Updating firmware on managed devices

From the Lenovo XClarity Administrator web interface, you can download, install, and manage firmware updates for managed devices, including chassis, servers, storage systems, and switches. You can assign firmware-compliance policies to the managed devices to ensure that firmware on those devices remains compliant. You can also create and edit firmware-compliance policies when validated firmware levels do not match the suggested predefined policies.

About this task

Note: An operating system is not required to update firmware. For bare metal servers, ensure that the server is powered off before updating firmware.
You can manage and apply firmware updates to the following managed devices:
  • Chassis. CMM updates
  • Converged, Flex System, NeXtScale, System x, ThinkAgile, and ThinkSystem servers. Baseboard management controller, UEFI, DSA, mezzanine, and adapter updates
  • Lenovo Storage and ThinkSystem DM storage devices
  • RackSwitch and Flex System switches
Firmware for the following devices cannot be updated through XClarity Administrator:
  • ThinkServer servers. See the documentation that was provided with the server to find information about how to update the firmware.
  • Flex Power Systems compute nodes. Several methods are available to update firmware for Flex Power Systems compute nodes. For more information, see IBM Flex System p260/p460 Compute Nodes online documentation. The process for other Flex Power Systems compute nodes is similar.
  • Flex System v7000 Storage Node. Use the Flex System v7000 Storage Node user interface to update the firmware. For more information, see FlexSystem v7000 Storage Node online documentation.
  • Flex switches that are in stacked mode or protected mode. You cannot update firmware on stacked switches. Updating firmware is disabled for all switches that are stacked.
  • Flex switches. If you are using the following switch, see the documentation that was provided with the switch to find information about how to update the firmware.

For information about installing operating systems using XClarity Administrator (see Installing operating systems on bare-metal servers).

Procedure

The following figure illustrates the workflow for updating firmware on managed devices.


Illustrates the steps involved in managing and updating firmware on managed devices, including managing the repository, creating and assigning compliance policies, and applying and activating updates.

  1. Manage the firmware-updates repository

    The firmware-updates repository contains a catalog of available updates and the update packages that can be applied to the managed devices.

    The catalog contains information about firmware updates that are currently available for all devices that XClarity Administrator supports. The catalog organizes the firmware updates by device type. When you refresh the catalog, XClarity Administrator retrieves information about the latest available firmware updates from the Lenovo website and stores the information in the firmware-updates repository.

    If new firmware updates are available, you must first download the update packages before you can update that firmware on the managed devices. Refreshing the catalog does not automatically download update packages. The Product Catalog table on the Firmware Updates Repository page identifies which update packages are downloaded and which are available for download.

    You can download firmware updates in a few different ways:
    • Firmware-update repository packs

      Firmware-update repository packs contains the latest available firmware updates at a specific point in time for all supported devices and a refreshed default firmware-compliance policy. These repository packs are imported and then applied from the Update Management Server page. When you apply a firmware-update repository pack, each update package in the pack is added to the firmware-updates repository, and a default firmware-compliance policy is automatically created for all manageable devices. You can copy this predefined policy, but you cannot change it.

      The following repository packs are available:
      • lnvgy_sw_lxca_cmmswitchrepox-x.x.x_anyos_noarch. Contains firmware updates for all CMMs and Flex System switches.

      • lnvgy_sw_lxca_storagerackswitchrepox-x.x.x_anyos_noarch. Contains firmware updates for all RackSwitch switches and Lenovo Storage devices.

      • lnvgy_sw_lxca_systemxrepox-x.x.x_anyos_noarch. Contains firmware updates for all Converged HX Series, Flex System, NeXtScale, and System x servers.

      • lnvgy_sw_thinksystemrepox-x.x.x_anyos_noarch. Contains firmware updates for all ThinkAgile and ThinkSystem servers.

      • lnvgy_sw_lxca_thinksystemv2repox-x.x.x_anyos_noarch. Contains firmware updates for all ThinkAgile and ThinkSystem V2 servers.

