Image Upgrade Workflow

The following is the image upgrade workflow in Paragon Automation:

1. Upload an image to Paragon Automation; see Upload an Image.

2. Stage image on the device; see Stage an Image.

   Paragon Automation validates if the complete software is copied on to the device by using the checksum of the image. The checksum of the image in Paragon Automation is verified with the checksum of the image in the device.

   If checksum of the image copied on to the device does not match with the checksum of the image in Paragon Automation, the image copied on to the device is deleted and the image is copied again. If the checksum does not match again, the stage task fails.

3. Deploy the image; see Deploy an Image.

   During deployment the following tasks are performed on the device:

   • Validate the image copied on to the device—Paragon Automation validates if the complete software is copied on to the device by using the checksum of the image. The checksum of the image in Paragon Automation is verified with the checksum of the image in the device.

     If checksum of the image copied on to the device does not match with the checksum of the device in Paragon Automation, the image copied on to the device is deleted and the image is copied again. If the checksum does not match again, the deploy job fails.

   • Upgrade Image on the device—Paragon Automation upgrades devices as follows:

     • Single Chassis/Standalone devices: Normal upgrade, where the device stops forwarding traffic during the upgrade process.

     • Virtual Chassis (EX Series and QFX Series devices): Nonstop software upgrade (NSSU), where the image is copied on to the primary device and the primary device copies the image on to the member devices. The image is upgraded on the member devices one-by-one. The image on the primary device is upgraded last.

       In this upgrade, there can be a minimal disruption to the traffic traversing through the device without affecting the control plane functioning.

     • Chassis Clusters (SRX Series Firewalls): Both upgrade or downgrade is possible by using In-Band Cluster Upgrade (ICU) or In-Service Software Upgrade (ISSU);

       See Upgrading Devices in a Chassis Cluster Using ICU for details about ICU and Understanding In-Service Software Upgrade (ISSU) for details about ISSU.

     • vSRX Virtual Firewall Cluster: The primary and the backup Routing Engines are upgraded one by one. The secondary Routing Engine is upgraded first and switched over to the primary role. The former primary Routing Engine is then upgraded.

       Traffic disruption is minimal during the upgrade.

     • QFX and MX Series devices with dual Routing Engines: The primary and the backup routing engines are upgraded by Paragon Automation. Traffic is disrupted during the upgrade.

   • Reboot the device—The devices are automatically rebooted after the image is upgraded.

Paragon Automation resynchronizes with the device after the device connects back.