Skip to main content
Cisco SD-WAN
Support
Product Documentation
Viptela Documentation

Software Installation and Upgrade for Cisco IOS XE Routers

  1. Last updated
  2. Save as PDF

This article describes how to install the IOS XE SD-WAN Software Release 16.10.2 on Cisco IOS XE routers.

Supported Hardware Platforms

You can install the IOS XE SD-WAN software on the following Cisco IOS XE routers:

  • Cisco ASR 1000 series aggregation services routers
    • ASR 1001-HX and ASR 1001-X
    • ASR 1002-HX and ASR 1002-X
  • Cisco ISR 1000 series integrated services routers
    • C1111-8P, C1111-8P LTE EA, and C1111-8P LTE LA
    • C1117-4P LTE EA and C1117-4P LTE LA
  • Cisco 4000 series integrated services routers
    • ISR 4221
    • ISR 4221X/K9
    • ISR 4321
    • ISR 4331
    • ISR 4431
    • ISR 4451
    • ISR 4461
  • ENCS 5100
    • ISRv
  • ENCS 5406
    • ISRv
    • T1, E1, and 4g NIMs
  • ENCS 5408
    • ISRv
    • T1, E1, and 4g NIMs
  • ENCS 5412 with T1/E1 and 4G NIM modules
    • ISRv

Supported Interface Modules

The following modules are supported for the ISR 4000 series routers:

  • NIM-1GE-CU-SFP
  • NIM-2GE-CU-SFP
  • NIM-1MFT-T1/E1
  • NIM-2MFT-T1/E1
  • NIM-4MFT-T1/E1
  • NIM-8MFT-T1/E1
  • NIM-ES2-4
  • NIM-ES2-8
  • NIM-LTEA-EA
  • NIM-LTEA-LA
  • NIM-VAB-A
  • NIM-VAB-M
  • SM-X-4X1G-1X10G
  • SM-X-6X1G

Supported Crypto Modules

The following crypto modules are required for the ASR 1000 series routers:

  • ASR1001HX-IPSECHW, for the ASR 1001-HX
  • ASR1002HX-IPSECHW, for the ASR 1002-HX

Before You Begin

Before you deploy an IOS XE router in the overlay network, ensure the following:

  • The controller devices—vBond orchestrators, vManage NMSs, and vSmart controllers—are running Cisco SD-WAN Software Release 18.3.
  • If you deploy both IOS XE and vEdge routers in the overlay network, the vEdge routers are running Release 17.2.1 or higher of the Viptela software. With these software versions, the vEdge and IOS XE software can interoperate, allowing BFD tunnels to be established between vEdge routers and IOS XE routers.
  • If you deploy both IOS XE and vEdge routers in the same site, the vEdge routers are running Cisco SD-WAN Software Release 18.3.
  • The ISR 4000 series router has at least 4 gigabytes (GB) of DRAM installed. It is recommended that the router have 8 GB of DRAM.
  • The ASR 1000 series router has at least 8 GB of DRAM installed. The ASR 1002-HX router has at least 16 GB of DRAM installed.
  • The router's bootflash has a minimum of 1.5 GB space available for the XE SD-WAN image.
  • If using your enterprise root certificate to authenticate the router, the certificate is copied to the router's bootflash before installing the XE SD-WAN software.
  • All unsupported modules are removed from the router before installing the XE SD-WAN software. For a list of supported modules, see Supported Interface Modules and Supported Crypto Modules.
  • The updated device list is uploaded to the vManage NMS and sent to the vBond orchestrator. To do so:
    1. Obtain the router's chassis and board ID serial number by issuing the show crypto pki certificates CISCO_IDEVID_SUDI command at the system prompt. If running Release 16.6.1 or earlier on an ASR series router, issue the show sdwan certificate serial command.
    2. Add the router's serial number to Plug and Play (PnP) Connect portal. See Add the IOS XE Router to the PnP Portal.
    3. In the vManage NMS Configuration ► Devices screen, click the Sync Smart Account button to download the updated device list to vManage NMS and send it to the vBond orchestrator.
  • Device configuration templates are created and attached to the router using the vManage NMS Configuration ► Templates screen. This ensures that the router can obtain a configuration and establish full control connections when it comes up.
  • If the router exceeds the unidirectional encrypted bandwidth of 250 Mbps and if the HSECK9 license is not already installed, the license file is copied to the router's bootflash and license installed on the router:
    ISR4K# license install file path
  • The ASR 1000 series, ISR 1000 series, and ISR 4000 series router is running the required version of the ROM monitor software (ROMMON), as shown in the table below. To verify the ROMMON version running on the router, issue the show rom-monitor or show platform command at the system prompt.
Hardware Platform Required ROM Monitor Software Version
ASR 1000 series 16.3 (2r)
ISR 1000 series 16.9 (1r)
ISR 4000 series 16.7 (3r)
  • The ISRv router is running the minimum required version of the CIMC and NFVIS software, as shown in the table below.
Hardware Platform CIMC NFVIS
ISRv 3.2.4 3.8.1

