Release Notes for Catalyst 3650 Series Switch, Cisco IOS XE Release 3.6.xE
Available Languages
Table of Contents
Release Notes for Catalyst 3650 Series Switch, Cisco IOS XE Release 3.6.xE
What’s New in Cisco IOS XE Release 3.6.10E
What’s New in Cisco IOS XE Release 3.6.8E
What’s New in Cisco IOS XE Release 3.6.7bE
What’s New in Cisco IOS XE Release 3.6.7E
What’s New in Cisco IOS XE Release 3.6.6E
What’s New in Cisco IOS XE Release 3.6.5bE
What’s New in Cisco IOS XE Release 3.6.5E
What’s New in Cisco IOS XE Release 3.6.4E
What’s New in Cisco IOS XE Release 3.6.3E
Wired Guest Access with Both Anchor and Foreign
Configuring OPENAUTH and WEBAUTH in Parallel
WEBAUTH Command Output Examples
What’s New in Cisco IOS XE Release 3.6.2aE
What’s New in Cisco IOS XE Release 3.6.1E
What’s New in Cisco IOS XE Release 3.6.0E
Cisco Wireless LAN Controller Models
Access Points and Mobility Services Engine
Wired Web UI (Device Manager) System Requirements
Wireless Web UI Software Requirements
Finding the Software Version and Feature Set
Interoperability with Other Client Devices
Resolved Caveats in Cisco IOS XE Release 3.6.10E
Resolved Caveats in Cisco IOS XE Release 3.6.9E
Resolved Caveats in Cisco IOS XE Release 3.6.8E
Resolved Caveats in Cisco IOS XE Release 3.6.7bE
Resolved Caveats in Cisco IOS XE Release 3.6.7E
Resolved Caveats in Cisco IOS XE Release 3.6.6E
Resolved Caveats for Cisco IOS XE Release 3.6.5bE
Resolved Caveats in Cisco IOS XE Release 3.6.5E
Resolved Caveats in Cisco IOS XE Release 3.6.4E
Resolved Caveats in Cisco IOS XE Release 3.6.3E
Resolved Caveats in Cisco IOS XE Release 3.6.2aE
Resolved Caveats in Cisco IOS XE Release 3.6.1E
Resolved Caveats in Cisco IOS XE Release 3.6.0E
Obtaining Documentation and Submitting a Service Request
Release Notes for Catalyst 3650 Series Switch, Cisco IOS XE Release 3.6.xE
First Published: June 27, 2014
This release note gives an overview of the features for the Cisco IOS XE 3.6.xE software on the Catalyst 3650 series switch.
Unless otherwise noted, the terms switch and device refer to a standalone switch and to a switch stack.
Contents
- Introduction
- What’s New in Cisco IOS XE Release 3.6.10E
- What’s New in Cisco IOS XE Release 3.6.8E
- What’s New in Cisco IOS XE Release 3.6.7bE
- What’s New in Cisco IOS XE Release 3.6.6E
- What’s New in Cisco IOS XE Release 3.6.5E
- What’s New in Cisco IOS XE Release 3.6.4E
- What’s New in Cisco IOS XE Release 3.6.3E
- What’s New in Cisco IOS XE Release 3.6.2aE
- What’s New in Cisco IOS XE Release 3.6.1E
- What’s New in Cisco IOS XE Release 3.6.0E
- Supported Hardware
- Wired Web UI (Device Manager) System Requirements
- Wireless Web UI Software Requirements
- Finding the Software Version and Feature Set
- Upgrading the Switch Software
- Features
- Interoperability with Other Client Devices
- Important Notes
- Limitations and Restrictions
- Caveats
- Troubleshooting
- Related Documentation
- Obtaining Documentation and Submitting a Service Request
Introduction
The Catalyst 3650 switches are the next generation of enterprise class stackable access layer switches that provide full convergence between wired and wireless networks on a single platform. This convergence is built on the resilience of new and improved 160-Gbps StackWise-160 and Cisco StackPower. Wired and wireless security and application visibility and control are natively built into the switch.
The Catalyst 3650 switches also support full IEEE 802.3at Power over Ethernet Plus (PoE+), modular and field replaceable network modules, redundant fans, and power supplies. The Catalyst 3650 switches enhance productivity by enabling applications such as IP telephony, wireless, and video for a true borderless network experience.
The Cisco IOS XE software represents the continuing evolution of the preeminent Cisco IOS operating system. The Cisco IOS XE architecture and well-defined set of APIs extend the Cisco IOS software to improve portability across platforms and extensibility outside the Cisco IOS environment. The Cisco IOS XE software retains the same look and feel of the Cisco IOS software, while providing enhanced future-proofing and improved functionality.
For more information about the Cisco IOS XE software, see http://www.cisco.com/en/US/prod/collateral/iosswrel/ps9442/ps11192/ps11194/QA_C67-622903.html
What’s New in Cisco IOS XE Release 3.6.5E
- Support for –B Domain—The FCC (USA) rule making on 5 GHz released on April 1, 2014 (FCC 14-30 Report and Order) goes into effect for products that are sold or shipped on or after June 2, 2016. Cisco APs and Cisco WLCs will comply with the new rules by supporting the new regulatory domain (– for the US and will create new AP SKUs that are certified under the new rules. Examples of new rules include new 5-GHz band channels permitted for outdoor use, and transmission (Tx) power level increased to 1W for indoor, outdoor, and point-to-point transmissions.
Note
Cisco APs and Cisco WLCs that are in the –A domain category can continue to operate and even coexist with –B domain devices without any issues.
We recommend that you upgrade Cisco APs and Cisco WLCs to the appropriate software release that supports –B domain.
