Notes from 4-Node MCIP 9.10.1P6 to 9.10.1P12 Upgrade

on

 A fairly simple upgrade from 9.10.1P6 to 9.10.1P12 to fix the:

SU530: [Impact Critical] NTLM authentication fails due to enforcement of Netlogon RPC sealing (Microsoft CVE-2022-38023)

We encountered 3 issues:

1) When we did the upgrade validation, we got a warning AUTOBOOT was set to false.

Fixed:

  • set d
  • debug keny show -variab;e AUTOBOOT
  • debug kenv modify -node * -variable AUTOBOOT -value true -persist true

2) On the number 2 nodes in each cluster (this was a 4-node MCIP) we discovered AUTO_FW_UPDATE was set to false. The boot halted with this message (or maybe because we had AUTOBOOT still false):

Automatic firmware update skipped (AUTO_FW_UPDATE not set to true).

Warning: The boot media contains a newer firmware image (6.4.15, 16.8). Please run 'update_flash' at the Loader prompt to update your system firmware (6.4.13, 16.7).

We did the 'upgrade_flash' followed by a 'bye' at the loader prompt.

Fixed:

  • set d
  • debug kenv show -variable AUTO_FW_UPDATE
  • debug kenv modify -node * -variable AUTO_FW_UPDATE -value true -persist true

3) One node also panic-ed, coredumped and failed to set 9.10.1P12 as the default image.

Warning: A clean shutdown did not occur and the default boot image was not modified. To change the default boot image, the operation must be followed be a clean shutdown.

A small issue. If we’d been going to a later ONTAP release, could be fixed at the loader prompt. In our case the old school:

  • ‘system image modify’ to set the default image correctly.
  • ‘storage failover takeover’
  • ‘storage failover giveback’
  • ‘cluster image resume-update’

Other Notes:

Overall took about 4 hours (checks, upgrade, fixing issues, checks.)

Assuming you have the image uploaded to the software repository on both clusters, the upgrade goes:

  1. Upgrade both B nodes (1 node in each cluster)
  2. Upgrade both A nodes (1 node in each cluster)

And some useful NetApp KB articles:

Comments

Post a Comment