We've got it!
Thank you so much Colin and JCelis. I plugged the IAP-325 onto another network, logged onto it using admin/admin and uploaded the Hercules 6.4.4.4-4.2.3.1_54637. Connected back to our network and hey presto!! It is working.
Here are the two things that I noticed:
1. If you plug the new IAP-325 into the same network and try to login, it wouldn't let you login to IAP-325 portal instead it will keep referring to currnet controller, whatever it may be IAP-225, 115, 103 etc. You really need to plug it into another network.
2. There is another great option in IAP-325, upload image via file upload, which is missing in IAP-225/115. This means, you no longer have to rely on TFTP Server or http. You can upload the image straight from the file.
3. You only need to upgrade/update firmware on one IAP-325, once it's added into the mix and working, you can add more IAP-325s straight away. You don't need to configure them outside of network - it will pick the configurationa and firmware from the IAP-325.
Kindest regards
J.