Perform device rollback and recovery | Rolling Back Device Upgrades | Upgrade Guide for Cisco Catalyst 9000 Series Switches and Smart Switches

Provides detailed instructions for device rollback and recovery.

Use this procedure to perform rollback and recovery on a device when the new software does not pass validation or the device does not boot normally.

Replace the sample values given inside the angular brackets (<...>), and use the filesystem name, such as flash: or bootflash:, as shown by the device.

Before you begin

Note

A rollback can reload the device and interrupt the traffic. Keep console or out-of-band access available prior to initiating the rollback procedure.

Do not use commands such as, emergency-install or format flash: , or perform actions such as deleting active .pkg files or clearing the install state as standard recovery steps. These actions can erase the configuration, software, and rollback information.

Software rollback does not automatically restore an older configuration. It may also not downgrade ROMMON, the bootloader, FPGA, or CPLD firmware.

Save the configuration and the complete console or session logs.
Confirm that a verified known-good image is available.
Do not remove inactive files until the rollback decision is complete.
Do not interrupt an install operation or power-cycle the switch.

Procedure

Check the current install state of the device.

Example:


switch# show install summary
switch# show install uncommitted
switch# show install rollback
switch# show boot
switch# show version

Identify the recovery action based on the install state of the device. Refer, Rollback conditions and recovery actions.
Perform the recovery step based on the device or image condition.
- Condition: Image is added, but not active.
```
switch# show install summary
Type  St   Filename/Version
--------------------------------
IMG   C    <current-version>
IMG   I    <staged-version>
```
  This output shows that the current image version is still active.
  
  To cancel the staged change, perform this step. This command can remove the images and packages needed for a later rollback. Hence, make sure to review the proposed list of files before giving confirmation to remove the files.
```
switch# install remove inactive
<review the proposed deletion list>
Do you want to remove the above files? [y/n] y
...
SUCCESS: install_remove
```
- Condition: New version is active, but not committed.
  This is the preferred rollback window.
```
switch# show install summary
Type  St   Filename/Version
--------------------------------
IMG   U    <new-version>

Auto abort timer: active
Time before rollback: <remaining-time>
```
  If validation fails, do not commit. Instead, abort the install operation. This can cause a device reload and management access might drop.
```
switch# install abort
This operation may require a reload of the system.
Do you want to proceed? [y/n] y
...
SUCCESS: install_abort
```
  If the command is rejected, use the install abort ? command and follow the syntax shown on the device.
  
  If the timer expires before the commit operation, the switch returns to the last committed state. Do not stop the timer when rollback protection is required. Stopping the timer does not commit the image.
  
  Check the install state after rollback:
```
switch# show install summary
Type  St   Filename/Version
--------------------------------
IMG   C    <previous-version>

Auto abort timer: inactive
```
```
switch# show install uncommitted
No Uncommitted Packages
```
  The rejected image might still be in inactive state. Keep it until validation and log collection processes are complete.
- Condition: New image version is already committed.
  After commit operation, the install abort option is no longer available.
  
  Check for a saved rollback point:
```
switch# show install rollback
ID    Label       Description
------------------------------------
<id>  <label>     <previous-version>

switch# show install rollback id <id>
Rollback id - <id>
IMG   C    <previous-version>
```
  Confirm the version, required files, and reload impact. You must not select a rollback ID by the number alone.
  
  Perform the rollback operation to the respective rollback point or ID.
```
switch# install rollback to id <id>
install_rollback: START
...
SUCCESS: install_rollback
```
  If no usable point exists, return to the verified previous image as a new software change:
```
switch# verify /sha512 flash:<previous-image.bin>
switch# install add file flash:<previous-image.bin>
switch# install activate auto-abort-timer <minutes>
<validate after the reload>
switch# install commit
```
  Confirm that the return path is supported. An intermediate release or configuration change might be required.
- Condition: SMU change is uncommitted.
  For an uncommitted SMU change, perform the rollback operation to committed state.
```
switch# install rollback to committed
...
SUCCESS: install_rollback
```
  To remove a committed SMU, follow its Cisco README file.
  
  These are the common commands:
```
switch# install deactivate file flash:<smu-file>
switch# show install summary
SMU   D    flash:<smu-file>

switch# install remove file flash:<smu-file>
```
  SMU deactivation might restart processes or reload the switch.
- Condition: Switch boots a .bin image.
  Use this only when the show version command output confirms that the switch is booting a .bin image and the product supports this method.
```
switch# verify /sha512 flash:<previous-image.bin>
switch# configure terminal
switch(config)# no boot system
switch(config)# boot system flash:<previous-image.bin>
switch(config)# end
switch# copy running-config startup-config
switch# show boot
switch# reload
```
  Confirm that the image is present everywhere required before reloading the device.
- Condition: The device is in switch: prompt.
```
switch: dir flash:
switch: cat flash:packages.conf
switch: boot flash:packages.conf
```
  Use the packages.conf file only when all the referenced .pkg files are present. Do not edit it manually.
  
  If the package set is missing or invalid, boot a verified image:
```
switch: boot flash:<known-good-image.bin>
```
  OR
```
switch: dir usbflash0:
switch: boot usbflash0:<known-good-image.bin>
```
  For TFTP recovery:
```
switch: set IP_ADDRESS <switch-ip>
switch: set IP_SUBNET_MASK <subnet-mask>
switch: set DEFAULT_GATEWAY <gateway-ip>
switch: ping <tftp-server-ip>
switch: boot tftp://<tftp-server-ip>/<known-good-image.bin>
```
  Direct .bin boot uses the bundle boot method. After IOS XE loads, copy the correct image to flash and restore the supported installation state.
Validate the rollback operation using these show commands.
Example:
```
switch# show version
switch# show boot
switch# show install summary
switch# show install uncommitted
switch# show switch
switch# show redundancy states
switch# show interfaces status
switch# show etherchannel summary
switch# show spanning-tree summary totals
switch# show platform resources
switch# show environment all
switch# show logging
```
Confirm that
- the intended release is active and committed
- the rollback timer is inactive and no install operation is incomplete
- expected members, interfaces, protocols, and services are healthy
- CPU, memory, power, temperature, and fans are healthy, and
- no new crash, traceback, or repeated error is present on the device.