The task nobody wants to do remotely: replacing the operating system on a live device. Do it wrong and you're driving to the site with a console cable. Do it right — verify the image, set the boot variable, keep the old one — and it's a scheduled reboot. Here's the disciplined version.
An IOS upgrade is conceptually simple — put a new image file in flash, tell the device to boot it, reboot — but the failure mode is severe: a device that won't boot needs physical console access and a ROMMON recovery, which for a remote site means a trip. The discipline that prevents that is entirely about doing things in the right order and verifying at each step: confirm there's room, verify the download wasn't corrupted, point the boot variable at the new image, keep the old one, and reboot inside a maintenance window with a rollback ready.
There's also a fork in the road. Classic IOS and older Catalysts boot a single bundle image with boot system — that's most of this post. Newer IOS-XE platforms (Catalyst 9000, ISR 4000, many current switches) prefer install mode with install add/activate/commit, which is safer and has built-in rollback. We cover both, and which one you have. This is the operational sibling of the Backup & Restore post — same "keep a parachute" mindset, applied to the OS itself.
01
Three questions, all read-only: what am I running, is there room for the new image, and have I backed up the config. Answer them before copying a single byte.
# What model, current version, and how it boots? SW1# show version | include IOS|System image|Model Cisco IOS Software, C2960X Software ... Version 15.2(7)E3 System image file is "flash:c2960x-universalk9-mz.152-7.E3.bin" Model number : WS-C2960X-24TS-L # Is there room? Compare "bytes free" to the new image size. SW1# dir flash: | include bytes 128169984 bytes total (39124992 bytes free) # Back up the config off-box FIRST (see the Backup post) SW1# copy running-config tftp: # and ideally copy the CURRENT image off too, so you can restore it.
Access switches often ship with small flash, and a new image plus the old one may not fit. Don't blindly delete the running image to make room — if the new copy is corrupt, you've just removed your only working OS. Instead: confirm the new image size, and if space is tight, remove old crash files or unused images (delete flash:old-image.bin) — never the one you're currently booted from — and dir again. On stacked switches, every member needs the image; that's what install mode (section 05) handles cleanly.
02
Get the image into flash, then — the step people skip and regret — verify its hash against Cisco's published value. A truncated or corrupt download that boots is far worse than one that doesn't.
SW1# copy tftp: flash: Address or name of remote host []? 192.168.1.50 Source filename []? c2960x-universalk9-mz.152-7.E12.bin !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 23891456 bytes copied in 74.2 secs # THE step that saves you: verify against Cisco's published MD5/SHA. SW1# verify /md5 flash:c2960x-universalk9-mz.152-7.E12.bin verify /md5 (flash:...E12.bin) = a3f5c9... ✓ matches Cisco.com # If this hash does NOT match the download page, STOP. Re-download. # A corrupt image that partially boots can hang in ROMMON — a site visit.
03
Copying the image doesn't make the device use it — the boot variable does. Point it at the new image, keep the old one as a fallback, save, and confirm before you reload.
SW1(config)# boot system flash:c2960x-universalk9-mz.152-7.E12.bin # A SECOND boot statement = automatic fallback if the first image fails SW1(config)# boot system flash:c2960x-universalk9-mz.152-7.E3.bin SW1(config)# exit # Confirm the config register boots normally (0x2102) — NOT 0x2142 SW1# show boot | include register|BOOT BOOT path-list : flash:...E12.bin;flash:...E3.bin Configuration Register is 0x2102 # SAVE — an unsaved boot statement is forgotten on reload SW1# write memory
IOS tries boot system lines top to bottom, so the new image must be listed first and the old one second. Two mistakes brick installs: forgetting to write memory (the device reloads into whatever startup-config had, ignoring your change), and having the config register set to 0x2142 from a past password recovery (it ignores startup-config entirely and comes up blank). Both are one show command away from being caught — confirm show boot and the register before you reload, not after.
