AMA: Cisco Catalyst Center Software Image Management (SWIM)

[Brooke Hammer]

Ask Me Anything Event

Welcome to the Cisco Community Ask Me Anything conversation. Submit your questions from  Friday, June 21, 2024 through Friday, July 12, 2024. Our colleagues Saurabh Khillare, and Absar UI Farooq will be waiting to assist you and resolve any questions that have not been clarified, or answer any new questions that you may have. We are waiting for you!

More about this event:

Join us for an Ask Me Anything (AMA) event where you can dive deep into Cisco Catalyst Center Software Image Management (SWIM)!

What is it?• Cisco Catalyst Center inventory offers various automation capabilities. One of them is Software Image upgrades using Software Image Management (SWIM).
• Using SWIM users can upgrade, downgrade or SMU patch their network devices managed on Catalyst Center inventory. In matter of few clicks we can perform image upgrades on upto 100 devices in a go.
• We can distribute the golden image on device flash during production hours too and schedule activation at non business hours or in maintenance window.

Get Expert Advice!
• This AMA session is your chance to get expert insights on this powerful feature.
• Whether you're a seasoned network pro or just starting out, feel free to ask any questions you have about SWIM, image repository or Cisco Catalyst Center in general.

Official Resources:

• SWIM Documentation

• Youtube: SWIM

Note: Please post your post as a comment below no later than July 12, 2024.

Post your question below by clicking "Reply"

(Answers will be processed depending on the availability of the experts)
Don't forget to thank the expert by giving it a helpful vote!

---

Our experts

Saurabh Khillare Technical Consulting Engineer

Absar Ul Farooq Technical Consulting Engineer

For more information, visit the Cisco Catalyst Center discussion forums . If you have questions or are experiencing technical problems with any of the Cisco products, post your question, request information or use the Cisco Community before opening a case with the TAC.

[auifaroo]

Hello,

Yes, during the image distribution on the WLC, the AP pre-image download occurs. Once the distribution is successful, you can verify it on the WLC using the command:

show ap image

[vartjais]

I have a customer who sees the source as Management IP while performing the swim operation, however we expect DNAC to use it's enterprise IP for the SWIM operation, how can we mitigate this ?

[auifaroo]

Hello,

To ensure DNAC uses the enterprise IP as the source for operations like SWIM, please make sure static routes are defined under the Enterprise interface. You can verify this by switching to the config wizard mode. To do so, use the following command:

sudo maglev-config update

Ensure the static routes are added under the enterprise port of DNAC, save the configuration, and retry SWIM.

Note: Please make these changes during a maintenance window  as there may be some service restarts on the DNAC end. However, the services will automatically come back up

---

@vartjais wrote:

I have a customer who sees the source as Management IP while performing the swim operation, however we expect DNAC to use it's enterprise IP for the SWIM operation, how can we mitigate this ?

---

[tanmahes]

Hi Team, My device is 9300 I hit netconf error under manageability in Inventory, can I disable netconf and get the device in managed state post which proceed with upgrade ?

[auifaroo]

---

Hello,

Yes, as long as the device (9300) is managed with CLI and SNMP credentials in Inventory, you can upgrade it without needing NETCONF and address any issues with NETCONF afterward.

However, please note that it is not possible to upgrade the 9800 without NETCONF, as the device will not be managed in the Inventory without NETCONF.

@tanmahes wrote:

Hi Team, My device is 9300 I hit netconf error under manageability in Inventory, can I disable netconf and get the device in managed state post which proceed with upgrade ?

---

[Sylvain_Che]

When performing a SWIM upgrade of, let's say Cat9k switches, DNAC pushes the IOS-XE and automatically set it as INSTALL MODE on the switch.
Is it possible to select BUNDLE MODE during the SWIM workflow?

[auifaroo]

Hi Sylvain, 

Catalyst Center won't do a conversion for you, but Both BUNDLE mode and INSTALL mode are supported for switches/routers running in either mode for day-N upgrades. 

Note: For PnP (day-0) upgrades, only Install mode is supported, reference guide : https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/2-3-5/release_notes/b_cisco_dna_center_rn_2_3_5.html

[vesingar]

Does Catalyst Center save my running configuration before the upgrade? After the upgrade, will my switch boot up with the startup configuration or the previous running configuration?

[auifaroo]

---

@vesingar wrote:

Does Catalyst Center save my running configuration before the upgrade? After the upgrade, will my switch boot up with the startup configuration or the previous running configuration?

---

Hello,

Yes, DNAC saves the configuration before the upgrade, ensuring there is no config loss post-upgrade. However, we recommend checking the compliance section of the device in Inventory to ensure the startup and running configurations are in sync. To see the commands DNAC pushes to the device, you can use the following EEM script:

event manager applet catchall
event cli pattern ".*" sync no skip no
action 1 syslog msg "$_cli_msg"

[manomuni]

Hello Team

How to check image readiness report from DNAC when attempting to upgrade device from DNAC?

Thanks in advance 

[SaurabhKhillare]

Hello,

You can check the readiness report from the image update page. click on the update readiness report option and you will see all the checks status.

 

[Alexjeffy95]

I am getting this error in the pre checks : Error message: unable to download file using HTTPs and SCP from source: 172.XX.XX.XX . DNAC-CA certificate is not present on the device. Expected: Device need to have https/scp reachability to Controller. Action: Verify HTTPS/SCP configurations. Cisco DNA Center certificates on device and protocol reachability. Also try with turning on Compatibility Mode from 'Image Distribution Servers' setting page.

How can I move forward ?

[auifaroo]

Hi Alex,

Here are a few things to check:

1. Ensure that ports 22, 80, and 443 are open bidirectionally between the device and DNAC.
2. Manually copy the image to the device to see if it succeeds. If it fails with an I/O error, you may have a certificate issue that needs to be  addressed. You can test if HTTPs file transfer is working from Catalyst Center (DNAC) to any Catalyst device by executing the following command on the switch (this is what DNAC does when running the SWIM readiness check)
   

   copy https://<dnac_ip>/core/img/cisco-bridge.png null: ​

3. Verify that the device has the DNAC-CA certificate. You can check this by running the command:
   

   show run | sec crypto pki trustpoint DNAC-CA ​

   
   

   If the certificate is not present, you can perform a force telemetry push from DNAC to push the certificate to the device. Navigate to Actions -> Telemetry -> Update Telemetry Settings, select 'Force Configuration Push,' and then update.

[Alexjeffy95]

Thanks, mate. It looks like it was a certificate issue, which has now been resolved and pushed to the device. However, I still see that SCP is not reachable. I have checked that the ports are allowed, and after running some debugs on the device, I encountered the following error:

%SSH-3-BAD_PACK_LEN: Bad packet length 65564

[auifaroo]

Hi Alex,

To mitigate this issue, ensure that SSH version 2 is configured on the device. If the problem persists despite having SSH version 2 enabled, please open a TAC case for further investigation.