New and Changed Information

The following table provides an overview of the significant changes up to this current release. The table does not provide an exhaustive list of all changes or of the new features up to this release.


Note

The information in this document applies for NDFC release 12.2.1 and later. For NDFC releases prior to 12.2.1, refer to the Image Management document instead.

Release Version

Feature

Description

NDFC release 12.2.1.

Updates to navigation

Beginning with NDFC release 12.2.1, the following areas related to image management have changed:

  • The Image Management page is now Fabric Software

  • The navigation path to the new Fabric Software is now:

    Manage > Fabric Software

NDFC release 12.2.1.

Update groups for switches in a fabric

Beginning with NDFC release 12.2.1, you can now perform switch upgrades or downgrades at the fabric level. For more information, see Upgrade or Downgrade Switches in a Fabric.

Understanding Fabric Software

This document provides detailed information for the Fabric Software feature for Nexus Dashboard Fabric Controller release 12.2.1 or later.

Fabric Software deploys Cisco software images to switches which allows network stability and feature consistency. The benefits of Fabric Software workflows include the following:

  • Comprehensive image management policies allow you to specify a version and patch level for a set of switches

  • Nexus Dashboard Fabric Controller (NDFC) validates compliance for the image policy associated with each switch

  • Image staging, validation, and in-service software upgrade (ISSU) operations are independent, allowing mass upgrades and downgrades, and the ability to perform staging and validation in a single step

    • You can perform the following operations before the maintenance window:

      • Stage image files

        This copies the image files to the bootflash.

      • Validate Network Operating System (NOS) and EPLD compatibility where possible

        This checks if the image is complete, if the image is valid for the individual hardware, and if the upgrade can be non-disruptive.

      • Run pre-upgrade reports

  • The ability to run reports pre/post-upgrade and compare the results

  • The ability to generate snapshots of the configuration pre/post-upgrade

  • The View Details column provides Live log status to monitor each operation

  • Allows you to make use of maintenance mode to minimize the impact of disruptive upgrades, especially for multi-reload upgrade situations

  • Allows you to perform multiple operations on the devices simultaneously. However, you cannot perform multiple operations on the same set of devices at the same time.

  • Upgrade groups allows bulk upgrades and downgrades. Upgrade groups have checks to avoid unnecessary downtime in redundant fabrics in the following cases:

    • All switches of a given role for a fabric will be in the same group

    • Switches that are grouped in odd or even groups:

      • Switches that have even numbers or VPC role of primary

      • Switches that have odd numbers or VPC role of secondary

  • Provides visibility into previous and current upgrade details as well as high level summarization

  • Visibility into current NOS, EPLD and patch consistency at a switch, fabric, and group level

Starting with Nexus Dashboard Fabric Controller release 12.2.1, the Overview tab has changed and displays the images, policies, platforms, release versions, and fabric information.

The Fabric Software UI has the following functional areas:

  • Overview: This displays the images, policies, platforms, release versions, and fabric information.

    • The Images card displays the number of images and the type of packages or patches.

    • The Policies card displays the number of polices, the number and types of platforms, and the release versions and the types of switches.

    • The fabric area displays information about the configured fabrics.

      Field

      Description

      Fabric

      The name of the fabric.

      Current Versions

      The current versions of software running on the switches in the fabric.

      Policy

      The fabric-level image policy that is being used for the switches in the fabric, if applicable. See Upgrade or Downgrade Switches in a Fabric for more information.

      Status

      The status of the fabric-level image policy:

      • None: No fabric-level image policy has been configured for this fabric.

      • In-Sync: The current image versions on each switch in the fabric is in-sync with the expected image versions.

      • Out-of-Sync: The current image versions on one or more switches in the fabric is out-of-sync with the expected image versions. Click the Out-of-Sync text in the Status column to bring up a slide-in pane that shows which switches in the fabric are out-of-sync with the expected image versions. See Recalculating Compliance for more information.

      • Prepare: Click to prepare a software image policy that can be used at the fabric level. See Preparing a Fabric Image Policy for more information.

      • Update plan: The system is ready to apply the necessary software updates to certain switches in the fabric. Click Update plan to bring up the Software Update Plan for the fabric. See Installing or Upgrading Software on Devices in a Fabric for more information.

      Fabric Type

      The type of fabric.

      Switches

      The number of switches in each fabric.

  • Images: This displays the images. You can upload or delete images.

    Field

    Description

    Platform

    Specifies the name of the platform. Images, RPMs, or SMUs are categorized as follows:

    • N9K/N3K

    • N6K

    • N7K

    • N77K

    • N5K

    • Other

    • Third Party

    The images are the same for N9K and N3K platforms.

    The platform is Other if the uploaded images are not mapped to any of the existing platforms.

    The platform is N9K/N3K for RPMs.

    Bits

    Specifies the bits of the image

    Image Name

    Specifies the filename of the image, RPM, or SMU that you uploaded.

    Image Type

    Specifies the file type of the image, EPLD, RPM, or SMU.

    Image Sub Type

    Specifies the file type of the image, EPLD, RPM, or SMU.

    The file type EPLDs are epld. The file types of images are nxos, system or kickstart. The file type for RPMs is feature and for SMUs the file type is patch.

    NXOS Version

    Specifies the NXOS image version for only Cisco switches.

    Image Version

    Specifies the image version for all devices, including the non-Cisco devices as well.

    Size (Bytes)

    Specifies the size of the image, RPM, or SMU files in bytes.

    Reference Count

    Specifies the reference count.

    Image Present

    Available beginning with NDFC release 12.2.1. Determines if the uploaded image is present after a successful NDFC restore process and/or NDFC upgrade process.

    Checksum

    Specifies the checksum of the image. The checksum checks if there’s any corruption in the file of the image, RPM, or SMU. You can validate the authenticity by verifying if the checksum value is same for the file you downloaded from the Cisco website and the file you upload in the Image Upload window.

  • Image Polices: This displays the image policies. You can create, delete, or edit image policies.

    Field

    Description

    Policy Name

    Specifies the name of the image policy.

