Manual Chapter :
Install or Upgrade Software
Applies To:
Show VersionsF5OS-A
- 1.2.0
Install or Upgrade Software
Installation and upgrade options
There are several types of installation and upgrade options for
F5OS
software:- System upgrade
- Clean (or bare metal) installation
System upgrade
A system upgrade installs new Base OS software on
the system and results in a service outage. This method preserves old
image and configuration data, and includes these three sub-types:
- ISO upgrade
- Upgrades both the operating system (OS) and services for the Base OS software.
- Partial upgrade
- Upgrades OS or services for Base OS software. The OS partial update file has a .os extension and the service file has a .img extension. You import partial upgrade files by using either thesystem importcommand, the webUI, or by logging in as a root user and using SCP to copy files to the system at theimages/import/osorimages/import/servicesdirectories respectively.
- Patch upgrade
- Upgrades or patches a subset of Base OS software. The patch file has a .patch extension. You import patch upgrade files by using either thefile importcommand, the webUI, or by logging in as a root user and using SCP to copy files to the system at theimages/import/servicesdirectory.Note:Currently, the patch upgrade option is not supported on F5OS software. However, this option might be supported for all versions of F5OS-A.
Clean installation
A clean installation reformats the disk of specific components
and restores the system to factory defaults.
Formatting erases all data on your
system.
For information on configuring your
rSeries
system after you complete a
software installation or upgrade, see F5
rSeries Systems: Administration and Configuration
in the F5OS
Knowledge Center at support.f5.com. System upgrades
System
upgradesYou perform a system upgrade of
F5OS
software when you want to upgrade the software on
the system
with a point release or
engineering hotfix. This installation method results in a full service outage and
reboots the system
automatically
when installation completes.When upgrading from F5OS-A version 1.0.1 to F5OS-A 1.1.0, you
should first move the tenant state to provisioned before performing the upgrade. You
should then move the tenant back to a deployed state once the F5OS-A upgrade is
complete.
Perform a system upgrade of F5OS software
Verify that you have downloaded and
imported the F5OS-A image files from F5 before you attempt to upgrade.
You can upgrade F5OS software on a system from the
CLI. This method results in a full service outage.
- Connect to the system using a management console or console server.The default baud rate and serial port configuration is 19200/8-N-1.
- Log in to the command line interface (CLI) of the system using an account with admin access.When you log in to the system, you are in user (operational) mode.
- Verify that the Base OS image you want to install is listed, and the status isready.show system imageThis verifies that the ISO is imported properly to the image server on the system, and the system can access these images when it reboots.A summary similar to this example displays:appliance-1# show system image IN VERSION OS STATUS DATE USE -------------------------------------- 1.1.0-1234 ready 2021-08-31 true VERSION IN SERVICE STATUS DATE USE -------------------------------------- 1.1.0-1234 ready 2021-08-31 true VERSION IN ISO STATUS DATE USE --------------------------------------- 1.1.0-1234 ready 2021-08-31 false
- Change to config mode.configThe CLI prompt changes to include(config).
- Set the ISO version to the new version and use theout-of-serviceoption to update the software on the system.system image set-version iso-version <version> proceed [yes|no]By default, you will be prompted to confirm the upgrade. To bypass the confirmation prompt, includeproceed yesat the end of the command sequence.This example shows upgrading the ISO version:appliance-1(config)# system image set-version iso-version 1.1.0-1234These examples show upgradingos-versionandservice-version:Upgrade OS version:appliance-1(config)# system image set-version os-version 1.1.0-1234Upgrade service version:appliance-1(config)# system image set-version service-version 1.1.0-1234
- When the compatibility check succeeds, typeyesto proceed with the installation process.A summary similar to this excerpt displays:appliance-1(config)# system image set-version iso-version 1.1.0-1234 Changing software version will trigger system reboot and interrupt tenant operation. Proceed? [yes/no]: yes response System iso version has been set
The system installs the upgrade and reboots
to the new version. This results in a temporary service outage.
