Network Device Firmware & Software Upgrade Services

What a controlled upgrade actually involves

The command that installs a new image is the shortest part of the job. What determines whether an upgrade succeeds is everything that happens before and after it: establishing the current software version and hardware revision, confirming there is enough storage for the new image, checking for existing system alarms that will only get harder to diagnose after a change, verifying the software entitlement permits the download, and working out the supported upgrade path — which for many platforms is not a single hop.

After the change, validation is what proves the upgrade worked. Interfaces up is not the same as service restored. Routing adjacencies re-established, VPN tunnels rebuilt, security policies enforcing as intended, wireless clients associating and roaming, licences re-applied — each needs checking against a defined list agreed before the window, so the decision to accept or roll back is made against a standard rather than a feeling.

Our upgrade process

1. AssessCurrent software version, hardware model and revision, storage headroom, active alarms, licence and support entitlement, HA state and configuration size.
2. PlanTarget version selection based on vendor advisories and your feature requirements, supported upgrade path determination including intermediate hops, and a documented rollback position.
3. Back upFull configuration capture, verified as complete and restorable. Where the platform supports it, confirmation that a fallback image is present and bootable.
4. UpgradeExecution inside the agreed maintenance window, HA pairs sequenced so the service survives the change where the design allows it.
5. ValidateService-level verification against criteria agreed before the window — routing, tunnels, policy enforcement, client association, licensing and management reachability.
6. ReportWritten record of before and after state, what was changed, what was validated, and any findings the upgrade surfaced that warrant follow-up.

Platforms we upgrade

When an upgrade is not the right answer

Sometimes the assessment concludes that upgrading is the wrong move. A device may be past end-of-support with no further software releases coming. It may lack the memory or storage to run a version that resolves the vulnerability you are trying to close. The feature you need may only exist on a platform generation you do not own. In those cases we say so and set out the alternatives — refresh, migration, or a compensating control while a replacement is procured. An upgrade that cannot achieve the objective is not worth the maintenance window.

Frequently asked questions

How long does a firmware upgrade take?

For a single device with a straightforward single-hop upgrade path, the change itself typically runs 30 to 90 minutes including reboot and validation. Multi-hop upgrade paths, chassis platforms, large stacks and HA pairs take longer. The assessment produces a per-device time estimate, and we scope maintenance windows against that rather than against an average.

Will the network go down during the upgrade?

It depends on the design. Devices deployed in HA pairs or redundant topologies can often be upgraded with minimal or no service interruption by sequencing the change across the pair. Standalone devices will be unavailable for the duration of the reboot. We identify which devices carry an unavoidable outage during planning so the business can agree the window with full knowledge.

Do I need an active OEM support contract?

For most vendors, downloading current software images requires an active support entitlement on that specific device. Verifying entitlement is part of our assessment. Where entitlement has lapsed, we can advise on renewal options — and in some cases a support renewal is substantially cheaper than the alternatives.

Can you upgrade devices across multiple sites?

Yes. Multi-site upgrade programmes are a common engagement. We typically pilot on a representative site, validate the process and timings, then roll out in waves with a defined go/no-go gate between them. Remote delivery is used where out-of-band management makes it safe, with on-site presence at locations where it does not.

What information do you need to quote?

Vendor, model, current software version, number of devices, whether they are standalone or in HA, site locations, whether remote access is available, and your preferred maintenance window. You can supply this through our upgrade assessment form and we will come back with a scoped proposal.

Related services

• Network & Security Lifecycle Management
• Network Security Patch Management
• Network Device Health Check
• Configuration Backup & Recovery
• Request an Upgrade Assessment