392015 UpgradetoASA9.5andASDM7.

5Cisco

Oursiteusescookiessomeareessentialtomakethesiteworkothershelpusimprovetheuserexperience.Byusingthesite,youconsenttotheuseof
thesecookies.Tolearnmoreaboutcookiesandhowyoucandisablethem,pleasereadourprivacystatement.

UpgradetoASA9.5andASDM7.5
Updated: Aug12,2015

TableofContents
UpgradetoASA9.5andASDM7.5
UpgradePath
ViewYourCurrentVersion
DownloadtheSoftwarefromCisco.com
UpgradeaStandaloneUnit
(CLI)UpgradeUsingtheCLI
(ASDM)UpgradefromYourLocalComputer
(ASDM)UpgradeUsingtheCisco.comWizard
UpgradeaFailoverPairorASACluster
UpgradeanActive/StandbyFailoverPair
CLI
ASDM
UpgradeanActive/ActiveFailoverPair
CLI
ASDM
UpgradeanASACluster
CLI
ASDM

UpgradetoASA9.5andASDM7.5
FirstPublished:August12,2015

UpgradePath
ViewYourCurrentVersion
DownloadtheSoftwarefromCisco.com
UpgradeaStandaloneUnit
UpgradeaFailoverPairorASACluster
UpgradePath
Seethefollowingtablefortheupgradepathforyourversion.Someversionsrequireaninterimupgradebeforeyoucan
upgradetothelatestversion.

Note :TherearenospecialrequirementsforZeroDowntimeUpgradesforfailoverandASAclusteringwiththefollowing
exception.UpgradingASAclusteringfrom9.0(1)or9.1(1):duetoCSCue72961,hitlessupgradingisnotsupported.

CurrentASAVersion FirstUpgradeto: ThenUpgradeto:

8.2(x) 8.4(6) 9.5(1)orlater

8.3(x) 8.4(6) 9.5(1)orlater

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/upgrade/upgrade95.html 1/12
392015 UpgradetoASA9.5andASDM7.5Cisco

8.4(1)through8.4(4) 8.4(6),9.0(4),or9.1(2) 9.5(1)orlater

8.4(5)andlater 9.5(1)orlater

8.5(1) 9.0(4)or9.1(2) 9.5(1)orlater

8.6(1) 9.0(4)or9.1(2) 9.5(1)orlater

9.0(1) 9.0(4)or9.1(2) 9.5(1)orlater

9.0(2)orlater 9.5(1)orlater

9.1(1) 9.1(2) 9.5(1)orlater

9.1(2)orlater 9.5(1)orlater

9.2(x) 9.5(1)orlater

9.3(x) 9.5(1)orlater

9.4(x) 9.5(1)orlater

ConfigurationMigration

Dependingonyourcurrentversion,youmightexperienceoneormoreconfigurationmigrationswhenyouupgrade.For
example,whenupgradingfrom8.2to9.5,youwillexperienceallofthesemigrations:

8.3SeetheCiscoASA5500MigrationGuidetoVersion8.3.
8.4Seethe8.4upgradeguide.
9.0Seethe9.0upgradeguide.

ViewYourCurrentVersion
(CLI)UsetheshowversioncommandtoverifythesoftwareversionofyourASA.(ASDM)Thesoftwareversionappearsonthe
ASDMhomepageviewthehomepagetoverifythesoftwareversionofyourASA.

DownloadtheSoftwarefromCisco.com
IfyouareusingtheASDMUpgradeWizard,youdonothavetopredownloadthesoftware.Ifyouaremanuallyupgrading,for
exampleforafailoverupgrade,downloadtheimagestoyourlocalcomputer.

IfyouhaveaCisco.comlogin,youcanobtaintheOSandASDMimagesfromthefollowingwebsite:

http://www.cisco.com/go/asasoftware

(CLI)ThisprocedureassumesyouputtheimagesonaTFTPserver,althoughotherservertypesaresupported.

UpgradeaStandaloneUnit
ThissectiondescribeshowtoinstalltheASDMandoperatingsystem(OS)images.

(CLI)UpgradeUsingtheCLI
(ASDM)UpgradefromYourLocalComputer
(ASDM)UpgradeUsingtheCisco.comWizard

(CLI)UpgradeUsingtheCLI

ThisprocedureusesTFTP.ForFTPorHTTP,seethecopycommand.

