Overview

Upgrading the Cisco IOS image on a Catalyst switch is a critical maintenance task that requires a methodical approach to ensure network stability and security. This FAQ provides expert guidance on secure upgrade procedures, covering everything from pre-transfer image verification to handling high-availability environments with redundant supervisors. Following these best practices minimizes downtime and protects against image corruption or security vulnerabilities.

Frequently Asked Questions

Q1: What is the most secure method to transfer a new Cisco IOS image to a Catalyst switch?

The most secure transfer method is using FTP with authentication (username/password) over a management network, or TFTP when combined with mandatory post-transfer MD5/SHA2 image verification. Cisco recommends using the archive download-sw privileged EXEC command for software image downloads . For the highest security, copy the image via SCP (Secure Copy Protocol) if your IOS version supports it, but always follow up with the verify command to validate image integrity before reloading the switch.

Q2: How do I verify the integrity of a Cisco IOS image after uploading it to the switch?

Use the verify command in privileged EXEC mode to validate the image checksum. For newer images, simply enter verify flash:[image-name.bin] to compute and compare the embedded SHA2 hash . For older images, you can use verify /md5 flash:[image-name.bin] and manually compare the output against the MD5 checksum provided on the official Cisco Software Download page . This step is critical to avoid boot failures from corrupted or tampered images.

Q3: What is the recommended upgrade procedure for a Catalyst switch with dual supervisors (high availability)?

For Catalyst 9400 series switches with dual supervisors, Cisco strongly recommends performing an In-Service Software Upgrade (ISSU) using install mode. First, ensure the system is in Stateful Switchover (SSO) mode and both supervisors are booted from the packages.conf file . The command install add file flash:[image-name.bin] activate issu commit initiates the process, which upgrades the standby supervisor, triggers a failover, and then upgrades the new standby with minimal network disruption . This process automatically handles ROMMON and CPLD upgrades when necessary.

Q4: Can I upgrade a switch using a .bin file instead of a .tar file, and what is the difference?

Yes, you can upgrade using a .bin file, which contains only the Cisco IOS image, while a .tar file includes both the IOS image and the web management files (HTML). Using a .bin file results in a smaller download and is lighter on flash memory, but it limits the functionality of the Web User Interface . For a CLI-only upgrade, set the boot variable directly to the .bin file with boot system flash:[image-name.bin], save the configuration, and reload the switch . For a fully functional GUI, use the .tar file with the archive download-sw command.

Q5: How does the automatic boot loader upgrade work during a Cisco IOS upgrade?

When you boot a Catalyst switch with a newer IOS XE release for the first time, the boot loader (ROMMON) is automatically upgraded based on the hardware version. This ensures compatibility with the new software features . During this process, the supervisor may automatically reload multiple times (e.g., three resets on a C9400 when moving to 16.6.2). This is normal behavior as the system updates the ROMMON and Complex Programmable Logic Device (CPLD) firmware to support the new image .

Q6: What are the pre-upgrade checklist items for a secure and successful IOS upgrade?

Before initiating any upgrade, follow this critical checklist: 1) Ensure network connectivity to the TFTP/FTP server using ping . 2) Verify sufficient free space on the flash: and bootflash: directories using dir . 3) Check the current boot variable and ensure auto-boot is enabled (no boot manual) to prevent the switch from dropping to ROMMON mode after reload . 4) Back up the current running configuration and IOS image. 5) For high-availability systems, confirm the system is in SSO mode .

Q7: What is the difference between Install Mode and Bundle Mode for booting a Catalyst 9400 switch?

In Install Mode, the Cisco IOS XE image is extracted into individual .pkg files, and the switch boots using a packages.conf file that references these packages. This mode is required for ISSU and allows for faster reloads and package-level upgrades . In Bundle Mode, the switch boots directly from the monolithic .bin file. While simpler, this mode does not support ISSU or granular package management. Cisco recommends using Install Mode for modern Catalyst switches, particularly those in high-availability setups .