The Software Maintenance Upgrade (SMU) is a package that can be installed on a system to provide a patch fix or security resolution to a released image for a specific defect in order to respond to immediate issues. It does not contain new features.

Some of the caveats of the SMU are:

• Provided on a per release, per component basis and is specific to the platform. SMU versions are synchronized to the package major, minor, and maintenance versions they upgrade.

• SMUs are not an alternative to maintenance releases. All defects fixed by SMUs are then automatically integrated into the upcoming maintenance releases.

• The Cisco IOS XE platform internally validates the SMU compatibility and does not allow you to install non-compatible SMUs. This is based on rules/limitations for a SMU change-set.

• An SMU provides a significant benefit over classic IOS software as it allows you to address the network issue quickly while reducing the time and scope of the testing required.

• SMU is a method to fix bugs in an existing release, and allows the application of a PSIRT fix in an existing release

• SMU is NOT an upgrade path from release X to maintenance release X.1

• SMU is NOT an upgrade path from release X to release Y

The device only supports “Hot Patching”. This means:

• The running image is modified in-place or in-service

• This avoids downtime and interruption of service

• The updated code to fix the defect is written in a different location, and where the patch redirects the program run

The work-flow for the patch requires that you complete the following sequence of operation in exec mode:

1. Addition of the SMU to the file system

2. Activation of the SMU onto the system

3. Committing the SMU change

4. Removal and Uninstallation of the SMU

The basic requirements for SMU are:

• The image where the defect was discovered

• The patch file that contains the fix for the defect must be formatted as ir1101-image_name.release_version.CSCxxyyyyy.SPA.smu.bin

This section shows an example of a patch for the CDET CSCvk58743.

Command example:

Router# config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# interface g0/0/0
Router(config-if)# ipv6 nd cache expire 770
Router(config-if)# end
Router#
 *Sep 25 12:00:29.978: %SYS-5-CONFIG_I: Configured from console by console

As the following CDET states, the ND Cache expire timer did not appear in the command output of show ipv6 neighbors g0/0/0

• CSCvk58743

Summary : Show ipv6 interface does not display "ND Cache expire timer"

Component : ipv6

Defective Image : ir1101-universalk9.16.11.01.SPA.bin

Patch Image : ir1101-universalk9.16.11.01.CSCvk58743.SPA.smu.bin

The following is what the required configuration output should look like:

Interface GigabitEthernet0/0/0
 no switchport
 no ip address
 ipv6 address FE80::1 link-local
 ipv6 address 2001::1/64
 ipv6 nd na glean
 
ipv6 nd cache expire 770
 
 end

In the above output, the blue text configures the length of time before an IPv6 neighbor discovery cache entry expires. The range is from 1 to 65536 seconds.

There are two methods to remove or uninstall the patch image.

• Restoring the image to its original version by using the following command:

  • install rollback to base

• Specific removal of a patch by using the following commands in sequence:

  • install deactivate file flash:ir1101-image_name.release_version.CSCxxyyyyy.SPA.smu.bin

  • install commit

  • install remove file flash:ir1101-image_name.release_version.CSCxxyyyyy.SPA.smu.bin