Procedure

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/upgrade/upgrade95.html 2/12
392015 UpgradetoASA9.5andASDM7.5Cisco

1. (Ifthereisaconfigurationmigration)Showtheconfigurationontheterminalsothatyoucanbackupyourconfiguration:
moresystem:runningconfig
Copytheoutputfromthiscommand,thenpastetheconfigurationintoatextfile.Forothermethodsofbackingup,seethe
configurationguide.
2. CopytheASAsoftwaretotheactiveunitflashmemory:
copytftp://server[/path]/asa_image_name{disk0:/|disk1:/}[path/]asa_image_name
Example:
ciscoasa#copytftp://10.1.1.1/asa951smpk8.bindisk0:/asa951smpk8.bin
ForothermethodsthanTFTP,seethecopycommand.
3. CopytheASDMimagetotheactiveunitflashmemory:
copytftp://server[/path]/asdm_image_name{disk0:/|disk1:/}[path/]asdm_image_name
Example:
ciscoasa#copytftp://10.1.1.1/,asdm751.bindisk0:/asdm751.bin
4. Ifyouarenotalreadyinglobalconfigurationmode,accessglobalconfigurationmode:
configureterminal
5. Showthecurrentbootimagesconfigured(upto4):
showrunningconfigbootsystem
Example:
ciscoasa(config)#showrunningconfigbootsystem
bootsystemdisk0:/cdisk.bin
bootsystemdisk0:/asa914smpk8.bin
TheASAusestheimagesintheorderlistedifthefirstimageisunavailable,thenextimageisused,andsoon.Youcannot
insertanewimageURLatthetopofthelisttospecifythenewimagetobefirst,youmustremoveanyexistingentries,and
entertheimageURLsintheorderdesired,accordingto6.and7..
6. Removeanyexistingbootimageconfigurationssothatyoucanenterthenewbootimageasyourfirstchoice:
nobootsystem{disk0:/|disk1:/}[path/]asa_image_name
Example:
ciscoasa(config)#nobootsystemdisk0:/cdisk.bin
ciscoasa(config)#nobootsystemdisk0:/asa914smpk8.bin
7. SettheASAimagetoboot(theoneyoujustuploaded):
bootsystem{disk0:/|disk1:/}[path/]asa_image_name
Example:
ciscoasa(config)#bootsystemdisk0://asa951smpk8.bin
Repeatthiscommandforanybackupimagesthatyouwanttouseincasethisimageisunavailable.Forexample,youcan
reentertheimagesthatyoupreviouslyremovedin6..
8. SettheASDMimagetouse(theoneyoujustuploaded):
asdmimage{disk0:/|disk1:/}[path/]asdm_image_name
Example:
ciscoasa(config)#asdmimagedisk0:/asdm751.bin
YoucanonlyconfigureoneASDMimagetouse,soyoudonotneedtofirstremovetheexistingconfiguration.
9. Savethenewsettingstothestartupconfiguration:
writememory
10. ReloadtheASA:
reload

(ASDM)UpgradefromYourLocalComputer

TheUpgradeSoftwarefromLocalComputertoolletsyouuploadanimagefilefromyourcomputertotheflashfilesystemto
upgradetheASA.

Procedure
1. (Ifthereisaconfigurationmigration)InASDM,backupyourexistingconfigurationusingtheTools>Backup
Configurationstool.
2. InthemainASDMapplicationwindow,chooseTools>UpgradeSoftwarefromLocalComputer.
TheUpgradeSoftwaredialogboxappears.
http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/upgrade/upgrade95.html 3/12
392015 UpgradetoASA9.5andASDM7.5Cisco

3. FromtheImagetoUploaddropdownlist,chooseASDM.
4. IntheLocalFilePathfield,enterthelocalpathtothefileonyourcomputerorclickBrowseLocalFilestofindthefileon
yourPC.
5. IntheFlashFileSystemPathfield,enterthepathtotheflashfilesystemorclickBrowseFlashtofindthedirectoryor
fileintheflashfilesystem.
6. ClickUploadImage.Theuploadingprocessmighttakeafewminutes.
7. YouarepromptedtosetthisimageastheASDMimage.ClickYes.
8. YouareremindedtoexitASDMandsavetheconfiguration.ClickOK.YouexittheUpgradetool.Note:Youwillsavethe
configurationandreloadASDMafteryouupgradetheASAsoftware.
9. Repeat2.through8.,choosingASAfromtheImagetoUploaddropdownlist.Youcanalsousethisproceduretoupload
otherfiletypes.
10. ChooseTools>SystemReloadtoreloadtheASA.
Anewwindowappearsthatasksyoutoverifythedetailsofthereload.
a. ClicktheSavetherunningconfigurationatthetimeofreloadradiobutton(thedefault).
b. Chooseatimetoreload(forexample,Now,thedefault).
c. ClickScheduleReload.
Oncethereloadisinprogress,aReloadStatuswindowappearsthatindicatesthatareloadisbeingperformed.Anoption
toexitASDMisalsoprovided.
11. AftertheASAreloads,restartASDM.

