Nexus 7000/7700 Software Upgrade via ISSU. Complete Upgrade Guide, Configuration Check, Verifying ISSU Capability (2024)

This article shows how to perform an ISSU (In-Service Software Upgrade) on a Nexus Data Center switch (7000 and 7700 models) and avoid service and network disruption. We explain the importance of keeping your NX-OS software updated, how the upgrade process is executed, explain the purpose of the Kickstart and System images, provide methods on how to transfer the NX-OS images to the switch bootflash on both supervisor engines, verify ISSU capability and test/simulate the upgrade process.

In addition we cover useful commands to discover issues that might occur during the upgrade process, configuration backup methods, upgrading a Nexus 7000 and Nexus 7700 series with single or dual Supervisor Engines (SUP1 and SUP2 models).

Key Topics:

• Why Upgrade your Nexus 7000/7700 NX-OS Software
• What is an ISSU Upgrade?
• How The ISSU Upgrade works
• Understanding Nexus Kickstart and System Images
• Transferring Images to Nexus 7000/7700 Switch
• Configuration Backup
• Incompatible Configuration Check, Verifying ISSU Capability, Testing The Upgrade Process
• Performing the Nexus ISSU Upgrade
• Nexus Upgrade Verification – Supervisor Engines and Modules
• Summary

Related Articles

• The Complete Cisco Nexus vPC Guide

Why Upgrade Your Nexus 7000/7700 NX-OS Software

Upgrading your NX-OS can be a daunting task as there is always the risk something might go wrong. Despite this, it is very important to ensure your core Nexus switch is running one of the latest and supported images.

If you’re looking for reasons why to take the risk and upgrade, here are a few that might help convince:

• Old NX-OS images might be stable but usually contain a number of bugs and security vulnerabilities that can put your core network and organization in risk.
• Your NX-OS version might not be supported any more. This means that in an event of a failure or problem, Cisco Technical Assistance Center (TAC) might require you to upgrade to a supported NX-OS version before providing any support.
• Support of new features, services and technologies. By upgrading to a newer NX-OS you’ll be able to take advantage of newer features that will now be supported.
• Support of new Modules and Supervisor Engines. When considering upgrading your Nexus Supervisor Engines or adding new modules it’s likely an upgrade will be required to support them.
• Peace of Mind. Knowing you’re on a supported, tested and patched up version always helps sleeping better at night!

It’s always recommended to perform a thorough research of the NX-OS version under consideration to identify caveats or issues that might affect your production environment. This information can be found on Cisco’s website or by opening a Cisco TAC Service Request.

What is an ISSU Upgrade?

The ISSU upgrade process provides us with the ability to upgrade a Nexus 7000/7700 switch without network or service disruption. During the ISSU process all Nexus modules and Supervisor Engines are fully upgraded without requiring a switch reboot.

Prerequisite for the ISSU upgrade is to have Dual Supervisor Engines and have an ISSU supported release loaded on your Nexus switch. The Dual Supervisor Engines are necessary as the ISSU process upgrades one Supervisor Engine at a time to keep the system up and running.

Cisco publishes a list of ISSU supported releases for every new NX-OS release. This means engineers should check the release notes of the candidate release they wish to upgrade to and see if their current version is amongst the ISSU supported releases.

Finally, an ISSU upgrade might be disruptive if there are configured features that are not supported on the new software image. We’ll show how you can test the ISSU upgrade process before initiating it.

How The ISSU Upgrade Works

Below is the process an ISSU upgrade follows on a Nexus 7000 with dual supervisor engines:

1. Installation begins with the install all command.
2. The installation process will verify the location and integrity of the new software image files.
3. System verifies the operational status and the current software version of both supervisor engines and all switching modules to ensure that the system is capable of an ISSU.
4. System initially upgrades all module cards bios/loader/bootrom.
5. System loads the new software images to the standby supervisor engine and brings it up to the HA ready state.
6. A supervisor switchover is then forced.
7. The new software image is loaded on the formerly active (now standby) supervisor and brings it up to the HA ready state.
8. A non-disruptive upgrade is performed on each of the switching modules starting from module 1.
9. Finally, on a Nexus 7000 with SUP-1 supervisor engines, each Connectivity Management Processor (CMP) is upgraded one at a time.

During the ISSU upgrade the switch provides continuous update of its progress and no command input is possible until the upgrade has been completed.

The ISSU upgrade can be initialled via a SSH or Telnet session to the Nexus switch or directly from the active supervisor engine console port.

When a supervisor switchover occurs, it’s possible the SSH/Telnet session will be lost but you can re-connect immediately and continue to monitor the upgrade process by issuing the show install all status command. Alternatively connect to both supervisor engine console ports simultaneously.

Understanding Nexus Kickstart and System Images

The Nexus 7000 requires two images in order to run. First is a Kickstart image while the second is a System image.

