Using the auto-provision feature to automatically upgrade new switches added to your ACI Fabric

After a brief break from the APIC, the auto-provisioning feature is available (again) inside of the APIC GUI starting with APIC version 2.3 release and later. However, if you need it (or want it) and you are running at least APIC 2.2, you can configure the feature via API (i.e., XML or JSON).

Why would you want the auto-provisioning feature? When configured properly, the auto-provisioning feature will automatically upgrade any new switch which is attached to the fabric to the current desired target of code. So, if you have RMA’d a switch and attach it to the fabric, it will upgrade (or downgrade) to the appropriate code, with no further action required on your part. Same story if you are expanding your ACI fabric with new Spines or Leafs.

NOTE – This feature is not intended to take the place of a normal ACI Fabric-wide upgrade process. If you need guidance on performing an ACI Fabric upgrade, check out the Upgrading your ACI Fabric article.

Configuration

Note – there are two ways to configure auto-provisioning that will work. Option 1 is the preferred way to enable the auto-provisioning feature.

  1. Set the “Default Firmware Version” under the Firmware Node Version Tab to your desired Code (i.e., 3.0.2h). Any nodes joining the fabric will be upgraded to that version of code.
  2. Use the Firmware Group to configure the version.
    1. Set the “Default Firmware Version” under the Firmware Node Version Tab to “Any”.
    2. Create a “default” Firmware Group, whereby we set the target code version for our Fabric. In the “Group Node IDs” Section, we will place a range of ALL possible nodes (i.e., 101-999).
    3. NOTE – Only commissioned switches will appear after you configure this; however, any node ID that joins the fabric (in your configured range) will be upgraded to the proper code.

NOTE – The version specified in the firmware group policy takes precedence over the version specificed in your Default Firmware Version policy. If the switch is not the running desired code, the firmware upgrade is performed at the time of bootscript processing.

Option 1 – Default Firmware Version set to specific code

Admin > Firmware > Firmware Node Firmware

    1. APIC – ENFORCE BOOTSCRIPT VERSION VALIDATION – CHECKED
    2. DEFAULT FIRMWARE VERSION – TARGET VERSION OF CODE (i.e., 3.0.2h) (do not select “Any”)
    3. Decommission and Recommission the switch
Screen Shot 2017-10-20 at 11.40.26 AM.png
Fabric Node Firmware – Setting the Default Firmware Version

Verification

Once you commissioned your switch, I’d recommend hopping into the console and watching the process (if available). Once you’re in, use the following command to check the status “cat /mit/sys/summary” – What you’re looking for is the “state”, at the end of the output. This should show up as downloading-boot-script. The downloading boot-script state just means that we are downloading the bootscript that points to the appropriate version of code for the fabric.

Leaf203# cat /mit/sys/summary
[ 1047.965687] epld_upgrade (25344) Ran 5258 msecs in last 5304 msecs
 
# System
address                  : 0.0.0.0
bootstrapState           : none
childAction              :
configIssues             :
controlPlaneMTU          : 9000
currentTime              : 2017-10-19T21:14:45.034+00:00
dn                       : sys
enforceSubnetCheck       : no
etepAddr                 : 0.0.0.0
fabricDomain             : ACI Fabric1
fabricId                 : 1
fabricMAC                : 00:22:BD:F8:19:FF
id                       : 203
inbMgmtAddr              : 0.0.0.0
inbMgmtAddr6             : ::
lcOwn                    : local
modTs                    : 2017-10-19T21:07:10.342+00:00
mode                     : unspecified
monPolDn                 : uni/fabric/monfab-default
name                     : Leaf203
nameAlias                :
oobMgmtAddr              : 0.0.0.0
oobMgmtAddr6             : ::
podId                    : 1
remoteNetworkId          : 0
remoteNode               : no
rn                       : sys
role                     : leaf
serial                   : FDO21242YD1
state                    : downloading-boot-script
status                   :
systemUpTime             : 00:00:17:29.000
unicastXrEpLearnDisable  : no

 

Option 2 – Use Firmware Group for auto-provisioning

In order to enable this configuration, we’ll need to do a couple of things:

  1. Enable the “Enforce bootscript version validation” knob and set the “Default Firmware version” to ANY.
  2. Create a New Firmware Group with a target code and place all possible leafs and all possible spines in that firmware group. By all possible leafs/spines, I mean all possible that could join in the future as well.
  3. Commission your Leaf/Spine switch to the ACI fabric and watch! It will join the fabric and be automatically upgraded to the desired code!
Step 1 – Enabling auto-provisioning

On the Firmware Node Version page in the APIC GUI, Click the “Enforce Bootscript Version Validation” checkbox, and set the “Default Firmware Version” to ANY.

