Table Of Contents
Upgrading or Downgrading Your ACE Software
Overview of Upgrading ACE Software
Prerequisites for Upgrading Your ACE
Changing the Admin Password
Changing the www User Password
Checking Your Configuration for FT Priority and Preempt
Creating a Checkpoint
Updating Your Application Protocol Inspection Configurations
Performing Software Upgrades and Downgrades
Task Flow for Upgrading the ACE Software
Task Flow for Downgrading the ACE Software
Copying the Software Upgrade Image to the ACE
Configuring the ACE to Autoboot the Software Image
Setting the Boot Variable
Configuring the Configuration Register to Autoboot the Boot Variable
Reloading the ACE
Displaying Software Image Information
Displaying the Boot Variable and Configuration Register
Displaying the Software Version
Upgrading or Downgrading Your ACE Software
This appendix provides information to upgrade your Cisco Application Control Engine (ACE) module. It contains the following major sections:
•
Overview of Upgrading ACE Software
•
Prerequisites for Upgrading Your ACE
•
Performing Software Upgrades and Downgrades
•
Displaying Software Image Information
Overview of Upgrading ACE Software
Your ACE comes preloaded with the operating system software. To take advantage of new features and bug fixes, you can upgrade your ACE with a new version of software when it becomes available.
In the Admin context, you will use the copy command in Exec mode to manually install the software on each ACE. After the software installation is finished, set the boot variable and configuration register to autoboot the software image. Then, reload the appliances to load the new image.
To minimize any disruption to existing network traffic during a software upgrade or downgrade, deploy your ACE appliances in a redundant configuration. For details about redundancy, see Chapter 6, Configuring Redundant ACEs.
Note
Software version A3(1.0) introduces hardware-assisted SSL (HTTPS) probes, for that reason, the ACE uses the all option for the default SSL version and uses the routing table (which may bypass the real server IP address) to direct HTTPS probes to their destination regardless of whether you specify the routed option or not in the ip address command. If you are using HTTPS probes in your A1(x) configuration with the default SSL version (SSLv3) or without the routed option, you may observe that your HTTPS probes behave differently with version A3(1.0). For more information about HTTPS probes, see the Cisco 4700 Series Application Control Engine Appliance Server Load-Balancing Configuration Guide.
Prerequisites for Upgrading Your ACE
Before you upgrade your ACE software, please read this appendix in its entirety so that you fully understand the entire upgrade process. Please be sure that your ACE configurations meet the upgrade prerequisites in the following sections:
•
Changing the Admin Password
•
Changing the www User Password
•
Checking Your Configuration for FT Priority and Preempt
•
Creating a Checkpoint
•
Updating Your Application Protocol Inspection Configurations
Changing the Admin Password
Before you upgrade to software version A2(1.1) or higher, you must change the default Admin password if you have not already done so. Otherwise, after you upgrade the ACE software, you will be able to log in to the ACE only through the console port. For details about changing the Admin password, see Chapter 1, Setting Up the ACE.
Changing the www User Password
Before you upgrade your software version, you must change the default www user password if you have not already done so. Otherwise, after you upgrade the ACE software, the www user will be disabled and you will not be able to use Extensible Markup Language (XML) to remotely configure an ACE until you change the default www user password. For details about changing the www user password, see Chapter 2, Configuring Virtualization in the Cisco 4700 Series Application Control Engine Appliance Virtualization Configuration Guide. In this case, the username would be www.
Checking Your Configuration for FT Priority and Preempt
If you want the currently active ACE to remain active after the software upgrade, be sure that the active ACE has a higher priority than the standby (peer) ACE and that the preempt command is configured. To check the redundant configuration of your ACEs, use the show running-config ft command. Note that the preempt command is enabled by default and does not appear in the running-config.
Creating a Checkpoint
We strongly recommend that you create a checkpoint in the running-configuration file of each context in your ACE. A checkpoint creates a snapshot of your configuration that you can later roll back to in case a problem occurs with an upgrade and you want to downgrade the software to a previous release. Use the checkpoint create command in Exec mode in each context for which you want to create a configuration checkpoint and name the checkpoint. For details about creating a checkpoint and rolling back a configuration, see Chapter 4, Managing the ACE Software. For information about downgrading your ACE, see the Downgrading Your ACE Software section in the Release Note for the Cisco 4700 Series Application Control Engine Appliance.
