Cisco Nexus 9000 Series NX-OS Software Upgrade and Downgrade Guide, Release 10.6(x)

PDF

Red Hat Package Managers

Updated: February 5, 2026

Overview

Learn about Red Hat Package Managers (RPMs) and how NX-OS that is built on a Linux kernel leverages the RPM framework to provide Optionality—the ability to customize the switch's software footprint by adding or removing components without needing to replace the entire system image.

You can upgrade or downgrade Red Hat Package Manager (RPM) to a new software version using NX-OS install commands or DNF commands. An upgradable RPM can be optional or mandatory.

Note

During the boot-up process of NX-OS, signed RPMs remain in memory while the image extraction stage takes place. However, this method is not the most efficient in terms of memory consumption. As of NX-OS Release 10.4(3)F, after the system reaches a stable state and adequate SSD space is accessible, the RPMs are transferred from memory to persistent storage. This feature is supported on N9K-C92348GC-X and all Nexus 9300 TOR switches.

See the following sections for more information about optional and mandatory RPMs.

Format of the RPM

This section describes the general format and naming convention of RPM files for NX-OS features.

The general format of a RPM is <name>-<version>-<release>.<arch>.rpm. The same format is followed for NX-OS feature RPMs.

  • Name: package name, for example, BGP

  • Version in <x.y.x.b> format: <major.minor.patch.build_number>, for example, 2.0.1.0

  • Release: The branch from which the RPM is created, for example, 9.2.1

  • Arch: The architecture type of the RPM, for example, lib32_n9000

This table provides more information on the naming convention, for example, fex-2.0.0.0-9.2.1.lib32_n9000.rpm.

Table 1. RPM naming convention

RPM Naming Convention

Example: fex-2.0.0.0-9.2.1.lib32_n9000.rpm

Description

fex

Indicates the name of the component.

2

Indicates that the RPM is not backward compatible. Configuration loss takes place during an upgrade.

0

Indicates the incremental API changes/command changes/Schema changes with backward compatibility. It is applicable to the new features on top of the existing capabilities. No configuration is lost during an upgrade.

0

Indicates a bug fix without any functionality change. No configuration is lost during an upgrade.

0

This number tracks how many times the component has changed during the development cycle of a release. This value will be 0 for all the release images.

9.2.1

Indicates the release number or the distribution version for the RPM. It aligns to the NVR format. Since the feature RPM is only applicable to a NXOS release, this field has NXOS release version number present.

lib32_n9000

Indicates the architecture type of the RPM.

Optional RPMs and their associated features

The optional RPMs are the RPMs that can be installed to enable the features without affecting the native NX-OS behavior or they can be removed using the install deactivate command from the switch.

Optional RPMs, for example, EIGRP are not a part of the base software. They can be added, upgraded, and removed as required using either dnf or install commands from the switch.

This table contains the list of the optional RPMs and their associated features.

Table 1. List of optional RPMs and their associated features

Package Name

Associated Features

APP HOSTING

feature app-hosting

BGP

feature bgp

BFD

feature bfd

Container-tracker

feature container-tracker

EIGRP

feature eigrp

Ext-Eth

  • feature openflow

  • feature evb

  • feature imp

  • feature netflow

  • feature sla_sender

  • feature sla_responder

  • feature sla twamp-server

  • feature sflow

EXT_ETH_LOWMEM

  • feature evb

  • feature netflow

FCoE

  • feature-set fcoe

  • feature-set fcoe-npv

FEX

feature-set fex

FHRP

  • feature hsrp

  • feature vrrpv3

HW TELEMETRY

feature hw telemetry

iCAM

feature icam

ISIS

feature isis

MPLS

  • feature mpls segment-routing

  • feature mpls evpn

Multicast

  • feature pim

  • feature pim6

  • feature msdp

  • feature ngmvpn

NIA

NA

NXSDK

NA

OSPF

  • feature ospf

  • feature ospfv3

RIP

feature rip

SDAA

NA

Services

feature catena

SR

feature mpls segment-routing traffic-engineering

TELEMETRY

feature telemetry

Virtualization

NA

VM Tracker

feature vmtracker

VXLAN

  • feature nv overlay

  • feature fabric forwarding

Guidelines for NX-OS feature RPM installation

The NX-OS system RPM repositories are present in NX-OS Series switches for RPM management.

Note

Avoid manually copying the RPMs to system repositories. Instead use the install or DNF commands.

Table 1. RPM repositories that are present in the switches

Repository Name

Repository Path

Description

groups-repo

/rpms

Part of the bundled NX-OS image. It is used to keep all the RPMs that are bundled as part of the NX-OS image. All RPMs based in this repository are known as base RPMs.

localdb

/bootflash/.rpmstore/patching/localrepo

Used for RPM persistency. When a user adds a NX-OS feature RPM as part of install add command, the RPM is copied to this location and it is persisted during the reloads. User has the responsibility to clean the repository.

To add a RPM to this repository, use install add command.

To remove a RPM from this repository, use install remove command.

DNF commands can be used to populate the repository too.

The maximum space for the repository is 200Mb along with the patching repository for Nexus 9000 Series switches except Nexus 3000 Series switches. For Nexus 3000 Series switches, the maximum space for the repository is 20 Mb only.

patching

/bootflash/.rpmstore/patching/patchrepo

Used for RPM persistency. When a user adds a NX-OS patch RPM to the switch, the patch RPM is copied to this repository.

thirdparty

/bootflash/.rpmstore/thirdparty

Used for RPM persistency when a user adds a third party RPM.

The groups-repo and localdb repositories hold the NX-OS feature RPMs that should be installed during the system boot or during activation. DNF commands or install command can be used for the installation or the removal of these RPMs.

The listed rules are applied to the feature RPM installation procedure during boot or install time:

  • Only RPMs with the same NX-OS release number should be selected for the installation.

  • Base RPMs cannot be added to the localdb repository.

Guidelines for third-party RPM installation

In releases prior to 10.1(x), you can install any third-party package on the device, even if it is not provided or signed by Cisco.

Starting with release 10.1(x) any third-party package that is not signed by Cisco is not allowed to be installed on the device. However, if you wish to bypass this and install the software, you can configure the device to enable the third-party software installation. The configuration persists as a normal configuration and can be verified by using the running-config command. Following this configuration, you can install any third-party software with the known risks.

Install command options for feature and third-party RPMs

Use the reference table for using install commands for the feature RPM operations.

Table 1. Reference for install commands for the feature RPM operations

Command

Description

install reset

This operation removes all the patches, persisted configurations, upgraded packages, third-party installed packages, unsaved configurations, and reloads the switch's previous mode (Full/Base) with the default packages.

The install reset command also performs write erase operation. The following message is displayed at the prompt:


switch(config)# install reset 
======================================================
WARNING!!This operation will remove all pactches, upgraded packages,
persisted etc configs, third party packages installed,
startup configuration(write erase) and
reload the switch with default packages.
=======================================================
Do you want to proceed with reset operation? (y/n)? [n]

install reset nxos base

This operation installs NX-OS in base mode by removing all patches, upgraded packages, persisted etc configurations, third-party packages installed, startup configuration (write erase), and reloads the switch with the default packages.

install reset nxos full

This operation installs NX-OS with full mode by removing all patches, upgraded packages, persisted etc configs, third-party packages installed, startup configuration (write erase), and reloads the switch with the default packages (with mandatory and optional RPMs).

install add <>

Adds an RPM file to the respective repository and updates the repository (patch/feature/third-party ).

install activate <rpm name>

Installs an RPM that is present in the repository.

install commit <rpm name>

Used for the patch RPMs. Makes the patch persist during the reload.

install deactivate <rpm name>

Uninstalls an RPM.

Beginning with NX-OS Release 10.1(1), when you use this command to deactivate RPMs, the options to either downgrade to the base version of RPM or to uninstall RPM appear. You can select the option that you desire and the operation will proceed.

install remove <rpm name>

Removes an RPM file from the repository and updates the repository.

sh install active

Displays the list of the installed RPMs in the system apart from base rootfs RPMs. (features/patch/third-party).

sh install inactive

Displays the list of the RPMs that are present in the repository but they are not installed.

sh install packages

Lists all the RPMs that are installed including rootfs RPMs.

[no] system software allow third-party

Beginning with NX-OS Release 10.1(1) the third-party RPM installations are not allowed to be installed on the device by default. This command bypasses this restriction and configures the device to enable the third-party software installation.

