topic Re: C9800 Upgrade scenario including replacing EOL'd WAPs. in Wireless

C9800 Upgrade scenario including replacing EOL'd WAPs.

mike.gusway — Thu, 20 Nov 2025 15:53:06 GMT

We have a 9800-40 HA SSO pair running 17.9.5 controlling almost all 2800-series APs with a handful of older 3702I APs. The 3702I is no longer supported after 17.9.8. We purchased all new 9172I APs to replace them, but those are not supported until 17.5.x. This means I can't join/configure/test the new APs until we upgrade the WLC, at which point the existing older APs would stop working, correct?

In the release notes for 17.15.x, it says that we can't go straight from 17.9.5 to 17.15.3. Looking over the ISSU matrix, it looks like we can do an ISSU from 17.9.5 to 17.9.8, and then ISSU from 17.9.8 directly to 17.15.3. The actual file I was looking at caps out the 17.9.x track at 17.9.7 but I'm assuming it hasn't been updated to include 17.9.8 yet. Should we go from 17.9.5 to 17.9.7 just in case?

ISSU Matrix

Either way, my main question revolves around the EOL'd 3702I APs. Do I need to remove them from the WLC prior to upgrading it to 17.15.3 in order to use ISSU, or will the upgrade complete and the older unsupported APs just be disconnected/removed automatically?

WiFi is critical in some areas like our distribution warehouses that run 24x7. Fortunately, the older 3702I APs are all in office areas that aren't used on the weekends. My hope is that we can upgrade the WLC on a weekend using ISSU to minimize any disruption in the warehouses, and no one will mind the offices being dark while we physically swap out the older APs for the new 9172I APs.

Any thoughts or advice on this would be greatly appreciated!

Thanks,

-Mike

Re: C9800 Upgrade scenario including replacing EOL'd WAPs.

Mark Elsen — Thu, 20 Nov 2025 16:22:54 GMT

- @mike.gusway The 3700 series are supported until 17.12.x according to : https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html

Unsupported APs will not be removed automatically , they will keep attempting to
reach the controller. Best is to disable them first (can be done by shutting down a POE-port)

>... My hope is that we can upgrade the WLC on a weekend using ISSU to minimize any disruption in the warehouses, and no one will mind the offices being dark while we physically swap out the older APs for the new 9172I APs.
Perhaps both activities could be executed together ?

- Ref : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/222405-upgrade-catalyst-9800-wlc-ha-sso-using-i.html
>....ISSU is available only between major releases within the same train. For example, 16.x.x to 17.x.x or 17.x.x to the next major train is not supported
From that I would understand that ISSU is possible between 17.9.5 and any 17.x.x higher version

Also look at : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/222405-upgrade-catalyst-9800-wlc-ha-sso-using-i.html#toc-hId--245480941
and or check the complete document too!

Appendix : always validate the configuration of a 9800 controller with the
CLI command show tech wireless and feed the output from that into Wireless Config Analyzer
(also always useful , before and after upgrades)

Re: C9800 Upgrade scenario including replacing EOL'd WAPs.

mike.gusway — Thu, 20 Nov 2025 16:54:01 GMT

Thanks for the reply, Mark. Yes, I've been reading as much as I can between that WLC document you linked and the release notes for 17.15.x . I caught this in the release notes below the table for "Upgrade Path to Cisco IOS XE 17.15.x":

Upgrade Path to Cisco IOS XE 17.15.x

"Additionally, an AP running Cisco IOS XE 17.9.5 or an earlier release does not have enough storage space to download Cisco IOS XE 17.15.x releases. Therefore, if you upgrade an AP image from 17.9.5 to 17.15.x would also fail."

I'm not sure what to think of that particular note, as the table says we can go from 17.9.5 directly to 17.15.3 since we don't have any 9130 or 9124. The ISSU matrix also says 17.9.5 directly to 17.15.3 is supported. That note about AP image version is why I thought we needed an interim update higher than 17.9.5. Am I missing something there?

Thanks!

Re: C9800 Upgrade scenario including replacing EOL'd WAPs.

Mark Elsen — Thu, 20 Nov 2025 17:00:18 GMT

- @mike.gusway >...."Additionally, an AP running Cisco IOS XE 17.9.5 or an earlier release does not have enough storage space to download Cisco IOS XE 17.15.x releases. Therefore, if you upgrade an AP image from 17.9.5 to 17.15.x would also fail."
It also says : Cisco IOS XE 17.15.1 or later releases have a file size of more than 1.5 GB, which is not supported by Cisco IOS XE 17.11.1 or earlier releases. If you are running Cisco IOS XE 17.11.1 or earlier releases, you must first upgrade to Cisco IOS XE 17.12.x (for example, 17.12.5), and then upgrade to Cisco IOS XE 17.15.x or later.
This according to me is a requirement 'in all circumstances' !

