The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This document lists the current and past versions of EPLD images and describes how to update them for use with the Cisco Nexus 9000 Series switches.
This document also covers later releases. If a new Cisco Nexus 9000 Series FPGA/EPLD Upgrade Release Notes document isn’t available, that means that these are the latest available numbers for upgrade.
This table lists the changes to this document.
Table 1. Changes to this document
Date |
Description |
September 2, 2025 |
Release 10.4(6)M became available. |
The Cisco Nexus 9000 Series NX-OS mode switches contain several programmable logical devices (PLDs) that provide hardware functionalities in all modules. Cisco provides electronic programmable logic device (EPLD) image upgrades to enhance hardware functionality or to resolve known issues. PLDs include electronic programmable logic devices (EPLDs), field programmable gate arrays (FPGAs), and complex programmable logic devices (CPLDs), but they do not include ASICs. In this document, the term EPLD is used for FPGA and CPLDs.
The advantage of having EPLDs for some module functions is that when you need to upgrade those functions, you just upgrade their software images instead of replacing their hardware.
Note: The EPLD image upgrades for a line card disrupt the traffic going through the module because the module must power down briefly during the upgrade. The system performs EPLD upgrades on one module at a time, so at any one time the upgrade disrupts only the traffic going through one module.
Cisco provides the latest EPLD images with each release. Typically, these images are the same as provided in earlier releases but occasionally some of these images are updated. These EPLD image updates are not mandatory unless otherwise specified. The EPLD image upgrades are independent from the Cisco In Service Software Upgrade (ISSU) process, which upgrades the system image with no impact on the network environment.
When Cisco releases an EPLD image upgrade, these release notes announce its availability, and you can download the EPLD images from the Software Download page.
When selecting an EPLD version for upgrade, ensure that the corresponding NX-OS software version is already installed. Upgrading to a newer EPLD image designed for a future NX-OS release while running an older NX-OS version is generally not supported, unless explicitly stated in the specific EPLD Release Notes. NX-OS and EPLD images are version-labeled to help prevent unsupported upgrades.
When to upgrade EPLDs
When new EPLD images are available, the upgrades are always recommended if your network environment allows for a maintenance period in which some level of traffic disruption is acceptable. If such a disruption is not acceptable, then consider postponing the upgrade until a better time.
Note: The EPLD upgrade operation is a disruptive operation. Execute this operation only at a programmed maintenance time. The system ISSU upgrade is a nondisruptive upgrade.
Note: Do not perform an EPLD upgrade during an ISSU system upgrade.
EPLD version is backward compatible. The NX-OS software can be downgraded for the switch and the EPLD version does not have to be downgraded to match the older NX-OS version.
Switch requirements
· The Cisco Nexus 9000 Series switch must be running the Cisco NX-OS operating system.
· You must be able to access the switch through a console, SSH, or Telnet connection; this is required for setting up a switch running in NX-OS mode.
· You must have administrator privileges to work with the Cisco Nexus 9000 Series switch.
EPLD upgrades available for NX-OS Mode releases 10.3(7) through 10.4(6)
Each EPLD image that you can download from the Software Download page is a bundle of EPLD upgrades packaged into a single EPLD image file. To view the available EPLD versions for the Nexus 9000 standalone and module switches in this release, refer to the tables.
Note:
● All updates to an image are shown in boldface. If more than one release is shown for a column, the boldface applies to the first release listed for the column.
● This release of EPLD addresses the Secure Boot Hardware Tampering vulnerability for Nexus 9000 Series switches. For more information, see Cisco Secure Boot Hardware Tampering Vulnerability.