The following command shows the error message when you activate third-party RPM without applying the third-party configuration:

switch(config)# install activate pbwMonitor-1.0-1.5.0.x86_64.rpm

Install operation 193 failed because package is not signed by Cisco.Enable TPS installation using 'system software allow third-party' CLI at Tue Nov 17 04:23:10 2020

The following command shows activating third-party RPM installations after applying the configuration: 

switch(config)# system software allow third-party 
switch(config)# 2020 Nov 17 04:25:41 switch %$ VDC-1 %$  %USER-2-SYSTEM_MSG: <<%PATCH-INSTALLER-2-TPS_FEATURE_ENABLED>> User has enabled TPS installation - patch_installer

switch(config)# install activate pbwMonitor-1.0-1.5.0.x86_64.rpm
[####################] 100%
Install operation 194 completed successfully at Tue Nov 17 04:25:58 2020

The following command shows disabling the third-party configuration:

switch(config)# no system software allow third-party 
switch(config)# 2020 Nov 17 04:27:17 switch %$ VDC-1 %$  %USER-2-SYSTEM_MSG: <<%PATCH-INSTALLER-2-TPS_FEATURE_DISABLED>> User has disabled TPS installation - patch_installer
Note

If you are using ISSU or upgrading to NX-OS Release 10.1.1 release from an earlier version, you must manually apply the third-party configuration within the first 30 minutes after the upgrade to ensure the third-party RPMs get installed.

Use install commands for digital signature support

Use the install commands for digital signature support.

Procedure

1.

Import and add a GPG (GNU Privacy Guard) key from a file located in the bootflash using the install add bootflash:<keyfile> gpg-key command.

Example:

switch# install add bootflash:RPM-GPG-KEY-puppetlabs gpg-key
[####################] 100%
Install operation 304 completed successfully at Thu Jun 19 16:40:28 2018

Release RPMs are signed with GPG (GNU Privacy Guard) key. The public GPG key is present at /etc/pki/rpm-gpg/arm-Nexus9k-rel.gpg . To add other public keys from different sources, use the steps in this section.
2.

Use one of the two steps to verify whether the RPM file is a signed or non-signed file.

  1. Verify that the package is a signed file using the install verify package <package-name> command.

  2. Verify that the RPM file is a signed file using the install verify bootflash:<RPM file> command.

    Example:

    switch# install verify bootflash:vxlan-2.0.0.0-9.2.1.lib32_n9000.rpm

RSA signed
switch#

Query all installed RPMs

Perform this step to query all the installed RPMs

Procedure

Query all the installed RPMs using the show install packages command.

Example:

switch# show install packages 
 
Boot Image:
NXOS Image: bootflash:/nxos.9.2.1.bin

----------------------------------------------------
Installed Packages
attr.x86_64 2.4.47-r0.0 installed Unsigned
aufs-util.x86_64 3.14+git0+b59a2167a1-r0.0 installed Unsigned
base-files.n9000 3.0.14-r89.0 installed Unsigned
base-passwd.lib32_x86 3.5.29-r0.1.0 installed Unsigned
bash.lib32_x86 4.3.30-r0.0 installed Unsigned
bfd.lib32_n9000 2.0.0.0-9.2.1 installed Signed
bgp.lib32_n9000 2.0.0.0-9.2.1 installed Signed
binutils.x86_64 2.25.1-r0.0 installed Unsigned
bridge-utils.x86_64 1.5-r0.0 installed Unsigned
busybox.x86_64 1.23.2-r0.0 installed Unsigned
busybox-udhcpc.x86_64 1.23.2-r0.0 installed Unsigned
bzip2.x86_64 1.0.6-r5.0 installed Unsigned
ca-certificates.all 20150426-r0.0 installed Unsigned
cgroup-lite.x86_64 1.1-r0.0 installed Unsigned
chkconfig.x86_64 1.3.58-r7.0 installed Unsigned
container-tracker.lib32_n9000 2.0.0.0-9.2.1 installed Signed
containerd-docker.x86_64 0.2.3+gitaa8187dbd3b7ad67d8e5e3a15115d3eef43a7ed1-r0.0
installed Unsigned
core.lib32_n9000 2.0.0.0-9.2.1 installed Signed
coreutils.lib32_x86 8.24-r0.0 installed Unsigned
cpio.x86_64 2.12-r0.0 installed Unsigned
cracklib.lib32_x86 2.9.5-r0.0 installed Unsigned
cracklib.x86_64 2.9.5-r0.0 installed Unsigned
createrepo.x86_64 0.4.11-r9.0 installed Unsigned
cronie.x86_64 1.5.0-r0.0 installed Unsigned
curl.lib32_x86 7.60.0-r0.0 installed Unsigned
db.x86_64 6.0.30-r0.0 installed Unsigned
dbus-1.lib32_x86 1.8.20-r0.0 installed Unsigned
dhcp-client.x86_64 4.3.2-r0.0 installed Unsigned
dhcp-server.x86_64 4.3.2-r0.0 installed Unsigned
switch#

Install RPMs using the one-step procedure

The commands for both install and upgrade RPMs are the same. Use this one-step procedure to install the RPMs.