Clean installation
You perform a clean installation of
F5OS
software when
you want to start from scratch or when the system is not recoverable. This installation
method requires you to use either the built-in rSeries
PXE server or a USB flash drive.Performing a clean installation
destroys all information on your system.
Before performing a clean installation of
F5OS
software on your rSeries
system, you must meet
these prerequisites:- Be able to access the system from a management console or console server
- Have root account accessIf your system has appliance mode enabled, you must first disable appliance mode before you can perform a clean installation using a USB flash drive.
Clean installation using a USB flash drive
When you perform a clean installation of
F5OS
software
on your system using a USB flash drive, you must first enable the front panel USB port
on your system.For security purposes, the USB port on
the system is disabled by default. You can use Always-On Management (AOM) to
enable the front panel USB port. For more information, see the platform guide
for your appliance model at support.f5.com/csp/knowledge-center/hardware.
Enable the front-panel USB port
The front-panel USB port on the
platform is disabled by default, but you can use Always-On Management (AOM) to
enable the USB port.
- Connect to the system using a management console or console server.The default baud rate and serial port configuration is 19200/8-N-1.
- Open the AOM Command Menu.Esc (The system displays the AOM Command Menu:[root@appliance-1 ~]# AOM Command Menu: A --- Reset AOM B --- Set baud rate I --- Display platform information P --- Power on/off host subsystem R --- Reset host subsystem U --- Front panel USB port Q --- Quit menu and return to console Enter Command:
- TypeUto configure the USB port on the system.The system displays the current status of the USB port:Front panel USB next boot setting: disabled 0 -- Disable front panel USB port 1 -- Enable front panel USB port Note: Reboot is necessary for change to take effect. Select Option:
- TypeRto reset (restart) the host subsystem.
Create a bootable USB flash drive
Before you create a bootable USB
flash drive, be sure that you have used Always-On Management (AOM) to enable
the USB port on your system, as the USB port is disabled by
default. Also, be sure that you have copied the ISO images to
images/staging/
on your
system. You can use an existing
rSeries
system to create a bootable USB flash drive that contains an F5OS-A software ISO
image.- Connect to the system using a management console or console server.The default baud rate and serial port configuration is 19200/8-N-1.
- Log in as the root user.The default login credentials are root/default. When logging in as root for the first time, the system prompts you to change the password.
- Create a bootable drive.dd if=<iso-image> of=/dev/sda bs=1M oflag=sync status=progressThis example writes a specified software ISO to the flash drive:[root@appliance-1 ~]# dd if=/var/import/staging/F5OS-A-1.2.0 of=/dev/sda bs=1M oflag=sync status=progressThis command sequence writes the ISO image to the flash drive. The flash drive creation process might take several minutes.
You can now use this USB flash drive to
boot
rSeries
systems, as
needed.Perform a clean installation of F5OS software
You can use a USB flash drive to perform a clean installation of F5OS software onto
the system from the CLI.
- Plug the USB flash drive into the USB port for the system that you are installing onto.
- Connect to the system using a management console or console server.The default baud rate and serial port configuration is 19200/8-N-1.
- Log in as the root user.The default login credentials are root/default. When logging in as root for the first time, the system prompts you to change the password.
- Reboot the system.reboot
- Intercept the boot by typingbat the BIOS setup screen, and then select the USB flash drive that you created.
- From the Installer menu, selectInstall F5OS-A.The installation proceeds automatically.
After the installation completes and the
system is fully rebooted to the Host OS, you can remove the USB flash drive.
It might take 10-15 minutes for
the system to fully boot after a clean installation.