Table 2. Available EPLD images for the Cisco Nexus 9200, 9300, 9300-EX, and 9300-FX platform switches
Table 3. Available EPLD images for the Cisco Nexus 9400 switches
Component |
EPLD |
Release 10.3(7) |
Release 10.4(1) |
Release 10.4(2) |
Release 10.4(3) |
Release 10.4(4) |
Release 10.4(5) |
Release 10.4(6) |
Cisco Nexus 9408 (N9K-C9408) |
IOFPGA |
0x29 (0.041) |
0x29 (0.041) |
0x29 (0.041) |
0x29 (0.041) |
0x29 (0.041) |
0x29 (0.041) |
0x29 (0.041) |
MIFPGA |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
|
22 Port LEM (N9K-X9400-22L) |
LEM MIFPGA |
0x20 (0.032) |
0x20 (0.032) |
0x20 (0.032) |
0x20 (0.032) |
0x08 (0.008) |
0x20 (0.032) |
0x20 (0.032) |
16 Port LEM (N9K-X9400-16W) |
LEM MIFPGA |
0x16 (0.022) |
0x15 (0.021) |
0x15 (0.021) |
0x15 (0.021) |
0x16 (0.022) |
0x16 (0.022) |
0x16 (0.022) |
8 Port LEM (N9K-X9400-8D) |
LEM MIFPGA |
0x16 (0.022) |
0x15 (0.021) |
0x15 (0.021) |
0x15 (0.021) |
0x16 (0.022) |
0x16 (0.022) |
0x16 (0.022) |
Table 4. Available EPLD Images for the Cisco Nexus 9500 Platform Switches
Release 10.3(7) |
Release 10.4(1) |
Release 10.4(2) |
Release 10.4(3) |
Release 10.4(4) |
Release 10.4(5) |
Release 10.4(6) |
||
Supervisor A (N9K-SUP-A) |
IOFPGA |
0x32 (0.050) |
0x32 (0.050) |
0x32 (0.050) |
0x32 (0.050) |
0x32 (0.050) |
0x32 (0.050) |
0x32 (0.050) |
Supervisor A+ (N9K-SUP-A+) |
IOFPGA |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
Supervisor B (N9K-SUP-B) |
IOFPGA |
0x30 (0.049) |
0x30 (0.049) |
0x30 (0.049) |
0x30 (0.049) |
0x30 (0.049) |
0x30 (0.049) |
0x30 (0.049) |
Supervisor B+ (N9K-SUP-B+) |
IOFPGA |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
System Controller (N9K-SC-A) |
IOFPGA |
0x23 (0.035) |
0x23 (0.035) |
0x23 (0.035) |
0x23 (0.035) |
0x23 (0.035) |
0x23 (0.035) |
0x23 (0.035) |
32-port 100-Gigabit QSFP28 line card |
IOFPGA |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
MIFPGA |
0x4 (0.004) |
0x4 (0.004) |
0x4 (0.004) |
0x4 (0.004) |
0x4 (0.004) |
0x4 (0.004) |
0x4 (0.004) |
|
32-port 100-Gigabit QSFP28 line card |
IOFPGA |
0x13 (0.019) |
0x13 (0.019) |
0x13 (0.019) |
0x13 (0.019) |
0x13 (0.019) |
0x13 (0.019) |
0x13 (0.019) |
MIFPGA |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
|
32-port 100-Gigabit QSFP28 line card |
IOFPGA |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
MIFPGA |
0x5 (0.005) |
0x5 (0.005) |
0x5 (0.005) |
0x5 (0.005) |
0x5 (0.005) |
0x5 (0.005) |
0x5 (0.005) |
|
36-port 100-Gigabit QSFP28 line card (N9K-X9732C-FX) |
IOFPGA |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
MIFPGA |
0x2 (0.002) |
0x2 (0.002) |
0x2 (0.002) |
0x2 (0.002) |
0x2 (0.002) |
0x2 (0.002) |
0x2 (0.002) |
|
16-port 400-Gigabit QSFP-DD line card (N9K-X9716D-GX) |
IOFPGA |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
MIFPGA |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
|
36-port 100-Gigabit QSFP28 line card |
IOFPGA |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
MIFPGA |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
|
36-port 100-Gigabit QSFP28 line card |
IOFPGA |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
MIFPGA |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
|
48-port 1/10GBASE-T and 4-port |
IOFPGA |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
MIFPGA |
0x8 (0.008) |
0x8 (0.008) |
0x8 (0.008) |
0x8 (0.008) |
0x8 (0.008) |
0x8 (0.008) |
0x8 (0.008) |
|
48-port 1-/10-/25-Gigabit SFP28 and |
IOFPGA |
0x15 (0.021) |
0x15 (0.021) |
0x15 (0.021) |
0x15 (0.021) |
0x15 (0.021) |
0x15 (0.021) |
0x15 (0.021) |
MIFPGA |
0x5 (0.005) |
0x5 (0.005) |
0x5 (0.005) |
0x5 (0.005) |
0x5 (0.005) |
0x5 (0.005) |
0x5 (0.005) |
|
48-port 10-Gigabit SFP+ and |