–B Domain Compliant Cisco APs starting with Cisco IOS XE Release 3.6.5E are: Cisco Aironet 700, 700W, 1040, 1140, 1260, 1530, 1570, 1600, 1700, 2600, 2700, 3500, 3600, 3700.
What’s New in Cisco IOS XE Release 3.6.4E
- Beginning with Cisco Wireless Release 8.1 and later, Mobility Agent related CLI/WebUI from AireOS-based controllers as Mobility Controller is no longer supported.
- Pairing of 3850, 3650 switches, or 4500E Sup-8E, as Mobility Agent is not supported with Cisco Wireless Release 8.1 and later releases.
- The TACACS+ login procedure using custom method list is simplified wherein configuring a default method list is no longer required when the same server group is used.
What’s New in Cisco IOS XE Release 3.6.3E
- CDP Bypass—The sessions are established in single and multi-host modes for IP Phones. However, if voice VLAN and 802.1x on an interface port is enabled, then the CDP Bypass is enabled when the host mode is set to single or multi host mode.
Note By default the host mode is set to single mode in <legacy> mode and multi-authentication in the edge mode.
Use the following commands to configure CDP bypass:
Switch(config)# interface <interface-id>
Switch(config-if)# switchport mode access
Switch(config-if)# switchport voice vlan <vlan-id>
Switch(config-if)# authentication port-control auto
Switch(config-if)# authentication host-mode single | multi-host
Switch(config-if)# dot1x pae authenticator
- WebAuth sleeping client—Allows successfully authenticated devices to stay logged in for a configured period without reauthentication.
The following CLI is added under the webauth parameter map:
sleeping-client timeout timeout-in-minutes
– There is one-to-one mapping between device MAC and username/password. Once an entry is added to sleeping-client cache, the device/user gets policies for the user stored in the cache. Therefore, any other user using the device also gets the same policies as the user stored in the sleeping-client cache. The user can force normal authentication by logging out. To do that, the user must explicitly enter the following URL:
– Mobility is not supported. If the client roams from one controller to another, the client undergoes normal authentication on the foreign controller.
- Multiple VLAN support for Wired Guest Access—Wired guest anchor can now support multiple VLANs and multiple guest LANs. Different VLANs can be assigned for each security profile like openauth, webauth and web consent.For more on Wired Guest Anchor, see “Wired Guest Access with Both Anchor and Foreign” section.
Note The Catalyst 3650 switch cannot be used as an anchor controller.
- Long URL—Webauth parameter map supports external URL with a maximum length of 256 characters. While configuring login URL for webauth, care should be taken that the complete length of the redirected URL should not exceed 550 characters. Commands used to configure external webauth parameter map with long URL are given below:
- Credentials support in HTTP GET Request—Customers can customize the HTML pages to send credentials in HTTP GET Request.
Note We recommended password encryption while using the HTTP GET Request.
- Append AP radio mac or SSID or client mac—External URLs sent to the client can be appended with AP radio mac address or SSID or client mac address or any of these combinations, so that the webauth redirect URL sent to the wireless client is parsed by an external server based on the appended attribute configured in the parameter-map. For example, an external server can use this attribute information present in the redirect URL to send the login page based on the AP location or SSID or the client mac address. The commands to configure this feature are given below:
- Multi-privilege level support to login to WEB UI through TACACS+—In releases prior to 3.6.3, the users were restricted to privilege level 15. In this release, users with privilege level 1 is supported to login and access for monitoring the controller, through TACACS+ or local authentication.
- Cisco 1570 Series Access Point—This release supports Cisco 1570 Series Access Point, in local mode.
- LWA—Multiple WebServer Configuration for External WebAuth.
The user has to configure extended ACL on the box and add the deny rule to allow the external server ip address. An example is given below:
This release introduces a new CLI in global parameter-map to configure the BYPASS_ACL. So, to configure the extended BYPASS_ACL under global parameter-map, use the following commands:
After the configuration, content of the BYPASS-ACL would be merged with intercept-acl or redirect acl. So, the traffic destined for the ip addresses which are configured in BYPASS_ACL would be allowed enabling the user to access multiple external servers during the authentication.
Permit 443 is not advised and to avoid the users from making mistakes while defining CWA ACL, a built-in ACL is provided, which needs some modification for bypassing traffic to CWA server. (the Controller or Switch creates a default URL Redirect- ACL with mandatory ACEs [permit http traffic, deny dns and dhcp] excluding “permit tcp any any eq 443”.) Using this ACL, the user needs to configure only “deny” rule for ISE Server/Any external Server to access it.
Default ACL Name: CISCO-CWA-URL-REDIRECT-ACL
You can see the ACL using show ip access-list command. After modifying the ACL, its available from the show running-config command output.
1. Modify the Default ACL “CISCO-CWA-URL-REDIRECT-ACL” to add “deny ip any host <server-ip>” above 100. If there is a requirement to allow multiple servers, use multiple “deny” rules.
2. Configure the Default ACL Name in ISE as redirect-url for CWA authorization profile.
Restrictions
- Wired guest VLAN on the access-switch should not have any SVI's present on any of the local switches. It should terminate directly on the foreign, so that the traffic is exported to the anchor.
- Anchor VLAN should not be allowed on the foreign controllers’ uplink. Doing so may result in unexpected behavior.
- The Foreign and Anchor guest LANs should not be on the same VLAN.
- Wired guest configuration should only be done during scheduled network downtime period.
Overview
In enterprise networks, there is typically a need for providing network access to its guests on the campus. The guest access requirements include providing connectivity to the Internet or other selective enterprise resources to both wired and wireless guests in a consistent and manageable way. The same wireless LAN controller can be used to provide access to both types of guests on the campus. For security reasons, a large number of enterprise network administrators segregate guest access to a DMZ (Demilitarized Zone) controller via tunneling. The guest access solution is also used as a fallback method for guest clients that fail dot1x and MAB authentication methods.