Updating Your Application Protocol Inspection Configurations
Because the ACE version A3(1.x) software has stricter error checks for application protocol inspection configurations than A1(x) software versions, be sure that your inspection configurations meet the guidelines that follow. The error checking process in A3(1.x) software denies misconfigurations in inspection classifications (class maps) and displays error messages. If such misconfigurations exist in your startup- or running-configuration file before you load the A3(1.x) software, the standby ACE in a redundant configuration may boot up to the STANDBY_COLD state. For information about redundancy states, see Chapter 6, Configuring Redundant ACEs.
If the class map for the inspection traffic is generic (match . . . any or class-default is configured) so that noninspection traffic is also matched, the ACE displays an error message and does not accept the inspection configuration. For example:
host1/Admin(config)# class-map match-all TCP_ANY
host1/Admin(config-cmap)# match port tcp any
host1/Admin(config)# policy-map multi-match FTP_POLICY
host1/Admin(config-pmap)# class TCP_ANY
host1/Admin(config-pmap-c)# inspect ftp
Error: This class doesn't have tcp protocol and a specific port
The following examples show some of the generic class-map match statements and an ACL that are not allowed in A3(1.x) inspection configurations:
•
match port tcp any
•
match port udp any
•
match port tcp range 0 65535
•
match port udp range 0 65535
•
match virtual-address 192.168.12.15 255.255.255.0 any
•
match virtual-address 192.168.12.15 255.255.255.0 tcp any
•
access-list acl1 line 10 extended permit ip any any
For application protocol inspection, the class map must have a specific protocol (related to the inspection type) configured and a specific port or range of port numbers.
For HTTP, FTP, RTSP, Skinny, and ILS protocol inspection, the class map must have TCP as the configured protocol and a specific port or range of ports. For example, enter the following commands:
host1/Admin(config)# class-map match-all L4_CLASS
host1/Admin(config-cmap)# match port tcp eq www
For SIP protocol inspection, the class map must have TCP or UDP as the configured protocol and a specific port or range of ports. For example, enter the following commands:
host1/Admin(config)# class-map match-all L4_CLASS
host1/Admin(config-cmap)# match port tcp eq 124
or
host1/Admin(config-cmap)# match port udp eq 135
For DNS inspection, the class map must have UDP as the configured protocol and a specific port or range of ports. For example, enter the following commands:
host1/Admin(config)# class-map match-all L4_CLASS
host1/Admin(config-cmap)# match port udp eq domain
For ICMP protocol inspection, the class map must have ICMP as the configured protocol. For example, enter the following commands:
host1/Admin(config)# access-list ACL1 extended permit icmp 192.168.12.15 255.255.255.0
192.168.16.25 255.255.255.0 echo
host1/Admin(config)# class-map match-all L4_CLASS
host1/Admin(config-cmap)# match access-list ACL1
Performing Software Upgrades and Downgrades
This section describes how to perform software upgrades and downgrades. It contains the following topics:
•
Task Flow for Upgrading the ACE Software
•
Task Flow for Downgrading the ACE Software
•
Copying the Software Upgrade Image to the ACE
•
Configuring the ACE to Autoboot the Software Image
•
Reloading the ACE
•
Displaying Software Image Information
Task Flow for Upgrading the ACE Software
This section provides a quick overview of the steps required to upgrade the software on each ACE. For clarity, the original active ACE is referred to as ACE-1 and the original standby ACE is referred to as ACE-2 in the following quick start.
Follow these steps to upgrade the ACE software:
Step 1
Log in to each ACE. The Exec mode prompt appears at the CLI. If you are operating in multiple contexts, observe the CLI prompt to verify that you are operating in the Admin context. If necessary, log directly in to, or change to the Admin context by entering the changeto command.
