Cisco · Catalyst 9300 · Field notes

IOS-XE upgrade, in install mode — with the downgrade path back

A stack-safe install-mode upgrade for a Catalyst 9300, plus the matching downgrade path. Sanitized for publication — IP and filename values below are illustrative.

Platform C9300-24UX · Boot mode Install · Target 17.09.05.SPA · Stack members 3 · Impact full reload · commit window 2h

stack-ring TFTP source ┌──────────┐ ┌──────────┐ ┌──────────┐ 10.200.20.163 │ member 1 │===│ member 2 │===│ member 3 │<── cat9k_iosxe.17.09.05.SPA.bin │ active │ │ standby │ │ member │ └──────────┘ └──────────┘ └──────────┘ install add/activate/commit runs once from the active member, syncs to standby + member over StackWise before the reload.

On this page

00Before you begin
1Remove unwanted packages
2Copy the image to flash
3Add the image to the stack
4Activate the new software
5Commit the changes
6Verify the upgrade
7Downgrade back to the old IOS
7.1Method A — install mode
7.2Method B — bundle mode

Before you begin

Stack health: show switch — every member should read Ready before you start.
Current version: show version — your baseline to diff against after the reload.
Flash space, on every member: dir flash: / show install summary. The image plus extraction headroom has to fit on each one, not just the active switch.
Config backup: copy running-config tftp://10.200.20.163/backups/9300-preupgrade.cfg
Upgrade path supported: check the release notes for your current version — some jumps need an intermediate hop.
Console access for the activate/reload step, in case the mgmt interface doesn't come back cleanly over SSH.
Maintenance window — install activate reloads the whole stack regardless of how clean the upgrade is.

Remove unwanted packages

why it's needed

Clears inactive/uncommitted packages left from previous installs, freeing flash before the new image lands.

Switch# install remove inactive

Copy the image to flash

why it's needed

Pulls the target image onto the active switch's flash over TFTP before it's added to the stack.

Switch# copy tftp://10.200.20.163/9300-24UX-A/cat9k_iosxe.17.09.05.SPA.bin flash:

Note

Verify before trusting it: verify /md5 flash:cat9k_iosxe.17.09.05.SPA.bin, checked against the hash on Cisco's download page. Cheaper to catch here than mid-install add.

Add the image to the stack

why it's needed

Syncs the image to every stack member over StackWise via install add.

Switch# install add file flash:cat9k_iosxe.17.09.05.SPA.bin

Activate the new software

what it does

Unpacks the .bin, updates the boot config, reloads the stack into the new image.

Switch# install activate

Caution

Reloads the entire stack. Confirm the maintenance window and console access before running this.

Commit the changes

why it's needed

Finalizes the upgrade so it survives the next reload.

Switch# install commit

Rollback window

install commit must run within 2 hours of activation or the switch auto-rolls-back on its next reload. If you find a problem before that window closes, use install rollback to committed to revert immediately — don't wait on the timer if the issue is urgent.

Verify the upgrade

show version — every member on the new IOS-XE version.
show switch — all members rejoined, all Ready.
show install summary — package state C (committed), not I.
Spot-check access ports came back and AAA/NTP/syslog reconnected.

Downgrade back to the old IOS

Catalyst 9300 stacks default to install mode; some legacy devices still run bundle boot mode. Check which one you have, then use the matching method below.

Check first

show version | include mode — INSTALL_MODE → Method A. BUNDLE_MODE → Method B.

7.1 Method A — install mode (default on 9300 stacks)

step	command
confirm image on flash	`dir flash:`
back up running-config	`copy running-config tftp://10.200.20.163/backups/9300-predowngrade.cfg`
add / activate / commit older image	`install add file flash:<OldIOSImageName>.bin activate commit`

7.2 Method B — bundle boot mode (legacy devices only)

Switch# dir flash:                                                # confirm the older image is present; TFTP/USB it in if not
Switch# copy running-config tftp://10.200.20.163/backups/9300-predowngrade.cfg
Switch(config)# boot system flash:<YourIOSImageName>.bin              # global config mode
Switch# copy running-config startup-config                        # save the boot statement
Switch# reload

After reload

Run show version to confirm the switch booted the expected image before handing it back.