Table Of Contents
Installing the Service Packs
Before You Begin
Uninstalling Patches or Fix Packs
Backing Up the Scheme Jars
Service Pack Installation
Generating the SSH Keys
Generating New SSH Keys on the Gateway and Units
Adding a Unit after SSH Keys Generation
Reverting to an Earlier Service Pack Version
Installing the Service Packs
This chapter provides instructions on how to install Service Packs 1 and 2 on top of an existing Cisco ANA 3.6 installation.
Note 
For a workflow of the steps required to install Cisco ANA 3.6 with Service Packs 1 and 2, see Figure 3-1 on page 3-1.
Service Pack 2 is installed on top of Service Pack 1, which is installed on top of an existing Cisco ANA 3.6 installation. If Cisco ANA 3.6 is already installed on your system, you must install Service Pack 1, and then Service Pack 2. If you have already installed Service Pack 1, you need only install Service Pack 2.
Note If you are migrating from Cisco ANA 3.5.2 to Cisco ANA 3.6, you must complete the Cisco ANA 3.6 installation before installing Service Pack 1. See Chapter 10, "Upgrading Cisco ANA".
The procedures for installing Service Pack 1 and Service Pack 2 are identical. To prevent repetition, the procedure is described once. To install Service Pack 2, you must perform the procedure described here for Service Pack 1, and then repeat the procedure for Service Pack 2. If Service Pack 1 is already installed, you need only perform the procedure once. The installation examples used in this chapter are based on Service Pack 2.
The following topics are described:
•Before You Begin
–Uninstalling Patches or Fix Packs
–Backing Up the Scheme Jars
•Service Pack Installation
–Generating the SSH Keys
•Reverting to an Earlier Service Pack Version
Before You Begin
Please be aware of the following before installing a Service Pack:
•Cisco ANA 3.6 must be up and running in order to install a Service Pack. See Chapter 5, "Installing a Gateway", and Chapter 6, "Installing a Unit".
•If other patches have been installed on top of Cisco ANA 3.6, they must be uninstalled before installing the Service Pack. See Uninstalling Patches or Fix Packs.
•The Service Pack installation process overwrites certain files, including site.xml and a set of Java Network Launch Protocol (JNLP) files. All files that are overwritten are backed up using the naming convention [filename.extension].old.
•It is recommended that you back up the Product and IPCore schemes in case a rollback is required to an earlier Service Pack version. See Backing Up the Scheme Jars.
•When you are installing Service Pack 2, if there are several routers that maintain a few thousand BGP routing entries or more in their routing tables, and the VNEs for these devices are using the product scheme, memory consumption may have increased, and the AVM memory allocations should be checked. In this case, please contact the Cisco Project Manager or Cisco Account Team to perform the necessary calculations.
•Refer to the Enhanced Functionality for VNEs table in the Release Notes for Cisco_Active Network Abstraction, 3.6 Service Pack 2, to review whether new technology modeling was added to the VNE in use in your deployed environment. In the event that new modeling was added, memory consumption may have increased and the AVM memory allocations should be checked. Please contact the Cisco Project Manager or Cisco Account Team to perform the necessary calculations.
•If you are reverting back to an existing installation of Cisco ANA 3.6 from a Service Pack 2 installation, please review the Best Practices for Integration BQL Parsing chapter in the Cisco Active Network Abstraction BQL User Guide, 3.6 Service Pack 2 to ensure that the integration is not affected, and make sure that all system configuration changes made to the registry are maintained.
Uninstalling Patches or Fix Packs
If other patches or fix packs have been installed on top of Cisco ANA 3.6, they must be uninstalled before installing a Cisco ANA 3.6 Service Pack.
To uninstall a patch or fix pack:
Step 1 Remove the patch name from the site.xml by running the following command from the gateway Main directory:
./runRegTool.sh -gs 127.0.0.1 set 0.0.0.0 site/mvm/services/bsm/patchjar <new value>
Note The <new value> is the current registry value of site/mvm/services/bsm/patchjar without the name of the uninstalled patch.
Step 2 Remove the patch name line from all .jnlp files in the directory ~/Main/webstart.
Step 3 If the patch (which may include files such as Perl scripts) does not include xml or class files, all of the old files are copied to the backup directory, as follows:
•The location of the backup directory is the home directory of the <user sheer>/backup. The files directory tree is maintained.
