Administration Guide vA2(3.0), Cisco ACE Application Control Engine Module
Upgrading Your ACE Software
Downloads: This chapterpdf (PDF - 237.0KB) The complete bookPDF (PDF - 6.82MB) | Feedback

Upgrading or Downgrading Your ACE Software

Table Of Contents

Upgrading or Downgrading Your ACE Software

Overview of Upgrading ACE Software

Prerequisites for Upgrading Your ACE

Changing the Admin Password

Changing the www User Password

Checking Your Configuration for FT Priority and Preempt

Creating a Checkpoint

Updating Your Application Protocol Inspection Configurations

Performing Software Upgrades and Downgrades

Task Flow for Upgrading the ACE Software

Task Flow for Downgrading the ACE Software

Copying the Software Upgrade Image to the ACE

Configuring the ACE to Autoboot the Software Image

Setting the Boot Variable

Configuring the Configuration Register to Autoboot the Boot Variable

Reloading the ACE

Recovering the ACE from the ROMMON Utility

Booting the ACE from ROMMON with the Correct Image Name

Booting the ACE from an Image Copied to the Supervisor Engine

Displaying Software Image Information

Displaying the Boot Variable and Configuration Register

Displaying the Software Version


Upgrading or Downgrading Your ACE Software


This appendix provides information to upgrade your Cisco Application Control Engine (ACE) module. It contains the following major sections:

Overview of Upgrading ACE Software

Prerequisites for Upgrading Your ACE

Performing Software Upgrades and Downgrades

Displaying Software Image Information

Overview of Upgrading ACE Software

Your ACE comes preloaded with the operating system software. To take advantage of new features and bug fixes, you can upgrade your ACE with a new version of software when it becomes available.

In the Admin context, you will use the copy command in Exec mode to manually install the software on each ACE. After the software installation is finished, set the boot variable and configuration register to autoboot the software image. Then, reload the modules to load the new image.

To minimize any disruption to existing network traffic during a software upgrade or downgrade, deploy your ACE modules in a redundant configuration. For details about redundancy, see Chapter 6, Configuring Redundant ACEs.


Note Software version A2(1.0) introduces hardware-assisted SSL (HTTPS) probes, for that reason, the ACE uses the all option for the default SSL version and uses the routing table (which may bypass the real server IP address) to direct HTTPS probes to their destination regardless of whether you specify the routed option or not in the ip address command. If you are using HTTPS probes in your A1(6.x) configuration with the default SSL version (SSLv3) or without the routed option, you may observe that your HTTPS probes behave differently with version A2(1.0). For more information about HTTPS probes, see the Cisco Application Control Engine Module Server Load-Balancing Configuration Guide.


Prerequisites for Upgrading Your ACE

Before you upgrade your ACE software, please read this appendix in its entirety so that you fully understand the entire upgrade process. Please be sure that your ACE configurations meet the upgrade prerequisites in the following sections:

Changing the Admin Password

Changing the www User Password

Checking Your Configuration for FT Priority and Preempt

Creating a Checkpoint

Updating Your Application Protocol Inspection Configurations

Changing the Admin Password

Before you upgrade to software version A2(1.1) or higher, you must change the default Admin password if you have not already done so. Otherwise, after you upgrade the ACE software, you will be able to log in to the ACE only through the console port or through the supervisor engine of the Catalyst 6500 series switch or the Cisco 7600 series router. For details about changing the Admin password, see Chapter 1, Setting Up the ACE.

Changing the www User Password

Before you upgrade to software version A2(1.1) or higher, you must change the default www user password if you have not already done so. Otherwise, after you upgrade the ACE software, the www user will be disabled and you will not be able to use Extensible Markup Language (XML) to remotely configure an ACE until you change the default www user password. For details about changing the www user password, see Chapter 2, Configuring Virtualization in the Cisco Application Control Engine Module Virtualization Configuration Guide. In this case, the username would be www.

Checking Your Configuration for FT Priority and Preempt

If you want the currently active ACE to remain active after the software upgrade, be sure that the active ACE has a higher priority than the standby (peer) ACE and that the preempt command is configured. To check the redundant configuration of your ACEs, use the show running-config ft command. Note that the preempt command is enabled by default and does not appear in the running-config.

Creating a Checkpoint

We strongly recommend that you create a checkpoint in the running-configuration file of each context in your ACE. A checkpoint creates a snapshot of your configuration that you can later roll back to in case a problem occurs with an upgrade and you want to downgrade the software to a previous release. Use the checkpoint create command in Exec mode in each context for which you want to create a configuration checkpoint and name the checkpoint. For details about creating a checkpoint and rolling back a configuration, see Chapter 4, Managing the ACE Software. For information about downgrading your ACE, see the Downgrading Your ACE Software section in the Release Note for the Cisco Application Control Engine Module.

Updating Your Application Protocol Inspection Configurations

Because the ACE version A2(1.x) software has stricter error checks for application protocol inspection configurations than A1(x) software versions, be sure that your inspection configurations meet the guidelines that follow. The error checking process in A2(1.x) software denies misconfigurations in inspection classifications (class maps) and displays error messages. If such misconfigurations exist in your startup- or running-configuration file before you load the A2(1.x) software, the standby ACE in a redundant configuration may boot up to the STANDBY_COLD state. For information about redundancy states, see Chapter 6, Configuring Redundant ACEs.

If the class map for the inspection traffic is generic (match . . . any or class-default is configured) so that noninspection traffic is also matched, the ACE displays an error message and does not accept the inspection configuration. For example:

host1/Admin(config)# class-map match-all TCP_ANY
host1/Admin(config-cmap)# match port tcp any
 
host1/Admin(config)# policy-map multi-match FTP_POLICY
host1/Admin(config-pmap)# class TCP_ANY 
host1/Admin(config-pmap-c)# inspect ftp
Error: This class doesn't have tcp protocol and a specific port

The following examples show some of the generic class-map match statements and an ACL that are not allowed in A2(1.x) inspection configurations:

match port tcp any

match port udp any

match port tcp range 0 65535

match port udp range 0 65535

match virtual-address 192.168.12.15 255.255.255.0 any

match virtual-address 192.168.12.15 255.255.255.0 tcp any

access-list acl1 line 10 extended permit ip any any

For application protocol inspection, the class map must have a specific protocol (related to the inspection type) configured and a specific port or range of port numbers.

For HTTP, FTP, RTSP, Skinny, and ILS protocol inspection, the class map must have TCP as the configured protocol and a specific port or range of ports. For example, enter the following commands:

host1/Admin(config)# class-map match-all L4_CLASS
host1/Admin(config-cmap)# match port tcp eq www

For SIP protocol inspection, the class map must have TCP or UDP as the configured protocol and a specific port or range of ports. For example, enter the following commands:

host1/Admin(config)# class-map match-all L4_CLASS
host1/Admin(config-cmap)# match port tcp eq 124

or

host1/Admin(config-cmap)# match port udp eq 135

For DNS inspection, the class map must have UDP as the configured protocol and a specific port or range of ports. For example, enter the following commands:

host1/Admin(config)# class-map match-all L4_CLASS
host1/Admin(config-cmap)# match port udp eq domain

For ICMP protocol inspection, the class map must have ICMP as the configured protocol. For example, enter the following commands:

host1/Admin(config)# access-list ACL1 extended permit icmp 192.168.12.15 255.255.255.0 
192.168.16.25 255.255.255.0 echo

host1/Admin(config)# class-map match-all L4_CLASS
host1/Admin(config-cmap)# match access-list ACL1

Performing Software Upgrades and Downgrades

This section describes how to perform software upgrades and downgrades. It contains the following topics:

Task Flow for Upgrading the ACE Software

Task Flow for Downgrading the ACE Software

Copying the Software Upgrade Image to the ACE

Configuring the ACE to Autoboot the Software Image

Reloading the ACE

Recovering the ACE from the ROMMON Utility

Task Flow for Upgrading the ACE Software

This section provides a quick overview of the steps required to upgrade the software on each ACE. For clarity, the original active ACE is referred to as ACE-1 and the original standby ACE is referred to as ACE-2 in the following quick start.

