Update/upgrade WLC Software Patch

[dot1x]

1. Could someone please assist what's the best practice to update the software version / patch on WLC?

Currently I'm running 8.3.102.0 and would like to update patch 8.3.130.0

2. Would APs restart once the WLC is updated? The APs are in FlexConnect Mode.

3. What's the best practice for standalone WLC?

4. What if we have WLCs in standby mode?

Any suggestions/recommendations please?

[Vengatesa Prasath · Accepted solution]

It is directly  upgrade to 8.3.130.0. 

If you are upgrading the WLC for the first time.. below link will help: 

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/68835-wlc-upgrade.html

yes, AP's will reload when you reboot the wlc for an upgrade. 

Always take backup of your config before you upgrade the WLC. 

You can follow below upgrade Procedure for HA: 

https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-1/HA_SSO_DG/High_Availability_DG.html#pgfId-46645

Hope this information helps..

[Leo Laohoo · Accepted solution]

If this is the first time you've ever done an firmware upgrade of a WLC, I strongly recommend you read the Release Notes very, very carefully (8.3.130.0 Release Notes found HERE).  

Not only will the Release Notes explain, in detail, how to upgrade the firmware of a controller but if you've got AP802, 1530, 1550 and 1570, you'll need to load a second supplementary firmware.  

[dot1x]

Thanks Leo and Vepannir for sharing the docs.

A quick question regarding Pre-Image Download for Access Points.

If we have more than 200 APs, what would be the best practice?

[startx001]

Hi all ,

Will Cisco announce patch for :

https://www.krackattacks.com/

https://www.windowscentral.com/krack

When it will be fixed in which version ?

KR
V

[Vengatesa Prasath]

8.3.130.0 has fix all ios AP models. For Cos AP's (like 2800, 3800, 1800...) no fix yet. 

you can subscribe to below link to get any further updates...

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171016-wpa#workarounds

-----Please rate useful posts-----

[Vengatesa Prasath]

If you have flex-connect group with specific ap model, then pre download will reduce downtime and save bandwidth..

please check the below link: (section: FlexConnect Smart AP Image Upgrade)

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-1/Enterprise-Mobility-8-1-Design-Guide/Enterprise_Mobility_8-1_Deployment_Guide/ch7_HREA.pdf

Smart AP Image Upgrade Summary

• Master and Slave APs are selected for each AP model per FlexConnect Group.

• Master downloads image from WLC.

• Slave downloads image from Master AP.

• Reduces downtime and saves WAN bandwidth.

hope this helps..

[dot1x]

---

@vepannir wrote:

If you have flex-connect group with specific ap model, then pre download will reduce downtime and save bandwidth..

please check the below link: (section: FlexConnect Smart AP Image Upgrade)

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-1/Enterprise-Mobility-8-1-Design-Guide/Enterprise_Mobility_8-1_Deployment_Guide/ch7_HREA.pdf

Smart AP Image Upgrade Summary

• Master and Slave APs are selected for each AP model per FlexConnect Group.

• Master downloads image from WLC.

• Slave downloads image from Master AP.

• Reduces downtime and saves WAN bandwidth.

hope this helps..

---

Hi Vepannir,

Thanks for your input. We do have FlexConnect Groups but I'll have to look again if we have same model in one FC Group (I doubt though). We might have mixture of 2700/2800/3800 APs.

• Master and Slave APs are selected for each AP model per FlexConnect Group.

Does it mean that one AP for each model in a FC Group would be selected as a master and other as slaves.

Eg: If I have 10 x 2700, 10 x 2800 and 10 x 3800 APs in FC Group say ABC.

So there would be 3 APs selected as master and rest 27 as slaves? Correct me if I'm wrong?

[Vengatesa Prasath]

yes you are correct. 

[dot1x]

Thanks.

Also, could you suggest what's the best practice if we have to uodate WLC, ISE and Prime?

Which device should we upgrade first?

[Vengatesa Prasath]

you can upgrade any of them first. 

But make sure all device compatible with each other. 

https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html

--- Vengat

******** Please rate useful post ***********

[dot1x]

yeah I had a look at the compatibility matrix.

Another question: Do I need to update FUS as well?

[Vengatesa Prasath]

Upgrading the Cisco WLC Software Release

Guidelines and Limitations

• We recommend that you install Release 1.9.0.0 of Cisco Wireless LAN Controller Field Upgrade Software (FUS), which is a special AES package that contains several system-related component upgrades. These include the bootloader, field recovery image, and FPGA/MCU firmware. Installing the FUS image requires special attention because it installs some critical firmware. The FUS image is independent of the runtime image. For more information, see http://www.cisco.com/​c/​en/​us/​td/​docs/​wireless/​controller/​release/​notes/​fus_​rn_​OL-31390-01.html.

  Note	If you are using a Cisco 2500 Series controller, you must install Release 1.9.0.0 or higher of Cisco Wireless LAN Controller FUS. This is not required if you are using other controller hardware models.

  Note	The FUS image installation process reboots the Cisco WLC several times and reboots the runtime image. The entire process takes approximately 30 minutes. We recommend that you install the FUS image in a planned outage window.

Same information is also available on the release notes: https://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn83mr3.html

[Leo Laohoo]

Don't be in a hurry to upgrade the controller.  Wait until Cisco releases the final fix software to address the KRACK vulnerability. 

[dot1x]

Thanks Leo.

We have mixture of Wave 1 and Wave 2 devices. We will wait for the final release.

Is there a link I could check when would the final release be available?