Download the XE SD-WAN Software

To download the XE SD-WAN software from the Cisco site:

  1. Go to https://www.cisco.com.
  2. Click Support & Downloads from the menu on the left side.
  3. On the Products and Downloads page, in the Downloads search box, search for Software-Defined WAN (SD-WAN) and select it.
  4. On the Select a Product page, from the right-most pane, select XE SD-WAN Routers.
  5. From the right-most pane, select your router model:
    • ASR 1000 Series IOS XE SD-WAN
    • ISR 1000 Series IOS XE SD-WAN
    • ISR 4000 Series IOS XE SD-WAN.
  6. Click the desired software release version to download it. The software image name has the format router-model-ucmk9.​release-number.
  7. Copy the software image to an HTTP or FTP file server in your local network.

Install the XE SD-WAN Software

To install the XE SD-WAN software on a new IOS XE router, nothing is required. All IOS XE routers ship with the XE SD-WAN software already installed.

If you have an existing IOS XE router, follow these steps to install the XE SD-WAN software:

  1. Download the XE SD-WAN software image from the Cisco site. 
  2. Upload the XE SD-WAN software image from the file server to the router's bootflash. See sample syntax below.
    FTP:
    ISR4K# (config)# ip ftp source-interface interface
    ISR4K# copy ftp://username:password@server-IP/file-location bootflash:
    TFTP:
    ISR4K# (config)# ip tftp source-interface interface
    ISR4K# (config)# ip tftp blocksize 8192
    ISR4K# copy tftp: bootflash: 
    SCP (assumes SSH is enabled):
    ISR4K# (config)# ip scp server enable
    FileServer$ scp filename username@router-IP:/filename
  3. Ensure that the router is connected to a management console.
  4. Create a backup of the current configuration that can be saved in the router's bootflash:
    ISR4K# copy run bootflash:original-xe-config
  5. Remove all existing boot statements and save the configuration:
    ISR4K# (config)# no boot system ...
    ISR4K# wr mem
  6. Verify that the BOOT variable is blank in the following output:
    ISR4K# show bootvar
    BOOT variable =
    CONFIG_FILE variable does not exist
    BOOTLDR variable does not exist
    Configuration register is 0x2102
    Standby not ready to show bootvar
  7. Add a boot variable that points to the XE SD-WAN image:
    ISR4K# (config)# boot system flash bootflash:SDWAN-image
    ISR4K# wr mem
  8. Verify that the BOOT variable points to the XE SD-WAN image:
    ISR4K# show bootvar
    BOOT variable =  bootflash:isr4300-ucmk9.16.10.1a.SPA.bin,1;
    CONFIG_FILE variable does not exist
    BOOTLDR variable does not exists
    Configuration register is 0x2102
    Standby not ready to show bootvar
  9. Remove all existing configuration from the router:
    ISR4K# write erase

  10. Set the config-register to 0x2102:
    ISR4K# config t
    ISR4K(config)# config-register 0x2102
    ISR4K(config)# end

  11. Verify that the config-register is set to 0x2102 or that it will be set to 0x2102 at the next reboot:
    ISR4K# show bootvar
  12. Reboot the router:
    ISR4K# reload
    Proceed with reload? [confirm] Yes
    If prompted to save the configuration, enter No. The router reboots with the XE SD-WAN image.
  13. If prompted to enter the initial configuration dialog, enter No.
    --- System Configuration Dialog ---
    Would you like to enter the initial configuration dialog? [Yes/No]: No
  14. If prompted to terminate auto-install, enter Yes.
    Would you like to terminate auto-install? [Yes/No]: Yes
  15. At the login prompt, log in with the default username, which is admin, and the default password, which is admin.
    If you are performing a first-time upgrade, the router does not prompt you for user credentials.

