isr downgrade fails with "secure upgrade was unsuccessful..."

[steveblack]

Hi There All,

I have been tasked to downgrade an ISR4331 ROMMON version and it seems to work until i reload and then it gives "secure upgrade was unsuccessful; continuing with current ROMMON version ..."

Is there any way to get any more details or find some kind of troubleshooting guide. All the web portals seem to say check that the upgrade worked OK but nothing to aid you if it fails?

thanks in advance!!!

Any clues are appreciated?

[Flavio Miranda · Accepted solution]

Hi

 Which versioin of rommon and IOS-XE ?

You need to follow this table.

Table 2. Minimum Supported ROMMON Release in Cisco IOS XE 16.x.x Releases

Cisco IOS XE Release	Cisco 4321 ISR	Cisco 4321 ISR	Cisco 4331 ISR	Cisco 4351 ISR	Cisco 4431 ISR	Cisco 4451 ISR	Cisco 4461 ISR
Cisco IOS XE 16.3.x	—	16.7(3r)	16.7(3r)	16.7(3r)	16.7(4r)	16.7(4r)	—
Cisco IOS XE 16.4.x	16.7(4r)	16.7(3r)	16.7(3r)	16.7(3r)	16.7(4r)	16.7(4r)	—
Cisco IOS XE 16.5.x	16.7(4r)	16.7(3r)	16.7(3r)	16.7(3r)	16.7(4r)	16.7(4r)	—
Cisco IOS XE 16.6.x	16.7(4r)	16.7(3r)	16.7(3r)	16.7(3r)	16.7(4r)	16.7(4r)	—
Cisco IOS XE 16.7.x	16.7(4r)	16.7(3r)	16.7(3r)	16.7(3r)	16.7(4r)	16.7(4r)	—
Cisco IOS XE 16.8.x	16.7(4r)	16.7(3r)	16.7(3r)	16.7(3r)	16.7(4r)	16.7(4r)	—
Cisco IOS XE 16.9.x	16.7(4r)	16.7(3r)	16.7(3r)	16.7(3r)	16.7(4r)	16.7(4r)	16.9(1r)
Cisco IOS XE 16.10.x	16.7(4r)	16.7(3r)	16.7(3r)	16.7(3r)	16.7(4r)	16.7(4r)	16.9(1r)
Cisco IOS XE 16.11.x	16.7(4r)	16.7(3r)	16.7(3r)	16.7(3r)	16.7(4r)	16.7(4r)	16.9(1r)
Cisco IOS XE 16.12.x	16.7(4r)	16.7(3r)	16.7(3r)	16.7(3r)	16.7(4r)	16.7(4r)	16.9(1r)
Cisco IOS XE 17.1.x	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)
Cisco IOS XE 17.2.x	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)
Cisco IOS XE 17.3.x	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)
Cisco IOS XE 17.4.x	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)
Cisco IOS XE 17.5.x	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)
Cisco IOS XE 17.6.x	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)	16.12(2r)

[steveblack · Accepted solution]

Thank your rapid response Flavio.

I was trying to put a much lower rommon and what is outlined here. Can I ask where you found this table so I can show it to the powers that be?

The one I found said I could go lower but I think this 4331 is brand new!

Thanks again!

Steve

[Leo Laohoo]

Post the complete output to the following commands: 

• sh version
• dir
• sh boot

[steveblack]

Thank you for your time and appreciate the effort. I think Flavio's chart showed I was attempting the impossible. It would have been nice of Cisco to have a more informative response.

Again Thank you

Steve

[Leo Laohoo · Accepted solution]

---

@steveblack wrote:

It would have been nice of Cisco to have a more informative response.

---

This is not the first time I have seen this and it will not be the last. 

With "classic" IOS, it was very rare (if not unheard of) to hear about "ROMMON upgrade", however, it is very common for ROMMON to be upgraded in IOS-XE -- If only it was spelled out openly in the Release Notes.  Unfortunately, Cisco has kept the ROMMON Compatibility Matrix for ASR 1k and ISR 4k mostly "hidden".

[steveblack]

Do you have any links to any cisco items that pertain to this as I would like to be able to read up more in case my Manager wants to talk about this? (I have been out of the Cisco work for about 15 years so I well out of the date) - I am trying to get up to speed.

Sorry to keep asking about what you probably think is obvious.

thank you for indulging me

Many thanks

Steve

[Leo Laohoo · Accepted solution]

I have no idea where @Flavio Miranda found this but there are many "format" of this table. 
Most common are found in the Release Notes under the heading Recommended Firmware Versions.  Unfortunately, this is as far as anyone can get.  In regards to the "how to" upgrade the ROMMON, that is even difficult to find so I have knocked up a document on my own:  Cisco ISR & ASR 1k Routers: IOS-XE/Firmware Upgrade (Install Mode).  There is a section, pictures included, about upgrading the ROMMON.  

Another format can be found in the Configuration Guides:  Table 1. Supported ROMMON Releases for Cisco 4000 Series Integrated Service Routers

[steveblack]

What can I say more than this? - Thank you for all your time on my question