在 Catalyst 3850 和 Catalyst 9000 系列交换机上执行 ISSU
简介
本文档介绍在 Catalyst 3850 和 Catalyst 9000 系列交换机上执行服务中软件升级 (ISSU) 所涉及的步骤。
什么是ISSU
服务中软件升级是在网络继续转发数据包时将映像升级为设备上的另一个映像的过程。ISSU可帮助网络管理员在执行软件升级时避免网络中断。所述映像以安装模式升级，其中，每个软件包被单独升级。
支持Stackwise-Virtual的所有Catalyst 3850和Catalyst 9000系列上均支持ISSU，带双管理引擎的Catalyst 9400/9600独立机箱上也支持ISSU。
StackWise虚拟(SVL)包括两个连接在一起的交换机，形成一个虚拟交换机。SVL支持服务中软件升级。
支持的平台和版本支持列表
在继续ISSU之前，请检查平台是否实际支持ISSU。此外，验证当前代码和目标代码之间是否支持ISSU。有关支持的平台和ISSU兼容性矩阵的模式详细信息，请访问以下网址：
ISSU之前的先决条件
1.检查当前代码版本
C9500#show version | in IOS XE Cisco IOS XE Software, Version 16.09.02
2.检查引导模式
只有在Stackwise虚拟中的两台交换机均在Install（安装）模式下启动时，才支持ISSU。
C9500#show ver | in INSTALL
* 1 50 C9500-40X 16.9.2 CAT9K_IOSXE INSTALL
2 50 C9500-40X 16.9.2 CAT9K_IOSXE INSTALL On Catalyst 9400, the above output is not available. Check if the switch booted from packages.conf file C9400#show version | in System image System image file is "flash:packages.conf"
如果以捆绑包模式引导机箱，则不支持ISSU。如果在捆绑包模式下运行交换机时尝试运行ISSU，您会看到这样的错误。
*Nov 13 14:55:57.338: %INSTALL-5-INSTALL_START_INFO: Chassis 1 R1/0: install_engine: Started install one-shot ISSU flash:cat9k_iosxe.16.09.02.SPA.bininstall_add_activate_commit: Adding ISSU ERROR: install_add_activate_commit: One-Shot ISSU operation is not supported in bundle boot mode FAILED: install_add_activate_commit exit(1) Tue Nov 13 14:56:03 UTC 2018
3.检查闪存上是否有足够的可用内存
C9500#dir flash: | in free
11353194496 bytes total (8565174272 bytes free)
C9500#dir stby-flash: | in free
11353980928 bytes total (8566865920 bytes free)
确保闪存中至少有1GB的空间来扩展新映像。清理旧的安装文件，以防空间不足，然后使用install remove inactive命令。
4.检查交换机是否处于SSO模式
C9500#show redundancy
Redundant System Information :
------------------------------
Available system uptime = 4 minutes
Switchovers system experienced = 0
Standby failures = 0
Last switchover reason = none
Hardware Mode = Duplex
Configured Redundancy Mode = sso
Operating Redundancy Mode = sso
Maintenance Mode = Disabled
Communications = Up
Current Processor Information :
-------------------------------
Active Location = slot 1
Current Software state = ACTIVE
Uptime in current state = 30 minutes
Image Version = Cisco IOS Software [Fuji], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 16.9.2, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2018 by Cisco Systems, Inc.
Compiled Mon 05-Nov-18 19:32 by mcpre
BOOT = flash:packages.conf;
CONFIG_FILE =
Configuration register = 0x102
Peer Processor Information :
----------------------------
Standby Location = slot 2
Current Software state = STANDBY HOT
Uptime in current state = 26 minutes
Image Version = Cisco IOS Software [Fuji], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 16.9.2, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2018 by Cisco Systems, Inc.
Compiled Mon 05-Nov-18 19:32 by mcpre
BOOT = flash:packages.conf;
CONFIG_FILE =
Configuration register = 0x102
5.检查是否启用了自动引导
C9500#show boot system
---------------------------
Switch 1
---------------------------
Current Boot Variables:
BOOT variable = flash:packages.conf;
Boot Variables on next reload:
BOOT variable = flash:packages.conf;
Manual Boot = no <<<<< Manual Boot should be set to "no"
Enable Break = no
Boot Mode = DEVICE
iPXE Timeout = 0
---------------------------
Switch 2
---------------------------
Current Boot Variables:
BOOT variable = flash:packages.conf;
Boot Variables on next reload:
BOOT variable = flash:packages.conf;
Manual Boot = no
Enable Break = no
Boot Mode = DEVICE
iPXE Timeout = 0
如果未启用自动启动，则可以按如下所示进行更改：
C9500(config)#no boot manual
6.检查当前ISSU和安装状态
注意：此步骤非常重要！
C9500#show issu state detail
--- Starting local lock acquisition on switch 1 ---
Finished local lock acquisition on switch 1
No ISSU operation is in progress <<<<<<<<< If see anything else, abort ISSU before proceeding.
Check on how to manually abort ISSU. C9500#show install summary
[ Switch 1 2 ] Installed Package(s) Information:
State (St): I - Inactive, U - Activated & Uncommitted,
C - Activated & Committed, D - Deactivated & Uncommitted
--------------------------------------------------------------------------------
Type St Filename/Version
--------------------------------------------------------------------------------
IMG C 16.9.2.0.2433 <<<<<<<< State should be Activated & Committed for current version alone.
If not clear install state before proceeding. Check on how to clear install state. -------------------------------------------------------------------------------- Auto abort timer: inactive --------------------------------------------------------------------------------
7.复制要升级/降级的新映像
仅将映像复制到活动机箱（对于Stackwise）或活动管理引擎（对于Cat9400双SUP）就足够了。
C9500#copy tftp: bootflash: Address or name of remote host []? X.X.X.X Source filename []? cat9k_iosxe.16.09.02.SPA.bin Destination filename [cat9k_iosxe.16.09.02.SPA.bin]?
ISSU工作流程 — 实际升级
验证所有前提条件后，您可以继续进行实际升级，并使用下列方法之一：
- 一步工作流（仅一步操作，不支持回滚）
- 三步工作流（涉及3个步骤，支持故障回滚）
一步工作流
此工作流程仅涉及一个步骤，有助于优化。
注意：无法回滚，因为升级已自动提交。如果要回滚，请继续执行3步工作流。
// This example has SW-2 as Active and Sw-1 as Standby before starting ISSU
C9500#install add file flash:cat9k_iosxe.16.09.02.SPA.bin activate issu commit install_add_activate_commit: START Fri Feb 8 10:07:51 jst 2019 *Feb 8 10:07:52.456 jst: %INSTALL-5-INSTALL_START_INFO: Switch 2 R0/0: install_engine: Started install one-shot ISSU flash:cat9k_iosxe.16.09.02.SPA.bininstall_add_activate_commit: Adding ISSU --- Starting initial file syncing --- [2]: Copying flash:cat9k_iosxe.16.09.02.SPA.bin from switch 2 to switch 1 [1]: Finished copying to switch 1 Info: Finished copying flash:cat9k_iosxe.16.09.02.SPA.bin to the selected switch(es) Finished initial file syncing --- Starting Add --- Performing Add on all members [1] Add package(s) on switch 1 [1] Finished Add on switch 1 [2] Add package(s) on switch 2 [2] Finished Add on switch 2 Checking status of Add on [1 2] Add: Passed on [1 2] Finished Add install_add_activate_commit: Activating ISSU Going to start Oneshot ISSU install process STAGE 0: Initial System Level Sanity Check before starting ISSU =================================================== --- Verifying install_issu supported --- --- Verifying standby is in Standby Hot state --- --- Verifying booted from the valid media --- --- Verifying AutoBoot mode is enabled --- Finished Initial System Level Sanity Check STAGE 1: Installing software on Standby =================================================== --- Starting install_remote --- Performing install_remote on Chassis remote [1] install_remote package(s) on switch 1 [1] Finished install_remote on switch 1 install_remote: Passed on [1] Finished install_remote STAGE 2: Restarting Standby =================================================== --- Starting standby reload --- Finished standby reload --- Starting wait for Standby to reach terminal redundancy state --- <<<<< Standby (Sw-1) reloads here!!!
<<<<<<<< After Standby (Sw-1) comes up >>>>>>>>>>>
*Feb 8 10:19:10.223 jst: %REDUNDANCY-3-IPC: IOS versions do not match.
*Feb 8 10:19:48.421 jst: %HA_CONFIG_SYNC-6-BULK_CFGSYNC_SUCCEED: Bulk Sync succeeded
*Feb 8 10:19:49.422 jst: %RF-5-RF_TERMINAL_STATE: Terminal state reached for (SSO) <<<<< Standby (Sw-1) comes up on new code and joins as Hot Standby..
*Feb 8 10:21:02.975 jst: %PLATFORM-6-HASTATUS_DETAIL: RP switchover, received chassis event became active. Switch to primary (count 1) <<<<<< Switchover happens after this log and the previous active (Sw-2) reloads.
<<<<<<<< After new Standby (Sw-2) comes up >>>>>>>>
*Feb 8 10:27:09.715 jst: %HA_CONFIG_SYNC-6-BULK_CFGSYNC_SUCCEED: Bulk Sync succeeded
*Feb 8 10:27:10.717 jst: %RF-5-RF_TERMINAL_STATE: Terminal state reached for (SSO). <<<< ISSU commit starts after this automatically..
*Feb 8 10:28:27.302 jst: %INSTALL-5-INSTALL_START_INFO: Switch 2 R0/0: install_engine: Started install commit
%IOSXEBOOT-4-ISSU_ONE_SHOT: (rp/0): ISSU finished successfully
*Feb 8 10:29:32.127 jst: %INSTALL-5-INSTALL_COMPLETED_INFO: Switch 2 R0/0: install_engine: Completed install commit ISSU
在ISSU完成后继续执行。
三步工作流
- 此工作流程包括三个步骤：添加、激活和提交。激活后，所有交换机都将升级到新的软件版本，但软件不会自动提交，而必须通过install commit命令手动执行。
- 此方法的优点是系统可以回滚到以前的软件版本。
- 如果回滚计时器未停止并使用install auto-abort-timer stop或install commit命令，系统会自动回滚。如果回滚计时器停止，新软件版本可以在设备上运行任何持续时间，然后回滚到以前的版本。
步骤1.安装add。
此命令将映像下载到bootflash并在两台交换机上展开映像。
// This example has SW-1 as Active and Sw-2 as Standby before starting ISSU
C9500#install add file flash:cat9k-universalk9.SPA.16.09.03.BETA.E1.SSA.bin.bin
install_add: START Fri Feb 8 09:22:00 jst 2019
*Feb 8 09:22:02.055 jst: %INSTALL-5-INSTALL_START_INFO: Switch 1 R0/0: install_engine: Started install add flash:cat9k-universalk9.SPA.16.09.03.BETA.E1.SSA.bin.bininstall_add: Adding PACKAGE
--- Starting initial file syncing ---
[1]: Copying flash:cat9k-universalk9.SPA.16.09.03.BETA.E1.SSA.bin.bin from switch 1 to switch 2
[2]: Finished copying to switch 2
Info: Finished copying flash:cat9k-universalk9.SPA.16.09.03.BETA.E1.SSA.bin.bin to the selected switch(es)
Finished initial file syncing
--- Starting Add ---
Performing Add on all members
[1] Add package(s) on switch 1
[1] Finished Add on switch 1
[2] Add package(s) on switch 2
[2] Finished Add on switch 2
Checking status of Add on [1 2]
Add: Passed on [1 2]
Finished Add
SUCCESS: install_add Fri Feb 8 09:26:26 jst 2019 <<<< Wait until install_add says SUCCESS. If fails, manually abort ISSU.
步骤2.安装激活。
- 当您执行此命令时，会发生以下一系列事件：
(i)启动回滚计时器。如果回滚计时器过期，则系统回滚到ISSU启动前的相同状态。使用install auto-abort-timer stop命令可以停止回滚计时器。使用install abort issu命令时，可以回滚ISSU。
(ii)备用交换机使用新软件进行调配，然后使用新软件版本重新加载。接下来，为活动交换机调配新软件，并重新加载。具有新映像的备用交换机现在成为活动交换机，而旧的活动交换机成为备用交换机。
在此过程结束时，两台交换机都使用新的软件映像运行。
C9500#install activate issu install_activate: START Fri Feb 8 09:28:27 jst 2019 install_activate: Activating ISSU *Feb 8 09:28:28.905 jst: %INSTALL-5-INSTALL_START_INFO: Switch 1 R0/0: install_engine: Started install activate ISSU Going to start Activate ISSU install process STAGE 0: Initial System Level Sanity Check before starting ISSU=================================================== --- Verifying install_issu supported --- --- Verifying standby is in Standby Hot state --- --- Verifying booted from the valid media --- --- Verifying AutoBoot mode is enabled --- Finished Initial System Level Sanity Check STAGE 1: Installing software on Standby =================================================== --- Starting install_remote --- Performing install_remote on Chassis remote *Feb 8 09:28:31.880 jst: %INSTALL-5-INSTALL_AUTO_ABORT_TIMER_PROGRESS: Switch 1 R0/0: rollback_timer: Install auto abort timer can expire in 7200 seconds [2] install_remote package(s) on switch 2 [2] Finished install_remote on switch 2 install_remote: Passed on [2]
Finished install_remote
STAGE 2: Restarting Standby =================================================== --- Starting standby reload --- Finished standby reload--- Starting wait for Standby to reach terminal redundancy state --- <<<<<<<< Standby (Sw-2) reloads here!!!*Feb 8 09:35:16.489 jst: %REDUNDANCY-3-IPC: IOS versions do not match. *Feb 8 09:36:00.238 jst: %HA_CONFIG_SYNC-6-BULK_CFGSYNC_SUCCEED: Bulk Sync succeeded *Feb 8 09:36:01.240 jst: %RF-5-RF_TERMINAL_STATE: Terminal state reached for (SSO) <<<< At this point, Standby (Sw-2) comes up with new code and joins as Hot Standby Finished wait for Standby to reach terminal redundancy state
STAGE 3: Installing software on Active =================================================== --- Starting install_active ---
Performing install_active on Chassis 11] install_active package(s) on switch 1 [1] Finished install_active on switch 1 install_active: Passed on [1] Finished install_active
Chassis 1 reloading, reason - Non participant detected
STAGE 4: Restarting Active (switchover to standby) <<<<<<<< At this point, there is a switchover and then the previous Active (Sw-1) reloads. =================================================== --- Starting active reload --- New software can load after reboot process is completed SUCCESS: install_activate Fri Feb 8 09:37:14 jst 2019
在Activate状态结束时，检查ISSU状态。
C9500#show issu state detail --- Starting local lock acquisition on switch 2 --- Finished local lock acquisition on switch 2 Operation type: Step-by-step ISSU Install type : Image installation using ISSUCurrent state : Activated state Last operation: Switchover Completed operations: Operation Start time ------------------------------------------------------- Activate location standby Chassis 2 2019-02-08:09:28:32 Activate location active Chassis 1 2019-02-08:09:36:03 Switchover 2019-02-08:09:37:16
State transition: Added -> Standby activated -> Active switched-over Auto abort timer: automatic, remaining time before rollback: 01:43:55 Running image: flash:packages.conf Operating mode: sso, terminal state reached <<<<< Wait until SSO terminal state before proceeding to commit.
步骤3.安装提交。
commit命令执行必要的清理，将新软件作为永久软件启用（删除软件的旧版本），并停止回滚计时器。提交后的任何重新引导都可使用新软件启动。
C9500#install commit install_commit: START Fri Feb 8 09:45:22 jst 2019 install_commit: Committing ISSU *Feb 8 09:45:23.533 jst: %INSTALL-5-INSTALL_START_INFO: Switch 2 R0/0: install_engine: Started install commit Going to start Commit ISSU install process STAGE 0: Initial System Level Sanity Check before starting ISSU =================================================== --- Verifying install_issu supported --- --- Verifying standby is in Standby Hot state --- --- Verifying booted from the valid media --- --- Verifying AutoBoot mode is enabled ---
Finished Initial System Level Sanity Check --- Starting install_commit_2 --- Performing install_commit_2 on Chassis 2 [2] install_commit_2 package(s) on switch 2 [2] Finished install_commit_2 on switch 2 install_commit_2: Passed on [2] Finished install_commit_2 STAGE 1: Dispatching the commit command to remote =================================================== --- Starting install_commit_remote --- Performing install_commit_remote on Chassis 1 Feb 8 09:48:33.364: %INSTALL-5-INSTALL_START_INFO: R0/0: install_engine: Started install commit *Feb 8 09:48:33.352 jst: %INSTALL-5-INSTALL_START_INFO: Switch 1 R0/0: install_engine: Started install commit Feb 8 09:51:27.505: %INSTALL-5-INSTALL_COMPLETED_INFO: R0/0: install_engine: Completed install commit ISSU [1] install_commit_remote package(s) on switch 1 [1] Finished install_commit_remote on switch 1 install_commit_remote: Passed on [1] Finished install_commit_remote SUCCESS: install_commit Fri Feb 8 09:51:27 jst 2019 <<<<< ISSU is completed here!!!!!
ISSU后检查表
ISSU成功完成后，
- 检查两台交换机是否都运行在新软件上。
- 选中show issu state detail output to be clean and not showing any ISSU in progress。
- 检查show install issu history输出以确保ISSU操作成功（命令仅适用于16.10.1版本及更高版本）。
- 建议在启用任何新功能之前，在新软件中留出足够的浸泡时间。
ISSU故障时的操作
- 如果ISSU发生故障，则预期自动中止会将系统恢复到初始状态（较旧的映像）。 但是，如果此操作也失败，则需要手动恢复机箱。
- 在手动恢复期间，检查主用和备用是否都运行旧映像（如果不运行，则恢复单个机箱）。
- 确保两个机箱都运行旧映像后，运行install remove inactive以删除任何未使用的映像软件包。
- 一旦两个机箱都运行旧软件，请手动清除ISSU操作的所有内部状态。（有关如何清除内部ISSU状态，请参阅此处）。
中止ISSU
- 在3步工作流程中，在激活ISSU过程中，如果abort-timer过期，系统可以自动中止到较旧的映像。
注意：如果备用设备在中止期间未到达SSO，则需要手动中止。此外，如果由于任何原因您希望在中间中止ISSU，则需要手动中止。
EXAMPLE : During install add, we notice these errors:
C9400#install add file flash:cat9k_iosxe.16.09.02.SPA.bin install_add: START Tue Nov 13 20:47:53 UTC 2018 *Nov 13 20:47:54.787: %INSTALL-5-INSTALL_START_INFO: Chassis 1 R1/0: install_engine: Started install add flash:cat9k_iosxe.16.09.02.SPA.bininstall_add: Adding PACKAGE --- Starting initial file syncing --- [1]: Copying flash:cat9k_iosxe.16.09.02.SPA.bin from chassis 1 to chassis 2 [2]: Finished copying to chassis 2 Info: Finished copying flash:cat9k_iosxe.16.09.02.SPA.bin to the selected chassis Finished initial file syncing --- Starting Add --- Performing Add on all members [1] Add package(s) on chassis 1 [1] Finished Add on chassis 1 [2] Add package(s) on chassis 2 cp: cannot stat '/tmp/packages.conf': No such file or directory [2] Finished Add on chassis 2 Checking status of Add on [1 2] Add: Passed on [1]. Failed on [2] Finished Add FAILED: install_add exit(1) Tue Nov 13 20:51:58 UTC 2018 <<<<<< install_add failed. If see any such error, first do a manual abort before proceeding further. C9400#install abort issu install_abort: START Tue Nov 13 20:57:40 UTC 2018 install_abort: Abort type ISSU subtype NONE smutype NONE *Nov 13 20:57:41.759: %INSTALL-5-INSTALL_START_INFO: Chassis 1 R1/0: install_engine: Started install abort ISSU NOTE: Going to start Abort ISSU install process STAGE 0: Initial System Level Sanity Check before starting ISSU =================================================== --- Verifying install_issu supported --- --- Verifying booted from the valid media --- --- Verifying AutoBoot mode is enabled --- Finished Initial System Level Sanity Check FAILED: ABORT operation is not allowed in ADDED state ERROR: install_abort exit(2 ) Tue Nov 13 20:57:49 UTC 2018 *Nov 13 20:57:49.756: %INSTALL-5-INSTALL_COMPLETED_INFO: Chassis 1 R1/0: install_engine: Completed install abort ISSU
正常ISSU状态
如果ISSU升级/降级/中止/自动中止失败，则需要手动清除ISSU内部状态。
C9400#sh issu state detail --- Starting local lock acquisition on chassis 1 --- Finished local lock acquisition on chassis 1 Operation type: One-shot ISSU Install type : Image installation using ISSU Current state : Added state Last operation: Activate location standby Chassis 2 <<<< Previous Add is still pending. This needs to be cleared before starting ISSU Completed operations: Operation Start time ------------------------------------------------------- Activate location standby Chassis 2 2018-11-13:16:26:34 State transition: Added Auto abort timer: inactive Running image: flash:packages.conf Operating mode: sso, terminal state not reached Enable Service Internal before you run this command
C9400#clear install state clear_install_state: START Tue Nov 13 17:05:47 UTC 2018 --- Starting clear_install_state --- Performing clear_install_state on all members [1] clear_install_state package(s) on chassis 1 [1] Finished clear_install_state on chassis 1 Checking status of clear_install_state on [1] clear_install_state: Passed on [1] Finished clear_install_state C9400#sh issu state detail --- Starting local lock acquisition on chassis 1 --- Finished local lock acquisition on chassis 1 No ISSU operation is in progress
修订历史记录
| 版本 | 发布日期 | 备注 |
|---|---|---|
3.0 |
13-Nov-2024 |
已删除PII。已更新标题、简介、样式要求、机器翻译、动词和格式。 |
1.0 |
14-May-2019 |
初始版本 |
反馈