WAAS upgrade

[sarabsin]

Hi,

We have a existing WAAS deployment with WAE 574 and WAAS CM 274.

We are planning to upgrade WAE with 594 and CM with 294.

I was thinking to backup and restore CM 274 to CM 294 and then replace the CM 274 with it . And register all existing 574s in remote sites and HQ to new 294 CM and then upgrade/replace WAE 574 with 594 one by one by registering them to new 294.

Is this good plan? Please let me know . if not please suggest better plan.I would like to have minimum downtime.

Also while i replace CM  during maintenance window, will this affect production traffic between all WAE 574s?

if one inline WAE is shutdown , does it block the traffic passing through or just do the bypass?

Your response is much appreciated in advance. 

[finn.poulsen]

Hi,

Assume that you'll be running the same WAAS version (during the migration at least) !

But why not follow the procedure, described by Cisco :

https://www.cisco.com/c/en/us/td/docs/app_ntwk_services/waas/waas/v531/configuration/guide/cnfg/maint.html#pgfId-1227475

This is for version 5.3.1 - check the version that corresponds to your version.

... and allow things to syncronize & remember to backup the CMS database !

>Also while i replace CM  during maintenance window, will this affect production traffic between all WAE 574s?

Answer : No, the CM does not directly participate in the optimization or operation of WAAS Accelerator devices.

CM is being used for : pushing opt. policies, reporting, storing of some certificates (if used) and if secure stores are used: encryption keys for disks (beware if this is used).

>if one inline WAE is shutdown , does it block the traffic passing through or just do the bypass?

Well, traffic will be bridged between the two interfaces, so it should just flow unaffected.

But if the cabling is not done accordingly to specs (straigh-through and/or Crossed), traffic will be blocked, when the inline relay kicks in.

Also be aware of potential spanning tree configs setup, which might block the port for some seconds.

Best regards

Finn

[sarabsin]

Hi Finn,

Thanks for your reply.

In the link you provide , it asks to add new 294 as secondary CM and then upgrade to primary.

I have already backed up database from primary and restored it to new 294 successfully.

My plan is to unplug existing 274 CM completely from network and plug 294 CM to same ports in the network. It has same IP address since it was restored exactly as 274 CM

I have few questions:

do i have to ssh to each exiting WAE devices   and recover them using "cms recover identity default" .

or will they automatically register with new 294 CM since it has same database/config from CM 274.?

if i force unregister/register - then i will have to delete the entries for each WAE from 294 CM , that is not what i want to achieve here?

I would like to keep the configs/policies for each WAE on 294 CM intact.

[finn.poulsen · Accepted solution]

Hi again,

If your using the same :

1. CMS database (restored from a copy)
2. Same IP config on CM294 as on CM274 (this is not within the database backup you have restored, but in the CLI)
3. and same hostname

The Accelerator WAEs should just connect automatically to the new CM.294, when it comes online.

And nothing will be changed.

But be aware that the changes you have made to the CM.274 (which is in production now) since the database backup was taken, will be lost.

You would have a synced database, if you used the approach in the document.

But newer mind.

Best regards

Finn

[sarabsin]

Thanks for confirming it Finn.

I will be implementing the change this weekend. Will update it you how does it go.

My next step is if CM is deployed successfully this weekend , then i would like to replace remote and HQ WAE 574 with WAE 594s .

Can i just put new WAEs 594 with original ip addresses and then recover them as RMA replace device from CM that way it will sync and pull config from CM ? Please  let me know if this will work or not.

[finn.poulsen]

Hi,

I don't think you can do that - the devices are different models, thus the generated certificate is different.

If you're using the same optimization policies everywhere, this policy will be automatically (dependant upon setup) pushed to new WAE/WAVEs, when these registers with the CM (again dependant on device groups membership etc).

The network stuff could be specific (ip-addresses, redirection etc), and is as such never defines in device groups, but either using CLI or on the indivudual Device in CM (I prefer the CLi method),

/Finn

[sarabsin]

Hi Finn,

I apprecite response again.

I have already depolyed CM with success as you said it came online without any issues.

As per WAE recovery  documentation below , the new WAE only looks for  "hostname or primary IP address" and The record is inactive and replaceable.

Since CM is already deployed in production and i have now way to test this, is there a way you have resources/Lab to test this and confirm? I would be grateful.

 =================================

Step 5 Open a Telnet session to the device CLI and enter the cms recover identity keyword EXEC command. keyword is the device recovery key that you configured in the WAAS Central Manager GUI.

When the WAAS Central Manager receives the recovery request from the WAAS device, it searches its database for the device record that meets the following criteria:

•The record is inactive and replaceable.

•The record has the same hostname or primary IP address as given in the recovery request.

If the recovery request matches the device record, then the WAAS Central Manager updates the existing record and sends the requesting device a registration response. The replaceable state is cleared so that no other device can assume the same identity. When the WAAS device receives its recovered registration information, it writes it to file, initializes its database tables, and starts.

[finn.poulsen]

Hi,

Unfortunately I don't have any LAB facilities ... and neither the time.

I've never tried this - as I always run with the same global policy and just push that down to the device.

But remember to mark the device as inactive and replaceable before proceeding.

Best regards

Finn

[sarabsin]

Hi Finn,

I can now confirm that you can recover  the newer model WAVE-694 in place of WAVE-674  devices as RMA device.I compared configs/policy , everything is same.

So it just verifies hostname and ip address.