upgrading 9800 HA from 17.3.3 to 17.3.6

[atifali.zaidi1]

Hello Experts i would like to go for an ISSU upgrade on my 9800-L-F HA pair, currently it has 9120 and 3700 series ap's registered to it currently ?

i was wondering during the upgrade if the known bug hits (wherein the 3700's get stuck in downloading state) and you will have to set the time back ( before 4th of december ) as per the workaround and then bounce the access points to get it fixed.  

the reason i am upgrading to 17.3.6 is to address the issue with the 9120 (the newly shipped comes with v07 and not seems to be compatible with 17.3.3).

i just need to have a hitless upgrade , so is this doable ?

[atifali.zaidi1]

the BUG detail regarding 3702 getting stuck in downloading state 

[Sandeep Choudhary]

Hi,

It will fail.....

FYI: The AP can leave and re-join any WLC after Dec 4th 2022 provided it does not have to download a new image, if it has to download a new image (regardless of the version, 9800 IOS-XE or AireOS), it will fail.

If you still face issues then follow these workarounds:

Workaround: For all controller types: if fixed software has not yet been installed on the WLC, then to get the APs to join:

* Disable NTP (so server time does not overwrite controller temporary fake time)

* Change date on WLC to some time before December 4, 2022.

** Do not set the date so far back as to invalidate newer certificates on the APs or WLC

Wait until all APs finish downloading and are able to join the controller and resume normal operation. If an AP is unable to rejoin even after setting the date back, reboot the AP.

* Enable NTP again, after all APs are joined.

Regards

Dont forget to rate helpful posts

[atifali.zaidi1]

hi there , yes i am already aware of this workaround .  so i suppose i would have to set the date to 2nd december 2022 first and then proceed with the ISSU , once that gets completed , i can enable the correct time . but will this impact production ?  i think it will not , right ?

[marce1000]

       - It won't , 

 M.

[Sandeep Choudhary]

It will impact production because AP need to download the newer version.

Regards

Dont forget to rate helpful posts

[Leo Laohoo]

Do not use ISSU unless there is someone at the site to pull the power cables.

[JPavonM]

I always proceed with the pre-download AP code method BUT using CLI as I've never succeed using GUI.

This method only impacts production when AP and WLC reboots to apply new code (5 minutes maximum), and not during the download process.

// Ensure there is no old codes in the bootflash to free space
install remove inactive
!
// Copy new code to flash
copy ftp://user:password@<path_to_filename> bootflash:
!
install add file bootflash:<filename>
!
show install summary
!
// Pre-download AP images without disruption
ap image predownload
!
show ap image
!
// Invoke the next command for APs to reboot and activate new image
ap image swap
!
// Immediately invoke the next one to activate the image and reboot the controller
install activate
Save and Proceed [yes]
Press Quit(q) to exit, you may save configuration and re-enter the command. [y/n/q]y
This operation may require a reload of the system. Do you want to proceed? [y/n]y
!
// After WLC reboot image needs to be commited, otherwise WLC will reload again in 360 minutes with the previouys image
!
install commit 

[balaji.bandi]

if you made a plan to upgrade why not upgrade to latest suggest 17.6.4 ? - check compatable matrix.

https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html

is this managed by DNAC ? personally i have not seen any issue ISSU upgrade - so its your decision and support model you have when you doing ISSU upgrade.

also how big your deployment - look at roleout upgrade for the AP.

MAKE sure you read the release notes mainly  (Before You Upgrade)

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-6/release-notes/rn-17-6-9800.html

[JPavonM]

No he can't as AP3702 is not supported in that release.

[Rich R]

> No he can't as AP3702 is not supported in that release.
But will be in 17.9 from 17.9.3 (out sometime in the next month or so) so that will be the next release to look at.

Regarding ISSU we've just avoided using it - I find the install scripts too unreliable and temperamental (not to mention slow).  It seems to be able to get itself into an unrecoverable state where you are forced to completely deactivate, remove the new release before starting over with one or more reloads and/or switchovers to recover (which completely defeats the purpose of ISSU).  Keep it simple - plan for a few minutes outage.