Updating firmware on managed devices

From the Lenovo XClarity Administrator web interface, you can download, install, and manage firmware updates for managed devices, including chassis, servers, storage systems, and switches. You can assign firmware-compliance policies to the managed devices to ensure that firmware on those devices remains compliant. You can also create and edit firmware-compliance policies when validated firmware levels do not match the suggested predefined policies.

About this task

Note: An operating system is not required to update firmware. For bare metal servers, ensure that the server is powered off before updating firmware.
You can manage and apply firmware updates to the following managed devices:
  • Chassis. CMM updates
  • Converged, Flex System, NeXtScale, System x, ThinkAgile, and ThinkSystem servers. Baseboard management controller, UEFI, DSA, mezzanine, and adapter updates
  • Lenovo Storage devices.
  • RackSwitch and Flex System switches.
Firmware for the following devices cannot be updated through XClarity Administrator:
  • ThinkServer servers. See the documentation that was provided with the server to find information about how to update the firmware.
  • Flex Power Systems compute nodes. Several methods are available to update firmware for Flex Power Systems compute nodes. For more information, see IBM Flex System p260/p460 Compute Nodes online documentation. The process for other Flex Power Systems compute nodes is similar.
  • Flex System v7000 Storage Node. Use the Flex System v7000 Storage Node user interface to update the firmware. For more information, see FlexSystem v7000 Storage Node online documentation.
  • Flex switches that are in stacked mode or protected mode. You cannot update firmware on stacked switches. Updating firmware is disabled for all switches that are stacked.
  • Flex switches. If you are using the following switch, see the documentation that was provided with the switch to find information about how to update the firmware.

For information about installing operating systems using XClarity Administrator (see Installing operating systems on bare-metal servers).

Procedure

The following figure illustrates the workflow for updating firmware on managed devices.


Illustrates the steps involved in managing and updating firmware on managed devices, including managing the repository, creating and assigning compliance policies, and applying and activating updates.

  1. Manage the firmware-updates repository

    The firmware-updates repository contains a catalog of available updates and the update packages that can be applied to the managed devices.

    The catalog contains information about firmware updates that are currently available for all devices that XClarity Administrator supports. The catalog organizes the firmware updates by device type. When you refresh the catalog, XClarity Administrator retrieves information about the latest available firmware updates from the Lenovo website and stores the information in the firmware-updates repository.

    If new firmware updates are available, you must first download the update packages before you can update that firmware on the managed devices. Refreshing the catalog does not automatically download update packages. The Product Catalog table on the Firmware Updates Repository page identifies which update packages are downloaded and which are available for download.

    You can download firmware updates in a few different ways:
    • Firmware-update repository packs

      Firmware-update repository packs contains the latest available firmware updates at a specific point in time for all supported devices and a refreshed default firmware-compliance policy. These repository packs are imported and then applied from the Update Management Server page. When you apply a firmware-update repository pack, each update package in the pack is added to the firmware-updates repository, and a default firmware-compliance policy is automatically created for all manageable devices. You can copy this predefined policy, but you cannot change it.

      The following repository packs are available:
      • lnvgy_sw_lxca_cmmswitchrepox-x.x.x_anyos_noarch. Contains firmware updates for all CMMs and Flex System switches.

      • lnvgy_sw_lxca_storagerackswitchrepox-x.x.x_anyos_noarch. Contains firmware updates for all RackSwitch switches and Lenovo Storage devices.

      • lnvgy_sw_lxca_systemxrepox-x.x.x_anyos_noarch. Contains firmware updates for all Converged HX Series, Flex System, NeXtScale, and System x servers.

      • lnvgy_sw_thinksystemrepox-x.x.x_anyos_noarch. Contains firmware updates for all ThinkAgile and ThinkSystem servers.

      You can determine whether firmware-update repository packs are stored in the repository from the Download Status column on Update Management Server page. This column contains the following values:
      • Downloaded icon Downloaded. The firmware-update repository pack is stored in the repository.
      • Not downloaded icon Not Downloaded. The firmware-update repository pack is available but not stored in the repository.
    • UpdateXpress System Packs (UXSPs)

      UXSPs contains the latest available firmware and device driver updates, organized by operating system. When you download UXSPs, XClarity Administrator downloads the UXSP, based on the version that is listed in the catalog, and stores the update packages in the firmware-updates repository. When you download a UXSP, each firmware update in the UXSP is added to the firmware-updates repository and listed on the Individual Updates tab, and a default firmware-compliance policy is automatically created for all manageable devices using the name <uxsp-version>-<date>-<server-short-name>-UXSP (for example, v1.50-2017-11-22- SD530-UXSP). You can copy this predefined policy, but you cannot change it.