This document covers deployment of wired guest access feature on Catalyst 3650 switch as foreign anchor and Cisco 5760 Wireless LAN controller acting as Guest Anchor in the DMZ. The feature works in a similar fashion on Cisco Catalyst 3850 switch acting as foreign controller.
The guest user connects to the designated wired port on a access layer switch for access and optionally may be made to go through Web Consent or Web Authentication modes, depending upon the security requirements (details in later sections). Once guest authentication succeeds, access is provided to the network resources and the guest controller manages the client traffic. Foreign controller is the primary switch where client connects for network access. It initiates tunnel requests. Guest anchor is the switch where the client actually gets anchored.
Before guest access feature can be deployed, there must be a mobility tunnel established between the foreign anchor and guest anchor switches. Guest access feature works for both MC (Foreign Controller)>> MC (Guest Anchor) and MA (Foreign Controller)>>MC (Guest Anchor) models. The foreign anchor switch trunks wired guest traffic to the guest anchor controller and multiple guest anchors can be configured for load balancing. The client is anchored to a Demilitarized Zone (DMZ) anchor controller. It is also responsible for handling DHCP IP address assignment as well as authentication of the client. After the authentication completes, the client is able to access the network.
Deployment Scenario
The following sections covers common use cases where the wired clients connect to access switches for network access. Two modes of access are explained with different examples. In all of the methods, the wired guest access feature can act as a fallback method for authentication. This is typically a use case when a guest user brings an end device that is unknown to the network. Since the end device is missing endpoint supplicant, it will fail dot1x mode of authentication. Similarly, MAB authentication would also fail, as the MAC address of the end device would be unknown to the authenticating server. It is worth noting that in such implementations, corporate end devices would successfully get access since they would either have a dot1x supplicant or their MAC addresses in the authenticating server for validation. This allows for flexibility in deployment, as the administrator does not need to restrict and tie up ports specifically for guest access.
The diagram below shows the topology used in the deployment scenario:
Figure 1-1 Wired Guest Access with Both Anchor and Foreign
Open Authentication
Step 1 Enable IPDT and DHCP snooping on client VLANs (VLAN75 in this example). Client VLAN has to be created on the guest anchor.
Step 2 Create VLAN 75 and L3 VLAN interface.
Step 3 Create a guest LAN specifying the client VLAN with the Cisco WLC 5760 itself acting as the mobility-anchor.
For openmode, use the no security web-auth command.
Foreign Configuration
Step 1 Enable DHCP and create a VLAN. The client VLAN need not be on the foreign.
Step 2 The switch detects mac address of the incoming client on the port-channel configured with ‘access-Session port-control auto’ and applies the subscriber policy ‘OPENAUTH’. The ‘OPENAUTH’ policy as described below should be created first:
Note The policy can be applied on the port where the end device is connected while the 3850/3650 is acting as the Foreign.
Step 3 Configure Mac learning on the Foreign for VLAN
Step 4 The ‘OPENAUTH’ policy is referred to sequentially which in this case points to a service. Template named ‘SERV-TEMP3 OPENAUTH’ as defined below:
Step 5 The service template contains a reference to the tunnel type and name. Client VLAN75 only needs to exist on the guestanchor since it’s responsible for handling client traffic
Step 6 Tunnel request is initiated from the foreign to the guestanchor for the wired client and
A ‘tunneladdsuccess’ indicated that the tunnel build up process completed:
On the ACCESS-SWITCH1 a Wired client connects to the Ethernet port that is set to access mode by the network administrator. It is portGigabitEthernet 1/0/11 in this example:
Guest Anchor Configuration
Step 1 Enable IPDT and DHCP snooping on clientVLAN(s), in this case VLAN75. Client VLAN needs to be created on the guestanchor.
Step 2 Create VLAN 75 and L3 VLAN interface.
Step 3 Configure radius and parameter map.
Step 4 Create a guest LAN specifying the client VLAN with the Cisco WLC 5760 itself acting as the mobilityanchor.
Foreign Configuration
Step 1 Enable DHCP and create a VLAN. The client VLAN does not need to be setup on the foreign.
Step 2 The switch detects mac address of the incoming client on the port-channel configured with ‘access-Session port-control auto’ and applies the subscriber policy ‘WEBAUTH’. The ‘WEBAUTH’ policy as described below should be created first:
Step 3 Mac learning should be configured on the Foreign for VLAN
Step 4 The ‘WEBAUTH’ policy is referred to sequentially which in this case points to a service
Template named ‘SERV-TEMP3 WEBAUTH’ as defined below:
Step 5 The service template contains a reference to the tunnel type and name. Client VLAN75 only needs to exist on the guestanchor since it’s responsible for handling client traffic
Step 6 Tunnel request is initiated from the foreign to the guestanchor for the wired client and a ‘tunneladdsuccess’ indicated that the tunnel build up process is completed.
On the ACCESS-SWITCH1, a Wired client connects to the Ethernet port that is set to access mode by the network administrator. It is portGigabitEthernet 1/0/11 in this example:
Configuring OPENAUTH and WEBAUTH in Parallel
To have 2 guests LANs and assigning them to different clients we have to base them on the VLANs on which the clients are learned.
Guest Anchor Configuration
Step 1 Enable IPDT and DHCP snooping on client VLAN(s), in this case VLAN75. Client VLAN needs to be created on the guestanchor.
Step 2 Create VLAN 75 and L3 VLAN interface.
