Cisco IOS Auto-Upgrade Manager
Upgrading images within IOS has long been a confusion point for many people, especially around the time that high-profile security vulnerabilities are announced. The complexities in upgrading IOS images include choosing the correct image, understanding the correct procedure to download the image onto the device, and understanding the recovery scenario if an upgrade fails. The IOS AutoUpgrade Manager automates this upgrade process for you, removing the points of confusion for you.
With the availability of Warm Reload and Warm Upgrade functionality, it is possible to implement a safe automatic upgrade of IOS images (without support of a network management tool like CiscoWorks, etc). When Cisco IOS Auto-Upgrade Manager is invoked from a command line or web interface, it will attempt to connect over the internet using XML to the Intelligent Download Application (IAD) Server on CCO. Information about the current image running on the device, basic details about what type of download is required, and CCO username/password information will be uploaded to IDA.
IOS Auto-Upgrade Manager will then manage the upgrade process from beginning to end performing the following tasks:
- Locating and downloading the image
- Checking all requirements
- Managing Flash memory space
- Validating the image
- Scheduling a Warm-Upgrade
- Providing Roll-back support should the upgrade fail
IOS Auto-Upgrade Manager is supported in 12.4(15)T and above and in the initial phase of IOS Auto-Upgrade Manager, two download options are available:
- Download a specific image from CCO
- Download a specific image from a local server
In order to download a specific Cisco IOS software image from www.cisco.com using the CLI you must use one of the following methods:
- Interactive Mode
- Single CLI Mode
The IOS Auto-Upgrade Manager guides you through the process of upgrading to a new Cisco IOS image in the interactive mode. When you choose automatic upgrade, you are required to answer a few questions in the interactive mode to complete the device upgrade. You can initiate interactive mode by issuing the upgrade automatic command without any options. The non-interactive single line CLI is for advanced users. You can download and upgrade to a new Cisco IOS software image from a Cisco or non-Cisco server by using the upgrade automatic getversion command and specifying all the required arguments. Both the interactive mode and single line CLI mode can be used to download images from Cisco and non-Cisco servers though.
So lets take a look @ what’s needed in order to configure this feature (and more importantly what’s not documented).
I’ll tell you I spent the better part of an afternoon testing this and only after the help of some Software Engineers did I get this work because the documentation has not been updated to reflect the proper steps yet. Also I’d like to send a big a thanks out to David Prall, CCIE #6508 (R/S, SP & Security) for taking the time to help me troubleshoot this as well.
Now the first (and most important) step in configuring the IOS Auto-Update feature is to configure the router with the proper SSL certificate. This is the step that caused me all the headache, now according to the documentation you need to follow these steps using MS Internet Explorer:
- Pull down the Tools menu in Internet Explorer (IE) and select Internet Options.
- Under the Advanced tab, select “Warn if changing between secure and not secure mode.”
- Enter the URL: https://www.cisco.com in IE. When a security alert pop-up box appears, click “No” for the question “You are about to leave a secure Internet connection. Do you want to continue?”.
- Double-click the lock icon on the status bar of IE.
- Select the Details tab of the certificate window displayed.
- Save the certificate in the Base-64 encoded format to a file (such as cisco.cert).
- Open the cisco.cert file in a Notepad to get the certificate data that you need to configure on your router.
However if you follow these step you will not get this feature to work as two important steps have been left out. In fact you will receive an error similar to the following:
################################################################################
Welcome to the Cisco IOS Auto Upgrade Manager. To upgrade your device, please
answer the following questions. To accept the default value for a question, simply hit
################################################################################
If you would like to download an image directly from Cisco Server over the Internet, a valid Cisco login account will be required.
Download from Cisco server? [yes]:
Enter the filename of the IOS image that you wish to upgrade to:
Image Name?c2800nm-advipservicesk9-mz.124-15.T5.bin
Please enter your Cisco username and password for entitlement verification. If you need to acquire a Cisco username/password, please go to http://www.cisco.com or contact your device administrator.
Cisco username:******
Cisco password:******
Contacting cisco.com. Wait..
Authorization fail: Make sure that you have configured a CA trustpoint and authenticated a valid SSL certificate.
Failed to contact cisco.com.
Upgrade failed.
The proper steps to follow in order to get this to work are to do the following using MS Internet Explorer:
- Pull down the Tools menu in Internet Explorer (IE) and select Internet Options.