    Platform

    Specifies the name of the platform. Images, RPMs, or SMUs are categorized as follows:

    • N9K/N3K

    • N6K

    • N7K

    • N77K

    • N5K

    • Other

    • Third Party

    The images are the same for N9K and N3K platforms.

    The platform is Other if the uploaded images are not mapped to any of the existing platforms.

    The platform is N9K/N3K for RPMs.

    NXOS Version

    Specifies the NXOS image version for only Cisco switches.

    Image Name

    Specifies the filename of the image, RPM, or SMU that you uploaded.

    EPLD Name

    Specifies the name of the electronic programmable logic device (EPLD).

    Package Name(s)

    Specifies the name of the package.

    Disable RPM(s)

    Shows whether the RPM/SMU Disable option is enabled (true) or not (false).

    Reference Count

    Specifies the reference count.

    Image Present

    Available beginning with NDFC release 12.2.1. Determines if the uploaded image is present after a successful NDFC restore process and/or NDFC upgrade process.

    Policy Description

    Specifies a description of the image policy.

  • Devices: This displays the devices. You can stage image, upgrade, validate, change mode, attach group, detach group, attach policy, or detach policy.


    Note

    You cannot attach or detach fabric policies from the Devices tab. Only image policies can be attached or detached from the Devices tab.

    Field

    Description

    Device Name

    Specifies the name of the device.

    IP Address

    Specifies the IP address of the device.

    Fabric

    Specifies the fabric that the device resides in.

    NXOS Version

    Specifies the NXOS image version for only Cisco switches.

    Policy

    Specifies the image policy that is being used by the device.

    Status

    Specifies the configuration status. Status will be either In-Sync or Out-of-sync.

    Model

    Specifies the switch model.

    View Details

    Click the link to view details for the switch, if available. For example, click Compliance to view the compliance check details.

    Image Staged

    Specifies whether the image has been staged or not.

    Validated

    Specifies whether the image has been validated or not.

    Upgrade

    Specifies whether the image has been upgraded or not

    Upgrade Groups

    Specifies the name of the upgrade group.

    Mode

    Specifies the upgrade mode (Maintenance or Normal).

    VPC Role

    Specifies the VPC role, if applicable (Primary or Secondary).

    VPC Peer

    Specifies which switch is the VPC peer with this switch, if applicable.

    Role

    Specifies the role for the switch.

    Last Upgrade Action

    Specifies when the last upgrade was performed on the switch.

  • History: This displays the history of all the operations performed on the switches.

    Field

    Description

    ID

    Specifies the ID number.

    Device Name

    Specifies the device name.

    Version

    Specifies the version of the image on the device.

    Policy Name

    Specifies the policy name attached to the image.

    Status

    Displays if the operation was a success or failure.

    Reason

    Specifies the reason for the operation to fail.

    Operation Type

    Specifies the type of operation performed.

    Fabric Name

    Specifies the name of the Fabric.

    Created By

    Specifies the user name who performed the operation.

    Timestamp

    Specifies the time when the operation was performed.

Terminology

This describes the terms that you must be familiar with:

Term

Acronym

Description

Electronic Programmable Logic Device

EPLD

The EPLD image upgrades to enhance hardware functionality or to resolve known issues.

In-Service Software Upgrade

ISSU

ISSU allows you to upgrade the software version of the release on a chassis device with no network downtime.

Local Area Network

LAN

LAN consists of a series of computers linked together to form a network in a circumscribed location.

Network Operating System

NOS

A specialized operating system designed for a network device such as a router, switch or firewall. Some examples include NX-OS for Nexus switches, IOS XE for Cisco Catalyst switches and so on.

Rendezvous Points

RP

RP is a router that acts as the place where sources and receivers of multicast data can find each other.

Route Reflector

RR

Route Reflector is a router that acts as a routing information exchange server for all other iBGP routers.

Secure Copy

SCP

SCP is used by fabric software to transfer files between devices.

Secure File Transfer Protocol

SFTP

SFTP is a network protocol that allows you to securely access, transfer, and manage large files and sensitive data.

Prerequisites

This section describes the prerequisites. This document assumes that the reader has a fundamental knowledge of Nexus Dashboard and Nexus Dashboard Fabric Controller.

  • SCP is used by Fabric Software. Both SCP and SNMP are always enabled by default and a minimum of 2 external service pool IPs are needed when you enable the Nexus Dashboard Fabric Controller.

  • Ensure that your user role is network-admin or device-upg-admin.

  • Ensure that there is a fabric, the fabric must have the "Deployment Enabled" flag set, and the switches are managed by the Nexus Dashboard Fabric Controller in this fabric.

  • Ensure you have LAN credential set.

Upgrade or Downgrade a Group of Switches

You have two upgrade methods and one downgrade method:

Upgrading or Downgrading a Group of Switches (Disruptive)

This section describes a disruptive method for upgrading or downgrading a group of switches.

If you are downgrading a group of switches, the process is identical to the process for upgrading a group of switches, except that the target image that you choose will be earlier than the currently installed image. The text for dialogs, fields, buttons, and other controls in the UI specify “upgrade” even though you are downgrading the software.

Downloading an Image from the Software Download Website

This section describes how to download an image from the software download website.

Procedure

Step 1

Go to the Software Download website.

Software Download Website

Step 2

Login with your credentials. You must login to download the software.

Step 3

Navigate to Switches, choose a series and a switch.

Step 4

Depending on the switch model, choose a software type:

  • For Nexus switches:

    • NX-OS EPLD Updates

    • NX-OS Firmware

    • NX-OS Patch Release

    • NX-OS Software Maintenance Upgrades (SMU)

    • NX-OS System Software

  • For Cisco Catalyst switches: IOS XE Software

    For Cisco Catalyst switches, NDFC provides support for software upgrade using CAT9K and CAT9K_LITE image types.

Step 5

Choose the software file you want to download and click the download icon.

Uploading the Image to Nexus Dashboard Fabric Controller

This section describes how to upload the image.


