Cisco Catalyst SD-WAN Upgrade Guide

PDF

Cisco Catalyst SD-WAN Upgrade Guide

Software upgrade information

Updated: July 1, 2026

Want to summarize with AI?

Log in

Explains how to upgrade software images on Cisco Catalyst SD-WAN devices using the Software Upgrade window and describes the workflow and operational considerations for centralized upgrades.

Software upgrade information is a device management topic that

  • enables downloading and upgrading software images on Cisco Catalyst SD-WAN devices

  • supports centralized upgrades from Cisco SD-WAN Manager for single or multiple devices, and

  • provides workflow features and operational guidance for upgrade sequencing and device compatibility.

Software upgrade workflow details

Use the Software Upgrade window to download new software images and upgrade the software image running on a Cisco Catalyst SD-WAN device.

From a centralized Cisco SD-WAN Manager, you can upgrade the software on Cisco Catalyst SD-WAN devices in the overlay network and reboot them with the new software. You can do this for a single device or for multiple devices simultaneously.

When you upgrade a group of Cisco Catalyst SD-WAN Validator, Cisco Catalyst SD-WAN Controllers, and Cisco IOS XE Catalyst SD-WAN devices or Cisco vEdge devices in either a standalone or Cisco SD-WAN Manager cluster deployment, the software upgrade and reboot is performed first on the Cisco Catalyst SD-WAN Validator, next on the Cisco Catalyst SD-WAN Controller, and finally on the Cisco IOS XE Catalyst SD-WAN devices or Cisco vEdge devices. Up to 40 Cisco IOS XE Catalyst SD-WAN devices or Cisco vEdge devices can be upgraded and rebooted in parallel, depending on CPU resources.

Introduced in the Cisco vManage Release 20.8.1, the software upgrade workflow feature simplifies the software upgrade process for the Cisco Catalyst SD-WAN edge devices through a guided workflow and displays the various device and software upgrade statuses. For more information on creating a Software Upgrade Workflow, see Software Upgrade Workflow.

Note

  • You cannot include Cisco SD-WAN Manager in a group software upgrade operation. You must upgrade and reboot the Cisco SD-WAN Manager server by itself.

  • You can create a software upgrade workflow only for upgrading the Cisco Catalyst SD-WAN edge devices.

  • It is recommended that you perform all software upgrades from Cisco SD-WAN Manager rather than from the CLI.

  • For software compatibility information, see Cisco SD-WAN Controller Compatibility Matrix and Server Recommendations.

Note

From Cisco Catalyst SD-WAN Manager Release 20.18.1, devices within the same site are upgraded sequentially. If a device fails, subsequent upgrades are skipped.

Prior to Cisco Catalyst SD-WAN Manager Release 20.18.1, devices within the same site are also upgraded sequentially. Even if a device fails, the remaining devices continue to upgrade.

The upgrade will proceed sequentially only if the certificate status of all devices with the same site ID is valid. If any device has an invalid certificate status, upgrades will occur in parallel.

Software upgrade workflow example

For example, when upgrading a group of Cisco Catalyst SD-WAN Validator, Cisco Catalyst SD-WAN Controllers, and Cisco IOS XE Catalyst SD-WAN devices or Cisco vEdge devices, the upgrade and reboot sequence is performed first on the Cisco Catalyst SD-WAN Validator, then on the Cisco Catalyst SD-WAN Controller, and finally on the routers. Up to 40 routers can be upgraded and rebooted in parallel, depending on CPU resources.

Unsupported upgrade scenario

You cannot include Cisco SD-WAN Manager in a group software upgrade operation. The Cisco SD-WAN Manager server must be upgraded and rebooted separately.

Software upgrade sequencing analogy

Upgrading devices in sequence is similar to updating a fleet of vehicles one at a time to ensure each is ready before moving to the next.

Device version compliance

Device version compliance is a policy that

  • ensures compatibility of network devices with Cisco SD-WAN Manager upgrades,

  • supports devices in the overlay up to N-2 long-lived releases, and

  • does not support devices older than this version in the overlay after an upgrade.

The release versions referenced in this policy are defined as follows:

  • N: Represents the current Cisco SD-WAN Manager release (for example, Cisco Catalyst SD-WAN Manager Release 20.18.x).