Procedure

1.

Install and activate the RPM using the install add <rpm> activate command.

Example:

switch# install add bootflash:chef.rpm activate
Adding the patch (/chef.rpm)
[####################] 100%
Install operation 868 completed successfully at Tue May  8 11:20:10 2018
 
Activating the patch (/chef.rpm)
[####################] 100%
Install operation 869 completed successfully at Tue May  8 11:20:20 2018
2.

Verify the output of the show install active command.

Example:

switch# show install active
Boot Image:
        NXOS Image: bootflash:/nxos.9.2.1.bin
 
Active Packages:
bgp-2.0.1.0-9.2.1.lib32_n9000
chef-12.0.0alpha.2+20150319234423.git.1608.b6eb10f-1.el5.x86_64
 
Active Base Packages:
        lacp-2.0.0.0-9.2.1.lib32_n9000
        lldp-2.0.0.0-9.2.1.lib32_n9000
        mtx-device-2.0.0.0-9.2.1.lib32_n9000
        mtx-grpc-agent-2.0.0.0-9.2.1.lib32_n9000
        mtx-infra-2.0.0.0-9.2.1.lib32_n9000
        mtx-netconf-agent-2.0.0.0-9.2.1.lib32_n9000
        mtx-restconf-agent-2.0.0.0-9.2.1.lib32_n9000
        mtx-telemetry-2.0.0.0-9.2.1.lib32_n9000
        ntp-2.0.0.0-9.2.1.lib32_n9000
        nxos-ssh-2.0.0.0-9.2.1.lib32_n9000
        snmp-2.0.0.0-9.2.1.lib32_n9000
        svi-2.0.0.0-9.2.1.lib32_n9000
        tacacs-2.0.0.0-9.2.1.lib32_n9000
        vtp-2.0.0.0-9.2.1.lib32_n9000

Install RPMs using the two-step procedure

The commands for both install and upgrade RPMs are the same. Use this two-step procedure to install the RPMs.

Procedure

1.

Install the RPM using the install add <rpm> command.

Example:

switch# install add bootflash:vxlan-2.0.1.0-9.2.1.lib32_n9000.rpm
  
[####################] 100%
Install operation 892 completed successfully at Thu Jun  7 13:56:38 2018
2.

Verify using the show install inactive command.

Example:

switch(config)# show install inactive | grep vxlan
vxlan-2.0.1.0-9.2.1.lib32_n9000
3.

Activate the RPM using the install activate <rpm> command.

Example:

switch# install activate vxlan

[####################] 100%
Install operation 891 completed successfully at Thu Jun  7 13:53:07 2018
4.

Verify using the show install active command.

Example:

switch# show install active | grep vxlan
vxlan-2.0.0.0-9.2.1.lib32_n9000
switch# show install inactive | grep vxlan
switch#

Upgrade the RPMs

The commands for both install and upgrade RPMs are the same. Perform this procedure to upgrade the RPMs:

Procedure

1.

Install the RPM using the install add <rpm>activate upgrade command.

Example:

switch(config)# install add bootflash:bgp-2.0.2.0-9.2.1.lib32_n9000.rpm activate upgrade

Adding the patch (/bgp-2.0.2.0-9.2.1.lib32_n9000.rpm)
[####################] 100%
Install operation 870 completed successfully at Tue May 8 11:22:30 2018

Activating the patch (/bgp-2.0.2.0-9.2.1.lib32_n9000.rpm)
[####################] 100%
Install operation 871 completed successfully at Tue May 8 11:22:40 2018
2.

Verify the output using the show install active command.