  1. Stop PnP and allow the XE SD-WAN packages to install:
    ISR4K# pnpa service discovery stop
    All the daemons are up prior to executing the ISR4K# pnpa service discovery stop command.
    PNP-DISCOVERY (1): Stopping PnP Discovery...
    Router#
    *Dec 20 11:12:10.756: %PNP-6-PNP_DISCOVERY_ABORT_ON_CLI: PnP Discovery abort on CLI input
    *Dec 20 11:12:10.759: %DMI-5-SYNC_START: R0/0: syncfd: External change to running configuration detected. The running configuration will be synchronized to the NETCONF running data store.
    *Dec 20 11:12:17.125: %DMI-5-SYNC_COMPLETE: R0/0: syncfd: The running configuration has been synchronized to the NETCONF running data store.
    *Dec 20 11:12:17.125: %DMI-5-ACTIVE: R0/0: syncfd: process is in steady state.
    *Dec 20 11:12:17.323: %DMI-5-CONFIG_I: R0/0: nesd: Configured from NETCONF/RESTCONF by system, transaction-id 177
    *Dec 20 11:12:18.665: %Cisco-SDWAN-Router_RP_0-SYSMGR-5-NTCE-200050: R0/0: SYSMGR: System status solid green (reason: All daemons up)

  2. Enable this image to be the default image on the router:
    ISR4K# request platform software sdwan software reset

    *Mar  5 01:53:36.563: %INSTALL-5-INSTALL_START_INFO: R0/0: install_engine: Started install activate bootflash:asr1000-ucmk9.16.11.01prd8.SPA.bin/usr/binos/conf/install_util.sh: line 594: /bootflash/.installer/install_add_pkg_list.txt: No such file or directory
    *Mar  5 01:53:54.750: %SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram
    Router#
    *Mar  5 01:54:18.893: %INSTALL-5-INSTALL_COMPLETED_INFO: R0/0: install_engine: Completed install activate PACKAGEMar  5 01:54:22.288: %PMAN-5-EXITAC
    Initializing Hardware ...
    System integrity status: 90170400 12030107
    U
    System Bootstrap, Version 16.3(2r), RELEASE SOFTWARE
    Copyright (c) 1994-2016  by cisco Systems, Inc.
    Current image running: Boot ROM0
    Last reset cause: LocalSoft
    ASR1001-HX platform with 8388608 Kbytes of main memory
    File size is 0x00001ae3
    Located packages.conf
    Image size 6883 inode num 155346, bks cnt 2 blk size 8*512
    #

    File size is 0x01fc15da
    Located asr1000-rpboot.16.11.01prd8.SPA.pkg
    Image size 33297882 inode num 155358, bks cnt 8130 blk size 8*512
    ##############################################################################################################################################################################################################################################################

    Boot image size = 33297882 (0x1fc15da) bytes
    ROM:RSA Self Test Passed
    ROM:Sha512 Self Test Passed
     
    Package header rev 3 structure detected
    Calculating SHA-1 hash...done
    validate_package_cs: SHA-1 hash:

                            calculated cc42e6b2:5766af1c:0594533f:b6b0d36f:7544436f
                            expected   cc42e6b2:5766af1c:0594533f:b6b0d36f:7544436f

    Validating main package signatures
    RSA Signed RELEASE Image Signature Verification Successful.
    Image validated

The router reboots with the XE SD-WAN image.

Note: Once you have installed this image, remember to use the command config-transaction to open CLI configuration mode. The config terminal command is not supported on SD-WAN routers.

Configure the IOS XE Router from the CLI

If your IOS-XE router is connected to a DHCP server, PnP runs automatically and vManage NMS automatically configures the device after the control connections are up. To verify that the control connections are up and the device is validated, enter the following command at the system prompt:

ISR4K# show sdwan control connections

If your IOS XE router is connected to a DHCP server and you are not using PnP, or if your IOS XE router is not connected to a DHCP server on the WAN, configure the router manually using the CLI:

