Asa 5525 with firepower Services upgrade

[vishal77]

Hello All,

Need to upgrade my ASA 5525-x with firepower Services managed by virtual FMC.

I have gathered compatibility matrix of between ASA and asa firepower Services.

Current Asa version 9.8(3) 

Target version 9.14(2)

Current FMC version 6.2.3

Target 6.6.4

Basically I need to know how can I start the upgrade like should I first upgrade the Asa then ASA firepower Services and at last FMC or like what ?

Please help to know in which order should I start my upgrade for succesful upgrade procedure.

[Rob Ingram]

@vishal77 

This link https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/firepower-fmc.html#topic_ilc_gx4_2bb states "If you manage the ASA FirePOWER module using the Firepower Management Center, then you need to upgrade the Management Center before you upgrade the module."

The steps at this link https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/asa-appliance-asav.html#topic_r5l_tt5_bbb instruct to upgrade the ASA then the Firepower Module.  

All of the steps to upgrade each component are in the links provided.

[vishal77]

Thank you rob for your reply.

• But if I upgrade the FMC to target version then won't it impact managebility of Asa through it. Also even if it's not able to manage the Asa then can I upgrade asa and firepower module via cli.

[Rob Ingram]

@vishal77 

No, FMC 6.6 can manage devices running 6.2.3

Table 3. FMC-Device Compatibility

FMC Version	Oldest Device Version You Can Manage
6.7.0 or any 6.7.x maintenance release	6.3.0
6.6.0 or any 6.6.x maintenance release	6.2.3

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/relnotes/firepower-release-notes-660/compatibility.html#id_88316

The links I provided shows you the steps to upgrade the ASA via CLI.

[vishal77]

Thank you rob.