02-12-2020 07:31 AM
I have a Catalyst 3560X (WS-C3560X-24P-S) running the latest IOS 15.2(4)E9 image, however the bootloader is 12.2(53r)SE2.
ROM: Bootstrap program is C3560E boot loader BOOTLDR: C3560E Boot Loader (C3560X-HBOOT-M) Version 12.2(53r)SE2, RELEASE SOFTWARE (fc1)
I have upgraded 3560/3750G/E/X's previously and have seen the microcode updates that take ages. I assumed the bootloader would be upgraded if needed when the IOS image was upgraded.
I have just been working on a couple of Catalyst 3560X's running older IOS 12.2(55)SE10, however these both a have a newer bootloader:
ROM: Bootstrap program is C3560E boot loader BOOTLDR: C3560E Boot Loader (C3560X-HBOOT-M) Version 15.2(3r)E, RELEASE SOFTWARE (fc1)
The hardware revisions for the switches are different so I am assuming the one I have that is running the latest IOS was actually manufactured before the other two (V04 vs V07).
I have had a search but can't find any references to updating the BootLoader independently of the IOS image - all the release notes just say the bootloader might get upgraded if needed.
I have unpacked the 15.2(4)E9 and the 15.2(1)E1 tar files and compared them and the 15.2(1)E1 includes the file 'pucode_bundle.dat' file that the later image doesn't. Is this the bootloader? Is there a process for upgrading this independently of the IOS image? The 'archive' command has a 'download-ucode' option?
02-14-2020 02:14 AM
02-15-2020 02:54 AM
>Different hardware versions load different bootloader and discard when not required.
Thumbs up!
M.
02-15-2020 10:23 AM
02-24-2020 07:24 AM
OK, so I managed to get hold of another 3560X running 12.2(55)SE software with bootloader 12.2(53r)SE1. This is an even older hardware version (Version ID: V01). I upgraded it to 15.0(2)SE1 and the bootloader didn't upgrade. The output on the console during boot simply says:
...done Initializing flashfs. Checking for Bootloader upgrade.. Boot Loader upgrade not required (Stage 2)
However if you add a fips authorization key and reload it the bootloader does get upgraded:
Checking for Bootloader upgrade..New version = Version 15.0(2.1.15)SE1 Fri Ja, Current version = Version 12.2(53r)SE1, RELEASE Upgrading Boot Loader... Completed processing ucode0 Completed processing bstage: Completed processing brom: Completed processing bsdcs: writing boot sectors.. Boot Upgrade image auto-rebooting ... Burning parameters into flash parameter block: MAC address: C4:71:00:00:00:00 Motherboard assembly number: 73-12557-04 Motherboard serial number: FDXXXXXXXXX Model revision number: A0 Motherboard revision number: A0 Model number: WS-C3560X-48P-L System serial number: FDXXXXXXXXX Daughterboard assembly number: 800-32786-01 Daughterboard serial number: FDXXXXXXXXX Top assembly part number: 800-31328-01 Top assembly revision number: A0 Version ID: V01 CLEI Code Number: COMJP00ARA Board configuration revision number: 0 Reading parameter block...done. Editing copy...done. Writing parameter block...done. Parameters burned into parameter block. done. The system will now restart
So the bootloader is now version 15.0(2.1.15)SE1. I then proceeded to upgrade to some later versions to see whether the bootloader would get upgraded to something later (I am aiming for 15.2(3r)E or later). So far it hasn't. I tried 15.2(1)E1, 15.2(3)E3 and I have just upgraded to the latest 15.2(4)E9. The same message is displayed on the console saying the bootloader doesn't need upgrading.
...done Initializing flashfs. Checking for Bootloader upgrade..New version = Version 15.0(2.1.15)SE1 Mon Se, Current version = Version 15.0(2.1.15)SE1, TEST Boot Loader upgrade not needed(v)
Still somewhat confused over this tbh...
02-24-2020 08:42 AM
02-24-2020 08:54 AM
Just added the 'fips authorization-key xxxxx' to the original 3560X I was playing with that is running 15.2(4)E9 but with the 12.2(53r)SE1 bootloader. The bootloader gets upgraded but only to 15.0(2.1.15)SE1:
Checking for Bootloader upgrade..New version = Version 15.0(2.1.15)SE1 Fri Ja, Current version = Version 12.2(53r)SE1, RELEASE Upgrading Boot Loader...
So I think older hardware versions never originally supported FIPS so when this came about Cisco had to provide an update to the bootloader that verified the IOS image as part of the FIPS accreditation. Newer hardware versions I suspect already have this functionality built-in to the bootloader (anything after 15.0 I guess?).
If I come across any other 3560x or 3750x's that are newer hardware versions I might see what happens when you add the fips command.
I think...
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide