ASA HA upgrade procedure

billmatthews · ‎01-07-2012

Hello,

I'll be upgrading an HA pair of ASA 5520s next week, and wanted to clarify the procedure. I read "Upgrading an Active/Standby Failover Configuration" at http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/admin_swconfig.html#wp1057338 which suggests placing the image on both units, updating boot statements, then issuing failover reload-standby.

But I was wondering if there's a way to a way to be a bit safer. I'd like to modify the standby unit, without affecting the config on the active. So I'd like to modify the boot statement on the standby without modifying the active config. That way incase there's a problem and the active reboots, it won't upgrade.

Can I modify the config on the standby without affecting the active?

Then I'd like to test the newly upgraded unit with our production traffic. Would that simply be no failover active, and then once the standby becomes active -- test traffic?

Once everything is okay, I would upgrade the second unit, and fail traffic back.

Thanks

Bill

varrao · ‎01-07-2012

Hi Bill,

What you can do is, change the boot parameter on the secondary first, reload the device, upgrade the secondary and then on the primary issue no failover active command, test it on the secondary first, if everything is fine then set boot parameter on the primary and upgrade it the same way.

Hope that helps,

Thanks,

Varun

Thanks,
Varun Rao

billmatthews · ‎01-10-2012

Thanks Varun, that worked -- with one small hiccup.

The secondary was running the new version, with the modified boot statement. But while we were working, the primary sync it's config to the secondary, overwriting the boot statement. I thought if the versions were different it wouldn't overwrite the config?

We manually put it back. But is there a way to temporarily stop config sync?

Thanks

varrao · ‎01-10-2012

Hi Bill,

That is the reason why we need to put the boot parameter on the devices together before upgrading, but if you dont want to then you would need to disable failover between them be either unplugging the cables or by issuing the command "no failover active", but then this type of method might include downtime as well.

Thanks,

Varun

Thanks,
Varun Rao