Thesedays,we have met a issue about upgrade IOS XE from 3.4.0 to 3.8.0 in Cat4507R SSO mode.We also need upgrade the ROMMON to support 3.8.0.
-------------------------
Symptom：We have uploaded the rommon image and IOS XE image to Cat4507R,and set the bootvar in config mode.But,we occured a error after we upgraded rommon,we didn't enter system by new image that is 3.8.0 at standby-hot device.(Note:we want to upgrade image with ISSU). And we can see standby-hot device is disable status by "show module" command.
-------------------------
Action Plan：We had searched some discussion in Cisco community,which the similar issue had beed fixed by reload entire device.
https://community.cisco.com/t5/switching/issues-when-upgrading-dual-sup-4510r-e-switch-with-sup8e-sso/td-p/3225699?dtid=osscdc000283
...
--------------------------
Analysis ：There is a upgrade guide in Cisco.com to display we can upgrade image with "In Service Software Upgrade Process"
"Operating on redundant systems, the In Service Software Upgrade (ISSU) process allows Cisco IOS XE software to be updated or otherwise modified while packet forwarding continues. In most networks, planned software upgrades are a significant cause of downtime. ISSU allows Cisco IOS XE software to be upgraded while packet forwarding continues. This increases network availability and reduces downtime caused by planned software upgrades."
Note：ISSU is available in Cisco IOS XE Release 3.1.0.SG and later releases.
--------------------------
Root Reason：We also found there are so many limitations for ISSU. Be shown as below:
Note：An ISSU upgrade from any release prior to IOS XE 3.6.0E to 3.6.0E or later is unsupported for IOS XE supervisor engines (SUP7-E, SUP7L-E and SUP8-E).
......
Prerequisites to Performing ISSU
Before performing ISSU, you must meet these prerequisites:
1.A permanent “ISSU barrier" exists between pre-IOS XE 3.6.0E and IOS XE 3.6.0 releases: ISSU is supported between versions on the same side of the barrier but it is not supported between versions on opposite sides.
Note： This restriction applies to Catalyst 4500X in a VSS, as well as to Supervisor Engine 7E, Supervisor Engine 7LE, and Supervisor Engine 8E in a VSS or in a redundant chassis.
2.Four scenarios will illustrate the restriction:
If you are running a release prior to IOS XE 3.6.0E (3.5.1E, for example), you cannot perform an ISSU upgrade to IOS XE 3.6.0E.
If you are running IOS XE 3.6.0E, you cannot perform an ISSU downgrade to IOS XE 3.5.0E.
If you are running IOS XE 3.6.0E, you can perform an ISSU upgrade to IOS XE 3.6.1E (when released).
If you are running a release after IOS XE 3.6.0E (for example, 3.7.0, when released), you cannot perform an ISSU downgrade to IOS XE 3.5.0E.
3.The type of the existing and target image must match. You cannot upgrade from a Universal Lite image to a Universal image (and vice versa) without experiencing several minutes of traffic loss. The same restriction applies between crypto and non-crypto images.
4.The active and the standby supervisor engines must have the same supervisor engine hardware (same model, same memory, and so on).
5.The new and old Cisco IOS XE software images must be loaded into the file systems (bootflash, SD card, or USB) of both the active and the standby supervisor engines before you begin the ISSU process.
The old software image should be available either in bootflash, SD card, or USB and the system should have been booted from one of these locations because the boot variable must be changed before the ISSU process starts.
Note：auto-boot must be enabled for ISSU to succeed.
6.Stateful Switchover (SSO) must be configured and the standby supervisor engine should be in STANDBY HOT state.
These commands indicate whether SSO is enabled: show module, show running-config,
show redundancy state.
7.If you do not have SSO enabled, see the Stateful Switchover document for further information on how to enable and configure SSO.
8.Nonstop Forwarding (NSF) must be configured and working properly. If you do not have NSF enabled, see the Cisco Nonstop Forwarding document for further information on how to enable and configure NSF.
Before you perform ISSU, ensure that the file system for both the active and the standby supervisor engines contains the new ISSU-compatible IOS XE software. The current Cisco IOS XE version running in the system must also support ISSU.
You can enter various commands on the Catalyst 4500 series switch to determine supervisor engine versioning and Cisco IOS XE software compatibility. Alternatively, you can use the ISSU application on Cisco Feature Navigator to determine this.
9.If you enter the no ip routing command, ISSU falls back from SSO to RPR mode, resulting in traffic loss.
Autoboot is turned on and the current booted image matches the one specified in the BOOT environmental variable. For details on how to configure and verify these, please refer to "Modifying the Boot Field and Using the boot Command.
If you enter the no ip routing command, ISSU falls back from SSO to RPR mode, resulting in traffic loss.
https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-8-0E/15-24E/configuration/guide/xe-380-configuration/issu_XE.html?bookSearch=true
---------------------------
So, we can know a permanent “ISSU barrier" exists between pre-IOS XE 3.6.0E and IOS XE 3.6.0,in other words,we cannot do ISSU when we want to upgrade image between versions on opposite sides.
If you think my understanding is wrong, please point it out so that we can learn together.
Thanks a lot !