Clean installation using a PXE server
You can perform a clean installation of
F5OS
software on your system using an external PXE server.Prerequisites
Before you use an external PXE server to do a clean installation
of F5OS software on your system, verify that the external PXE server is
configured as follows:
- The PXE server must be on the same network segment as therSeriesplatform
- The PXE server must be configured with PXE technologies, including DHCP, TFTP, and HTTP
- On the PXE server, the TFTP root directory is at/tftpboot, and within the/tftpbootdirectory, there is a directory namedpxelinux.cfg
- The/tftpbootdirectory contains these UEFI files:
- syslinux.efi
- ldlinux.e64
- An HTTP service is configured on a file server with/var/www/htmlas its root directory, and the/tftpbootdirectory is symlinked within the/var/www/htmldirectory
- The DHCP server has thefilenameoption configured assyslinux.efi
- SELinux (or similar security measures) must be configured to allow TFTP to read and send the contents of the/tftpbootdirectory
- Any firewalls must allow network access to the HTTP and TFTP services on the PXE server
Prepare for a PXE installation
Before you install using a PXE
server, you must already have configured a PXE server in your network.
To prepare for a PXE installation,
you must make an F5OS-A image file available on the PXE server, determine the
MAC address for your
rSeries
platform, and create a PXE
configuration file.- Download a software image file from the F5 downloads site (downloads.f5.com).
- Import the image file onto your PXE server.
- Mount the image file into the/mntdirectory, and then copy the contents to/tftpboot.mount -o loop,ro /var/<filename>.iso /mnt/f5os-a cp /mnt/f5os-a /tftpboot/f5os-a -RThe image file is now available over TFTP and HTTP.
- Determine and make note of the MAC address for yourrSeriesplatform.show interfaces interface mgmt ethernet stateA summary similar to this example displays:appliance-1# show interfaces interface mgmt ethernet state ethernet state auto-negotiate true ethernet state duplex-mode FULL ethernet state port-speed SPEED_1GB ethernet state hw-mac-address 00:12:a1:34:56:02 ethernet state negotiated-duplex-mode FULL ethernet state negotiated-port-speed SPEED_1GB ethernet state counters in-mac-pause-frames 0 ethernet state counters in-oversize-frames 0 ethernet state counters in-jabber-frames 0 ethernet state counters in-fragment-frames 0 ethernet state counters in-crc-errors 0 ethernet state counters out-mac-pause-frames 0
- Create a PXE configuration file in the/tftpboot/pxelinux.cfgdirectory, where the name of the file is the MAC address of the platform, prefixed with "01".All double hex values in the file name should be delimited with a dash. For example, the configuration file for the MAC address identified above would be named 01-00-12-a1-34-56-02.The configuration file should contain this information:SAY Now booting F5OS-A DEFAULT F5OS-A LABEL F5OS-A KERNEL /f5os-a/images/pxeboot/vmlinuz edd=off APPEND initrd=/f5os-a/images/pxeboot/initrd.img inst.stage2=http://<pxe-server-ip-address>/tftpboot/f5os-a ks=http://<pxe-server-ip-address>/tftpboot/f5os-a/ks.cfg console=ttyS0 inst.sshd=1
Next, you can reboot the system and initiate a clean installation from the PXE server.
Install F5OS-A software on a system using a PXE server
Before you install using a PXE server, you must have copied an F5OS-A image file (.iso) to the PXE server and created a PXE configuration file on the server.
You can use an external PXE server to perform a clean installation of F5OS software onto the system from the CLI.
- Connect to the system using a management console or console server.The default baud rate and serial port configuration is 19200/8-N-1.
- Log in to the command line interface (CLI) of the system using an account with root access.
- Copy the F5OS-A image file (.iso) to the/var/export/chassis/import/isodirectory on the system.
- Reboot the system.reboot
- Intercept the boot by typingpat the BIOS setup screen.The system automatically resets and goes into PXE boot mode, and the installation proceeds automatically. When the installation completes, the system restarts automatically.It might take 10-15 minutes for the system to fully boot after a clean installation.
Tenant software installation
When you install a tenant from the
rSeries
system chassis partition webUI or CLI, you are
deploying a new tenant installation.If you want to upgrade the software for an existing
tenant, you must log in to the tenant using the tenant's web-based
management interface or command line interface (CLI), upload the updated
software version, and then perform the upgrade inside the tenant.
