Upgrading WLC's 5508 with Flexconnect AP's all over the world

[aleopoldie]

Hello experts,

I have to upgrade 2 WLC's 5508 in SSO with some local AP's and some Flexconnect AP's in other countries and with a minimum of downtime. The thing is we want to control the reboot of the AP's on the remote sites.

Here is how I would like to process:

Let's consider we have the WLCs on site A with local AP's. We also have some Flexconnect AP's on remote site B, C and D, all running version 7.6.130.0. The goal is to upgrade to 8.3.122.0

This is how I want to do it :

- Download the AireOS 8.3.122.0 on the WLC's

- Predownload the AireOS 8.3.122.0 on all AP's (local and Flexconnect) on all sites

- Verify that all AP's have the backup image 8.3.122.0

- Block the FW CAPWAP traffic from the WLC to all remote sites so that the flexconnect AP's run in standalone mode (we are using local switching on remote sites, with PSK, so no need for the WLC)

- Swap the image on all AP's of the WLC (normally, the Flexconnect AP's will not be affected, only local AP's on site A will be, right?)

- Reboot the WLC's so that WLC's and local AP's of site A can come back with the new image, while Flexconnect AP's would still run 7.6.110.0 (because the FW CAPWAP traffic is has been blocked from WLC's to remote sites B, C and D)

- Then, we can decide and control on which site we want to reboot the Flexconnect AP's so that we control the downtime. 

Does it make sense for you ? Or should I swap images before blocking the FW CAPWAP traffic ?

Thank you,

[LJ Gabrillo]

I think you do not need to do this:
"Block the FW CAPWAP traffic from the WLC to all remote sites so that the flexconnect AP's run in standalone mode (we are using local switching on remote sites, with PSK, so no need for the WLC)"

I'd suggest to remove that line, it should have no issues with your activity considering it's FlexConnect.

Comments on this line:

Swap the image on all AP's of the WLC (normally, the Flexconnect AP's will not be affected, only local AP's on site A will be, right?)

I believe FlexConnect APs will be affeced if you pushed the images on ALL APs. I'd advise scheduling a maintenance window for your infrastructure during this activity since once the FlexConnect APs reboot, well, wireless access on those sites with FlexConnect APs will be interrupted for a few minutes. I believe, whether you like it or not, rebooting the WLC will execute a script on the APs to reboot as well. 
That's how upgrades work

[Ric Beeching]

LJ,

By blocking the CAPWAP traffic he can manage the reload per-site as they will be in standalone mode until the block is removed so that makes sense to me.

It seems like a sound plan... If available on your current software version I would also make sure the AP Image predownload option is enabled in each Flex group so there's less WAN traffic.

Cheers,

Ric

[LJ Gabrillo]

Oh okay, that solves the issue the FlexConnect APs reboots if the WLC is rebooted. I think you can do that, though I'd expect you need to tell the personel there to manually reboot the FlexConnect in order for it to apply the new firmware

Oh yeah, I forgot to mention this, additional comments on:

Swap the image on all AP's of the WLC (normally, the Flexconnect AP's will not be affected, only local AP's on site A will be, right?)


You actually do not need to do a SWAP command.
Once the firmware is uploaded on the WLC, WLC automatically makes that the PRIMARY image, hence you do not need to swap. Both the WLC and the AP will consider the primary image to be the
newly downloaded image (of course don't forget to pre-download the image). You can verify that via #show boot" command.

I'll just put the GUI/CLI config/command on how to pre-download images for everyone's reference(In case somebody stumbles on this thread too!) :D

->VIA GUI:
AT: Wireless->Access Points
CLICK: Global Configuration
AT: High Availability Section
CLICK: Download Primary Image -Primary image is the new image

**VERIFY STATUS:
AT: Wireless->Access Points
CLICK: All

LOOK AT: 'Download Status' Column

->VIA CLI:
#config ap image predownload primary all
#show ap image all -Verify

PS: In my experience in upgrading WLCs(i've upgraded a lot from small, 20APs or so, to 100 plus APs or so). Havent encountered super big problems along the way, heck, any problems at all. :D

Hoping your upgrade is smooth bro! :D 

[aleopoldie]

Hello, 

First of all, thank you both of you for your fast answers.

Indeed, I want to block the CAPWAP traffic in order to manage the per-site reload.

Basically I didn't know that the SWAP command was not necessary, thank you.

I will be able to remotly reboot the Flexconnect AP's over the switch with a shut/no shut, that should be okay.

The AP's concerned are 1142 and 1602.

Just 1 question Ric, you mentionned that I have to make sure the AP Image predownload option is enabled on each Flexconnect group. I didn't get it, for flexconnect AP upgrade, we need to predownload throug the flexconnect group ?

[Scott Fella]

If I were you, I would probably test this out. You want to make sure that when you block the ports that the FlexConnect everything works as planned. You also want to make sure both model AP's take the new image. It's a good plan, but without testing, it's not 100%. Typically when I have upgraded large FlexConnect sites, I would move them to a controller that has been upgraded so I can control sites or AP's being upgraded.

[aleopoldie]

Hello Scott,

I can confirm that Flexconnect AP's are working without the WLC as we already tested that. I also confirm AP's can run the new image we're gonna set.

Thank you for your answer.

-Alex

[Ric Beeching]

Yep so go for predownload no problem but often this can cause unncessary congestion on the WAN as 1000s of APs predownload the same image. There is a FlexConnect feature called master ap where, once enabled, a master AP per model is selected per Flex group (i.e. for you it would be a single 1142 and single 1602 AP). These master APs download the image and all the other APs within the Flex group will download it off them to save on bandwidth. 

Enable it by going to the Flex group, selecting the Image Upgrade tab and selecting FlexConnect AP Upgrade. You don't need to specify a master AP manually as it will automatically pick one from each model.

Ric

[aleopoldie]

Yes I heard about this master AP feature, but as we only have around 30 AP's for this upgrade, I think it should be ok. Thanks for clarifying.

Nevertheless, the swap image is really not necessary ? For me, when AP's will be predownloaded, the image will run as the backup image, and we need to swap, don't we ?

[Ric Beeching]

Ah no problem then!

No, once you've installed the new image to your WLC you should see it as the primary (show boot) prior to any reload. You can then issue config ap image predownload primary all to deploy that new primary image to your APs and reload as required.

Ric

[aleopoldie]

Ric,

I agree, but after puting the command config ap image predownload primary all the image will be located as backup image for AP's, so we need to swap images don't we ?

Sorry for insisting, but I wonder what's the goal of this command if we don't need it :-)

[LJ Gabrillo]

aleopoldie you still NEED that command to MINIMIZE downtime 

1. Behavior if that command is not typed:
-AP sets primary firmware to the new firmware, BUT doesn't download it
-Once AP reboots, AP will download firmware, and reboot again

2. Behavior if that command IS typed
-AP sets primary firmware to the new firmware and downloads it
-encounters a single reboot only :)

Command is optional really but recommended :)
Hope this helps

[LJ Gabrillo]

Hey Bro, what firmware are you currently using? as well as your target firmware
Those APs are quite old, your target firmware MAY NOT support your existing APs. Please consider this.

Release notes should reveal all necessary support information

[aleopoldie]

We are using 7.6.110.0 and go for 8.3.122.0

Both 1602 and 1142 are supported, but on the 8.3.122.0 release notes they mention that this is limited

Do you have more details about what is limited ?