AP IOS Updates

[jnewton83985]

I've updated individual APs before however, I am trying to find the best way to do this with 140+ APs. We do have prime although I only see two ways to upgrade them via prime.

Rolling AP upgrade

• This is great but my controllers are configured in active/standby, not N+1. Prime documentation leads me to believe the AP's are moved from one controller to the other and this is not supported in SSO although I see no need for it when updating the AP IOS image.
• I don't want to update all AP groups and I don't see a way to exclude groups.

Software Images

• I've uploaded the IOS images to the image repository however I hit a road block on step 2
• No devices are listed under device selection. I'm not sure if this is due to the image I've uploaded or if this is meant for updating switches, controllers, etc, and not APs.

Thoughts?

[Haydn Andrews]

I've hit this how to do the upgrade whilst causing the least amount of outage before.

You are correct with SSO you can't do the rolling AP upgrade.

If you have a 9800 controller and 17.3 or above you might be able to do an ISSU upgrade - but I'm taking a guess this isn't an option.

I have used either of the following processes before to minimise the downtime:

Upload the new image to the WLC - and perform a pre-download to the APs.

Then in outage time its the WLC reloads which will cause all the APs to reload and come up on the new image - this saves you the downtime of the APs doing an image upgrade post the WLC being upgraded - just be aware that some x700 series APs will do a double upgrade, so they will download the code again regardless.

Other option I have done, is create a secondary WLC with the same config (IPs excepted) running the target state code.

I then can roll over APs at sites one by one (worked great where I had different time zone sites)

Then when complete, I upgrade the original WLC and perform a migration back (minimal downtime if the clients even notice)

This option does require you to have a compatible WLC for the target code and AP models

[Leo Laohoo]

What type of WLC is there, AireOS or IOS-XE?

[jnewton83985]

3504 WLC

@Haydn Andrews Are you referring to updating the AP IOS or the primary software as you described? I'm trying to update AP IOS image due to vulnerabilities.

[Leo Laohoo]

3504?  Oh that is easy.  

And what sort of APs do you want this done?  Are they APs with classic IOS or COS (different OS platform, different command)?

[Leo Laohoo · Accepted solution]

NOTE:  This is best done on the WLC using CLI. 

First, get a list of AP names:  "sh ap summary"

Next, the command combination are the following: 

debug ap enable <AP NAME>

If the AP is classic IOS (2700/3700 and older), the command is:  

debug ap command <AP NAME> "archive download-sw /overwrite tftp://<TFTP_IP_ADDRESS>/<FILENAME.TAR>"

If the AP is Cheetah OS (COS) (2800/3800/4800 and NEWER), the command is:  

debug ap command <AP NAME> "archive download-sw /no-reload tftp://<TFTP_IP_ADDRESS>/<FILENAME.TAR>"

[jnewton83985]

@Leo Laohoo That is how I update the IOS image per AP. Is that the only way to update the AP IOS, one at a time?

 @Arshad Safrulla The controllers are running 8.5.131.0 and the APs are using IOS 15.3(3)JF7$. I will be updating to 15.3(3)JK6 and 15.3(3)JF15 per 3600/3700 AP. I am not updating the AireOS as that would render our 3600s useless as they are no longer supported after a certain release. Is there not a way to only update the IOS image from the controller or prime for all APs?

@Haydn Andrews When trying to use software images in prime, I uploaded the image in step 1 and can't move forward in step 2. The IOS image I uploaded resides on the prime server. See pictures below:

[Arshad Safrulla]

What you have downloaded here are Autonomous AP IOS Software, these are used only when AP's are not centrally managed by a WLC. Since you mentioned about an availability of an WLC managing the AP's, You need to upgrade your WLC to 8.5.171.0 which is the TAC recommended release, this will automatically upgrade the AP's to the same code as well.

[jnewton83985]

@Arshad Safrulla Those are k9w8 images, not k9w7. How are they autonomous images? Are you saying update the controller software will also update AP IOS images? I wasn't aware of that. 

[Arshad Safrulla]

You are correct, these are lightweight images. I will update my previous post to correct the mistake.

!

Yes, as I mentioned before you cannot run a different image in WLC and a different image in AP when AP's are managed by WLC.

[Leo Laohoo]

---

@Arshad Safrulla wrote:

Is that the only way to update the AP IOS, one at a time?

---

No, I can update several hundred at a time using the method above.  Just cut-n-paste the entire lot in and it will be fine.

[Arshad Safrulla]

Hi,

You cannot upgrade only AP IOS only, since the AP's are controlled by a WLC (3504 in ur case) firmware for the AP's is also provided and controlled by WLC. Therefor both WLC and AP's must run the same code.

Recommended AireOS codes- https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html

Before the upgrade please make sure that the AP models you have are compatible with the new AireOS you are planning to upgrade. Also if you have PRIME you have to make sure it's compatibility as well. Wireless compatibility matrix as below

https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html

Below article will provide an overview in to the WLC upgrade procedure,

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/68835-wlc-upgrade.html

However it is recommended that you follow the release notes of the AireOS code that you are intending to upgrade to.

While upgrading it is best that you upload the new AireOS image you are planning to upgrade in to the WLC and then predownload it to all the AP's. This way you can minimize the downtime.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/managing_software.html

[Haydn Andrews]

What version are you upgrading from and to

What version is the WLC

What image are you trying to upload where you mention 

• I've uploaded the IOS images to the image repository however I hit a road block on step 2

can you share the screenshot of the error your getting

[Scott Fella]

There is a lot of great feedback here. Few things to add.  Make sure you test the version you will be upgrading to in case you run into issues. You don’t want to upgrade to fix a vulnerability just to cause poor user experience.  My take on SSO is that you need to have an additional controller for upgrading/downgrading.  In any case, you can see the many ways folks proceed with upgrading, it’s unique in some cases but consistent on others.