I find it difficult to understand the ISSU matrix, but I would still say it's safe f you stay in 17.x releases

Re: C9800 Upgrade scenario including replacing EOL'd WAPs.

mike.gusway — Thu, 20 Nov 2025 17:06:19 GMT

@Mark Elsen wrote:

- @mike.gusway >...."Additionally, an AP running Cisco IOS XE 17.9.5 or an earlier release does not have enough storage space to download Cisco IOS XE 17.15.x releases. Therefore, if you upgrade an AP image from 17.9.5 to 17.15.x would also fail."
It also says : Cisco IOS XE 17.15.1 or later releases have a file size of more than 1.5 GB, which is not supported by Cisco IOS XE 17.11.1 or earlier releases. If you are running Cisco IOS XE 17.11.1 or earlier releases, you must first upgrade to Cisco IOS XE 17.12.x (for example, 17.12.5), and then upgrade to Cisco IOS XE 17.15.x or later.
This according to me is a requirement 'in all circumstances'
That's the confusing part, as the upgrade table just above that note says you can go directly from 17.9.5 to 17.15.3x. Based on that note, I would think the table should indicate that you need to upgrade to 17.12.x first.

Re: C9800 Upgrade scenario including replacing EOL'd WAPs.

Mark Elsen — Thu, 20 Nov 2025 17:10:18 GMT

- @mike.gusway I consider that an error in the documentation too , when reading that part literally the 17.12.x
upgrade should be done first and I also advice that.

Re: C9800 Upgrade scenario including replacing EOL'd WAPs.

Mark Elsen — Thu, 20 Nov 2025 17:12:44 GMT

- @mike.gusway Perhaps the only argument for the 'table-sentence' could be that it is valid for an empty controller,
which would later use 17.15.x compatible APs

Re: C9800 Upgrade scenario including replacing EOL'd WAPs.

mike.gusway — Thu, 20 Nov 2025 18:32:24 GMT

Okay, so it looks like I should use ISSU to get from 17.9.5 to 17.12.5, and then ISSU again to get from 17.12.5 up to 172.15.3 in order to support the brand new 9172I APs.

Thanks

Re: C9800 Upgrade scenario including replacing EOL'd WAPs.

Mark Elsen — Thu, 20 Nov 2025 20:25:19 GMT

- @mike.gusway Ok, good luck,

Re: C9800 Upgrade scenario including replacing EOL'd WAPs.

Leo Laohoo — Thu, 20 Nov 2025 20:42:12 GMT

@mike.gusway wrote:
In the release notes for 17.15.x, it says that we can't go straight from 17.9.5 to 17.15.3.

The Release Notes specifically states that the AP cannot go straight to 17.15.X. Only the AP. The controller can.

If I was to go about doing this, this is what I would do:

1. Force the AP to "pre-download" 17.12.X but not (yet) reboot.
2. Upload (not upgrade) 17.15.X to the controller but not do not reboot.
3. Once Step 1 and Step 2 are done, forcefully reboot the APs. Wait 30 seconds before rebooting the controller.

So this is what is going to happen next:

1. The APs reboots first and they will boot into 17.12.X.
2. The controller comes up and boots into 17.15.X.
3. The AP joins the controller, downloads 17.15.X and reboots.
4. The AP boots into 17.15.X and joins the controller.
5. Done.

Re: C9800 Upgrade scenario including replacing EOL'd WAPs.

Leo Laohoo — Wed, 17 Dec 2025 20:49:13 GMT

@mike.gusway wrote:
and then ISSU again to get from 17.12.5 up to 172.15.3

Do not use ISSU to upgrade to 17.15.X. There is a specific warning in the 17.15.X Release Notes:

TAC Recommended Builds

Warning: Due to a collateral introduced in 17.15 and later versions, ISSU process must be avoided at this time, until a fix is available in IOS-XE. Normal upgrade process can be used, and this notice does not impact any other feature or change code evaluation at this time The defects to be tracked are: CSCws35670 & CSCwr15775 , both fixes are required for ISSU to work The symptoms can vary, by they may include among others:
• WLC crash
• Netconf broken after upgrade
• 802.11be profiles missing, causing WLANs not to be broadcasted
• WLANs not pushed to Aps
• GUI is unresponsive

Re: C9800 Upgrade scenario including replacing EOL'd WAPs.

mike.gusway — Wed, 17 Dec 2025 15:23:40 GMT

Thanks, Leo. I had missed that in the Release Notes but didn't use ISSU anyway.

I took advantage of the company's complete closure on Thanksgiving Day here in the US to do a normal upgrade of the WLC from 17.9.5 to 17.12.5 and then another to get up to gold star release 17.15.4b. I had no issues going this route and no one was affected by the WLC and AP restarts. The old APs in the office areas were no longer operational at this point, but we swapped them out first thing on Friday morning with the new 9172I models. No problems there, either. I had them all connected to a switch so that I could remotely make sure they came online and could be programmed after the WLC upgrades. A lot of people had taken that Friday off anyway, and no one had scheduled meetings in the conference rooms where WiFi would have been needed.

-Mike