- Under the Advanced tab, select “Warn if changing between secure and not secure mode.”
- Enter the URL: https://www.cisco.com in IE. When a security alert pop-up box appears, click “No” for the question “You are about to leave a secure Internet connection. Do you want to continue?”.
- Double-click the lock icon on the status bar of IE.
- Click on the Certification Path tab
- You will now see a certification chain. Select the ‘Verizon Class 3 Secure Server CA’ CA cert and click on “View Certificate” and this will open a separate details window for the cert.
- Then, click on Details tab for the cert
- Next click “Copy to File” which will open a certificate export wizard which can be used to save the certificate in Base-64 encoded X.509 format..
- Open the cisco.cert file in a Notepad to get the certificate data that you need to configure on your router.
Steps 5 & 6:
Step 7 & 8:
Step 8:
Once you have performed all 9 steps you are ready to configure your router for Auto-Update. You first have to import the certificate you just exported on the router and this is done using the following configuration:
ISR-2811(config)#crypto pki trustpoint cisco_ssl_cer
ISR-2811(ca-trustpoint)# enrollment terminal
ISR-2811(ca-trustpoint)# revocation-check none
ISR-2811(ca-trustpoint)#exit
ISR-2811(config)#crypto pki authenticate cisco_ssl_cer
Enter the base 64 encoded CA certificate.
End with a blank line or the word "quit" on a line by itself
-----BEGIN CERTIFICATE-----
<<<Paste the content of the cert in notepad here>>>
-----END CERTIFICATE-----
Certificate has the following attributes:
Fingerprint MD5: 10FC635D F6263E0D F325BE5F 79CD6767
Fingerprint SHA1: 742C3192 E607E424 EB454954 2BE1BBC5 3E6174E2
% Do you accept this certificate? [yes/no]: yes
Trustpoint CA certificate accepted.
% Certificate successfully imported
ISR-2811(config)#exit
Now the certificate has been successfully pasted into the router, you next need to enable the router for autoupgrade. This is done using the ‘autoupgrade‘ command. The autoupgrade command allows to specify what url location you would like to use to download the image from. If you are downloading the image directly from CCO you do not need to configure/modify the default for this command. This is done using the following command:
ISR-2811#config t
Enter configuration commands, one per line. End with CNTL/Z.
ISR-2811(config)#autou
ISR-2811(config)#autoupgrade ?
disk-cleanup Set Auto Upgrade Manager disk cleanup options
ida Set Auto Upgrade Manager IDA related information
status Set Auto Upgrade Manager status related information
ISR-2811(config)#autoupgrade ida ?
url Set Auto Upgrade Manager IDA url
ISR-2811(config)#autoupgrade ida url
You also have the capability to configure the router to send status updates regarding Auto-Upgrade via email using the ’autoupgrade status email’ command. Once you have configured the parameters of the Auto-Upgrade Manager on the router you are ready to perform the upgrade. Remember earlier I mentioned that you can initiate two types of upgrades: Interactice Mode & Single CLI Mode. Interactive Mode is started using the ‘upgrade automatic’ command and the router will begin to walk you through a series a prompts and perform the upgrade automatically based on your answers. The nice thing about the automatic upgrade is that it allows to do a warm-upgrade of the router immediately, schedule a warm-upgrade or perform the upgrade manually when your ready, all through a prompt. In order to see the upgrade performed via the Interactive Mode click the following link: Interactive Mode Sample.
In order to perform the Single CLI Mode upgrade I issue the following command:
upgrade automatic getversion cisco username mycconame password myccopassword image c2800nm-advipservicesk9-mz.124-15.T5.bin at now disk-management auto
This command downloads an IOS software image from the Cisco website (www.cisco.com) and reloads the router immediately after the download. It also will delete the flash files automatically if there is not enough disk space. To see the upgrade performed via the Single CLI Mode click the following link: Single CLI Mode Sample.
As a side note, you can also configure the router to download the image from a TFTP server, FTP Server or HTTP Server of your choice.
I also agree. I won't be proud of putting that on my resume or web site.
Urh, what are they thinking ...
I'm no fan of the new logos either. Looks like Cisco may be altering the professional level designations in the ...
I'm afraid so and I'm no fan of them either :-) 
is CSCO serious with this? these logos are disgustingly ugly..the current logos are just fine.. why does everyone have to ...
Modified configuration that works on a 2811 running 12.4(20)T using the Virtual-Template Interface and a split-tunnel. Fa0/0 is the ...