Note

If you are about to upload a compacted NX-OS image to the NDFC image repository and another NX-OS image with the same name is currently in the repository, you might overwrite the existing (older) NX-OS image with the newer NX-OS image that you are about to upload. You can avoid overwriting the existing image using the following method:

  1. Upgrade the switches that can use normal NX-OS image first.

  2. Delete the normal NX-OS image from the NDFC repository using the Image Upload screen.

  3. Upload the compact image and upgrade the other set of switches.
Procedure

Step 1

In the Fabric Software window, choose Images.

Step 2

From the Actions drop-down list, select Upload.

Step 3

In the Upload Image dialog box, either upload the file or import from SCP.

Note that uploading an image to SCP or SFTP server from a non-Unix based device is not supported.

Step 4

Click Verify.

Creating the Image Policies

This section describes how to create the image policies.

Procedure

Step 1

In the Fabric Software window, choose Image Policies.

Step 2

From the Actions drop-down list, select Create.

Step 3

In the following Create Image Management Policy dialog box, enter the following information:

Depending on the switch type, not all fields in the Create Fabric Software Policy dialog box are available to all the devices.

Step 4

Click Save.

Creating and Attaching a Group to the Switches

This section describes how to create and attach a group to switches. Grouping allows you to track upgrades for a set of switches. You can create several groups and select a switch regardless of the group, role, or type of switch.

We recommend that you create upgrade groups based on the switch roles. For example, if a fabric has multiple switches with different roles, such as Leaf, Spine, Border, and more, creating groups based on different roles is recommended. This clearly separates roles and responsibilities during switch image management operations. Switches with different roles perform critical functionality and respond differently based on the control plane, data plane, and system-level convergence. For example, a user with the admin role can create multiple groups as follows:

  • Group-Leaf-Even for Leaf switches that have even numbers or VPC role of primary

  • Group-Leaf-Odd for Leaf switches that have odd numbers or VPC role of secondary

Typically, Spine and Border devices are limited to fabric, while the role of the Leaf is the most common one. Therefore, users with the admin role can upgrade individual Spines followed by Individual Borders, or create different groups for Spines and Borders. Users with the admin role can still leverage groups to divide the Leaf role switches and perform bulk actions.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the devices you want to group.

Step 3

From the Actions drop-down list, select Modify Groups.

Step 4

In the Modify Groups dialog box, click the Attach Group radio button and choose Create Group or a group that was already created from the Group drop-down list.

To create a group, enter a group name in the Modify Groups dialog box.

Step 5

Click Save.

Attaching a Policy to the Switches

This section describes how to attach a policy to the switches.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, select the devices you want to attach a policy.

Step 3

From the Actions drop-down list, select Modify Policy.

Step 4

In the Modify Policy dialog box, click the Attach Policy radio button and choose the required policy from the Policy drop-down list.

Step 5

(Optional) Check or uncheck the Stage & Validate check box, as required.

This option deploys the image on to the switch and validates for compatibility with the existing software version on the switch. The check box is enabled by default. You can uncheck this field while attaching the policy and do a manual stage and validate, if required. For more information, see Copying the Image to the Switches and Validating the Switches (Optional).

Step 6

Click Attach.

The table in the Devices tab displays the status of the stage and validate operations.

Step 7

(Optional) Click the link in the View Details column to view the install log for details about these operations. You can use the log to learn about errors, if any.

The History tab also provides logs for all the configuration changes and details about the errors.

On successful completion, the Image Staged and Validated columns will display a green icon for the respective devices.
What to do next
Review the install log to see if the validation was successful and proceed with the upgrade operation.

Copying the Image to the Switches

The section describes how to copy the image to the switches.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the device you want.

Step 3

From the Actions drop-down list, select Stage Image.

Step 4

In the Stage Image window, ensure there is enough space. The Primary Supervisor (Available Space in Bytes) displays in red if there is not enough space.

To make more space:

  • In the Stage Image window, click on the device name.

  • In the Switch Overview window, ensure you are on the Hardware > Bootflash tab, you will need to delete files to create space so you can stage the image.

  • Place a checkmark on the file names that you want to delete.

  • Click Actions and Delete Files.

  • In the Warning Are you sure you want to delete? dialog box, click Confirm to delete the files.

  • Go back to the Stage Image window and ensure the Required Free Space column displays 0.

Step 5

Click Stage.

Validating the Switches (Optional)

Before you begin

This section describes how to validate the switches to find out which switches can be upgraded by doing a compatibility check. This checks if the image is complete, if the image is valid for the individual hardware, and if the upgrade can be non-disruptive. The log files provide detailed information for each switch.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the device you want to validate.

Step 3

From the Actions drop-down list, select Validate.

Step 4

In the Validate dialog box, place a checkmark in the checkbox if you want a non-disruptive upgrade.

Step 5

Click Validate.

Step 6

In the Fabric Software window, under the View Details column, click Validate to check on the log file for that switch.

Step 7

In the Fabric Software window, under the Validated column, you can see the validation progress until it completes.

  • If the validation completed successfully, it shows green.

  • If the validation fails, it shows red. Check the log file under the View Details column. You will need to fix the errors before proceeding.

Creating and Running the Pre-ISSU Report on the Switches (Optional)

This section describes how to create and run the pre-ISSU report on the switches (optional).

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the devices you want to run a report.

Step 3

From the Actions drop-down list, select Run Reports.

Step 4

In the Create Report dialog box, choose Pre ISSU radio button.

  1. Click Select a Template.

  2. In the Select Report Template dialog box, choose the custom_swift_issu template and click Select.

  3. In the Report Name field, enter a name for the report.

    Ensure that you provide the same name for the pre and the post-ISSU reports which allows the system to associate the two reports.

  4. Use the default values that are available in the fields and click Generate.

    Note

     

    You cannot run the pre-ISSU report more than once.
    The system generates the report when ready. Ensure the status displays successful.

  5. You can click on the link under the Results column to view the HTML version of the report.

Generating Pre-Upgrade Snapshots of the Switch Configuration (Optional)

This topic describes how to generate snapshots of the configuration of a switch. It is a best practice to generate snapshots of the switch configuration before entering and exiting the maintenance mode for performing an upgrade. You can use this to compare the configuration of the switch before it was moved into maintenance mode and after bringing back to normal mode.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the required device.

Step 3

From the Actions drop-down list, choose Generate Snapshot.