IOFPGA |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
MIFPGA |
0x6 (0.006) |
0x6 (0.006) |
0x6 (0.006) |
0x6 (0.006) |
0x6 (0.006) |
0x6 (0.006) |
0x6 (0.006) |
|
48-port 10-Gigabit SFP+ and
|
IOFPGA |
0x6 (0.006) |
0x6 (0.006) |
0x6 (0.006) |
0x6 (0.006) |
0x6 (0.006) |
0x6 (0.006) |
0x6 (0.006) |
MIFPGA |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
|
Fabric module for Cisco Nexus 9504 |
IOFPGA |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
Fabric module for Cisco Nexus 9504 |
IOFPGA |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
Fabric module for Cisco Nexus 9508 |
IOFPGA |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
0x14 (0.020) |
Fabric module for Cisco Nexus 9508 |
IOFPGA |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
Fabric module for Cisco Nexus 9508 |
IOFPGA |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
0x11 (0.017) |
Fabric module for Cisco Nexus 9516 |
MIFPGA |
0x11 (0.017) |
0x11 (0.011) |
0x11 (0.011) |
0x11 (0.011) |
0x11 (0.011) |
0x11 (0.011) |
0x11 (0.011) |
IOFPGA |
0x8 (0.008) |
0x8 (0.008) |
0x8 (0.008) |
0x8 (0.008) |
0x8 (0.008) |
0x8 (0.008) |
0x8 (0.008) |
Table 5. Available EPLD Images for the Cisco Nexus 9500 Switches with R Line Card
Release 10.3(7) |
Release 10.4(1) |
Release 10.4(2) |
Release 10.4(3) |
Release 10.4(4) |
Release 10.4(5) |
Release 10.4(6) |
||
36-port 100-Gigabit QSFP28 line card (N9K-X9636C-RX) |
IOFPGA |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
0x18 (0.024) |
MIFPGA |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
|
36-port 100-Gigabit QSFP28 line card (N9K-X9636C-R) |
IOFPGA |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
0x12 (0.018) |
MIFPGA |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
0x9 (0.009) |
|
36-port 40-Gigabit QSF+ line card |
IOFPGA |
0x19 (0.025) |
0x19 (0.025) |
0x19 (0.025) |
0x19 (0.025) |
0x19 (0.025) |
0x19 (0.025) |
0x19 (0.025) |
MIFPGA |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
0x3 (0.003) |
|
52-port 100-Gigabit –R line cards |
IOFPGA |
0xD |
0xD |
0xD |
0xD |
0xD |
0xD |
0xD |
MIFPGA |
0xF |
0xF |
0xF |
0xF |
0xF |
0xF |
0xF |
|
0xE |
0xE |
0xE |
0xE |
0xE |
0xE |
0xE |
||
Fabric module for Cisco Nexus 9504 |
IOFPGA |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
0x7 (0.007) |
Fabric module for Cisco Nexus 9508 100-Gigabit –R line cards (N9K-C9508-FM-R) |
IOFPGA |
0x10 (0.016) |
0x10 (0.016) |
0x10 (0.016) |
0x10 (0.016) |
0x10 (0.016) |
0x10 (0.016) |
0x10 (0.016) |
Table 6. Available EPLD images for the Cisco Nexus 9800 platform switches
Component |
EPLD |
Release 10.3(7) |
Release 10.4(1) |
Release 10.4(2) |
Release 10.4(3) |
Release 10.4(4) |
Release 10.4(5) |
Release 10.4(6) |
N9K-C9800-SUP-A |
TMFPGA |
0x010006 |
0x010006 |
0x010006 |
0x010006 |
0x010006 |
0x010006 |
0x010006 |
IOFPGA |
0x010020
|
0x010020 |
0x010020 |
0x010020 |
0x010020 |
0x010020 |
0x010020 |
|
N9K-X9836DM-A |
IOFPGA |
0x10030 |
0x10024 |
0x10024 |
0x10030 |
0x10030 |
0x10030 |
0x10030 |
MIFPGA |
0x1000e |
0x1000d |
0x1000e |
0x1000e |
0x1000e |
0x1000e |
0x1000e |
|
N9K-X98900CD-A |
IOFPGA |
N/A |
N/A |
0x0005b |
0x0005b |
0x00061 |
0x00061 |
0x00061 |
MIFPGA |
N/A |
N/A |
0x1000c |
0x1000c |
0x1000c |
0x1000c |
0x1000c |
|
N9K-C9804-FM-A |
IOFPGA |
0x10002 |
0x10002 |
0x10002 |
0x10002 |
0x10002 |
0x10002 |
0x10002 |
N9K-C9808-FM-A |
MIFPGA |
0x10002 |
0x10002 |
0x10002 |
0x10002 |
0x10002 |
0x10002 |
0x10002 |
Determine whether to upgrade EPLD images
If the current EPLD image number for a card is greater than or matches the version expected for your current NX-OS software version, you can skip the upgrade.
