For more information, see the following topics:

• Platforms and Environments

• Before You Update: Important Notes

When you deploy before updating the Firepower Management Center, resource demands may result in a small number of packets dropping without inspection. Additionally, deploying some configurations restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the device handles traffic. For more information, see Configurations that Restart the Snort Process When Deployed or Activated and Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide.

See Run a Readiness Check through the Shell or Run a Readiness Check through the Firepower Management Center Web Interface.

Click the system status icon to view the Tasks tab in the Message Center. Tasks that are running when the update begins are stopped, become failed tasks, and cannot be resumed. You can manually delete failed status messages after the update completes.

In the System > Updates page, click the install icon next to the update you are installing.

Choose the Firepower Management Center and click Install. Confirm that you want to install the update and reboot.

You can begin monitoring the update’s progress on the Tasks tab of the Message Center. However, after the Firepower Management Center completes its necessary pre update checks, you are logged out. When you log back in, the Upgrade Status page displays a progress bar and provides details about the script currently running.

Choose Help > About and confirm that the software version is listed correctly. Also note the versions of the intrusion rule update and Vulnerability Database (VDB); you will need this information later.

If the intrusion rule update or the VDB available on the Support site is newer than the version currently running, install the newer version. For more information, see the Firepower Management Center Configuration Guide

When you install the intrusion rule update, you do not need to automatically reapply policies. You will manually deploy configuration changes, which also reapplies policies.

In most cases, deploying for the first time after you update the Firepower Management Center restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the device handles traffic. For more information, see Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide.

You must update to the latest patch to take advantage of product enhancements and security fixes. If a later patch is available on the Support site, use the Firepower System Release Notes for that version to update the system.

For more information, see Update Sequence for Firepower Management Centers in High Availability.

For more information, see the following topics:

• Platforms and Environments

• Before You Update: Important Notes

We strongly recommend upgrading the Firepower Management Center to the same maintenance release or later as the version you upgrade the managed device to. As an example, we recommend a Firepower Management Center run at least Version 6.2.2.1 before you upgrade a managed device to Version 6.2.2.1.

In most cases, deploying for the first time after you update the Firepower Management Center restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the device handles traffic. For more information, see the Snort® Restart Traffic Behavior section in the Firepower Management Center Configuration Guide, Version 6.2.2.

See the Cisco FXOS Release Notes for information on updating FXOS. To update FXOS on high availability pairs, update the operating system on the standby, switch failover, then update the new standby; see Update Sequence for High Availability Firepower Threat Defense Devices.

Updating FXOS causes an expected disruption in traffic. Updating FXOS also reboots the chassis, which drops traffic or passes it uninspected in an intra-chassis cluster depending on whether the cluster uses an enabled hardware bypass module, and drops traffic in an inter-chassis cluster only if chassis reboots overlap before at least one module comes online.

See Run a Readiness Check through the Shell or Run a Readiness Check through the Firepower Management Center Web Interface.

In the System > Updates page, click the install icon next to the update you are installing.

The system does not allow you to choose an ineligible device. If you cannot choose the device you want to update, make sure you downloaded the correct file.

Click Install. Confirm that you want to install the update and reboot devices. Devices may reboot twice; this is expected. You can monitor the update's progress on the Tasks tab of the Message Center.

After the update process completes, choose Devices > Device Management and verify that the devices you updated have the correct software version.

When you deploy for the first time after updating a device, resource demands may result in a small number of packets dropping without inspection. The deploy does not otherwise interrupt traffic inspection unless, since the previous deploy, you have modified specific policy or device configurations that always restart the Snort process when you deploy them. If you have modified any of these configurations, traffic drops or passes without further inspection during the restart depending on how the device handles traffic. For more information, see the Configurations that Restart the Snort Process When Deployed or Activated and Snort® Restart Traffic Behavior sections in the Firepower Management Center Configuration Guide, Version 6.2.2.

You must update to the latest patch to take advantage of product enhancements and security fixes. If a later patch is available on the Support site, use the Firepower System Release Notes for that version to update the system.

For more information, see the following topics:

• Platforms and Environments

• Before You Update: Important Notes

Cisco_Network_Sensor_Patch-6.2.2.x-xxxx.sh.REL.tar

Deploying may cause a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected. For more information, see the Cisco ASA with FirePOWER Services Local Management Configuration Guide.

Choose Monitoring > ASA FirePOWER Monitoring > Task Status. Tasks that are running when the update begins are stopped, become failed tasks, and cannot be resumed. You can manually delete failed status messages after the update completes.

Choose Configuration > ASA FirePOWER Configuration > System Information and confirm that the software version is listed correctly. Also note the versions of the intrusion rule update and Vulnerability Database (VDB); you will need this information later.

If the intrusion rule update or the VDB available on the Support site is newer than the version currently running, install the newer version. For more information, see the Cisco ASA with FirePOWER Services Local Management Configuration Guide.

When you install the intrusion rule update, you do not need to automatically reapply policies. You will manually deploy configuration changes, which also reapplies policies.

Deploying may cause a short pause in traffic flow and processing, and may also cause a few packets to pass uninspected. For more information, see the Cisco ASA with FirePOWER Services Local Management Configuration Guide.

For more information, see the following topics:

• Platforms and Environments

• Before You Update: Important Notes

We strongly recommend upgrading the Firepower Management Center to the same maintenance release or later as the version you upgrade the managed device to. As an example, we recommend a Firepower Management Center run at least Version 6.2.2.1 before you upgrade a managed device to Version 6.2.2.1.

In most cases, deploying for the first time after you update the Firepower Management Center restarts the Snort process, which interrupts traffic inspection. Whether traffic drops during this interruption or passes without further inspection depends on how the device handles traffic. For more information, see Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide.

• 7000 and 8000 Series:

  Sourcefire_3D_Device_S3_Patch-6.2.2.x-xxxx.sh.REL.tar

• NGIPSv:

  Sourcefire_3D_Device_Virtual64_VMware_Patch-6.2.2.x-xxxx.sh.REL.tar

• ASA with FirePOWER Services:

  Cisco_Network_Sensor_Patch-6.2.2.x-xxxx.sh.REL.tar

See Run a Readiness Check through the Shell or Run a Readiness Check through the Firepower Management Center Web Interface.

In the System > Updates page, click the install icon next to the update you are installing.

Many update file names look similar. The system does not allow you to choose an ineligible device. If you cannot choose the device you want to update, make sure you downloaded the correct file.

If you are updating stacked 8000 Series devices, choosing one member of the stack automatically chooses the other devices in the stack. You must update members of a stack together.

Click Install. Confirm that you want to install the update and reboot devices. Devices may reboot twice; this is expected. You can monitor the update's progress on the Tasks tab of the Message Center.

After the update process completes, choose Devices > Device Management and verify that the devices you updated have the correct software version.

When you deploy for the first time after updating a device, resource demands may result in a small number of packets dropping without inspection. The deploy does not otherwise interrupt traffic inspection unless, since the previous deploy, you have modified specific policy or device configurations that always restart the Snort process when you deploy them. If you have modified any of these configurations, traffic drops or passes without further inspection during the restart depending on how the device handles traffic. For more information, see Configurations that Restart the Snort Process When Deployed or Activated and Snort® Restart Traffic Behavior in the Firepower Management Center Configuration Guide.

You must update to the latest patch to take advantage of product enhancements and security fixes. If a later patch is available on the Support site, use the Firepower System Release Notes for that version to update the system.