Admin > Firmware > Firmware Node Version

Enforce Bootscript Version Validation - Auto Provisioning.png
Auto-Provisioning

 

Step 2 – Creating your Firmware Group

Admin > Firmware > Firmware Node Version > Firmware Groups

Next, we’ll create our “default” Firmware Group, whereby we set the current (and target) code version for our Fabric. The extra step we will take (to ensure that the auto-upgrade takes place) is that we in the “Group Node IDs” Section, we will place a range of ALL possible nodes; this ensures that when and if we add a NEW node (i.e., a node that is not a part of the fabric today), that it will be covered in this list. Failure to do this step will result in the fact that your Leaf or Spine switch will not be automatically upgraded when it is added to the fabric.

  • Name the Group (i.e., 3.0.2h) << I like to name Firmware Groups after the version of code
  • Target Firmware Version – Set this to your desired APIC code
  • Group Node IDs (IMPORTANT) – Use a large range! 101 – 999 is acceptable; the important part is that you are including the range of all nodes that could POSSIBLY be added to your fabric.

Create Firmware Group

Step 3 – Go Commission your node!

 

Verification

Once you commissioned your switch, I’d recommend hopping into the console and watching the process (if available). Once you’re in, use the following command to check the status “cat /mit/sys/summary” – What you’re looking for is the “state”, at the end of the output. This should show up as downloading-boot-script. The downloading boot-script state just means that we are downloading the bootscript that points to the appropriate version of code for the fabric.

Leaf203# cat /mit/sys/summary
[ 1047.965687] epld_upgrade (25344) Ran 5258 msecs in last 5304 msecs
 
# System
address                  : 0.0.0.0
bootstrapState           : none
childAction              :
configIssues             :
controlPlaneMTU          : 9000
currentTime              : 2017-10-19T21:14:45.034+00:00
dn                       : sys
enforceSubnetCheck       : no
etepAddr                 : 0.0.0.0
fabricDomain             : ACI Fabric1
fabricId                 : 1
fabricMAC                : 00:22:BD:F8:19:FF
id                       : 203
inbMgmtAddr              : 0.0.0.0
inbMgmtAddr6             : ::
lcOwn                    : local
modTs                    : 2017-10-19T21:07:10.342+00:00
mode                     : unspecified
monPolDn                 : uni/fabric/monfab-default
name                     : Leaf203
nameAlias                :
oobMgmtAddr              : 0.0.0.0
oobMgmtAddr6             : ::
podId                    : 1
remoteNetworkId          : 0
remoteNode               : no
rn                       : sys
role                     : leaf
serial                   : FDO21242YD1
state                    : downloading-boot-script
status                   :
systemUpTime             : 00:00:17:29.000
unicastXrEpLearnDisable  : no

 

APIC 2.2 XML code to enable the auto-provisioning feature

In APIC 2.2, the configuration knobs do not show up in the GUI, however they are present under the hood and can be turned on if you know how.

To configure
POST URL — https://{{APIC_IP}}/api/node/mo/uni/fabric/fwrepop.xml

BODY
<firmwareRepoP enforceBootscriptVersionValidation=”yes” defaultSwitchVersion=”any” status=”modified”/>

To verify it has been configured
GET URL – https://{{hostName}}/api/node/mo/uni/fabric/fwrepop.xml

– or –

Login to visore (https://{{APIC_IP}}/visore.html (credentials are your apic username/password)

In the DN field, search for “firmwareRepoP”

You should see the following:

Screen Shot 2017-09-21 at 10.15.39 AM.png

 


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.