How to upgrade a Active / Passive Cluster SFOS V18.5.2 to V19.5 in a Production Environment?

In SFOS, you can always use a direct Upgrade with a single upgrade file. The trick is, the dual slot firmware version. So the firewall does not have to do "all upgrades in the path", instead you can move to the new version and "Migrate your existing configuration to the new firmware". That is how the update process works. 

So to speak, you can do a direct upgrade to V19.5 and check, if you see any kind of problems. If so, you can move back to V18.5 MR2. 

You will do a lot of Firmware updates and fixes as V18.5 MR2 is rather old. IF you see any kind of problems, check: community.sophos.com/.../troubleshoot-a-broken-application-in-sfos

Hi,

to prevent any misunderstandings by me ...

Based in the screenshot, I click the Download Button on Version 19.0.1MR, later INSTALL, wait the until the reboots are finished, and all is fine?

This means the Configuration is converted to V19 and working?

Are you sure?

Hey Guenter if the firmware is upgraded successfully on the same page you'll see the active firmware version, based on the screenshot the current active firmware is v18.5.2 MR-2 Build 380 

Hi,

thank's for your answer.

For my understanding, does this include the correct conversion of the running configuration?

In this case, can you confim that the current configuration (L3 and IPSEC VPN) will correctly work on Version V19 (A/P Cluster)?

On my experience (TWICE) with A/P Clusters, the firmware are upgraded to V19, but the Configuration are NOT converted. At least once, the configuration are lost. This means there was only the default configuration. In the other case, after a couple of houres NO rule never matches.

This cases are reported to Sophos (Summer/Autumn 2022) but no technical guy from them was interrested on this circumstance.

I mean - to reproduce this in a LAB, and so on ...

I my case - I need a working "how to" how I do the upgrade to V19 and can be sure that the upgrade works with the current configuration. 

We have no to time for experiments.

My maximum maintainance window is 24h hours.

Hi,

thank's for your answer.

For my understanding, does this include the correct conversion of the running configuration?

In this case, can you confim that the current configuration (L3 and IPSEC VPN) will correctly work on Version V19 (A/P Cluster)?

On my experience (TWICE) with A/P Clusters, the firmware are upgraded to V19, but the Configuration are NOT converted. At least once, the configuration are lost. This means there was only the default configuration. In the other case, after a couple of houres NO rule never matches.

This cases are reported to Sophos (Summer/Autumn 2022) but no technical guy from them was interrested on this circumstance.

I mean - to reproduce this in a LAB, and so on ...

I my case - I need a working "how to" how I do the upgrade to V19 and can be sure that the upgrade works with the current configuration. 

We have no to time for experiments.

My maximum maintainance window is 24h hours.

Hey Guenter Please take a look into the upgrade information in the Point no 2 in the first comment !
https://docs.sophos.com/releasenotes/index.html?productGroup

Hi Vivek,

I'm aware about this site.

But my important question is still not answered.

Are the current configuration work correctly (L3 and IPSEC S2S Tunnels), if we upgrade this A/P Cluster from V18.5.2 MR2-380 to V19.0.1 MR1-365?

I have posted my experience from Summer/Autumn 2022 above. 

I have a cluster in my environment in HA A-A with couple IPsec tunnels and it has been a delightful experience so far 
Shouldn't be a problem but ensure to take a backup first before upgrading !

Let me get into more details about this: 

So there was / is / can be a problem with the migration of Config FW old to New. If there are "unsupported changes made", it will run into factory default.

However: If you run a HA, the firmware upgrade will be done on the Aux appliance first. Without a successful upgrade, the primary will not upgrade. https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/HighAvailablityStartupGuide/HAFirmwareUpgrade/index.html

Therefore, even in a scenario, where you would have a "invalid config", the HA will break but your network will not fail, as primary still works with the old firmware. You would have to revert the Aux via Console cable to the old firmware. 

This is the worst case scenario - But as V19.0 MR1 is actually old, it is unlikely you will have an unsupported firmware. See:  Sophos Firewall: v19.0 MR1: Feedback and experiences 

Hi,

Interresting...

Are there any entries in the logs which indicates ""unsupported changes made"?

Essentially those issues are not visible as they occur after the upgrade. But the chance you have such a configuration enabled, is rather small. 

For example: https://support.sophos.com/support/s/article/KB-000044123?language=en_US