Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

Upgrade FWSM 3.1(5) to 4.0(4)


This is a single context active/ standby pair. The standard procedure for upgrade is download image to both units and reload the primary and then the secondary before primary comes back. My concern is that if a problem occurs (say corrupt image) or something else, which means neither device comes back, we will have extended outage before we can down grade and roll back the configs.

Is it possible to do one unit at a time by setting "no failover" on both devices and then upgrading individually. If so, should we do the active or standby first. Also, will the reload cause failover to re-enable thus making this method not possible.

Many thanks in advance for any assistance and clarification - Steve

Cisco Employee

Re: Upgrade FWSM 3.1(5) to 4.0(4)

Pls. read this thread.;jsessionid=B99E020430685E26F1EA5913AB7EAB28.node0

You can also remove the "firewall" lines from the switch that hosts the secondary unit and reload the primary unit with the upgraded code.

This way you have a unit with an old image ready to go if something were to go wrong with the upgrade of the primary.


Re: Upgrade FWSM 3.1(5) to 4.0(4)

Just to clarify, this is the switch config:

firewall module 2 vlan-group 1,3,5
firewall vlan-group 1  595,602-605,620,621,627,726,795,818
svclc multiple-vlan-interfaces
svclc module 3 vlan-group 2,3,4,5
svclc vlan-group 2  622,625,626,999
svclc vlan-group 3  624
svclc vlan-group 4  184,534,635,640,734,736,737,749,750
svclc vlan-group 5  628,702,731,732,735,742

FWSM in mod 2 and ACE in mod 3

To ensure I only isolate the FWSM and not the ACE, you recommend:

"no firewall module 2 vlan-group 1,3,5"

Is that correct?

Thansk - Steve