Upgrading HA

How Sophos Firewall firmware upgrades work when HA is turned on.

If you upgrade Sophos Firewall while the device is in HA mode, there will be no downtime throughout the upgrade process.

The image below shows how the HA firmware process works when the Sophos Firewall is running in HA.

HA upgrade process

In HA, a group of two devices works as a single entity known as a cluster. Every HA cluster has one primary device and one secondary (auxiliary) device. The primary device controls how the cluster operates, while the auxiliary device always waits to become the primary device. The roles of the primary and auxiliary devices in the cluster depend on the configuration mode.

When you upgrade an HA device, the process is as follows:

  1. The primary device (device A) upgrades the secondary device (device B).
  2. Device B runs the new firmware and takes control of the network. It's now the primary device and device A is the secondary.
  3. Device A then upgrades and runs the new firmware. It's still the secondary device, but if you have configured the other device as a preferred primary, then the cluster will failover.
Note You can also roll back the firmware version of a HA pair without disabling HA. This follows the same process.
Caution Don’t upgrade the HA pair using the Boot firmware image option.