(ASDM)UpgradeUsingtheCisco.comWizard

TheUpgradeSoftwarefromCisco.comWizardletsyouautomaticallyupgradetheASDMandASAtomorecurrentversions.

Inthiswizard,youcandothefollowing:

ChooseanASAimagefileand/orASDMimagefiletoupgrade.
Note :ASDMdownloadsthelatestimageversion,whichincludesthebuildnumber.Forexample,ifyouaredownloading
9.4(1),thedownloadmightbe9.4(1.2).Thisbehaviorisexpected,soyoumayproceedwiththeplannedupgrade.
Reviewtheupgradechangesthatyouhavemade.
Downloadtheimageorimagesandinstallthem.
Reviewthestatusoftheinstallation.
Iftheinstallationcompletedsuccessfully,restarttheASAtosavetheconfigurationandcompletetheupgrade.
Procedure
1. (Ifthereisaconfigurationmigration)InASDM,backupyourexistingconfigurationusingtheTools>Backup
Configurationstool.
2. ChooseTools>CheckforASA/ASDMUpdates.
Inmultiplecontextmode,accessthismenufromtheSystem.
TheCisco.comAuthenticationdialogboxappears.
3. EnteryourCisco.comusernameandpassword,andthenclickLogin.
TheCisco.comUpgradeWizardappears.
Note:Ifthereisnoupgradeavailable,adialogboxappears.ClickOKtoexitthewizard.
4. ClickNexttodisplaytheSelectSoftwarescreen.
ThecurrentASAversionandASDMversionappear.
5. ToupgradetheASAversionandASDMversion,performthefollowingsteps:
a. IntheASAarea,checktheUpgradetocheckbox,andthenchooseanASAversiontowhichyouwanttoupgradefrom
thedropdownlist.
b. IntheASDMarea,checktheUpgradetocheckbox,andthenchooseanASDMversiontowhichyouwanttoupgrade
fromthedropdownlist.
6. ClickNexttodisplaytheReviewChangesscreen.
7. Verifythefollowingitems:
TheASAimagefileand/orASDMimagefilethatyouhavedownloadedarethecorrectones.
TheASAimagefileand/orASDMimagefilethatyouwanttouploadarethecorrectones.
http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/upgrade/upgrade95.html 4/12
392015 UpgradetoASA9.5andASDM7.5Cisco

ThecorrectASAbootimagehasbeenselected.
8. ClickNexttostarttheupgradeinstallation.
Youcanthenviewthestatusoftheupgradeinstallationasitprogresses.
TheResultsscreenappears,whichprovidesadditionaldetails,suchastheupgradeinstallationstatus(successorfailure).
9. Iftheupgradeinstallationsucceeded,fortheupgradeversionstotakeeffect,checktheSaveconfigurationandreload
devicenowcheckboxtorestarttheASA,andrestartASDM.
10. ClickFinishtoexitthewizardandsavetheconfigurationchangesthatyouhavemade.
Note :Toupgradetothenexthigherversion,ifany,youmustrestartthewizard.

UpgradeaFailoverPairorASACluster
Toperformazerodowntimeupgrade,youneedtoupgradeeachunitinaparticularorder.

UpgradeanActive/StandbyFailoverPair
UpgradeanActive/ActiveFailoverPair
UpgradeanASACluster

UpgradeanActive/StandbyFailoverPair

ToupgradetheActive/Standbyfailoverpair,performthefollowingsteps.

CLI
BeforeYouBegin

Performthesestepsontheactiveunit.

