Peer-assisted distribution
Reachable, eligible peers can supply image pieces and reduce server traffic. Results depend on the network and swarm.
Cisco image and patch staging with private peer delivery
IRIS
IRIS stages Cisco images and patches on routers and switches using peer-to-peer delivery. Devices share downloaded pieces, verify the image, and stop at staging.
Run irisctl setup to deploy IRIS on Docker or Kubernetes, create signing keys and prepare device packages. The installation guide lists download availability.
Private swarm delivery
1 image -> many devices
- Publish
The server publishes image metadata and a private torrent.
- Share
Devices download pieces from the server and from each other.
- Stage
Each device verifies the image, stages it, and waits for the operator.
P2P
devices help distribute image pieces
Encrypted
HTTPS for the Console and service APIs, mutual TLS between peers by default
Resumable
piece downloads continue after an interruption
Safe
verified staging with no reload
How it works
The simple idea: devices help each other download.
A file server sends the whole image to every device. With IRIS, the tracker finds eligible peers, the origin seeder supplies pieces, and devices share what they already have.
Traditional pull
Every device pulls the whole image from one place. Transfers and image verification at the distribution source and on each device are manual or separately scripted. A large rollout waits on the server and its uplink.
IRIS private swarm
Tracker and origin seeder run in one distribution container. A separate Console provides the management UI. IRIS combines peer delivery with server-side Cisco hash checks and on-device checks against the catalog hash. The installer enables mutual TLS to encrypt peer transfers.
Better fault tolerance
BitTorrent-style piece transfers can resume after interruption, and devices can fill missing pieces from more than one source once the swarm has content.
Safer change control
IRIS only stages the approved image. Install, activation, boot changes, and reloads stay outside the tool and under operator control. On an existing management VLAN (inband), IRIS also never creates, changes, or removes that VLAN, its SVI, gateway, routes, or VRF.
Workflow
Publish, assign, stage, stop.
Use the Console or API to publish images, assign devices, and follow staging progress. Software installation and reloads remain outside IRIS.
Publish an image
Upload an image or import an eligible file already on the server. IRIS records its hashes and creates private swarm metadata.
POST /api/v1/images/import
Catalyst 9000 Guest Shell
Run the shared agent in Guest Shell, supervised by EEM, or use the amd64 IOx container on supported switches with app-hosting storage.
- Installs catalog trust material.
- Downloads image pieces through the private swarm.
- Stages approved images to device storage.
Platforms
One agent across device platforms.
IOx and IOS-XR appmgr use one device-agent container build for arm64 and amd64. Each platform has its own package and storage handling. Guest Shell runs the same agent code from a bundle.
Device families include Catalyst, Industrial Ethernet, Cisco 8000, and NCS. Available deployment paths depend on device capabilities and software.
The server and web Console run in separate containers on one Docker host, separate Docker hosts, or Kubernetes. The server manages images, assignments, and the swarm; the Console provides the browser interface. Follow device staging and peer transfers in the Swarm Map, or export telemetry to an OpenTelemetry collector.
The Console, catalog, tracker, artifact server, telemetry listener, and internal management API use HTTPS. Device agents verify the server certificate. Image pieces travel through the private BitTorrent swarm. The Ubuntu managed installer requires mutual TLS for peer transfers by default.
Documentation