Follow these steps to upgrade the ACE software:


Step 1 Log in to each ACE. The Exec mode prompt appears at the CLI. If you are operating in multiple contexts, observe the CLI prompt to verify that you are operating in the Admin context. If necessary, log directly in to, or change to the Admin context by entering the changeto command.

switch login: admin
Password: xxxxxxxx
Cisco Application Control Software (ACSW)
TAC support: http://www.cisco.com/tac
Copyright (c) 2002-2009, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.
User 'www' is disabled.Please change the password to enable the user.
ACE-1/Admin# 

Step 2 Save the running configurations of every context by entering the write memory all command in Exec mode in the Admin context of each ACE.

ACE-1/Admin# write memory all

Step 3 Create a checkpoint in each context of both ACEs by entering the checkpoint create command in Exec mode.

ACE-1/Admin# checkpoint create ADMIN_CHECKPOINT
ACE-1/Admin# changeto C1
ACE-1/C1# checkpoint create C1_CHECKPOINT

Step 4 Return to the Admin context:

ACE-1/C1# changeto Admin
ACE-1/Admin#

Step 5 Enter either the copy ftp, copy sftp, or the copy tftp command in Exec mode to copy the new software image to the image: directory of each ACE. For example, to copy the image with the name c6ace-t1k9_A2_3_0.bin using FTP, enter:

ACE-1/Admin# copy ftp://server1/images/c6ace-t1k9-mz.A2_3_0.bin image:
Enter source filename[/images/c6ace-t1k9-mz.A2_3_0.bin]? 
Enter the destination filename[]? [c6ace-t1k9-mz.A2_3_0.bin] File already exists, do you 
want to overwrite?[y/n]: [y] 
Enter hostname for the ftp server[server1]?
Enter username[]? user1
Enter the file transfer mode[bin/ascii]: [bin] 
Enable Passive mode[Yes/No]: [Yes] no
Password:

Step 6 Ensure that the new software image is present on both the active and standby ACEs by entering the dir command in Exec mode. For example, enter:

ACE-1/Admin# dir image:c6ace-t1k9-mz.A2_3_0.bin 
    176876624 Aug 08 2009 14:15:31 c6ace-t1k9_A2_3_0.bin
    176876624 Jun 9 14:15:31 2008 c4710ace-mz.A2_1_0.bin

           Usage for image: filesystem
                  896978944 bytes total used
                   11849728 bytes free 908828672 bytes total
 
   

Step 7 Check the MD5 checksum of the new software image on both ACEs to ensure that the new image is the same as the image posted on Cisco.com. For example, enter:

ACE-1/Admin# show file image:c6ace-t1k9-mz.A2_3_0.bin md5sum

Step 8 Configure ACE-1 to automatically boot from the new image. To set the boot variable and configuration register to 1 (perform auto boot and use startup-config file), use the boot system image: and config-register commands in configuration mode. For example, enter:

ACE-1/Admin# config
ACE-1/Admin(config)# boot system image:c6ace-t1k9-mz.A2_3_0.bin
ACE-1/Admin(config)# config-register 1
ACE-1/Admin(config)# exit
ACE-1/Admin# 

You can set up to two images through the boot system command. If the first image fails, the ACE tries to boot from the second image.


Note Use the no boot system image: command to remove the previously configured boot variable.


Step 9 Verify that the boot variable was synchronized with ACE-2 by entering the following command on ACE-2:

ACE-2/Admin# show bootvar
BOOT variable = "disk0:c6ace-t1k9-mz.A2_3_0.bin"
Configuration register is 1
ACE-2/Admin#

Step 10 Enter the show ft group detail command in Exec mode to verify the state of each module. Upgrade the ACE that has its Admin context in the STANDBY_HOT state (ACE-2) first by entering the reload command in Exec mode. After ACE-2 boots up, it may take a few minutes to reach the STANDBY_HOT state again. Configuration synchronization is still enabled and the connections through ACE-1 are still being replicated to ACE-2.

