cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1953
Views
0
Helpful
1
Replies

IOS-XR upgrade fail from 5.1.3 to 5.3.3 on ASR9000

spapageorgiou
Level 1
Level 1

Hi all,

I'm trying to upgrade an ASR9001 from 5.1.3 to 5.3.3 but the command:

admin install add tar ftp://xx.xxx.xx/ASR9K-iosxr-px-K9-5.3.3.tar fails.

What it says about NTP does not apply (time is right) and about code signing stuff, I really don't know what that means.

The md5 of the tar file is correct.

Any ideas?

Thanx,

Sp

The output is:

RP/0/RSP0/CPU0:R4(admin)#install add tar ftp://ciscoftp:******@xx.yy.zz.40/ASR9K-iosxr-px-K9-5.3.3.tar synchronous
Fri May  6 11:11:18.025 EEST
Install operation 80 '(admin) install add tar /ftp://ciscoftp:*************************@xx.yy.zz.40/ASR9K-iosxr-px-K9-5.3.3.tar synchronous'
started by user 'spiros' via CLI at 11:11:18 EEST Fri May 06 2016.
Info:     The following files were extracted from the tar file
Info:     '/ftp://ciscoftp:*************************@xx.yy.zz.40/ASR9K-iosxr-px-K9-5.3.3.tar' and will be added to the entire router:
Info:      
Info:         README-ASR9K-iosxr-px-k9-5.3.3 (skipped - not a pie)
Info:         asr9k-video-px.pie-5.3.3
Info:         asr9k-services-px.pie-5.3.3
Info:         asr9k-services-infra-px.pie-5.3.3
Info:         asr9k-optic-px.pie-5.3.3
Info:         asr9k-mpls-px.pie-5.3.3
Info:         asr9k-mini-px.pie-5.3.3
Info:         asr9k-mgbl-px.pie-5.3.3
Info:         asr9k-mcast-px.pie-5.3.3
Info:         asr9k-li-px.pie-5.3.3
Info:         asr9k-fpd-px.pie-5.3.3
Info:         asr9k-doc-px.pie-5.3.3
Info:         asr9k-bng-px.pie-5.3.3
Info:         asr9k-asr901-nV-px.pie-5.3.3
Info:         asr9k-asr9000v-nV-px.pie-5.3.3
Info:         asr9k-k9sec-px.pie-5.3.3
Info:      
Error:    Cannot proceed with the add operation because the code signing certificate has expired.
Error:    Suggested steps to resolve this:
Error:     - check the system clock using 'show clock' (correct with 'clock set' if necessary).
Error:     - check the pie file was built within the last 5 years using '(admin) show install pie-info
Error:       /tmp/install/tar/instdir/34139816_349000000/asr9k-video-px.pie-5.3.3'.
Error:     
Error:    The following pies were not added due to an error:
Error:        asr9k-video-px.pie-5.3.3
Error:        asr9k-services-px.pie-5.3.3
Error:        asr9k-services-infra-px.pie-5.3.3
Error:        asr9k-optic-px.pie-5.3.3
Error:        asr9k-mpls-px.pie-5.3.3
Error:        asr9k-mini-px.pie-5.3.3
Error:        asr9k-mgbl-px.pie-5.3.3
Error:        asr9k-mcast-px.pie-5.3.3
Error:        asr9k-li-px.pie-5.3.3
Error:        asr9k-fpd-px.pie-5.3.3
Error:        asr9k-doc-px.pie-5.3.3
Error:        asr9k-bng-px.pie-5.3.3
Error:        asr9k-asr901-nV-px.pie-5.3.3
Error:        asr9k-asr9000v-nV-px.pie-5.3.3
Error:        asr9k-k9sec-px.pie-5.3.3
Install operation 80 failed at 11:30:15 EEST Fri May 06 2016.

1 Reply 1

Ali Muazzam
Level 1
Level 1

Hi,

Your problem is covered under CSCut52232 (Signing Certificate Expire by Cct 2015). You need to apply this SMU before you can upgrade to 5.3.3

Before you can apply CSCut52232, you need to add SAM certificate, please follow the link below how to add SAM cert

http://www.cisco.com/c/en/us/td/docs/routers/technotes/MOP-CSS-to-Abraxas.html

Once you have added certificate, you can go and apply SMU CSCut52232 (its hitless i.e. no traffic impact) and only after this SMU you wont get signing error while upgrading. Please let me know if this solves your problem.

Review Cisco Networking for a $25 gift card