Patching One HA fully then the next.

[RobinClayton]

If patching a HA pair to the next Major version i.e. 9.0.6 -> 9.1.0  is it safe to patch one of the pair all the way to 9.1.0 (minor versions and major versions) 

And then fail over and do the other firewall to bring that up to latest minor and finally on to the major version.

Or should both firewalls be running the same latest minor version before updating the Major. 

And I guess the same question when doing the software vesion, should both be at the very last version of Major/Minor before moving one to the next software?

Cheers

Rob

[BPry]

@RobinClayton,

As long as it's a single major version difference, I've never had an issue upgrading one box fully to the target maintenance release in the next major release and then doing the other box once I've failed over traffic. That's standard operating procedure when I'm doing major release updates. 

[RobinClayton]

cheers