Skip to main content
MacStadium doesn’t upgrade your firewall’s software on a schedule. Your Cisco ASA or ASAv stays on its current version until you ask for a change, with one exception: a critical security vulnerability, where MacStadium may need to patch without waiting. There are two kinds of request, and they work differently:
  • A code upgrade, where your existing firewall moves to a newer software version.
  • A firewall replacement, where you move to a different appliance, physical or virtual.

​
Requesting a change

Contact MacStadium Support. You don’t need to name a specific version: asking for an upgrade is enough, and MacStadium comes back with the code versions available to you so you can choose between them. Common reasons customers ask:
  • A security advisory or vulnerability scan flags something on your current version, whether that’s a Cisco advisory, a CVE notification, or a finding from your own scanning.
  • A known bug you’re hitting, for example a memory leak leading to crashes, or an issue with HA failover.
  • A feature you need that requires a newer software version.
  • More capacity, which usually means a replacement rather than a code upgrade.

​
Code upgrades

Once you’ve picked a version, MacStadium contacts you to agree a maintenance window that suits you. In the window:
  • The upgrade itself takes around 5 minutes.
  • A further 5 minutes or so goes on verification: confirming traffic is still flowing through the firewall, that you can reach your assets, and that the features running beforehand still work, including site-to-site VPN and remote access VPN. The test is whether you can carry on working as you did before the window, not just whether the firewall came back up.
VPN tunnels may take a few minutes to re-establish after the firewall restarts. If a site-to-site tunnel doesn’t come back up, contact MacStadium Support.

​
Firewall replacements

A replacement happens in two parts. Pre-staging. MacStadium builds and configures the new firewall ahead of time. This can take a while and doesn’t affect your running environment, since the old firewall is still handling traffic throughout. Cutover. Once the new firewall is staged, MacStadium contacts you to agree a window for the switch. In that window the old firewall is shut down and the new one brought into service, then verified the same way: licensing, site-to-site VPN, remote access VPN, reachability of your assets, and anything else you were running beforehand.

​
Emergency maintenance

The exception to all of the above is a critical security vulnerability. When one is severe enough, MacStadium may need to patch without waiting for a window you’ve chosen, because the alternative is leaving it unpatched. Notice in that case may be short.

​
After the window

Before closing the window, MacStadium confirms the firewall is on the expected version, interfaces are up, routing has converged, VPN tunnels have re-established, and that you can still reach your assets and operate as you did beforehand. If you notice a lingering connectivity issue after a window closes, contact MacStadium Support with your firewall hostname and roughly when you noticed it.