      Note: When you download UXSPs from the Firmware Updates: Repository page, only firmware updates are downloaded and stored in the repository. Device driver updates are excluded. For information about downloading Windows device driver updates using UXSPs, see Managing the OS device-drivers repository.
      You can determine whether UXSPs are stored in the firmware-updates repository from the Download Status column on the Individual Updates tab of the Firmware Updates: Repository page. This column contains the following values:
      • Downloaded icon Downloaded. The entire update package or the individual firmware update is stored in the repository.
      • Partially downloaded icon x of y Downloaded. Some but not all firmware updates in the update package are stored in the repository. The numbers in parentheses indicate the number of available updates and the number of stored updates, or there are no updates for the specific device type.
      • Not downloaded icon Not Downloaded. The entire update package or the individual firmware update is available but not stored in the repository.
    • Individual firmware updates

      You can download individual firmware-update packages, at one time. When you download firmware-update packages, XClarity Administrator downloads the update, based on the version that is listed in the catalog, and stores the update packages in the firmware-updates repository. You can then create firmware-compliance policies using those update packages for each of your managed devices.

      Note: The core firmware updates (such as management controller, UEFI, and pDSA) are operating-system independent. Firmware-update packages for the RHEL 6 or SLES 11 operating systems are used to update compute nodes and rack servers. For more information about which firmware-update packages to use for your managed servers, see Downloading firmware updates.
      You can determine whether specific firmware updates are stored in the firmware-updates repository from the Download Status column on the Individual Updates tab on the Firmware Updates: Repository page. This column contains the following values:
      • Downloaded icon Downloaded. The entire update package or the individual firmware update is stored in the repository.
      • Partially downloaded icon x of y Downloaded. Some but not all firmware updates in the update package are stored in the repository. The numbers in parentheses indicate the number of available updates and the number of stored updates, or there are no updates for the specific device type.
      • Not downloaded icon Not Downloaded. The entire update package or the individual firmware update is available but not stored in the repository.
    XClarity Administrator must be connected to the Internet to refresh the catalog and download firmware-update. If it is not connected to the Internet, you can manually download the files to a workstation that has network access to the XClarity Administrator host using a web browser and then import the files into the firmware-updates repository.
    Illustrates the steps involved in managing the repository, including refreshing the product catalog and acquiring or importing firmware updates.
    When you manually import firmware updates into XClarity Administrator, you must include the following required files: payload (image and MIB), metadata XML, change history, and readme. For example:
    • lnvgy_sw_lxca_thinksystemrepo*_anyos_noarch.tgz

    • lnvgy_sw_lxca_thinksystemrepo*_anyos_noarch.xml

    • lnvgy_sw_lxca_thinksystemrepo*_anyos_noarch.chg

    • lnvgy_sw_lxca_thinksystemrepo*_anyos_noarch.txt

    Attention:
    • Only import these required files. Do not import other files that might be found on the firmware download websites.
    • If you do not include the XML file in the update package, the update is not imported.
    • If you do not include all required files that are associated with the update, the repository shows that the update is not downloaded, which means that it is partially imported. You can then import the missing files by selecting and importing them.
    • The core firmware updates (such as management controller, UEFI, and pDSA) are operating-system independent. Firmware-update packages for the RHEL 6 or SLES 11 operating systems are used to update compute nodes and rack servers. For more information about which firmware-update packages to use for your managed servers, see Downloading firmware updates.

    For more information about the firmware updates, see Managing the firmware-updates repository.

  2. (Optional) Create and assigning firmware-compliance policies

    Firmware-compliance policies ensure that the firmware on specific devices is at the current or specific level by flagging the devices that need attention. Each firmware-compliance policy identifies which devices are monitored and which firmware-update level must be installed to keep the devices in compliance. XClarity Administrator then uses these policies to check the status of managed devices and to identify devices that are out of compliance.

    When you create a firmware-compliance policy, you can choose to have XClarity Administrator flag a device when:
    • The firmware on the device is down level
    • The firmware on the device does not exactly match the compliance target version

    XClarity Administrator comes with predefined firmware-compliance policies, labeled DEFAULT-<devices>-<date>, which flags any device as not compliant when the firmware on that device is down level.

    After a firmware-compliance policy is created, XClarity Administrator checks the compliance status of each device when there are changes to the hardware inventory or firmware-updates repository. When the firmware on a device is not compliant with the assigned policy, XClarity Administrator identifies that device as not compliant on the Firmware Updates: Apply / Activate page, based on the rule that you specified in the firmware-compliance policy.
    Illustrates the process for monitoring for firmware compliance and sending alerts when a device becomes noncompliant.

    For example, you can create a firmware-compliance policy that defines the baseline level for firmware that is installed in all Flex System x440 Compute Nodes and then assign that firmware-compliance policy to all managed x440 compute nodes. When the firmware-updates repository is refreshed and a new firmware update is added, those compute nodes might become out of compliance. When that happens, XClarity Administrator updates the Firmware Updates: Apply / Activate page to show that the devices are not compliant and generates an alert.

    Note: You can choose to show or hide alerts for devices that do not meet the requirements of their assigned firmware-compliance policies (see Configuring global firmware-update settings). Alerts are hidden by default.

    For more information about the firmware-compliance policies, see Creating firmware-compliance policies.

