Zero Downtime ASA Upgrade (CLI)

So you have stateful failover configured on your pair of Cisco ASAs and need to upgrade ASDM or the os? Maybe a critical security vulnerability was discovered with the software and you need to upgrade them ASAP. With stateful failover, we can perform a zero downtime upgrade on our ASAs to minimize end user disruption. Below are the steps I used to upgrade a pair of ASA 5525-X’s using the command line interface. You can find Cisco’s documentation for upgrading an Active/Standby Failover Configuration here.

  • First, back up your current configuration!

  • Download your updated ASDM and ASA software from
  • Copy new ASA operating system to active and standby units.

  • Copy new ASDM software to active and standby units.

  • Verify the current boot images, making note of the boot order. Remove the current image and set the config to boot from the newly uploaded image followed by the old image as a back up.

  • Configure the ASA to use the new ASDM image

  • Save your configuration and reload the secondary standby unit.

  • Verify the standby unit is back up and running the new software version.

  • Make the active primary unit the new standy unit

  • You may need to re-establish your SSH connection. Log back into the ASA and verify that the secondary unit is now the active unit. Reload the primary/standby unit, wait a few minutes and verify that both units are now running identical code.


And there you have it. If you’d like, after monitoring and verification, you can remove the old ASA and ASDM images from the boot order commands as well as the disk to keep things clean.


2 thoughts on “Zero Downtime ASA Upgrade (CLI)”

Leave a Reply to Rich Cancel reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.