Upgrade matrix

Certain versions can be upgraded directly to Forcepoint Email Security version 8.5.x; other versions must be migrated or upgraded to a different version first. The following table details the upgrade/migration paths from previous versions to version 8.5.x.

All upgrades to Forcepoint Email Security in Azure version 8.5.5 require a migration.

Version 8.5.4 and 8.5.5 Virtual Appliances are certified and supported for VMware ESXi 7 / 6.7 / 6.5 / 6.0. A stable release of ESXi is recommended to avoid unexpected issues.

See v8.5.4 Release Notes or v8.5.5 Release Notes.

Note: For ESXi 7 and 6.7, users must use the v8.5.4 OVA file to create a new VM. Versions 8.5.3 and earlier will not deploy and are not supported on ESXi 6.7 or 7.

Platform	Version	Mode	First Step	First Version	Second Step	Final Version
Physical	7.8.4	single	upgrade	8.4.0	upgrade	8.5.0
Physical	8.0.0	single	upgrade	8.3.0	upgrade	8.5.0
Physical	8.0.1	single	upgrade	8.3.0	upgrade	8.5.0
Physical	8.1.0	single			upgrade	8.5.0
Physical	8.2.0	single			upgrade migrate	8.5.0, 8.5.3 8.5.3 Azure
Physical	8.3.0	single			upgrade migrate	8.5.0, 8.5.0 8.5.3 Azure
Physical	8.4.0	single			upgrade migrate	8.5.0, 8.5.3, 8.5.4 8.5.3 Azure, 8.5.4 Azure
Physical	8.5.0	single			upgrade migrate	8.5.0, 8.5.3, 8.5.4 8.5.3 Azure, 8.5.4 Azure
Physical	8.5.3	single			upgrade migrate	8.5.4, 8.5.5 8.5.4 Azure 8.5.5 Azure
Physical	8.5.4	single			upgrade	8.5.5 8.5.5 Azure
Physical	7.8.4	dual	migrate	8.4.0	upgrade	8.5.0
Physical	8.0.0	dual	migrate	8.3.0	upgrade	8.5.0
Physical	8.0.1	dual	migrate	8.3.0	upgrade	8.5.0
Physical	8.1.0	dual			migrate	8.5.0
Physical	8.2.0	dual			migrate	8.5.0
Virtual	7.8.4	single	migrate	8.4.0	upgrade	8.5.0
Virtual	8.0.0	single	migrate	8.3.0	upgrade	8.5.0
Virtual	8.0.1	single	migrate	8.3.0	upgrade	8.5.0
Virtual	8.1.0	single			upgrade	8.5.0
Virtual	8.2.0	single			upgrade migrate	8.5.0, 8.5.3 8.5.3 Azure
Virtual	8.3.0*	single			upgrade migrate	8.5.0, 8.5.3 8.5.3 Azure
Azure	8.3.0	single			migrate	8.5.0 Azure
Virtual	8.4.0	single			upgrade migrate	8.5.0, 8.5.3, 8.5.4 8.5.3 Azure, 8.5.4 Azure
Virtual	8.5.0	single			upgrade migrate	8.5.3, 8.5.4 8.5.3 Azure, 8.5.4 Azure
Azure	8.5.0	single			migrate migrate	8.5.0 Azure 8.5.3 Azure, 8.5.4 Azure
Virtual	8.5.3	single			upgrade migrate	8.5.4, 8.5.5 8.5.4 Azure 8.5.5 Azure
Azure	8.5.3	single			migrate	8.5.4 Azure 8.5.5 Azure
Virtual	8.5.4	single			upgrade	8.5.5 8.5.5 Azure
Azure	8.5.4	single			migrate	8.5.5 Azure

*The version 8.3 virtual appliance was updated and re-released on June 2, 2017. Direct upgrade from a version 8.3 appliance to version 8.5.x is available only if you deployed from the updated OVA file released on June 2, 2017. If you deployed from the original OVA file released on December 19, 2016, you must use the migration process described in Migrate to version 8.5.x under upgrade instructions section.

Important: Starting in version 8.5, vCPU specifications changed for virtual appliances, which will require you to increase your vCPU and RAM allocations following an upgrade from version 8.3 or lower. See the Knowledge Base article Resource Upgrade on OVA and Forcepoint Appliances Getting Started Guide for additional information and virtual appliance specifications.

Versions older than 7.8.4

For systems running a version 7.6.x or 7.7.x deployment, and requiring an upgrade to version 8.5.x, it is necessary to upgrade to version 7.7.0 or 7.8.0 first, then upgrade to version 7.8.4, then to version 8.4, and finally to version 8.5.x. See the following:

For systems running Email Security Gateway on an X10G security blade, it is necessary to upgrade to version 8.0.0 before upgrading to version 8.3. Next, a direct upgrade to version 8.5.0 is possible.

Certain older V10000 and V5000 appliances are not supported with version 8.0.0 and later. See V Series appliances supported with version 8.x.

Any version 7.6.x Email Security component that is currently installed on Windows Server 2003 must be migrated to Windows Server 2008 R2 before the upgrade to v7.7.0. Migration to Windows Server 2012 may be performed after an upgrade to v7.8.0.

Ensure that third-party components are upgraded as well, to work with your new email protection solution version.

Appliance upgrades

For upgrade instructions, see:

We recommend that you perform a complete system backup in the event your system experiences a power outage or other interruption during the upgrade process. Recovery procedures are also included in case they are needed.

The upgrade process includes Forcepoint appliance components (V Series appliance, virtual appliance, or X Series chassis security blade), along with Forcepoint Security Manager and Email Log Server Windows components. Ensure that your deployment additionally includes Forcepoint DLP for data loss prevention (DLP) capabilities. The upgrade process detects and upgrades this module during the Security Manager upgrade.

Warning: Please contact Technical Support before you begin the upgrade process if Forcepoint personnel have customized any Email Security Gateway, TRITON AP-EMAIL, or Forcepoint Email Security back-end configuration settings.

Starting with v8.3.0, a single ISO image (v8.x.x Unified Appliance Installer) is offered to restore an appliance back to the factory settings as well as to upgrade all installed modules in the target appliance to the corresponding version.

Modules include:

App — Base appliance infrastructure and appliance controller

Forcepoint Web Security:

Web — Forcepoint Web Security core components
Proxy — Content Gateway web proxy

Forcepoint Email Security:

Email — Forcepoint Email Security core components

To upgrade an appliance prior to v8.3.0, the legacy RPM upgrade package is required. Refer to the dedicated upgrade guide for V Series or X Series appliances.

If deploying on a virtual appliance, verify the ESXi version. Users of SXi 6.7 must use the v8.5.4 OVA file to create a new VM. Versions 8.5.3 and earlier will not deploy and are not supported on ESXi 6.7.

Dual-Mode appliances

The V Series appliance and the email virtual appliance were re-architected at version 8.3. Dual security mode on the V Series appliance (TRITON AP-EMAIL and TRITON AP-WEB or Web Filter & Security) is no longer supported. It is recommended to migrate the Email module off any dual-mode appliance to a new version 8.5.x appliance, leaving the web security system on the existing appliance. Before beginning the upgrade, see Upgrading V Series Dual-Mode Appliances to Version 8.5 for important upgrade instructions. Email data and messages on an existing virtual appliance must also be migrated to a new version 8.5.x appliance. See Migrate to version 8.5.x under upgrade instructions section.