Problem updating C2960x Image.

[peter-bennett]

Hi, I'm trying to update a C2960X from 15.2(7)E9.bin to 15.2(7)10.bin.

I get the following errors under the File Transfer Check - "Unable to download file using HTTPs and SCP from source : X.X.X.X. DNAC-CA certificate is present on the device. Please check the device connectivity.
Expected: Device need to have https/scp reachability to Controller
Action: Verify HTTPS/SCP configurations, Cisco DNA Center certificates on device and protocol reachability. Also, try with turning on Compatibility Mode from 'Image Distribution Servers' Settings page.

Under Provision / Inventory / Image Update Status - "Failed to distribute c2960x-universalk9-mz.152-7.E10.bin"

Clicking on "Failed to distribute c2960x-universalk9-mz.152-7.E10.bin"  gives - 

Under Distribution - Image Integrity Verifcation & Pre Distribution Operation both succeded.

Distribution fails with -
Task Name
Primary Protocol
Task Status
Failure (NCSW32001: Distribution failed using protocol: HTTPS.Distribution of image: c2960x-universalk9-tar.152-7.E10.tar on device. with protocol: HTTPS . Loading Image File to Device failed!. Device response error: [
Loading https://X.X.X.X/api/v1/file/temporary/96d0ee7a-f927-48bf-9e2f-8105009b81e7 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!)
Task Name
Secondary Protocol
Task Status
Failure (NCSW32001: Distribution failed using protocol: SCP. Distribution of image: c2960x-universalk9-tar.152-7.E10.tar on device. with protocol: SCP . Loading Image File to Device.
Destination file name on storage location and the source file name are different..
)

Post Distribution Operation / Image Checksum on Device / Distribution Completed are marked as Aborted.

On forums, it mentions renewing the DNAC Certificate, the certificate was updated in July 2024. 

We have 80+ switches, & all except this updated without issue.

Any help / advice would be grateful received.

Many thanks in advance.

[Leo Laohoo]

---

@peter-bennett wrote:

Destination file name on storage location and the source file name are different

---

That's the clue.

---

@peter-bennett wrote:

Under Provision / Inventory / Image Update Status - "Failed to distribute c2960x-universalk9-mz.152-7.E10.bin"

---

That's a BIN file being uploaded.

---

@peter-bennett wrote:

Failure (NCSW32001: Distribution failed using protocol: SCP. Distribution of image: c2960x-universalk9-tar.152-7.E10.tar on device. with protocol: SCP . Loading Image File to Device.

---

But DNAC is expected to upload the TAR file.

[peter-bennett]

Thanks for replying, I've tried with both .tar & .bin, & get the same error messages.

[Leo Laohoo]

Upload TAR.  BIN works on IOS-XE but won't work with classic IOS.  

[peter-bennett]

Thanks for replying. The current running image is a .bin file. When I go to Provision / Inventory / Image Update. It gives an error of "Failure in Update Checks.

[balaji.bandi]

What DNAC Version ?

what is the Logs show on the device ?

check below thread :

https://www.cisco.com/c/en/us/support/docs/cloud-systems-management/dna-center/220990-troubleshoot-https-error-in-dna-center-f.html#toc-hId-2753662

cert troubleshoot :

https://www.cisco.com/c/en/us/support/docs/cloud-systems-management/dna-center/220990-troubleshoot-https-error-in-dna-center-f.html#toc-hId-2753662

[peter-bennett]

HI, the ver is 2.3.5.6-70143.

Device Controllability is disabled, I don't know why, I'm waiting to get an answer from the person who dealt with dnac before me.

thanks

[shambhu.kumar]

Please go to - Provision / Network Devices /Inventory / Action /Edit device / Validate, it shoule be green check mark.
Then update ,it will sync the device and bring in managability state.

Then try for upgrade, marked with golden image. In case failed again and over write DNAC certificate in switch again.

At least 25 Mb free space should be available.

Regards

[peter-bennett]

thanks for your reply, I went to Provision / Network Devices /Inventory / Action /Edit device / Validate & it did not alter anything.

[shambhu.kumar]

Please go to inventory and select device, which you want to upgrade,

What is the manageability status of device ? is it showing managed with green checked? and what is showing in software image tab? is it showing "needs update" with green check mark?

[Leo Laohoo]

Golden image is a BIN file and this is wrong (a bug).  For classic IOS, "gold" image should be TAR files.  

[shambhu.kumar]

There are both options available BIN and TAR, which one you wants to make golden image, choice is yours, Check below screenshot. it has been upgraded through DNAC using golden image "c2960x-universalk9-mz.152-7.E10.bin "  file and it is successfully upgraded. Can you share the bug ID please

Regards

[Leo Laohoo · Accepted solution]

This is a bug with DNAC.  DNAC should not have allowed a classic IOS BIN file be marked as "golden".

[peter-bennett]

HI Leo, thanks for your reply.

As the switch is & has been running a .bin image since 9th March 2024. is there a way to resolve this ?

thanks

[Leo Laohoo]

How many stacks of 2960X are you planning to upgrade?