage. Cisco ASA firewalls usually have a ton of storage, so to play it safe, don't worry about cleaning this until you have completed the upgrade. You can use the following command to see the contents of the storage if you are curious though.
Alright, let's copy the bits over to the firewall. The format for the command is: copy source destination flash:. Type this from the console or SSH session on the firewall.
Copy over the OS *.bin files.
Copy over the VPN client installers.
Copy the new *.bin and *.pkg files to the second firewall.
Both firewalls should be running the same version when you are done.
Checksum Validation
After the file has been copied, please verify the checksum. The original checksum hash can be found on Cisco's website where you downloaded the firmware from.
Upgrade the Firmware
Only upgrade and reboot one firewall at a time to avoid interruptions of service.
Take note of the current version using this command.
Take note of location and filename of the currently loaded OS version.
Enter configure terminal mode then disable the current IOS from loading at boot. Specify the new IOS version that you want to load at the next boot. You will need to enter the file path in the commands.
Set the new *.bin files as the boot version.
Exit the configure terminal mode then use the shortcut wr to copy the running-config to the startup-config.
Are you ready for this? How exciting! Use the reload command to reboot the firewall. When you hit y on your keyboard, the system will reboot. It can take a few seconds for the screen to actually update though.
After the first firewall you updated is fully online, verify everything is healthy BEFORE proceeding to the second firewall. You can run this command on either or both firewalls if you like.
Verify standby is done reloading before rebooting active system. When the output says: "Standby Ready State," it is safe to reboot the active system.
Remember, when we are working with a pair of firewalls, when we execute one config change on the primary firewall, that config change is replicated to the second firewall. Thus, we do not need to repeat these config changes on the secondary firewall. However, we do need to reboot the secondary firewall for the new firmware to run as the active version. To reload the secondary firewall, run the following command:
After the second firewall is fully online, as before, verify everything is healthy. You can run this command on either or both firewalls if you like.
Lastly, we need to specify the new VPN client packages.
Cleanup
To validate our work, use the show version and show boot commands to verify you are now using the new ASA version and that the path to the file is correct.
As previously stated, often times there are old firmware versions or backup configs on the firewalls. Now is the time you can clean them up. This is by no means required, but at your discretion. Generally speaking, we opt to leave the old NXOS version on the firewall for a few weeks then we remove it (if we remember).
A cool trick on the ASA firewalls is that you can run commands from one firewall that will execute on the failover firewall by adding "failover exec mate" to the beginning of the command.
References
- https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/asa-appliance-asav.html#id_27294
- https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/asa-appliance-asav.html#id_58353
- https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/200107-ASA-9-x-Upgrade-a-Software-Image-using.html