Upgrading C2960s via Cisco Device Manager?

[Matthew Martin]

Hello All,

I plan on upgrading a couple of WS-C2960-24PC-L this weekend (*5 in total), to version 12.2(55)SE11, and noticed that these switches have a Software Upgrade option under the Maintenance Menu in the Web Browser version of Device Manager, and I have a couple of questions regarding this method...

1)  Every IOS upgrade I've ever done was from the command line. Are there any benefits or drawbacks from upgrading the IOS from the Device Manager?

2)  Does it automatically remove the old version when the upgrade begins/finishes? What if there's an issue with the new version and you need to fallback to the old/current version?

3)  This is sort of related to #2. Is there a way to keep the old version on the switch and specify it in the config as sort of a "fallback version" in case the updated version won't boot for some reason?

*These switches are all located in remote locations away from where I am, so all will be upgraded via the Network and not Console cable, so was hoping there's a fallback method in case something goes wrong when the switch reboots...

One last thing... I checked around the forums but couldn't find a way to do this. Some people had scripts but their links were broken in their posts. I want to backup the current Images on these switches before I do the upgrade, and I am trying to copy the full directory where the image/bin file lives since its the version with the web-based Device Manager it has many files and directories...

Thanks in Advance,
Matt

[Leo Laohoo]

1)  Every IOS upgrade I've ever done was from the command line. Are there any benefits or drawbacks from upgrading the IOS from the Device Manager?

Always use the CLI because there are some error messages SDM won't be able to detect and report back. 

2)  Does it automatically remove the old version when the upgrade begins/finishes? What if there's an issue with the new version and you need to fallback to the old/current version?

In CLI, the option to leave the old IOS is enabled by default.  There's an option, again in CLI, to remove the first old IOS.  

I checked around the forums but couldn't find a way to do this.

VIP Webcast Video: IOS Upgrade on Catalyst Switches 2900, 3500 and 3700 - Easy as Pi

[Matthew Martin]

Hey Leo, thanks for the reply!

Ok, I'll stick with the CLI for the upgrade in that case... Thanks!

For the "fallback" image (*if that is an option), is there a command I can add to this section in the config before I issue the reload to switch to the new version so it will fallback to this image if there is trouble after the reboot?

!
boot-start-marker
boot-end-marker
!

Also, if this section of the config is left blank will it just load the first image/bin that it finds? And if that's the case, what is considered the first image file (*is it alphabetically, newest version first, etc...)?


One last thing, which I think might answer my question above, about using a fallback version... I'm just not positive how you list these, see below:

Would this be how I would List the New and Fallback versions to boot to?

2960sw2(config)# boot system ?
  WORD  pathlist of boot file(s) ... file1;file2;...

2960sw2(config)# boot system flash:/c2960-lanbasek9-mz.122-55.SE11/c2960-lanbasek9-mz.122-55.SE11.bin;flash:/c2960-lanbasek9-mz.122-55.SE7/c2960-lanbasek9-mz.122-55.SE7.bin

I assume I would need to include the absolute path to the .bin files since the version is the one with the Web Based Device Manager, which has the image file in a subdirectory inside the tar file... Is that right?

Thanks Again,
Matt

[Leo Laohoo]

Also, if this section of the config is left blank will it just load the first image/bin that it finds?

This field will only work with 4500/6500 and routers.  For 2960S, for example, this will always be blank.  The command "sh bootvar" will display the boot variable string.  

Would this be how I would List the New and Fallback versions to boot to?

There are two ways to do this, as I've explained in detail with my Webcast session, the manual way and the automatic way. 

The manual way uses the command "boot system flash flash:<FILENAME>.bin".  The biggest problem to this is, if the operator enters the wrong filename (or even subdirectory) the appliance will boot the first IOS file it'll cross.  

The automatic method will (always correctly) change the boot variable string without any operator intervention.  

[Matthew Martin]

Hey Leo, thanks again for the reply!

Looks like on these 2960s the command is just "show boot", the "show bootvar" command throws an error.

My show boot output contains the following:

2960SALDCsw1#sh boot
BOOT path-list      : flash:c2960-lanbase-mz.122-44.SE3/c2960-lanbase-mz.122-44.SE3.bin
Config file         : flash:/config.text
Private Config file : flash:/private-config.text
Enable Break        : no
Manual Boot         : no
HELPER path-list    :
Auto upgrade        : yes
Auto upgrade path   :
NVRAM/Config file
      buffer size:   65536
Timeout for Config
          Download:    0 seconds
Config Download
       via DHCP:       disabled (next boot: disabled)

So with the "Auto" method, will the switch just automatically find and choose the newest version in the flash memory, if multiple images are found? If so, what happens if the newer version fails to load for whatever reason, will it try to boot any other images found in "flash:"..?

Thanks Again,Matt

[Leo Laohoo]

So with the "Auto" method, will the switch just automatically find and choose the newest version in the flash memory, if multiple images are found? If so, what happens if the newer version fails to load for whatever reason, will it try to boot any other images found in "flash:"..?

In my Webcase (VIP Webcast Video: IOS Upgrade on Catalyst Switches 2900, 3500 and 3700 - Easy as Pi) I discussed in detail the features of the automated command "archive download-sw".  If left by default, this script will change the boot variable string when the entire unpacking process is complete. 

One of the biggest reason why I always recommend anyone to use the "archive download-sw" process is the process' ability to do a final check of the files being unpacked.  If the TAR file is even corrupt, the process stops (and throws an error message).  If the file is the wrong version, the process stops (and throws an error message).

