Upgrading or Downgrading Orchestrator Deployments in Application Service Engine

This chapter contains the following sections:

Prerequisites and Guidelines

This section describes how to upgrade or downgrade a 3-node Cisco ACI Multi-Site Orchestrator cluster that was deployed in Cisco Application Service Engine. If your Orchestrator cluster was deployed in VMware ESX VMs, see the Upgrading Orchestrator Deployments in VMware ESX chapter. If you deployed a single-node Orchestrator (for example, for testing purposes), the upgrade procedure differs slightly and is described in Installing Single Node Orchestrator chapter instead.

Before you upgrade your Cisco ACI Multi-Site Orchestrator cluster, you must:

  • Ensure that you are running at least Cisco ACI Multi-Site Orchestrator, Release 2.2(3). If you are running an earlier release, your cluster was deployed in VMware ESX VMs and you must follow the Upgrading Orchestrator Deployments in VMware ESX chapter instead.

  • Ensure that your current Cisco ACI Multi-Site Orchestrator installation is running properly.

The following sections provide steps specific to upgrading, however the same exact procedure can be used to switch to an earlier image to downgrade your installation. Keep in mind however, the Application Service Engine deployments cannot be downgraded to a release prior to Release 2.2(3).

Cisco ACI Multi-Site and Cisco APIC Interoperability Support

Prior to Release 2.2(1), you were required to run the same APIC versions in all sites and the version of the Orchestrator that corresponded to that APIC release. During fabric upgrade you were also required to upgrade all the APIC sites first before upgrading the Multi-Site Orchestrator. For example, if you were upgrading the fabrics from APIC Release 4.0(1) to Release 4.1(1), you had to remain on Release 2.0(1) of the Orchestrator until all sites were on APIC Release 4.1(1).

Starting with Release 2.2(1), Multi-Site Orchestrator releases have been decoupled from the APIC releases. The APIC clusters in each site as well as the Orchestrator itself can now be upgraded independently of each other and run in mixed operation mode.

Mixed operation mode is supported for sites running any of the following APIC releases:

  • 3.2(6) or later

  • 4.0(1) or later

  • 4.1(1) or later

  • 4.2(1) or later

However, keep in mind that if you upgrade the Orchestrator before upgrading the APIC clusters in one or more sites, the new Orchestrator features may not yet be supported by an earlier APIC release. In that case a check is performed on each template to ensure that every configured option is supported by the target sites. The check is performed when you save a template or deploy a template. If the template is already assigned to a site, any unsupported configuration options will not be saved; if the template is not yet assigned, you will be able to assign it to a site, but not be able to save or deploy the schema if it contains configuration unsupported by the site. In case an unsupported configuration is detected, an error message will show, for example: This APIC site version <site-version> is not supported by MSO. The minimum version required for this <feature> is <required-version> or above.

The following table lists the features and the minimum required APIC release for each one:

Feature

 Minimum APIC Version

ACI Multi-Pod Support

Release 3.2(6)

Service Graphs (L4-L7 Services)

Release 3.2(6)

External EPGs

Release 3.2(6)

ACI Virtual Edge VMM Support

Release 3.2(6)

DHCP Support

Release 3.2(6)

Consistency Checker

Release 3.2(6)

CloudSec Encryption

Release 4.0(1)

Layer 3 Multicast

Release 4.0(1)

MD5 Authentication for OSPF

Release 4.0(1)

EPG Preferred Group

Release 4.0(2)

Host Based Routing

Release 4.1(1)

Intersite L3Out

Release 4.2(1)

Upgrading Multi-Site Orchestrator on Service Engine

This section describes how to upgrade Cisco ACI Multi-Site Orchestrator that is deployed on Cisco Application Service Engine.

Before you begin

Procedure

Step 1

Download the Cisco ACI Multi-Site Orchestrator Image.

  1. Browse to the ACI Multi-Site Orchestrator download page on Cisco DC App Center.

  2. Click Download to download the image.

Step 2

Make the image accessible by the Orchestrator.