Step 3 Create a guest LAN specifying the client VLAN with the Cisco WLC 5760 itself acting as the mobilityanchor. For openmode, use the no security web-auth command.
Foreign Configuration
Step 1 Enable DHCP and create a VLAN. As noted, client VLAN does not need to be setup on the foreign:
Step 2 The switch detects mac address of the incoming client on the port-channel configured with ‘access-Session port-control auto’ and applies the subscriber policy ‘DOUBLEAUTH’. TThe vlan18, vlan19 class maps are explained in “Step4”. Everything else is webauth using the second “always” class-map with “match-first” event The ‘DOUBLEAUTH’ policy as described below should be created first:
Step 3 Mac learning should be configured on the Foreign for vlan 18 and 19.
Step 4 The ‘vlan19’ and 'vlan18' class-map contains the VLAN match criteria based on which we will differentiate which guest LAN the client falls in. It is defined below:
Step 5 The ‘OPENAUTH’ policy is referred to sequentially which in this case points to a service
Template named ‘SERV-TEMP3 OPENAUTH’ as defined below:
Step 6 The service template contains a reference to the tunnel type and name. Client VLAN75 only needs to exist on the guestanchor since it’s responsible for handling client traffic
Step 7 Tunnel request is initiated from the foreign to the guestanchor for the wired client and A ‘tunneladdsuccess’ indicated that the tunnel build up process completed:
On the ACCESS-SWITCH's there are multiple Wired client connecting to wither vlan18 or vlan19 which can be then assigned the guest LANs accordingly.
WEBAUTH Command Output Examples
For additional details on this feature, see the following document: https://techzone.cisco.com/t5/Converged-Access-NGWC/Wired-Guest-Access-with-Both-Anchor-and-Foreign-as-5760-WLC/ta-p/778400
What’s New in Cisco IOS XE Release 3.6.2aE
No features were added or enhanced for this release. For more information about updates in this release, see the “Caveats” section.
What’s New in Cisco IOS XE Release 3.6.1E
- Support for Device Sensor (LAN Base)
- Support for Cisco Aironet 1700 Series Access Points
- VLAN tagging support for Cisco Aironet 700W Series Access Points
- MAC Authentication per WLAN
- Support for Cisco Prime Infrastructure 2.2 and 2.1.2
What’s New in Cisco IOS XE Release 3.6.0E
Note Device Classifier has been disabled by default starting from Release 3.6.0E. Any features dependent on device classifier should enable it if required.
Use this URL for the Cisco IOS XE Release 3E Documentation Roadmap: http://www.cisco.com/c/en/us/support/ios-nx-os-software/ios-xe-3e/tsd-products-support-series-home.html |
Provides quick and easy access to all relevant documentation for specific platforms. Look for Quick Links to Platform Documentation on the respective platform documentation pages. |
Provides platform and software documentation for these technologies: |
|
| Supports Cisco Identity Services Engine (ISE) profiling for connected devices by using IOS Device Sensor |
|
| Introduces VRF-aware support for IPv6 routing protocols (VRF-aware OSPFv3, EIGRPv6, and BGPv6). |
|
Medianet Support (MSP, Metadata (no QoS), Perfmon, Mediatrace) |
Supports Cisco Media Services Proxy, Cisco Medianet Metadata (no QoS), and Cisco Performance Monitor. |
Eliminates the overhead of manual post install configuration on all the switches, in the smart install network. |
|
Provides a single line CLI, to enable base line security features (Port Security, DHCP snooping, DAI) |
|
Introduces support for Cisco EnergyWise Version 2.8. For more information, see the Cisco EnergyWise software release notes and configuration guide. |
|
| Introduces support for Unicast Reverse Path Forwarding in IPv6. |
|
| Expands the Enhanced Object Tracking (EOT) functionality to allow the tracking of IP version 6 (IPv6) routes. |
|
Allows an IPv6 Static Route to be associated with a tracked-object. |
|
Switch-based agent support for zero touch automated device installation solution called NG-PNP. |
|
Ensures that the Network Device Admission Control (NDAC)-authenticated 802.1X links between Cisco TrustSec devices are in open state even when the Authentication, Authorization, and Accounting (AAA) server is not reachable. |
|
Enhances the functionality of Cisco TrustSec with SXP version 4 by adding support for Security Group Tag (SGT) Exchange Protocol (SXP) bindings that can be propagated in both directions between a speaker and a listener over a single connection. |
|
| Controls and manages the Cisco TrustSec access control on a network device based on an attribute-based access control list. When a security group access control list (SGACL) is enabled globally, the SGACL is enabled on all interfaces in the network by default; use the Enablement of Security Group ACL at Interface Level feature to disable the SGACL on a Layer 3 interface. |
|
| Enables a standard CLI view including all commands by default. |
|
Displays the authentication results on the main HTML page. There is no pop-up window to display the authentication results. |
|
Ensures that one or more custom HTML pages can be downloaded and configured from a single tar file bundle. The images and the custom pages containing the images are also part of the same downloadable tar file bundle. |
|
Supports image file names without prefixes and removes the requirement of users having to specify the wireless management interface IP to indicate the source of image in the HTML code. |
|
Enables multicast Domain Name System (mDNS) to operate across layer 3 boundaries. |
|
| Allows users to configure multiple non-link local addresses as virtual addresses. The Hot Standby Router Protocol (HSRP) ensures host-to-router resilience and failover, in case the path between a host and the first-hop router fails, or the first-hop router itself fails. |
|
| Allows the device-sensor to extract the HTTP packet Type-Length-Value (TLV) to derive useful information about the end device type. |
|
Allows you to create a banner page and set an inactivity timeout for HTTP or HTTP Secure (HTTPS) connections. The banner page allows you to log on to the server when the session is invalid or expired. |
|
(LAN Base, IP Base, IP Services) Allows you to select the type, length, value (TLV) fields that are sent on a particular interface to filter information sent through Cisco Discovery Protocol packets. |
|
Provides a mechanism to authenticate Open Shortest Path First version 3 (OSPFv3) protocol packets as an alternative to existing OSPFv3 IPsec authentication. |
|
Enhances route maps to enable configuration of a recursive next-hop IP address that is used by policy-based routing (PBR). |
|
| Helps you manually configure how the received packets should be routed. You can identify packets by using several attributes and specify the next hop or the output interface to which the packet should be sent. |
