ArubaOS-Switch Firmware Upgrade Runbook

ArubaOS-Switch (AOS-S) keeps software images in primary and secondary flash. A safe upgrade uses the inactive flash location for the candidate image while preserving the known-good image and its compatible configuration for rollback.^[1]

1. Select and review the target release

Record the product number, software family, current version, BootROM version, stack or chassis role, and target image filename. Download only the image for that hardware family from the HPE Networking Support Portal. Read the target release notes for supported products, minimum source versions, intermediate releases, BootROM behavior, known issues, and downgrade restrictions before scheduling the change.^[2][3]

2. Capture the baseline and backup

show version
show flash
show config files
write memory

• Export the startup configuration to an external, tested location.
• Capture interface, VLAN, trunk or LACP, spanning-tree, routing, PoE, stacking, and neighbor state relevant to the switch role.
• Confirm the management path to the file server before the outage.
• Record which flash image is running and which image is the default boot source.
• Confirm that monitoring and change stakeholders expect the outage.

3. Stage the image in the inactive flash

The example below assumes that primary is the known-good running image and secondary is the inactive destination. Reverse the flash names when your baseline shows the opposite.

copy tftp flash <server-ip> <image-file>.swi secondary
show flash
verify signature flash secondary

AOS-S also supports other transfer methods on selected platforms and releases. Prefer a secured transfer method when the model supports it, and use the command syntax from its Basic Operation Guide. Do not bypass signature validation merely to make an image load.

4. Boot the candidate image

boot system flash secondary

• Save the configuration when prompted if the approved running configuration has not already been saved.
• Confirm the reboot and watch the console throughout the boot sequence.
• Allow any documented BootROM upgrade and automatic second reboot to finish without intervention.
• Do not begin recovery actions until the documented boot window has elapsed.

5. Validate service

show version
show flash
show config files

• Confirm the expected software and BootROM versions and the running flash location.
• Check management access, logs, time synchronization, environmental state, and stack membership.
• Validate uplinks, LACP or trunks, spanning tree, VLANs, routing adjacencies and routes, PoE endpoints, authentication, and monitoring as applicable.
• Compare the results with the captured baseline and complete a real traffic test.

6. Accept the change or preserve rollback

Keep the previous image in primary until the agreed observation period is complete. After acceptance, either retain the two-version layout for rollback or synchronize the validated secondary image to primary during an approved change:

copy flash flash primary
verify signature flash primary
boot set-default flash primary
show flash

Rollback

If validation fails and primary still contains the known-good image, boot it explicitly:

boot system flash primary

After the reboot, verify the software version and restore the pre-change configuration when the release notes identify configuration incompatibilities. Revalidate the same service checks, collect diagnostics, and document the failed condition before another attempt.