Thanks, good to know ! I hope they can add 802.11n APs soon. 
This is a GREAT list of RegEx for the ASA, thank you.
With a PCI audit around the corner I ...
Wow. All that work just to eliminate a DNS problem. Why not simply instruct users to type https:// ...
bugger, there goes support for my 3620 :-( 
Hi Joe,
If this is the last planned major version release do you know what Cisco intend to replace it ...
Comment by Vaibhav
on 14 June 2008:
Use auto upgrade manager on your 73xx series, upgrade to the latest SB train and watch your router die because of memory corruption or other strange issues!
All without having to transfer the IOS via FTP and rebooting. All done for you!
Comment by Joe Harris
on 17 June 2008:
You know nothing makes me more upset than someone that just likes to throw mud and tries to push blame away from where it belongs. Since I deal with this type of behavior a lot I’ll take this moment to educate you because I know your intent here was to defame Cisco but I see this more as an opportunity to educate YOU (not the router) and help out others at the same time. After all helping people is why I started this website. Let’s take this a step at a time shall we:
1. First, considering YOU had to tell the router which IOS to load, I hardly see how the router is to blame here. Not really sure why you would tell a 7301 to go from 12.4T code to 12.2SB code anyway (btw a 7304 will not run the needed code which supports Auto-Upgrade so it’s a 7301 not a 73XX). So you should have just listed 7301 instead.
2. Second, when you are downloading IOS Software, bug identification has never been anyone’s responsibility other than your own when you don’t have a CROS contract. In fact I know that you are unaware of it or else you would have not had the problems you had, but for over the last 10 years Cisco has made publicly available a tool called the IOS Bug Toolkit. This tool allows YOU to search for software bugs based on the version of code you are running or wanting to run and/or based feature sets you are looking to implement.
3. Third, Cisco’s Foundation Technology Remote Management Service is a service which is part of the CROS product portfolio that can always be purchased if YOU don’t feel as though IOS management is not something YOU want to actively manage. This service allows YOU to outsource IOS management (among other things) to a trained Cisco personnel. This service encompasses, Transition Management, Incident Management, Problem Management, Configuration Management, Software Release Management, Change Management & Performance Reporting. YOU should really look into this service and avoid issues that YOU create for YOURESELF. Read the Data Sheet (paying particular attention to the Release Management section).
4. Forth, prior to making such a radical move like moving from 12.4T code to 12.2SB code YOU should really also incorporate the Cisco IOS Feature Navigator Tool into your background resources to help YOU find the appropriate image YOU need for YOUR platform based on the features YOU are looking to deploy. In YOUR case YOU should use the Compare Images feature of the tool to compare the differences and similarities of the two images.
5. Lastly, YOU should work at developing a much better working relationship with YOUR local Cisco SE. Most SE’s will be more than willing to sit down with YOU and make a recommendation on IOS Code when they are aware of YOUR network, it’s applications and the services it provides. Cisco SE’s are not comfortable, myself included, making a blind code recommendation without having at least some level of intimacy with YOUR network. We (Cisco SE’s) are the best resource YOU have. If you are not aware of who your local SE is then let me know and I would be more than happy to help you locate whom that person is.
And all of this is provided for YOU!
Comment by Vaibhav
on 19 June 2008:
I was not aware of CROS and IOS Feature Navigator. I apologize.
Comment by Vaibhav
on 19 June 2008:
my aim was not to “throw mud and tries to push blame away” but to express my frustration with the quality of the recently released IOS images.
Comment by Falbuq
on 1 July 2008:
Having worked for Cisco for a number of years in Remote Operations Services I just wanted to mention that Cisco prefers that Cisco ROS not be called CROS. It should be referred to as CISCO ROS. Just a minor correction - no mud involved.
Comment by mlitka
on 29 July 2008:
Just thought I would pass this along. I was labbing this up this afternoon and the ida url referenced in the CCO instructions apparently has changed. I took a stab at the following at it worked:
https://www.cisco.com/cgi-bin/ida/locator/locator.pl
I removed the ‘new-’ in front of ‘ida’.
Comment by Joe Harris
on 29 July 2008:
Hi Mlitka, your correct the documentation is wrong here again however the command reference has the correct URL listed: http://www.cisco.com/en/US/docs/ios/fundamentals/command/reference/cf_a1.html#wp1014042