  1. Connect to the the router using a management console.
  2. Stop PnP to allow access to the CLI:
    ISR4K# pnpa service discovery stop
  3. Enter configuration mode:
    ISR4K# config-transaction
    ISR4K(config)#
  4. Configure the hostname:
    ISR4K(config)# system host-name hostname
    Configuring the hostname is optional, but is recommended because this name in included as part of the prompt in the CLI and it is used on various vManage NMS screens to refer to the device.
  5. Configure the system IP address.
    ISR4K(config-system)# system-ip ip-address
    The vManage NMS uses the system IP address to identify the device so that the NMS can download the full configuration to the device.
  6. Configure the numeric identifier of the site where the device is located:
    ISR4K(config-system)# site-id site-id
  7. Configure the IP address of the vBond orchestrator or a DNS name that points to the vBond orchestrator. The vBond orchestrator's IP address must be a public IP address, to allow the router to reach the vBond orchestrator.
    ISR4K(config-system)# vbond (dns-name | ip-address)
  8. Configure the organization name, which is the name that is included in the certificates on all devices in the overlay network. This name must be the same on all devices.
    ISR4K(config-system)# organization-name name
  9. Configure the tunnel interface to use for overlay connectivity. The tunnel number must match the WAN interface used. For example, if the router interface is Gig0/0/2, the tunnel interface number is 2.
    ISR4K(config)# interface Tunnel #
    ISR4K(config-if)# ip unnumbered wan-physical-interface
    ISR4K(config-if)# tunnel source wan-physical-interface
    ISR4K(config-if)# tunnel mode sdwan
  10. If the router is not connected to a DHCP server, configure the IP address of the WAN interface:
    ISR4K(config)# interface GigabitEthernet #
    ISR4K(config)# ip address ip-address mask
    ISR4K(config)# no shut
    ISR4K(config)# exit
  11. Configure tunnel parameters:
    ISR4K(config)# sdwan
    ISR4K(config-sdwan)# interface WAN-interface-name
    ISR4K(config-interface-interface-name)# tunnel-interface
    ISR4K(config-tunnel-interface)# color color/path-name
    ISR4K(config-tunnel-interface)# encapsulation ipsec
  12. If an IP address is manually configured on the router, configure a default route:
    ISR4K(config)# ip route 0.0.0.0 0.0.0.0 next-hop-ip-address

  13. If the vBond address was defined as a hostname, configure DNS:
    ISR4K(config)# ip domain lookup
    ISR4K(config)# ip name-server dns-server-ip-address

  14. Save the changes and exit configuration mode:
    ISR4K(config)# commit
    ISR4K# exit

  15. If using a certificate signed by your enterprise root CA, install the certificate:
    ISR4K# request platform software sdwan root-cert-chain install bootflash:certificate
    Router# $tform software sdwan root-cert-chain install bootflash:cacert.pem
    uploading root-ca-cert-chain via VPN 0
    Copying ... /bootflash/cacert.pem via VPN 0
    /tmp/sw/rp/0/0/rp_daemons/mount/usr/bin/vconfd_script_upload_root_ca_crt_chain.sh: line 197: [: ==: unary operator expected
    Successfully installed the root certificate chai            

  16. Verify that the control connections are up and the router is validated:
    ISR4K# show sdwan control connections

PEER    PEER PEER         SITE  DOMAIN  PEER         PEER PRIV  PEER        PEER PUB                                            
TYPE    PORT SYSTEM IP    ID    ID      PRIVATE IP   PORT       PUBLIC IP   PORT     LOCAL COLOR               
--------------------------------------------------------------------------------------------------
vsmart  dtls 192.168.1.2  10    1       172.1.1.3    12346      172.1.1.3   12346     biz-internet                    
vbond   dtls -             0    0       172.1.1.4    12346      172.1.1.4   12346     biz-internet                     
vmanage dtls 192.168.1.3  10    0       172.1.1.2    12346      172.1.1.2   12346     biz-internet       
                         
                          CONTROLLER
                          GROUP
PROXY STATE  UPTIME       ID
------------------------------------       
  up         1:19:51:40   0
  up         1:19:51:45   0
  up         1:19:51:38   0

You can now configure SD-WAN features on the router using the vManage NMS templates.

