CiscoWorks Resource Manager Essentials

Software Image Management (SWIM) is an application in Resource Manager Essentials (RME) that helps network administrators manage and upgrade software images on Cisco devices. Essentials is one of the products in the CiscoWorks 2000 family.

This document answers the most frequently asked questions about the SWIM application in the Essentials 3.0 release. This document covers details up to the SWIM 3.0 release. The SWIM 3.0 release is bundled with the Essentials 3.0 release. If no specific version of SWIM is mentioned in the document, assume it is 3.0. If content applies to a specific SWIM release, the SWIM release number is mentioned.

A. SWIM offers the following management functions:

• Image distribution—Schedules download of software images to a single device or groups of devices. Hardware and firmware validation verifies whether the new image can run on the device.
• Audit trail—Tracks software changes made on the network.
• Importing images from CCO—Integrates with Cisco Connection Online (CCO) to download software images.
• Software library—Builds and maintains a library archive of software images. You can add images to the library from the file system, CCO, or a device.
• Upgrade analysis—Determines the hardware upgrades required on network devices to enable them to run new software.
• Job ApprovalMaker Checker—Allows organizations to require approvals before allowing software upgrades.
• Baseline and library synchronization—Allows the library to synchronize with the software images running on the devices. A periodic job can generate a list of images that are not in the library. You then have the option to import new images into the library and then check them for discrepancies between software images running on the network and images in the library.
• Work order—Shows changes that will be made to network devices as part of the software upgrade.
• CCO bug tool integration—Integrates with CCO to report bugs that could affect the software that runs on network devices.

A. No. SWIM only supports software management functions. The Config Archive application supports Configuration File Management functions. You can access the Config Archive application management functions by choosing Resource Manager Essentials > Administration > Configuration Management > General Setup.

A. The software version requirements vary among classes of devices.

Cisco IOS-based devices must run at least Software Release 10.3. Cisco IOS Software Releases before 10.3 do not provide Management Information Base (MIB) or Command-Line Interface (CLI) interfaces required by SWIM to manage the devices.

With Catalyst (Layer 2) switches, the minimum software requirement is Cisco IOS Software Release 2.1 on Supervisor. SWIM requires the minimum Cisco IOS Software Release 3.2(4) on Cisco 760 Series Integrated Services Digital Network (ISDN) routers and Cisco IOS Software Release 4.0(1) on 770 Series ISDN routers.

A. Most Cisco IOS devices load the software image from Flash to RAM when rebooting, then run the software from RAM. Such devices are called Run-from-RAM (RFR) devices. For these devices, the software image on Flash can be upgraded without rebooting the device.

Certain Cisco IOS devices (namely 2500s, 1600s, and AS5200s) run the system software image directly from Flash. These are Run-from-Flash (RFF) devices. The Flash partition in which the current image is stored is the RFF partition, which is read-only.

SWIM supports upgrading software images on RFF partitions by using a procedure called Rxboot upgrade. Before upgrading, reboot the device and put it into Rxboot mode, which makes the RFF partition available to write a new software image.

A. SWIM works the following ways:

• When creating software upgrade jobs, SWIM reads information from Inventory in Essentials about the type of device, size of RAM, and Flash cards.
• Based on the software on the device and other information that is read from Inventory, SWIM recommends a new image for the device from the library or from the library and CCO. SWIM then schedules a software upgrade job.
• When the upgrade job runs, SWIM connects to the device using Simple Network Management Protocol (SNMP) or, for some devices, using Telnet. SWIM uses the appropriate Management Information Base (MIB) or Command-Line Interface (CLI) instrumentation provided by the device to upgrade the software. MIBs that manage differ among device classes and software versions.

A. Inventory information must be up-to-date for SWIM to produce expected results. Out-of-date Inventory information can result in failed SWIM functions, including the following:

• The wrong image or Flash card might be recommended to receive an upgrade.
• Incorrect determination on whether the Flash partition needs to be erased.
• SWIM might add an image to the library from the device (Resource Manager Essentials > Software Management > Library > Add Images), yet fail to import the expected image files. The image is imported into the library, but because the Inventory information is incorrect or out-of-date, the imported image is different than the expected image.
• The baseline and synchronization functions might not import the expected images into the library from the devices.