  3. Applying and activating updates
    XClarity Administrator does not automatically apply firmware updates to managed devices. To update firmware, you must manually apply and active the update on selected devices. You can apply the firmware in one of the following ways:
    • Apply and activate firmware on managed devices that are not compliant with the assigned firmware-compliance policy.

      You can choose to apply and activate all firmware updates that apply to a firmware-compliance policy or only specific firmware updates in a policy.

      Firmware-compliance policies must be created and assigned to the devices on which you intend to apply firmware updates. For more information, see Creating firmware-compliance policies and Assigning firmware-compliance policies.

      If the device has an assigned compliance policy and the firmware update results in compliance violations, you must correct the violations either by adjusting the compliance policy or assigning an alternate policy.

    • Apply and activate firmware that is later than the currently installed firmware on a single managed device or group of devices without using compliance policies.

    Note: If you choose to install a firmware-update package that contains updates for multiple components, all components to which the update package applies are updated.
    When you perform updates on a set of devices, XClarity Administrator performs the updates in the following order:
    • Chassis CMM

    • RackSwitch and Flex System switches

    • Flex compute nodes, and rack and tower servers

    • Lenovo Storage devices

    To activate the firmware updates, the devices must be restarted. (Note that restarting a device is disruptive.) You can choose to restart the devices as part of the update process (called immediate activation), or wait until a maintenance window is available to restart the devices (called delayed activation). In this case, you must manually restart the device for the update to take effect.
    Note: Updates to CMMs and Flex switches are always activated immediately, even if you select delayed activation.
    When you choose to update the firmware for a managed device, the following steps occur:
    1. XClarity Administrator sends the firmware updates (for example, for the management controller, UEFI, and DSA) to the device.
    2. When the device is restarted, the firmware updates are activated on the device.
    3. For servers, XClarity Administrator sends updates for optional devices, such as network adapter and hard drive updates. XClarity Administrator applies these updates, and the server is restarted
    4. When you restart the device or choose immediate activation, the updates for the optional devices are activated.
    Attention: Before you attempt to apply and activate updates on managed devices, ensure that you have completed the following actions:
    • Review the "Read before downloading Lenovo XClarity Administrator Virtual Appliance Update" link on the XClarity Administrator download webpage.

    • Read the firmware-update considerations before you attempt to update firmware on your managed devices (see Firmware-update considerations).
    • Initially, devices that are not supported for updates are hidden from the view. Devices that are not supported cannot be selected for updates.
    • If devices are installed in the server but is not detected by XClarity Administrator, enable Enhanced Support for Down-Level Devices to display inventory and full-version information for all devices, even if the firmware is down-level or if the device is missing from the inventory (see Configuring global firmware-update settings).

    • Ensure that the firmware-updates repository contains the firmware packages that you intend to deploy. If not, refresh the product catalog, and download the appropriate firmware updates (see Refreshing the product catalog and Downloading firmware updates).
      Note: When XClarity Administrator is initially installed, the product catalog and the repository are empty.
    • Ensure that the Flex switches that are being updated are powered on.
    • Ensure that no jobs are currently running on the target server. If jobs are running, the update job is queued until all other jobs have completed. To see a list of active jobs, click Monitoring > Jobs.
    • Typically, devices must be restarted to activate the firmware update. If you choose to restart the device during the update process (immediate activation), ensure that any running workloads have either been stopped or, if you are working in a virtualized environment, moved to a different server.
    • If XClarity Administrator runs on a hypervisor host that runs on a managed server, do not use XClarity Administrator to update firmware on that server. When firmware updates are applied with immediate activation, XClarity Administrator forces the target server to restart, which would restart the hypervisor host and XClarity Administrator as well. When applied with deferred activation, only some firmware is applied until the target system is restarted.
    • If you are updating CMMs that are running firmware level stack release 1.3.2.1 2PET12K through 2PET12Q, that have been running for more than three weeks, and are in a dual-CMM configuration, you must virtually reseat both the primary and standby CMMs before updating firmware (see Virtually reseating a CMM).
    • On the Apply/Activate page, the NVMe firmware version is listed for solid state drives (SSDs). Because no target firmware update is identified for discovered NVMe devices, a warning message is displayed when you attempt to update the target system. However, the HDD/SSD update is applied even if it is not identified with a target component, so the NVMe firmware is still updated.

    • You can choose to install prerequisite firmware in addition to the firmware update. All prerequisite firmware must be downloaded to the repository before it can be applied.

      Note: In some cases, multiple versions might be needed to update firmware, and all versions would need to be downloaded to the repository. For example, to upgrade the IBM FC5022 SAN scalable switch from v7.4.0a to v8.2.0a, you must first install v8.0.1-pha, then v8.1.1, and then v8.2.0a. All three versions must be in repository to update the switch to v8.2.0a.
    • If the device has an assigned compliance policy and the firmware update results in compliance violations, you must correct the violations either by adjusting the compliance policy or assigning an alternate policy.

    For more information about installing updates, see Applying and activating firmware updates.