•The file naming convention is: <filename>_<patchname>_<date>.bak.
•When reverting, copy the file under the same directory tree starting from the Main directory, and then change the file names and make them executable.
Step 4 Restart the gateway and all the units.
Backing Up the Scheme Jars
In case a rollback is required after installation of Service Pack 2 (see Reverting to an Earlier Service Pack Version), it is recommended that you back up the Product and IPCore schemes of Service Pack 1.
To backup the Product and IPCore schemes:
Step 1 Log in to the gateway as user "sheer".
Step 2 Copy the product.jar and ipcore.jar files located under ~/Main/scheme into a backup directory.
Service Pack Installation
The following procedure describes how to install a Service Pack on the gateway and units.
Note If Cisco ANA 3.6 is not already installed on the gateway and units, please follow the instructions described in Installing the Gateway Server System, page 5-3 and Installing the Unit System, page 6-3.
To install Service Pack 2 on the gateway and launch the units:
Step 1 Log in to the gateway as user "sheer".
Step 2 Create a temporary directory /tmp/ANAPatch on the gateway.
Step 3 Copy the provided file (ANA_3_6_SP2.jar) file to the temporary directory (if you are installing from the DVD the file ANA_3_6_SP2.jar is located under the Server folder).
Step 4 Enter the command jar -xvf ANA_3_6_SP2.jar
This command extracts the necessary JAR files and a Perl script.
Step 5 Enter the command perl ./update.pl SP2 -all
This command installs the Service Pack, updates the SSH keys (see Generating the SSH Keys), and restarts the system.
Note If the error java.io.FileNotFoundException: Main/scripts/redirectUdp.pl (Permission denied) occurs when you run perl ./update.pl SP2 -all, enter the following commands in the ANAPatch directory (with root user):
jar -xvf patch_other.jar
cp Main/scripts/redirectUdp.pl ~/Main/scripts/redirectUdp.pl
Figure 7-1 shows an example of the output which lists all the processes:
Figure 7-1 Service Pack Installation on Gateway Processes
Step 6 Log in to a unit connected to the gateway as user "sheer".
Step 7 Enter the command cd /export/home/sheer4/Main to return to the main directory.
Step 8 Enter mvm.csh to launch the unit.
Step 9 Repeat Steps 6 to 8 for each unit.
The following section describes how the SSH keys are generated on the gateway and units in the setup during the Service Pack installation.
Generating the SSH Keys
SSH keys are used to secure communication between a gateway and the units in a setup. They are unique to each gateway and the units that are connected to it. The Service Pack installation includes the SSH keys script that generates unique SSH keys on the gateway and propagates these keys to the all the units in the setup, ensuring synchronization between the gateway and the units.
You must generate the SSH keys only after the gateway and all the units in the setup are up and running.
Note•Important: Generating SSH keys must be done only once. If the SSH keys were already generated when you installed Service Pack 1, please do not do it again for Service Pack 2.
•If you want to add an additional unit to the setup at a later stage, follow the procedure described in Adding a Unit after SSH Keys Generation.
Generating New SSH Keys on the Gateway and Units
The following procedure describes how to generate new SSH keys on the gateway and units in your setup.
Note You must do this only if the SSH keys were not already generated during the installation of Service Pack 1.
Step 1 Log in to the gateway as user "sheer".
Step 2 Enter cd /export/home/sheer4/Main/scripts/patch to go to the required directory.
Step 3 Enter perl ./sshKeysUpdate.pl to update the SSH keys.
Note You should run sshKeysUpdate.pl only once on the gateway. If this script is run more than once, the SSH keys will be deleted and the default connection to the newly installed unit will be removed. In this case, you will need to add the unit manually (see Manually Adding a Unit and Updating the SSH Keys).
Step 4 Enter ssh <UNIT IP> to open a Telnet/SSH session from the gateway to the unit.
Step 5 Enter ssh <GATEWAY IP> to open a Telnet/SSH session from the unit to the gateway.
Note•If you receive the message "DSA key fingerprint is <fingerprint>. Are you sure you want to continue connecting (yes/no)?", please answer "yes".