Cisco Application Control Software (ACSW)
TAC support: http://www.cisco.com/tac
Copyright (c) 2002-2009, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.
User 'www' is disabled.Please change the password to enable the user.
Step 2
Save the running configurations of every context by entering the write memory all command in Exec mode in the Admin context of each ACE.
ACE-1/Admin# write memory all
Step 3
Create a checkpoint in each context of both ACEs by entering the checkpoint create command in Exec mode.
ACE-1/Admin# checkpoint create ADMIN_CHECKPOINT
ACE-1/C1# checkpoint create C1_CHECKPOINT
Step 4
Return to the Admin context:
Step 5
Enter either the copy ftp, copy sftp, or the copy tftp command in Exec mode to copy the new software image to the image: directory of each ACE. For example, to copy the image with the name c4710ace-mz.A3_1_0.bin using FTP, enter:
ACE-1/Admin# copy ftp://server1/images/c4710ace-mz.A3_1_0.bin image:
Enter source filename[/images/c4710ace-mz.A3_1_0.bin]?
Enter the destination filename[]? [c4710ace-mz.A3_1_0.bin] File already exists, do you
want to overwrite?[y/n]: [y]
Enter hostname for the ftp server[server1]?
Enter the file transfer mode[bin/ascii]: [bin]
Enable Passive mode[Yes/No]: [Yes] no
Step 6
Ensure that the new software image is present on both the active and standby ACEs by entering the dir command in Exec mode. For example, enter:
ACE-1/Admin# dir image:c4710ace-mz.A3_1_0.bin
176876624 Aug 08 2008 14:15:31 c4710ace-mz.A3_1_0.bin
176876624 Jun 9 14:15:31 2008 c4710ace-mz.A1_8_0A.bin
Usage for image: filesystem
896978944 bytes total used
11849728 bytes free 908828672 bytes total
Step 7
Check the MD5 checksum of the new software image on both ACEs to ensure that the new image is the same as the image posted on Cisco.com. For example, enter:
ACE-1/Admin# show file image:c6ace-t1k9-mz.A2_3_0.bin md5sum
Step 8
Configure ACE-1 to automatically boot from the new image. To set the boot variable and configuration register to 0x1 (perform auto boot and use startup-config file), use the boot system image: and config-register commands in configuration mode. For example, enter:
ACE-1/Admin(config)# boot system image:c4710ace-mz.A3_1_0.bin
ACE-1/Admin(config)# config-register 0x1
ACE-1/Admin(config)# exit
You can set up to two images through the boot system command. If the first image fails, the ACE tries to boot from the second image.
Note
Use the no boot system image: command to remove the previously configured boot variable.
Step 9
Verify that the boot variable was synchronized with ACE-2 by entering the following command on ACE-2:
ACE-2/Admin# show bootvar
BOOT variable = "disk0:/c4710ace-mz.A3_1_0.bin;
disk0:/disk0:c4710ace-mz.A1_8_0A.bin"
Configuration register is 0x1
Step 10
Enter the show ft group detail command in Exec mode to verify the state of each appliance. Upgrade the ACE that has its Admin context in the STANDBY_HOT state (ACE-2) first by entering the reload command in Exec mode. After ACE-2 boots up, it may take a few minutes to reach the STANDBY_HOT state again. Configuration synchronization is still enabled and the connections through ACE-1 are still being replicated to ACE-2.
During the upgrading and downgrading of the ACE software, the ACE uses the STANDBY_WARM and WARM_COMPATIBLE redundancy states to handle any CLI incompatibility issue between peers. For information about redundancy states, see Chapter 6, Configuring Redundant ACEs.
Note
Do not add any more commands to the ACE-1 configuration. At this point in the upgrade procedure, any incremental commands that you add to the ACE-1 configuration may not be properly synchronized to the ACE-2 configuration.
Note
If you upgrade from A1(7a) or A1(7b) to A3(1.0), you will see that the ACE enters the STANDBY_HOT state. However, if you upgrade from A1(8.0) or A1(8.0a) to A3(1.0), you will see that the ACE enters the STANDBY_WARM state.
