Upgrade FWSM 3.1(5) to 4.0(4)

Unanswered Question
Feb 17th, 2010
User Badges:


This is a single context active/ standby pair. The standard procedure for upgrade is download image to both units and reload the primary and then the secondary before primary comes back. My concern is that if a problem occurs (say corrupt image) or something else, which means neither device comes back, we will have extended outage before we can down grade and roll back the configs.

Is it possible to do one unit at a time by setting "no failover" on both devices and then upgrading individually. If so, should we do the active or standby first. Also, will the reload cause failover to re-enable thus making this method not possible.

Many thanks in advance for any assistance and clarification - Steve

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Kureli Sankar Wed, 02/17/2010 - 05:52
User Badges:
  • Cisco Employee,

Pls. read this thread.


You can also remove the "firewall" lines from the switch that hosts the secondary unit and reload the primary unit with the upgraded code.

This way you have a unit with an old image ready to go if something were to go wrong with the upgrade of the primary.


azzu-supportservices Thu, 02/18/2010 - 03:28
User Badges:

Just to clarify, this is the switch config:

firewall module 2 vlan-group 1,3,5
firewall vlan-group 1  595,602-605,620,621,627,726,795,818
svclc multiple-vlan-interfaces
svclc module 3 vlan-group 2,3,4,5
svclc vlan-group 2  622,625,626,999
svclc vlan-group 3  624
svclc vlan-group 4  184,534,635,640,734,736,737,749,750
svclc vlan-group 5  628,702,731,732,735,742

FWSM in mod 2 and ACE in mod 3

To ensure I only isolate the FWSM and not the ACE, you recommend:

"no firewall module 2 vlan-group 1,3,5"

Is that correct?

Thansk - Steve


This Discussion