Upgrade Cisco Secure Firewall Threat Defense on an FPR-3110 Using FDM
Introduction#
This article documents a Cisco Secure Firewall Threat Defense (FTD) software upgrade performed through the local Cisco Secure Firewall Device Manager (FDM) web interface.
The lab upgrade started on software build 7.2.8-25 and completed on 7.6.6-115. The procedure uses the FDM graphical interface; no CLI session was part of this lab.
Cisco Documentation#
- Cisco Secure Firewall Threat Defense Upgrade Guide for Device Manager
- Cisco Secure Firewall Threat Defense Release Notes, Version 7.6.x
Check the upgrade guide, release notes, and compatibility information for the exact device and software versions before repeating this procedure in another environment.
Lab Environment#
| Component | Lab details |
|---|---|
| Appliance SKU | FPR-3110-NGFW-K9 |
| Device shown in FDM | Cisco Secure Firewall 3110 Threat Defense |
| Management | FDM, managed locally |
| Starting software | 7.2.8-25 |
| Target software | 7.6.6-115 |
| Upgrade package | Cisco_FTD_SSP_FP3K_Upgrade-7.6.6-115.sh.REL.tar |
Prerequisites#
- Sign in to the FDM dashboard for the locally managed device.
- Download the upgrade package from Cisco Software Download.
- Before uploading, compare the package's SHA and MD5 values with the values published by Cisco.
- Deploy pending FDM configuration changes before beginning the software upgrade.
Upgrade Procedure#
1. Confirm the current FTD version
Open the FDM dashboard and confirm the appliance and current software build before starting. The lab dashboard shows the Cisco Secure Firewall 3110 running build 7.2.8-25.
Figure 1. Initial FDM dashboard and current FTD software build.
2. Deploy pending FDM changes
Complete the pending FDM deployment before starting the operating system upgrade. Wait for the deployment to finish.
Figure 2. FDM shows the initial deployment in progress.
Confirm that the deployment completed and that there are no pending changes.
Figure 3. FDM shows no pending changes after the deployment.
3. Open the software update page
In FDM, open Device Summary > Updates and locate the System Upgrade section. Confirm that the current version shown there is 7.2.8-25.
Figure 4. System Upgrade section in the FDM Updates page.
4. Upload the upgrade package
Select the upgrade package downloaded from Cisco Software Download and upload it to FDM. In this lab, the uploaded file is:
Cisco_FTD_SSP_FP3K_Upgrade-7.6.6-115.sh.REL.tar
Verify the SHA and MD5 values against Cisco's published values before uploading the file.
Figure 5. The 7.6.6-115 upgrade package selected for upload.
Review the upload confirmation. In this lab, Run Upgrade immediately on upload is unchecked, so the package is uploaded and staged before the readiness check.
Figure 6. Upload confirmation; the immediate-upgrade option is unchecked.
5. Run the readiness check
Start the readiness check for the staged upgrade package and wait for it to finish. Do not proceed until FDM reports a successful precheck.
Figure 7. The readiness check is still running.
The lab readiness check completed with Precheck Success. FDM also indicates that a reboot is required.
Figure 8. Readiness check completed successfully for the target build.
6. Review and start the upgrade
Select Upgrade Now after the successful readiness check. Review the confirmation dialog before continuing.
The lab dialog has Automatically cancel on upgrade failure and roll back to previous version selected. The dialog also warns that FDM will log out and the device will reboot automatically. Continue to start the upgrade.
Figure 9. Upgrade confirmation dialog; automatic rollback on failure is selected.
7. Monitor the upgrade
After the upgrade begins, FDM reports that the session will be logged out while the process runs.
Figure 10. FDM indicates that the upgrade is starting and the session will be logged out.
Allow the upgrade to continue. Do not power off or manually reboot the appliance during the process. In the captured progress screen, the upgrade is at 9% with 42 minutes remaining.
Figure 11. Upgrade progress shown at 9%, with an estimated 42 minutes remaining.
8. Verify the upgraded version
After FDM becomes available again, return to the dashboard and confirm the software version. The post-upgrade dashboard shows build 7.6.6-115.
Figure 12. Post-upgrade FDM dashboard showing FTD build 7.6.6-115.
Issues and Resolution#
The supplied timeline and screenshots do not show a failed readiness check or an upgrade error. The captured readiness check completed with Precheck Success, and the final dashboard shows the target software build.
Security and Operational Notes#
- Use the upgrade package from Cisco Software Download and verify its SHA and MD5 values against Cisco's published values before upload.
- The FDM confirmation dialog warns that the session ends and the appliance reboots automatically during the upgrade.
- Do not run a system restore, manually reboot, or power off the device while the upgrade is in progress, as stated in the FDM confirmation dialog.
- The automatic rollback option was selected in this lab. The captures do not show a rollback being exercised.
Conclusion#
The FPR-3110-NGFW-K9 was upgraded through the local FDM interface from FTD 7.2.8-25 to 7.6.6-115. The FDM dashboard after the upgrade confirms the target build.