During the upgrading and downgrading of the ACE software, the ACE uses the STANDBY_WARM and WARM_COMPATIBLE redundancy states to handle any CLI incompatibility issue between peers. For information about redundancy states, see Chapter 6, Configuring Redundant ACEs.


Note Do not add any more commands to the ACE-1 configuration. At this point in the upgrade procedure, any incremental commands that you add to the ACE-1 configuration may not be properly synchronized to the ACE-2 configuration.



Note If you upgrade from software version A2(1.3) or earlier to A2(3.0), you will see that the ACE enters the STANDBY_HOT state. However, if you upgrade from A2(1.4) or later to A2(3.0), you will se that the ACE enters the STANDBY_WARM state.


ACE-2/Admin# reload
This command will reboot the system
Save configurations for all the contexts. Save? [yes/no]: [yes]

Step 11 Disable preemption on ACE-1.

ACE-1/Admin# config
ACE-1/Admin(config)# ft group 1
ACE-1/Admin(config-ft-group)# no preempt
Press Ctrl-z to return to Exec mode.

Step 12 Perform a graceful failover of all contexts from ACE-1 to ACE-2 by entering the ft switchover all command in Exec mode on ACE-1. ACE-2 becomes the new active ACE and assumes mastership of all active connections with no interruption to existing connections.

ACE-1/Admin# ft switchover all

Step 13 Upgrade ACE-1 by reloading it and verify that ACE-1 enters the STANDBY_HOT state (may take several minutes) by entering the show ft group detail command in Exec mode. Because both ACE-1 and ACE-2 are running the same version of software now, configuration mode is enabled. The configuration is synchronized from ACE 2 (currently active) to ACE-1.

ACE-1/Admin# reload
This command will reboot the system
Save configurations for all the contexts. Save? [yes/no]: [yes]

Step 14 Reenable preempt on the FT group on ACE-2. If ACE-1 is configured with a higher priority and preempt is configured on the FT group, ACE-1 reasserts mastership after it has received all configuration and state information from ACE-2, making ACE-2 the new standby. ACE-1 becomes the active ACE once again.

ACE-2/Admin# config
ACE-2/Admin(config)# ft group 1
ACE-2/Admin(config-ft-group)# preempt
Press Ctrl-z to return to Exec mode.

Step 15 Enter the show ft group detail command to verify that ACE-1 is in the ACTIVE state and ACE-2 is in the STANDBY_HOT state.


Task Flow for Downgrading the ACE Software

This section provides a quick overview of the steps required to downgrade the software on each ACE. For clarity, the original active ACE is referred to as ACE-1 and the original standby ACE is referred to as ACE-2 in the following quick start.

Follow these steps to downgrade the ACE software:


Step 1 Before you downgrade your ACE software, ensure that the following conditions exist:

Identical versions of the desired downgrade software images reside in the image: directory of both ACEs.

The active ACE has a higher priority than the standby ACE and preempt is enabled on the FT group if you want the active ACE to remain active after the downgrade procedure.

Step 2 If your ACE includes a license that was not supported by the previous software version, ensure that you remove this and reinstall the previous license.

See Chapter 3, Managing ACE Software Licenses, in the Cisco Application Control Engine Module Administration Guide.

Step 3 Log in to the ACE. The Exec mode prompt appears at the CLI. If you are operating in multiple contexts, observe the CLI prompt to verify that you are operating in the Admin context. If necessary, log directly in to, or change to the Admin context.

switch login: admin
Password: xxxxxxxx
Cisco Application Control Software (ACSW)
TAC support: http://www.cisco.com/tac
Copyright (c) 2002-2009, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.
User 'www' is disabled.Please change the password to enable the user.
ACE-1/Admin# 

Step 4 Save the running configurations of every context by entering the write memory all command in Exec mode in the Admin context of each ACE.

