Install MOP – CSS to Abraxas Migration

First Published: May 3, 2015

NOTE: Works with document’s Advanced Properties “First Published” property. Click File | Properties | Advanced Properties | Custom.

Last Updated: May 15, 2015

 

This document describes how to prepare for the CSS to Abraxas code signing migration for IOS XR images.NOTE: Works with document’s Advanced Properties “Last Updated” property. Click File | Properties | Advanced Properties | Custom.

NOTE: Available paragraph styles are listed in the Quick Styles Gallery in the Styles group on the Home tab. Alternatively, they can be accessed via the Styles window (press Alt + Ctrl + Shift + S).

CSS-to-Abraxas Code Migration Overview

IOS-XR uses certificates to sign and verify SMUs and packages that are installed on it to ensure only valid packages are installed.

Validity of the root certificate in all XR images expires on October 17, 2015. Post this expiry date any verification done using this certificate will fail. Users cannot install any new SMU, pie files, or perform a system upgrade/downgrade after the expiry date. However, existing installations will continue to work fine.

Currently the CSS server is used to sign the SMUs when they are built. In view of upgraded security standards, the Product Security Baseline (PSB) and the Infosec team recommend using the Abraxas server to the sign the images.

All the SMUs will be signed using the Abraxas server, starting from XR5.3.2, XR6.0 and beyond. In order to comply to the Abraxas-based SMU signing, users must install a pre-expiry SMU on the existing images before October 17, 2015. The pre-expiry SMU extends the validity of the root certificate on the existing image and ensures the newer SMUs can be signed using the Abraxas server. If the pre-expiry SMU is not installed before October 17, 2015, users must perform the following two steps:

1.     Add the root certificate.

2.     Install a post-expiry SMU. The post-expiry SMU ensures the newer SMUs can be signed using the Abraxas server.

Users can install SMU or pie files only after installing either the pre-expiry or post-expiry SMU, as appropriate.

The following procedures provide the steps required to prepare for the CSS to Abraxas migration.

How to Prepare for CSS to Abraxas Code Signing Migration

Installing a pre-expiry SMU

If you are still within October 17, 2015, you must install a pre-expiry SMU corresponding to your image.  Installing the pre-expiry SMU ensures that the validity of the root certificate on the XR image is extended. You can install additional SMUs or pie files only after adding the pre-expiry SMU.

Important: If you do not install a pre-expiry SMU before October 17, 2015, then you must follow steps provided in Installing a post-expiry SMU.

Pre-requisites

Be sure to install the pre-expiry SMU before October 17, 2015.

Steps to install a pre-expiry SMU

Perform the following steps to install a pre-expiry SMU:

1.     Pick the pre-expiry SMU for your image from here.

2.     Add the pre-expiry SMU to your router using the install add command.

3.     Activate the SMU using the install activate command.

Note: You can continue installing other SMUs using the install add and install activate commands, after installing the pre-expiry SMU, even after the expiry date.

Example

The following example shows how to install a pre-expiry SMU for XR5.1.3:

Installing a post-expiry SMU

You must install a post-expiry SMU along with the new root certificate, if you have crossed October 17, 2015. You can install additional SMUs or pie files after adding the post-expiry SMU.

Pre-requisites

—      Be sure to add the root certificate before installing the post-expiry SMU.

—      The post-expiry SMU can be installed at any time after October 17, 2015.

Steps to install a post-expiry SMU

1.     Copy the root certificate to the disk on your router. The root certificate is available here.

2.     Install the certificate using the sam add certificate command from the privileged EXEC mode, if you have logged in to the router from the console.

OR

Install the certificate using the samcmd sam add certificate command from the shell.

3.     Download the post-expiry SMU for your image from here.

a.     Add the SMU to your router using the install add command.

b.     Activate the SMU using the install activate command.

Note: You can continue installing other SMUs using the install add and install activate commands, after installing the post-expiry SMU.

Example

The following example shows how to install a post-expiry SMU for XR5.1.3:

 

Appendix

Upgrading/Downgrading Images before the expiry date

Pre-requisites

—      Be sure to check the upgrade/downgrade matrix available for your image.

Perform the following steps if you are still within October 17, 2015, and want to upgrade/downgrade to a different image after the expiry date:

1.     Pick the pre-expiry SMU for your image from here.

2.     Add the pre-expiry SMU to your router using the install add command.

3.     Activate the SMU using the install activate command.

4.     Add the mini-px.pie file of the upgrade/downgrade image as required, using the install add command.

Note: You can add the mini-px.pie file even after the expiry date since the pre-expiry SMU is added to your router.

5.     Deactivate all the SMUs/pie files on the router. The existing SMUs/pie files will not be compatible with the new image.

6.     Activate the pie file of the new image using the install activate command. Your router should be upgraded/downgraded as required.

Note: You must install the pre-expiry or post-expiry SMU of the new image as appropriate depending on the current date.

Example

The following example shows how to upgrade from XR5.1.3 to XR5.1.4 after installing the pre-expiry SMU:

Upgrading/Downgrading Images after the expiry date

Pre-requisites

Be sure to check the upgrade/downgrade matrix available for your image.

Perform the following steps if you have crossed October 17, 2015:

1.     Copy the root certificate to your disk. The root certificate is available here.

2.     Install the certificate using the sam add certificate command in privileged EXEC mode, if you have logged in to the router from the console.

OR

Install the certificate using the samcmd sam add certificate command from the shell.

3.     Pick the post-expiry SMU for your image from here.

4.     Add the post-expiry SMU to your router using the install add command.

5.     Activate the SMU using the install activate command.

6.     Add the mini-px.pie of the upgrade/downgrade image as required, using the install add command.

7.     Deactivate all the SMUs/pie files on the router. The existing SMUs/pie files will not be compatible with the new image.

8.     Activate the new image using the install activate command. Your image should be upgraded/downgraded as required.

Example

The following example shows how to upgrade from XR5.1.3 to XR5.1.4 after installing the post-expiry SMU: