Downgrade Cisco Wireless Controller software

[Aleck_Sei]

Hi all,

It is very likely that you will need to downgrade an AIR-CT8540-K9 WLC to version 8.5.161.6. to be able to pair it with another WLC in SSO HA mode with the same software version. Currently, it is ruled out for various reasons to upgrade the other controller.

We have two doubts:

(1) On the CISCO software download page we find version 8.5.161.0 (ED) (AIR-CT8540-K9-8-5-161-0.aes) but not 8.5.161.6. Is this correct? Are they the same version? Are they compatible?
(2) The controller to be updated has been restored to its original factory settings. Is it possible to change the software through the initial configuration GUI via HTTP / Service-Port or is it necessary to configure it first and then upgrade via FTP or another method?

Thanks for your help

[balaji.bandi]

yes that is version available to download 

upgrade method as suggested below - use what best for you.

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/68835-wlc-upgrade.html

[ammahend]

1. They are not same version, you should run the same version, the"6" at the end is Engineering special.

2. you will need to do initial setup, so that controller can communicate with network to download software using any of the method supported. follow the link Balaji sent.

Just for future reference.

• Major Release: 8
• Feature Release: 5
• Maintenance Release: 161
• Engineering Special: 6
• (ED): Early Deployment release

[marce1000]

                                 >... it is ruled out for various reasons to upgrade the other controller.
  - If possible that situation should be reverted and there are a number of important reasons for that ; 1) AP and Client behavior bugs in older versions 2) https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html  3) Related to item 2 : aireos based controllers are getting old and being phased out , if at all possible last/latest release should be used 4) TAC will not investigate if problems are seen and will (then) recommend item 2 too !

 M.
  

[Aleck_Sei]

Thank you very much for your answer.

The controller with which we want to pair the new one and which is currently running with version 8.5.161.6 has about 5000 active APs. Our client currently does not allow modifying anything on the active controller and we must pair the new one in SSO HA mode, hence the need to do a downgrade.

[balaji.bandi]

You can offload downgrade to desired version, and patch to the level what active Controller is now.

below suggestions :

1. Always take the configuration out of the box.

2. configure basic configuration required for HA

3. make sure you have same license level as master.

4. you can connect only sync link to see the WLC can able to sync the config from master.

[ammahend]

If you are not able to find specific software, call Cisco TAC, they will most likely be able to publish it for you, instead of downgrading, I am sure there is a reason you are running an Engineering special image in production with 5000 APs

[Scott Fella]

So to be clear, you have a single 8540 in production running 8.5.161.6 and you want to bring up another 8540 and configure HA SSO?  If that is the case, then you would have to make configuration changes to go from standalone to SSO.  Even if you want to go to HA N+1, there is some changes you still have to make.  

If you don't have a lab or a way to test this, then this makes if hard for you.  When you have experience doing this, it easy to have that conversation with the customer to explain what they are asking and what it takes to get there including the risk and how long of a downtime you would need.  

I'm not a fan or "Special Code" versions as that has been an issue for me in the past.  However, if you can't test and you have no idea why they are on that code, then again, it makes it hard.

[Rich R · Accepted solution]

As @ammahend and @Scott Fella have pointed out 8.5.161.6 is an Engineering Special Escalation Image which would have been obtained from TAC and you will not find that on the software download site.

You either need to find the original image you got from TAC or ask TAC for it again.  However there is a strong possibility TAC will no longer have access to that image because it's so old and they will likely advise you to use the latest software as @marce1000 explained.  The escalation image file you got was probably named: AS_7500_8_5_161_6.aes

[Rich R · Accepted solution]

If you can't get the original image then I suggest:
1. Upgrade the new WLC to latest possible software as per TAC recommended link below.  If you can't upgrade beyond 8.5 because of old model APs then 8.5.182.11 (link below) otherwise currently 8.10.190.0 if all APs supported on 8.10.
2. Then configure the new WLC with all same config as old one (except IP addresses obviously but configure ready to join as HA later).  Move APs to the new WLC so the APs will need to download the new software.  You can test with 1 or 2 APs first by changing WLC HA setting on the APs.  Once you're sure it's working correctly you migrate all the remaining APs.
3. Upgrade the old WLC and then join them as HA pair on new code version.

[Aleck_Sei]

Thank you very much to everyone for your help.