ACE-1/Admin# write memory all

Step 5 If you had created checkpoints in your previous running-configuration files (highly recommended), roll back the configuration in each context on each ACE to the check-pointed configuration.

For example:

ACE-1/Admin# checkpoint create ADMIN_CHECKPOINT
ACE-1/Admin# changeto C1
ACE-1/C1# checkpoint create C1_CHECKPOINT

For information about creating checkpoints and rolling back configurations, see the Cisco Application Control Engine Module Administration Guide.

Step 6 If necessary, enter the copy ftp, copy sftp, or the copy tftp command in Exec mode to copy the downgrade software image to the image: directory of each ACE. For example, to copy the image with the name c6ace-t1k9-mz.A2_3_0.bin using FTP, enter:

ACE-1/Admin# copy ftp://server1/images/c6ace-t1k9-mz.A2_3_0.bin image:

Step 7 Configure ACE-1 to autoboot from the previous image. To set the boot variable and configuration register to 1 (perform auto boot and use startup-config file), use the boot system image: and config-register commands in configuration mode. For example, enter:

ACE-1/Admin# config
ACE-1/Admin(config)# boot system image:c6ace-t1k9-mz.A2_3_0.bin 
ACE-1/Admin(config)# config-register 0x1 
ACE-1/Admin(config)# exit
ACE-1/Admin# 

You can set up to two images through the boot system command. If the first image fails, the ACE tries the second image.


Note Use the no boot system image: command to unset the previously configured boot variable.


Step 8 Verify the boot variable was synchronized to ACE-2 by entering the following command on ACE-2:

ACE-2/Admin# show bootvar
    BOOT variable = "disk0:/c6ace-t1k9-mz.A2_1_0.bin; 
    disk0:/c6ace-t1k9-mz.A2_3_0.bin"
Configuration register is 1
 
   

Step 9 Enter the show ft group detail command in Exec mode to verify the state of each module. Downgrade the ACE that has its Admin context in the STANDBY_HOT state (ACE-2) first by entering the reload command.

ACE-2/Admin# reload
This command will reboot the system
Save configurations for all the contexts. Save? [yes/no]: [yes]


Note If you downgrade from software version A2(3.0) to A2(1.3) or earlier, you will see that the ACE enters the STANDBY-HOT state. However, if you downgrade from A2(3.0) to A2(1.4) or later, you will see that the ACE enters the STANDBY_WARM state.


When ACE-2 loads the startup-configuration file, you may observe a few errors if you did not roll back the configuration to a checkpoint. These errors are harmless and occur because the ACE software does not recognize the A2(x) commands in the startup-configuration file.

Configuration synchronization is still enabled and the connections through ACE-1 are still being replicated to ACE-2.

Step 10 Perform a graceful failover of all contexts from ACE-1 to ACE-2 by entering the ft switchover all command in Exec mode on ACE-1. ACE-2 becomes the new active ACE and assumes mastership of all active connections with no interruption to existing connections.

ACE-1/Admin# ft switchover all

Step 11 Reload ACE-1 with the same downgrade software version as ACE-2. Again, you may observe a few errors as ACE-1 loads the startup-configuration file.

ACE-1/Admin# reload
This command will reboot the system
Save configurations for all the contexts. Save? [yes/no]: [yes]

After ACE-1 boots up, it assumes the role of standby and enters the STANDBY_HOT state (this may take several minutes).

Step 12 Verify the states of both ACEs by entering the show ft group detail command in Exec mode. Because both ACE-1 and ACE-2 are running the same version of software now, configuration mode is enabled. The configuration is synchronized from ACE 2 (currently active) to ACE-1. If ACE-1 is configured with a higher priority and preempt is configured on the FT group, ACE-1 reasserts mastership after it has received all configuration and state information from ACE-2, making ACE-2 the new standby. ACE-1 becomes the active ACE once again.

Step 13 Perform manual cleanup in the running-configuration files of both ACEs to remove unnecessary version configuration elements.

