The error NCSW10301: Unable to download the image from cisco.com : invalid metadata_trans_id is a common issue encountered in Cisco Catalyst Center (formerly DNA Center) during Software Image Management (SWIM) operations. This error typically indicates a failure in downloading the associated ISSU Compatibility Matrix (comp_matrix.xml) even if the base image file downloads successfully. Root Causes of NCSW10301
External API Failures: Cisco has identified that certain external providers used for metadata APIs occasionally experience sporadic outages, causing this specific "invalid metadata" response.
Software Bugs: Several bugs have been tracked for this behavior, including CSCwd15921, which affects releases 2.2.3.x through 2.3.4.x.
Registration & Approval Issues: Newer versions like 2.3.7.9 may trigger this error if the product is not properly registered or approved to call Cisco cloud services.
Certificate Expiration: Expired certificates in the Catalyst Center Trustpool can break the secure communication required to fetch metadata from software.cisco.com.
Proxy Configuration: If the appliance is behind a proxy and the SWIM engine is not correctly utilizing the proxy settings, metadata requests will fail. Step-by-Step Troubleshooting and Fixes 1. Manual Image Import (The Guaranteed Workaround)
If the automated download fails, the most reliable fix is to manually upload the image:
Download Locally: Go to the Cisco Software Download portal on your laptop and download the required .bin or .tar file.
Import to Catalyst Center: In Catalyst Center, navigate to Design > Image Repository and use the Import function to upload the file from your local machine.
Verify Integrity: Once imported, check System > Settings > Integrity Verification to ensure the image is verified against Known Good Values (KGV). 2. Refresh Cisco.com Credentials
Sometimes the token between your appliance and Cisco's servers becomes "invalid": Go to System > Settings > Cisco.com Credentials.
Remove the existing account and re-add it using your Cisco Smart Account credentials. 3. Update the Trustpool
Metadata downloads require valid root certificates to verify Cisco's servers: Navigate to Settings > Trust & Privacy > Trustpool.
Check if there is a pending update for the Cisco Trustpool and apply it to restore secure communications. 4. Verify Proxy and Connectivity
Ensure the appliance can actually reach the metadata endpoints: The error NCSW10301: Unable to download the image
Use the CLI to test connectivity to cloudsso.cisco.com and software.cisco.com.
Check if your firewall is blocking traffic to these URLs or if the appliance is attempting to bypass the configured proxy for SWIM tasks. 5. Check for Known Field Notices
Cisco released Field Notice FN74033, stating that older versions of DNA Center will fail to download metadata after April 26, 2024, due to certificate changes. If you are on an older release, an upgrade to a fixed version (e.g., 2.3.5.x or later) is required. Comparison of Solution Paths Effectiveness When to Use Manual Import Urgent upgrades or persistent API errors. Credential Refresh Authentication or account permission issues. Trustpool Update Certificate or SSL handshake failures. Software Upgrade For long-term fixes of known bugs (e.g., CSCwd15921).
Are you currently running a single-node or three-node cluster, and what is your specific software version? DNA CENTER IMAGE REPOSITORY ERROR NCSW10301
NCSW10301: Unable to download the image from cisco.com : invalid metadata_trans_id
is a known issue typically encountered in Cisco Catalyst Center (formerly DNA Center) during Software Image Management (SWIM) operations. While the main software image may download successfully, the associated ISSU Compatibility Matrix (comp_matrix.xml) fails due to this metadata error. Review of Error NCSW10301
This error often points to issues with Cisco's external API providers or specific version-related bugs in the Catalyst Center software. Cisco Community Affected Versions : Observed in versions 2.2.3.x, 2.3.3.x, and 2.3.4.x Root Cause
: It is frequently linked to sporadic API issues with external providers that Cisco uses for metadata services. Known Bugs : This specific symptom is tracked under Cisco Bug CSCwd15921 Cisco Community Recommended Workarounds
If you encounter this error, you can use the following methods to bypass the automated download failure: Manual Import
: Download the required software image directly to your local machine from the Cisco Software Download
portal. Then, manually import the image file into the Catalyst Center Image Repository. Internal Server Transfer
: If you have another device with the correct image in its flash memory, copy that image to an internal server and then import it into Catalyst Center. Check Connectivity & Credentials
: Ensure your Cisco.com (CCO) credentials are correctly configured in the system settings and that the appliance has verified HTTPS reachability to Cisco's servers. KGV & Trustpool Updates : Verify that your Known Good Values (KGV) certificates are up to date under System > Settings
, as expired certificates can sometimes block metadata verification. Cisco Community CLI commands Force NTP sync (if using chrony) chronyc -a makestep
to verify your Catalyst Center certificate expiration status?