Step 4

In the Generate Snapshot dialog box, click Pre-Upgrade-Snapshot.

Step 5

Click Save.

The system generates a pre-upgrade snapshot for the switch.

Step 6

Click the link in the View Details column for the respective switch to view the snapshot generated for the switch. The History tab also provides logs for all the configuration changes and details about the errors.

Changing to Maintenance Mode

This section describes how to change to maintenance mode.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the device you want.

Step 3

From the Actions drop-down list, select Change Mode.

Step 4

In the Change Mode dialog box, choose Maintenance and click Save and Deploy Now.

Upgrading or Downgrading Switches

This section describes how to upgrade or downgrade a switch or a group of switches.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

Do one of the following:

  • Place a checkmark in the checkbox for the device you want to upgrade.
  • To upgrade a group of switches, filter on the Upgrade Groups, select all, and place a checkmark in the checkbox for all the devices you want.

Step 3

From the Actions drop-down list, select Upgrade.

Note

 

You may need to upgrade up to 4 times NOS, EPLD, and/or RPM. EPLD Golden must be upgraded separately.

  1. Click on the Upgrade radio button.

  2. In the Select Upgrades field, place a checkmark on the upgrades you want.

    For Cisco Catalyst switches, you can only upgrade the NOS. EPLD and SMU upgrades are currently not supported.

  3. In the Upgrade Options field, select Disruptive.

  4. You can either check the BIOS Force checkbox or not. It does require a reload.

  5. You can view the Validation Status and filter if needed.

  6. Click Upgrade.

Changing to Normal Mode

This section describes how to change to normal mode.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the device you want.

Step 3

From the Actions drop-down list, select Change Mode.

Step 4

In the Change Mode dialog box, choose Normal and click Save and Deploy Now.

Repeat the following procedure for the next group:

Note

 

Ensure the switches are online before continuing to the next group.

  1. Changing to Maintenance Mode

  2. Upgrading or Downgrading Switches

  3. Changing to Normal Mode

Running the Post-ISSU Report on the Switches (Optional)

This section describes how to run the post-ISSU report on switches only if the mode was changed to normal mode.


Note

For release 12.1.2, you must wait until the switch is fully operational before running the Post-ISSU.
Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the devices you want to run the post-ISSU.

Step 3

From the Actions drop-down list, select Run Reports.

Step 4

In the Create Report dialog box, choose Post ISSU radio button.

  1. Click Select a Template.

  2. In the Select Report Template dialog box, choose the custom_swift_issu template and click Select.

  3. From the Report Name drop-down list, select the name of the pre-ISSU report that you have generated and click Generate.

  4. Use the default values that are available in the fields and click Generate.

    The system generates the report when ready. Ensure the status displays successful.

  5. You can click on the link under the Results column to view the HTML version of the report.

    The post-ISSU report displays a summary of the results of the checks performed before and after the upgrade, consecutively. Analyze the report for any errors and take corrective actions, as required.

Step 5

Perform the following to view the reports:

  1. In the Nexus Dashboard Fabric Controller window, choose Operations > Programmable Reports, and then go to the Reports tab.

  2. In the Reports window, click on the link displayed under the Title column of the report that you want to view.

  3. In the Report dialog box, click the expand icon to open the HTML version of the report.

    The window displays a summary and the details about the errors, warnings, info and success messages. It also displays a snapshot of the configuration before and after the upgrade.

Generating Post-Upgrade Snapshot of the Switch Configuration (Optional)

This topic describes how to generate snapshots of the configuration of a switch. It is a best practice to generate snapshots of the switch configuration before entering and exiting the maintenance mode for performing an upgrade. You can use this to compare the configuration of the switch before it was moved into maintenance mode and after bringing back to normal mode.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the required device.

Step 3

From the Actions drop-down list, choose Generate Snapshot.

Step 4

In the Generate Snapshot dialog box, click Post-Upgrade-Snapshot.

Step 5

Click Save.

The system generates a post upgrade snapshot for the switch.

Step 6

Click the link in the View Details column for the respective switch to view the snapshots and the pre and post snapshot comparison summary generated for the switch. The History tab also provides logs for all the configuration changes and details about the errors.

Upgrading a Group of Switches (Non-disruptive)

This section describes a non-disruptive method for upgrading a group of switches.

Downloading an Image from the Software Download Website

This section describes how to download an image from the software download website.

Procedure

Step 1

Go to the Software Download website.

Software Download Website

Step 2

Login with your credentials. You must login to download the software.

Step 3

Navigate to Switches, choose a series and a switch.

Step 4

Choose a software type:

  • For Nexus switches:

    • NX-OS EPLD Updates

    • NX-OS Firmware

    • NX-OS Patch Release

    • NX-OS Software Maintenance Upgrades (SMU)

    • NX-OS System Software

  • For Cisco Catalyst switches: IOS XE Software

    For Cisco Catalyst switches, NDFC provides support for software upgrade using CAT9K and CAT9K_LITE image types.

Step 5

Choose the software file you want to download and click the download icon.

Uploading the Image to Nexus Dashboard Fabric Controller

This section describes how to upload the image.


Note

If you are about to upload a compacted NX-OS image to the NDFC image repository and another NX-OS image with the same name is currently in the repository, you might overwrite the existing (older) NX-OS image with the newer NX-OS image that you are about to upload. You can avoid overwriting the existing image using the following method:

  1. Upgrade the switches that can use normal NX-OS image first.

  2. Delete the normal NX-OS image from the NDFC repository using the Image Upload screen.

  3. Upload the compact image and upgrade the other set of switches.
Procedure

Step 1

In the Fabric Software window, choose Image.

Step 2

From the Actions drop-down list, select Upload.

Step 3

In the Upload Image dialog box, either upload the file or import from SCP.

Note that uploading an image to SCP or SFTP server from a non-Unix based device is not supported.

Step 4

Click Verify.

Creating the Image Policies

This section describes how to create the image policies.

Procedure

Step 1

In the Fabric Software window, choose Image Policies.

Step 2

From the Actions drop-down list, select Create.

Step 3

In the Create Image Management Policy dialog box, enter the following information:

Depending on the switch type, not all fields in the Create Image Management Policy dialog box are available to all the devices.

