No, it's sufficient to save '/etc/sysconfig/firewall' in your private update.tar.gz
And why not download the new firewall package and install with "dpkg -i"?