Cisco DNA Center User Guide, Release 1.3

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco DNA Center User Guide, Release 1.3

Chapter Title

Manage Software Images

Results

Updated:
June 25, 2020

Chapter: Manage Software Images

Manage Software Images

About Image Repository

Cisco DNA Center stores all of the software images and software maintenance updates (SMUs) for the devices in your network. Image Repository provides the following functions:

  • Image Repository—Cisco DNA Center stores all the unique software images according to image type and version. You can view, import, and delete software images.

  • Provision—You can push software images to the devices in your network.

Before using Image Repository features, you must enable Transport Layer Security protocol (TLS) on older devices such as Catalyst 3K, 4K, and 6K. After any system upgrades, you must re-enable TLS again. For more information, see “Configure Security for Cisco DNA Center” in the Cisco Digital Network Architecture Center Administrator Guide.

Integrity Verification of Software Images

The Integrity Verification application monitors software images that are stored in Cisco DNA Center for unexpected changes or invalid values that could indicate your devices are compromised. During the import process, the system determines image integrity by comparing the software and hardware platform checksum value of the image that you are importing to the checksum value identified for the platform in the Known Good Values (KGV) file to ensure that the two values match.

On the Image Repository window, a message displays if the Integrity Verification application cannot verify the selected software image using the current KGV file. For more information about the Integrity Verification application and importing KGV files, see the Cisco Digital Network Architecture Center Administrator Guide.

View Software Images

After you run Discovery or manually add devices, Cisco DNA Center automatically stores information about the software images, SMUs and sub-packages for the devices.

Procedure

Step 1

From the Cisco DNA Center home page, choose Design > Image Repository.

The software images are organized and displayed based on the device type. By default, software images for physical devices are displayed. You can toggle to Virtual tab to view software images for virtual devices.

Step 2

In the Image Name column, click the downward arrow to view all the software images for the specified device type family. The Using Image column indicates how many devices are using the specific image shown in the Image Name field. Click the number link to view the devices that are using the image.

Step 3

In the Version column, click the Add On link to view the applicable SMUs, Sub-packages, and ROMMON upgrades for the base image.

Sub-packages are the additional features that can be added to the existing base image. The sub-package version that is the same as the image family and the base image version is displayed here.

Note 

If you tag any SMU as golden, it will be automatically activated when the base image is installed.

You cannot tag a sub-package as golden.

For ROMMON upgrade, cisco.com configuration is mandatory. When a device is added, the latest ROMMON details will be fetched from cisco.com for applicable devices. Also, when there is base image import or tagging of base image, the ROMMON image will be automatically downloaded from cisco.com.

Step 4

In the Device Role column, select a device role for which you want to indicate this is a "golden" software image. For more information, see About Golden Software Images and Specify a Golden Software Image.

Use a Recommended Software Image

Cisco DNA Center can display and allow you to select Cisco-recommended software images for the devices that it manages.

Procedure

Step 1

From the Cisco DNA Center home page, choose > System Settings > Settings > Cisco Credentials and verify that you have entered the correct credentials to connect to Cisco.com.

Step 2

Choose Design > Image Repository.

Cisco DNA Center displays the Cisco-recommended software images according to device type.

Step 3

Designate the recommended image as golden. See Specify a Golden Software Image for more information.

After you designate the Cisco-recommended image as golden, Cisco DNA Center automatically downloads the image from cisco.com.

Step 4

Push the recommended software image to the devices in your network. See Provision a Software Image for more information.

Import a Software Image

You can import software images and software image updates from your local computer or from a URL.

Procedure

Step 1

From the Cisco DNA Center home page, choose Design > Image Repository.

Step 2

Click Import.

Step 3

Click Choose File to navigate to a software image or software image update stored locally or enter the image URL to specify an HTTP or FTP source from which to import the software image or software image update.

Step 4

If the image you are importing is for a third-party (not Cisco) vendor, select Third Party under Source. Then select an Application Type, describe the device Family, and identify the Vendor.

Step 5

Click Import.

A window displays the progress of the import.
Step 6

Click Show Tasks to verify that the image was imported successfully.

If you imported a SMU, Cisco DNA Center automatically applies the SMU to the correct software image, and an Add-On link appears below the corresponding software image.

Step 7

Click the Add-On link to view the SMU.

