cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
8778
Views
0
Helpful
42
Replies

FN - 63979 - ASR9000, CRS, and XR12000 That Run Cisco IOS-XR 5.3.0 and Earlier - Oct 17, 2015 SW Certificate Expiration - SMU Upgrade

Eddie Chami
Cisco Employee
Cisco Employee

This is a place holder for questions on FN 63979

Details are here: http://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63979.html

Use this thread to ask any questions. 

42 Replies 42

Most likely because of image signing or certificate problem. If your upgrading to a new release I would suggest turboboot to that release.. 4.3.4 is pretty old. 

Ok which release is best to be upgraded. Please advise?

Turboboot 6.2.3 mini.pie, once your on 6.2.3 install all the pies you NEED and the SMUs or Service Pack(SP) of 6.2.3. Keep staying current using Services Packs going forward.

mrivaud
Cisco Employee
Cisco Employee

Hi Eddie,

Is the temporary certificate the same for all platforms and versions? From some post SMU TAR files, css-root.cer seems to be the same file. We have several platforms and versions, and it will help if we can use the same css-root.cer file for the different platforms and versions that we have.

Regards,

Manuel

Manuel,

 

The same certificate can be used across the platforms. The cert is in the tar.

 

regards

Eddie.

Hi Eddie 

I am trying to understand how i should do to upgrade from 5.3.1 /5.3.0 to ver 5.3.2 and i tried this after the 17 October, I found the tar file in 5.1.3 where the CSS-ROT.CER but not in version 5.3.0 or 5.3.1 or 5.3.2 i have read the instructions but should I use the same procedure as in filed notice teher should be a "     Download the post-expiry SMU for your image from here." but there is none what  I can see for 5.3.2 or ( 5.3.0 or 5.3.1) what is I missing 

/Ola

 

Ola,

531/532 don't need the expiry SMU.  They already contain the SMU/fix in it.  As for 530, yes it has the expiry SMU available on CCO.  Here is the link:

https://software.cisco.com/download/release.html?mdfid=282414851&flowid=2137&softwareid=280867577&release=5.3.0&relind=AVAILABLE&rellifecycle=&reltype=latest

The cert is in there.  But as mentioned in this thread already.  If you have the cert for one release, it's the same for all other releases and platforms.  

Thanks,

Bryan

Hi Bryan 

thanks for answering , regarding version 5.3.1 and onwards is ok then.

Perfect, the node we had issue with was   running version 5.2.2 and there is also a SMU on CCO as you mentioned correctly. 

I will follow this guide line here  below and the CSS-root cert will I find in the tar file of the post-expiry SMU for version 5.2.2 and add that and activate the SMU before I  try the upgrade to the 5.3.2 version right ?

/Ola

Steps to install a post-expiry SMU

1.     Copy the root certificate to the disk on your router. The root certificate is available here.

2.     Install the certificate using the sam add certificate command from the privileged EXEC mode, if you have logged in to the router from the console.

OR

Install the certificate using the samcmd sam add certificate command from the shell.

3.     Download the post-expiry SMU for your image from here.

a.     Add the SMU to your router using the install add command.

b.     Activate the SMU using the install activate command.

 

 

 

Ola,

Yes, that is the correct process.  

Bryan

renato.lopez
Level 1
Level 1

Hello:

I have the same issue in an ASR9k running 4.3.4 with following installed software.

RP/0/RSP0/CPU0:R1001PNM#show install committed summary
Tue Dec  1 11:08:47.246 CET
Default Profile:
  SDRs:
    Owner
  Committed Packages:
    disk0:asr9k-doc-px-4.3.4
    disk0:asr9k-px-4.3.4.CSCul39674-1.0.0
    disk0:asr9k-fpd-px-4.3.4
    disk0:asr9k-k9sec-px-4.3.4
    disk0:asr9k-px-4.3.4.CSCum03261-1.0.0
    disk0:asr9k-mgbl-px-4.3.4
    disk0:asr9k-px-4.3.4.CSCum43188-1.0.0
    disk0:asr9k-mini-px-4.3.4
    disk0:asr9k-mpls-px-4.3.4
    disk0:asr9k-px-4.3.4.CSCum51429-1.0.0
    disk0:asr9k-px-4.3.4.CSCug75299-1.0.0
    disk0:asr9k-px-4.3.4.CSCun15934-1.0.0
    disk0:asr9k-px-4.3.4.CSCui94441-1.0.0
    disk0:asr9k-px-4.3.4.CSCum26074-1.0.0
    disk0:asr9k-px-4.3.4.CSCuo22306-1.0.0
    disk0:asr9k-px-4.3.4.CSCul93777-1.0.0.

I am trying to follow the procedure according the documentation but i cannot find any post-expiry SMU from Cisco.com, which will be available on cisco.com October 18, 2015.

Can you guide me about where to find the SMU?

/Renato

Renato, I see its on CCO here is the 4.3.4 SMU:

AA09874 CSCut52232 Recommended Production SMU for SAM post Oct 2015.

Can you take another look?

Hi thanks :

I found it now, the release date is 14-Sept-2015 and i was looking in October :).

Hitless/Recommended SMU, Post-Expiry-Cert Expiration Mandatory SAM SMU.  Login & Valid Contract Required
asr9k-px-4.3.4.CSCut52232.tar
14-SEP-2015 0.29 MB

Regards

Renato

pshadrin1
Level 1
Level 1

Hi!

We need to install asr9k-px-4.3.4.sp10 Service Pack (to fix some bugs). It contain asr9k-px-4.3.4.CSCut52232 already. Need I install asr9k-px-4.3.4.CSCut52232.tar first or just copy css-root.cer to disk0?

Hi,

You'll have to do the following in order. 

1) css-root.cer to disk0

2) Install CSCut52232

3) Install SP10

Or

1) css-root.cer to disk0

2) Set your clock to 2013

3) Install SP10

Eddie.

Hi, Eddi!

Thank you so much

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: