Showing results for 
Search instead for 
Did you mean: 

SMU SAM changeset for certificate expiration

Hi all,

We just noticed an issue during installation of the CSCut30136 SMU to mitigate the certificate expiration on IOS XR. On non 4.3.4-sp2 system we can install the SMU smoothly and hitless. On systems with 4.3.4-sp2 the message appears, that parallel reloads are necessary (which seems to lead to a reboot). 

Why are 4.3.4-sp2 systems behaving differently?

Tue Jun 23 03:22:39.125 UTC
Install operation 145 '(admin) install activate disk0:asr9k-px-4.3.4.CSCut30136-1.0.0 synchronous' started by user 'xxxxxxx' via
CLI at 03:22:39 UTC Tue Jun 23 2015.
Info:     This operation will reload the following nodes in parallel:
Info:         0/RSP0/CPU0 (RP) (SDR: Owner)
Info:         0/RSP1/CPU0 (RP) (SDR: Owner)
Info:         0/0/CPU0 (LC) (SDR: Owner)
Info:         0/1/CPU0 (LC) (SDR: Owner)
Proceed with this install operation (y/n)? [y]
Install operation 145 cancelled by user 'xxxxxxx' at 03:23:52 UTC Tue Jun 23 2015.



Eddie Chami
Cisco Employee

Michel, this behavior is noted in the Field Notice, your seeing this behavior because 4.3.4 SP requires  per-requiste SP enable-meant SMUs which correctly loads the install load path once the SP is installed. If these where not present before the SP was installed, you will see this behavior.




Thanks Eddie for the explanation but i'm still confused :-) 

I've checked to release information inside the sp2 tar package and there are no pre-requisites mentioned:

Date Generated:          Mon May  5 11:32:38 PDT 2014

Owner:                   junchen

Name:                    asr9k-px-4.3.4.sp2.pie

Package(s):              iosxr-adv-video-4.3.4.sp2-1.0.0

On-the-Box Name:         asr9k-px-4.3.4.sp2

Uncompressed File Size:  144563599 bytes

Compressed File Size:    74557570 bytes

DDTS:                    CSCuo50552

Description:             DDTS to build Service Pack 2 for IOS XR 4.3.4 on ASR9K-PX platform

Pre-requisites:          None



Are there any options to get the fix for the certification issue installed without reloading the affected 4.3.4-sp2 systems?


Hi Michel,


See the below note.

Unfortunately there is no workaround, and don't worry about going back and installing the SMUs now, if it was up to me, i would wait for SP8 and you wouldn't have to worry about the Cert SMU and you would get a bunch of other fixes, you also wouldn't have to worry about the below note either, since the fixes for the below are part of the SP and now that you have SP2 loaded, once you install SP8 the loadpath will be all SP friendly and you'll be all set. We're trying to get SP8 out in the next 10 days or so. I can let you know once its posted?


There is a known issue with service packs for pre 5.1.2 releases, To install SP on top of version 4.3.2, 4.3.4, 5.1.0, 5.1.1 for the first time, customers need to install the mandatory SMU for CSCul58246 first, then install the SP
CSCul58246 has two other pre-requiste SMUs on 4.3.4, hence i suggest you just pick up SP8. 


Thanks again Eddie. Sp8 seems to be a good way, but still requires a reboot (which is indeed a pain to just fix this certificate issue).


If its just the cert issue and nothing else, i wouldn't rush then, you still have a few months to take care of that.. So you can hold off, install SP8 before the cert expires.

Content for Community-Ad

This widget could not be displayed.