Step 4

Click Save.

Creating and Attaching a Group to the Switches

This section describes how to create and attach a group to switches. Grouping allows you to track upgrades for a set of switches. You can create several groups and select a switch regardless of the group, role, or type of switch.

We recommend that you create upgrade groups based on the switch roles. For example, if a fabric has multiple switches with different roles, such as Leaf, Spine, Border, and more, creating groups based on different roles is recommended. This clearly separates roles and responsibilities during switch image management operations. Switches with different roles perform critical functionality and respond differently based on the control plane, data plane, and system-level convergence. For example, a user with the admin role can create multiple groups as follows:

  • Group-Leaf-Even for Leaf switches that have even numbers or VPC role of primary

  • Group-Leaf-Odd for Leaf switches that have odd numbers or VPC role of secondary

Typically, Spine and Border devices are limited to fabric, while the role of the Leaf is the most common one. Therefore, users with the admin role can upgrade individual Spines followed by Individual Borders, or create different groups for Spines and Borders. Users with the admin role can still leverage groups to divide the Leaf role switches and perform bulk actions.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the devices you want to group.

Step 3

From the Actions drop-down list, select Modify Groups.

Step 4

In the Modify Groups dialog box, click the Attach Group radio button and choose Create Group or a group that was already created from the Group drop-down list.

To create a group, enter a group name in the Modify Groups dialog box.

Step 5

Click Save.

Attaching a Policy to the Switches

This section describes how to attach a policy to the switches.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, select the devices you want to attach a policy.

Step 3

From the Actions drop-down list, select Modify Policy.

Step 4

In the Modify Policy dialog box, click the Attach Policy radio button and choose the required policy from the Policy drop-down list.

Step 5

(Optional) Place a check mark in the Stage & Validate checkbox, if needed.

This option deploys the image on to the switch and validates for compatibility with the existing software version on the switch. The check box is enabled by default. You can uncheck this field while attaching the policy and do a manual stage and validate, if required. For more information, see Copying the Image to the Switches and Validating the Switches (Optional).

Step 6

Click Attach.

The table in the Devices tab displays the status of the stage and validate operations.

Step 7

(Optional) Click the link in the View Details column to view the install log for details about these operations. You can use the log to learn about errors, if any.

The History tab also provides logs for all the configuration changes and details about the errors.

On successful completion, the Image Staged and Validated columns will display a green icon for the respective devices.

Step 8

Click Save.

Copying the Image to the Switches

The section describes how to copy the image to the switches.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the device you want.

Step 3

From the Actions drop-down list, select Stage Image.

Step 4

In the Stage Image window, ensure there is enough space. The Primary Supervisor (Available Space in Bytes) displays in red if there is not enough space.

To make more space:

  • In the Stage Image window, click on the device name.

  • In the Switch Overview window, ensure you are on the Hardware > Bootflash tab, you will need to delete files to create space so you can stage the image.

  • Place a checkmark on the file names that you want to delete.

  • Click Actions and Delete Files.

  • In the Warning Are you sure you want to delete? dialog box, click Confirm to delete the files.

  • Go back to the Stage Image window to stage the image.

Step 5

Click Stage.

Validating the Switches (Optional)

This section describes how to validate the switches to find out which switches can be upgraded by doing a compatibility check. This checks if the image is complete, if the image is valid for the individual hardware, and if the upgrade can be non-disruptive. The log files provide detailed information for each switch.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the device you want to validate.

Step 3

From the Actions drop-down list, select Validate.

Step 4

In the Validate dialog box, place a checkmark in the checkbox if you want a non-disruptive upgrade.

Step 5

Click Validate.

Step 6

In the Fabric Software window, under the View Details column, click Validate to check on the log file for that switch.

Step 7

In the Fabric Software window, under the Validated column, you can see the validation progress until it completes.

  • If the validation completed successfully, it shows green.

  • If the validation fails, it shows red. Check the log file under the View Details column. You will need to fix the errors before proceeding.

Creating and Running the Pre-ISSU Report on the Switches (Optional)

This section describes how to create and run the pre-ISSU report on the switches (optional).

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the devices you want to run a report.

Step 3

From the Actions drop-down list, select Run Reports.

Step 4

In the Create Report dialog box, choose Pre ISSU radio button.

  1. Click Select a Template.

  2. In the Select Report Template dialog box, choose a template and click Select.

  3. Answer all the questions and click Generate.

Generating Pre-Upgrade Snapshots of the Switch Configuration (Optional)

This topic describes how to generate snapshots of the configuration of a switch. It is a best practice to generate snapshots of the switch configuration before entering and exiting the maintenance mode for performing an upgrade. You can use this to compare the configuration of the switch before it was moved into maintenance mode and after bringing back to normal mode.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the required device.

Step 3

From the Actions drop-down list, choose Generate Snapshot.

Step 4

In the Generate Snapshot dialog box, click Pre-Upgrade-Snapshot.

Step 5

Click Save.

The system generates a pre-upgrade snapshot for the switch.

Step 6

Click the link in the View Details column for the respective switch to view the snapshot generated for the switch. The History tab also provides logs for all the configuration changes and details about the errors.

Upgrading a Group of Switches

This section describes how to upgrade a group of switches.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, filter on the Upgrade Groups, select all, and place a checkmark in the checkbox for all the devices you want.

Step 3

From the Actions drop-down list, select Upgrade.

Note

 

You may need to upgrade up to 2 times (NXOS, RPM).

  1. Click on the Upgrade radio button.

  2. In the Select Upgrades field, place a checkmark on the upgrades you want.

  3. In the Upgrade Options field, select Force Non-Disruptive.

  4. Do not check the Bios forced checkbox.

  5. You can view the Validation Status and filter if needed.

  6. Click Upgrade.

Step 4

After all the switches within the group are fully upgraded. Repeat this procedure for the next group.

Running the Post-ISSU Report on the Switches (Optional)

This section describes how to run the post-ISSU report on switches (Optional).

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the devices you want to run the post-ISSU.

Step 3

From the Actions drop-down list, select Run Reports.