The error NCSW10301 is a known issue within Cisco Catalyst Center (formerly DNA Center) that occurs when the system fails to download an image or its associated metadata (like the ISSU Compatibility Matrix) from Cisco.com. The specific "invalid metadata trans-id" typically indicates a failure in the API transaction between your controller and Cisco's automated software distribution backend. Common Causes
Known Bug: This error is documented in Cisco Bug CSCwd15921, affecting versions 2.2.3.x through 2.3.4.x.
API/External Provider Issues: Intermittent issues with the external APIs used to fetch software metadata can trigger this failure.
Expired Trustpool: Outdated or expired certificates in the controller's trustpool can prevent secure communication with Cisco's servers.
Proxy Configuration: Misconfigured proxies or proxies that bypass certain authentication steps may interfere with the download process. Recommended Workarounds
If you encounter this error, use these steps to resolve or bypass the issue: Update the Trustpool Bundle: Navigate to Settings > Trust & Privacy > Trustpool.
If an update is available, click Update trustpool on controller now and retry the task. Manual Image Import (Recommended Bypass):
Download the required software image manually to your laptop or a local server from the Cisco Software Central.
Import the image into Catalyst Center manually via the Image Repository. Check Integrity Verification: Go to System > Settings > Integrity Verification.
Ensure the Known Good Values (KGV) file is up-to-date. If not, import the latest KGV directly or manually.
Are you currently running one of the affected versions mentioned (2.2.3.x–2.3.4.x), or are you on a newer release like 2.3.7.x? DNA CENTER IMAGE REPOSITORY ERROR NCSW10301
The error NCSW10301: Unable to download the image from cisco.com : invalid metadata_trans_id typically occurs during Software Image Management (SWIM) operations in Cisco Catalyst Center (formerly DNA Center). It is often tied to synchronization failures between the appliance and Cisco's external image metadata services. Root Causes
Known Cisco Bug (CSCwd15921): Affects Catalyst Center versions 2.2.3.x, 2.3.3.x, and 2.3.4.x. While the software image itself may download successfully, the associated ISSU Compatibility Matrix fails because of an invalid or expired metadata transaction ID. Ideal tolerance: Less than 5 seconds difference from pool
External API Issues: Sporadic issues with Cisco's external provider APIs can prevent the generation of a valid transaction ID needed for the metadata download.
Service Registration: In newer versions like 2.3.7.9, this error may be accompanied by messages indicating the product needs to be registered or approved to call the service. Recommended Solutions & Workarounds Manual Image Import:
Download the required software image (e.g., .bin or .tar file) directly from the Cisco Software Download site to your local machine.
In Catalyst Center, navigate to the Image Repository and use the Import function to upload the image manually from your computer or an internal server. Verify Proxy and Connectivity:
Ensure the appliance has a clear path to cisco.com. Some users have resolved connectivity issues by switching the proxy configuration from HTTPS to HTTP (while the payload remains encrypted). Check Registration Status:
Verify that your Catalyst Center is properly registered with Cisco Smart Licensing and has the necessary permissions to access Cisco cloud services. Contact Cisco TAC:
If the issue persists, open a case with Cisco Technical Assistance Center (TAC) to investigate potential backend database sync issues or expired internal certificate chains. DNA CENTER IMAGE REPOSITORY ERROR NCSW10301
chronyc -a makestep
Ideal tolerance: Less than 5 seconds difference from pool.ntp.org.
After syncing, restart the controller’s services and retry the download.
export no_proxy="*.cisco.com,software.cisco.com,*.ciscoccservice.com"
Configure proxy rules:
cache disable for cisco.com/download
cache disable for software.cisco.com/api
In NCS/DNA Center, enable debug logs for image management:
ncs set-log-level com.cisco.ncs.imagemanagement DEBUG
ncs tail -f /var/log/ncs/imagedownload.log
Look for entries containing trans-id, metadata mismatch, or HTTP 403/409.
This is the most effective solution for corruption issues.