Updating IOS XE and ROMMON on Catalyst 4503E in VSS mode.

[Alexander Istomin]

Hello, experts.

We plan to upgrade ROMMON and IOS XE on Catalyst 4503E that is working in VSS mode.

ROMMON: from 15.1(1r)SG5 to 15.1(1r)SG18

IOS XE: from 3.8.4.E to 3.11.2E

I've read this guides:

1. ROMMON: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/release/note/OL_30306-01.html

2. ISSU #1: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-8-0E/15-24E/configuration/guide/xe-380-configuration/vss.html#pgfId-1320146

3. ISSU #2: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/15-1-2/XE_340/configuration/guide/config/issu.html

But it still not clear for me, how to upgrade ROMMON on VSS cluster. There is no something like "ISSU for ROMMON", so as I understand it, this needs to be done separately on each switch. But what happens with VSS at this time? What could go wrong?

Please, guide me and share your experience how to do that in the best way. And without "IT LOOKS LIKE ALL NET IS DOWN! AAA-A-A!" :)

[Reza Sharifi]

Hi,

There is no ISSU for ROMMON upgrade. I recommend doing this in 2 phases if you can't have a long enough window to do both upgrades. So, 1 maintenance window for just upgrading the Rommon and a second one for upgrading the IOS. Also, with ISSU, the upgrade takes longer than doing it the traditional way. If you have a maintenance window, the simplest solution is to do it the traditional way. I think, if you go the traditional way, you can do them all in a one hour window.

HTH

[Leo Laohoo · Accepted solution]

Here's how I've done our Sup7E upgrade (with VSS): 

1. Copy the ROMMON file to the active supervisor card; 
2. Copy the ROMMON file to the secondary supervisor card; 
3. Verify the MD5 of the ROMMON file in the active supervisor card (verify /md bootflash:firmwareupgrade-151_1r_SG18.SPA 18a1899edc2eb4350e2563cab592e8db)
4.  Verify the MD5 of the ROMMON file in the secondary supervisor card (verify /md slavebootflash:firmwareupgrade-151_1r_SG18.SPA 18a1899edc2eb4350e2563cab592e8db)
5. Unpack the IOS-XE file into the active supervisor card (archive tar /x tftp://<TFTP_IP_ADDRESS>/<IOS_FILENAME>.tar bootflash:); 
6. Unpack the IOS-XE file into the secondary supervisor card (archive tar /x tftp://<TFTP_IP_ADDRESS>/<IOS_FILENAME>.tar slavebootflash:); 
7. Verify the IOS-XE file in the active supervisor card; 
8. Verify the IOS-XE file in the secondary supervisor card; 
9. Make sure the config-registry value is "0x2102"
10. Configure the boot variable string to boot the ROMMON and then the IOS-XE next.

conf t
 no boot system flash bootflash:<OLD IOS>
 boot system flash bootflash:firmwareupgrade-151_1r_SG18.SPA
 boot system flash bootflash:<NEW IOS-XE FILE>
 boot system flash bootflash:<OLD IOS>
end
wr

11. Reboot both units using the "reload" command. 

To verify, use the command "sh version | i ROM"

Once the pair has recovered and loaded with the correct version, remove the boot variable string pointing to the ROMMON: 

conf t
 no boot system flash bootflash:firmwareupgrade-151_1r_SG18.SPA
end
wr

And that should be it.  

WARNING:  ROMMON upgrade can take around 30 minutes.

[Alexander Istomin]

Leo,

I did upgrade (ROMMON + IOS) exactly as you wrote and everything went fine.

All update (ROMMON + IOS) lasted about 10 minutes.

The minor thing what i want to add to your plan is don't forget to check bootvar with:

show bootvar 

before doing:

redundancy reload shelf 

Thanks for the help!

[Leo Laohoo]

---

@Alexander Istomin wrote:

The minor thing what i want to add to your plan is don't forget to check bootvar

---

I deliberately did not include the option to check the boot-variable string because, to a novice, the output is long and confusing.  

[Alan.A]

Instead of TAR file, Can I transfer .BIN file directly for both supervisor and verify md5? What if my config register is not 0x2102, Do I need to set it first to 0x2102 and reload before doing the actual upgrade? Or I can do it in one reload? Because when if I change the confreg there is a note that it will take effect after a reload.

[Leo Laohoo]

---

@Alan.A wrote:

What if my config register is not 0x2102, Do I need to set it first to 0x2102 and reload before doing the actual upgrade?

---

• 0x2102 means "read the config and boot the IOS based on the boot-variable string".  
• 0x2101 means "read the config, IGNORE the boot-variable string and boot the first IOS image from the directory". 
• 0x2100 means "boot into ROMMON". 

Make sure the config-register is set to 0x2102 before the reboot.  

[Alan.A]

Hi Leo,

Here is an example of what I mean, yesterday before I perform an upgrade of 4506 1XSup I noticed that the config register is 0X2101 so I changed it to 0x2102, and there is a note in the show version command "Configuration register is 0x2101 (will be 0x2102 at next reload)" so I saved it and reload.

After a reload the confreg became 0x2102 and that's the time that I transferred the rommon and the IOS image to bootflash and perform the actual reload and upgrade went successful. Problem is I reload the box twice. Is it ok to reload the box only once?

[Leo Laohoo]

---

@Alan.A wrote:

Problem is I reload the box twice. Is it ok to reload the box only once?

---

My instructions above only mentions of a single reload.  
Step 9 states:  Make sure the config-registry value is "0x2102".  Step 9 never mentions about "rebooting".

If you want to deviate, then it is all up to you.