Note

 

This release supports GUI image upload from an HTTP or HTTPS server only, so you must either make the image available on a web server accessible by the Orchestrator or manually upload the image to the Application Server Engine where the Orchestrator is hosted.

If you have a web server running in your environment, simply host the .aci image you downloaded on that server and proceed to the next step.

Otherwise, to manually upload the image:

  1. Copy the application to the Application Service Engine.

    If your Cisco Application Services Engine is deployed in VMware ESX (.ova), Linux KVM (.qcow), or as a physical appliance (.iso), or you have enabled password-based logins for your AWS (.ami) deployment, use the following command to copy the Orchestrator image into the tmp directory on the Services Engine: 

    # scp <app-local-path> rescue-user@<service-engine-ip>:/tmp/

    However, if your Service Engine is deployed in AWS and you have not enabled password-based login, you must use the certificate (.pem) file that you created during the Application Services Engine deployment: 

    # scp -i <pem-file-name>.pem <app-local-path>.aci rescue-user@<service-engine-ip>:/tmp/

    For example, assuming you're running the scp command from the same directory where you saved the Orchestrator image:

    • For password-based authentication:

      # scp ./cisco-mso-2.2.3c.aci rescue-user@10.30.11.147:/tmp/

    • For PEM-based authentication:

      # scp -i <pem-file-name>.pem ./cisco-mso-2.2.3c.aci rescue-user@10.30.11.147:/tmp/

  2. Log in to your Service Engine as rescue-user.

    If your Cisco Application Service Engine is deployed in VMware ESX (.ova), Linux KVM (.qcow), or as a physical appliance (.iso), simply SSH in using the following command: 

    # ssh rescue-user@<service-engine-ip>

    However, if your Application Service Engine is deployed in AWS (.ami), you must login using the certificate (.pem file) that you created during the Application Service Engine deployment: 

    # ssh -i <pem-file-name>.pem rescue-user@<service-engine-ip>

  3. Add the new image.

    In the following command, replace <application-path> with the full path to the application image you copied in the previous step. 

    # acidiag app install <application-path>

    For example:

    # acidiag app install /tmp/cisco-mso-2.2.3c.aci

  4. Verify that the application was loaded.

    Use the following command to check the operState of the application.

    While the application is loading and installing it will go through a number of operational states, which will be reflected in the operState field, for example 'operState': 'Initialize'. This process can take up to 20 minutes and you must ensure that the state changes to Disabled before proceeding to the next step. 

    # acidiag app show
[   {   'adminState': 'Disabled',
        'apiEntrypoint': '/query',
        'appID': 'MSO',
        'creationTimestamp': '2020-02-10T20:30:36.195960295Z',
        'description': 'Multi-Site Orchestrator application',
        'displayName': 'ACI Multi-Site Orchestrator',
        'id': 'cisco-mso:2.2.3',
        'name': 'cisco-mso',
        'operStage': 'PostInstall',
        'operState': 'Disabled',
        'schemaversion': '',
        'uiEntrypoint': '/ui/app-start.html',
        'vendorID': 'Cisco',
        'version': '2.2.3'}]

Step 3

Log in to your Orchestrator.

Step 4

From the left navigation pane, select Admin > Firmware Management.

Step 5

Add the new image to the Application Service Engine cluster.

Note

 

If you manually uploaded the image to the Service Node cluster, the image will be already available and you can skip this step.

  1. In the main window, click Add Image.

    An Add Image window opens.

  2. In the File Path field, provide the URL to the new Orchestrator image.

    For example, https://www.my-web-server.com/mso/cisco-mso-2.2.3c.aci.

  3. Click OK to add the image.

    The image will be uploaded to the Orchestrator's Service Engine nodes, unpacked, processed, and made available for the upgrade. The whole process may take several minutes and you will be able to see the status of the image.

    Wait for the status to change to Available before proceeding to the next step.

Step 6

Activate the new image.

Ensure that the new image's status is Available.

  1. In the main window, click the actions menu next to the image you added.

  2. Then click Activate.

  3. In the Activation Confirmation window, click Continue.

    It may take up to 20 additional minutes for all the Orchestrator services to start and the GUI to become available. The page automatically reloads when the process is completed.