cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
778
Views
0
Helpful
2
Replies

Upgrade FWSM 3.1(5) to 4.0(4)

Hi

This is a single context active/ standby pair. The standard procedure for upgrade is download image to both units and reload the primary and then the secondary before primary comes back. My concern is that if a problem occurs (say corrupt image) or something else, which means neither device comes back, we will have extended outage before we can down grade and roll back the configs.

Is it possible to do one unit at a time by setting "no failover" on both devices and then upgrading individually. If so, should we do the active or standby first. Also, will the reload cause failover to re-enable thus making this method not possible.

Many thanks in advance for any assistance and clarification - Steve

2 Replies 2

Kureli Sankar
Cisco Employee
Cisco Employee

Pls. read this thread.

https://supportforums.cisco.com/message/3018105;jsessionid=B99E020430685E26F1EA5913AB7EAB28.node0

You can also remove the "firewall" lines from the switch that hosts the secondary unit and reload the primary unit with the upgraded code.

This way you have a unit with an old image ready to go if something were to go wrong with the upgrade of the primary.

-KS

Just to clarify, this is the switch config:


firewall module 2 vlan-group 1,3,5
firewall vlan-group 1  595,602-605,620,621,627,726,795,818
svclc multiple-vlan-interfaces
svclc module 3 vlan-group 2,3,4,5
svclc vlan-group 2  622,625,626,999
svclc vlan-group 3  624
svclc vlan-group 4  184,534,635,640,734,736,737,749,750
svclc vlan-group 5  628,702,731,732,735,742

FWSM in mod 2 and ACE in mod 3

To ensure I only isolate the FWSM and not the ACE, you recommend:

"no firewall module 2 vlan-group 1,3,5"

Is that correct?

Thansk - Steve

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: