How to upgrade a Active / Passive Cluster SFOS V18.5.2 to V19.5 in a Production Environment?

Question

Hi Community and Sophos Guys. 
 
 As the title describes, I have to upgrade a Active / Passive Cluster SFOS V18.5.2 to V19.5 in a Production Environment. 
 
 This Production Environment uses XGS2100 as hardware, and have a maximum of 24h hours for a downtime. 
 After that the Firewall must up and running. This is a just in time Production which receives orders via a EDI System. 
 
 For this case what is the correct upgradepath?

LuCar Toni · Answer

Let me get into more details about this: 
 So there was / is / can be a problem with the migration of Config FW old to New. If there are "unsupported changes made", it will run into factory default. 
 However: If you run a HA, the firmware upgrade will be done on the Aux appliance first. Without a successful upgrade, the primary will not upgrade. https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/HighAvailablityStartupGuide/HAFirmwareUpgrade/index.html 
 Therefore, even in a scenario, where you would have a "invalid config", the HA will break but your network will not fail, as primary still works with the old firmware. You would have to revert the Aux via Console cable to the old firmware. 
 This is the worst case scenario - But as V19.0 MR1 is actually old, it is unlikely you will have an unsupported firmware. See: Sophos Firewall: v19.0 MR1: Feedback and experiences

LuCar Toni · Answer

Essentially those issues are not visible as they occur after the upgrade. But the chance you have such a configuration enabled, is rather small. 
 For example: https://support.sophos.com/support/s/article/KB-000044123?language=en_US

Vivek Jagad · Answer

Hello Guenter , Thank you for reaching out to the community, Please refer the useful docs below: 1.) Upgrading HA - https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/HighAvailablityStartupGuide/HAFirmwareUpgrade/index.html 2.) Release Notes > Product type Network Security > Sophos Firewall > select the desired version and you'll find the upgrade information - https://docs.sophos.com/releasenotes/index.html?productGroup 3.) Move to a different firmware version - https://docs.sophos.com/nsg/sophos-firewall/19.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/BackupAndFirmware/Firmware/FirmwareMoveToDifferentVersion/index.html

How to upgrade a Active / Passive Cluster SFOS V18.5.2 to V19.5 in a Production Environment?

Top Replies