F5
rSeries
systems support running these
tenants, for which the installation files are available as .bundle images:- BIG-IPsoftware
For information on
F5OS
software compatibility with F5
hardware, see K9476: The F5 hardware/software compatibility matrix. For documentation about installing and configuring tenant
software, see the BIG-IP LTM Knowledge
Center for your specific
BIG-IP
software version.For information about performing in-tenant upgrades on the
VELOS platform via the tenant CLI in the TMOS shell, see K33251052: Considerations when
performing an upgrade or update for a BIG-IP tenant on a VELOS
system and K34745165: Managing software images
on the BIG-IP system.
Tenant image overview
BIG-IP tenant images
These
BIG-IP
tenant
images are available to deploy on F5
rSeries
systems:- ALL-F5OS
- T4-F5OS
- T2-F5OS
- T1-F5OS (see note)
T1-F5OS has limitations, so using the other
images is recommended. Other images must be downloaded from the F5 downloads site.
Each image type has different uses so you need to be sure to use
the correct type for your tenant needs. For additional information about BIG-IP
tenant image types, see K45191957: Overview of the
BIG-IP tenant image types.
Tenant resource allocation overview
These are recommended resource considerations for
determining the amount of memory (RAM) and disk space to allocate when planning tenant
deployments on
F5
rSeries
systems.Create and deploy tenants from the CLI
Before you get started, import the tenant images you
want to use for the tenant deployments. You must already have created VLANs on the
system. Before you can create and deploy tenants, you also need to estimate resource
requirements so you know how many vCPUs, memory, and other resources to assign to the
tenant.
You can create and deploy tenants from
the CLI.
- Log in to the command line interface (CLI) of the system using an account with admin access.When you log in to the system, you are in user (operational) mode.
- Change to config mode.configThe CLI prompt changes to include(config).
- Create and deploy the tenant.tenants tenant <name> config <options>These options are available:OptionDescriptionappliance-modeEnable or disable root and bash access for the tenant.cryptosEnable or disable crypto device support for the tenant.gatewayUser-specified gateway for the tenant management IP address.imageUser-specified image for the tenant.memoryUser-specified memory in MBs for the tenant.mgmt-ipUser-specified management IP address for tenant management access.nameUser-specified name for the tenant.nodesUser-specified node numbers to schedule the tenant.prefix-lengthUser-specified prefix length for the tenant management IP address.running-stateUser-specified state for the tenant: configured, provisioned, or deployed.storageStorage quota for the tenant.trust-modeUser-specified state for the tenant: enabled (trusted) or disabled (not trusted). The default state is disabled (not trusted).Trust-mode is only available on r2000/r4000 platforms.MAC masquerade, which is required for High Availability (HA) on r2000/r4000 platforms, can only be configured on trusted tenants.typeTenant type. The default value is BIG-IP.vcpu-cores-per-nodeUser-specified number of logical CPU cores for the tenant.vlansUser-specified vlan-id from VLAN table for the tenant.This example creates a BIG-IP tenant calledbig-ipthat spans four nodes and is in the configured running-state, by default:appliance-1# tenants tenant big-ip config type BIG-IP image BIGIP-15.1.6-0.0.3.ALL-F5OS.qcow2.zip.bundle mgmt-ip 192.0.2.200 prefix-length 24 gateway 192.0.2.254 nodes 1Only trusted tenants (trust-mode option enabled) can be configured with MAC masquerade, which is required for High Availability (HA) on r2000/r4000 platforms. If you plan to configure HA on an r2000 or r4000 platform, be sure to enable trust-mode. For more information about configuring MAC masquerade, see K13502: Configuring MAC masquerade (11.x - 16.x).Other reasons for configuring MAC masquerade include:
- You want to minimize Address Resolution Protocol (ARP) communication or dropped packets during traffic group failover events.
- You want to improve reliability and failover speed in lossy networks.
- You want to improve interoperability with switches that are slow to respond to gratuitous ARP requests.