|
Extends the capabilities of object tracking using Cisco Discovery Protocol (CDP) to allow the policy-based routing (PBR) process to verify object availability by using additional methods. |
|
Enables networks to redirect guest users to the URL they had originally requested. This feature is enabled by default and requires no configuration. |
|
Determines the level of network access provided to an endpoint based on the type of the endpoint device. This feature also permits hardbinding between the end device and the interface. Autoconfig falls under the umbrella of Smart Operations solution. |
|
Provides a mechanism to configure multiple commands at the same time and associate it with a target such as an interface. An interface template is a container of configurations or policies that can be applied to specific ports. |
|
Provides unique customization capabilities and event driven automation within Cisco products. |
|
Provides the capability to diagnose Media Stream on top of various instrumentations in Cisco routers/switches and endpoints. Also addresses the MediaNet Video monitoring requirement to discover the signaling path and provides end-to-end diagnostics along the media stream routes. |
|
Supports CleanAir Express on the Cisco 1600 Series Access Points. For more information about CleanAir Express, see http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/cleanair-technology/aag_c22-594304.pdf |
|
Support is added to the following APs in this release: Note The Cisco Aironet 1530 Series APs are supported operating only in Local mode; these APs in mesh mode are not supported. |
|
Access control lists (ACLs) when configured using fully qualified domain name (FQDN) enables ACLs to be applied based on the destination domain name. The destination domain name is then resolved to an IP address, which is provided to the client as a part of DNS response. Guest users can log in using web authentication with parameter map that consists of FQDN ACL name. You can apply access list to a specific domain. RADIUS server has to send AAA attribute fqdn-acl-name to the controller. The operating system checks for the pass through domain list, its mapping, and permits the FQDN. FQDN ACL allows clients to access only configured domains without authentication. The FQDN ACL is supported only for IPv4 wireless session. |
|
Local policies can profile devices based on HTTP and DHCP to identify the end devices on the network. Users can configure device-based policies and enforce the policies per user or per device policy on the network. Local policies allow profiling of mobile devices and basic onboarding of the profiled devices to a specific VLAN. They also assign ACL and QoS or configure session timeouts |
|
You can validate the rogue clients by utilizing the resources available in the Cisco Mobility Services Engine (MSE). Using MSE, you can dynamically list the clients joining to the controller. The list of clients joined to the controller is stored in the MSE as a centralized location, where the controller communicates with MSE and validates the client before reporting if the rogue client is a valid one or not. MSE maintains the MAC addresses of clients joined to the controller. The communication between the controller and MSE is an on-demand service as the controller requests this service from MSE. |
|
Marking and policing actions for ingress SSID and client policies are applied at the access point. The SSID and client ingress policies that you configure in the controller are pushed to the AP. The AP performs policing and marking actions for each packet. However, the controller selects the QoS policies. Marking and policing of egress SSID and client policies are applied at the controller. QoS statistics are collated for client and SSID targets in ingress direction. Statistics are supported only for ingress policies with a maximum of five classes on wireless targets. For very large policies, statistics for ingress policies are not visible at the controller. The frequency of the statistics depends on the number of clients associated with the access point. |
|
Application Visibility and Control (AVC) classifies applications using deep packet inspection techniques with the Network-Based Application Recognition (NBAR2) engine, and provides application-level visibility and control (QoS) in wireless networks. After the applications are recognized, the AVC feature enables you to either drop, mark, or police the data traffic. AVC is configured by defining a class map in a QoS client policy to match a protocol. AVC QoS actions are applied with AVC filters in both upstream and downstream directions. The QoS actions supported for upstream flow are drop, mark, and police, and for downstream flow are mark and police. AVC QoS is applicable only when the application is classified correctly and matched with the class map filter in the policy map. |
|
Supports new hardware for DWDM SFP+ and 10G ZR SFP+ modules. For a list of all supported SFP+ modules, see http://www.cisco.com/c/en/us/td/docs/interfaces_modules/transceiver_modules/compatibility/matrix/OL_6974.html |
|
Support for Syslog traps using the snmp-server enable traps syslog command. After enabling Syslog traps, specify the trap message severity by using the logging snmp-trap command. Use the logging snmp-trap 0 7 command to enable all severity levels (0 to 7). To enable individual trap levels, configure the following commands:
Note that, along with the Syslog traps, the Syslog history should also be applied. Without this configuration, Syslog traps are not sent. Use the logging history informational command to enable the Syslog history. |
|
Support for IPv6 destination server export. For more information, see the Cisco Flexible NetFlow Configuration Guide. Support for NetFlow Data Export Format Version 10 (IPFIX). For more information, see the Cisco Flexible NetFlow Configuration Guide. |
|
You do not have to create a separate WLAN for 802.11r support. You can specify the non-802.11r clients to associate with an SSID that is enabled with 802.11r. |
|
Support for Cisco SFP+ Active Optical Cables - Cisco SFP-10G-AOC1M Cisco SFP-10G-AOC2M Cisco SFP-10G-AOC3M, Cisco SFP-10G-AOC5M, Cisco SFP-10G-AOC7M, Cisco SFP-10G-AOC10. For a list of all supported SFP+ modules, see http://www.cisco.com/c/en/us/td/docs/interfaces_modules/transceiver_modules/compatibility/matrix/OL_6974.html |
Supported Hardware
Catalyst 3850 Switch Models
Network Modules
Table 2 lists the three optional uplink network modules with 1-Gigabit and 10-Gigabit slots. You should only operate the switch with either a network module or a blank module installed.
