Nexus 9k EPLD upgrade

[rkbalaguru]

I understand while we upgrade EPLD we need to reboot the nexus 9K switch for new version to take effect.  we have 9k switch pairs in our network. since the traffic going over the switches, if we perform upgrade on switch , is there any way to move all traffic gracefully to other switch to avoid drop. please let me know your experience and suggestions

[Peter Paluch]

Hello,

Indeed, after an EPLD upgrade, the switches (or at least the modules) need to be reloaded, and that will cause traffic disruption.

If I may ask: What exact switch types are you running, and what NX-OS version? Also, since you said you are using pairs of Nexus switches, are you using them in vPC? Finally, are these switches running any routing protocol themselves? This all has quite an influence on the way you would proceed.

Please let us know. Thank you!

Best regards,
Peter

[rkbalaguru]

Hi Peter,

Thanks for your reply,  i have Nexus 9396PX model with n9000-epld.7.0.3.I4.5.img. Yes, as you said they are running in VPC and we have configured bgp with almost 10 neighbor to AWS direct connect, also we have L3 SVIs are configured , that's the reason if i reboot these all will impact, do you have any suggestion?

[Peter Paluch]

Hello,

My apologies for a delayer answer!

In your situation, I believe that the proper way of doing the upgrade is to steer the traffic away from one switch, upgrade and reload it, then migrate the traffic onto it while steering it away from the other neighbor, and upgrade that one.

This process has two aspects: L3 routing, and L2 switching.

For the L3 routing, this is where you need to get creative somewhat. You said that these vPC peers have about 10 BGP peerings each. You would need to make modifications to the BGP attributes of the received and advertised routes so that the traffic stops being routed through a particular switch. I cannot suggest any particular set of steps since I do not know your BGP setup. I believe I would need to see the configuration to understand more, and to be able to suggest any particular sequence of steps.

For the L2 switching, steering the traffic away from one switch should be fairly simple: Since you are using vPC, you would simple start shutting down the physical ports of the vPCs on one switch, which would have all switched traffic move over to the second vPC peer. The routing on the second vPC peer would already need to be set up so that it would not send the packets through the peer-link back to the original vPC peer you want to isolate. You would upgrade the switch, reload it, and once it is back up and running, you would reverse the procedure and make the same steps with the remaining vPC peer.

There are documents out there that describe a replacement procedure for a vPC peer switch - the steps you would need to go through are rather similar. Check them out:

https://www.cisco.com/c/en/us/support/docs/interfaces-modules/nexus-7000-series-supervisor-1-module/119033-technote-nexus-00.html

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/operations/n5k_vpc_ops.html#pgfId-425202

Please be sure to make yourself acquainted with them, and feel welcome to ask further!

Best regards,
Peter

[sbhadrav@cisco.com]

When new EPLD images are available, the upgrades are always recommended if your network environment allows for a maintenance period in which some level of traffic disruption is acceptable. If such a disruption is not acceptable at this time, then you might consider postponing the upgrade until a better time.
The EPLD upgrade operation is a disruptive operation. You should execute this operation only at a programmed maintenance time. The system/kickstart ISSU upgrade is a nondisruptive upgrade. The EPLD upgrade operation is a disruptive operation. You should execute this operation only at a programmed maintenance time. The system/kickstart ISSU upgrade is a nondisruptive upgrade.
Switch Requirements
The Cisco Nexus 9000 Series switch must be running the Cisco NX-OS operating system and include the following hardware:

Supervisor modules—one or two, each with at least 200 MB of available bootflash memory (Cisco Nexus 9504 and 9508 only)
System controller modules—one or two (Cisco Nexus 9504 and 9508 only)
I/O modules—one to eight (Cisco Nexus 9504 and 9508 only)
Fabric modules—three or six (Cisco Nexus 9504 and 9508 only)
Fan tray modules (three)
Uplink module (Cisco Nexus 93128 and 9396 only)
You must be able to access the switch through a console, SSH, or Telnet.

You must have administrator privileges to work with the Cisco Nexus 9000 Series switch.
Please ckeck below link for more info;-
https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/epld/n9k-epld-rn-61.html#pgfId-93995