A. SWIM’s System Software Recommendation compares target device information with image attributes and requirements. Image attributes include the size of the image, its subset feature, and the minimum DRAM and BOOT ROM requirements. You can input the attributes when you import the images into the library. You can later edit the attributes by using the Browse Library function.

The following steps explain the passes SWIM performs before making an image recommendation:

1. SWIM reads and stores all images in a list that belong to the same family as the device selected for upgrade. SWIM queries the local software library as well CCO.
2. SWIM checks for minimum requirements. Using the image list from Step 1, SWIM removes the following:
   1. Images that require more DRAM than the device has.
   2. Images that require a later version of BOOT ROM than the device has.
   3. Images that have file sizes larger than the size of Flash partitions on the device.
   4. Images that have the same version number and feature subset as the running image.
3. SWIM compares the Feature Subset name of each of the remaining images in the list to the Feature Subset name of the running image on the device. The images in the list are marked relative Feature Subset. SWIM marks the images with one of the following:
   1. SUPERSET (Feature Subset of the image is a superset of the image running on the device.)
   2. EXACT
   3. SUBSET
   4. OTHER
4. At the end of Step 3, SWIM has four groups of images (a-d in Step 3). Some groups may not have images that match the Feature Subset criteria in a group.
5. SWIM searches all four groups in Step 3. If SWIM finds a group without an image, it moves to the next group. When SWIM finds an image in a group, it recommends that image serve as the default image.
6. After a default image is selected, SWIM analyzes the Flash partition information on the device to make a default Flash target recommendation. SWIM also does the following:
   1. Makes a list of all Flash partitions on the device and obtains the total size of the Flash partition as well as the free space available on the Flash partition. SWIM does not erase files whose sizes are less than 1 MB.
   2. Removes Flash partitions from the list in Step 6a that are read-only.
   3. Finds the name of the partition that has the maximum total size. If the total size of the partition exceeds the size of the image selected in the earlier steps, SWIM recommends that this Flash partition serve as the default Flash target.
   4. If SWIM cannot find a Flash partition that matches the criteria, it finds the Flash partition that has the most free space. SWIM recommends this partition as the default Flash target. (SWIM erases the Flash before copying the new image).
   5. If SWIM fails to recommend a Flash target, it removes the default image recommendation.

A. SWIM is automatically installed when you install Essentials. Follow the steps below to verify that SWIM has been installed correctly.

1. Launch Essentials.
2. Log in and use Administrator privileges.
3. Select CiscoWorks2000 Server > About CiscoWorks2000 > Applications and Versions.
4. Scroll the page to verify that the following packages are installed:
   • On Solaris, a package named CSCOswim appears in the Resource Manager Essentials Installed Packages table.
   • On NT, an entry for SWIM appears under Name in the Resource Manager Essentials Installed Packages table.
   • The Version column shows which version or release of SWIM is installed.
5. If you have Administrator privileges, you can view the Software Management folder under Resource Manager Essentials and Resource Manager Essentials > Administration. Follow the steps below.
   1. Choose Resource Manager Essentials > Software Management.
   2. Choose Resource Manager Essentials > Administration > Software Management. The Software Management folder contains subfolders, each of which launches a SWIM function.

A. Different operations in SWIM require different levels of user privileges. Privilege levels are known as “roles” in Essentials. For a list of Essentials functions and required user roles, use the Permissions Report function. Choose CiscoWorks2000 Server > Setup > Security > Permissions Report. The following roles allow you to perform specific functions:

• Help Desk performs read-only operations on the network and in SWIM, such as viewing software changes on the network or viewing the status of SWIM jobs.
• Network Administrator performs SWIM operations that can cause changes to the network or to Essentials itself, such as the Distribute Images function or the Add Image to Library function.
• System Administrator sets Approver lists, schedules jobs, and edits SWIM preferences.

A. To find which functions you can access in SWIM:

1. Choose CiscoWorks2000 Server > Setup > Security > Modify My Profile to find your assigned roles. The assigned roles are displayed in the list box on the User Profile screen.
2. Choose CiscoWorks2000 Server > Setup > Security > Permissions Report to verify which Essentials and SWIM tasks you can run.

A. On UNIX, you must enable the RCP daemon and create a local user account, which is used for RCP authentication purposes.