•If you receive the message "Permission denied (publickey,keyboard-interactive)", enter sheer-conf.pl on the unit to install the unit and update its SSH keys, as described in Adding a Unit after SSH Keys Generation.
Step 6 Enter mvm.csh to launch the unit.
Figure 7-2 shows an example of the output listing the processes:
Figure 7-2 Generating SSH Keys on Gateway Processes
Adding a Unit after SSH Keys Generation
The following procedure describes how to use the SSH keys script to add an additional unit (or standby unit) to your existing setup, and update its SSH keys:
Note•Important: You should perform this procedure only if you are adding an additional unit to the setup. It is not recommended to perform this procedure on units that already exist in your setup, as the SSH keys for these units were already updated (see Generating New SSH Keys on the Gateway and Units).
•If you have a problem synchronizing the SSH keys between the gateway and the unit, you can use the manual procedure to add the unit and update the keys (see Manually Adding a Unit and Updating the SSH Keys).
Step 1 Install the ANA Unit software on the new unit, as described in Installing the Unit System, page 6-3.
Step 2 On the gateway, log in as user "sheer".
Step 3 Enter cd /export/home/sheer4/Main/scripts/patch to go to the required directory.
Step 4 Enter perl ./sshNewUnitAddition.pl <NEW_UNIT_IP> to update the SSH keys on the new unit.
Step 5 Enter mvm.csh to launch the unit.
Figure 7-3 shows an example of the output listing the processes:
Figure 7-3 Adding New Unit Processes
Step 6 Add the new unit to the Cisco ANA platform, as described in Adding the Unit to the Cisco ANA Platform, page 6-4.
Step 7 Wait a few minutes to make sure that the unit is up and running.
Manually Adding a Unit and Updating the SSH Keys
If the script to update the SSH keys was run more than once causing the SSH keys to be deleted, the connection to the newly installed unit will be removed. In such a case, you can add the unit and update the SSH keys manually, as described in the following procedure:
Step 1 Install the ANA Unit software on the new unit, as described in Installing the Unit System, page 6-3.
Step 2 On the gateway, log in as user "sheer".
Step 3 Enter the following commands:
/usr/bin/scp authorized_keys <NEW UNIT IP>:~/.ssh
(Provide user "sheer" password and answer "yes" when prompted to accept the host key.)
usr/bin/scp id_dsa id_dsa.pub authorized_keys <NEW UNIT IP>:~/local/sheer_secured/
(Provide user "sheer" password.)
ssh <GATEWAY IP> "echo OK"
(Answer "yes" when prompted to accept the host key.)
Step 4 For each unit, enter the following command:
(Answer "yes" when prompted to accept the host key.)
Step 5 For each unit, enter the following command:
scp ~/.ssh/known_hosts <UNIT IP>:~/.ssh/
Step 6 Add the new unit to the Cisco ANA platform, as described in Adding the Unit to the Cisco ANA Platform, page 6-4.
Step 7 Wait a few minutes to make sure that the unit is up and running.
Reverting to an Earlier Service Pack Version
The following procedure describes how to revert back to Service Pack 1 after Service Pack 2 has been installed:
Step 1 Open an SSH session to the gateway machine and log into the machine as user "sheer", default password "sheer".
Step 2 Change the directory to sheer/Main by running the following command:
Step 3 Rename the patch file name by running the following command:
mv SP2_patch.jar SP2_patch.jar.bak
Step 4 Open the Cisco ANA Registry Editor and connect to the gateway.
Step 5 From the File menu in the Registry Editor window, select Connect To Golden-Source Registry, and select the Template option.
Step 6 In the Navigation pane's hierarchy of registry xml files, select site > mvm > services > bsm.
Step 7 In the Entry tab in the right pane, select the name that identifies the key you selected in the Navigation pane, and remove the SP2_patch.jar entry in the Source field.
Step 8 Return to the Unix shell, and remove the patch name line from all the .jnlp files in the directory ~/Main/webstart.
Step 9 In the directory ~/Main/scheme, replace the Product and IPCore scheme jars with the jars you backed up previously (see Backing Up the Scheme Jars).
Step 10 Enter the command cd/export/home/sheer4/Main to return to the Main directory.
Step 11 Enter mvm.csh to launch the gateway.
Step 12 Repeat Steps 10 and 11 on all the units to launch them.
