Outlines the process and benefits of upgrading NX-OS software on Nexus switches, detailing disruptive, non-disruptive, and min-disruptive ISSU methods, their prerequisites, procedures, platform-specific considerations, and impact on network stability and downtime.
A software upgrade on a switch involves updating the operating system (OS) or firmware running on the switch and is performed to provide:
-
Security patching: Addressing known vulnerabilities to protect the network from potential exploits.
-
Bug fixes: Resolving software-related issues that may cause instability or unexpected behavior.
-
Feature enhancement: Enabling new software-defined networking (SDN) capabilities, improved management protocols, or better traffic optimization features.
Upgrading a Nexus switch running NX-OS is a critical operation that requires careful planning to ensure network stability. The process typically involves, downloading the software image, verifying the compatibility between the current version and the target version, checking for hardware requirements, and utilizing the install all command, which automates the upgrade process and performs compatibility checks.
The two types of NX-OS software upgrade are:
-
Disruptive upgrade
-
Non-disruptive In-Service Software Upgrade (ND ISSU)
Disruptive upgrade
A disruptive upgrade is the default upgrade process that requires a reload or cold reboot of the Nexus device and any connected Fabric Extenders (FEX). This reload disrupts both the control plane and the data plane, causing downtime and traffic interruption.
Disruptive upgrades are necessary when non-disruptive upgrade prerequisites are not met, or when upgrading between incompatible images, which may result in configuration loss, for example, unified ports, breakout, and FEX configurations.
Disruptive upgrade is supported on all NX-OS platforms but causes downtime during the upgrade. For example, in Nexus 9000 Series with single supervisors, disruptive upgrade causes the supervisor CPU to reset and reload the new software, disrupting control plane and data plane during the process.
The reload causes disruptions to connected servers and hosts, but in vPC deployments, traffic is minimized by routing through the peer switch during upgrade.
Use the install all nxos bootflash:<filename> command for disruptive upgrade.
Example
install all nxos bootflash:nxos64-cs.10.6.2.F.binFor a sample display for disruptive upgrade, refer to the Disruptive ISSU for CloudScale TOR and Silicon One EOR sections.
Non-disruptive In-Service Software Upgrade
Non-disruptive In-Service Software Upgrade (ND ISSU) allows upgrading the device software while the switch continues to forward traffic, minimizing or eliminating downtime.
Non-disruptive ISSU requires meeting specific prerequisites, such as compatible software releases, supported hardware platforms, and ISSU-ready topology and features. Few features and configurations are not supported during non-disruptive ISSU, and certain platforms or configurations only support disruptive ISSU.
Non-disruptive ISSU requires careful configuration, such as setting appropriate BGP graceful restart timers and avoiding configuration changes during the upgrade.
Non-disruptive ISSU is further classified as:
-
Non-Disruptive ISSU for Cloud Scale switches
-
Enhanced ISSU (default)
Enhanced ISSU uses Linux containers (LXC) to run virtual instances of supervisor modules and line cards, enabling the upgrade with minimal impact. With Enhanced ISSU, the software runs inside a separate Linux container for the supervisor and line card. On the TOR, two additional containers are created and brought up as the standby supervisor and standby line card respectively.
The virtual instances or linus containers communicate with each other using an emulated Ethernet connection. In the normal state, only two Linux containers are instantiated: vSup1, a virtual SUP container in an active role, and vLC, a virtual linecard container.
Use the install all nxos bootflash:<filename> non-disruptive command for disruptive upgrade.
Example:
install all nxos bootflash:nxos64-cs.10.6.2.F.bin non-disruptive.For switches in LXC boot mode, the enhanced LXC upgrade falls back to standard ND ISSU because the target image kernels are likely different from the current image. In standard ISSU, the CPU reset domain uses a kexec system call to boot into the new image after NX-OS components save their state. Kexec allows a new Linux kernel-based image to be loaded and booted from the currently running kernel.
For samples of display for Non-disruptive ISSU, refer to the Non-Disruptive ISSU for Cloudscale TOR section.
-
-
Min-disruptive ISSU for Silicon One switches
-
Standard ISSU only
Beginning with NX-OS Release 10.6(3)F, min-disruptive (MD) ISSU, or minimally disruptive ISSU, is introduced only on Nexus 9364E-SG2 Silicon One-based TORs. While performing MD ISSU, any minimal packet disruption is displayed to the user.
The drop-time information is also shown in the output of the
show install all min-disruptive drop-timecommand.switch# show install all min-disruptive drop-time Estimated traffic outage time for current upgrade : about 65 msWhile performing a min-disruptive ISSU, increase the routing protocol graceful restart timer to a higher value. The recommended value for graceful restart timer is 240 seconds, although this value can be adjusted based on the configuration scale.
If network topology changes during MD ISSU cause few SUP apps not to proceed with the upgrade, then MD ISSU is aborted and the upgrade becomes disruptive. Furthermore, if any SUP app responds with failure, MD ISSU is aborted and the upgrade becomes disruptive.
The output of the show install all status command now shows min-disruptive.
Use the install all nxos bootflash:<filename> min-disruptive command for disruptive upgrade.
Example
install all nxos bootflash:nxos64-s1.10.6.2.F.bin min-disruptive.For a sample of display for min-disruptive ISSU, refer to the Min-Disruptive ISSU on Silicon One TOR section.
-