On NT, you do not need an additional setup because the RCP service is set up as part of the Essentials install.

On a standard Solaris system, enable the RCP server by doing the following:

1. Log in as superuser.
2. Edit the /etc/inetd.conf file as shown below.
   1. Add a line to invoke in.rshd in the file /etc/inetd.conf. Depending on your system, the line that invokes the RCP server will look similar to the following:

      shell stream tcp nowait root /usr/sbin/in.rshd in.rshd 0

   2. Save the changes to the edited file and exit your text editor.

You also must create a user account on the Essentials server to act as the remote user to authenticate the RCP commands issued by devices. This user account must own an empty .rhosts file in its home directory to which the user bin has write access.

You can choose the name of this user account because you can configure the Essentials server to use any user account. The default user account name is cwuser. The examples in this procedure use the default name cwuser. If you choose to use a different name, substitute that name for cwuser.

To create and configure the RCP remote user account, follow the steps below while you are logged in as root.

1. Add a user account named cwuser to the system by issuing the following command:

   # useradd -m -c "user account to authenticate remote copy operations" \cwuser
   

2. Navigate to the cwuser home directory.
3. Create the .rhosts file by issuing the following command:

   # touch .rhosts
   

4. Change the owner of the .rhosts file by issuing the following command:

   # chown cwuser:bin .rhosts
   

5. Change the permissions of the .rhosts file by issuing the following command:

   # chmod 0664 .rhosts
   

6. If you did not use the default user name cwuser, configure the Essentials server to use the user account that you created as the RCP remote user on the Resource Manager Essentials > Administration > System Configuration screen.

A. Yes. If there are multiple IP addresses configured on the device, all IP addresses on the device must be configured in the Domain Name System (DNS). Examples of devices with multiple IP addresses are those having many interfaces, with each interface configured with its own IP address, or a device that interfaces configured with primary and secondary IP addresses.

Configure the DNS so that all IP addresses are resolved to the same host name. The host name in the DNS should match the host name inputted into RME’s Inventory.

A. Use the RCP transport protocol for image transfers only on Cisco IOS devices that support the CISCO-FLASH-MIB. Catalyst switches that run Supervisor software older than 5.2, and 700 Series devices do not support the RCP protocol.

The Cisco IOS devices can not use RCP if they only support OLD-CISCO-FLASH-MIB, (for example, MC3810) or if they do not support any Flash Management Information Base (MIB) (for example, RSP 7000 devices running Cisco IOS Software Releases 10.3-11.0).

A. When uninstalled, SWIM does not remove the software images directory from the Essentials server. The software images directory contains subdirectories for storing software images for various device families.

A. Simple Network Management Protocol (SNMP) is the preferred mechanism used by SWIM to upgrade software. Some devices, however, cannot be upgraded using SNMP alone. For such devices, SWIM uses a Telnet interface to do the upgrades. SNMP upgrades all Run-from-RAM Cisco IOS devices, Dual Flash Bank Run-from-Flash (DFB RFF) devices, and all Catalyst switches.

SWIM uses Telnet to perform the following upgrades:

• Single Flash Bank Run-from-Flash Cisco IOS devices (SFB 2500s, 1600s, AS5200)
• RSP 7000 devices running Cisco IOS Software Releases 10.3 - 11.0
• Cisco 700 Series
• CIP, MICA, Microcom upgrades

A. SWIM makes three attempts to connect to the device using SNMP. The first retry timeout interval of 10 seconds is not configurable. Subsequent retry timeout intervals are configurable and are based upon the value in the slow timeout variable in Resource Manager Essentials > Administration > System Configuration.

If the initial attempt to connect to the device fails, SWIM waits three minutes before it attempts to connect again. The three-minute wait enables routing protocol or spanning tree convergence to occur, which could have been initiated because another device was rebooted during the software upgrade.

The number of retries is not configurable. The underlying SNMP stack also tries three times to connect to the device. All the secondary addresses configured in DNS for the device are tried during each attempt.

A. SWIM upgrades software by using the Telnet interface or Command-Line Interface (CLI) on devices that do not support enough Management Information Base (MIB) instrumentation for software management. SWIM telnets into the devices and executes privileged commands such as copy tftp flash, copy flash tftp, erase flash, show version, copy flash modem to perform upgrades.

SWIM modifies the configuration file using the Telnet interface to upgrade the software. For SWIM to work on a device, there are some restrictions on how default privileges and enable mode authentication are configured. The restrictions apply to only those Cisco IOS devices that are managed by SWIM through the Telnet interface. Cisco 700 Series and Catalyst 5000/6000/4000 devices are not affected. Restrictions include the following:

• SWIM tries to run the above CLI commands from privilege level 15. The user must always configure an enable password/secret for privilege level 15, and the same password/secret must be inputted into RME’s Inventory. If the device is configured with TACACS authentication for enable mode access, then the Enable TACACS user name and password must be inputted into Inventory. The Enable User name and password authenticated by TACACS+ server always should receive a privilege level of 15.
• The default privilege level configured on a vty line must allow SWIM to run the CLI commands mentioned earlier as well change the configuration file on the device. The privilege level does not need to be 15, but setting the privilege level to 15 guarantees SWIM can always work on the device.

A. Job Approval allows an organization to require approvals before an administrator distributes software images. When an image distribution job is created, the administrator (or whoever creates the job) selects from a list of users who can approve the job. For the job to run, one of the users on the approver list must approve it before its scheduled time. If the job is not approved, it will be rejected at the scheduled time.

A. An approver list consists of user names in Essentials who have the authority to approve software upgrades. Create the list by using the Create Approver List function. Go to Resource Manager Essentials > Administration > Job Approval > Create Approver List. Only users who have an Approver role can be added to the Approver List.

A. Yes. To create a job that does not require approval, uncheck the Software Management’s appropriate Job Approval option. To create a job that does not require approval, go to Resource Manager Essentials > Administration > Job Approval > Edit Preferences >SWIM.

A. To configure Job Approval, do the following:

1. Add the approver user account with Approver role. Choose CiscoWorks2000 Server > Setup > Security >Add Users.
2. Create an Approver List. Choose Resource Manager Essentials > Administration > Job Approval > Create Approver List.
3. Enable the Job Approval option. Choose Resource Manager Essentials > Administration > Job Approval > Edit Preferences >SWIM.

A. Verify the user roles by going to CiscoWorks2000 Server > Setup > Security > Modify/Delete Users. To approve a job, the user must have an Approver role.

A. Only those who can approve the job can view the bottom frame of the Job Details page. To approve or reject the job, you must be on the list of approvers.

A. This option is available only for the non-Maker CheckerJob Approval model. For the Maker CheckerJob Approval model, allow time for the approver to approve the job.

A. A CCO connection is not mandatory to use basic SWIM functions. Image distribution, library management, tracking software upgrade changes, and other functions can run without CCO connectivity. CCO connectivity provides the additional benefits of obtaining images and their attributes from CCO and viewing the status of outstanding bugs against the software images running on the devices in the network. The following features of SWIM require connectivity to CCO:

• Add image to library from CCO. SWIM can import images for Cisco IOS, Catalyst, and 700 Series devices. For Cisco IOS devices, SWIM imports only system software, but does not support importing bootloader images.
• Distribute images directly from CCO to devices. This is also called Recommend Images from CCO. Without a CCO connection, the Recommend Images screen Image list box will not show images from CCO when it creates a Distribute Images job.
• CCO upgrade analysis.
• Cisco IOS image deferral processing.
• Browse Bugs, Browse Bugs by Device, and Locate Devices by Bugs options.

A. SWIM uses HTTP protocol to communicate to CCO about downloading images and their attributes. If you use an HTTP proxy for Internet connectivity, configure Proxy URL information in Resource Manager Essentials > Administration > System Configuration.

A. SWIM does not support proxy that requires user authentication.

A. During the Distribute Images task, SWIM communicates with CCO to obtain a list of applicable images and their attributes. Based on this information, SWIM recommends an image. There is a large number of Cisco IOS images available on CCO, which can cause a substantial delay in retrieving image attributes from CCO. Not all these images will be meaningful or relevant to the user. SWIM filters the amount of images being considered to make a more meaningful and manageable subset.

For Catalyst and 700 devices, fewer images are available on CCO than for Cisco IOS; therefore, it is not necessary to filter the images.

A. Although LS1010 devices run Cisco IOS images, there are some differences in how the LS1010 images are released. LS1010 images do not follow the Cisco IOS-type image releases like general deployment (GD), limited deployment (LD), and early deployment (ED). Therefore, SWIM cannot effectively filter LS1010 type images. Nor does SWIM filter Catalyst 8500 Series images.

A. SWIM communicates with CCO to obtain image information. It then displays the header information (CW_FEATURE and CW_VERSION) in a popup list for selection. For some Cisco 1000 Series images, CW_FEATURE and CW_VERSION information is the same even though images differ. You can see duplicate entries for Cisco 1000. You can distinguish these images on the Verification screen (the next screen) by looking at the image details.

A. Crypto images are available only to authorized CCO users. Make sure that the CCO Login user configured in CiscoWorks 2000 has permission to download crypto images.

A. SWIM checks the validity of the downloaded images by comparing the MD5 checksum of the image with the MD5 checksum value retrieved from the CCO database.

A. SWIM does not erase files whose sizes are less than 1 MB on Cisco IOS devices because those files may be config files that are backed up to Flash partitions or .html files or Java applets used for management. SWIM subtracts sizes of all files whose sizes are less than 1 MB from the size of the Flash partition. The result of the subtraction is displayed as the size of the Flash partition in the SWIM user interface.

The screen’s left-most frame in Resource Manager Essentials > Software Management > Library > Add Images displays the size of the largest Flash partition on the device. The size is displayed as an integer-truncated value in megabytes. The Distribute Images screen displays information for all Flash partitions on the device. The values are displayed with two-decimal-digit precision.

The example below illustrates SWIM’s behavior on a Cisco IOS device, which has two files whose sizes are 10 KB and 50 KB respectively. The Flash card’s total size is 8 MB. Because it has two files whose sizes are less than 1 MB, the Add Image to Library screen displays the size as 7 MB. The Distribute Images screen displays the size as 7.94 MB.

enm-2502> show flash

System flash directory:

File Length Name/status

1 8089628 c2500-js-l.112-14.bin

2 10470 test_file1

3 52995 test_file2

8153288 bytes used, 235320 available, 8388608 total]

8192K bytes of processor board System flash (Read ONLY)

enm-2502>

A. Cisco 700 Series—Cisco 761, Cisco 762, Cisco 765, Cisco766, Cisco 771, Cisco 772, Cisco 775, Cisco 776

A. Cisco 800 Series—Cisco 801, Cisco 802, Cisco 803, Cisco 804, Cisco 805

Cisco UBR 900 Series—Cisco UBR 904, Cisco UBR 924

Cisco 1000 Series—Cisco 1000, Cisco 1003, Cisco 1004, Cisco 1005

Cisco 1400 Series—Cisco 1401

Cisco 1600 Series—Cisco 1601, Cisco 1602, Cisco 1603, Cisco 1604, Cisco 1605

Cisco 1700 Series—Cisco 1720, Cisco 1750

Cisco 2500 Series—Cisco 2500, Cisco 2501, Cisco 2502, Cisco 2503, Cisco 2504, Cisco 2505, Cisco 2506, Cisco 2507, Cisco 2508, Cisco 2509, Cisco 2510, Cisco 2511, Cisco 2512, Cisco 2513, Cisco 2514, Cisco 2515, Cisco 2516, Cisco 2517, Cisco 2518, Cisco 2519, Cisco 2520, Cisco 2521, Cisco 2522, Cisco 2523, Cisco 2524, Cisco 2525, accessProRC, accessProEC

Cisco 2600 Series—Cisco 2610, Cisco 2611, Cisco 2612, Cisco 2613, Cisco 2620, Cisco 2621

Cisco 3100 Series—Cisco 3101, Cisco 3102, Cisco 3103, Cisco 3104

Cisco 3200 Series—Cisco 3202, Cisco 3204

Cisco 3600 Series—Cisco 3620, Cisco 3640

Cisco 3810—MC3810

Cisco 4000—Cisco 4000, 4000 M

Cisco 4500—Cisco 4500, Cisco 4500M

Cisco 4700—Cisco 4700, Cisco 4700S

Cisco 7000—Cisco 7000, Cisco 7010

Cisco 7100—Cisco 7120 Quad T1, Cisco 7120 T3, Cisco 7120 E3, Cisco 7120 AT3, Cisco 7120 AE3, Cisco 7120 SMI3, Cisco 7140 Dual T3, Cisco 7140 Dual E3, Cisco 7140 Dual AT3, Cisco 7140 Dual AE3, Cisco 7140 Dual MM3, Cisco Dual 10/100 FE, Cisco 8-Pt. Dual 10/100 FE.

Cisco 7200 Series—Cisco 7202, Cisco 7204, Cisco 7206, Cisco 7204 VXR, Cisco 7206 VXR, Cisco UBR 7223, Cisco UBR 7446

Cisco 7500 Series—Cisco 7505, Cisco 7506, Cisco 7507, Cisco 7513, Cisco 7576

Cisco 12000 Series—Cisco 12004, Cisco 12008

AS5x00—AS5200, AS 5300, AS 5800

Cisco 2900 XL Series—Catalyst 2908XL, Catalyst 2916M-XL, Catalyst 2924XL-V, Catalyst 2924C-XL-V, Catalyst 2912XL, Catalyst 2924M-XL, Catalyst 2912MF-XL, Catalyst 2924XL, Catalyst 2924C-XL

Cisco 3500 XL Series—Catalyst 3508G-XL, Catalyst 3512 XL, Catalyst 3524 XL

LS1010 ATM Switch—LS1010, LS1015

Catalyst 8500 L2/L3 Switch—Catalyst 8510 CSR, Catalyst 8510 MSR, Catalyst 8515 CSR, Catalyst 8515 MSR, Catalyst 8540 CSR, Catalyst 8540 MSR

Catalyst 2948G L3 Switch—Catalyst 2948G

Catalyst 2908G L3 Switch—Catalyst 2908G

Catalyst 5000 Route Switch Modules, Feature Cards—WSX 5302, WSF 5541

Catalyst 6000 Route Switch Modules, Feature Cards—WSX 6302, WSF 6001 MSFC

A. Catalyst 2900 Series (wsc2900, wsc2926)—wsx5005, wsx5006, wsx5009, wsx5010, wsx5011, wsx5012, wsx5012a, wsx5013, wsx5014, wsx5020, wsx5101, wsx5103, wsx5104, wsx5105, wsx5111, wsx5113, wsx5114, wsx5153, wsx5154, wsx5155, wsx5156, wsx5157, wsx5158, wsx5201, wsx5201r, wsx5203, wsx5213, wsx5213a, wsx5223, wsx5224, wsx5225r, wsx5227, wsx5305, wsx5380, wsx5403, wsx5410, wsx5411, wsx5413, wsx5414, wsx5505, wsx5506, wsx5509, wsx5530, wsx5540, wsx5550

Catalyst 2900G Series (wsc2948g)—wsx2948, wsx29481gbrj

Catalyst 4000 Series (wsc4003, wsc4006)—wsx4012, wsx4013,wsx4148rj, wsx4232gbrj, wsx4306gb, wsx4418gb, wsx4424gbrj

Catalyst 2900G Series (wsc2980g)—wsx2980

Catalyst 4900G Series (wsc4912g)—wsx4912, wsx4912gb

Catalyst 5000 Series (wsc5000, wsc5500, wsc5505, wsc5509, wsc5540, wsc5550)—wsx5005, wsx5006, wsx5009, wsx5010, wsx5011, wsx5012, wsx5012a, wsx5013, wsx5014, wsx5020, wsx5030, wsx5031, wsx5101, wsx5103, wsx5104, wsx5105, wsx5111, wsx5113, wsx5114, wsx5153, wsx5154, wsx5155, wsx5156, wsx5157, wsx5158, wsx5161, wsx5162, wsx5165, wsx5166, wsx5167, wsx5168, wsx5201, wsx5201r, wsx5203, wsx5213, wsx5213a, wsx5223, wsx5224, wsx5225r, wsx5227, wsx5302, wsx5305, wsx5380, wsx5403, wsx5410, wsx5411, wsx5413, wsx5414, wsx5505, wsx5506, wsx5509, wsx5530, wsx5540, wsf5541, wsx5550

Catalyst 6000 Series (wsc6006, wsc6009, wsc6506, wsc6509)—wsx6ksup12ge, wsx6ksup1a2ge,wsx6408gbic, wsx6224mmmt, wsx6248rj45, wsx6302msm, wsf6001msfc