Before you begin the update, Cisco strongly recommends that you delete or move any backup files that reside on your appliance, then back
up current event and configuration data to an external location.

Use the Defense Center to back up event and configuration data for itself and the devices it manages. For more information on the backup
and restore feature, see the FireSIGHT System User Guide.

Note:

The Defense Center purges locally stored backups from previous updates. To retain archived backups, store the backups externally.

Caution:

BIOS Version 2.0.1b must be running on DC2000 and DC4000 appliances in order to update to version 5.4.1.1 and later. If

updating your appliances fails due to an incompatible BIOS version, contact Support.

Caution:

Prior to updating an ASA FirePOWER module running FirePOWER Services or a Cisco ASA managed by ASDM, set the device

clock to the correct time. If an ASA device clock is set to the incorrect time before updating, the Access Control Licensing page does not
load.

Traffic Flow and Inspection During the Update

The update process reboots managed devices and might restart the Snort process. Depending on how your devices are configured and
deployed, the following capabilities could be affected



traffic inspection, including application awareness and control, user control, URL filtering, Security Intelligence, intrusion detection
and prevention, and connection logging



traffic flow, including switching, routing, NAT, VPN, and related functionality



link state

Note that when you update clustered 7000 or 8000 Series devices or device stacks, the system performs the update one device at a time to
avoid traffic interruption. When you update clustered devices, apply the update one device at a time, allowing the update to complete before
updating the second device.

The following table explains how Snort restarts affect traffic inspection. It is reasonable to anticipate that the product update could affect
traffic similarly.