Upgrade Software on ASR1000 Series Platforms: A Quick Start Guide

Why this matters: Some older versions require intermediate upgrades for compatibility or feature support. This ensures the platform boots correctly and functions post-upgrade.

Important notes

PAK license snapshot

• If you have a PAK license without a snapshot and want to upgrade to Cisco IOS XE 17.12.1a or later, you must first upgrade to an interim version (17.9.x) to allow the system to automatically snapshot the PAK license and complete Device-Led Conversion (DLC) proces — then upgrade to your target release.
• See FN-74148 and Snapshots for PAK Licenses for details.

Weak ciphers deprecation

Starting with Cisco IOS XE 17.11.1a:

• DES, 3DES, MD5, and DH Groups 1, 2, and 5 are deprecated and no longer supported
• Use AES, SHA, and DH Groups 14+ instead
• esp-gmac transforms are also deprecated
• See FN-72510 for details.

Caution: If deprecated ciphers are configured and the software upgrade is performed to Cisco IOS XE 17.11.1a or newer the IPsec tunnel negotiation fails and it results in service disruption.
To temporarily continue using weak ciphers during migration, disable CSDL compliance with crypto engine compliance shield disable command and reboot. 

Pre-Upgrade Checklist

• Backup current configuration and local licenses (if applicable)
• Ensure you have at least 2 GB of free space on bootflash
• Allocate 15–20 minutes for downtime
• Review relevant release notes for all versions involved in your upgrade path.

General Upgrade Steps

Path A: from Cisco IOS XE 3.x/16.(1–8).x to 17.12 or newer:

1. Upgrade ROMmon if needed (see ROMmon Upgrade).
2. Upgrade to Cisco IOS XE 16.9.x (for ASR 1000-RP2) or 16.12.x for other models.
3. Upgrade FPGA if needed (see FPGA/CPLD Upgrade).
4. If PAK licenses were used with no snapshot: upgrade to Cisco IOS XE 17.9.x, upon the upgrade the system automatically takes a PAK snapshot and completes Device-Led Conversion (DLC) process.
5. Upgrade to the target version (Cisco IOS XE 17.12 or newer).

Path B: from Cisco IOS XE 16.(9–12).x to 17.12 or newer:

1. Upgrade ROMmon if needed (see ROMmon Upgrade).
2. Upgrade FPGA if needed(see FPGA/CPLD Upgrade).
3. If PAK licenses were used with no snapshot: upgrade to Cisco IOS XE 17.9.x, upon the upgrade the system automatically takes a PAK snapshot and completes Device-Led Conversion (DLC) process.
4. Upgrade to the target version (Cisco IOS XE 17.12 or newer).

ROMmon Upgrade (Required)

ROMmon is the bootloader firmware installed on specific hardware modules in the Cisco IOS XE router. Upgrading it ensures the hardware can boot and run newer Cisco IOS XE 17.x images.

Recommended version at the time of this writing: 17.15(4r)

Warning: After upgrading to ROMmon 17.3(1r) or newer, you cannot revert on: ASR 1001-X, ASR 1001-HX, ASR 1002-HX, ASR 1000-RP3

Warning: After upgrading ROMmon to 17.15(4r), you cannot downgrade to any earlier version on any card/platform.

• Check current ROMmon version installed on the RP module (refer to "Firmware Version" at the bottom of the output)

  Router#show platform    
  <...>    
  
  Slot      CPLD Version        Firmware Version                        
  --------- ------------------- --------------------------------------- 
  0         19060309            16.9(4r)                          
  R0        19060309            16.9(4r)   <<<<<                      
  F0        19060309            16.9(4r)                          
  

ROMmon Upgrade Steps:

Step 1. Copy the ROMmon image to bootflash.

copy tftp: bootflash:

Step 2. Verify the MD5 checksum of the ROMmon image matches the value published for this file on Software Download page

verify /md5 bootflash:asr1000-rommon.1715-4r.SPA.pkg

Step 3. Upgrade the ROMmon monitor.

upgrade rom-monitor filename bootflash:asr1000-rommon.1715-4r.SPA.pkg all    

Note: When upgrading ROMmon to 17.15(4r) via upgrade rom-monitor filename all, first manually reload the ESP cards using hw-module slot <F0/F1> reload. Once cards reach the ok state, reload the entire chassis with reload. The ESP module remains disabled for up to 15 minutes during recovery. 

Note: For ASR1000-MIP100, ROMmon is not updated — 16.3(2r) is packaged inside 17.15(4r) intentionally (to support the upgrade rom-monitor filename all command). This is expected behavior. 

Platform-specific notes:

• ASR1001-X, ASR1001-HX, ASR1002-HX: Download links point to a .bin file - a special FPGA Upgrade Tool addressing CVE-2019-1649 (Cisco Secure Boot Hardware Tampering Vulnerability). Must be run from the ROMmon prompt. See detailed instructions.
• ASR1000-RP2, ASR1000-RP3, ASR1002-X: Download links point to a standard .pkg firmware file.  Upgrade steps:

Step 1. Copy the image to bootflash.

copy tftp: bootflash:    

Step 2. Upgrade the hardware programmable component.

upgrade hw-programmable fpga filename bootflash:<hw-programmables-image.pkg> r0    

Cisco IOS XE Software Upgrade Process

Depending on your current software version the process of upgrading Cisco IOS XE to the target 17.x version requires an interim upgrade step or it could be a direct upgrade. 

Both options are described in this section.

Path A: Upgrade with Interim Step

Note: Use this path if your current version is Cisco IOS XE 3.x or 16.(1–8).x.

Upgrade Steps

Step 1. Copy the interim image to bootflash and verify

copy tftp://<interim-image.bin> bootflash:
verify /md5 bootflash:<interim-image.bin>

Step 2. Set boot parameters for the interim image

configure terminal
no boot system
boot system bootflash:<interim-image.bin>
boot system bootflash:<current-image.bin>
end
write memory

Step 3. Set the configuration register and reload

configure terminal
config-register 0x2102
end
write memory
reload

Once the router boots into the interim version, verify functionality and licensing state.

Step 4. Copy the final image to bootflash and verify

copy tftp://<final-image.bin> bootflash:
verify /md5 bootflash:<final-image.bin>

Step 5. Update the boot statement to the final image, save the config and reload

configure terminal
no boot system
boot system bootflash:<final-image.bin>
boot system bootflash:<interim-image.bin>
end
write memory
reload

Path B: Upgrade to Cisco IOS XE 17.x

Note: Use this path if your current version is Cisco IOS XE 16.(9-12).x. These versions are compatible with a direct upgrade to Cisco IOS XE 17.x. 

No interim step required unless target is Cisco IOS XE 17.12 or newer and PAK licenses were used with no snapshot taken - in that case, an interim upgrade to 17.9.x is recommended first, so the PAK snapshot can be collected.

Upgrade Steps

Step 1. Copy the final image to bootflash and verify

copy tftp://<final-image.bin> bootflash:
verify /md5 bootflash:<final-image.bin>

Step 2. Configure the boot image

configure terminal
no boot system
boot system bootflash:<final-image.bin>
boot system bootflash:<current-image.bin>
end
write memory

Step 3. Set the configuration register and reload

configure terminal
config-register 0x2102
end
write memory
reload

Install Mode 

From Cisco IOS XE 17.15.1a, all platforms ship in install mode by default. You can boot, upgrade, and downgrade using install commands.

Instructions on converting from bundle mode to install mode, upgrading and downgrading in install mode: Installing the Software Using Install Commands

Smart Licensing Using Policy (SLP)