Four 1-Gigabit small form-factor pleadable (SFP) module slots. Any combination of standard SFP modules are supported. SFP+ modules are not supported. |
|
Catalyst 3650 Switch Models
Stackable 24 10/100/1000 Ethernet downlink ports, four 1-Gigabit SFP (small form-factor pluggable) uplink ports, 250-W power supply |
||
Stackable 48 10/100/1000 Ethernet downlink ports, four 1-Gigabit SFP uplink ports, 250-W power supply |
||
Stackable 24 10/100/1000 PoE+1 downlink ports, four 1-Gigabit SFP uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 PoE+ downlink ports, four 1-Gigabit SFP uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 Full PoE downlink ports, four 1-Gigabit SFP uplink ports, 1025-W power supply |
||
Stackable 24 10/100/1000 Ethernet downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 250-W power supply |
||
Stackable 48 10/100/1000 Ethernet downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 250-W power supply |
||
Stackable 24 10/100/1000 PoE+ downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 PoE+ downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 Full PoE downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 1025-W power supply |
||
Stackable 48 10/100/1000 Full PoE downlink ports, four 10-Gigabit SFP+ uplink ports, 1025-W power supply |
||
Stackable 48 10/100/1000 PoE+ downlink ports, four 10-Gigabit SFP+ uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 Ethernet downlink ports, four 10-Gigabit SFP+ uplink ports, 250-W power supply |
||
Stackable 24 10/100/1000 Ethernet downlink ports, four 1-Gigabit SFP uplink ports, 250-W power supply |
||
Stackable 48 10/100/1000 Ethernet downlink ports, four 1-Gigabit SFP uplink ports, 250-W power supply |
||
Stackable 24 10/100/1000 PoE+ downlink ports, four 1-Gigabit SFP uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 PoE+ downlink ports, four 1-Gigabit SFP uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 Full PoE downlink ports, four 1-Gigabit SFP uplink ports, 1025-W power supply |
||
Stackable 24 10/100/1000 Ethernet downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 250-W power supply |
||
Stackable 48 10/100/1000 Ethernet downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 250-W power supply |
||
Stackable 24 10/100/1000 PoE+ downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 PoE+ downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 Full PoE downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 1025-W power supply |
||
Stackable 48 10/100/1000 Full PoE downlink ports, four 10-Gigabit SFP+ uplink ports, 1025-W power supply |
||
Stackable 48 10/100/1000 PoE+ downlink ports, four 10-Gigabit SFP+ uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 Ethernet downlink ports, four 10-Gigabit SFP+ uplink ports, 250-W power supply |
||
Stackable 24 10/100/1000 Ethernet downlink ports, four 1-Gigabit SFP uplink ports, 250-W power supply |
||
Stackable 48 10/100/1000 Ethernet downlink ports, four 1-Gigabit SFP uplink ports, 250-W power supply |
||
Stackable 24 10/100/1000 PoE+ downlink ports, four 1-Gigabit SFP uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 PoE+ downlink ports, four 1-Gigabit SFP uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 Full PoE downlink ports, four 1-Gigabit SFP uplink ports, 1025-W power supply |
||
Stackable 24 10/100/1000 Ethernet downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 250-W power supply |
||
Stackable 48 10/100/1000 Ethernet downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 250-W power supply |
||
Stackable 24 10/100/1000 PoE+ downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 PoE+ downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 Full PoE downlink ports, two 1-Gigabit SFP and two 10-Gigabit SFP+ uplink ports, 1025-W power supply |
||
Stackable 48 10/100/1000 Full PoE downlink ports, four 10-Gigabit SFP+ uplink ports, 1025-W power supply |
||
Stackable 48 10/100/1000 PoE+ downlink ports, four 10-Gigabit SFP+ uplink ports, 640-W power supply |
||
Stackable 48 10/100/1000 Ethernet downlink ports, four 10-Gigabit SFP+ uplink ports, 250-W power supply |
Optics Modules
Catalyst switches support a wide range of optics. Because the list of supported optics is updated on a regular basis, consult the tables at this URL for the latest (SFP) compatibility information:
http://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html
Cisco Wireless LAN Controller Models
Access Points and Mobility Services Engine
Table 5 lists the supported products of the Catalyst 3650 Switch.
Table 6 lists the specific supported Cisco access points.
Compatibility Matrix
Table 7 lists the software compatibility matrix.
|
2.Because of SHA-2 certificate implementation, MSE 7.6 is not compatible with Cisco IOS XE Release 3.6E. Therefore, we recommend that you upgrade to MSE 8.0. |
For more information on the compatibility of wireless software components across releases, see the Cisco Wireless Solutions Software Compatibility Matrix.
Finding the Software Version and Feature Set
Table 9 shows the mapping of the Cisco IOS XE version number and the Cisco IOS version number.
The package files for the Cisco IOS XE software are stored on the system board flash device (flash:).
You can use the show version privileged EXEC command to see the software version that is running on your switch.
Note Although the show version output always shows the software image running on the switch, the model name shown at the end of this display is the factory configuration and does not change if you upgrade the software license.
You can also use the dir filesystem : privileged EXEC command to see the directory names of other software images that you might have stored in flash memory.