Procedure
1. (Ifthereisaconfigurationmigration)Showtheconfigurationontheterminalsothatyoucanbackupyourconfiguration:
moresystem:runningconfig
Example:
active#moresystem:runningconfig
Copytheoutputfromthiscommand,thenpastetheconfigurationintoatextfile.Forothermethodsofbackingup,seethe
configurationguide.
2. CopytheASAsoftwaretotheactiveunitflashmemory:
copytftp://server[/path]/asa_image_name{disk0:/|disk1:/}[path/]asa_image_name
Example:
active#copytftp://10.1.1.1/asa951smpk8.bindisk0:/asa951smpk8.bin
ForothermethodsthanTFTP,seethecopycommand.
3. Copythesoftwaretothestandbyunitbesuretospecifythesamepathasfortheactiveunit:
failoverexecmatecopy/noconfirmtftp://server[/path]/filename{disk0:/|disk1:/}
[path/]filename
Example:
active#failoverexecmatecopy/noconfirmtftp://10.1.1.1/asa951smpk8.bindisk0:/asa951smp
k8.bin
4. CopytheASDMimagetotheactiveunitflashmemory:
copytftp://server[/path]/asdm_image_name{disk0:/|disk1:/}[path/]asdm_image_name
Example:
active#copytftp://10.1.1.1/asdm751.bindisk0:/asdm751.bin
5. CopytheASDMimagetothestandbyunitbesuretospecifythesamepathasfortheactiveunit:
failoverexecmatecopy/noconfirmtftp://server[/path]/asdm_image_name{disk0:/|disk1:/}
[path/]asdm_image_name
Example:
active#failoverexecmatecopy/noconfirmtftp://10.1.1.1/asdm751.bindisk0:/asdm751.bin
6. Ifyouarenotalreadyinglobalconfigurationmode,accessglobalconfigurationmode:
configureterminal
7. Showthecurrentbootimagesconfigured(upto4):

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/upgrade/upgrade95.html 5/12
392015 UpgradetoASA9.5andASDM7.5Cisco

showrunningconfigbootsystem
Example:
ciscoasa(config)#showrunningconfigbootsystem
bootsystemdisk0:/cdisk.bin
bootsystemdisk0:/asa941smpk8.bin
TheASAusestheimagesintheorderlistedifthefirstimageisunavailable,thenextimageisused,andsoon.Youcannot
insertanewimageURLatthetopofthelisttospecifythenewimagetobefirst,youmustremoveanyexistingentries,and
entertheimageURLsintheorderdesired,accordingto8.and9..
8. Removeanyexistingbootimageconfigurationssothatyoucanenterthenewbootimageasyourfirstchoice:
nobootsystem{disk0:/|disk1:/}[path/]asa_image_name
Example:
ciscoasa(config)#nobootsystemdisk0:/cdisk.bin
ciscoasa(config)#nobootsystemdisk0:/asa941smpk8.bin
9. SettheASAimagetoboot(theoneyoujustuploaded):
bootsystem{disk0:/|disk1:/}[path/]asa_image_name
Example:
ciscoasa(config)#bootsystemdisk0://asa951smpk8.bin
Repeatthiscommandforanybackupimagesthatyouwanttouseincasethisimageisunavailable.Forexample,youcan
reentertheimagesthatyoupreviouslyremovedin8..
10. SettheASDMimagetouse(theoneyoujustuploaded):
asdmimage{disk0:/|disk1:/}[path/]asdm_image_name
Example:
ciscoasa(config)#asdmimagedisk0:/asdm751.bin
YoucanonlyconfigureoneASDMimagetouse,soyoudonotneedtofirstremovetheexistingconfiguration.
11. Savethenewsettingstothestartupconfiguration:
writememory
12. Reloadthestandbyunittobootthenewimage:
failoverreloadstandby
Waitforthestandbyunittofinishloading.UsetheshowfailovercommandtoverifythatthestandbyunitisintheStandby
Readystate.
13. Forcetheactiveunittofailovertothestandbyunit:
nofailoveractive
14. Reloadtheformeractiveunit(nowthenewstandbyunit):
reload
Ifyouwanttorestorethisunittobeactiveafteritreloads,enterthefailoveractivecommand.

ASDM
Procedure
1. (Ifthereisaconfigurationmigration)InASDM,backupyourexistingconfigurationusingtheTools>Backup
Configurationstool.
2. Ontheactiveunit,inthemainASDMapplicationwindow,chooseTools>UpgradeSoftwarefromLocalComputer.
TheUpgradeSoftwaredialogboxappears.
3. FromtheImagetoUploaddropdownlist,chooseASDM.
4. IntheLocalFilePathfield,enterthelocalpathtothefileonyourcomputerorclickBrowseLocalFilestofindthefileon
yourPC.
5. IntheFlashFileSystemPathfield,enterthepathtotheflashfilesystemorclickBrowseFlashtofindthedirectoryor
fileintheflashfilesystem.
6. ClickUploadImage.Theuploadingprocessmighttakeafewminutes.
7. YouarepromptedtosetthisimageastheASDMimage.ClickYes.
8. YouareremindedtoexitASDMandsavetheconfiguration.ClickOK.YouexittheUpgradetool.Note:Youwillsavethe
configurationandreloadASDMafteryouupgradetheASAsoftware.
9. Repeat2.through8.,choosingASAfromtheImagetoUploaddropdownlist.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/upgrade/upgrade95.html 6/12
392015 UpgradetoASA9.5andASDM7.5Cisco

10. ClicktheSaveicononthetoolbartosaveyourconfigurationchanges.
11. ConnectASDMtothestandbyunit,anduploadtheASAandASDMsoftwareaccordingto2.through9.,usingthesame
filelocationsyouusedontheactiveunit.
12. ChooseTools>SystemReloadtoreloadthestandbyASA.
Anewwindowappearsthatasksyoutoverifythedetailsofthereload.
a. ClicktheSavetherunningconfigurationatthetimeofreloadradiobutton(thedefault).
b. Chooseatimetoreload(forexample,Now,thedefault).
c. ClickScheduleReload.
Oncethereloadisinprogress,aReloadStatuswindowappearsthatindicatesthatareloadisbeingperformed.Anoption
toexitASDMisalsoprovided.
13. AfterthestandbyASAreloads,restartASDMandconnecttothestandbyunittomakesureitisrunning.
14. ConnectASDMtotheactiveunitagain.
15. ForcetheactiveunittofailovertothestandbyunitbychoosingMonitoring>Properties>Failover>Status,and
clickingMakeStandby.
16. ChooseTools>SystemReloadtoreloadthe(formerly)activeASA.
Anewwindowappearsthatasksyoutoverifythedetailsofthereload.
a. ClicktheSavetherunningconfigurationatthetimeofreloadradiobutton(thedefault).
b. Chooseatimetoreload(forexample,Now,thedefault).
c. ClickScheduleReload.
Oncethereloadisinprogress,aReloadStatuswindowappearsthatindicatesthatareloadisbeingperformed.Anoption
toexitASDMisalsoprovided.
AftertheASAcomesup,itwillnowbethestandbyunit.

UpgradeanActive/ActiveFailoverPair

ToupgradetwounitsinanActive/Activefailoverconfiguration,performthefollowingsteps.

CLI
BeforeYouBegin

Performthesestepsinthesystemexecutionspace.Alsoperformthesestepsontheprimaryunit.

Procedure
1. (Ifthereisaconfigurationmigration)Showtheconfigurationontheterminalsothatyoucanbackupyourconfiguration:
moresystem:runningconfig
Copytheoutputfromthiscommand,thenpastetheconfigurationintoatextfile.Forothermethodsofbackingup,seethe
configurationguide.
2. CopytheASAsoftwaretotheprimaryunitflashmemory:
copytftp://server[/path]/asa_image_name{disk0:/|disk1:/}[path/]asa_image_name
Example:
primary#copytftp://10.1.1.1/asa951smpk8.bindisk0:/asa951smpk8.bin
ForothermethodsthanTFTP,seethecopycommand.
3. Copythesoftwaretothesecondaryunitbesuretospecifythesamepathasfortheprimaryunit:
failoverexecmatecopy/noconfirmtftp://server[/path]/filename{disk0:/|disk1:/}
[path/]filename
Example:
primary#failoverexecmatecopy/noconfirmtftp://10.1.1.1/asa951smpk8.bindisk0:/asa951smp
k8.bin
4. CopytheASDMimagetotheprimaryunitflashmemory:
copytftp://server[/path]/asdm_image_name{disk0:/|disk1:/}[path/]asdm_image_name
Example:
primary#copytftp://10.1.1.1/asdm751.bindisk0:/asdm751.bin

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/upgrade/upgrade95.html 7/12
392015 UpgradetoASA9.5andASDM7.5Cisco