  • N-1: Refers to the prior long-lived release (for example, Cisco Catalyst SD-WAN Manager Release 20.15.x).

  • N-2: Refers to the long-lived release two versions prior (for example, Cisco Catalyst SD-WAN Manager Release 20.12.x).

If you onboard a new device of any version, the device is still supported. However, after onboarding, this device will be flagged with a red banner in Cisco SD-WAN Manager, indicating that an upgrade is required.

Cisco ISR 4000 series devices are subject to the device version compliance policy described in this section. For supported device and software combinations, see the Cisco Catalyst SD-WAN Control Components Compatibility Matrix and Recommended Computing Resources.

Upgrade behavior

This feature changes the upgrade process depending on how the upgrade is initiated:

When a user initiates an upgrade to a newer Cisco SD-WAN Manager version (e.g., Cisco Catalyst SD-WAN Manager Release 20.18.x) through the UI, the upgrade is blocked if the overlay contains devices with software versions older than N-2 (e.g., Cisco Catalyst SD-WAN Manager Release 20.12.x).

For instance, if Cisco SD-WAN Manager is on version Cisco Catalyst SD-WAN Manager Release 20.15.1 and devices are on Cisco IOS XE Catalyst SD-WAN Release 17.9.x, an upgrade to Cisco Catalyst SD-WAN Manager Release 20.18.x will be blocked because the minimum supported device version for Cisco Catalyst SD-WAN Manager Release 20.18.x is Cisco Catalyst SD-WAN Manager Release 20.12.x. All devices in the network must be on version Cisco IOS XE Catalyst SD-WAN Release 17.12.x or above for the upgrade to proceed.

If a user performs the upgrade via the CLI, the upgrade proceeds even if devices are older than N-2. However, Cisco SD-WAN Manager displays a banner indicating the presence of less than N-2 devices and recommends upgrading them.

Device compliance notifications

Cisco SD-WAN Manager uses two primary methods to flag incompatible devices. If a user performs any operations on devices running versions older than N-2, it may lead to unexpected errors or device operational failures.

Compliance messages

A message appears in Cisco SD-WAN Manager when incompatible devices are detected. This message recommends upgrading those devices. Clicking the message redirects the user to the Compliance & Conflicts page, which displays the device status and software version.

  • Error: If devices are less than N-2 versions, an error message appears: 
    Incompatible software version detected. Click here for details.

  • Error: If devices are on N-3 version, or if Cisco Catalyst SD-WAN Controller or Cisco Catalyst SD-WAN Validator are on N-1 or N-2 versions, an error message appears:

    • N-3 devices with N version of SD-WAN Controller or SD-WAN Validator: 
      Incompatible software versions between the Manager and WAN Edge have been detected. Upgrade the software immediately to avoid any disruptions.

    • N-3 devices with N-1 or lesser versions of SD-WAN Controller or SD-WAN Validator:

      Incompatible software versions between the Manager and Controller, Validator and WAN Edge have been detected. Upgrade the software immediately to avoid any disruptions.

Out of compliance alarm

An alarm is raised in the Alarm Details page in Cisco SD-WAN Manager when devices running versions older than N-2 are detected in the overlay. Multiple alarms may be raised if device versions change.

If the list of out-of-compliance devices contains five or fewer entries, the Probable Causes section displays the device hostnames. For more than five devices, the Probable Causes section displays only the count of out-of-compliance devices.

Unsupported devices

Starting with the Cisco Catalyst SD-WAN Manager Release 20.18.x release, Cisco SD-WAN Manager removes unsupported device families from the Zero Touch Provisioning (ZTP) settings page. These platform families include:

  • Cisco vEdge Cloud

  • Cisco ASR 1000 Series Aggregation Services Routers

  • Cisco ASR 1002-X Series Aggregation Services Routers

  • Cisco vEdge devices

Cisco ISR 1100 and ISR 1100X Series Integrated Services Routers default operating system recognition

Cisco SD-WAN Manager changes the default recognition of Cisco ISR 1100 and ISR 1100X Series Integrated Services Routers from Viptela operating system to Cisco IOS XE operating system. As a result, Cisco SD-WAN Manager removes the Migration menu if it detects that a Cisco ISR 1100 and ISR 1100X Series Integrated Services Router is running Cisco IOS XE operating system. However, the Migration menu continues to be displayed for devices running Viptela operating system.