I am upgrading a failover set, two 535s from 6.1(4) to 6.3.3. My Secondary is licensed to run in failover secondary mode only. I concerned that if I take both devices down and disconnect the failover links the Secondary will become a toaster when it boots. TAC has told me that I have 24 hours before my Secondary will hose without talking to the Primary. If anyone has some insight please pass it along. I would hate to be hit with cold reality at 4 AM.
Cisco probably does not recommend this but you asked for some insight so here it goes. Depending on the location on the firewalls, in the past I have uploaded the IOS to the primary PIX. After that is done, Upload the IOS to the failover PIX. At this point, both firewalls have the correct IOS there just waiting to be rebooted. Reeboot the primary, the failover takes over and starts passing traffic. Wait about 15 or 20 seconds and reboot the failover. Just about that time the primary will come back up and be running the new IOS. A few seconds later the failover comes back and has the new IOS. If you time it correctly (or if you have a console to the primary PIX) your downtime should be very little and both your firewalls will be upgraded. Like I said before, this probably is not recommended by Cisco but you wanted some insight.
BenefitsDocumentationPrerequisiteImage Download LinksLimitationsSupported PlatformsLicense RequirementsTopologyStep-By-Step ConfigurationConfigure Virtual ServiceActivate the virtual service and configure guest IPsConfiguring UTD (Service Plane)Configurin...
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...