To determine the EPLD upgrades needed for a Cisco Nexus 9000 Series switch running 10.4(6) software, use the show install impact epld bootflash:<filename> command on that switch, where the filename given for this release is the n9000-epld.10.4.6.img file. First, copy this file to the bootflash to proceed. In this example, the MIFPGA and IOFPGA EPLD images do not need to be upgraded.
Step 1. Copy the n9000-epld.10.4.6.img file to the bootflash.
Step 2. To determine the EPLD upgrades needed for a Cisco Nexus 9000 Series switch running 10.4(6) software, enter the following command:
show install impact epld bootflash:<filename>
For example:
switch# show install all impact epld n9000-epld.10.4.6.img
Retrieving EPLD versions.... Please wait.
Images will be upgraded according to the table:
Module Type EPLD Running-Version New-Version Upg-Required
------ ---- ------------- --------------- ----------- ------------
1 LC MI FPGA 0x0f 0x0f No
1 LC IO FPGA 0x0d 0x0d No
1 LC DB FPGA 0x0e 0x0e No
21 FM IO FPGA 0x07 0x07 No
27 SUP IO FPGA 0x15 0x15 No
28 SUP IO FPGA 0x15 0x15 No
29 SC IO FPGA 0x20 0x20 No
30 SC IO FPGA 0x20 0x20 No
Compatibility check:
Module Type Upgradable Impact Reason
-------------------------------------------------------------
1 LC Yes disruptive Module Upgradable
21 SUP Yes disruptive Module Upgradable
27 SUP Yes disruptive Module Upgradable
28 SUP Yes disruptive Module Upgradable
29 SC Yes disruptive Module Upgradable
30 SC Yes disruptive Module Upgradable
Upgrade during ISSU
To upgrade your EPLD image using the ISSU command, enter the NX-OS and EPLD image to be installed using the install all nxos <nxos-image> epld <epld-image> command.
For additional information about ISSU, see the Cisco Nexus 9000 Series NX-OS Software Upgrade and Downgrade Guide.
Displaying the status of EPLD upgrades
To display the status of EPLD upgrades on the switch, enter the show install epld status command.
Limitations
● If a module is not online, you cannot upgrade its EPLD images.
● If there are two supervisors that are installed in the switch (Cisco Nexus 9504, 9508, and 9516 switches only), you can either upgrade only the standby or upgrade all modules (including both supervisor modules) by using these commands:
◦ install epld bootflash:<image-name> module standby-supervisor-slot-number (upgrades only the standby supervisor module)
Note: After you use this command, you can switchover the active and standby supervisor modules and then upgrade the other supervisor.
◦ install epld bootflash:<image-name> module all (upgrades all of the modules)
● If there is only one supervisor installed in the switch, the upgrade or downgrade of the EPLD images is disruptive.
Cisco secure boot hardware tampering vulnerability
This section details updating your EPLD version for affected switches listed in the link below.
Secure Boot Hardware Tampering Vulnerability advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190513-secureboot
The table provides the PIDs exposed to the issue, as well as the fixed IO FPGA version for each PID, for validation purposes.
Vulnerable products
These are the vulnerable products addressed in the Secure Boot Tampering Security Advisory (cisco-sa-20190513-secureboot).