Upgrading the Switch Software
For information about how to upgrade the switch software, see the System Management Configuration Guide, Cisco IOS XE Release 3E (Catalyst 3650 Switches) at the following URL:
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3650/software/release/3e/system_management/configuration_guide/b_sm_3e_3650_cg.html
Important Upgrade Note
After you upgrade to Cisco IOS XE Release 3.6E, the WebAuth success page behavior is different from the behavior seen in Cisco IOS XE Release 3.3.X SE. After a successful authentication on the WebAuth login page, the original requested URL opens in a pop-up window and not on the parent page. Therefore, we recommend that you upgrade the Web Authentication bundle so that the bundle is in the format that is used by the AireOS Wireless LAN Controllers.
To download a sample Web Authentication bundle, follow these steps:
Step 1 Browse to http://software.cisco.com/download/navigator.html.
Step 2 Navigate to Products > Switches > Campus LAN Switches - Access > Cisco Catalyst 3650 Series Switches.
Step 4 Click Wireless Lan Controller Web Authentication Bundle.
Step 5 Choose Release 3.6.0 and click Download.
Step 6 After the download, follow the instructions provided in the Read Me file that is attached in the bundle.
Note In a High Availability scenario, if you download the Web Authentication bundle to the active controller, the bundle cannot be synchronized with the standby controller. Therefore, we recommend that you also manually download the Web Authentication bundle to the standby controller.
Note When you upgrade to Cisco IOS XE Release 3.6.5E the SSH access is lost, because it cannot use the CISCO_IDEVID_SUDI_LEGACY RSA server key. Before upgrade, generate the server key using the crypto key generate rsa command in global configuration mode.
To verify whether the RSA server key is available on your device, run the show crypto key command.
Features
The Catalyst 3650 switch supports three different feature sets:
- LAN Base feature set—Provides basic Layer 2+ features, including access control lists (ACLs) and quality of service (QoS) and up to 4094 VLANs.
- IP Base feature set—Provides Layer 2+ and basic Layer 3 features (enterprise-class intelligent services). These features include access control lists (ACLs), quality of service (QoS), ACLs, QoS, static routing, EIGRP stub routing, IP multicast routing, Routing Information Protocol (RIP), basic IPv6 management, the Open Shortest Path First (OSPF) Protocol, and support for wireless controller functionality.
- IP Services feature set—Provides a richer set of enterprise-class intelligent services and full IPv6 support. It includes IP Base features plus Layer 3 routing (IP unicast routing and IP multicast routing). The IP Services feature set includes protocols such as the Enhanced Interior Gateway Routing Protocol (EIGRP), the Open Shortest Path First (OSPF) Protocol, and support for wireless controller functionality.
Note A separate access point count license is required to use the switch as a wireless controller.
For more information about the features, see the product data sheet at this URL:
http://www.cisco.com/en/US/products/ps13133/products_data_sheets_list.html
Interoperability with Other Client Devices
This section describes the interoperability of this version of the switch software release with other client devices.
Table 11 lists the client types on which the tests were conducted. The clients included laptops, handheld devices, phones, and printers.
Important Notes
- A switch stack containing a mix of Catalyst 3850 and Catalyst 3650 switches is not supported.
- With Cisco Prime Infrastructure 2.1.1, the refresh config and inventory collection tasks from the switch might take anywhere from 20 minutes to 40 minutes. For more information, see CSCum62747 on the Bug Search Tool.
- Sometimes a delay is seen in the handling of ICMP reply packets when the packet timer is set to milliseconds (if the value is under 1 second). This is an expected behavior.
- Although visible in the CLI, the following commands are not supported:
– authorize-lsc-ap (CSCui93659)
- Catalyst 3650 switch supports IEEE 802.3ae standard.
- The following features are not supported in Cisco IOS XE Release 3.6E:
– Mesh, FlexConnect, and OfficeExtend access point deployment
– Wireless Guest Anchor Controller (The Catalyst 3850 switch can be configured as a foreign controller.)
– MVR (Multicast VLAN Registration)
– IPv6 routing - OSPFv3 Authentication
– Port Security on EtherChannel
– 802.1x Configurable username and password for MAB
– Link State Tracking (L2 Trunk Failover)
– Disable Per VLAN MAC Learning
– IEEE 802.1X-2010 with 802.1AE support
– IEEE 802.1AE MACsec (MKA & SAP)
– IPv6 Ready Logo phase II - Host
– OSPFv3 Graceful Restart (RFC 5187)
– Fallback bridging for non-IP traffic between VLANs
– DHCP snooping ASCII circuit ID
– Per VLAN Policy & Per Port Policer
– Ingress/egress Shared Queues
– Trust Boundary Configuration
– Cisco Group Management Protocol (CGMP)
– Performance Monitor (Phase 1)
– AAA: RADIUS over IPv6 transport
– AAA: TACACS over IPv6 Transport
– Auto QoS for Video endpoints
– IPv6 Strict Host Mode Support
– IPv6 Static Route support on LAN Base images
– VACL Logging of access denied
– RFC5460 DHCPv6 Bulk Leasequery
– DHCPv6 Relay Source Configuration
– RFC 4292 IP-FORWARD-MIB (IPv6 only)
– RFC4292/RFC4293 MIBs for IPv6 traffic
– Layer 2 Tunneling Protocol Enhancements
– UniDirectional Link Routing (UDLR)
– Pragmatic General Multicast (PGM)
– PVLAN, DAI, IPSG Interoperability
– Ingress Strict Priority Queuing (Expedite)
– Weighted Random Early Detect (WRED)
– Improvements in QoS policing rates
– Fast SSID support for guest access WLANs
- Be careful when connecting a “snagless” Ethernet cable to port 1 on a 48-port switch. The protective boot of the cable might inadvertently press the Mode button, causing the switch to erase its startup configuration and reboot. (CSCuj17317)
There is no workaround except to avoid connecting a “snagless” Ethernet cable to port 1 on a 48-port switch.
