topic Re: Upgrade Catalyst 9800 in Wireless

Upgrade Catalyst 9800

Maurice Ball — Sat, 23 Mar 2024 13:21:47 GMT

Could someone please help me out with this? Cisco wrote this so confusing I need some validation. I am planning on upgrading my Catalyst 9800-L to the recommended code version 17.9.4a. When I look at the APSP release notes it states that I need to install the SMU as well as the APSP. I see the install files for the APSP for the code version 17.9.4a installation but when I check for the SMU package. I only see a SMU package for 17.9.4. Do I need to install the SMU for 17.9.4 also or only the APSP for the WLC software version 17.9.4a?

Re: Upgrade Catalyst 9800

Leo Laohoo — Sat, 23 Mar 2024 13:25:23 GMT

Apply the SMU on 17.9.4 to fix the security vulnerability. 17.9.4 with the SMU is exactly the same as 17.9.4a.

Re: Upgrade Catalyst 9800

Maurice Ball — Sat, 23 Mar 2024 15:54:10 GMT

I should apply that same SMU to code version 17.9.4a?

Re: Upgrade Catalyst 9800

Maurice Ball — Sat, 23 Mar 2024 16:00:42 GMT

The following is stated on the software page:

Dear Cisco Customer, If you are not using APSP in 17.9.4, please use 17.9.4a, to obtain fix for CSCwh87343, Cisco IOS XE Software Web UI Privilege Escalation Vulnerability, CVE-2023-20273. In case of SMU/APSP installed, please wait until SMU for CSCwh87343 is available for 17.9.4

Which makes me think the fix for the SMU is included in the code version 17.9.4a.

Re: Upgrade Catalyst 9800

Mark Elsen — Sat, 23 Mar 2024 16:15:07 GMT

- I would advise to go direct to 17.9.5 , as far as I am 'aware off internally...' it is planned to become an advisory (and then you have the SMU stuff already) ; no further worries about SMU.

Appendix : also after upgrades for instance , it remains useful to check the controller again using
the CLI command show tech wireless and feed the output to : Wireless Config Analyzer

Re: Upgrade Catalyst 9800

Leo Laohoo — Sun, 24 Mar 2024 01:57:00 GMT

@Maurice Ball wrote:
I should apply that same SMU to code version 17.9.4a?

Might as well go straight to 17.9.5 and start testing.

17.9.5 APSP 1 is already out and APSP 1 Release Notes can be found HERE.

Re: Upgrade Catalyst 9800

Maurice Ball — Mon, 25 Mar 2024 08:42:16 GMT

ok thanks for the help.

Re: Upgrade Catalyst 9800

Mark Elsen — Mon, 25 Mar 2024 09:27:22 GMT

- No problem , in between Leo mentioned an SMU/APSP for 17.9.5 ; my take on that is : For the time being stick to native 17.9.5 only , review the content of the SMU/APSP and only use it when you see a specific item mentioned in the problem list (that you might experience) . It makes things simpler for upgrading and avoids conflicts and problems when going to the next version ,

Re: Upgrade Catalyst 9800

Leo Laohoo — Mon, 25 Mar 2024 12:05:35 GMT

Today, I upgraded a pair of 9800-80 (VSS) to 17.12.3 manually. No DNAC. No PI.

What is so unique about it? I unpacked the packages and set the controller to reboot 15 minutes later.

Re: Upgrade Catalyst 9800

Maurice Ball — Wed, 27 Mar 2024 10:56:46 GMT

The controller was back operational within 15 minutes?

Re: Upgrade Catalyst 9800

Leo Laohoo — Wed, 27 Mar 2024 11:21:13 GMT

@Maurice Ball wrote:
The controller was back operational within 15 minutes?

That is not what I meant.

I initiated the software install so the packages can be extracted, however, I did something to delay the automatic script from rebooting the controller for another 15 minutes.

And then the pair of 9800 rebooted.

Re: Upgrade Catalyst 9800

Gehrig_W — Wed, 10 Jul 2024 20:28:57 GMT

Hello Leo, can You put some more light on this please?

What would You liek to achieve with this 15 minutes delay ?

Thank You

Wini

Re: Upgrade Catalyst 9800

Leo Laohoo — Wed, 10 Jul 2024 22:33:11 GMT

@Gehrig_W wrote:
What would You liek to achieve with this 15 minutes delay ?

Hi Wini,

Without using DNAC or PI, I have demonstrated that I can unpack all the packages at a particular time but reboot the WLC, router or switches at a time-and-date of my choosing.

Hope this makes sense.