• If you want to import the firmware image from your computer, in the Location field, click the Local radio button. Click the Choose File button, then navigate to the folder on your local system with the firmware image that you want to import. Go to Step 6.

• If you want to import the firmware image from a remote location, click either Secure copy or HTTP, depending on the method that you want to use to import the firmware image from the remote location:

  • If you selected the Secure copy radio button, enter the Secure Copy Protocol (SCP) source that you want to use to download the software image:

    1. In the URL field, enter the URL from where the image will be downloaded.

       The format for the SCP source is:

       <SCP server IP or FQDN>:/<path>/<filename>

       An example URL is 10.1.2.3:/path/to/the/image/aci-apic-dk9.6.2.1a.iso.

    2. In the Username field, enter your username for secure copy.

    3. In the Authentication Type field, select the type of authentication for the download. The type can be:

       • Password

       • Ssh Public Private Files

       The default is Password.

       • If you selected Password, in the Password field, enter your password for secure copy.

       • If you selected Ssh Public Private Files, enter the following information:

         • Ssh Key Contents: The SSH private key content.

         • Ssh Key Passphrase: The SSH key passphrase that is used for generating the SSH private key.

           Note

           Based on the provided SSH private key, the Cisco APIC internally creates a temporary SSH public key just for this transaction to establish a connection with the remote server. You must ensure that the remote server has the corresponding public key as one of the "authorized_keys". After the authentication check is performed, the temporary public key on the Cisco APIC is deleted.

           You can generate an SSH private key (~/.ssh/id_rsa) and a corresponding SSH public key (~/.ssh/id_rsa.pub) on one of the Cisco APICs by entering the following:

           ssh-keygen -t rsa -b 2048 -C "<username>@<apic_name>"

           Or you can generate them on another machine. For either method, you need to provide the generated private key for each download configuration.

  • If you selected the HTTP radio button, enter the http source that you want to use to download the software image.

    The format for the HTTP source is:

    <HTTP server IP or FQDN>:/<path>/<filename>

    An example URL is 10.1.2.3:/path/to/the/image/aci-apic-dk9.6.2.1a.iso.

APIC runs the built-in pre-upgrade validations along with the external validation rules. Make sure that all validations are passed or make sure that appropriate actions were performed for the failed validations. If there is a validation that failed with severity Catastrophic, you must fix it to proceed to the next step.

As mentioned in the External Validation Rules section, APIC can get the external rules either from Cisco Intersight or from its local firmware repository.

• Controllers upgrade or downgrade one at a time to maintain cluster availability.

• While APIC1 is rebooting, you are navigated to the monitoring view on APIC2. Except for this particular period, you must be always on APIC1 to monitor the progress.

  There are three types of progress bars:

  • Upgrade - The entire upgrade progress

  • Cluster Wide - Steps and progress for the cluster level operation

  • Node X - Steps and progress for the individual APIC node

  You can expand Cluster Wide and Node progress to see the details.

• Wait for all controllers to complete and report Fully Fit status.