5. CopytheASDMimagetothesecondaryunitbesuretospecifythesamepathasfortheactiveunit:
failoverexecmatecopy/noconfirmtftp://server[/path]/asdm_image_name{disk0:/|disk1:/}
[path/]asdm_image_name
Example:
primary#failoverexecmatecopy/noconfirmtftp://10.1.1.1/asdm751.bindisk0:/asdm751.bin
6. Makebothfailovergroupsactiveontheprimaryunit:
failoveractivegroup1
failoveractivegroup2
7. Ifyouarenotalreadyinglobalconfigurationmode,accessglobalconfigurationmode:
configureterminal
Example:
primary(config)#configureterminal
8. Showthecurrentbootimagesconfigured(upto4):
showrunningconfigbootsystem
Example:
ciscoasa(config)#showrunningconfigbootsystem
bootsystemdisk0:/cdisk.bin
bootsystemdisk0:/asa941smpk8.bin
TheASAusestheimagesintheorderlistedifthefirstimageisunavailable,thenextimageisused,andsoon.Youcannot
insertanewimageURLatthetopofthelisttospecifythenewimagetobefirst,youmustremoveanyexistingentries,and
entertheimageURLsintheorderdesired,accordingto9.and10..
9. Removeanyexistingbootimageconfigurationssothatyoucanenterthenewbootimageasyourfirstchoice:
nobootsystem{disk0:/|disk1:/}[path/]asa_image_name
Example:
ciscoasa(config)#nobootsystemdisk0:/cdisk.bin
ciscoasa(config)#nobootsystemdisk0:/asa941smpk8.bin
10. SettheASAimagetoboot(theoneyoujustuploaded):
bootsystem{disk0:/|disk1:/}[path/]asa_image_name
Example:
ciscoasa(config)#bootsystemdisk0://asa951smpk8.bin
Repeatthiscommandforanybackupimagesthatyouwanttouseincasethisimageisunavailable.Forexample,youcan
reentertheimagesthatyoupreviouslyremovedin9..
11. SettheASDMimagetouse(theoneyoujustuploaded):
asdmimage{disk0:/|disk1:/}[path/]asdm_image_name
Example:
ciscoasa(config)#asdmimagedisk0:/asdm751.bin
YoucanonlyconfigureoneASDMimagetouse,soyoudonotneedtofirstremovetheexistingconfiguration.
12. Savethenewsettingstothestartupconfiguration:
writememory
13. Reloadthesecondaryunittobootthenewimage:
failoverreloadstandby
Waitforthesecondaryunittofinishloading.Usetheshowfailovercommandtoverifythatbothfailovergroupsareinthe
StandbyReadystate.
14. Forcebothfailovergroupstobecomeactiveonthesecondaryunit:
nofailoveractivegroup1
nofailoveractivegroup2
15. Reloadtheprimaryunit:
reload
Ifthefailovergroupsareconfiguredwiththepreemptcommand,theyautomaticallybecomeactiveontheirdesignatedunit
afterthepreemptdelayhaspassed.Ifthefailovergroupsarenotconfiguredwiththepreemptcommand,youcanreturn
themtoactivestatusontheirdesignatedunitsusingthefailoveractivegroupcommand.

ASDM

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/upgrade/upgrade95.html 8/12
392015 UpgradetoASA9.5andASDM7.5Cisco

BeforeYouBegin

Performthesestepsinthesystemexecutionspace.

Procedure
1. (Ifthereisaconfigurationmigration)InASDM,backupyourexistingconfigurationusingtheTools>Backup
Configurationstool.
2. Ontheprimaryunit,inthemainASDMapplicationwindow,chooseTools>UpgradeSoftwarefromLocalComputer.
TheUpgradeSoftwaredialogboxappears.
3. FromtheImagetoUploaddropdownlist,chooseASDM.
4. IntheLocalFilePathfield,enterthelocalpathtothefileonyourcomputerorclickBrowseLocalFilestofindthefileon
yourPC.
5. IntheFlashFileSystemPathfield,enterthepathtotheflashfilesystemorclickBrowseFlashtofindthedirectoryor
fileintheflashfilesystem.
6. ClickUploadImage.Theuploadingprocessmighttakeafewminutes.
7. YouarepromptedtosetthisimageastheASDMimage.ClickYes.
8. YouareremindedtoexitASDMandsavetheconfiguration.ClickOK.YouexittheUpgradetool.Note:Youwillsavethe
configurationandreloadASDMafteryouupgradetheASAsoftware.
9. Repeat2.through8.,choosingASAfromtheImagetoUploaddropdownlist.
10. ClicktheSaveicononthetoolbartosaveyourconfigurationchanges.
11. MakebothfailovergroupsactiveontheprimaryunitbychoosingMonitoring>Failover>FailoverGroup#,where#is
thenumberofthefailovergroupyouwanttomovetotheprimaryunit,andclickingMakeActive.
12. ConnectASDMtothesecondaryunit,anduploadtheASAandASDMsoftwareaccordingto2.through9.,usingthe
samefilelocationsyouusedontheactiveunit.
13. ChooseTools>SystemReloadtoreloadthesecondaryASA.
Anewwindowappearsthatasksyoutoverifythedetailsofthereload.
a. ClicktheSavetherunningconfigurationatthetimeofreloadradiobutton(thedefault).
b. Chooseatimetoreload(forexample,Now,thedefault).
c. ClickScheduleReload.
Oncethereloadisinprogress,aReloadStatuswindowappearsthatindicatesthatareloadisbeingperformed.Anoption
toexitASDMisalsoprovided.
14. ConnectASDMtotheprimaryunit,andcheckwhenthesecondaryunitreloadsbychoosingMonitoring>Failover>
System.
15. Afterthesecondaryunitcomesup,forcetheprimaryunittofailovertothesecondaryunitbychoosingMonitoring>
Properties>Failover>System,andclickingMakeStandby.
16. ChooseTools>SystemReloadtoreloadthe(formerly)activeASA.
Anewwindowappearsthatasksyoutoverifythedetailsofthereload.
a. ClicktheSavetherunningconfigurationatthetimeofreloadradiobutton(thedefault).
b. Chooseatimetoreload(forexample,Now,thedefault).
c. ClickScheduleReload.
Oncethereloadisinprogress,aReloadStatuswindowappearsthatindicatesthatareloadisbeingperformed.Anoption
toexitASDMisalsoprovided.
IfthefailovergroupsareconfiguredwithPreemptEnabled,theyautomaticallybecomeactiveontheirdesignatedunitafter
thepreemptdelayhaspassed.IfthefailovergroupsarenotconfiguredwithPreemptEnabled,youcanreturnthemto
activestatusontheirdesignatedunitsusingtheMonitoring>Failover>FailoverGroup#pane.

UpgradeanASACluster

ToupgradeallunitsinanASAcluster,performthefollowingstepsonthemasterunit.Formultiplecontextmode,perform
thesestepsinthesystemexecutionspace.

CLI

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/upgrade/upgrade95.html 9/12
392015 UpgradetoASA9.5andASDM7.5Cisco

Procedure
1. (Ifthereisaconfigurationmigration)Backupyourconfigurationfile:
moresystem:runningconfig
Copytheoutputfromthiscommand,thenpastetheconfigurationintoatextfile.Forothermethodsofbackingup,seethe
generaloperationsconfigurationguide.
2. CopytheASAsoftwaretoallunitsinthecluster:
clusterexeccopy/noconfirmtftp://server[/path]/asa_image_name{disk0:/|disk1:/}
[path/]asa_image_name
Example:
master#clusterexeccopy/noconfirmtftp://10.1.1.1/asa951smpk8.bindisk0:/asa951smpk8.bin
ForothermethodsthanTFTP,seethecopycommand.
3. CopytheASDMimagetoallunitsinthecluster:
clusterexeccopy/noconfirmtftp://server[/path]/asdm_image_name{disk0:/|disk1:/}
[path/]asdm_image_name
Example:
master#clusterexeccopy/noconfirmtftp://10.1.1.1/asdm751.bindisk0:/asdm751.bin
4. Ifyouarenotalreadyinglobalconfigurationmode,accessglobalconfigurationmode:
configureterminal
5. Showthecurrentbootimagesconfigured(upto4):
showrunningconfigbootsystem
Example:
ciscoasa(config)#showrunningconfigbootsystem
bootsystemdisk0:/cdisk.bin
bootsystemdisk0:/asa941smpk8.bin
TheASAusestheimagesintheorderlistedifthefirstimageisunavailable,thenextimageisused,andsoon.Youcannot
insertanewimageURLatthetopofthelisttospecifythenewimagetobefirst,youmustremoveanyexistingentries,and
entertheimageURLsintheorderdesired,accordingto6.and7..
6. Removeanyexistingbootimageconfigurationssothatyoucanenterthenewbootimageasyourfirstchoice:
nobootsystem{disk0:/|disk1:/}[path/]asa_image_name
Example:
ciscoasa(config)#nobootsystemdisk0:/cdisk.bin
ciscoasa(config)#nobootsystemdisk0:/asa941smpk8.bin
7. SettheASAimagetoboot(theoneyoujustuploaded):
bootsystem{disk0:/|disk1:/}[path/]asa_image_name
Example:
ciscoasa(config)#bootsystemdisk0://asa951smpk8.bin
Repeatthiscommandforanybackupimagesthatyouwanttouseincasethisimageisunavailable.Forexample,youcan
reentertheimagesthatyoupreviouslyremovedin6..
8. SettheASDMimagetouse(theoneyoujustuploaded):
asdmimage{disk0:/|disk1:/}[path/]asdm_image_name
Example:
ciscoasa(config)#asdmimagedisk0:/asdm751.bin
YoucanonlyconfigureoneASDMimagetouse,soyoudonotneedtofirstremovetheexistingconfiguration.
9. Savethenewsettingstothestartupconfiguration:
writememory
10. Reloadeachslaveunitwhenyourepeatthiscommandforeachunitname:
clusterexecunitslaveunitreloadnoconfirm
Example:
master#clusterexecunitunit2reloadnoconfirm
Toavoidconnectionlossandallowtraffictostabilize,waitforeachunittocomebackup(approximately5minutes)before
reloadingthenextunit.Toviewmembernames,enterclusterexecunit?,orentertheshowclusterinfocommand.
11. Disableclusteringonthemasterunit:
noenable