This command will reboot the system
Save configurations for all the contexts. Save? [yes/no]: [yes]
Step 11
Disable preemption on ACE-1.
ACE-1/Admin(config)# ft group 1
ACE-1/Admin(config-ft-group)# no preempt
Press Ctrl-z to return to Exec mode.
Step 12
Perform a graceful failover of all contexts from ACE-1 to ACE-2 by entering the ft switchover all command in Exec mode on ACE-1. ACE-2 becomes the new active ACE and assumes mastership of all active connections with no interruption to existing connections.
ACE-1/Admin# ft switchover all
Step 13
Upgrade ACE-1 by reloading it and verify that ACE-1 enters the STANDBY_HOT state (may take several minutes) by entering the show ft group detail command in Exec mode.
Because the standby ACE has changed its state to either STANDBY_COLD or STANDBY_HOT, the configuration mode is enabled. The configuration is synchronized from ACE -2 (currently active) to ACE-1.
This command will reboot the system
Save configurations for all the contexts. Save? [yes/no]: [yes]
Step 14
Reenable preempt for the FT group on the active ACE (ACE-2). If ACE-1 is configured with a higher priority and preempt is configured on the FT group, ACE-1 reasserts mastership after it has received all configuration and state information from ACE-2, making ACE-2 the new standby. ACE-1 becomes the active ACE once again.
Step 15
Enter the show ft group detail command to verify that ACE-1 is in the ACTIVE state and ACE-2 is in the STANDBY_HOT state.
Task Flow for Downgrading the ACE Software
This section provides a quick overview of the steps required to downgrade the software on each ACE. For clarity, the original active ACE is referred to as ACE-1 and the original standby ACE is referred to as ACE-2 in the following quick start.
Follow these steps to downgrade the ACE software:
Step 1
Before you downgrade your ACE software, ensure that the following conditions exist:
•
Identical versions of the desired downgrade software images reside in the image: directory of both ACEs.
•
The active ACE has a higher priority than the standby ACE and preempt is enabled on the FT group if you want the active ACE to remain active after the downgrade procedure.
Step 2
If your ACE includes a license that was not supported by the previous software version, ensure that you remove this and reinstall the previous license.
See Chapter 3, Managing ACE Software Licenses, in the Cisco 4700 Series Application Control Engine Appliance Administration Guide.
Step 3
Log in to the ACE. The Exec mode prompt appears at the CLI. If you are operating in multiple contexts, observe the CLI prompt to verify that you are operating in the Admin context. If necessary, log directly in to, or change to the Admin context.
Cisco Application Control Software (ACSW)
TAC support: http://www.cisco.com/tac
Copyright (c) 2002-2009, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.
User 'www' is disabled.Please change the password to enable the user.
Step 4
Save the running configurations of every context by entering the write memory all command in Exec mode in the Admin context of each ACE.
ACE-1/Admin# write memory all
Step 5
If you had created checkpoints in your previous running-configuration files (highly recommended), roll back the configuration in each context on each ACE to the check-pointed configuration.
For example:
ACE-1/Admin# checkpoint create ADMIN_CHECKPOINT
ACE-1/C1# checkpoint create C1_CHECKPOINT
For information about creating checkpoints and rolling back configurations, see the Cisco 4700 Series Application Control Engine Appliance Administration Guide.
Step 6
If necessary, enter the copy ftp, copy sftp, or the copy tftp command in Exec mode to copy the downgrade software image to the image: directory of each ACE. For example, to copy the image with the name c4710ace-mz.A1_8_0A.bin using FTP, enter:
ACE-1/Admin# copy ftp://server1/images/c4710ace-mz.A1_8_0A.bin image:
Step 7
Configure ACE-1 to autoboot from the previous image. To set the boot variable and configuration register to 0x1 (perform auto boot and use startup-config file), use the boot system image: and config-register commands in configuration mode. For example, enter:
ACE-1/Admin(config)# boot system image:c4710ace-mz.A1_8_0A.bin
ACE-1/Admin(config)# config-register 0x1
ACE-1/Admin(config)# exit
You can set up to two images through the boot system command. If the first image fails, the ACE tries the second image.
Note
Use the no boot system image: command to unset the previously configured boot variable.
Step 8
Verify the boot variable was synchronized to ACE-2 by entering the following command on ACE-2:
ACE-2/Admin# show bootvar
BOOT variable = "disk0:/c4710ace-mz.A1_8_0A.bin;
disk0:/c4710ace-mz.A3_1_0.bin"
Configuration register is 0x1
Step 9
Enter the show ft group detail command in Exec mode to verify the state of each appliance. Downgrade the ACE that has its Admin context in the STANDBY_HOT state (ACE-2) first by entering the reload command.
This command will reboot the system
Save configurations for all the contexts. Save? [yes/no]: [yes]
When ACE-2 loads the startup-configuration file, you may observe a few errors if you did not roll back the configuration to a checkpoint. These errors are harmless and occur because the ACE software does not recognize the A3(1.0) commands in the startup-configuration file.
After ACE-2 boots up, note the following:
•
For software version A1(8.0) or A1(8.0a), after ACE-2 boots up, it may take a few minutes to reach the STANDBY_WARM state again.
•
For software version A1(7a) or A1(7b), after ACE-2 boots up, it may take a few minutes to reach the STANDBY_HOT state again.
Configuration synchronization is still enabled and the connections through ACE-1 are still being replicated to ACE-2.
Step 10
Perform a graceful failover of all contexts from ACE-1 to ACE-2 by entering the ft switchover all command in Exec mode on ACE-1. ACE-2 becomes the new active ACE and assumes mastership of all active connections with no interruption to existing connections.
ACE-1/Admin# ft switchover all
Step 11
Reload ACE-1 with the same downgrade software version as ACE-2. Again, you may observe a few errors as ACE-1 loads the startup-configuration file.
This command will reboot the system
Save configurations for all the contexts. Save? [yes/no]: [yes]
After ACE-1 boots up, it assumes the role of standby and enters the STANDBY_HOT state (this may take several minutes).
Step 12
Verify the states of both ACEs by entering the show ft group detail command in Exec mode. Because both ACE-1 and ACE-2 are running the same version of software now, configuration mode is enabled. The configuration is synchronized from ACE 2 (currently active) to ACE-1. If ACE-1 is configured with a higher priority and preempt is configured on the FT group, ACE-1 reasserts mastership after it has received all configuration and state information from ACE-2, making ACE-2 the new standby. ACE-1 becomes the active ACE once again.
Step 13
Perform manual cleanup in the running-configuration files of both ACEs to remove unnecessary version configuration elements.
Step 14
Enter the write memory all command in both ACEs to save the running-configuration files in all configured contexts to their respective startup-configuration files. This action will eliminate future errors when the ACEs reload their startup-configuration files.
Copying the Software Upgrade Image to the ACE
This section describes how to copy a software image to the ACE from a variety of sources, including:
•
FTP server
•
SFTP server
•
TFTP server
During the copy process, you can rename the image copied to the ACE.
Details
Command
|
Purpose
|
copy {ftp://server/path[/filename] |
sftp://[username@]server/path[/filename] |
tftp://server[:port]/path[/filename]} image:[name]
host1/Admin# copy
ftp://server1/images/c4710ace-mz.A3_1_0.bin image:
|
Copies a software image from the specified source to the ACE.
The keywords, arguments, and options are as follows:
• ftp://server/path[/filename]—Specifies the URL of the software image located on an FTP server. This path is optional because the ACE prompts you for this information if you omit it.
• sftp://[username@]server/path[/filename]—Specifies the URL of a software image on a secure FTP server. This path is optional because the ACE prompts you for this information if you omit it.
• tftp://server[:port]/path[/filename]—Specifies the URL of a software image on a trivial FTP server. This path is optional because the ACE prompts you for this information if you omit it.
• image:[name]—Specifies the name for the software image copied to the ACE. If you do not enter the name argument, the ACE uses the default name of the image.
|
What to Do Next
To set the boot variable and configure the ACE to autoboot this image, see the "Configuring the ACE to Autoboot the Software Image" section.
Configuring the ACE to Autoboot the Software Image
This section describes how to configure the ACE to autoboot an image that you copy to it by setting the boot variable and the configuration register. The boot variable specifies the image from which the ACE boots at startup. The configuration variable can be set to autoboot the image defined by the boot variable.
This section contains the following topics:
•
Setting the Boot Variable
•
Configuring the Configuration Register to Autoboot the Boot Variable
•
Displaying the Boot Variable and Configuration Register
For detailed information on the boot variable and configuration register, see Chapter 1, Setting Up the ACE.
Setting the Boot Variable
This section describes how to set the boot variable. You can set up to two images so that if the first image fails, the ACE tries the second image.
Restrictions
You must perform this task from the Admin context in configuration mode only.
Details
| |
Command
|
Purpose
|
Step 1
|
config
Example:
host1/Admin# config
host1/Admin#(config)#
|
Enters global configuration mode.
|
Step 2
|
boot system image:image_name
host1/Admin(config)# boot system
image:c4710ace-mz.A3_1_0.bin
|
Sets the boot variable.
The image_name argument is the name of the installed image.
|
| |
no boot system image:image_name
host1/Admin(config)# no boot system
image:c4710ace-mz.A3_1_0.bin
|
(Optional) Unsets the previously configured boot variable.
|
Configuring the Configuration Register to Autoboot the Boot Variable
This section describes how to configure the ACE to autoboot the system image identified in the boot environment variable.
Restrictions
You must perform this task from the Admin context in configuration mode only.
Details
| |
Command
|
Purpose
|
Step 1
|
config
Example:
host1/Admin# config
host1/Admin#(config)#
|
Enters global configuration mode.
|
Step 2
|
host1/Admin# config-register 0x1
|
Configures the ACE to autoboot the system image identified in the boot environment variable.
Note A config-register setting of 0x0 instructs the ACE to boot to the rommon prompt upon a reboot. The ACE remains in ROMMON mode at startup.
|
Reloading the ACE
This section describes how to allow the ACE to use the installed software upgrade by reloading the ACE appliance.
Restrictions
You must perform this task from the Admin context in Exec mode only.
Details
Command
|
Purpose
|
This command will reboot the system
Save configurations for all the contexts. Save?
[yes/no]: [yes]
|
Reloads the ACE.
|
Displaying Software Image Information
This section describes how to display software image information and contains the following topics:
•
Displaying the Boot Variable and Configuration Register
•
Displaying the Software Version
Displaying the Boot Variable and Configuration Register
To display the boot variable and configuration register, perform the following task from the Admin context in the Exec mode:
Command
|
Purpose
|
show bootvar
|
Verifies the boot variable and configuration register.
|
Examples
The following examples shows how to display the boot variable and configuration register:
host1/Admin# show bootvar
BOOT variable = "disk0:c4710ace-mz.A3_1_0.bin"
Configuration register is 0x1
The 0x1 indicates that the configuration register is set to 1.
Displaying the Software Version
To display the software image on the ACE, perform the following task:
Command
|
Purpose
|
show version
|
Displays the software image on the ACE.
|
Examples
The following example includes the command output:
host1/Admin# show version
Cisco Application Control Software (ACSW)
TAC support: http://www.cisco.com/tac
Copyright (c) 1985-2008 by Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.
system: Version A3(1.0) [build 3.0(0)A3(0.0.148) adbuild_03:31:25-2008/08/0
6_/auto/adbure_nightly2/nightly_rel_a3_1_0_throttle/REL_3_0_0_A3_0_0
system image file: (nd)/192.168.65.31/scimitar.bin
Device Manager version 1.1 (0) 20080805:0415
installed license: ACE-AP-VIRT-020 ACE-AP-C-1000-LIC
total: 6226392 kB, free: 4315836 kB
shared: 0 kB, buffers: 17164 kB, cached 0 kB
total: 935560 kB, used: 611564 kB, available: 276472 kB
last boot reason: Unknown
configuration register: 0x1
kernel uptime is 0 days 21 hours 25 minute(s) 17 second(s)