The idea for this post came from someone I was working with recently. Thanks Fan (and Carson, and Shree) :-)
In Service Software Upgrade (ISSU) is a method of upgrading software on a switch without interrupting the flow of traffic through the switch. The conditions for successfully completing an ISSU are usually pretty strict and if you don’t comply, the hitless upgrade can all of a sudden become impacting.
The conditions for ISSU on the Nexus 5000 are pretty well documented (cisco.com link) however, there are a couple bits of knowledge that are not. This post is a reminder of the ISSU conditions you need to comply with and a call out to the bits of information that aren’t so well documented.
The two major ISSU conditions on the n5k are:
- You must unconfigure all Layer 3 features
- The n5k must not have any Spanning Tree (STP) ports in
Designatedstate unless the port is an Edge port.
The first one is easy: the switch cannot be doing any routing. Even if the switch is Layer 2 only, this condition will still fail if any of the following are true:
- Any Layer 3 features are enabled (even if not configured, just having them enabled is enough to fail)
- Any Layer 3 licenses are installed (this includes LAN_BASE_SERVICES_PKG and LAN_ENTERPRISE_SERVICES_PKG)
To satisfy condition #1, you must:
- Unconfigure all Layer 3 features
- Remove the
feature xxxline(s) related to Layer 3 features from the running config
- Uninstall both Layer 3 licenses
- If either license was installed, reboot the switch
The last bullet is worth emphasizing. The switch must be reloaded after uninstalling the Layer 3 licenses in order to satisfy condition #1. This is not well documented, but it’s true.
The second condition says that there can be no non-Edge ports in the
Designated role. Here’s an example:
- D is a Designated port
- R is a Root port
- DE is a Designated Edge port
The n5ks have ports in the
Designated role because there is a downstream switch connected to a non-Edge port. This breaks the ISSU condition.
However the ports on the n2ks are fine because they are — by default — configured as Edge ports so even though they are in the
Designated role, the condition is satisfied.
Resolving this condition in a topology such as the one shown above needs to be done with care. If not done carefully, you could be trading one problem for another or cause some crazy problems in the network.
- Make sure the n5k is not the STP Root in any VLAN
- Don’t connect a switch downstream of the n5k
- Connect a switch downstream, but do so with a vPC and make the port-channel interface an Edge port
When you think you’ve satisfied the conditions for an ISSU, use the
show install command to verify. When you see the impact will be
non-disruptive for each module then, and only then, will the upgrade be hitless.
Compatibility check is done: Module bootable Impact Install-type ------ -------- -------------- ------------ 1 yes non-disruptive reset 101 yes non-disruptive rolling 102 yes non-disruptive rolling
If you cannot resolve both conditions, then you cannot perform a hitless upgrade.