Step 14 Enter the write memory all command in both ACEs to save the running-configuration files in all configured contexts to their respective startup-configuration files. This action will eliminate future errors when the ACEs reload their startup-configuration files.


Copying the Software Upgrade Image to the ACE

This section describes how to copy a software image to the ACE from a variety of sources, including:

FTP server

SFTP server

TFTP server

During the copy process, you can rename the image copied to the ACE.

Details

Command
Purpose
copy {ftp://server/path[/filename] | 
sftp://[username@]server/path[/filename] | 
tftp://server[:port]/path[/filename]} image:[name]

Example:
host1/Admin# copy 
ftp://server1/images/c6ace-t1k9-mz.A2_3_0.bin image:

Copies a software image from the specified source to the ACE.

The keywords, arguments, and options are as follows:

ftp://server/path[/filename]—Specifies the URL of the software image located on an FTP server. This path is optional because the ACE prompts you for this information if you omit it.

sftp://[username@]server/path[/filename]—Specifies the URL of a software image on a secure FTP server. This path is optional because the ACE prompts you for this information if you omit it.

tftp://server[:port]/path[/filename]—Specifies the URL of a software image on a trivial FTP server. This path is optional because the ACE prompts you for this information if you omit it.

image:[name]—Specifies the name for the software image copied to the ACE. If you do not enter the name argument, the ACE uses the default name of the image.

What to Do Next

To set the boot variable and configure the ACE to autoboot this image, see the "Configuring the ACE to Autoboot the Software Image" section.

Configuring the ACE to Autoboot the Software Image

This section describes how to configure the ACE to autoboot an image that you copy to it by setting the boot variable and the configuration register. The boot variable specifies the image from which the ACE boots at startup. The configuration variable can be set to autoboot the image defined by the boot variable.

This section contains the following topics:

Setting the Boot Variable

Configuring the Configuration Register to Autoboot the Boot Variable

Displaying the Boot Variable and Configuration Register

For detailed information on the boot variable and configuration register, see Chapter 1, Setting Up the ACE.

Setting the Boot Variable

This section describes how to set the boot variable. You can set up to two images so that if the first image fails, the ACE tries the second image.


Caution If you set a single image through the boot system image: command, be sure to enter the image name correctly. Otherwise, when you attempt to reload the ACE, it uses the incorrect image name, fails the reload, and accesses the ROMMON utility. For information on recovering from this problem, see the "Recovering the ACE from the ROMMON Utility" section.

Restrictions

You must perform this task from the Admin context in configuration mode only.

Details

 
Command
Purpose

Step 1 

config


Example:

host1/Admin# config

host1/Admin#(config)#

Enters global configuration mode.

Step 2 

boot system image:image_name

Example:
host1/Admin(config)# boot system 
image:c6ace-t1k9-mz.A2_3_0.bin 

Sets the boot variable.

The image_name argument is the name of the installed image.

 
no boot system image:image_name

Example:
host1/Admin(config)# no boot system 
image:c6ace-t1k9-mz.A2_3_0.bin 

(Optional) Unsets the previously configured boot variable.

Configuring the Configuration Register to Autoboot the Boot Variable

This section describes how to configure the ACE to autoboot the system image identified in the boot environment variable.

Restrictions

You must perform this task from the Admin context in configuration mode only.

Details

 
Command
Purpose

Step 1 

config


Example:

host1/Admin# config

host1/Admin#(config)#

Enters global configuration mode.

Step 2 

config-register 1

Example:
host1/Admin# config-register 1

Configures the ACE to autoboot the system image identified in the boot environment variable.


Note A config-register setting of 0 instructs the ACE to boot to the rommon prompt upon a reboot. The ACE remains in ROMMON mode at startup.


Reloading the ACE

This section describes how to allow the ACE to use the installed software upgrade by reloading the ACE module.

Restrictions

You must perform this task from the Admin context in Exec mode only.

Details

Command
Purpose
reload

Example:
host1/Admin# reload
This command will reboot the system
Save configurations for all the contexts. Save? 
[yes/no]: [yes]


Reloads the ACE.