      You can determine whether firmware-update repository packs are stored in the repository from the Download Status column on Update Management Server page. This column contains the following values:
      • Downloaded icon Downloaded. The firmware-update repository pack is stored in the repository.
      • Not downloaded icon Not Downloaded. The firmware-update repository pack is available but not stored in the repository.
    • UpdateXpress System Packs (UXSPs)

      UXSPs contains the latest available firmware and device driver updates, organized by operating system. When you download UXSPs, XClarity Administrator downloads the UXSP, based on the version that is listed in the catalog, and stores the update packages in the firmware-updates repository. When you download a UXSP, each firmware update in the UXSP is added to the firmware-updates repository and listed on the Individual Updates tab, and a default firmware-compliance policy is automatically created for all manageable devices using the name <uxsp-version>-<date>-<server-short-name>-UXSP (for example, v1.50-2017-11-22- SD530-UXSP). You can copy this predefined policy, but you cannot change it.

      Note: When you download UXSPs from the Firmware Updates: Repository page, only firmware updates are downloaded and stored in the repository. Device driver updates are excluded. For information about downloading Windows device driver updates using UXSPs, see Managing the OS device-drivers repository.
      You can determine whether UXSPs are stored in the firmware-updates repository from the Download Status column on the Individual Updates tab of the Firmware Updates: Repository page. This column contains the following values:
      • Downloaded icon Downloaded. The entire update package or the individual firmware update is stored in the repository.
      • Partially downloaded icon x of y Downloaded. Some but not all firmware updates in the update package are stored in the repository. The numbers in parentheses indicate the number of available updates and the number of stored updates, or there are no updates for the specific device type.
      • Not downloaded icon Not Downloaded. The entire update package or the individual firmware update is available but not stored in the repository.
    • Individual firmware updates

      You can download individual firmware-update packages, at one time. When you download firmware-update packages, XClarity Administrator downloads the update, based on the version that is listed in the catalog, and stores the update packages in the firmware-updates repository. You can then create firmware-compliance policies using those update packages for each of your managed devices.

      Note: The core firmware updates (such as management controller, UEFI, and pDSA) are operating-system independent. Firmware-update packages for the RHEL 6 or SLES 11 operating systems are used to update compute nodes and rack servers. For more information about which firmware-update packages to use for your managed servers, see Downloading firmware updates.
      You can determine whether specific firmware updates are stored in the firmware-updates repository from the Download Status column on the Individual Updates tab on the Firmware Updates: Repository page. This column contains the following values:
      • Downloaded icon Downloaded. The entire update package or the individual firmware update is stored in the repository.
      • Partially downloaded icon x of y Downloaded. Some but not all firmware updates in the update package are stored in the repository. The numbers in parentheses indicate the number of available updates and the number of stored updates, or there are no updates for the specific device type.
      • Not downloaded icon Not Downloaded. The entire update package or the individual firmware update is available but not stored in the repository.
    XClarity Administrator must be connected to the Internet to refresh the catalog and download firmware-update. If it is not connected to the Internet, you can manually download the files to a workstation that has network access to the XClarity Administrator host using a web browser and then import the files into the firmware-updates repository.
    Illustrates the steps involved in managing the repository, including refreshing the product catalog and acquiring or importing firmware updates.
    When you manually import firmware updates into XClarity Administrator, you must include the following required files: payload (image and MIB), metadata XML, change history, and readme. For example:
    • lnvgy_sw_lxca_thinksystemrepo*_anyos_noarch.tgz

    • lnvgy_sw_lxca_thinksystemrepo*_anyos_noarch.xml

    • lnvgy_sw_lxca_thinksystemrepo*_anyos_noarch.chg

    • lnvgy_sw_lxca_thinksystemrepo*_anyos_noarch.txt

    Attention:
    • Only import these required files. Do not import other files that might be found on the firmware download websites.
    • If you do not include the XML file in the update package, the update is not imported.
    • If you do not include all required files that are associated with the update, the repository shows that the update is not downloaded, which means that it is partially imported. You can then import the missing files by selecting and importing them.
    • The core firmware updates (such as management controller, UEFI, and pDSA) are operating-system independent. Firmware-update packages for the RHEL 6 or SLES 11 operating systems are used to update compute nodes and rack servers. For more information about which firmware-update packages to use for your managed servers, see Downloading firmware updates.

    For more information about the firmware updates, see Managing the firmware-updates repository.