Example:

switch(config)# show install active

Boot Image:
NXOS Image: bootflash:/nxos.9.2.1.bin

Active Packages:
bgp-2.0.2.0-9.2.1.lib32_n9000
chef-12.0.0alpha.2+20150319234423.git.1608.b6eb10f-1.el5.x86_64

Active Base Packages:
lacp-2.0.0.0-9.2.1.lib32_n9000
lldp-2.0.0.0-9.2.1.lib32_n9000
mtx-device-2.0.0.0-9.2.1.lib32_n9000
mtx-grpc-agent-2.0.0.0-9.2.1.lib32_n9000
mtx-infra-2.0.0.0-9.2.1.lib32_n9000
mtx-netconf-agent-2.0.0.0-9.2.1.lib32_n9000
mtx-restconf-agent-2.0.0.0-9.2.1.lib32_n9000
mtx-telemetry-2.0.0.0-9.2.1.lib32_n9000
ntp-2.0.0.0-9.2.1.lib32_n9000
nxos-ssh-2.0.0.0-9.2.1.lib32_n9000
snmp-2.0.0.0-9.2.1.lib32_n9000
svi-2.0.0.0-9.2.1.lib32_n9000
tacacs-2.0.0.0-9.2.1.lib32_n9000
vtp-2.0.0.0-9.2.1.lib32_n9000

Downgrade RPMs

The downgrade procedure needs a special command attribute. Downgrade the RPMs using the one-step procedure.

Procedure

1.

Downgrade the RPM using the install add <rpm>activate downgrade command.

Example:

switch(config)# install add bootflash:bgp-2.0.1.0-9.2.1.lib32_n9000.rpm activate downgrade


Adding the patch (/bgp-2.0.1.0-9.2.1.lib32_n9000.rpm)
[####################] 100%
Install operation 872 completed successfully at Tue May 8 11:24:43 2018
 
Activating the patch (/bgp-2.0.1.0-9.2.1.lib32_n9000.rpm)
[####################] 100%
Install operation 873 completed successfully at Tue May 8 11:24:52 2018
2.

Verify the output using the show install active command.

Example:

switch(config)# show install active
Boot Image:
 NXOS Image: bootflash:/nxos.9.2.1.bin
 
Active Packages:
 bgp-2.0.1.0-9.2.1.lib32_n9000
 chef-12.0.0alpha.2+20150319234423.git.1608.b6eb10f-1.el5.x86_64
 
Active Base Packages:
 lacp-2.0.0.0-9.2.1.lib32_n9000
 lldp-2.0.0.0-9.2.1.lib32_n9000
 mtx-device-2.0.0.0-9.2.1.lib32_n9000
 mtx-grpc-agent-2.0.0.0-9.2.1.lib32_n9000
 mtx-infra-2.0.0.0-9.2.1.lib32_n9000
 mtx-netconf-agent-2.0.0.0-9.2.1.lib32_n9000
 mtx-restconf-agent-2.0.0.0-9.2.1.lib32_n9000
 mtx-telemetry-2.0.0.0-9.2.1.lib32_n9000
 ntp-2.0.0.0-9.2.1.lib32_n9000
 nxos-ssh-2.0.0.0-9.2.1.lib32_n9000
 snmp-2.0.0.0-9.2.1.lib32_n9000
 svi-2.0.0.0-9.2.1.lib32_n9000
 tacacs-2.0.0.0-9.2.1.lib32_n9000
 vtp-2.0.0.0-9.2.1.lib32_n9000
switch(config)#

Uninstall the RPMs

Perform this procedure to uninstall the RPMs.

Procedure

Downgrade to the base version of RPM, if one exists in the groups-repo (/rpms), or uninstall the RPM completely from the switch using the install deactivate <rpm> command.

  • To downgrade to the base version, enter y .

  • To completely uninstall the RPM, enter n in the command prompt.

Example:

switch(config)# install deactivate bgp
Base RPM found. Do you want to downgrade to base version(y/n) [n] y     
Downgrading to the base version
[####################] 100%
Install operation 190 completed successfully at Tue Nov 17 04:10:40 2020

Example:

switch(config)# install deactivate bgp
Base RPM found. Do you want to downgrade to base version(y/n) [n] n

=================================================================================
 WARNING!!
 This operation will remove 'bgp-3.0.0.0-9.4.1.lib32_n9000' related configuration from running-configuration
 on successful completion. Update startup-configuration accordingly.
==================================================================================
[####################] 100%
Install operation 9 completed successfully at Tue Nov 17 05:05:59 2020

Remove the RPMs

Perform this procedure to remove the RPMs.

Procedure

Remove the RPM from the repository using the install remove <rpm> command.

Example:

switch(config)# show install inactive | grep vxlan
      
vxlan-2.0.0.0-9.2.1.lib32_n9000
switch(config)# install remove vxlan

Proceed with removing vxlan? (y/n)?  [n] y
[####################] 100%
Install operation 890 Removal of base rpm package is not permitted  at Thu Jun  7 13:52:15 2018