PAGE UPDATED: Dec. 30, 2024
Overview
Zebra LifeGuard system delivers OS updates and security patches to Zebra devices running Android through its Firmware Over the Air (FOTA) Client app and the Zebra Common Transport Layer (CTL) service. Updates include patches and fixes to Zebra embedded systems, as well as security updates from Google, which publishes a monthly list of OS vulnerabilities tracked as the Security Patch Level (SPL). The SPL on Zebra devices can be found in Settings > System > System update and are cumulative; each includes vulnerability fixes from all previous updates.
Built on Google Firebase Cloud Messaging (FCM), the solution includes a set of REST APIs that can be used by EMM solution providers to interface with Zebra servers and automate updates of managed devices. Organizations using an Enterprise Mobility Management (EMM) system integrated with LifeGuard OTA can view, select and apply updates from within compatible EMM systems. In addition, StageNow 5.0 and later integrates with the LifeGuard update database, allowing administrators to easily identify the OS and LifeGuard image(s) required for upgrade operation(s) in StageNow Profiles. See StageNow section for more information.
EMM solution providers interested in integrating with Zebra LifeGuard APIs can learn more at the Zebra Developer Portal (login required).
LifeGuard OTA Updates
Scheduled Maintenance
Zebra's over-the-air service requires periodic maintenance. See the schedule of planned service outages.
Device Requirements
The following is required for a device to receive updates using LifeGuard OTA through an EMM:
- Devices must be fully managed
- Automatic Update feature is supported on:
- Android 14: All devices, all packages
- Android 13: All devices, all packages
- Android 11: All devices, all packages
- Android 10: Full OTA packages (baseline only)
- Android 8.x (Oreo): Supported only on PS20J devices with BSP 1.30.04 Patch 19 (or later)
- Android 7.x (Nougat): With Patch 19 (or later)
- FOTA client must be enabled on device(s)
- Internet connectivity must be active (for downloads to device)
- The following network ports must be open for LifeGuard and FCM operations:
- 443
- 5228
- 5229
- 5230
Select one of these IP options (to apply to FCM ports listed above): - No internet protocol (IP) restrictions (recommended)
- All IP addresses for default domains
- The following LifeGuard servers are accessed over port 443 for device enrollment and downloads:
fts.zebra.comdownloads.zebra.comzbr-entitled-downloads-prod.s3.amazonaws.coms3-1-w.amazonaws.coms3-w.us-east-1.amazonaws.com
More Information
- Zebra Data Services FAQ | Frequently asked questions about Zebra's data transportation
- Zebra Network Traffic | All Zebra device traffic explained on a single page
- FCM networking policies and restrictions | Google's Firebase firewall docs
OTA Update Instructions
The instructions linked below describe the manual process for upgrading SDM660- and 6490-platform devices from Android 8.x Oreo (or later) to the Android version indicated. The instructions also can be used as a basis for developing an EMM-driven update process.
Before attempting to upgrade, find out which Android version is current for the intended target device(s).
| From OS | To OS | Platform or Device(s) | Instructions (R-click to download) |
|---|---|---|---|
| Android 8.x (Oreo) or later | Android 13 | SDM660 | View Guide |
| Android 8 (or later) | Android 13 | TC21 GMS and other SDM660-platform devices | View PDF |
| Android 8 (or later) | Android 13 | TC53 GMS | View PDF |
| Android 8 (or later) | Android 13 | TC73 GMS | View PDF |
| Android 8 (or later) | Android 13 | 6490-platform devices | View PDF |
| Android 11 (factory) | Android 11 (latest) | 6490 | View PDF |
| Android 8 (or later) | Android 11 (latest) | 6490 | View PDF |
| Android 8.x (Oreo) or later | Android 11 | SDM660 | View PDF |
| Android 8.x (Oreo) or later | Android 10 | SDM660 | View PDF |
| Android 8.x (Oreo) or later | Android 9.x (Pie) | SDM660 | View PDF |
| Android 8.x (Oreo) or later | Android 8.x (Updates only; not for OS upgrade) | SDM660 | View PDF |
Upgrade instructions for 8956-platform devices can be found within their respective release notes.
Automatic Updates
The LifeGuard system gives administrators the option of applying device updates automatically whenever one is available from Zebra. There are two options for enabling auto-updates; a device can be enrolled in one or the other:
Zebra-managed Auto Updates
If not disabled on the device by the administrator, Zebra-managed updates can be enabled by toggling Automatic System Updates in the FOTA client UI:
- Settings > System > System update > Gear icon > Automatic System Update (toggle)
The FOTA client also can be enabled using Zebra StageNow or an EMM system with Zebra OEMConfig.
Important Notes
- Enabling this option disables any prior enrollment in enterprise-managed automatic updates.
- If an EMM system was previously managing the device, the device loses enterprise tenancy and enrollment status on the FOTA client changes to "Enrolled to Zebra Services" (after about 10 minutes).
- Devices can opt out of FOTA-service updates by moving the toggle to the disabled position. After about 10 minutes, the enrollment status should read "Not Enrolled."
- After enabling the FOTA service, an OS upgrade request is triggered if:
- Any device(s) were enrolled in the last 24 hours.
- A new BSP has been released in the last 24 hours (applies to previously enrolled devices).
Enterprise-managed Auto Updates
For companies with an EMM system integrated with Zebra LifeGuard OTA, this option is enabled by enrolling the device using Zebra Enrollment Manager and setting an auto-update deployment policy for the device(s). This option enables additional controls for setting update schedules and other rules.
Auto-update Features Compared
| Zebra-managed Automatic Updates | Enterprise-managed Automatic Updates |
|---|---|
| Full Automation | Flexible Automation |
| Fixed rules | Admin sets rules for update network and device power |
| Download over LAN, WLAN, or WWAN (whatever is available) | Select which networks to use for updates |
| No local media server support | Supports local media server |
| Start updates at a selected time of day; user can postpone | Scheduled updates |
| Sends updates 1-3 days after release | Allows testing of updates before sending |
| No device-user messaging | Allows custom messages to device user |
| No EMM required | EMM required |
| Enroll on device or through StageNow | Enroll through EMM only |
| Cancel updates on device or via StageNow | Cancel updates via EMM server |
| Supports Android 11+ | Supports Android 7+ |
Non-FOTA Update Methods
If a device fails to complete an update (or hangs up after a failed update attempt), a non-FOTA update can often restore the device to operation without the need to send it out for repair.
- Non-FOTA update methods include:
- Zebra StageNow - and its Smart Update* can be used to manually build a staging Profile to upgrade to a newer OS version.
- EMM system with Zebra OEMConfig - using one of the LifeGuard builds downloaded for the intended target device.
- If the target device contains a build without the "STD" (standard) designation, the build selected for the staging Profile must be selected manually.
- Upon a successful non-FOTA upgrade using a STD-designated build, the device can be enabled to receive automatic system updates via FOTA.
* Smart Update requires a "STD" build on the device; not compatible with "PRD" or other designations.