I figured it out and was able to make the switch install all the pending updates.
The procedure I had to follow was:
- enable allow-unsafe-updates , and reboot the switch
- then, re-enable allow-unsafe-updates and remove the power from the switches
- then reconnect power to the switches
The missing step here was that I took more than the allow-unsafe-updates <timer> to remove the power.
Still I think that requiring a full power cycle (physical re-plug the power cable; can't do it with a soft reboot), forcing admins to go on site and to every single technical room to remove power cables, is an unacceptable requirement for enterprise level campus switch and a bit of, well, a joke.
Is there any plan to remove this requirement?