Do take time to go through my presentation because the questions currently being asked were all covered (some in great details).

[Matthew Martin]

Hey Leo, thanks again for the reply, much appreciated!

So I started skimming through your presentation, but I don't really have the time at the moment to watch the full 90 minutes. But, I believe I get the gist of it. However, I will try and watch the whole thing sometime soon, as it has lots of good info in it.

*Couple of questions...

Since I'm upgrading 5 of these 2960s on Friday, I wanted to try and do the following:

1. Upload Images/tar files to all 5 switches prior to Friday, in order to save a lot of time on Friday when I'm ready to begin upgrading.

2. On Friday, begin installing the new versions on each of the switches.

So, if I want to do that plan above, but still use the archive command (*which you are right, its much more full-proof), would this be what I want to do, with the numbered lines above corresponding to these commands below..?

1. Before Friday execute the command:

# archive download-sw  /leave-old-sw  /no-set-boot  tftp://<ip_address>/<tar_filename>.tar

*Or do I need to just execute a copy command for step #1, like this:
# copy tftp://<ip_address>/<tar_filename>.tar   flash:

2. Then, on Friday, when I'm Ready to Upgrade, Execute the command:

# archive download-sw  /leave-old-sw  flash:<tar_filename>.tar

So, for the #2 step/command above, I included the /leave-old-sw Option because I was worried about the possibility of an inaccessible switch if something goes wrong while its installing the new version because these switches are all in a remote location and I'll be connected via telnet, not Console. But, in your video I believe you state that it ONLY removes the old version after a "successful" upgrade to the new version. If that's the case, and the old version is ONLY removed after it knows the new version was installed and is running successfully, then I don't need that option.

For #1 above, which is just prepping the switches by uploading the tar file to each of the switches. Is the copy command what I want for that? I wasn't positive if "archive download-sw" would automatically begin installing the image as soon as the download was complete..? Since I'm using the "archive downlaod-sw" command in step 2, that should be the verification of the IOS image is compatible with the switch, and all that good stuff you talk about in the video.

Does that sound like that would work?

Thanks in Advance,
Matt

[Leo Laohoo · Accepted solution]

But, in your video I believe you state that it ONLY removes the old version after a "successful" upgrade to the new version.

Make it simple.  The "archive download-sw" command you're using (and what you're intending to achieve) means you want to leave the old IOS, right?  So the DEFAULT option (without even using "/leave-old-sw") means the old IOS alone.  You are not going to use "/overwrite" option so this also means the old IOS will be left alone. 

In regards to copying the IOS into the switches, I'm not really a big fan.  The reason behind this is because the space they'll be occupying in the switch.  If these switches are all in the same location, why not just find a PC over there and install a TFTP server (remotely), like TFTPd32.  And then point the switches to the TFTP server to fetch the IOS file? 

Very important thing:  Have you performed an MD5 hash check to confirm the file(s) is/are not corrupt?

If the IOS file is residing in the switch, then the command "archive download-sw flash:IOS_filename.tar" is sufficient.  This command, without any options used, means: 

1.  Change the boot variable string when the unpacking is finish; 

2.  Leave the old IOS when complete; 

3.  Perform a version check; 

4.  Check to see if the IOS file is compatible with the switch; and

5.  Perform file integrity check to ensure the files are not corrupt

[Matthew Martin]

Hey Leo, thanks again for the reply!

Ok, perfect, I believe you hit all my questions in that reply. I now feel comfortable moving along with the upgrades.

Thanks a lot for all your responses, it's been much appreciated!

Thanks Again,Matt

[Matthew Martin]

Hey Leo,

Just wanted to post back and say that my updates went smoothly on all 5 switches that I needed to upgrade. Also, I wanted to mention that flash space was apparently low on the switches, and even though I did not include that option to remove the old image, it was done so anyway. I saved the output from the terminal, see below:

2960sw1# archive download-sw flash:c2960-lanbasek9-tar.122-55.SE11.tar
examining image...
extracting info (108 bytes)
extracting c2960-lanbasek9-mz.122-55.SE11/info (539 bytes)
extracting info (108 bytes)

System Type:             0x00000000
  Ios Image File Size:   0x00960200
  Total Image File Size: 0x00D22A00
  Minimum Dram required: 0x04000000
  Image Suffix:          lanbasek9-122-55.SE11
  Image Directory:       c2960-lanbasek9-mz.122-55.SE11
  Image Name:            c2960-lanbasek9-mz.122-55.SE11.bin
  Image Feature:         LAYER_2|SSH|3DES|MIN_DRAM_MEG=64

Old image for switch 1: flash:c2960-lanbase-mz.122-44.SE3
  Old image will be deleted before download.

Deleting `flash:c2960-lanbase-mz.122-44.SE3` to create required space
Extracting images from archive into flash...
c2960-lanbasek9-mz.122-55.SE11/ (directory)
extracting c2960-lanbasek9-mz.122-55.SE11/c2960-lanbasek9-mz.122-55.SE11.bin (9822428 bytes)
.......
..

Since the upgrades went well this was not really a big deal. But, if something had gone wrong, I don't know what would have had to be done...

Thanks,
Matt

[Leo Laohoo]

Should be fine, Matt.

[stewenkaraman49093]

I experience troubles with web device manager after being update Cisco catalyst WS-C2960-24PC-L
 on latest SW Version. Device manager is opening fine on its address: http://192.168.xx.xx/  but after that its frozen and links are broken, simply cannot navigate trough the setup options.. I'm just curious is this one of the tricks that Cisco use to force us to buy new one or what?