Step 8

In the Device Role field, select the role for which you want to mark this SMU as golden. See Specify a Golden Software Image for more information.

Note 

You can only mark a SMU as golden if you previously marked the corresponding software image as golden.

Assign a Software Image to a Device Family

After importing a software image, you can assign it to available device families. The imported image can be assigned to multiple devices any time.

Procedure

Step 1

From the Cisco DNA Center home page, choose Design > Image Repository.

Step 2

Click Imported Images.

Step 3

Click the Assign link.

Step 4

In the Assign Device Family window, select the device families to which you want to assign the image.

Step 5

Click Assign.

The software image is assigned to the device family and the number of devices using that image are shown in the Using Image column. After assigning the image, you can mark it as a golden image. See Specifying a Golden Software Image.

Note 

For PnP devices, you can import a software image and assign it to a device family even before the device is available. You can also mark the image as a golden image. When the device is made available in the inventory, the image assigned to the device family is automatically assigned to the newly added devices of that device family.

When the image is imported and has cisco.com credentials added, Cisco DNA Center provides the list of device families that are applicable for the image. You can select the required device family from the list.

If the image is not available in cisco.com or credentials are not added in Cisco DNA Center, you must design the right device family for the image.

Upload Software Images for Devices in Install Mode

The Image Repository page might show a software image as being in Install Mode. When a device is in Install Mode, Cisco DNA Center is unable to upload its software image directly from the device. When a device is in install mode, you must first manually upload the software image to the Cisco DNA Center repository before marking the image as golden, as shown in the following steps.

Procedure

Step 1

From the Cisco DNA Center home page, choose Design > Image Repository.

Step 2

In the Image Name column, find the software image of the device that is running in Install Mode.

Step 3

Click Import to upload the binary software image file for the image that is in Install Mode.

Step 4

Click Choose File to navigate to a software image stored locally or Enter image URL to specify an HTTP or FTP source from which to import the software image.

Step 5

Click Import.

A window displays the progress of the import.
Step 6

Click Show Tasks and verify that the software image you imported is green, indicating it has been successfully imported and added to the Cisco DNA Center repository.

Step 7

Click Refresh.

The Image Repository window refreshes. Cisco DNA Center displays the software image, and the Golden Image and Device Role columns are no longer greyed out.

About Golden Software Images

Cisco DNA Center allows you to designate software images and SMUs as golden. A golden software image or SMU is a validated image that meets the compliance requirements for the particular device type. Designating a software image or SMU as golden saves you time by eliminating the need to make repetitive configuration changes and ensures consistency across your devices. You can designate an image and a corresponding SMU as golden to create a standardized image. You can also specify a golden image for a specific device role. For example, if you have an image for the Cisco 4431 Integrated Service Routers device family, you can further specify a golden image for those Cisco 4431 devices that have the Access role only.

You cannot mark a SMU as golden unless the image to which it corresponds is also marked golden.

Specify a Golden Software Image

You can specify a golden software image for a device family or for a particular device role. The device role is used for identifying and grouping devices according to their responsibilities and placement within the network.

Procedure

Step 1

From the Cisco DNA Center home page, choose Design > Image Repository.

The software images are displayed according to device type.
Step 2

From the Family column, select a device family for which you want to specify a golden image.

Step 3

From the Image Name column, select the software image that you want to specify as golden.

Step 4

In the Device Role column, select a device role for which you want to specify a golden software image. Even if you have devices from the same device family, you can specify a different golden software image for each device role. Note that you can select a device role for physical images only, not virtual images.

If the software image you specified as golden is not already uploaded into the Cisco DNA Center repository, this process might take some time to complete. Under the Action column on the Image Repository page, if the trash can icon is greyed out, the image is not yet uploaded to the Cisco DNA Center repository. Cisco DNA Center must first upload the software image to its repository, and then it can mark the image as golden. If the software image is already uploaded to the Cisco DNA Center repository, indicated by the active trash can icon in the Action column, then the process to specify a golden image completes faster.

Provision a Software Image

You can push software images to the devices in your network. Before pushing a software image to a device, Cisco DNA Center performs upgrade readiness prechecks on the device, such as checking the device management status, disk space, and so on. If any prechecks fail, you cannot perform the software image update. After the software image of the device is upgraded, Cisco DNA Center checks for the CPU usage, route summary, and so on, to ensure that the state of the network remains unchanged after the image upgrade.

