The Product Upgrades page provides an upgrade-centered overview of your deployment—how many devices you have, when they were last upgraded, whether there is an upgrade in progress, and so on.

Before you copy upgrade packages to managed devices, you must upload the packages to the management center, or to an internal server that the devices can access.

The Product Upgrades page lists all upgrade packages that apply to your current deployment, with suggested releases specially marked. In most cases, you can just click Download next to the upgrade package or version you want.

For more information, see Managing Upgrade Packages with the Management Center and Troubleshooting Upgrade Packages.

Click Upgrade next to the target version. If you are given a drop-down menu, select Threat Defense.

The threat defense upgrade wizard appears. It has two panes: Device Selection on the left, and Device Details on the right. Click a device link in the Device Selection pane (such as '4 devices') to show the Device Details for those devices. Your target version is pre-selected in the Upgrade to menu. The system determines which devices can be upgraded to that version and displays them in the Device Details pane.

In the Device Details pane, select the devices you want to upgrade and click Add to Selection.

You can use the device links on the Device Selection pane to toggle the Device Details pane between selected devices, remaining upgrade candidates, ineligible devices (with reasons why), devices that need the upgrade package, and so on. You can add and remove devices from your selection, or click Reset to clear your device selection and start over. Note that you do not have to remove ineligible devices; they are automatically excluded from upgrade. You must upgrade the members of device clusters and high availability pairs together.

Click Copy Upgrade Package and wait for the transfer to complete. For the Secure Firewall 3100/4200 in multi-instance mode, if you upgraded the chassis, the upgrade package should already be on the device (unless you deleted it).

Compatibility and other quick prechecks are automatic. For example, the system alerts you immediately if you need to deploy configurations. Other checks take more time. To begin these, click Run Readiness Check.

Do not deploy changes to, manually reboot, or shut down a device while running readiness checks. Although you can skip checks by disabling the Require passing compatibility and readiness checks option, we recommend against it. Passing all checks greatly reduces the chance of upgrade failure. If the checks expose issues that you cannot resolve, do not begin the upgrade.

These options allow you to revert from both successful and unsuccessful upgrades, to generate troubleshooting files, and to upgrade Snort. For information on why you might disable these options, see Threat Defense Upgrade Options.

We recommend revisiting the configuration and deployment health checks you performed earlier: Configuration and Deployment Checks.

The wizard shows your overall upgrade progress, which you can also monitor in the Message Center. For detailed status, click Detailed Status next to the device you want to see. This detailed status is also available from the Upgrade tab on the Device Management page.

For high availability devices, note that the Message Center and the upgrade wizard associate the units with their high availability states when you clicked Start Upgrade. That is, they report upgrading the "standby" and then the "active," even though failover occurs and you are only ever upgrading the standby. The Device Management page always shows the correct current high availability states of the units, which can be different from the original states displayed by the Message Center or the wizard..

After the upgrade completes, choose Devices > Device Management and confirm that the devices you upgraded have the correct software version.

The upgrade process switches device roles so that it is always upgrading a standby unit or data node. It does not return devices to the roles they had before upgrade. If you have preferred roles for specific devices, make those changes now.

Although the upgrade often updates these components, there could be newer ones available. If the component available on the Cisco Support & Download site is newer than the version currently running, install the newer version. Note that when you update intrusion rules, you do not need to automatically reapply policies. You will do that later.

Before you deploy, you may want to review the changes made by the upgrade (as well as any changes you have made since upgrade):

• If you have not cleared your workflow, you can return to the wizard. Choose Devices > Threat Defense Upgrade and click Configuration Changes next to each device.

• If you have cleared the workflow, or if you want to quickly generate change reports for multiple devices, use the Advanced Deploy page. Choose Deploy > Advanced Deploy, select the devices you upgraded, and click Pending Changes Reports. After the reports finish generating, you can download them from the Tasks tab on the Message Center.