Seamless firmware upgrade ???

[wpzed]

What are the best practices to avoid downtime caused by firmware upgrade of OPNsense?
My current setup is similar to ‘Diagarm 1’. Is the solution sketched in ‘Diagarm 2’ good, or is there any better solution?

[crlt]

What are the best practices to avoid downtime caused by firmware upgrade of OPNsense?
My current setup is similar to ‘Diagarm 1’. Is the solution sketched in ‘Diagarm 2’ good, or is there any better solution?

The first diagram you posted is just Multi-WAN, this does not provide firewall redundancy so your network will be offline while OPNsense updates.

The second diagram you posted is Multi-WAN with High Availability. Since that setup has two firewalls, you can update the second firewall, temporarily make it the primary while you test functionality and stability, and then when satisfied you can update the first firewall and return it to the active/primary state. In my experience this is the best option with OPNsense. The documentation outlines this procedure in the link below.

https://docs.opnsense.org/manual/how-tos/carp.html#example-updating-a-carp-ha-cluster