Step 4

In the Create Report dialog box, choose Post ISSU radio button.

  1. Click Select a Template.

  2. In the Select Report Template dialog box, choose a template and click Select.

  3. Answer all the questions and click Generate.

Generating Post-Upgrade Snapshot of the Switch Configuration (Optional)

This topic describes how to generate snapshots of the configuration of a switch. It is a best practice to generate snapshots of the switch configuration before entering and exiting the maintenance mode for performing an upgrade. You can use this to compare the configuration of the switch before it was moved into maintenance mode and after bringing back to normal mode.

Procedure

Step 1

In the Fabric Software window, choose Devices.

Step 2

In the Devices window, place a checkmark in the checkbox for the required device.

Step 3

From the Actions drop-down list, choose Generate Snapshot.

Step 4

In the Generate Snapshot dialog box, click Post-Upgrade-Snapshot.

Step 5

Click Save.

The system generates a post upgrade snapshot for the switch.

Step 6

Click the link in the View Details column for the respective switch to view the snapshots and the pre and post snapshot comparison summary generated for the switch. The History tab also provides logs for all the configuration changes and details about the errors.

Uninstalling Packages From a Switch

This section describes how to uninstall packages from a switch. You first need to take note of the patch names, detach the packages, and then uninstall them.

Procedure

Step 1

In the Nexus Dashboard Fabric Controller window, choose LAN > Switches.

Step 2

In the Switches window, place a checkmark in the checkbox for the device you want to uninstall packages from.

Step 3

From the Actions drop-down list, select More > Show Commands.

Step 4

In the Switch Show Commands window, enter the following:

  1. In the Commands field, choose show.

  2. Under the Variables section, in the show field, enter install patches.

    In the right pane it lists the package names. Take note of the package names you want to uninstall by copying the file name. For example:

  3. Exit the window.

Step 5

In the Nexus Dashboard Fabric Controller window, choose Operations > Fabric Software.

Step 6

In the Fabric Software window, choose Image Policies.

Step 7

From the Actions drop-down list, select Create.

Step 8

In the Created Image Management Policy dialog box, enter the following:

  1. In the Policy Name field, enter a policy name. For example, uninstall_patch.

  2. From the Platform drop-down list, choose the correct platform.

  3. Do not check the View All Packages checkbox.

  4. In the Package Name field, leave it blank.

  5. In the Policy description field, leave it blank.

  6. Do not check the ELPD checkbox.

  7. In the Select ELPD field, leave it blank.

  8. Place a checkmark in the RPM/SMU Disable in the checkbox.

  9. In the RPMs/SMUs To Be Uninstalled field, enter the packages.

    Note

     

    Provide a comma to separate the values.

  10. Click Save.

Step 9

In the Fabric Software window, choose Device.

Step 10

In the Devices window, place a checkmark in the checkbox for the devices you want to modify the policy.

Step 11

From the Actions drop-down list, select Modify Policy.

Step 12

In the Modify Policy dialog box, enter the following:

  1. Click on the Attach Policy radio button.

  2. In the Policy field, enter the policy name and click Attach. For example:

Step 13

The switch is going to recalculate. Click on the status for the switch under the Status column. For example:

Step 14

In the Image Version Status dialog box, it shows the packages that will be removed.

Step 15

To remove the packages, in the Devices window, make sure the checkmark is placed in the checkbox for the devices you want to remove the packages from.

Step 16

From the Actions drop-down list, select Upgrade.

Step 17

In the Upgrade/Uninstall window, enter the following:

  1. Click on the Uninstall radio button and click Uninstall.

  2. In the Devices window, you can check the uninstall progress of the device if you click on the Upgrade under the View Details column.

  3. Once the packages has been removed, the status will show In-Sync in green and Upgrade will show a green button.

  4. In the Devices window, you can also verify if the packages were uninstalled successfully by viewing the log file. Click on Upgrade for that device under the View Details column.

Upgrade or Downgrade Switches in a Fabric

Beginning with NDFC release 12.2.1, you can now perform switch upgrades or downgrades at the fabric level.


Note

This feature applies only for LAN fabrics.

Preparing a Fabric Image Policy

This section describes how to prepare a software image policy that can be used at the fabric level.

Procedure

Step 1

In the Fabric Software window, verify that the Overview tab is selected.

See Understanding Fabric Software for more information on the Overview tab and the other tabs in the Fabric Software window.

Step 2

In the list of fabrics shown in the Overview page, locate the fabric where you want to prepare a software image policy that will be used for that fabric.

Step 3

In the Status column, click Prepare in the row for the fabric where you want to prepare a software image policy.

The Prepare - <fabric> window appears.

Step 4

In the Prepare - <fabric> window, make the appropriate configurations for this fabric-level image policy.

  1. Review the types of devices listed in the Platforms area.

    The list will consist of device types that are detected in this fabric. Use this list to verify that the software policy that you select in the next step aligns with the type of devices that you have in this fabric.

    For example, if you see CAT9K,N9K listed in the Platforms area, when you select the policy in the next step, you would want to verify that any policy that you select aligns with either Catalyst 9000 or Nexus 9000 series switches.

  2. Click the radio button to either Attach Policy or Detach Policy.

    • If you select Detach Policy, click Detach to detach the fabric-level image policy from these switches in this fabric.

    • If you select Attach Policy, proceed with these instructions to attach an existing image policy or to create a new one.

  3. In the Policy field, attach an existing image policy or create a new one.

    • If you already have fabric-level image policies created and you want to use one of those existing image policies, scroll through the list of image policies and select the one that you want to use. Go to 4.d.

    • If you do not have any fabric-level image policies created yet, or if you do not want to use one of the existing image policies for any reason, click +Create Policy.

      The Create New Image Management Policy window appears.

      1. In the Create New Image Management Policy window, enter a unique name for the fabric-level image policy in the Policy Name field or leave the automatically-generated policy name as-is, if desired.

      2. Enter a description for the new fabric-level image policy in the Policy Description field, if necessary.

      3. In the Rules area, click +Add Row.

      4. Enter the necessary information in the Rules area to configure this new fabric-level image policy.

        • Platform: Select the types of switches in the fabric that will use this new fabric-level image policy.

