Catalyst 9300 Stack Automatic Firmware Update

[Hannibal]

Hi Dear  Community, the better Community of the Internet

I open this query thread about the stack firmware update made up of the Cisco Catayst c9300.

I can see that with very few commands in Install Mode it is now possible to update the firmware. Excellent.

I have a stack made up of 5 C9300 switches.

We did a 2-switch stack firmware update lab, starting with the master switch. In theory, once the master switch in the stack is updated, it should automatically update the second member of the stack, but it did not. The stack was broken and each member was left with a different firmware version.

The Cisco documentation is not clear, what is the procedure for the update to be automatic? What is the best practice with the Cat 9300?

Should we load the image to update in the Flash of each of the members of the stack and launch the commands from the master switch?

The automatic update of the complete stack of the c9300 is configured at the factory or do we have to configure some commands so that the master switch automatically updates the firmware of the rest of the members of the stack?

Thank you in advanced

Hannibal

[balaji.bandi]

Sure we understand the cisco document and they published to use it, but I am more concerned about the real world, we have tried it but crashed.  - so I (we) would like your hands-on (rather a document evidence here) - in a real Live environment where the production traffic is in place. 

10Seconds become more of 15-20min to fix. - this is my experience.

[Leo Laohoo]

---

@pdebreczeni wrote:
Extended Fast Software Upgrade (xFSU) could be an acceptable alternative 

---

ISSU/FSU/eFSU/xFSU will only work in really "corner cases", in a lab or in a demo.  Rarely does ISSU/FFU/eFSU/xFSU work in a production environment.   I have experienced several "versions" of ISSU/FFU/eFSU/xFSU "in action" which resulted with someone having to pull the power cord (and a room-full of swearing) of the demented unit just to stabilize the network.  

(Paging @Reza Sharifi, your opinion regarding this matter would be beneficial to this topic.) 

I am not saying "do not use ISSU/FSU/eFSU/xFSU".  On the contrary, that is not the intention of my response.  The message I am trying to impart is this:  Before upgrading, get a WebEx session with Cisco TAC so they can "witness" when ISSU/FSU/eFSU/xFSU goes down in flames.    It is of no use to any- and everyone if TAC gets roped in after the event -- TAC needs to be involved before the upgrade.  

[jmcgrady1]

When the c9300 first came out, i was disappointed to learn that a firmware update takes down the whole stack. Other vendors do individual updates of stack members, whilst keeping the stack alive, with ease. I had hoped that there would be a reliable robust way to do this by now. Its a reason why we still use 9500 switches with virtual stacking.

[Leo Laohoo]

As what @pdebreczeni said, an option is xFSU.  However, know the risks.  We tried it with several freshly powered up stacks and they work.  How does xFSU behave with a high uptime?  ¯\_(ツ)_/¯

[Hannibal]

Hi Leo, I have never tried this option, until now I have preferred the safest option, I think. The last time, about two years ago, I upgraded a stack of four c9300 switches and this took about half an hour. You can even load the new firmware image into each of the flashes of each member of the stack to reduce time and only then, at the time of the upgrade, you issue the commands and that's it.

Best regards

Hann

[Hannibal]

Hi, Well, it also has its good points, at least the fact that once the firmware upgrade is finished you have a hour to carry out all the checks is excellent. Once everything is working as before, you launch the "commit" command and run. It is true that you must do the upgrade in a maintenance hour and notify of service interruption. I have had to do it in two very critical Datacenters. I also have a couple of 9500 connected via VSL making a virtual switch.

Best regards

Hann