Symptom

Upgrade from 9.3(3) to 9.3(6) then when testing downgrade back via "install all" there are incompatibilities that prevent the downgrade: N9K-C9336-FX2-Z-PI# show incompatibility-all nxos nxos.9.3.3.bin Checking incompatible configuration(s) for vdc 'N9K-C9336-FX2-Z-PI': ------------------------------------------------------------------------ The following configurations on active are incompatible with the system image 1) Service : rpm , Capability : CAP_FEATURE_RPM_TUNNELENCRYPT_KEYSTR_NOSHOW Description : RPM tunnel-encryption key chain command "key-chain tunnelencrypt-psk no-show" is configured Capability requirement : STRICT Enable/Disable command : Use "no key-chain tunnelencrypt-psk no-show" to remove it 2) Service : rpm , Capability : CAP_FEATURE_RPM_TUNNELENCRYPT_KEYCHAIN Description : RPM tunnel-encryption key chain command "key chain tunnel-encryption" is configured Capability requirement : STRICT Enable/Disable command : Use "no key chain tunnel-encryption" to remove it 3) Service : rpm , Capability : CAP_FEATURE_IP_NEXTHOP_VERIFY_FORCE_ORDER Description : RPM-PBR "set ip next-hop verify-availability ... force-order" is configured Capability requirement : STRICT Enable/Disable command : Please Use "no set ip next-hop verify-availability force-order" to remove the configuration 4) Service : rpm , Capability : CAP_FEATURE_IP_NEXTHOP_VERIFY_DROP_ON_FAIL Description : RPM-PBR "set ip next-hop verify-availability ... drop-on-fail" is configured Capability requirement : STRICT Enable/Disable command : Please Use "no set ip next-hop verify-availability drop-on-fail" to remove the configuration 5) Service : rpm , Capability : CAP_FEATURE_IPV6_NEXTHOP_VERIFY_FORCE_ORDER Description : RPM-PBR "set ipv6 next-hop verify-availability ... force-order" is configured Capability requirement : STRICT Enable/Disable command : Please Use "no set ipv6 next-hop verify-availability force-order" to remove the configuration 6) Service : rpm , Capability : CAP_FEATURE_IPV6_NEXTHOP_VERIFY_DROP_ON_FAIL Description : RPM-PBR "set ipv6 next-hop verify-availability ... drop-on-fail" is configured Capability requirement : STRICT Enable/Disable command : Please Use "no set ipv6 next-hop verify-availability drop-on-fail" to remove the configuration 7) Service : rpm , Capability : CAP_FEATURE_RPM_MACSEC_TYPE_6_KEYCHAIN Description : RPM type-6-encryption key chain command "key-octet-string cryptographic-algorithm " is configured Capability requirement : STRICT Enable/Disable command : Use "no key-octet-string" to remove it 8) Service : rpm , Capability : CAP_FEATURE_RPM_EVPN_GWIP_USE_NEXTHOP Description : The following EVPN CLIs are configured on route-map "set evpn gateway-ip use-nexthop" Capability requirement : STRICT Enable/Disable command : Please remove this configuration from all route-map 9) Service : rpm , Capability : CAP_FEATURE_RPM_COMM_LIST_GRACEFUL_SHUTDOWN Description : Community list standard "graceful-shutdown community" is configured Capability requirement : STRICT Enable/Disable command : please remove the graceful-shutdown configuration and retry Checking dynamic incompatibilities: ----------------------------------- No incompatible configurations N9K-C9336-FX2-Z-PI# Configurations listed above are not present in the show run or show run all. Attempting to remove per the instructions above does not fix. Write erase, reload, then downgrade of the N9k via "install all" is required.

Conditions

Upgrade to 9.3(6) then attempt to downgrade via "install all".

Workaround

Write erase, reload, then downgrade of the N9k via "install all"

Further Problem Description