Cisco Catalyst Center - Image Update

Netmart — Tue, 11 Nov 2025 18:29:58 GMT

Hello,

I was wondering, whether the Cisco Catalyst Workflow for upgrading images on switches like Cat9300 series consider delta check between running and startup config prior to pushing the upgrade.

Otherwise, the delta check has to be considered as manual task prior to the upgrade.

Please advise.

Thanks,

Re: Cisco Catalyst Center - Image Update

Royalty — Wed, 12 Nov 2025 01:59:51 GMT

Hi @Netmart,

It does not check or save the configuration for the software distribution phase but it will do a write memory before proceeding with software activation. The switch will not proceed with the Install Mode upgrade and the 'install add file' command if the system configuration has been modified, so it is a requirement for the startup and running config to be in sync. It doesn't do a specific check as part of the pre checks though. I personally make it a habit to resync the device (given the 24 hour default resync period unless edited for the specific device) and then re-run inventory compliance checks before upgrading which does show whether the system running and nvram startup config are aligned. The only other way of streamlining the process under the SWIM without having to navigate to provision/inventory is to probably add a custom check and attach that to the software distribution/activation phase as desired.

See the below for CC software activation logging:

Switch#
*Aug 15 21:41:43.904: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: dnaadmin] [Source: 10.50.50.50] [localport: 22] at 21:41:43 UTC Tue Aug 15 2025
*Aug 15 21:41:44.013: %HA_EM-6-LOG: catchall: enable
*Aug 15 21:41:44.070: %HA_EM-6-LOG: catchall: terminal length 0
*Aug 15 21:41:44.124: %HA_EM-6-LOG: catchall: terminal width 0
*Aug 15 21:41:44.194: %HA_EM-6-LOG: catchall: show ip interface brief
*Aug 15 21:41:44.288: %HA_EM-6-LOG: catchall: show cdp neighbors
*Aug 15 21:41:44.393: %HA_EM-6-LOG: catchall: show spanning-tree summary
*Aug 15 21:41:47.280: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: dnaadmin] [Source: 10.50.50.50] [localport: 22] at 21:41:47 UTC Tue Aug 15 2025
*Aug 15 21:41:47.388: %HA_EM-6-LOG: catchall: enable
*Aug 15 21:41:47.444: %HA_EM-6-LOG: catchall: terminal length 0
*Aug 15 21:41:47.495: %HA_EM-6-LOG: catchall: terminal width 0
*Aug 15 21:41:47.544: %HA_EM-6-LOG: catchall: show clock
*Aug 15 21:41:47.683: %HA_EM-6-LOG: catchall: show version
*Aug 15 21:41:47.774: %HA_EM-6-LOG: catchall: show romvar
*Aug 15 21:41:47.861: %HA_EM-6-LOG: catchall: show boot
*Aug 15 21:41:48.066: %HA_EM-6-LOG: catchall: show version
*Aug 15 21:41:48.250: %HA_EM-6-LOG: catchall: show version
*Aug 15 21:41:48.340: %HA_EM-6-LOG: catchall: terminal width 0
*Aug 15 21:41:48.460: %HA_EM-6-LOG: catchall: dir flash:cat9k_lite_iosxe_npe.17.12.04.SPA.bin
*Aug 15 21:41:48.574: %HA_EM-6-LOG: catchall: show clock
*Aug 15 21:41:48.682: %HA_EM-6-LOG: catchall: show install summary
*Aug 15 21:41:48.833: %HA_EM-6-LOG: catchall: show boot
*Aug 15 21:41:48.929: %HA_EM-6-LOG: catchall: terminal width 0
*Aug 15 21:41:48.973: %HA_EM-6-LOG: catchall: configure terminal
*Aug 15 21:41:49.029: %HA_EM-6-LOG: catchall: no boot manual
*Aug 15 21:41:49.084: %HA_EM-6-LOG: catchall: no boot system
*Aug 15 21:41:49.158: %HA_EM-6-LOG: catchall: boot system flash:packages.conf
*Aug 15 21:41:49.189: %SYS-5-CONFIG_I: Configured from console by dnaadmin on vty2 (10.50.50.50)
*Aug 15 21:41:49.194: %HA_EM-6-LOG: catchall: exit
*Aug 15 21:41:49.824: %HA_EM-6-LOG: catchall: write memory
*Aug 15 21:41:51.257: %HA_EM-6-LOG: catchall: show version
*Aug 15 21:41:51.335: %HA_EM-6-LOG: catchall: show clock
*Aug 15 21:41:51.435: %HA_EM-6-LOG: catchall: terminal width 0
*Aug 15 21:41:51.587: %HA_EM-6-LOG: catchall: install add file flash:cat9k_lite_iosxe_npe.17.12.04.SPA.bin activate commit
*Aug 15 21:41:51.605: %INSTALL-5-INSTALL_START_INFO: Switch 1 R0/0: install_mgr: Started install add_activate_commit flash:cat9k_lite_iosxe_npe.17.12.04.SPA.bin
*Aug 15 21:42:04.110: %HA_EM-6-LOG: catchall: disable
*Aug 15 21:42:04.145: %SYS-6-LOGOUT: User dnaadmin has exited tty session 2(10.50.50.50)
*Aug 15 21:42:04.152: %HA_EM-6-LOG: catchall: logout
*Aug 15 21:43:48.353: %HA_EM-6-LOG: catchall: disable
*Aug 15 21:43:48.383: %SYS-6-LOGOUT: User dnaadmin has exited tty session 3(10.50.50.50)
*Aug 15 21:43:48.390: %HA_EM-6-LOG: catchall: logout

Hope that helps somewhat!

Re: Cisco Catalyst Center - Image Update

Netmart — Mon, 17 Nov 2025 04:56:56 GMT

Thank you very much for providing those insights.

In this context, you might have come across the following behavior:

Cisco Bug: CSCwf33035
SWIM upgrade pre-check behavior does not match upgrade behavior

Known Affected Release

DNAC2.3.3.7

Description (partial)

Symptom: Cisco DNA Center's SWIM upgrade pre-check tests a file transfer to device using its own IP address (e.g.: "copy HTTPS://{CiscoDNACenter-IP-address}//core/img/cisco-bridge.png null:".) However, during an actual upgrade distribution is completed using the FQDN (e.g.: "copy HTTPS://{CiscoDNACenter-FQDN}/api/v1/file/temporary/fe24c26b-7f7d-4e48-86d8-f0b7ab2591b0 flash:".) If the user does not have "name-server" configured on the switch or that DNS server is not configured with the Cisco DNA Center appliance's FQDN, then the distribution activity will fail, even though the pre-check states that file transfer check is successful. The error log in the GUI may look similar to this. DNAC.EXAMPLE.COM/api/v1/file/temporary/fe24c26b-7f7d-4e48-86d8-f0b7ab2591b0... %Error opening HTTPS://DNAC.EXAMPLE.COM/api/v1/file/temporary/fe24c26b-7f7d-4e48-86d8-f0b7ab2591b0 (I/O error) ) Task Name Secondary Protocol Task Status Failure (NCSW32001: File checksum/size on destination varies from file checksum/size of source. \n Probable Cause: The file copy failed due to Temporary Network errors.. )

topic Re: Cisco Catalyst Center - Image Update in Cisco Catalyst Center

Cisco Catalyst Center - Image Update

Re: Cisco Catalyst Center - Image Update

Re: Cisco Catalyst Center - Image Update