Note If you reload the ACE and rommon mode prompt appears, a problem with the upgrade or the ACE has occurred. See the "Recovering the ACE from the ROMMON Utility" section for more information.


Recovering the ACE from the ROMMON Utility

This section describes how to recover the ACE from the ROMMON utility. If you reload the ACE and the rommon mode prompt appears, one of the following problems may have occurred:

You entered the installed image name incorrectly. This problem assumes that you correctly installed the image on the ACE.

The downloaded ACE image is corrupted.

The ACE compact Flash had a hardware failure.

If you incorrectly entered the image name, boot the ACE from the rommon prompt and then after the ACE reboots, correct the image name in the boot variable. For more information, see the "Booting the ACE from ROMMON with the Correct Image Name" section.

If the downloaded image is corrupted or the compact Flash failed, copy the ACE image on the supervisor engine and boot the ACE from the supervisor engine. For more information, see the "Booting the ACE from an Image Copied to the Supervisor Engine" section.

Booting the ACE from ROMMON with the Correct Image Name

This section describes how to boot the ACE from ROMMON with the correct image name. If you set a single image through the boot system command, you must enter the image name correctly for the ACE to reload successfully. Otherwise, when you attempt to reload the ACE, it uses the incorrect image name, fails the reload, and accesses the ROMMON utility as indicated by the ROMMON mode prompt.

After the attempted reload, a boot message (similar to the following) appears in the CLI indicating that the image could not load:

boot: cannot load "disk0:c6ace-t1k9mz.A2_3_0.bin"

In this example, the image name is incorrect. The c6ace-t1k9mz.A2_3_0.bin image in the message should be c6ace-t1k9-mz.A2_3_0.bin.

Verify whether the image name is correct. If it is, then the problem could be a corrupted image or a compact Flash failure. For more information on how to reload the ACE from these conditions, see the "Booting the ACE from an Image Copied to the Supervisor Engine" section.

Details

Follow these steps to boot the ACE with the correct image name from ROMMON mode and correct the image name in the boot variable:


Step 1 Access the disk0: directory to view the correct image name.

rommon 1> dir disk0:
Directory of disk0:

20903		28583947			-rw- c6ace-t1k9-mz.A2_3_0.bin <correct image
2		74448896			-rw- TN-CONFIG
....
rommon 2> 

Step 2 Set the boot image that is on the ACE.

rommon 2> BOOT=disk0:c6ace-t1k9-mz.A2_3_0.bin

Step 3 Verify the boot image in the configuration variables.

rommon 3> set
PS1=rommom!>
RELOAD_REASON=reload command by admin
?=0
BOOT=c6ace-t1k9-mz.A2_3_0.bin
rommon 4> 

Step 4 Boot the image on the ACE.

rommon 4> boot
Loading disk0:c6ace-t1k9-mz.A2_3_0.bin. Please wait...

The boot process may take several minutes to finish.

Step 5 When the login prompt appears, log in to the ACE.

host1 login: admin
Password:
Cisco Application Control Software (ACSW)
TAC support: http://www.cisco.com/tac
Copyright (c) 2002-2006, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.
host1/Admin#

Step 6 Access configuration mode in the Admin context and unset the previously configured boot variable by using the no boot system image: command.

host1/Admin# config
host1/Admin(config)# no boot system image:c6ace-t1k9mz.A2_3_0.bin 

Step 7 Reset the boot variable with the correct image name by using the boot system image: command.

host1/Admin(config)# boot system image:c6ace-t1k9-mz.A2_3_0.bin 

Step 8 To verify that the boot variable has the correct image name, use the show bootvar command in the Admin context from the Exec mode.

host1/Admin# show bootvar
BOOT variable = "c6ace-t1k9-mz.A2_3_0.bin"
Configuration register is 0x1
host1/Admin#


Booting the ACE from an Image Copied to the Supervisor Engine

This section describes how to boot the ACE from an image copied to the supervisor engine. You may need to do this if you download a corrupted ACE image or the ACE compact Flash has failed.

