PIX525 failover pair software upgrade 6.3 to 7.0

[cmazur]

In the past I had to do some powering down and disconnecting of cable to upgrade my pair of PIXs. The documentation now appears to say that I don't need to do this disconnecting. Is this true?

[m.singer]

I have not gone through the upgrade process yet. Does your PIX run in failover mode? I believe you can upgrade one by one (active and standby) without disrupting the user traffic.

[srue]

please see the following link BEFORE upgrading a failover set from 6.3(x) to 7.0(x)

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_70/pix_upgd/pixupgrd.htm#wp1374847

[mhoda]

Hello Chester,

Yes, with the introduction of version 7.x, it is possible. Please take a read at the following link:

http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_70/rel_nt/asa_rn.htm

Snippet -

Zero-Downtime Software Upgrades

This feature introduces the ability for customers to perform software upgrades of failover pairs without impacting network uptime or connections flowing through the units. Version 7.0 introduces the ability to do inter-version state sharing between security appliance failover pairs, allowing customers to perform software upgrades to maintenance releases (for example Version 7.0(1) upgrading to 7.0(2)) without impacting traffic flowing through the pair (in active/standby failover environments or Active/Active environments where the pair is not oversubscribed - more that 50% load on each pair member).

It is however important to note that if you want to upgrade from PIX 6.x to 7.x then there is downtime.

Thanks,

Mynul