19

In order of preference/priority, what factors do you consider in driving an upgrade (or downgrade) with Cisco IOS? If no compelling factors exist, how long would you allow a particular version of IOS to stay running? I've seen some switches with uptimes > 5 years.

And when upgrading, how is the specific IOS release identified as the upgrade target?

Improve this question

3 Answers 3

Reset to default
26

In order of preference/priority, our company tends to upgrade based on these factors:

  • Vulnerabilities, vulnerabilities, vulnerabilities!
  • Bugs
  • Attaining new features not currently available-- new cards/modules have a "first supported in" IOS version which could be higher than what you have running
  • Migrating away from retired release trains
  • Matching versions on more recently deployed and similar hardware

A device that is very critical to the infrastructure may not be as aggressively upgraded as one that is less critical. Consideration is given to the role of the device, the redundancy surrounding it, and the impact of the upgrade itself by the downtime incurred or by the possibility of having config feature behavior changes or different defaults when going between major versions. This is the necessity question that also touches on soft costs such as the time and resources to accomplish the upgrades measured against the weight given to each of the factors such as vulnerabilities.

Be sure to subscribe to multiple vulnerability announcement sites such as Cisco PSIRT (Product Security Incident Response Team) and the US Cert (Computer Emergency Readiness Team).

A downgrade might be in order if:

  • Organization has a policy to only run tested/QA'd versions and new equipment came with a more recent release.
  • Org has a policy against running anything other than GD.
  • Use Cisco's Output Interpreter of "show version" to look for obvious issues/vulnerabities/bugs.
  • Look for GD (General Deployment) releases and avoid DF (Deferred).
  • Use ED (Early Deployment) only when it contains must-have features not available elsewhere.
  • Avoid LD (Limited Deployment) when possible and use GD instead.

There are certainly arguments for going to an ED or LD version, but the desire, of course, is to get to the most stable version that meets requirements. Use Cisco's Feature Navigator to help identify potentially different feature-sets (assuming you're licensed to use them).

Improve this answer
4
  • 3
    Expanding upon "Attaining new features" I would bring out the fact that new cards/modules have a "first supported in" IOS version which could be higher than what you have running.
    – Mike Marotta
    May 30, 2013 at 13:55
  • 2
    I would add it depends on how critical the equipment is and if it's redundant or not. For instance, if it's your core switch, and for some reason, you only have one, then you might NOT want to upgrade, unless you HAVE to - and then maybe not to the most recent version, but to the most STABLE version instead.
    – Pseudocyber
    May 30, 2013 at 14:36
  • 2
    I would have said: 1. Vulnerabilities 2. Vulnerabilities 3. Vulnerabilities 4. Bugs
    – Paul Gear
    May 30, 2013 at 23:09
  • Excellent points by everyone. Folded back into answer.
    – generalnetworkerror
    May 31, 2013 at 20:06
8

You missed out, necessity

A switch in a dusty old broom closet probably doesn't need it's IOS upgraded to the latest IOS for security fixes and new features, if it only has a 10 year old ink jet printer attached.

You should comment on when not to upgrade also, as it can be a waste of time, human resources, and cause downtime when jumping between major versions that might cause features to no longer work or the config syntax has changed, and so on.

Improve this answer
3
  • Points incorporated into answer.
    – generalnetworkerror
    May 31, 2013 at 20:05
  • Network devices exist to connect things, ignoring security just because a device is "isolated" has burnt many companies. With a well managed change policy upgrading is a small cost, and the consistency gained alone can easily pay back the cost.
    – LapTop006
    Jun 1, 2013 at 12:10
  • 1
    @LapTop006 That was an off the cuff example, my point was though, that you shouldn't always upgrade "because you can", of if you really have no good reason to.
    – Baldrick
    Jun 1, 2013 at 15:32
1

All very good comments. I've also seen network standardization and IOS test results that can help drive ios upgrade.

I would agree that vulnerabilities is high in the list, but it also depends on type of network and traffic type.

For ex, a financial institution would be more concerned with security and vulnerabilities than another type of network that could be concerned more with bugs once they get hit with one thus driving change.

Besides this, it's also best to disable services not needed in the network or on the devices.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.