        • Role: Select the roles for the switches in the fabric that will use this new fabric-level image policy.

        • Use one of the following options to be used with this new fabric-level image policy:

          • Image: Select the software image that will be used with this new fabric-level image policy.

          • Install Packages: Select the installation packages that will be used with this new fabric-level image policy.

          • EPLD: Select the electronic programmable logic device (EPLD) image that will be used with this new fabric-level image policy.

        • Uninstall Packages: Check the box to uninstall packages from the switches in the fabric as part of this new fabric-level image policy.

      5. Click the checkbox in the row to complete the configuration for this image policy rule.

      6. Repeat these steps to configure a new set of rules for this fabric-wide image policy, if necessary.

        For example, you might configure a new set of rules with a different option in the Platform field selected to configure a new set of rules for other types of switches in the fabric, or with a different option in the Role area selected to configure a new set of rules for switches with a different role in the fabric.

      7. Click Save when you have configured all the necessary rules in the fabric-level image policy.

        You are returned to the Prepare - <fabric> window, with this new fabric-level image policy automatically selected in the Policy field.

  4. Determine when you want to stage the fabric-level image policy.

    • Leave the Stage Now option unselected to stage the fabric-level image policy at a later date.

      Staging the fabric-level image policy later allows you to stage the images in the fabric to be used later (for example, by copying the images onto the switch bootflash) so that you can upgrade a subset of the devices later that match the policy.

    • Click the Stage Now option to enable this option.

      The fabric-level image policy will stage after you click Attach in the next step.

  5. Click Attach.

The image policy is now attached to this fabric, and is displayed in the Policy column in the Overview page.

Step 5

Make additional configurations for each fabric, if necessary, based on the status shown in the Status column:

  • None: No fabric-level image policy has been configured for this fabric.

  • In-Sync: The current image versions on each switch in the fabric is in-sync with the expected image versions. No further configurations are needed for the fabric-level image policy for this fabric.

  • Out-of-Sync: The current image versions on one or more switches in the fabric is out-of-sync with the expected image versions. Click the Out-of-Sync text in the Status column to bring up a slide-in pane that shows which switches in the fabric are out-of-sync with the expected image versions. See Recalculating Compliance for more information.

  • Prepare: Click to prepare a software image policy that can be used at the fabric level, as described in this topic.

  • Update plan: The system is ready to apply software updates to the appropriate switches in the fabric. Click Update plan to bring up the Software Update Plan for the fabric. See Installing or Upgrading Software on Devices in a Fabric for more information.

Once you have prepared a software image policy that will be used for a fabric, you cannot then delete or edit that policy directly. However, you can delete uploaded images, even if the ref count is greater than 0.

If uploaded images are used in a software image policy but you have not attached that software image policy to any devices yet, then you can delete those software image policies along with the selected images. However, if you created multiple software image policies using one image and you attached one of those policies to devices in a fabric, then you cannot delete the image and you cannot delete any of the other software image policies that use that image, even if those software image policies aren't attached to any devices in the fabric yet.

Changing Number of Concurrent Switches for Staging/Validating/Updating

As you go through the procedures in Installing or Upgrading Software on Devices in a Fabric, there are points during the staging/validating or updating processes where you might be taking actions on a group of switches concurrently. Following are the default values for the number of switches that are grouped together when you are taking an action on a group of switches concurrently:

  • Staging/validating: Default number of switches is 10

  • Updating: Default number of switches is 20

Follow these procedures if you want to change these default values.

Procedure

Step 1

Navigate to:

Admin > System Settings > Admin

Step 2

Modify the values in the following fields, if necessary:

  • Image update thread pool size: The number of switches that can be updated concurrently. Default value is 20. Valid range is 10-200.

  • Image stage/validate thread pool size: The number of switches that can be staged and validated concurrently. Default value is 10. Valid range is 5-200.

Step 3

Click Save when you have completed any configuration changes on this page.

Installing or Upgrading Software on Devices in a Fabric

This section describes how to install or upgrade software on the devices in a fabric using a fabric-level image policy.

Procedure

Step 1

In the Fabric Software window, verify that the Overview tab is selected.

Step 2

In the list of fabrics shown in the Overview page, locate the fabric where you want to install or upgrade software on the devices in that fabric.

Step 3

In the row for a fabric, select Update plan in the Status column to install or update the software on the devices in that fabric.

The Software Update Plan window appears.

Step 4

Determine if you want to automatically assign groups.

To automatically assign groups, click Actions > Auto-Assign Groups.

You can automatically assign groups based on the following criteria:

  • Role Based: All switches of a given role for a fabric in the same group

  • Even Odd: Switches that are grouped in odd or even groups:

    • Switches that have even numbers or vPC role of primary

    • Switches that have odd numbers or vPC role of secondary

    NDFC uses the following calculations to balance the number of switches in the even and odd groups as much as possible:

    1. NDFC will first divide the switches by role between the even and odd groups; this is done to reduce the likelihood of having most or all of one type of switch in only one of the two groups.

    2. NDFC will then alternate switch assignments between the even and odd groups, where the first switch of one type goes into the even group, the second switch of that same type goes into the odd group, and so on.

Step 5

Review the information provided in the Software Summary area.

  • Fabric: The name of the fabric where you will be installing or upgrading software on the devices in that fabric.

  • Update Plan Status: The status of the update plan.

  • Update Groups: The number of groups that will be part of this software update in this fabric.

  • Devices to be Updated: The number of devices in this fabric that will be updated.

  • Policy: Click the link to open a side panel showing the fabric level policy details.

Step 6

Review the general information provided in the switch group area.

  • The first area shows whether the update has yet to start and any warnings about the update. Click Warnings to bring in a side panel with more information on the warnings.

  • Switches: Shows the number of switches in this switch group.

  • Update Status: Shows the status of the update.

  • Install Start Time: Shows the time when the update installation started.

  • Install End Time: Shows the time when the update installation ended.

Step 7

Review the more detailed information provided in the switch group area.

Click the down arrow next to the switch group name to display more detailed information on that switch group.

