Ironport Always recommends you disconnect a machine from the cluster before performing an upgrade. This will allow other remaining machine to function as normal while the one upgrades and in case there might be problem with the unit during the upgrade process.
So I would recommend:
1. disconnect from machine1 from cluster [Clusterconfig - disconnect] no need to commit
- optional do a [suspendlistener] if your network allows other cluster member to continue functioning
2. perform upgrade -ignore warning about disconnecting other cluster members
3. and when machine is done it will ask you to restart , confirm and its back up (operational) use the resume command if you suspended the listener earlier
4. disconnect the second machine and follow the above procedure
5. After all machine have been upgrade just issue the clusterconfig - reconnect commands
*I would advice to make any changes on the config during this process as they will not be syncronised.
When you disconnect a machine from the cluster it does not lose configuration. It will carry on processing mails even when performing the upgrade. After upgrade is done and it needs to reboot, will it not process mails until it completely restarts. Make sure it comes back up and is processing mails fine before you disconnect the second box2.
I fmails have started flowing on box1, then disconnect box2 from cluster and start the upgrade process there.
Remember they need to be upgraded to the same asyncOS version (including build). for clustering to work.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...