Details

Follow these steps to boot the ACE from an image copied to the supervisor engine:


Step 1 From the supervisor engine CLI, perform the following steps:

a. Copy the ACE image to disk0: on the supervisor engine by using the copy command. For example, to copy the c6ace-t1k9-mz.A2_3_0.bin image from a TFTP server to disk0:, enter:

Router# copy tftp://192.168.144.14/tftpboot/c6ace-t1k9-mz.A2_1.bin disk0:
Destination filename [c6ace-t1k9-mz.A2_1.bin]?
Accessing tftp://192.168.144.14/tftpboot/c6ace-t1k9-mz.A2_3_0.bin ...
Loading /tftpboot/c6ace-t1k9-mz.A2_1.bin from 192.168.144.14 (via VLAN 
12):!!!!!!!!!!!!!!!!!!!!!!!!...
[OK - 29251568 bytes]

29251568 bytes copied in 81.600 secs (358475 bytes/sec)
Router# 

b. After the image is copied to the supervisor engine, access configuration mode and set the boot variable for the ACE and the image. For example, to access configuration mode and set the boot variable if the ACE is in slot 3, enter:

Router# config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#boot device module 3 disk0:c6ace-t1k9-mz.A2_1.bin
Device BOOT variable = disk0:c6ace-t1k9-mz.A2_1.bin
Warning: Device list is not verified
Router#

Step 2 From the ACE, perform the following steps:

a. Boot the ACE from the image on the supervisor engine by using the boot eobc command.

rommon 1> boot eobc:

b. When the login prompt appears, log in to the ACE.

host1 login: admin
Password:
Cisco Application Control Software (ACSW)
TAC support: http://www.cisco.com/tac
Copyright (c) 2002-2006, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.
host1/Admin#

c. If the image on the ACE is corrupted, copy another image onto the ACE as described in the "Copying the Software Upgrade Image to the ACE" section. Then configure the ACE to autoboot the image as described in the "Configuring the ACE to Autoboot the Software Image" section.

If the compact Flash on the ACE had a hardware failure, contact Cisco TAC for assistance.


Displaying Software Image Information

This section describes how to display software image information and contains the following topics:

Displaying the Boot Variable and Configuration Register

Displaying the Software Version

Displaying the Boot Variable and Configuration Register

To display the boot variable and configuration register, perform the following task from the Admin context in the Exec mode:

Command
Purpose

show bootvar

Verifies the boot variable and configuration register.

Examples

The following examples shows how to display the boot variable and configuration register:

host1/Admin# show bootvar
BOOT variable = "disk0:c6ace-t1k9-mz.A2_1.bin"
Configuration register is 1
host1/Admin#

The 1 indicates that the configuration register is set to 1.

Displaying the Software Version

To display the software image on the ACE, perform the following task:

Command
Purpose

show version

Displays the software image on the ACE.

Examples

switch/Admin# show version
Cisco Application Control Software (ACSW)
TAC support: http://www.cisco.com/tac
Copyright (c) 2002-2009, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.

Software
  loader:    Version 12.2[121]
  system:    Version A2(3.0) [build 3.0(0)A2(2.99.80)]
  system image file: [LCP] disk0:c6ace-t1k9-mzg.A2_2_99_80.bin
  installed license: ACE-SSL-05K-K9

Hardware
  Cisco ACE (slot: 5)
  cpu info:
    number of cpu(s): 2
    cpu type: SiByte
    cpu: 0, model: SiByte SB1 V0.2, speed: 700 MHz
    cpu: 1, model: SiByte SB1 V0.2, speed: 700 MHz
  memory info:
    total: 954268 kB, free: 230688 kB
    shared: 0 kB, buffers: 4144 kB, cached 0 kB
  cf info:
    filesystem: /dev/cf
    total: 1000000 kB, used: 541824 kB, available: 458176 kB

last boot reason:  reload command by admin
configuration register:  0x1
switch kernel uptime is 39 days 20 hours 23 minute(s) 40 second(s)


switch/Admin#