Field

Description

Switch

The switch that belongs to this switch group. Click the switch name to bring up additional information on that switch.

IP Address

The IP address for a switch in the switch group.

Model

The model of the switch in the switch group.

Role

The role of the switch in the switch group

Current Software

The current level of software running on this switch in the switch group.

Update Type

The update type for this switch in the switch group.

Update Status

The update status of this switch in the switch group.

Logs

The install logs for this switch in the switch group. Click View Logs for additional information on the install log.

Mode

The mode for the switch in the switch group.

vPC Role

The vPC role of the switch in the switch group, if applicable.

vPC Peer

The vPC peer of the switch in the switch group, if applicable.

Policy

The update policy associated with this switch in the switch group. Click the update policy for additional information.

Last Upgrade Action

The last upgrade action for this switch in the switch group.

Step 8

Determine if you want to make changes to the switches in the update group.

For each of the actions listed below, you can click the box next to single switch in the update group or click the box next to Switch to select all the switches in the update group. The following options are then displayed above the update group:

  • Remove from Update Group: Click to remove the selected switch(es) from the update group.

  • Create New Update Group: Click to create a new update group with the selected switch(es).

  • Move to Update Group: Click to move the selected switch(es) to a different update group.

Step 9

To upgrade the switches in an update group, perform the following steps in that group's area in the Software Update Plan window:

Note

 

The default number of number of switches that can be staged and validated concurrently is 10, and the number of switches that can be updated concurrently is 20. To change those default values, see Changing Number of Concurrent Switches for Staging/Validating/Updating.

  1. First click Stage/Distribute to stage and validate the update.

    Click View Logs to view the actions that take place on the NX-OS switches as they relate to NDFC.

  2. Then click Install Update to perform the software update on the switches in this update group.

    Install Update allows you to trigger a software upgrade for all the switches in that update group.

    A confirmation dialog appears that provides an estimated timeframe for the installation process based on the number of switches in the update group. Note that the estimated timeframe might change based on a number of variables:

    • The number of switches that are in an update group. By default, updates are performed concurrently on 20 switches at a time, so if you have 40 switches in an update group, updates are first performed on the first batch of 20 switches, and then a second pass is performed on the second batch of 20 switches.

    • Advanced options that are described in the next step, which may change the estimated timeframe, depending on the advanced option.

  3. (Optional) In the Install Update confirmation dialog, click the Show Advanced Options arrow to make the advanced selections for the installation, if necessary.

    • In the Execution Paradigm field, select a Serial or Parallel execution:

      • Serial: Switches are updated one at a time, serially, where the update process must fully complete on one switch before it begins on the next switch in the update group.

      • Parallel: Switches are updated all at one time, depending on the number of switches that can be updated concurrently. For example, if you have 40 switches in the update group but 20 switches are updated at a time concurrently, then a Parallel setting will result in the first set of 20 switches going through the update process, all at one time, and then the second set of 20 switches going through the same concurrent update process after the update process has completed for the first set.

    • In the On Failure field, determine if you want the installation to Continue or to Pause if there is a failure that occurs during the update. A failure might occur for a number of reasons, such as a switch failing to come back online or a failure to successfully establish an ssh session between NDFC and the switch.

      The actions taken with this setting may also be affected by settings in other areas.

      For example, assume that you have Pause as the setting for this field, and you have Serial as the setting in the Execution Paradigm field. If a set of 20 switches in an update group are going through a serial update and an issue arises with the sixth switch in the set, the update will pause at that sixth switch's update process and will not proceed with the update process for the remaining 14 switches in the set until you manually begin the update process again.

      However, if you have Parallel as the setting in the Execution Paradigm field and there is an issue with the sixth switch in a set in the update group, the update process will complete for the other 14 switches in the set that are being updated concurrently, and the update process will pause before moving to the update processs for the next set of switches in the update group.

    • In the Snapshot field, choose either the Snapshot or No Snapshot option.

      Note that the snapshot option is essentially a reporting mechanism to compare the state of the system before and after an upgrade; the snapshot option in this case is not used to create a checkpoint (snapshot) of the system. See Snapshots for more information about this option.

    • Check the box next to Maintenance Mode if you want to enable this option.

      Maintenance mode, along with normal mode, are part of Graceful Insertion and Removal, or GIR. When the Maintenance Mode option is enabled, NDFC will place the switches in the update group in the maintenance mode during the update process, where all configured Layer 3 control-plane protocols are isolated from the network, and will return the switches to normal mode after the update process is completed. Refer to the Configuring Graceful Insertion and Removal for more information on GIR.

    • Make the proper selection in the Force Disruptive field, if necessary.

      When you click Stage/Distribute earlier in these procedures, NDFC will determine if the switches in the update group are set with disruptive or non-disruptive upgrade settings.

      • If all of the switches are shown as non-disruptive in the initial staging point of the process, then the default value for this field will be for the box next to the Force Disruptive field as unchecked (not enabled).

      • However, if any of the switches are shown as disruptive in the initial staging point of the process, then the default value for this field will be for the box next to the Force Disruptive field as checked (enabled) for all of the switches in this update group.

      Refer to the Understanding In-Service Software Upgrades for more information about this option.

Recalculating Compliance

This section describes how to recalculate compliance on devices in a fabric where software was installed or upgraded using a fabric-level image policy.

The Recalculate Compliance option checks if the versions on the switch and the policy are same. You might want to recalculate compliance when the information on the Overview page does not correctly reflect the expected status for the devices in a fabric or to change the Status from Out-of-Sync to In-Sync. If you made a change directly on the switch CLI, you might also use the Recalculate Compliance option so that the system fetches those updates from the switch and compares them with those in the fabric policy rules.

Procedure

Step 1

In the Fabric Software window, verify that the Overview tab is selected.

Step 2

In the list of fabrics shown in the Overview page, locate the fabric where you want to recalculate compliance on the devices in that fabric.

Step 3

In the row for that fabric, click the ellipsis at the end of that row (…), then select Recalculate Compliance.

The status provided in the Status column might get updated to In-Sync or Out-of-Sync, based on a comparison between the switch CLI and the fabric policy. Click on the status entry to show additional in-sync or out-of-sync details.