4331 ISR, Direct upgrade from 3.16.9S to 17.6.3 or 17.3.5

[MauryJ]

Hello all,

We have an ISR-4331 that is running IOS XE 3.16.09.5 and need to get it upgraded.   I see that both 17.6.3 and 17.3.5 are recommended releases.    
I did see that a ROMMON update is required.   Besides that, would we be able to upgrade directly to either of the recommended releases?   I didn't find any prerequisite versions, or upgrade paths, mentioned in the release notes.
Thanks

[Leo Laohoo]

Cisco ISR & ASR 1k Routers: IOS-XE/Firmware Upgrade (Install Mode)

[georgehewittuk1 · Accepted solution]

Yes I've upgraded with this 'jump' before from 3.x to 17.x i believe it is because of the architecture of the packages- as you righty stated need to make sure ROMMON is performed before as a pre-req as it's commonly outdated.

[MauryJ]

That's good to know, thanks @georgehewittuk1 .

And thanks @Leo Laohoo for the link to your installation guide.

[MohdHaizarAbdulLatiff4746]

Hi All,

We have a new router to be deploy at site - the router model is Cisco ISR 4431 and firmware release is version 17.3.5 

So I would like whether the 17.3.5 is the latest version ? or do we need to upgrade to 17.6.x release?

Your advise and recommendation is highly appreciated.

Thanks 

[Leo Laohoo]

Start testing 17.9.3.

[MohdHaizarAbdulLatiff4746]

Which one do i need to download ? the first one or the other with (No Payload Encryption) ?

1)Cisco ISR 4400 Series IOS XE Universal

isr4400-universalk9.17.09.03a.SPA.bin

Advisories

30-Mar-2023

737.55 MB

2)Cisco ISR 4400 Series IOS XE Universal-No Payload Encryption

isr4400-universalk9_npe.17.09.03a.SPA.bin

Advisories

30-Mar-2023

741.18 MB

[Leo Laohoo]

Download the first one because it supports SSH.

[MohdHaizarAbdulLatiff4746]

Thank you for you advice and suggestion. 

[MohdHaizarAbdulLatiff4746]

How do I check the md5sum verification for this firmware version file? 

1)Cisco ISR 4400 Series IOS XE Universal

isr4400-universalk9.17.09.03a.SPA.bin

Where can I find if this is the correct checksum, generated by Cisco?

[Leo Laohoo]

There is no need to check the MD5 checksum because if the MD5 do not match, the Install Mode procedure will stop without rebooting the router.

[MohdHaizarAbdulLatiff4746]

Hi All, need further assistance on how to login my router.

Previously i have perform below configuration to our cisco router ISR 4431 series

!
aaa new-model
!
!
aaa authentication login default group tacacs+ local line enable
aaa authentication login async none
aaa authentication enable default group tacacs+ enable
aaa authorization console
aaa authorization exec default group tacacs+ if-authenticated
aaa accounting exec default
action-type start-stop
group tacacs+
!
aaa accounting commands 1 default
action-type stop-only
group tacacs+
!
aaa accounting commands 15 default
action-type start-stop
group tacacs+
!

BUT after my console access to the router have ended & try to login again, the below error messages occur & I cannot login to the router as I'm not set any username & password previously.

User Access Verification

Username:
*May 26 06:12:59.442 UTC: %AAA-3-BADSERVERTYPEERROR: Cannot process authentication server type tacacs+ (UNKNOWN)

Please help me on how to login access to the router. TQ