- Commit the configuration changes.commit
- Return to user (operational) mode.end
- You can monitor the operational state of the tenant and move the tenant into the provisioned running-state.tenants tenant big-ip config running-state provisionedThis causes the system to assign the tenant to nodes and create virtual disks for the tenant on those nodes.
- Show the current status for the tenant:show tenants tenant big-ipWhen the system is creating the virtual disk and installing the image on a disk, the operational state of the tenant shows this information:
- PHASE – Allocating resources to the tenant is in progress
- status – Provisioning
A summary similar to this example displays:appliance-1# show tenants tenant big-ip tenants tenant big-ip state name big-ip state unit-key-hash PcPJWXRSLgdL3FRivOJODwrIZdYLncH3rqrjkW0X03uKHZFSLPjAc3d3E3Pbgd+Piq8p86LsMgma/kHoRdd+Kg== state type BIG-IP state image BIGIP-15.1.6-0.0.3.ALL-F5OS.qcow2.zip.bundle state mgmt-ip 192.0.2.200 state prefix-length 24 state gateway 192.0.2.254 state cryptos disabled state vcpu-cores-per-node 2 state memory 7680 state running-state provisioned state mac-data mgmt-mac 00:0a:49:ff:20:0c state mac-data base-mac 00:0a:49:ff:20:0d state mac-data mac-pool-size 1 state appliance-mode disabled state status Provisioning INSTANCE CREATION READY MGMT NODE POD NAME ID PHASE TIME TIME STATUS MAC -------------------------------------------------------------------------------------------------------- 1 big-ip-1 1 Allocating resources to tenant is in progress -When the system completes the virtual disk creation, the operational state shows this information:- PHASE – Ready to deploy
- status – Provisioned
A summary similar to this example displays:appliance-1# show tenants tenant big-ip tenants tenant big-ip state name big-ip state unit-key-hash PcPJWXRSLgdL3FRivOJODwrIZdYLncH3rqrjkW0X03uKHZFSLPjAc3d3E3Pbgd+Piq8p86LsMgma/kHoRdd+Kg== state type BIG-IP state image BIGIP-15.1.6-0.0.3.ALL-F5OS.qcow2.zip.bundle state mgmt-ip 192.0.2.200 state prefix-length 24 state gateway 192.0.2.254 state cryptos disabled state vcpu-cores-per-node 2 state memory 7680 state running-state provisioned state mac-data mgmt-mac 00:0a:49:ff:20:0c state mac-data base-mac 00:0a:49:ff:20:0d state mac-data mac-pool-size 1 state appliance-mode disabled state status Provisioned INSTANCE CREATION READY MGMT NODE POD NAME ID PHASE TIME TIME STATUS MAC -------------------------------------------------------------------------- 1 big-ip-1 1 Ready to deploy - - Change to config mode.configThe CLI prompt changes to include(config).
- You can then deploy the tenant.tenants tenant big-ip config running-state deployedThis example moves the tenant into the deployed state, which causes the system to start and maintain VMs on each node to which the tenant is assigned.
- Commit the configuration changes.commit
- Return to user (operational) mode.end
- You can check the status of the tenant.show tenants tenant big-ip state instancesA summary similar to this example displays:appliance-1# show tenants tenant big-ip state instances INSTANCE NODE POD NAME ID PHASE CREATION TIME READY TIME STATUS MGMT MAC --------------------------------------------------------------------------------------------------------------------------- 1 big-ip-1 1 Running 2022-04-08T15:30:20Z 2022-04-08T15:30:21Z Started tenant instance 00:94:a1:69:34:25
Once you configure and deploy the tenant, and the
Status is updated to Running, then you can use the management IP address to access the
tenant system using SSH, the web-based interface, or TMOS Shell (
tmsh
).Once a tenant is Deployed (and is up and running),
changing its state back to Configured or Provisioned stops the tenant. You will
receive a warning message before this occurs.
If the Status is Pending instead of Running, this might
mean that there are not enough resources (vCPUs, memory, or other resources) for the
tenant to be deployed. See the Tenant Details screen in the webUI for more
information about the specific tenant.
