New IOS-XE Build Lots of Features Now Available that had been missing

[Mloraditch]

Read thoroughly and enjoy!

Important notes

• After upgrading to this cloud-native IOS XE 17.15, downgrading to any CS version via the dashboard will not be possible. In order to downgrade to the CS version, a factory reset may be required and support assistance will be necessary. Please consider this before upgrading your network to cloud-native IOS XE. Learn more - http://cs.co/9002xhAan.
• Attempting to convert unsupported models such as C9200CX may result in an unusable switch. Please review the list of supported models in the release notes below before proceeding with the upgrade.

Cloud-native ios xe overview

• Cloud-native IOS XE introduces a significant architectural shift from the previous container-based design to a cloud-native framework, unlocking benefits for your cloud-managed Cisco Catalyst switches, including the C9300-M, C9300L-M, C9300X-M, C9200L and MS390 families. These include faster boot and initialization performance, especially for stacks, and the start of a new generation of capabilities as we enable more underlying IOS-XE capabilities, and a Cloud CLI Terminal that introduces the ability to run Show CLI commands directly from the dashboard!
• CS16 or CS17 are prerequisites before initiating this upgrade. We do not recommend attempting to upgrade to IOS XE from other firmware versions.

Release highlights

• In this release, we are excited to support the following features and enhancements. Below are the key highlights:
• Introducing a new onboarding flow for cloud and hybrid operating modes: two powerful ways to manage your Catalyst 9000 switches from the Meraki dashboard. These modes give you the flexibility to choose between a fully cloud-managed experience (cloud operating mode) or a hybrid approach (previously referred to as cloud monitoring), that offers configuration via an embedded cloud CLI while leveraging the cloud for monitoring and troubleshooting. Learn more http://cs.co/9000F98vQ (Note that the new onboarding process for hybrid and cloud operating modes will be rolled out in phases. If you don’t see the new UI while adding your Catalyst switches to a network, please be assured it will be available soon. We appreciate your patience and understanding as we work to bring this feature to all eligible organizations.)
• Management Interface Architecture Change: a dedicated management interface is no longer required.
• Default Network Module: this enhancement simplifies and consolidates network module configuration into 8 default ports that get applied dynamically to any inserted network module.
• Standardized Cisco Logging and Interface Naming
• Configuration Templates
• Adaptive Policy
• Intelligent Capture
• Storm Control
• Radius Multi-Auth (dot1X)
• Device Uptime
• 802.1X Control Direction
• Meraki Authentication (Meraki Auth)
• Alternate Management Interface (AMI)
• Port Schedules
• C9200L Hardware Platform Support (see supported models below)
• SNMPv3
• Encrypted Traffic Analytics
• Energy Efficient Ethernet
• MAC Allow Lists

Before you upgrade or migrate: key considerations

• After migrating CLI/DNA managed switches to cloud operating mode, please note that console and SSH access are no longer available. All management access is only available via the cloud dashboard or the local status page through the rear management port.
• Layer 3 switches with a DHCP management IP address are not supported. Please configure a static IP address for the management interface to avoid network disruptions and improper traffic flow. If the L3 switch’s default route and management interface gateways are NOT the same prior to the upgrade, after the upgrade to IOS XE all switch traffic will use the management interface’s DHCP acquired gateway as a next hop.
• Layer 3 switches cannot run DHCP servers on uplink interfaces. Please note that interfaces that have been designated as a preferred uplink cannot also run a DHCP server. Interfaces with both Preferred Uplink and DHCP server configurations will have the DHCP server configuration disabled on that interface.
• Switches using the Alternative Management Interface (AMI) will require an L3 SVI to be configured for the same vlan assigned to AMI. For AMI to work, your network must have AMI configured and your switch must have an SVI configured matching that AMI vlan.
• After upgrading from CS to cloud-native IOS XE firmware, port mirroring configurations on module ports will not be retained. Users will need to reconfigure port mirroring on module ports following the upgrade.
• To migrate a CLI/DNA-managed switch to the dashboard in cloud mode, claim the switch into a network already configured for cloud-native IOS XE. Claiming into a network configured for CS firmware may have unexpected results.
• The 30-day grace period applies to licensing for Catalyst switches onboarded to Meraki Dashboard, allowing customers to trial cloud mode prior to fully committing. Valid DNA licenses can be converted to Meraki licenses through a qualified promotion process. Refer http://cs.co/9005aw6VH for more details.

