Contents

Introduction

Prerequisites

Background Information

Cisco IOS XE Upgrade Paths

Pre-Upgrade Checklist

General Upgrade Steps

Cisco IOS XE Software Upgrade Process

Install Mode

Smart Licensing Using Policy (SLP)

Last supported Cisco IOS XE release for ASR1000 modules

Introduction

This document describes key considerations, known issues and best practices when upgrading Cisco ASR 1000 Series router software in autonomus mode.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

- Cisco IOS® XE software

- Basic router configuration and management

Components Used

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

Upgrading your Cisco ASR 1000 Series Router to Cisco IOS XE 17.x and newer versions ensures you benefit from the latest features, security enhancements, and performance improvements. This guide outlines the necessary steps, including interim upgrades for older versions, and considerations for ROMmon (ROM Monitor), FPGA (Field-Programmable Gate Array), and Smart Licensing.

Cisco IOS XE Upgrade Paths

This table summarizes the upgrade paths suggestions for ASR1000 Series platforms based on your current software version:

Current Version

Interim Step #1

Interim Step #2

Final  Step

3.x/16.(1–8).x

16.9.x (RP2)

or 16.12.x (other models)

17.9.x (only if PAK/RTU licenses in use, no snapshot taken)

17.12 or newer

16.(9–12).x

N/A

17.9.x (only if PAK/RTU licenses in use, no snapshot taken)

17.12 or newer

Why this matters: Some older versions require intermediate upgrades for compatibility or feature support. This ensures the platform boots correctly and functions post-upgrade.

Important notes

PAK license snapshot

- If you have a PAK license without a snapshot and want to upgrade to Cisco IOS XE 17.12.1a or later, you must first upgrade to an interim version (17.9.x) to allow the system to automatically snapshot the PAK license and complete Device-Led Conversion (DLC) proces — then upgrade to your target release.

- See FN-74148 and Snapshots for PAK Licenses for details.

Weak ciphers deprecation

Starting with Cisco IOS XE 17.11.1a:

- DES, 3DES, MD5, and DH Groups 1, 2, and 5 are deprecated and no longer supported

- Use AES, SHA, and DH Groups 14+ instead

- esp-gmac transforms are also deprecated

- See FN-72510 for details.

Caution: If deprecated ciphers are configured and the software upgrade is performed to Cisco IOS XE 17.11.1a or newer the IPsec tunnel negotiation fails and it results in service disruption.

To temporarily continue using weak ciphers during migration, disable CSDL compliance with crypto engine compliance shield disable command and reboot.

Pre-Upgrade Checklist

- Backup current configuration and local licenses (if applicable)

- Ensure you have at least 2 GB of free space on bootflash

- Allocate 15–20 minutes for downtime

- Review relevant release notes for all versions involved in your upgrade path.

General Upgrade Steps

Path A: from Cisco IOS XE 3.x/16.(1–8).x to 17.12 or newer:

1. Upgrade ROMmon if needed (see ROMmon Upgrade).

2. Upgrade to Cisco IOS XE 16.9.x (for ASR 1000-RP2) or 16.12.x for other models.

3. Upgrade FPGA if needed (see FPGA/CPLD Upgrade).

4. If PAK licenses were used with no snapshot: upgrade to Cisco IOS XE 17.9.x, upon the upgrade the system automatically takes a PAK snapshot and completes Device-Led Conversion (DLC) process.

5. Upgrade to the target version (Cisco IOS XE 17.12 or newer).

Path B: from Cisco IOS XE 16.(9–12).x to 17.12 or newer:

1. Upgrade ROMmon if needed (see ROMmon Upgrade).

2. Upgrade FPGA if needed(see FPGA/CPLD Upgrade).

3. If PAK licenses were used with no snapshot: upgrade to Cisco IOS XE 17.9.x, upon the upgrade the system automatically takes a PAK snapshot and completes Device-Led Conversion (DLC) process.

4. Upgrade to the target version (Cisco IOS XE 17.12 or newer).

ROMmon Upgrade (Required)

ROMmon is the bootloader firmware installed on specific hardware modules in the Cisco IOS XE router. Upgrading it ensures the hardware can boot and run newer Cisco IOS XE 17.x images.

Recommended version at the time of this writing: 17.15(4r)

Warning: After upgrading to ROMmon 17.3(1r) or newer, you cannot revert on: ASR 1001-X, ASR 1001-HX, ASR 1002-HX, ASR 1000-RP3

Warning: After upgrading ROMmon to 17.15(4r), you cannot downgrade to any earlier version on any card/platform.

- Check current ROMmon version installed on the RP module (refer to "Firmware Version" at the bottom of the output)
Router#show platform

<...>

Slot      CPLD Version        Firmware Version

--------- ------------------- ---------------------------------------

0         19060309            16.9(4r)

R0        19060309            16.9(4r)   <<<<<

F0        19060309            16.9(4r)

- If your version is older than 17.3(1r), proceed with the upgrade.

ROMmon Upgrade Steps:

Step 1. Copy the ROMmon image to bootflash.

copy tftp: bootflash:

Step 2. Verify the MD5 checksum of the ROMmon image matches the value published for this file on Software Download page

verify /md5 bootflash:asr1000-rommon.1715-4r.SPA.pkg

Step 3. Upgrade the ROMmon monitor.

upgrade rom-monitor filename bootflash:asr1000-rommon.1715-4r.SPA.pkg all

Note: When upgrading ROMmon to 17.15(4r) via upgrade rom-monitor filename all, first manually reload the ESP cards using hw-module slot <F0/F1> reload. Once cards reach the ok state, reload the entire chassis with reload. The ESP module remains disabled for up to 15 minutes during recovery.

Note: For ASR1000-MIP100, ROMmon is not updated — 16.3(2r) is packaged inside 17.15(4r) intentionally (to support the upgrade rom-monitor filename all command). This is expected behavior.

Resources:

- ROMmon Upgrade Guide

- ROMmon 17.15(4r) Download

FPGA/CPLD Upgrade

FPGA or CPLD (Complex Programmable Logic Device) versions manage low-level hardware features. Incorrect or outdated versions can cause boot errors or hardware malfunction with newer Cisco IOS XE images.

How to confirm the CPLD/FPGA version

- Run show hw-programmable all command to check your current CPLD/FPGA versions of each module.

- The CPLD version is also displayed in the bottom section of the output of show platform command.

When to Upgrade CPLD/FPGA

1. ASR 1000-RP2: If FPGA version is older than 17071402, upgrade is required.

Note: ROMmon versions older than 16.9(5r) or FPGA versions older than 17071402 cannot boot IOS XE images larger than 1GB. See Cisco bug ID CSCvm90995

2. Other platforms: Upgrade if CPLD/FPGA is older than the recommended version below.

Recommended Versions

This table lists recommended versions and respective download links for both CPLD and FPGA for each ASR 1000 platform.

Platform

CPLD

FPGA

Download

ASR 1000-RP2

14111801

18102401

Download

ASR 1000-RP3

19091111

—

Download

ASR1001-X

19060309

—

Download

ASR1002-X

14012203

20034

Download

ASR1001-HX

19030215

16051716

Download

ASR1002-HX

19030211

15102108

Download

Platform-specific notes:

- ASR1001-X, ASR1001-HX, ASR1002-HX: Download links point to a .bin file - a special FPGA Upgrade Tool addressing CVE-2019-1649 (Cisco Secure Boot Hardware Tampering Vulnerability). Must be run from the ROMmon prompt. See detailed instructions.

- ASR1000-RP2, ASR1000-RP3, ASR1002-X: Download links point to a standard .pkg firmware file.  Upgrade steps:

Step 1. Copy the image to bootflash.

copy tftp: bootflash:

Step 2. Upgrade the hardware programmable component.

upgrade hw-programmable fpga filename bootflash:<hw-programmables-image.pkg> r0

Cisco IOS XE Software Upgrade Process

Depending on your current software version the process of upgrading Cisco IOS XE to the target 17.x version requires an interim upgrade step or it could be a direct upgrade.

Both options are described in this section.

Path A: Upgrade with Interim Step

Note: Use this path if your current version is Cisco IOS XE 3.x or 16.(1–8).x.

Upgrade Steps

Step 1. Copy the interim image to bootflash and verify

copy tftp://<interim-image.bin> bootflash:

verify /md5 bootflash:<interim-image.bin>

Step 2. Set boot parameters for the interim image

configure terminal

no boot system

boot system bootflash:<interim-image.bin>

boot system bootflash:<current-image.bin>

end

write memory

Step 3. Set the configuration register and reload

configure terminal

config-register 0x2102

end

write memory

reload

Once the router boots into the interim version, verify functionality and licensing state.

Step 4. Copy the final image to bootflash and verify

copy tftp://<final-image.bin> bootflash:

verify /md5 bootflash:<final-image.bin>

Step 5. Update the boot statement to the final image, save the config and reload

configure terminal

no boot system

boot system bootflash:<final-image.bin>

boot system bootflash:<interim-image.bin>

end

write memory

reload

Path B: Upgrade to Cisco IOS XE 17.x

Note: Use this path if your current version is Cisco IOS XE 16.(9-12).x. These versions are compatible with a direct upgrade to Cisco IOS XE 17.x.

No interim step required unless target is Cisco IOS XE 17.12 or newer and PAK licenses were used with no snapshot taken - in that case, an interim upgrade to 17.9.x is recommended first, so the PAK snapshot can be collected.

Upgrade Steps

Step 1. Copy the final image to bootflash and verify

copy tftp://<final-image.bin> bootflash:

verify /md5 bootflash:<final-image.bin>

Step 2. Configure the boot image

configure terminal

no boot system

boot system bootflash:<final-image.bin>

boot system bootflash:<current-image.bin>

end

write memory

Step 3. Set the configuration register and reload

configure terminal

config-register 0x2102

end

write memory

reload

Install Mode

From Cisco IOS XE 17.15.1a, all platforms ship in install mode by default. You can boot, upgrade, and downgrade using install commands.

Instructions on converting from bundle mode to install mode, upgrading and downgrading in install mode: Installing the Software Using Install Commands

Smart Licensing Using Policy (SLP)

Requirement: Smart Licensing Using Policy becomes mandatory in releases Cisco IOS XE 17.3.2 and later.

Reference: Cisco SLP Overview and Onboarding Guide

Last supported Cisco IOS XE release for ASR1000 modules

Part ID

Last supported Cisco IOS XE version

ASR1000-MIP100

17.18.x

EPA-1X100GE

EPA-QSFP-1X100GE

EPA-2X40GE

EPA-18X1GE

EPA-10X10GE

17.18.x

ASR1000-ESP100-X

ASR1000-ESP200-X

17.18.x

ASR1000-RP3

17.18.x

ASR1000-ESP100

ASR1000-ESP200

17.15.x

ASR1000-RP2

17.9.x

ASR1000-SIP40

17.9.x

ASR1000-6TGE

ASR1000-2T+20X1GE

17.9.x