Upgrade or Downgrade Edge SWG (ProxySG) or Advanced Secure Gateway using the Command Line Interface
Article ID: 169271
Updated On:
Products
Issue/Introduction
Learn how to upgrade or downgrade the Symantec Edge SWG (ProxySG) or Symantec Advanced Secure Gateway (ASG) using the Command Line Interface (CLI) through Secure Shell (SSH) or serial console.
For instructions for upgrading through the Graphical User Interface (GUI), please see Upgrade Edge SWG (ProxySG) or Advanced Secure Gateway via the GUI.
Environment
Edge SWG or ASG requirements for CLI upgrade:
- Have the correct SGOS image hosted on a server that is accessible from the Edge SWG or ASG, or link location from the support site download page
- Have a recent backup of all private data. See Backup or copy the Edge SWG (ProxySG) configuration via the CLI (SSH) (recommended to get private data shown in config)
- Follow the correct upgrade/downgrade path. See SGOS Upgrade/Downgrade Requirements and Resources
- Make sure regarding upgrading or downgrading to the recommended release for the appropriate branch. See Recommended stable releases for Edge SWG (ProxySG) and Advanced Secure Gateway (ASG)
Resolution
Connect to the command line (with SSH or a serial console) and run these commands:
# en
# conf t
# (config) upgrade-path "http://xxx.xxx.xxx.xxx/path/to/file.bcsi"
# (config) exit
# load upgrade
# restart upgrade
Notes:
- Quotes around the URL are only needed when special characters are in the URL like "?"
- xxx.xxx.xxx.xxx is the IP address of the server where the file is hosted.
- /path/to/file.bcsi is the path and filename of the image
The use of HTTPS for the download URL will require Edge SWG or ASG to know the certificate of that server. Specify the IP or URL that would be appropriate for the CN of the Certificate used. If the certificate has the IP address as the CN, then the URL must contain the IP address, or, if the certificate has the hostname as CN, then specify the hostname in the URL. For HTTP this does not matter. Edge SWG and ASG already have the appropriate Certificates to Validate the URL link for the Symantec site.
Load the OS to the Edge SWG (ProxySG) or ASG using the HTTPS URL from the Broadcom Support Portal
- Log in to the Broadcom Support Portal and go to the Product Downloads section.
- If there are a lot of products listed, narrow down by hardware type. In this example, an SG-S500-20 is used.
- Choose the release version from the drop-down menu next to the model desired, and click the link on the model number.
- On the following screen, find the .bsci file, and click the "Generate" link on the right-hand side
- The download link will now appear. Select the text of the download link and copy it.
- Use this URL as the upgrade-path in the commands given at the beginning of the article.
Additional Information
NOTE: When upgrading to a newer version, you may have to rejoin the domain (in some cases). This is generally not needed when you upgrade to a newer version but it may be needed if you have to downgrade for some reason. You may have to do this if authentication stops working after the upgrade or downgrade. In such cases, you will have to delete the SG Machine account from AD and rejoin the domain. Here is the KB article on how to join the Windows Domain.
Feedback
