Upgrade 2 Cat 9500 xe 17.12.x to 17.12.5 in stacking mode install

[Ciro G Mele]

Hi team,

I have a stack of 2 switches 9500 of 48 ports and 2 sw 9500 of 24 ports. The question is whether to use the install or request command. 
The .bin file should only go in the flash of the active switch...?. 
What is the correct way to do this upgrade?

Thanks for your help in advance.

 Ciro G. Mele.

[balaji.bandi]

If this is a stackwise virtual, I prefer to do an install using ISSU (it has worked for me several times).

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/17-12/release_notes/ol-17-12-9500/upgrading_the_switch_software.html

[Ciro G Mele]

Hi, @balaji.bandi 

Thanks for your response. 

They're on StackWise. Is just verifying this information enough to upgrade through Issu?

Or is there something else to check?

Thanks again.

Ciro Gustavo Mele.

[Leo Laohoo]

If the only option is ISSU, make sure to raise a pro-active TAC Case:  TAC agent is WebEx into the 9500 VSS pair before the ISSU upgrade begins and ready to intervene if-and-when the upgrade goes the wrong way.

Alternatively, please read One-Hit-Wonder NSFW.

[balaji.bandi]

sure - take the backup configuration out of the box. If the connected devices are dual home, follow the provided document to upgrade 

last - make sure device have enough space (remove any crash logs and old image which is not needed).

[gabriel.cona1]

@Ciro G Mele .

BUNDLE Mode:
This is the most basic mode of operation.
The switch boots directly from the .bin file stored in flash memory.
In this case, the IOS-XE image must be loaded onto each switch (in flash).

###boot system flash:<image.bin>

INSTALL Mode:
This is the recommended and most commonly used mode in production environments.
The .bin file is decompressed and installed into the system, and the switch runs using the individual package files (e.g., .pkg).
In this case, it’s enough to load the IOS-XE image on the active switch.

Upgrade sequences:
INSTALL → INSTALL:
###install add file flash:<image.bin> activate commit
BUNDLE → INSTALL:
###request platform software package install switch all file flash:<image.bin> auto-copy

I hope this clarifies your question.
I strongly recommend reviewing Cisco’s official upgrade guides carefully before performing the upgrade process.

[Ciro G Mele]

Hi, @gabriel.cona1 

The issue is that both cat9500 are in stackwise and the question is what is the best option to update them with issu or another way to avoid problems?

Thanks again.

Ciro Gustavo Mele.

[gabriel.cona1]

First, you need to know how your stack is configured, whether it’s in bundle mode or install mode. Then, review the upgrade path process. Upgrade path: bundle > install > ISSU — or upgrade path: install > ISSU. Check the documentation from your equipment manufacturer. Look for the ISSU compatibility matrix for your 9000 model.

Make sure both the current software and the target software support ISSU. If ISSU is not supported on the 9000 model, most likely you will have to perform a traditional upgrade (install). 

Install: Installs software or packages; May or may not require a reboot

Bundle: A complete software package including all components; More integrated installation process

ISSU (In-Service Software Upgrade); Upgrades software without downtime; No network interruption during upgrade

[Leo Laohoo]

---

@gabriel.cona1 wrote:
ISSU (In-Service Software Upgrade); Upgrades software without downtime; No network interruption during upgrade

---

ISSU is not a one-size-fits-all.  It may work for some but it can be a catastrophic and humiliating experience to some.  

Always have a proactive TAC Case, with the TAC agent WebEx into the platform, before performing an ISSU.  If-and-when something "unusual" should ever happen during the ISSU, the TAC agent is ready to intervene, thus, minimizing the downtime.  

And remember:  For a 9800, Wireless TAC can guarantee 85% failure rate when doing an ISSU from 17.3.X, 17.6.X, 17.9.X and 17.12.1 to 17.12.3.  

[gabriel.cona1]

@Leo Laohoo 

In the description, you provide an excerpt, but it is clearly indicated that the upgrade guides must be reviewed thoroughly. Regarding opening a Cisco TAC case for support during an upgrade window, it is obviously the most effective approach. However, we also have guides and labs available to simulate the upgrade process successfully.

As for opening a Cisco TAC Service Request (SR) for upgrade support, in my organization it is questioned because support is expected to act in response to incidents. They do not object to opening many cases—that's what we engineers are for—but prefer to rely on documentation and internal preparation for upgrades.

[Leo Laohoo]

In the last 10 years, Cisco documentation, as a whole, is no longer "trust worthy" and has gotten worse since 2018.  I have seen many Field Notices getting withdrawn within 72 hours it was put up not just because it was not only "poorly written" (by contractors) but, rather, was not double-checked by Cisco themselves.  In 2020, Cisco even published a Configuration Guide meant for the Catalyst 5000, a product long past end-of-life in 2000.  

I would seriously be apprehensive and reluctant to follow "ISSU upgrade guide" and apply it to a production environment without first testing the whole process.

[Ciro G Mele]

Hi, @Leo Laohoo 

Thank you very much for sharing your experience. If you had to choose an update method, it would be the install mode by copying the .bin file to the active switch; it gives you more security.?

Thanks in advance.

Ciro Gustavo Mele.

[Leo Laohoo]

---

@Ciro G Mele wrote:
If you had to choose an update method, it would be the install mode by copying the .bin file to the active switch; it gives you more security.?

---

Bundle Mode does not support SMU.  If there was any security vulnerability fixed with an SMU, then this SMU cannot be applied to a platform in Bundle Mode.  

This is one of the fundamental reason why Install Mode is better than Bundle Mode and I would only use Bundle Mode in extreme circumstances like forcefully booting a platform to a specific version from ROMMON or trying to bypass a ROMMON or IOS-XE bug during bootup.

[Ciro G Mele]

Hi, @gabriel.cona1 

Thank you for responding,

I understand that the best way to update these Cat 9500 switches in StackWise, would be in install mode: simply copy the new iOS to the active switch with the devices powered on and then type activate commit.

Is that correct?

Thanks a lot !

Ciro G. Mele.

[gabriel.cona1]

@Ciro G Mele, yes, that’s correct.

The following command:
install add file flash:cat9k_iosxe.17.09.04.SPA.bin activate commit
performs the upgrade process by copying the image to the stack switches and decompressing the .pkg files for execution.

Please make sure to review the official Cisco upgrade guides for the detailed procedure and best practices. If you have any questions, I’m available. Good luck!