Add the IOS XE Router to the PnP Portal

  1. Go to https://software.cisco.com.
  2. In the Network Plug and Play  box, click Plug and Play Connect. The Plug and Play Connect dialog box opens.
  3. If you have not already created the controller profile, do so now:
    1. Click the Controller Profiles tab located directly beneath the Plug and Play Connect title and to the right of the Devices tab.
    2. Click Add Profile. The Add Controller Profile dialog box opens with Step 1 Profile Type highlighted.
      G00546.png
    3. In the Controller Type  drop-down, select vBond.
    4. Click Next. Step 2 Profile Settings is highlighted and the profile setting fields displayed.
      G00547.png
    5. In the Profile Name field, enter a name for the PnP profile you are creating.
    6. In the Description field, enter a description of the profile you are creating. This field is optional.
    7. In the Default Profile drop-down, select Yes if no other controller profile exists.
    8. In the Organization Name field, enter the organization name that is included in the certificates on all devices in the overlay network. You can find the organization name in the vManage NMS Administration ► Settings screen.
    9. In the Primary Controller drop down, select Domain Name or IPv4, and fill in the appropriate fields.
    10. Click Next. The system returns you to the Devices tab of the Plug and Play Connect dialog box. 
      G00549.png
  4. If the router details have been stored in a CSV file, click Import using a CSV file and attach the file. Otherwise, select Enter Device info manually to add the router to the PnP portal.
  5. Click Next. The Identify Device popup window opens.
    G00548.png
  6. Fill in the Serial Number, Base PID, and Certificate Serial Number fields with the output of the show crypto pki certificates CISCO_IDEVID_SUDI command issued at the system prompt:
    ISRK# show crypto pki certificates CISCO_IDEVID_SUDI
    Certificate
      Status: Available
      Certificate Serial Number (hex): XXXXXXXX
      Certificate Usage: General Purpose
      Issuer:
        cn=ACT2 SUDI CA
        o=Cisco
      Subject:
        Name: ISR4431/K9
        Serial Number: PID:ISR4431/K9 SN:XXXXXXXXXXX
        cn=ISR4431/K9
        ou=ACT-2 Lite SUDI
        o=Cisco
        serialNumber=PID:ISR4431/K9 SN:XXXXXXXXXXX
      Validity Date:
        start date: 19:35:04 UTC Mar 28 2016
        end   date: 19:35:04 UTC Mar 28 2026
      Associated Trustpoints: CISCO_IDEVID_SUDI

    See Before You Begin.
  7. In the Controller Profile drop-down, select the controller profile you created in Step 3.
  8. Click Save.

The router's serial number is added to the PnP portal.

Upgrade or Downgrade ROMmon

This section describes how to upgrade or downgrade the ROM monitor (ROMmon) version that is running on a device. Perform this procedure if you need to change a ROMmon version to a required version that is shown in the “Before You Begin” section.

To determine the ROMmon version that is running on a device, enter the following command:

Router# Show rom-monitor R0

To upgrade or downgrade ROMmon, follow these steps:

  1. Take either of these actions:
  • If possible, load the ROMmon file into the device bootflash using a method such as SCP, FTP, TFTP, or a USB drive.
  • If you do not have out-of-band management access to the router, transfer the ROMmon file by using the vManage CLI, as shown in the following example:

vManage# request execute vpn 0 scp -P 830 C1100-rommon-16-1r-SPA.pkg admin@router-ip-address:/bootflash/vmanage-admin/C1100-rommon-169-1r-SPA.pkg

  1. Take either of these actions to verify that the ROMmon file that you loaded or transferred appears in the directory output:
  • If you loaded the ROMmon file into the device bootflash, enter the following command:

Router# dir bootflash

  • If you transferred the ROMmon file by using the vManage CLI, enter the following command:

vManage# dir bootflash:vmanage-admin

  1. Enter the following command to set config-register to 0x2102:

Router# config-register 0x2102

  1. Upgrade (or downgrade) the ROMmon file on your device by using the upgrade command as shown in the following examples:
  • Example upgrade command if you loaded the ROMmon file into the device bootflash:

Router# upgrade rom-monitor filename bootflash: C1100-rommon-169-1r-SPA.pkg R0

  • Example upgrade command if you transferred the ROMmon file by using the vManage CLI:

vManage# upgrade rom-monitor filename bootflash:vmanage-admin/C1100-rommon-169-1r-SPA.pkg R0

  1. After a series of messages pertaining to the upgrade display and the router prompt displays, enter the following command to reload the router:

Router# Reload

  1. Enter the following command and verify that the output shows the new ROMmon version:

Router# Show rom-monitor R0

 

 

Additional Information

See the documentation for your Cisco router.
See the Templates help article for your software release.
Software Installation and Upgrade for vEdge Routers

  1. Back to top
  • Was this article helpful?

Recommended articles

  1. There are no recommended articles.
  1. Article type
    Topic
  2. Tags
    1. software install