Limitations and Restrictions
Note Device Classifier has been disabled by default starting from Release 3.6.0E. Any features dependent on device classifier should enable it if required.
- You cannot configure NetFlow export using the Ethernet Management port (g0/0).
- The maximum committed information rate (CIR) for voice traffic on a wireless port is 132 Mb/sec.
- VRRPv3 for IPv4 and IPv6 is not supported.
- Restrictions for Cisco TrustSec:
– Cisco TrustSec can be configured only on physical interfaces, not on logical interfaces.
– Cisco TrustSec for IPv6 is not supported.
– Dynamic binding of IP-SGT is not supported for hosts on Layer 3 physical routed interfaces because the IP Device Tracking feature for Layer 3 physical interfaces is not supported.
– Cisco TrustSec cannot be configured on a pure bridging domain with IPSG feature enabled. You must either enable IP routing or disable the IPSG feature in the bridging domain.
– Cisco TrustSec on the switch supports up to 255 security group destination tags for enforcing security group ACLs.
- When a logging discriminator is configured and applied to a device, memory leak is seen under heavy syslog or debug output. The rate of the leak is dependent on the quantity of logs produced. In extreme cases, the device may crash. As a workaround, disable the logging discriminator on the device.
- The WEB UI home page may not load when ip http access class command is enabled. When you encounter this issue, we recommend that you do the following:
a. Run the show iosd liin command.
b. Get the internet-address and configure the same IP as permit in the access-list.
- For WEB UI access using TACACS server, the custom method-list for authentication and authorization pointing to the TACACS server group does not work. You should use the default authorization method-list pointing to the same TACACS server group for the WEB UI to work.
- We recommend that you run the exception dump device second flash command after the install process. This helps to store the crash files into a secondary flash during a crash when there is no available space in the main memory area to store the crash information.
- For routing protocols, when aggressive hello timer is configured, a timely delivery of control packets is not guaranteed. Do not configure timers shorter than 3 seconds for Hello interval and shorter than 9 seconds for Dead interval, across the protocols. If there is a requirement to use aggressive timers of 1 and 3 seconds for Hello and Dead interval respectively, the recommendation is to upgrade to Cisco IOS XE Denali 16.3 release or later.
- We recommend that you configure the access-session interface-template sticky timer timer-value command at the global or interface configuration mode, and not within the template.
- With port-security configured on a port, switch may consume very first few frames that would be required to install newly learned or a re-learned MAC address in to the hardware. Those frames are not forwarded further to the network.
Caveats
- Cisco Bug Search Tool
- Open Caveats
- Resolved Caveats in Cisco IOS XE Release 3.6.10E
- Resolved Caveats in Cisco IOS XE Release 3.6.10E
- Resolved Caveats in Cisco IOS XE Release 3.6.7bE
- Resolved Caveats in Cisco IOS XE Release 3.6.7E
- Resolved Caveats in Cisco IOS XE Release 3.6.6E
- Resolved Caveats in Cisco IOS XE Release 3.6.5E
- Resolved Caveats in Cisco IOS XE Release 3.6.4E
- Resolved Caveats in Cisco IOS XE Release 3.6.3E
- Resolved Caveats in Cisco IOS XE Release 3.6.2aE
- Resolved Caveats in Cisco IOS XE Release 3.6.1E
- Resolved Caveats in Cisco IOS XE Release 3.6.0E
Cisco Bug Search Tool
The Bug Search Tool (BST), which is the online successor to Bug Toolkit, is designed to improve the effectiveness in network risk management and device troubleshooting. The BST allows partners and customers to search for software bugs based on product, release, and keyword, and aggregates key data such as bug details, product, and version. The tool has a provision to filter bugs based on credentials to provide external and internal bug views for the search input.
To view the details of a caveat listed in this document:
1. Access the BST (use your Cisco user ID and password) at https://tools.cisco.com/bugsearch/.
Resolved Caveats in Cisco IOS XE Release 3.6.10E
Resolved Caveats in Cisco IOS XE Release 3.6.9E
Resolved Caveats in Cisco IOS XE Release 3.6.8E
Resolved Caveats in Cisco IOS XE Release 3.6.7E
Resolved Caveats in Cisco IOS XE Release 3.6.6E
Resolved Caveats in Cisco IOS XE Release 3.6.5E
Resolved Caveats in Cisco IOS XE Release 3.6.4E
Resolved Caveats in Cisco IOS XE Release 3.6.3E
Resolved Caveats in Cisco IOS XE Release 3.6.2aE
Resolved Caveats in Cisco IOS XE Release 3.6.1E
Troubleshooting
For the most up-to-date, detailed troubleshooting information, see the Cisco TAC website at this URL:
http://www.cisco.com/en/US/support/index.html
Choose Product Support > Switches. Then choose your product and click Troubleshoot and Alerts to find information for the problem that you are experiencing.
Related Documentation
http://www.cisco.com/c/en/us/support/ios-nx-os-software/ios-xe-3e/tsd-products-support-series-home.html
http://www.cisco.com/go/cat3650_docs
https://www.cisco.com/cgi-bin/Support/Errordecoder/index.cgi
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What’s New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html
Subscribe to the What’s New in Cisco Product Documentation, which lists all new and revised Cisco Technical documentation, as an RSS feed and deliver content directly to your desktop using a read application. The RSS feeds are a free service.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)