Share your post-upgrade feedback!

• We value your feedback on our latest release! Please take a moment to complete this brief 5-minute survey (https://forms.office.com/r/gHuK4bJRZ5) and share your experience with us.

Known issues

• Clients Static DHCP reservation cannot be changed. Workaround requires removing static reservations and recreating them.
• Configuration application fails due to bad-cli errors related to et-analytics during each config push. Changing destination port configuration for encrypted traffic analytics, while active, can corrupt config. As a workaround, disable then re-enable with new port config.
• Client Tracking does not work on 10G MGig interfaces, as well as 25G, 40G and 100G ports.
• Named VLAN column is not displaying any values in the switches client summary table.
• IPv6 route for DNS is set with an empty Gateway IP, leading to configuration application failure.
• Devices lose all configurations after an upgrade from 17.15.2 to 17.15.3. Rebooting or shutting down a switch shortly after upgrade (17.15.2 to 17.15.3) might not preserve “safe-config”. Please wait 30 min after upgrade to ensure configuration is marked ‘safe’.
• MTR live tool does not function from the dashboard.
• 9200L 8-member stack: Stack merge occurs due to incompatibility when installing a new image. 8-member stacks may experience longer boot or upgrade times.
• Issue with upgrading a stack of 8 members on the 9200L series from one cloud-native IOS XE version to another.
• The Default VLAN profile API appends new configurations instead of overwriting existing ones potentially leading to unexpected behavior.
• The device uptime displayed for stack standby members is incorrect.

Fixed issues

• Fixed an issue related to downstream clients may experience packet loss for 60-200 seconds in stacks while the standby switch takes over the active stack member role when the active stack member is powered off.
• Fixed an issue related to Management plane connectivity may be interrupted when there are a large number of LLDP announcements.
• Fixed an issue related to stacks of 5 or more switches may experience a configuration mismatch when making multiple consecutive port configuration changes to several interfaces in a row.
• Port scheduling is supported on this version.
• LACP is not functioning on the network module ports of NM-2Y modules.

Supported models

• NOTE: ATTEMPTING TO CONVERT UNSUPPORTED MODELS SUCH AS C9200CX MAY RESULT IN A UNUSABLE SWITCH. PLEASE REVIEW THE LIST OF SUPPORTED MODELS BEFORE PROCEEDING WITH THE UPGRADE.
• C9200L-24T-4X , C9200L-24P-4X, C9200L-48T-4X , C9200L-48P-4X , C9200L-48PL-4X , C9200L-24PXG-4X , C9200L-48PXG-4X , C9200L-24PXG-2Y , C9200L-48PXG-2Y , C9200L-24T-4G , C9200L-24P-4G , C9200L-48T-4G , C9200L-48P-4G , C9200L-48 PL-4G
• C9300-24T-M, C9300-24P-M, C9300-24U-M , C9300-24UX-M , C9300-48T-M , C9300-48P-M , C9300-48U-M , C9300-48UXM-M , C9300-48UN-M , C9300-24S-M, C9300-48S-M , C9300X-12Y-M, C9300X-24Y-M, C9300X-48HXN-M, C9300X-24HX-M, C9300X-48HX-M, C9300X-48TX-M, C9300L-24P-4X-M, C9300L-24T-4X-M, C9300L-24UXG-4X-M, C9300L-48P-4X-M, C9300L-48PF-4X-M, C9300L-48T-4X-M, C9300L-48UXG-4X-M, and the corresponding Catalyst switch SKUs for migration
• MS390-24-HW, MS390-24P-HW, MS390-24U-HW, MS390-24UX-HW, MS390-48-HW, MS390-48P-HW, MS390-48U-HW, MS390-48UX-HW, MS390-48UX2-HW
• Breakout Cables aren’t supported at this time.

Transitioning from cs to ios xe 17.15: unsupported features

• The following CS features are not supported in this release:
• Sticky MAC
• Gov(Federal), Canada, China, or India Cloud
• Certain features will be added to the IOS XE versions in future releases. Refer to the Cloud-native IOS XE documentation for further details: http://cs.co/9001Q4ALF

[Mloraditch]

Plus cloud monitoring is now hybrid  mode with more features!

[cmr]

It is also now a Stable Release Candidate and no longer a Beta...  Though the config loss if you turn it off too soon after upgrade is a little concerning...  On the firmware upgrades feed I've cleaned up the notes as some fixes were already fixed etc.

[rhbirkelund]

I am reeeally going to need more information on this one. 

• Devices lose all configurations after an upgrade from 17.15.2 to 17.15.3. Rebooting or shutting down a switch shortly after upgrade (17.15.2 to 17.15.3) might not preserve “safe-config”. Please wait 30 min after upgrade to ensure configuration is marked ‘safe’.

If I upgrade my 9300X core switch I may risk it loosing all configuration for up to 30 minutes? That's going to be a huge no, from me.

[jimmyt234]

Sounds like you just need to make sure your device is kept online for >30 minutes after an upgrade for it to be "safe"? 😕

[JeroenVercoulen]

I see this firmware has been removed from the dashboard. Any reason why?

[cmr]

I'd guess see @jimmyt234's post above, but I don't know.

[cmr]

The best bit is that the dashboard still actively advertises it...

 

[JeroenVercoulen]

Must say I was steadily upgrading al networks to this firmware version. Everything was working correct till last Friday. An upgrade of the MS390 to this version failed. Now I have 2 dead switches. Maybe that's the reason I don't know. Seems like the troublesome MS390 will not end and this moment.  Working on RMA for that one though. 

- Reboot not working

- Factory reset not working

- RMA pain in the ass at the moment

Luckily the switch with the most AP's is still working.

[JonoM]

Hi @JeroenVercoulen ,

Please note that the latest stable release candidate for cloud-native IOS XE has been temporarily removed from the dashboard due to concerns related to specific upgrade scenarios between CS firmware and cloud-native IOS XE, rather than any issues with the quality of version 17.15.3 itself. Our teams are actively working to fix the issue and will release a new release candidate as soon as possible. We appreciate your patience and will provide updates as they become available. 

[GIdenJoe]

At one customer I had the 17.15.3 having plenty of traffic forwarding issues.  (DHCPs being dropped without any snooping active) and more traffic delays.  I'm curious if this is the reason the firmware has been pulled.

[JonoM]

The release candidate of IOS XE 17.15.3 has been republished as a Beta release. This change is due to the discovery of a bug when upgrading from a CS firmware to an IOS XE firmware. During upgrades from CS firmware, networks may experience a brief (less than five minutes) risk of network instability while the CS configuration is removed and replaced with IOS XE configuration. Please note that this issue is not related to the quality or functionality of IOS XE 17.15.3 itself. A resolution for this issue is under development, and an updated Release Candidate will be provided upon validation.

You can find more details on the release notes, found under Organization > Monitor > Firmware Upgrades

[cmr]

With this rereleased build, I can no longer perform a cable test on an mGig port on a C9300L, it comes back as failed with each pair as not supported.  The connected device was an MR56 running at 2.5Gb/s.  Connecting the same device to a 1Gb port passes all pairs and measures the cable length at 27m which is about right.  the cabling is shielded CAT6a.

[cmr]

I tried again and the switch port disconnects when the cable test is run...

But at least the MR56 reconnected at 5Gbps this time!