Ensure your perimeter firewalls are not performing SSL decryption or deep packet inspection on traffic destined for *.cisco.com . This can alter the HTTP headers and invalidate transaction IDs.
If the error persists after syncing your credentials and clearing the transaction cache, open a case with Cisco TAC (Technical Assistance Center). Provide them with the exact timestamp of the failure and the specific trans_id extracted from your syslog or Catalyst Center audit logs to help them locate the failure on the backend server.
If Cisco's cloud API continuously serves invalid metadata, bypass the automated cloud download by hosting the image locally. Ensure your perimeter firewalls are not performing SSL
Invalid metadata errors often mask an authentication or entitlement failure. Log into Cisco Software Central .
Navigate to Provision > Inventory . Find the affected device, click the Actions dropdown, and select Clear Software Image Upgrade Tasks . Provide them with the exact timestamp of the
If a previous download attempt failed, a stale transaction ID ( trans_id ) may be cached in your orchestration engine or switch memory.
Manually download the validated .bin or .SPA target image directly from the Cisco Software Download portal via a web browser. Log into Cisco Software Central
The local device or management platform is using outdated or un-synchronized Smart Account credentials, failing the entitlement check required for the download. Troubleshooting and Resolution Steps 1. Clear the Stale Download Transaction