Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

There is no single safe “patch Cisco SD-WAN” procedure: the right path depends on whether you are fixing an IOS XE Catalyst SD-WAN router, patching managed device software through Cisco SD-WAN Manager, or updating a control component. Inventory your platforms and releases, confirm the image is compatible, then use the workflow Cisco documents for that component and release. A patch is not automatically disruption-free: some SMUs require a reload, and Cisco says control-component patches cannot be uninstalled.

Identify what you need to patch

“Cisco SD-WAN” can refer to the routers at branch sites, device software managed by SD-WAN Manager, or the control components. These are separate update paths, not interchangeable names for one operation.

Update path What it changes Key compatibility or impact point
IOS XE Catalyst SD-WAN Software Maintenance Upgrade (SMU) A targeted point fix for supported router software. Availability depends on platform and minimum software release. Cisco classifies SMUs as Hot (non-reload) or Cold (reload); activation may reboot depending on the image.
SD-WAN Manager device workflow Device software on compatible, selected devices. Manager presents images available and supported for the selected devices. The workflow offers separate Upgrade and Patch actions.
Control-component patch workflow Cisco SD-WAN Manager, Validator, and Controller software. Patch compatibility depends on the base release. In the workflow documented from Cisco Catalyst SD-WAN Manager Release 20.18.1, the sequence is Manager, Validator, then Controller; applied patches cannot be uninstalled.

Cisco describes an SMU as a point fix for an issue in released software, intended to minimize disruption where possible; it is not a substitute for a maintenance release. Cisco feature history identifies SMU package support beginning with Cisco IOS XE Catalyst SD-WAN Release 17.9.1a and Cisco vManage Release 20.9.1. Those version references do not establish that a particular SMU is available for every platform or deployment.

Inventory releases and check compatibility first

Before choosing an image, record the complete scope of the change. Include router platform and current IOS XE Catalyst SD-WAN release, Manager and control-component releases, whether Manager is clustered, and the exact target fix or release. Without those details, a universal target version or command sequence would be unsafe.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
#1 Best Overall
Meraki MX75-HW Security Appliance Bundle | Cloud-Managed Firewall | No License Included | 1 Gbps Throughput | 3X WAN (1x SFP, 2X GbE) | SD-WAN & VPN
  • SECURITY & SD-WAN PERFORMANCE: The MX75-HW cloud-managed appliance delivers up to 1 Gbps firewall throughput and 500 Mbps VPN throughput, supporting small branch deployments with up to 200 users.
  • ADVANCED THREAT PROTECTION: Integrated intrusion prevention, advanced malware protection, and content filtering safeguard your network against evolving cyber threats.
  • CLOUD-MANAGED SIMPLICITY: Zero-touch provisioning and centralized cloud dashboard for seamless configuration, monitoring, and troubleshooting.
  • APPLICATION-AWARE CONTROL: Layer 7 traffic shaping prioritizes critical applications like voice and video while optimizing overall network performance.
  • BUILT-IN SD-WAN & VPN: Simplifies multi-site connectivity with intelligent path control, automatic failover, and secure site-to-site VPN.
  • For router and control-component compatibility, check Cisco’s compatibility matrix against your actual versions.
  • If Manager itself is being upgraded, consult the Manager upgrade matrix for a supported upgrade path.
  • Confirm that the image is compatible with the selected devices and their current release. Manager’s workflow only exposes images available and supported for the devices selected.
  • Check platform support, minimum release requirements, and whether an SMU is Hot or Cold before scheduling the change.

Choose the appropriate patch workflow

For an IOS XE Catalyst SD-WAN router SMU

Use the SMU package only when Cisco lists it for the specific router platform and software release. The device runs a compatibility check for the SMU. Check the image’s activation behavior as well: a Cold SMU requires a reload, and activation or deactivation can reboot the device depending on the image.

For managed device software

For Cisco SD-WAN Manager Release 20.18.1 and later, Cisco documents the Device Software Upgrade workflow. In Manager, open Workflows > Workflow Library and start that workflow; on other releases, use the workflow appropriate to that version. Select compatible devices and the image, then choose Upgrade or Patch according to the change you intend. Keep device types separate where Cisco warns against combining them, and check the workflow’s current eligibility rules for your release.