Create and deploy tenants from the webUI
You must have imported the tenant images that you want to use for the tenant deployments into the system. You must also have previously created any required VLANs. Before you can create and deploy tenants, you also need to estimate resource requirements so you know how many vCPUs, memory, and other resources to assign to the tenant.
An administrator can deploy tenants from the webUI.
- Log in to the webUI using an account with admin access.
- On the left, click.The Tenant Deployment screen displays showing the existing tenant deployments and associated details.
- To add a tenant deployment, clickAdd.The Add Tenant Deployment screen displays.
- ForName, type a name for the tenant deployment (up to 49 characters).The first character in the name cannot be a number. After that, only lowercase alphanumeric characters and hyphens are allowed.
- ForType, keep the default setting ofBIG-IP.
- ForImage, select the software image that was previously imported onto the system.Ensure that the image you selected meets your tenant deployment needs.
- ForIP Address, type the IPv4 address, IPv6 address, or Fully Qualified Domain Name (FQDN) for the tenant.
- ForPrefix Length, type a number from 1-32 for the length of the prefix.
- ForGateway, type the IPv4 address or IPv6 address of the gateway.
- ForVLANs, select one or more VLANs that are available to the tenant.You can assign VLANs to more than one tenant.
- ForResource Provisioning, select one of these options:OptionDescriptionRecommendedRecommended values for vCPUs and memory for the tenant.AdvancedEnables you to configure custom values for vCPUs and memory on the tenant. For example, if you want to configure a single vCPU tenant, or a tenant that uses more than the recommended amount of memory.
- ForvCPUs, select the number of vCPUs to provide to the tenant.The minimum recommended number of vCPUs per typical tenant is two (one vCPU is sufficient only for lightweight tenants that cannot be updated). The number of vCPUs needed depends on the amount of traffic the tenant will be handling. More vCPUs provide faster throughput.
- ForMemory, specify the amount of RAM, in MB, to allocate to the tenant.The amount of memory needed depends on the number of vCPUs assigned. The minimum amount of memory needed is determined by the formula[(3.5 * 1024 * #ofvCPUs) + 512].If you do not allocate sufficient memory, you may receive a warning message.
- ForVirtual Disk Size, specify the storage quota, in GB, for the tenant virtual disk.The default size depends on the image type used. The default size for the ALL image is 82GB.
- ForState, choose one of these options:OptionsDescriptionConfiguredThe tenant configuration exists on the system, but the tenant is not running, and no hardware resources (CPU, memory) are allocated to it. This is the initial state and the default.ProvisionedMoves the tenant into the Provisioned state, which causes the system to install the software, assign the tenant to nodes, and create virtual disks for the tenant on those nodes. If you choose this option, it takes a few minutes to complete the provisioning. The tenant does not run while in this state.DeployedChanges the tenant to the Deployed state. The tenant is set up, resources are allocated to the tenant, the image is moved onto the system, the software is installed, and after those tasks are complete, the tenant is fully deployed and running. If you choose this option, it takes a few minutes to complete the deployment and bring up the system.Once a tenant is Deployed (and is up and running), changing its state back to Configured or Provisioned stops the tenant. You will receive a warning message before this occurs.
- ForCrypto/Compression Acceleration, selectEnabledif the tenant requires high-performance crypto processing and compression.When this option is enabled, the tenant receives dedicated crypto devices proportional to the number of vCPU cores. Crypto processing and compression are off-loaded to the hardware. When the option is disabled, the tenant receives no crypto devices.
- To restrict usage of the Bash shell for tenant administrators, setAppliance ModetoEnabled(this isDisabledby default.)
- ClickSave & Close.
The tenant is now configured and in the Deployed state. When the status says Running, the tenant administrator can log in to the tenant webUI or CLI using the management IP address (with HTTPS or SSH) and continue configuring the tenant system.
If the Status says Pending instead of Running, this may mean that there are not enough resources (vCPUs, memory, or other resources) for the tenant to be deployed. See the Tenant Details screen in the webUI for more information about the specific tenant.