Cisco DNA Center compares each device's software image with the image that you have designated as golden for that specific device type. If there is a difference between the software image of the device and the golden image, then Cisco DNA Center specifies the software image of the device as outdated. The upgrade readiness prechecks will be triggered for those devices. If all the prechecks are cleared, you can distribute (copy) the new image) to the device and activate (make the new image as running image) it. The activation of the new image requires a reboot of the device. This might interrupt the current network activity. In that case, you can schedule the process to a later time..

If you have not designated a golden image for the device type, then the device's image cannot be updated. See Specify a Golden Software Image for more information.

Procedure

Step 1

From the Cisco DNA Center home page, click Provision.

Step 2

Choose Software Images from the Focus drop-down list. Select the device whose image you want to upgrade.

Note 

If the prechecks are successful for a device, the Outdated link in the OS Image column will have a green tick mark. If any of the upgrade readiness prechecks fail for a device, the Outdated link will have a red into mark, and you cannot update the OS image for that device. Click on the Outdated link and correct the errors before proceeding further.

See List of Device Upgrade Readiness Prechecks for the list of prechecks.

Step 3

From the Actions drop-down list, choose Software Images > Update Image and do the following.

  1. Distribute: Click Now to start the distribution immediately or click Later if you want to schedule the distribution at a specific time.

    Note 

    If the image is already distributed for the selected device, the Distribute process will be skipped and you will only be able to Activate the image.

  2. Click Next.

  3. Activate: Click Now to start the activation immediately or click Later if you want to schedule the activation at a specific time.

    Note 

    You can skip this step, if you want to perform only the distribution process currently.

  4. (Optional) Select the Schedule Activation after Distribution is completed check box as required.

  5. Confirm: Click Confirm to confirm the update.

You can check the status of the update in the OS Update Status column. If this column is not displayed, click and choose OS Update Status.
Step 4

(Optional) Click Upgrade Status to view the progress of the image upgrade.

Note 

If you have a device between Cisco DNA Center and another fabric device, such as an edge router, the software update process might fail if the in between device reloads while the software image is being provisioned to the other device.

List of Device Upgrade Readiness Prechecks

Precheck

Description

Device management status

Checks if the device is successfully managed in Cisco DNA Center.

File transfer check

Checks if the device is reachable through SCP and HTTPS.

NTP clock check

Compares device time and Cisco DNA Center time to ensure successful Cisco DNA Center certificate installation.

Flash check

Verifies if there is enough disk space for the update. If there is not enough disk space, a warning or error message is returned. For information about the supported devices for Auto Flash cleanup and how files are deleted, see Auto Flash Cleanup.

Config register check

Verifies the config registry value.

Crypto RSA check

Checks whether an RSA certificate is installed.

Crypto TLS check

Checks whether the device supports TLS 1.2.

IP Domain name check

Checks whether the domain name is configured.

Startup config check

Checks whether the startup configuration exists for the device.

NFVIS Flash check

Checks if the golden image is ready to be upgraded in the NFVIS device.

Service Entitlement check

Checks if the device has valid license.

Interface check

Checks the status of the device interface.

CDP neighbors check

Displays information about the connected routers and switches in the network that are discovered using CDP.

Running Config check

Checks the configuration that is currently running on the device.

Spanning Tree Summary check

Checks the information about the Spanning Tree Protocol (STP).

AP Summary check

Displays the AP Summary associated with the Cisco Wireless Controllers devices.

Auto Flash Cleanup

During the device upgrade readiness precheck, the flash check verifies whether there is enough space on the device to copy the new image. If there is insufficient space:

  • For devices that support auto flash cleanup, the flash check fails with a warning message. For these devices, the auto cleanup process is attempted during the image distribution process to create the sufficient space. As a part of the auto flash cleanup, Cisco DNA Center identifies unused .bin, .pkg, and .conf files and delete them iteratively until enough free space is created on the device. Image distribution is attempted after the flash cleanup. You can view these deleted files in Sytem > Audit Logs.


    Note

    Auto flash cleanup is supported on all devices except Nexus switches and Wireless controllers.

  • For devices that do not support auto flash cleanup, the flash check fails with an error message. You can delete files from device flash to create required space before starting the image upgrade.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco