Field Notice: FN74387 - SSH Connectivity Loss During Cisco IOS XR Software Upgrade to Release 25.2.1 on Cisco Network Convergence System 540 and 5500 Series Routers - Workaround Provided

Available Languages

Updated:September 10, 2026
Document ID:FN74387

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Medium
Impact Rating:
Medium
First Published:
2026-Sep-10
Last Published:
2026-Sep-10
Revision:
1.0
Cisco Bug IDs:

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Products Affected


Affected Product Name Description Comments
N540-12Z20G-SYS-A NCS540 20x1G+12x10G AC  
N540-12Z20G-SYS-D NCS540 20x1G+12x10G DC  
N540-24Q2C2DD-SYS NCS540-2x400G QSFP-DD+2x100G+24x25G  
N540-24Q8L2DD-SYS NCS540-2x400G QSFP-DD+8x50G+24x25G  
N540-28Z4C-SYS-A NCS540 28x10G + 4x100G AC  
N540-28Z4C-SYS-D NCS 540 28x10G + 4x100G DC  
N540-6Z14S-SYS-D NCS540 10x1G SFP + 6x1/10G SFP+ Dual DC iTEMP  
N540-6Z18G-SYS-A NCS540 18x1G SFP + 6x1/10G SFP+ AC  
N540-6Z18G-SYS-D NCS540 18x1G SFP + 6x1/10G SFP+ DC  
N540-FH-AGG-SYS N540-Front Haul Aggregation Router  
N540-FH-CSR-SYS N540-Front Haul Cell Site Router  
N540X-12Z16G-SYS-A NCS540 12x1G SFP + 4x1G Cu + 12x10G AC  
N540X-12Z16G-SYS-D NCS540 12x1G SFP + 4x1G Cu + 12x10G DC  
N540X-16Z4G8Q2C-A NCS 540 16x10G+4x1G Cu+8x25G+2x100G AC  
N540X-16Z4G8Q2C-D NCS540 16x10G+4x1G Cu+8x25G+2x100G DC  
N540X-16Z8Q2C-D NCS540 16x10G+8x25G+2x100G DC  
N540X-4Z14G2Q-A NCS540 14x1G + 4x1/10G + 2x10/25G Dual-AC iTEMP Conf-Coat  
N540X-4Z14G2Q-D NCS540 14x1G + 4x1/10G + 2x10/25G Dual-DC iTEMP Conf-Coat  
N540X-6Z18G-SYS-A NCS540 18x1G SFP + 6x1/10G SFP+ Dual-AC iTEMP Conformal Coat  
N540X-6Z18G-SYS-D NCS540 18x1G SFP + 6x1/10G SFP+ Dual DC iTEMP Conformal Coat  
N540X-8Z16G-SYS-A N540 12/20(CSFP)x1G + 4x1GCu +8x1/10G DualAC iTEMP Conf-Coat  
N540X-8Z16G-SYS-D N540 12/20(CSFP)x1G + 4x1GCu +8x1/10G DualDC iTEMP Conf-Coat  
NCS-57B1-5D24H-SE NCS57B1 Fixed Scale HW 5x400, 24x100 all QSFP-DD chassis  
NCS-57B1-5DSE-SYS NCS57B1 Fixed Scale HW Flexible Consumption Need Smart Lic  
NCS-57B1-6D24-SYS NCS57B1 Fixed Base HW Flexible Consumption Need Smart Lic  
NCS-57C1-48Q6-SYS NCS 57C1 Base Chassis, Flexible Consumption Need Smart Lic  
NCS-57C1-48Q6D-S NCS 57C1 Base Chassis, Fixed ports - 32X25G, 16X50G & 6X400  
NCS-57D2-18DD-S NCS57D2 7.2T Fixed Base Chassis 66 QSFP-DD flexible ports  
NCS-57D2-18DD-SYS NCS57D2 7.2T Fixed Base Chassis 66 QSFP-DD flexible ports  




Defect Information


Defect IDHeadline
CSCwt16391SSH connectivity not possible during SW upgrade crossing 25.2.1 bundary

Problem Description


Some Cisco Network Convergence System (NCS) 540 and 5500 Series Routers may exhibit connectivity loss of SSH during the Cisco IOS XR Software upgrade process from a release earlier than 25.2.1 to Release 25.2.1 or later.


Background


SSH is used to encrypt management sessions and protect against unauthorized access. This connectivity failure is caused by an incompatibility between internal library files that is triggered during the upgrade process.


Problem Symptom


Affected routers may lose SSH connectivity after executing the install package replace command, as shown in the following example:

install package replace /harddisk:/ncs540l-x64-x.x.x.iso

Access is restored once the router completes the subsequent reload. This symptom occurs exclusively after the install package replace command and before the install apply command in Cisco IOS XR Software releases earlier than Release 25.2.1 that are being updated to Release 25.2.1 or later.


Workaround/Solution


Solution

To avoid this issue, use the install replace command instead of install package replace, as shown in the following example:

install replace /harddisk:/<GISO_filename>.iso

Note: Install replace requires the use of golden ISO (GISO).

Workaround

If connectivity was already lost, access needs to be retrieved without using SSH (e.g., using Telnet or the console). Use the install apply command to continue with the upgrade process and allow the device to reload, as shown in the following example:

install apply

After the reboot is complete, SSH functionality will be restored.


Additional Information


Upgrading Cisco NCS 540 and 5500 Series Routers to Cisco IOS XR7 Software Release 25.3.1 or later introduces the Simplified Install feature, which helps prevent the loss of SSH connectivity during the upgrade process. In certain deployment scenarios, a bridge SMU may be required to address CSCwm77418. For further technical details and configuration guidance, please refer to Simplified Install on Cisco IOS XR7 Platforms.


Revision History


VersionDescriptionSectionDate
1.0Initial Release—2026-SEP-10

For More Information

For further assistance or for more information about this field notice, contact the Cisco Technical Assistance Center (TAC) using one of the following methods:

Receive Email Notification About New Field Notices

To receive email updates about Field Notices (reliability and safety issues), Security Advisories (network security issues), and end-of-life announcements for specific Cisco products, set up a profile in My Notifications.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco