Verify your IOS before reloading that router!
Posted by: Rich in Config. Guides, Tricks and TipsA lot of cisco techs are in the same position. You only have remote access to a router but need to perform an IOS upgrade. This might be to squash a bug or simply because Cisco TAC will not proceed with a TAC case until you do so.
How do you verify that the IOS image has not been corrupted between cisco.com and your device? Read on to find out!
All of the IOS downloads have an MD5 sum that identifies the original unaltered files. MD5 hashing is basically a way of taking an input, in this case the IOS, running it through a hashing algorithm and coming up with a string/Value. The important thing to note here is no matter who runs the IOS through the hashing algorithm, the output will always be the same. If even a slight change has been made to the file then the output will be different.
So, once your IOS is on the router you need to do the following:
router#verify /md5 disk0:c1700-advsecurityk9-mz.123-14.T7.bin
At this point the router will respond with the hash value of the file you have uploaded which can now be compared to the hash value from cisco.com. If these values do not match DO NOT RELOAD THE ROUTER!!! If you do the chances are you will end up with a paper weight until you can get out to site.
You should re-upload the IOS to ensure that it is correct and perform the above again. If you get a mismatched input then the chances are the IOS on your TFTP server is corrupt and you will need to re-download from Cisco.com.
Hope that helps you avoid those “uh oh” moments when a device doesnt return to service!
Thanks for reading.
Entries (RSS)
July 24th, 2008 at 8:16 pm
nice.
btw eric from http://www.nettiki.com/ just told me the following..
“Another thing to look for is that when you use tftp (Trivial File Transfer Protocol) to upgrade your image from a tftp server, you should look for two “OK”s. The 1st OK will indicate that the file transfer completed successfully and the 2nd OK will indicate that the checksum of the file validated correctly.”
July 24th, 2008 at 10:37 pm
Another very useful tip, thanks
September 7th, 2008 at 4:00 am
If you run your TFTP server on linux, you can get the md5 hash for the file by using the ‘md5sum’ command on the file to match against cisco.com
September 9th, 2008 at 7:48 pm
You can, but that doesnt help you to determine if the file was corrupted in-transit. Taking the original (known good) MD5 from cisco.com and then matching it up by using Verify on the router ensures you are not about to buy yourself a long drive out to the site!
May 19th, 2009 at 3:16 pm
@Rich: I agree, I just meant that it’s better though than trying to upload it a couple of times to the router and verify there if it’s already corrupt