Table 7. Nexus 9000 series switches affected by the Secure Boot Hardware Tampering Vulnerability
PID |
Fixed IO FPGA Version |
N9K-C93180YC-EX |
0x15
|
N9K-C93108TC-EX |
0x15
|
N9K-C93180YC-FX |
0x20
|
N9K-C93108TC-FX |
0x20
|
N9K-C9348GC-FXP |
0x10
|
N9K-C93240YC-FX2 |
0x10
|
N9K-C9336C-FX2 |
0x10
|
N9K-C9364C |
0x6
|
N9K-C9332C |
0x10
|
N9K-C93180YC-FX |
0x20
|
N9K-C9232C |
0x8
|
N9K-SUP-A+ |
0x14
|
N9K-SUP-B+ |
0x14
|
N9K-SUP-B |
0x30
|
N9K-SUP-A |
0x30
|
Cisco secure boot hardware tampering vulnerability - remediation steps
Nexus 9000 Modular chassis with dual supervisor
Note: Requirement–Update both golden and primary regions of FPGA to address this particular vulnerability. It is by design that we do not allow updating both primary and golden at the same time (to avoid programming errors that may cause switch to not boot, so only one region is allowed to be programmed per reload).
Do not attempt to upgrade golden region of the FPGA once it is on a fixed version.
Step 1. Copy the EPLD image to bootflash (e.g., this document will use the n9000-epld.10.4.6.img image).
Step 2. If you have dual supervisors, determine which is the standby supervisor by entering the command show module to verify the status of the supervisors, and start upgrading the standby first. On the Nexus 9500, only supervisors need to be upgraded to address this vulnerability. Line cards/fabric modules/system controllers are not affected.
Step 3. Assuming the standby supervisor is slot 28, update the primary FPGA region of the standby supervisor.
switch# install epld bootflash:n9000-epld.10.4.6.img module 28
Expected result: The switch will update the primary EPLD of the standby supervisor and will reload the standby supervisor module automatically. Do not interrupt, power cycle, or reload when EPLD update is happening. Once the standby is rebooted, it will again come up as the standby supervisor. The command show version module 28 epld will continue to show the old version.
Note: The CLI sequence used in this document is just an example. Your CLI sequence can be confirmed directly on the switch.
switch# show mod | grep SUP
27 0 Supervisor Module N9K-SUP-A active *
28 0 Supervisor Module N9K-SUP-A ha-standby <<< standby supervisor
27 9.3(0.416) 1.0 SUP1
28 9.3(0.416) 0.3011 SUP2
switch# show version module 28 epld
EPLD Device Version
---------------------------------------
IO FPGA 0x27
This is expected, as the switch would have booted from golden FPGA which is still not updated. You can verify this from the syslog which would say:
%CARDCLIENT-5-MOD_BOOT_GOLDEN: Module 28 IOFPGA booted from Golden
Step 4. Update the Golden (also called backup) FPGA region of the standby supervisor.
switch# install epld bootflash:n9000-epld.10.4.6.img module 28 golden
Module 28 : IO FPGA [Programming] : 100.00% ( 64 of 64 total sectors)
Module 28 EPLD upgrade is successful.
Module Type Upgrade-Result
------ ------------------ --------------
28 SUP Success
Expected result: The switch updates the golden EPLD of the standby supervisor and reloads the standby supervisor module automatically. Do not interrupt, power cycle, or reload when EPLD update is happening. Once standby is booted, it will again come up as the standby supervisor.
Once this is done, enter the show version module 28 epld to confirm the FPGA version is greater than or equal to the fixed version for the standby supervisor. Your switch has the fixed version for standby supervisor.
switch# show version module 28 epld
EPLD Device Version
---------------------------------------
IO FPGA 0x30
Repeat Steps 3 and 4 for the active supervisor. At the end of Step 3, the supervisor in slot 27 will reload and so now will become the standby supervisor. The active supervisor will be the supervisor in slot 28.
For the situation where the active supervisor is in the other slot, considering SUP 27 is active to begin with, for the above activity, such as Steps 3 and 4, commands would have swapped 27 in place of 28.
Log below shows what happens when the EPLD upgrade happens for the active supervisor:
Module 27 : IO FPGA [Programming] : 100.00% (64 of 64 sectors)
Module 27 EPLD upgrade is successful.
