Automated Updates?

[Matt_Bunzl]

I want to set up our switches to update automatically, ideally the at a set time each month, but appears that the 'window' can only be set for a day in the week, at a set time...

This is an example of a switch setting on one of our networks. 

Network-Wide > General

I am very confused as to what this is trying to tell me. There is an update, which is not scheduled, but has a window of Tuesday 12AM. 

So why didn't it install the update (which is in a warning state) on any of the previous Tuesdays at 12am? 

If I use the schedule tool, it just allows me to set a time and date for a one-off update. 

The page on Organisation > Firmware Upgrades just seems to let me select one-off upgrades across the organisation. Nothing about automatic scheduling. Do I really have to manually push updates to all the switches, every quarter? I see automatic updates mentioned all over the place, but nowhere seems to actually tell me how.

Where the heck do I set up automatic updates? And if this 'window' is it... why isn't it working?

Hopefully someone can make some sense here.

Thanks

Matt

[alemabrahao]

Automated Firmware Upgrades

Meraki’s goal is to make networking simple and one of the ways that we do this is by automating firmware upgrades. In order to support the process of firmware maturity and to provide the most stable experience to customers, Meraki will schedule firmware upgrades for networks that meet the criteria for a firmware upgrade. All networks, by default, receive automated upgrades. While this upgrade method does not require any additional input from the administrator, it may not be appropriate as a complete firmware management process, depending on the needs of your network. 

When new firmware becomes available it will immediately be available on dashboard for an administrator to upgrade to. Though it will eventually be pushed to qualified networks via the automated upgrade process, the automated upgrade process does not happen immediately after release and is rolled out over time. The automated process can sometimes take weeks to occur on all networks, depending on certain factors.

Some factors that may affect the automated deployment time period include: potential conflicts between new and old firmware builds, the number of devices receiving the new build, or special configurations on critical devices or networks that require caution for upgrades. The primary considerations for Meraki when deploying firmware upgrades is to preserve maximum security, uptime, and compatibility. If any of these factors are at risk, Meraki may choose to wait to deploy until those risks have been resolved.

The firmware that is selected via the automatic upgrade process can be one of three release types; Stable, Stable Release Candidate, or Beta. When an automated firmware upgrade is released by Meraki, networks that are scheduled for automated upgrades will be moved to the latest version. Periodically, automated upgrades may occur for firmware versions that are beta, stable release candidate, or stable. Customers will be notified via email when these upgrades are scheduled. 

Automatic upgrades for beta firmware releases will only be scheduled for customers that have enabled the 'Try beta firmware' option in Network-wide > Configure > General or who are already running an older beta firmware release.

While automated firmware upgrades are pushed out to all networks over time, due to the potential delays mentioned above, a more manual process may be required for some organizations. If a network needs a more timely upgrade pattern, it is best for the organization administrators to schedule upgrade times manually on the Organization > Firmware Upgrades page in the dashboard.

Administrators and network alert recipients will be notified when an automated firmware upgrade is scheduled. By default, these upgrades are scheduled 1 to 2 weeks from the date of notification. Additionally, a notification banner within dashboard will be present for organization administrators after the upgrade has been scheduled. Networks that do not contain devices or where all devices are dormant will have upgrades scheduled immediately.

This firmware upgrade process cannot be opted out of as it is a core service provided by Meraki however the upgrade(s) may always be rescheduled.

Automated firmware upgrade decisions are made on a per-network basis. As a result, if an upgrade is to be deployed it may or may not be deployed to all networks in the organization with that device type. 

Automated firmware upgrades do not occur on a fixed timetable. As a result, a network running older beta firmware may not be immediately upgraded to recently released beta firmware. 

Some networks might not get a firmware upgrade scheduled due to various reasons. We recommend network administrators check all of their Dashboard networks periodically for available firmware upgrades and upgrade them manually to the latest firmware versions in such scenarios.

General Firmware Best Practices

Meraki was built on the promise of making management of devices intuitive, and this extends to Meraki firmware management. Thanks to the power of the Meraki dashboard, we are able to create and release high quality firmware that allows access to cutting-edge features and high quality, secure software. Out of the box, we recommend you let the simple, automatic and seamless updates work to your advantage. By default, your devices will be scheduled for updates when new firmware becomes available — firmware that has been robustly validated and tested before being deployed.

Meraki’s default firmware settings include:

• no automatic beta firmware deployments

• a default upgrade window

• a default upgrade choice of Wednesdays

On average, Meraki deploys a new firmware version once a quarter for each product family, and this cadence ensures you get access to new features and functionalities as they become available, minimizing major changes between firmware versions to ensure high quality software.

Once you are scheduled for an automatic update, Meraki will notify you 2 weeks in advance of the scheduled upgrade and, within this two week time window, you have the ability to reschedule to a day and time of your choosing. We recommend selecting a time that is most convenient to your business needs, and if you want to, you can set this time as your default upgrade window under your general network settings.

https://documentation.meraki.com/Architectures_and_Best_Practices/Cisco_Meraki_Best_Practice_Design/...

[Matt_Bunzl]

Ah, I think I am understanding this a bit better thanks. In the past, the date I see for the firmware date...

I have aways seen this date as a "update at the very latest". Is this simply a date that the new firmware has before it will be automatically updated? 

Thanks for your clarification, it is much appreciated. 

[Ryan_Miles]

The three categories or labels shown on the firmware page are: Good, Warning, and Critical. If you hover on the information bubble it displays a description. Including them below. This is also covered in documentation.

Good

You are running the latest firmware. A minor update may be available, but no immediate action is required.

Warning

Newer stable major firmware or newer minor beta firmware is available that may contain security fixes, new features, and performance improvements. We recommend that you upgrade to the latest stable or latest beta firmware version.

Critical

Your firmware is out of date and may have security vulnerabilities and/or lack key performance improvements. We highly recommend that you upgrade to the latest stable or latest beta firmware release.

The status doesn't equate to when upgrades will be performed. That is still dependent on the settings you have selected on Network-wide > General > Firmware upgrades. More details here.

[Matt_Bunzl]

Hi Ryan_Miles. I get what the statuses mean. I am more concerned with the automatic deployment of the updates. 

Currently, I am having to contact Network owners each quarter and negotiate switch downtime for them, because, as an organisation, we have a policy of jumping on new release firmware quickly, especially as the UI recommends this action. However, after months of seeing a new release of firmware, 98% of our switches are still on the old firmware, so we have little faith that automatic firmware is happening, or at the very least is so slow that we do not feel comfortable in the process.

I would like to be able to set automatic updates (if in status of Warning) to push out at the last Sunday morning of each month at 3am; and have that applied to all new release level firmware updates. 

At the moment, the only control is that we can set a time and a day of the week, and it might happen anytime between now and the next three months, but we aren't confident, as we've never seen it work. It's hard to instil confidence in a service, if you can't tell them when their switches will go down, even for 15 minutes. Especially when a lot of these are 24/7 warehouses and businesses.  

This might be less of a 'how do I do it' post and more of a feature request. 

[Ryan_Miles]

I see your networks are set to Ignore currently. So unless you schedule something it will remain in the Ignore state.

https://documentation.meraki.com/General_Administration/Firmware_Upgrades/Cisco_Meraki_Firmware_FAQ#... 

[Matt_Bunzl]

But the only two options I have are:

Schedule the upgrade for: Date & Time
Perform the upgrade now

I don't want either of these. I want a rolling update so I do not have to manually input the dates every quarter. 

I think I am going around in circles here. So far, the Meraki portal's idea of an automatic update, still requires the input of a date and time each time new firmware is updates. I just want it pushed out ASAP without me needing to log in and pick a date and time for each network

[Ryan_Miles]

If a network was scheduled for a firmware job at one point in the past and then canceled it will be set to Ignore until a new firmware job is scheduled (whether it's "Schedule the upgrade for" or " Perform the upgrade now").

So, if you schedule a firmware job (schedule or perform now) it should pull the network out of the "Ignore" state and set it back to "Upgrade as scheduled". Then any subsequent firmware jobs scheduled by Meraki would take place during your configured upgrade window automatically.