Here’s what they look like:

NEXUS_7000# dir bootflash://sup-1/
392990621 Sep 08 11:14:54 2018 n7000-s1-dk9.6.2.20a.bin
31178240 Sep 08 11:01:10 2018 n7000-s1-kickstart.6.2.20a.bin

The Kickstart image is around 31Mb-70Mb in size depending on the NX-OS version and contains the Linux kernel, basic drivers and initial file system. The System image is much larger, around 400Mb-650Mb in size depending on the NX-OS version and contains the system software and infrastructure code.

Transferring Images to Nexus 7000/7700 Switch

FTP is the recommended method of transfer. Thanks to the TCP transport protocol utilized by the FTP protocol, it is highly unlikely the image integrity will be compromised during the transfer.

Following are the possible locations where the image files can be stored on the Nexus:

• bootflash: or bootflash://sup-1/ (essentially the same location on supervisor engine 1)
• bootflash://sup-2/ This is the supervisor engine 2 bootflash

Image transfer can be initiated using the ftp command as shown in the example below:

NEXUS_7000# copy ftp://192.168.1.1/n7000-s1-kickstart.6.2.20a.bin bootflash:
Enter vrf (If no input, current vrf 'default' is considered):
Enter username: cisco
Password:
[################# ] 29.55MB ***** Transfer of file Completed Successfully *****
Copy complete, now saving to disk (please wait)...

At this point we can transfer the image to the supervisor engine 2 bootflash using the command:

NEXUS_7000# copy ftp://192.168.1.1/n7000-s1-kickstart.6.2.20a.bin bootflash://sup-2/

or copy the image directly from supervisor engine 1 with the following command:

NEXUS_7000# copy bootflash://sup-1/n7000-s1-kickstart.6.2.20a.bin bootflash://sup-2/

The second method is faster and preferred.

Configuration Backup

Creating a configuration backup should be mandatory in any upgrade process. This can be achieved via a simple show running-configuration and copy-pasting the output to a text file, or using the Nexus CheckPoint feature.

Incompatible Configuration Check, Verifying ISSU Capability, Testing The Upgrade Process

Verifying the upgrade and ISSU process is an extremely important step and should never be skipped. Cisco’s release notes clearly state the supported ISSU Paths however executing the test commands shown in this section will reveal any incompatible configuration and provide a complete insight of what will happen during the upgrade.

Here are the two commands highly recommended to be executed before the upgrade. Both are non-disruptive:

• show incompatibility system bootflash:<image> . Performs a configuration compatibility check that will highlight any configuration or features that might impact the upgrade process.
• show install all impact kickstart bootflash:<image> system bootflash:<image> . Performs a simulated upgrade that verifies the new firmware integrity, ISSU upgrade process, provides detailed report of which module images will be upgraded and more.

Below is the output of each command. In this particular environment we are checking an upgrade from NX-OS 6.2(16) to 6.2(20a):

NEXUS_7000# show incompatibility system bootflash:n7000-s1-dk9.6.2.20a.bin
Checking incompatible configuration(s)
No incompatible configurations
Checking dynamic incompatibilities:
-----------------------------------
No incompatible configurations

The system has reported there are no issues with our configuration. Next, we execute a test/simulation of the upgrade process:

The show install all impact command will take a long time to complete as it simulates the upgrade process.

The key column here is the Impact column at the end. This confirms that our upgrade to the new image will be non-disruptive for every module including the supervisor engines (Modules 5 & 6). Supervisor engines will be reset (one at a time), but an automatic switchover between them will ensure there is no service disruption.

Performing the Nexus ISSU Upgrade

Once we are confident and ready we can proceed with the upgrade using the install all command. Keep in mind that if you’re connected via SSH, you’ll be disconnected from the SSH session as soon as the active supervisor engine is rebooted.

To reconnect and continue monitoring the installation process, SSH back in and issue the show install all status command. Alternatively you’ll need to be connected to both supervisor engines console ports.

Once the initial checks are complete, you’ll be promoted to confirm with a "y" (yes) to continue with the installation

Nexus Upgrade Verification – Supervisor Engines and Modules

Once the installation is complete, a simple show version will verify the Nexus switch operating system has been upgraded:

In addition, the show module command will provide detailed information on what modules are installed and their software version which should match the newly installed software:

Finally, you can view the installation log using the show install all status command.

Summary

This article explained the importance of upgrading your Cisco Nexus 7000/7700 NX-OS operating system, what an ISSU (In-Service Software Upgrade) is, how ISSU works and the steps involved during the process. We also talked about the purpose and role of the Nexus Kickstart image and Nexus System image and showed how to transfer an image to your Nexus 7000/7700 switch.

In addition, we touched on different methods to backup your Nexus configuration and perform the important configuration compatibility check, ISSU capability verification and test the upgrade process. We finally saw how the Nexus ISSU upgrade is performed along with the upgrade verification process which includes supervisor engines and modules installed.