  2. (Optional) Create and assigning firmware-compliance policies

    Firmware-compliance policies ensure that the firmware on certain managed devices is at the current or specific level by flagging the devices that need attention. Each firmware-compliance policy identifies which devices are monitored and which firmware level must be installed to keep the devices in compliance.You can set compliance at the device or firmware component level. XClarity Administrator then uses these policies to check the status of managed devices and to identify devices that are out of compliance.

    When you create a firmware-compliance policy, you can choose to have XClarity Administrator flag a device when:
    • The firmware on the device is down level
    • The firmware on the device does not exactly match the compliance target version

    XClarity Administrator comes with a predefined firmware-compliance policy named Latest firmware in repository. When new firmware is downloaded or imported into the repository, this policy is updated to include latest available versions of firmware in the repository.

    After a firmware-compliance policy is assigned to a device, XClarity Administrator checks the compliance status of each device when the device inventory changes or firmware-updates repository changes. When the firmware on a device is not compliant with the assigned policy, XClarity Administrator identifies that device as not compliant on the Firmware Updates: Apply / Activate page, based on the rule that you specified in the firmware-compliance policy
    Illustrates the process for monitoring for firmware compliance and sending alerts when a device becomes noncompliant.

    For example, you can create a firmware-compliance policy that defines the baseline level for firmware that is installed in all ThinkSystem SR850 devices and then assign that firmware-compliance policy to all managed ThinkSystem SR850 devices. When the firmware-updates repository is refreshed and a new firmware update is added, those compute nodes might become out of compliance. When that happens, XClarity Administrator updates the Firmware Updates: Apply / Activate page to show that the devices are not compliant and generates an alert.

    Note: You can choose to show or hide alerts for devices that do not meet the requirements of their assigned firmware-compliance policies (see Configuring global firmware-update settings). Alerts are hidden by default.

    For more information about the firmware-compliance policies, see Creating and assigning firmware-compliance policies.

  3. Applying and activating updates

    XClarity Administrator does not automatically apply firmware updates to managed devices. To update firmware, you must manually apply and active the update on selected devices. You can apply the firmware in one of the following ways:

    • Apply bundled firmware updates using compliance policies

      You can apply firmware updates to all components in the selected devices according to the assigned firmware-compliance policy using a bundle image that contain the applicable firmware update packages.

      The bundled-update process first updates the baseboard management controller and UEFI out of band. When these updates are complete, the process creates a bundled image of remaining firmware in the compliance policy based on the machine type. Then, the process mounts the image to the selected device and restarts the device to boot the image. The image automatically runs to perform the remaining updates.

      Attention: Selected devices are powered off before starting the update process. Ensure that any running workloads have either been stopped or, if you are working in a virtualized environment, moved to a different server. If jobs are running, the update job is queued until all other jobs have completed. To see a list of active jobs, click Monitoring > Jobs.
      Note:
      • Applying bundled firmware updates is supported only for ThinkSystem SR635 and SR655 servers.

      • Applying bundled firmware updates is supported only for IPv4 address. IPv6 addresses are not supported.

      • Ensure that each target device was booted to the OS at least once to retrieve the full inventory information.

      • Baseboard management controller firmware v2.94 or later is required to use the bundled-update function.

      • Only firmware updates from repository packs or individual firmware updates are used. UpdateXpress System Packs (UXSPs) are not supported.

      • Only downloaded firmware updates are applied. Refresh the product catalog, and download the appropriate firmware updates (see Refreshing the product catalog and Downloading firmware updates).
        Note: When XClarity Administrator is initially installed, the product catalog and the repository are empty.
      • Compliance check is supported only for the baseboard management controller and UEFI in ThinkSystem SR635 and SR655 servers; however, XClarity Administrator attempts to apply firmware updates to all available hardware components.

      • Updates are applied according to the assigned firmware-compliance policy. You cannot choose to update a subset of components.

      • XClarity Administrator v3.2 or later is required to apply firmware updates for Lenovo XClarity Provisioning Manager (LXPM), LXPM windows drivers, or LXPM Linux drivers to ThinkSystem SR635 and SR655 servers.

      • The baseboard management controller and UEFI updates are skipped if the currently installed version is higher than the assigned compliance policy.

      • Firmware-compliance policies must be created and assigned to the devices on which you intend to apply firmware updates. For more information, see Creating and assigning firmware-compliance policies.

      • The selected devices are powered off before starting the update process. Ensure that any running workloads have either been stopped or, if you are working in a virtualized environment, moved to a different server.

    • Apply selected firmware updates with or without compliance policies

      You can apply firmware updates on selected components and devices according to the assigned firmware-compliance policy using applicable firmware-update packages. You can also choose to apply firmware updates that are later than the currently installed firmware on selected components and devices without using compliance policies.

      You can choose to apply updates for all components in a specific device. You can also choose to update only a subset of components in the selected devices, such as the baseboard management controller or UEFI.

      To activate the firmware updates, the devices must be restarted. (Note that restarting a device is disruptive.) You can choose to restart the devices as part of the update process (called immediate activation), or wait until a maintenance window is available to restart the devices (called delayed activation). In this case, you must manually restart the device for the update to take effect.

      When you choose to update the firmware for a managed device, the following steps occur:
      1. XClarity Administrator sends the firmware updates (for example, for the management controller, UEFI, and DSA) to the device.
      2. When the device is restarted, the firmware updates are activated on the device.
      3. For servers, XClarity Administrator sends updates for optional devices, such as network adapter and hard drive updates. XClarity Administrator applies these updates, and the server is restarted
      4. When you restart the device or choose immediate activation, the updates for the optional devices are activated.
      Note:
      • When applying updates using compliance policies, a firmware-compliance policy must be created and assigned to each target devices. For more information, see Creating and assigning firmware-compliance policies.

      • If you choose to install a firmware-update package that contains updates for multiple components, all components to which the update package applies are updated.

      • Updates to CMMs and Flex switches are always activated immediately, even if you select delayed activation.

    When you perform updates on a set of devices, XClarity Administrator performs the updates in the following order:
    • Chassis CMM

    • RackSwitch and Flex System switches

    • Flex compute nodes, and rack and tower servers

    • Lenovo Storage devices

    Attention: Before you attempt to apply firmware updates on managed devices, ensure that you have completed the following actions:
    • Read the firmware-update considerations before you attempt to update firmware on your managed devices (see Firmware-update considerations).
    • Initially, devices that are not supported for updates are hidden from the view. Devices that are not supported cannot be selected for updates.
    • By default, all detected components are listed as available for applying updates; however, down-level firmware might prevent a component from appearing in inventory or reporting full-version information. To list all policy-based packages that are available for you to apply updates, click All Actions > Global Settings, and selecting Enhanced Support for Down-Level Devices. When this option is selected, Other Available Software is listed in the Installed Version column for undetected devices. For more information, see Configuring global firmware-update settings.
      Note:
      • The global settings cannot be changed when updates to managed devices are in progress.

      • It takes a few minutes to generate the additional options. After a few moments, you might need to click the Refresh icon (Refresh icon) to refresh the table.

    • Ensure that no jobs are currently running on the target server. If jobs are running, the update job is queued until all other jobs have completed. To see a list of active jobs, click Monitoring > Jobs.
    • Ensure that the firmware-updates repository contains the firmware packages that you intend to deploy. If not, refresh the product catalog, and download the appropriate firmware updates (see Refreshing the product catalog and Downloading firmware updates).
      Note: When XClarity Administrator is initially installed, the product catalog and the repository are empty.

      If you intend to install prerequisite firmware, ensure that the prerequisite firmware is downloaded in the repository as well.

      In some cases, multiple versions might be needed to update firmware, and all versions would need to be downloaded to the repository. For example, to upgrade the IBM FC5022 SAN scalable switch from v7.4.0a to v8.2.0a, you must first install v8.0.1-pha, then v8.1.1, and then v8.2.0a. All three versions must be in repository to update the switch to v8.2.0a.

    • Typically, devices must be restarted to activate the firmware update. If you choose to restart the device during the update process (immediate activation), ensure that any running workloads have either been stopped or, if you are working in a virtualized environment, moved to a different server.

    For more information about installing updates, see Applying and activating firmware updates.