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/upgrade/upgrade95.html 10/12
392015 UpgradetoASA9.5andASDM7.5Cisco

Waitfor5minutesforanewmastertobeselectedandtraffictostabilize.Donotenterwritememorywhenthemasterunit
reloads,youwantclusteringtobeenabledonit.
12. Reloadthemasterunit:
reloadnoconfirm
Anewelectiontakesplaceforanewmasterunit.Whentheformermasterunitrejoinsthecluster,itwillbeaslave.

ASDM
Procedure
13. LaunchASDMonthemasterunit.
14. (Ifthereisaconfigurationmigration)InASDM,backupyourexistingconfigurationusingtheTools>Backup
Configurationstool.
15. InthemainASDMapplicationwindow,chooseTools>UpgradeSoftwarefromLocalComputer.
TheUpgradeSoftwarefromLocalComputerdialogboxappears.
16. ClicktheAlldevicesintheclusterradiobutton.
TheUpgradeSoftwaredialogboxappears.
17. FromtheImagetoUploaddropdownlist,chooseASDM.
18. IntheLocalFilePathfield,enterthelocalpathtothefileonyourcomputerorclickBrowseLocalFilestofindthefile
onyourPC.
19. IntheFlashFileSystemPathfield,enterthepathtotheflashfilesystemorclickBrowseFlashtofindthedirectoryor
fileintheflashfilesystem.
20. ClickUploadImage.Theuploadingprocessmighttakeafewminutes.
21. YouarepromptedtosetthisimageastheASDMimage.ClickYes.
22. YouareremindedtoexitASDMandsavetheconfiguration.ClickOK.YouexittheUpgradetool.Note:Youwillsavethe
configurationandreloadASDMafteryouupgradetheASAsoftware.
23. Repeat15.through22.,choosingASAfromtheImagetoUploaddropdownlist.
24. ClicktheSaveicononthetoolbartosaveyourconfigurationchanges.
25. ChooseTools>SystemReload.
TheSystemReloaddialogboxappears.
26. ReloadeachslaveunitoneatatimebychoosingaslaveunitnamefromtheDevicedropdownlist,andthenclicking
ScheduleReloadtoreloadtheunitnow.
Toavoidconnectionlossandallowtraffictostabilize,waitforeachunittocomebackup(approximately5minutes)before
reloadingthenextunit.Toviewwhenaunitrejoinsthecluster,seetheMonitoring>ASACluster>ClusterSummary
pane.
27. Afterallslaveunitshavereloaded,disableclusteringonthemasterunitbychoosingConfiguration>Device
Management>HighAvailabilityandScalability>ASACluster,unchecktheParticipateinASAclustercheckbox,and
clickApply.
Waitfor5minutesforanewmastertobeselectedandtraffictostabilize.Whentheformermasterunitrejoinsthecluster,it
willbeaslave.
Donotsavetheconfigurationwhenthemasterunitreloads,youwantclusteringtobeenabledonit.
28. ChooseTools>SystemReloadandreloadthemasterunitfromtheSystemReloaddialogboxbychoosingThis
DevicefromtheDevicedropdownlist.
29. QuitandrestartASDMyouwillreconnecttothenewmasterunit.

CiscoandtheCiscologoaretrademarksorregisteredtrademarksofCiscoand/oritsaffiliatesintheU.S.andothercountries.
ToviewalistofCiscotrademarks,gotothisURL:www.cisco.com/go/trademarks.Thirdpartytrademarksmentionedarethe
propertyoftheirrespectiveowners.TheuseofthewordpartnerdoesnotimplyapartnershiprelationshipbetweenCiscoand
anyothercompany.(1110R)

Copyright2015CiscoSystems,Inc.Allrightsreserved.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/upgrade/upgrade95.html 11/12
392015 UpgradetoASA9.5andASDM7.5Cisco
2015Ciscoand/oritsaffiliates.Allrightsreserved.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/upgrade/upgrade95.html 12/12