04
Reboot inside a maintenance window, with a safety timer armed in case the new image doesn't come back the way you expect. Then confirm you're actually running the new version.
# Optional but wise on remote gear: arm a safety net BEFORE reloading. # If the box comes back wrong and you can't fix it, this reloads it again # to the (still-present) old image after the window. Cancel if all is well. SW1# reload in 15 # hold a re-reload 15 min out # ... then do the real reload: SW1# reload System configuration has been modified. Save? [yes/no]: yes Proceed with reload? [confirm] # --- device reboots on the new image --- # Confirm the upgrade actually took, then cancel the safety net SW1# show version | include Version Cisco IOS Software ... Version 15.2(7)E12 ← new! SW1# reload cancel # all good — disarm the parachute
Because you kept the old image and listed it as the second boot statement, rollback is fast: no boot system flash:...E12.bin to drop the new one (leaving the old), write memory, reload — you're back on the known-good version in one reboot. This is exactly why you don't delete the old image to make space. If the box won't boot at all, the console + ROMMON (boot flash:...E3.bin from the rommon> prompt) is the last resort — the reason a console cable is always in the bag.
05
Catalyst 9000, ISR 4000 and current IOS-XE platforms replace boot-system juggling with a packaged install workflow that stages, activates, and commits — with a built-in timed rollback. If show version says IOS-XE, prefer this.
# Confirm you're in INSTALL mode (not BUNDLE) — install commands need it SW1# show version | include INSTALL|BUNDLE # 1. Stage the package onto all stack members (no service impact) SW1# install add file flash:cat9k_iosxe.17.09.05.SPA.bin # 2. Activate — this reloads the switch. "prompt-level none" for scripted; # it starts a rollback timer you must confirm within, or it reverts. SW1# install activate # --- reloads onto the new image --- # 3. Happy with it? Commit to make it permanent and stop the auto-rollback. SW1# install commit # Not happy? Before committing, revert to the previous image: SW1# install rollback to committed SW1# install remove inactive # later: reclaim space from old pkgs
Install-mode and bundle-mode are different worlds. On an IOS-XE box running in install mode, boot system pointed at a raw .bin can leave it inconsistent; conversely install commands do nothing useful in bundle mode. Check with show version first and use the matching workflow. The big win of install mode is the commit step: activation is provisional and auto-rolls-back if you don't confirm — so a bad upgrade on a remote switch un-does itself instead of stranding you. That safety is why it's the modern default.
06
The whole post as a runbook. Print it; follow it every time; skip no line.
| Step | Command / action |
|---|---|
| 1 · Verify model & version | show version — get the exact image for this model + license. |
| 2 · Check space | dir flash: — enough for new + keep old. |
| 3 · Back up config & image | copy run tftp:; copy current image off-box. |
| 4 · Copy new image | copy tftp: flash: |
| 5 · Verify hash | verify /md5 flash:... — must match Cisco. Non-negotiable. |
| 6 · Boot variable | boot system new first, old second; check show boot; register 0x2102. |
| 7 · Save | write memory |
| 8 · Reload in a window | Arm reload in; reload; confirm show version; reload cancel. |
Takeaways
verify /md5 against Cisco's published value. A corrupt image that half-boots into ROMMON is a site visit; a mismatch caught on the CLI is a re-download.show boot and register 0x2102, and write memory or it's forgotten.no boot system the new one, reload). Never delete it to make room — trim crash files or unused images instead.reload in 15 before the real reload re-reverts you if the new image misbehaves and you can't reach it; reload cancel once it's confirmed good.install add/activate/commit stages safely and auto-rolls-back until you commit — far safer for remote gear than boot-system juggling.NOCTIS plans and executes IOS/IOS-XE upgrades for hotels and SMBs — patched for known CVEs, verified, staged in a maintenance window, with rollback ready. The scary remote reboot, made routine.
Book a Discovery Call →