Module Type Upgrade-Result
------ ------------------ --------------
27 SUP Success
EPLDs upgraded. Performing switchover.
Once the supervisor in Slot 27 becomes ha-standby, complete Step 4 for Slot 27 and it will again boot and become the ha-standby. Both the supervisors now have the vulnerability fixed version of the FPGA.
At the end of the upgrades, the switch should boot with the primary EPLD image for both SUPs, as seen in the logs below:
switch# show logging log | grep -i fpga | grep -i 27
2019 Jul 10 07:55:04 switch %CARDCLIENT-5-MOD_BOOT_PRIMARY: Module 27 IOFPGA booted from Primary
switch# show logging log | grep -i fpga | grep -i 28
2019 Jul 10 07:58:01 switch %CARDCLIENT-5-MOD_BOOT_PRIMARY: Module 28 IOFPGA booted from Primary
Nexus 9000 Modular chassis with single supervisor
Note: Requirement–Update both golden and primary regions of FPGA to address this vulnerability. It is by design that we don't allow updating both primary and golden at the same time (to avoid programming errors that may cause switch to not boot, so only one region is allowed to be programmed per reload).
Do not attempt to upgrade Golden region of FPGA once it is on a fixed version.
Step 1. Copy the EPLD image to bootflash (e.g., this document will use the n9000-epld.10.4.6.img image).
Step 2. Assuming the supervisor is in slot 27, update the Primary FPGA region.
switch# install epld bootflash:n9000-epld.10.4.6.img module 27
Expected result: Switch will update the primary EPLD of the supervisor and will reload the switch automatically. Do not interrupt, power cycle, or reload when EPLD update is happening. Once the supervisor is booted, the command show version module 27 epld will continue to show the old version.
Note: The CLI sequence used in this document is just an example. Your CLI sequence can be confirmed directly on the switch.
switch# show version module 27 epld
-------------------------------------------------------------------
Name InstanceNum Version Date
-------------------------------------------------------------------
IO FPGA 0 0x27 20160111
BIOS version v08.35(08/31/2018)
Alternate BIOS version v08.32(10/18/2016)
This is expected, as the switch would have booted from the golden FPGA which is still not updated. You can verify this from the syslog which would say:
%CARDCLIENT-5-MOD_BOOT_GOLDEN: Module 27 IOFPGA booted from Golden
Step 3. Since in this case there is only one supervisor, next update the golden (also called the backup) FPGA region.
switch# install epld bootflash:n9000-epld.10.4.6.img module 27 golden
Module 27 : IO FPGA [Programming] : 100.00% (64 of 64 total sectors)
Module 27 EPLD upgrade is successful.
Module Type Upgrade-Result
------ ------------------ --------------
27 SUP Success
Expected result: The switch will update the golden EPLD of the supervisor and will reload the switch automatically. Do not interrupt, power cycle, or reload the device while the EPLD update is in progress.
Once this is done, when you enter the command show version module 27 epld to confirm that the FPGA version is greater than or equal to the fixed version for the supervisor. Your supervisor now has the vulnerability fixed version of FPGA.
switch# show version module 27 epld
-------------------------------------------------------------------
Name InstanceNum Version Date
-------------------------------------------------------------------
IO FPGA 0 0x30 20190625
BIOS version v08.35(08/31/2018)
Alternate BIOS version v08.32(10/18/2016)
At the end of the upgrades, the switch should boot with the primary EPLD for the supervisor. The log to check is seen below:
switch# show logging log | grep -i fpga | grep -i 27
2019 Jul 10 07:55:04 switch %CARDCLIENT-5-MOD_BOOT_PRIMARY: Module 27 IOFPGA booted from Primary
Note: If you attempt to upgrade the golden region of the FPGA once it is on the fixed version, the system will not automatically allow you to upgrade the golden region of the supervisor and will provide the prompt seen below:
switch# install epld bootflash:n9000-epld.10.4.6.img module all golden
Digital signature verification is successful
Compatibility check:
Module Type Upgradable Impact Reason
------ ----------------- ---------- ---------- ------
22 FM Yes disruptive Module Upgradable
24 FM Yes disruptive Module Upgradable
27 SUP No none Golden Not Upgradable
28 SUP No none Golden Not Upgradable
29 SC Yes disruptive Module Upgradable
30 SC Yes disruptive Module Upgradable
Retrieving EPLD versions.... Please wait.
