Filter
Top Products
70-22
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 70 Using Image Manager
About Image Updates on Devices Using Image Manager
changes to the NAT policy model in Security Manager for Version 8.3. Hence, when a device is
upgraded to ASA 8.3, that device is put into the Configuration Required state to indicate to the
Configuration user that some changes are required in Configuration Manager to make the device
operational. After rediscovering the device in Security Manager, the user can right-click the device
in the device tree and select Make Device Operational to bring it back to normal state.
• An image upgrade from ASA Version 8.3.x to 8.4.2 or higher also requires rediscovery of the device
in Security Manager because of incompatible changes in PAT configuration in ASA Version 8.4.2.
In this case also, the device state is changed to the Configuration Required state after the image
upgrade.
• An image upgrade from ASA Version 8.x to 9.0.1 or higher requires rediscovery of the device in
Security Manager because of incompatible changes in Unified access rules, inspection, and NAT
rules.
• An image upgrade from ASA Version 7.x to 8.x introduces major changes in the SSLVPN
configuration both on the device and in Security Manager. Because of these incompatible changes,
the device must be deleted from Security Manager after the image upgrade and then added again.
The device is put into the Configuration Required state to notify the user to act upon these warnings.
• Any VPN image, such as an AnyConnect, CSD, or Hostscan image, being loaded using Image
Manager warns the user if the existing VPN image was part of a shared policy being assigned to the
current device or other devices. A warning is issued to also copy the new image to all the devices to
which the shared policy is assigned so that the shared policy can be updated for all the devices
seamlessly without the loss of policy sharing.
• Warn when the standby unit in a failover pair in not reachable. This is an error that will cause the
job to be aborted.
• Warning for upgrade of Active/Standby failover pair. The version being upgraded should comply
with the recommendations listed at: ASA/PIX: How to Use the CLI to Upgrade the Software Image
on a Failover Pair.
Note The same warnings are also applicable for an ASA in cluster configuration.
• Warning for upgrade of Active/Active failover pair that the image update job will be aborted unless
the pair is converted to Active/Standby (that is, if all the failover groups are active on one physical
unit).
Note Additional validations are required for a "device" that is a designated cluster master. In addition to a
check that is similar to that for Active/Standby Failover, there is also a check that the cluster image is
compatible with supported platforms. A cluster cannot be downgraded to a version less than 9.x.
To validate an image installation, do the following:
Step 1 From the File menu, select Validate.
The Validate Image Assignments window opens.
Step 2 Click Add Assignment.
The Image Assignment window opens.
Step 3 In the Image Assignment window, from the drop-down list, select either:
• Select Images and Assign to Devices