CISCO C1111-4P software upgrade path

[fti-it]

I have a C1111-4P router with c1100-universalk9.17.06.01a.SPA.bin image loaded, I want to update to c1100 universalk9.17.13.01a.SPA.

So can I update directly to a new image or need to update any intermediate?

[liviu.gheorghe]

Hello @fti-it ,

you can upgrade directly to 17.13.01a. Any ROMMON firmware upgrade will be performed automatically as part of the IOS XE upgrade.

[Leo Laohoo]

Direct upgrade to 17.13.X is supported.  Do not forget to read the Release Notes. 

Cisco ISR & ASR 1k Routers: IOS-XE/Firmware Upgrade (Install Mode)

[ngocthang]

Hi guy, i have a router cisco C111-4P (Cisco IOS XE Software, Version 16.10.01b. i am facing proplem The CE router executed a vulnerability scan and discovered a flaw. The device version cannot enable the 'ip ssh server algorithm kex ecdh-sha2-nistp521', please help to check and reply. Please let me know if I update to which version I can handle this problem. Thanks!

[liviu.gheorghe]

Hello @ngocthang , 

If you upgrade to IOS version 17.09.04a, you can enable the required key exchange algorithm:

c1111(config)#ip ssh server algorithm kex ?
curve25519-sha256@libssh.org Curve 25519 key exchange algorithm
diffie-hellman-group14-sha1 DH_GRP14_SHA1 diffie-hellman key exchange algorithm
ecdh-sha2-nistp256 ECDH_SHA2_P256 ecdh key exchange algorithm
ecdh-sha2-nistp384 ECDH_SHA2_P384 ecdh key exchange algorithm
ecdh-sha2-nistp521 ECDH_SHA2_P521 ecdh key exchange algorithm

Hope this helps.