Images will be upgraded according to this table:
Module Type EPLD Running-Version New-Version Upg-Required
------ ---- ------------- --------------- ----------- ------------
22 FM IO FPGA 0x19 0x19 Yes
24 FM IO FPGA 0x19 0x19 Yes
29 SC IO FPGA 0x17 0x20 Yes
30 SC IO FPGA 0x17 0x20 Yes
Module 27 (EPLD ver 0x29) Golden upgrade not supported
Module 28 (EPLD ver 0x30) Golden upgrade not supported
The above modules require upgrade.
Since both System Controller modules need an upgrade, a chassis reload will happen at the end of the upgrade.
Do you want to continue (y/n) ? [n] y
Nexus 9000 TOR (standalone chassis) switch
Note: It is required to update both the golden and primary regions of the FPGA to address this vulnerability. It is by design that we don't allow updating both primary and golden at the same time (to avoid programming errors that may lead to switch boot failure), so only one FPGA region is allowed to be programmed per reload.
Do not attempt to upgrade golden region of FPGA once it is on a fixed version.
Step 1. Copy the EPLD image to bootflash (e.g., this document will use the n9000-epld.10.4.6.img image).
Step 2. Update the primary FPGA region.
switch# install epld bootflash:n9000-epld.10.4.6.img module all
Expected result: The switch will update the EPLD and will reload automatically. Do not interrupt, power cycle, or reload the switch while the EPLD update is in progress. The switch will boot up with the golden FPGA. The command show version module 1 epld will show the old IO FPGA version at this time. This is expected.
Note: The CLI sequence used in this document is just an example. Your CLI sequence can be confirmed directly on the switch.
switch# show version module 1 epld
-------------------------------------------------------------------
Name InstanceNum Version Date
-------------------------------------------------------------------
IO FPGA 0 0x06 20180920
MI FPGA 0 0x01 20170609
BIOS version v01.14(06/15/2019)
Alternate BIOS version v01.12(07/25/2018)
You can verify this from syslog which would say:
%CARDCLIENT-5-MOD_BOOT_GOLDEN: Module 1 IOFPGA booted from Golden
%CARDCLIENT-2-FPGA_BOOT_GOLDEN: IOFPGA booted from Golden
Step 3. Update the golden (also called backup) FPGA region.
switch# install epld bootflash:n9000-epld.10.4.6.img module all golden
Expected result: The switch will update the EPLD image and will reload automatically. Do not interrupt, power cycle, or further reload the switch when the EPLD update is in progress.
Once this is done, when you check show version module 1 epld, you will see an FPGA version that is greater than or equal to the fixed version.
switch# show version module 1 epld
-------------------------------------------------------------------
Name InstanceNum Version Date
-------------------------------------------------------------------
IO FPGA 0 0x07 20180920
MI FPGA 0 0x01 20170609
BIOS version v01.14(06/15/2019)
Alternate BIOS version v01.12(07/25/2018)
After the upgrade is complete, the switch should boot up with the primary EPLD image as shown in the logs below:
switch# show logging log | grep -i fpga
2019 Jul 9 19:46:11 switch %CARDCLIENT-2-FPGA_BOOT_PRIMARY: IOFPGA booted from Primary
2019 Jul 9 19:46:11 switch %CARDCLIENT-2-FPGA_BOOT_PRIMARY: MIFPGA booted from Primary
2019 Jul 9 19:46:11 switch %CARDCLIENT-5-MOD_BOOT_PRIMARY: Module 1 IOFPGA booted from Primary
2019 Jul 9 19:46:11 switch %CARDCLIENT-5-MOD_BOOT_PRIMARY: Module 1 MIFPGA booted from Primary
Related documentation
Document |
Description |
Release Notes for Cisco NX-OS 9000 series switches |
|
Documentation for Cisco NX-OS 9000 series switches |
Documentation feedback
To provide technical feedback on this document, or to report an error or omission, please send your comments to nexus9k-docfeedback@cisco.com. We appreciate your feedback.
Legal information
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2025 Cisco Systems, Inc. All rights reserved.