For control components

Use the control-component workflow documented for your Manager release, not the device software workflow. Cisco’s combined control-component upgrade workflow from Manager Release 20.18.1 supports patch upgrades and specifies this order:

  1. Patch or upgrade Manager.
  2. Patch or upgrade Validator.
  3. Patch or upgrade Controller.

The workflow accepts only patches compatible with the base release. Cisco says an applied control-component patch cannot be uninstalled and recommends taking a VM snapshot before upgrading.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
Sale
Cisco Meraki MX68CW-HW Wireless LTE Security SD-WAN Appliance (Renewed)
  • Renewed Enterprise Appliance: This Cisco Meraki MX68CW-HW comes professionally renewed to deliver reliable performance for small to medium-sized business networks, offering enterprise-grade security and SD-WAN capabilities at an accessible price point
  • Integrated Wireless Connectivity: Features built-in wireless capabilities that enable seamless network deployment without requiring additional access points, providing flexible connectivity options for your business environment
  • LTE Failover Support: Equipped with LTE cellular connectivity to ensure continuous network uptime by automatically switching to cellular backup when primary internet connections fail, maintaining business continuity during outages
  • Advanced Security Features: Delivers comprehensive network security with integrated firewall, content filtering, and intrusion detection capabilities to protect your business from cyber threats and unauthorized access
  • SD-WAN Technology: Incorporates software-defined wide area networking functionality that intelligently routes traffic across multiple connections, optimizing application performance and reducing bandwidth costs while simplifying network management

Monitor the workflow and verify the fix

Workflow completion is evidence that the software operation finished; it does not by itself prove that the original defect is resolved or that services are healthy. Check both the Manager’s recorded result and your deployment’s normal operational acceptance checks.

  1. Review the Manager task list for success or failure.
  2. Open task details to see which devices were affected, then inspect the task logs for the upgrade or patch result.
  3. For the documented SMU procedure, check the success message and confirm the device has synced up in Manager.
  4. Separately validate the control connections, routes, tunnels, and the specific defect or security fix using the acceptance checks established for your topology.

Cisco’s reviewed procedures do not define one operational acceptance checklist that applies to every topology. Choose checks that directly exercise the affected feature and the services that depend on it.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Plan for disruption and recovery

Schedule the change with the expected impact of the selected image in mind. A Cold SMU requires a reload, and SMU activation may reboot depending on the image. For a control-component patch, take the recommended VM snapshot before the change: Cisco states that an applied patch cannot be uninstalled. Prepare a maintenance window and a recovery plan appropriate to the device, Manager topology, and services involved; Cisco’s cited procedures do not prescribe one rollback plan for every router or topology.

Best Value
KFD 54V Power Supply for Cisco Meraki MX68 MX65 MX68W MX68CW MX68-HW MX68W-HW MX68CW-HW SD-WAN MX6x Routers MA-PWR-100WAC 640-76010 640-47010 54V 1.85A 1.67A 90W 100W Cisco Router Power Cord Adapter
  • KFD products are UL/ CE / FCC / RoHS certified, Warranty: 30 Days Free Exchange /36 Months Warranty; Input:100-240V 50-60Hz, Output:54V AC Adapter for Cisco Meraki MX68 Router Power Cord Charger , Power Adapter Power Cord has OVP, OCP, SCP Protection (OVP: Over Voltage output Protection. OCP: Over Current output Protection. SCP: Short Circuit output Protection)
  • 54V Power Supply for Cisco Meraki MX68 MX68W MX68CW MX68-HW MX68W-HW MX68CW-HW SD-WAN Small Branch Security Appliance MX6x Routers MA-PWR-100WAC P/N: 640-76010 MA-PWR-100 WAC +48V - 54V 1.85A - 2A 90Watts 100 Watt 90W - 100W 48VDC - 54VDC 1850mA - 2000mA Switching Power Supply Cord Cable PS Battery Charger Mains PSU
  • 54V 1.67A 90.18W AC/DC Adapter Compatible with Cisco Meraki MX65 MX65W MX65-HW MX65W-HW Advanced Security License MA-PWR-90WAC 640-47010 600-47010 48V - 54.0V 90W Power Supply Cord Charger

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.