CHAPTER 14
BIOS Protection
• Introduction to BIOS Protection, on page 351
• ROMMON Upgrade, on page 351
• Feature History for BIOS Protection, on page 352
Introduction to BIOS Protection
BIOS protection feature enables write-protection and secure upgrade of the golden ROMMON image.
ROMMON is a bootstrap program that initializes the hardware and boots the Cisco IOS XE software image
when you power on or restart the device. ROMMON upgrades can be required to resolve firmware defects
or to support new features. Typically, ROM Monitor upgrades are infrequent and not required for every Cisco
IOS XE software upgrade.
Without BIOS protection feature, golden ROMMON may be corrupted by malicious code during software
upgrades.
ROMMON Upgrade
ROMMON images are stored on the SPI flash device as primary ROMMON and golden ROMMON. Primary
ROMMON boots every time the device is powered on or restarted. If the primary ROMMON gets corrupted,
the device uses the golden ROMMON to boot the IOS XE software image. When the device boots from the
primary ROMMON, golden ROMMON is locked. With BIOS protection, golden ROMMON is made
write-protected and cannot be upgraded using the flash utility upgrade mechanism. Access policies are governed
by the FPGA firmware. FPGA blocks the disallowed operations such as write, erase etc on the golden
ROMMON SPI flash device.
Golden ROMMON upgrade is not enabled without secure-boot FPGA upgrade.
Note
Primary ROMMON is automatically upgraded when the device boots. Golden ROMMON can be upgraded
using the capsule upgrade. Primary FPGA is automatically upgraded when the device boots. Golden FPGA
is never upgraded.
The upgrade process varies between standalone and high availability systems and is explained below.
System Management Configuration Guide, Cisco IOS XE Bengaluru 17.4.x (Catalyst 9400 Switches)
351
To Next Page
Loading...
Need help?
General