Guest

Cisco Catalyst 4500 Series Switches

Release Note for the Catalyst 4500 Series Switch, Cisco IOS Release 12.2(54)SGx and 12.2(53)SGx

  • Viewing Options

  • PDF (3.5 MB)
  • Feedback

Table of Contents

Release Notes for the Catalyst 4500 Series Switch, Cisco IOS Releases 12.2(54)SGx and 12.2(53)SGx

Contents

Cisco IOS Software Packaging for the Cisco Catalyst 4500 Series

Catalyst 4500 Series Switch Cisco IOS Release Strategy

Cisco IOS Software Migration Guide

Summary of Migration Plan

Support

System Requirements

Supported Hardware on Catalyst 4500 Series Switch

Supported Hardware on Catalyst 4500 E-Series Switch

Supported Features on the Catalyst 4500 Series Switch

Features Unique to Supervisor Engines 6-E and 6L-E

Unsupported Features

New and Changed Information

New Hardware Features in Release12.2(54)SG1

New Software Features in Release12.2(54)SG1

New Hardware Features in Release12.2(54)SG

New Software Features in Release12.2(54)SG

New Hardware Features in Release 12.2(53)SG6

New Software Features in Release 12.2(53)SG6

New Hardware Features in Release 12.2(53)SG5

New Software Features in Release 12.2(53)SG5

New Hardware Features in Release 12.2(53)SG4

New Software Features in Release 12.2(53)SG4

New Hardware Features in Release12.2(53)SG3

New Software Features in Release12.2(53)SG3

New Hardware Features in Release12.2(53)SG2

New Software Features in Release12.2(53)SG2

New Hardware Features in Release12.2(53)SG1

New Software Features in Release12.2(53)SG1

New Hardware Features in Release12.2(53)SG

New Software Features in Release12.2(53)SG

New Hardware Features in Release12.2(52)XO

New Software Features in Release12.2(52)XO

New Hardware Features in Release12.2(52)SG

New Software Features in Release12.2(52)SG

New Hardware Features in Release 12.2(50)SG3

New Software Features in Release 12.2(50)SG3

New Hardware Features in Release 12.2(50)SG2

New Software Features in Release 12.2(50)SG2

New Hardware Features in Release12.2(50)SG1

New Software Features in Release12.2(50)SG1

New Hardware Features in Release12.2(50)SG

New Software Features in Release12.2(50)SG

New Hardware Features in Release12.2(46)SG

New Software Features in Release12.2(46)SG

New Hardware Features in Release12.2(44)SG

New Software Features in Release12.2(44)SG

New Hardware Features in Release12.2(40)SG

New Software Features in Release12.2(40)SG

Upgrading the System Software

Identifying an +E Chassis and ROMMON

Guidelines for Upgrading the ROMMON

Upgrading the Supervisor Engine ROMMON from the Console

Upgrading the Supervisor Engine ROMMON Remotely Using Telnet

Upgrading the Cisco IOS Software

Limitations and Restrictions

All Supervisor Engines

For Supervisor Engines II+Plus through V-10GE

For Supervisor Engine 6-E and Supervisor Engine 6L-E

Caveats

Open Caveats for Cisco IOS Release 12.2(54)SG1

Resolved Caveats in Cisco IOS Release 12.2(54)SG1

Open Caveats for Cisco IOS Release 12.2(54)SG

Resolved Caveats in Cisco IOS Release 12.2(54)SG

Open Caveats for Cisco IOS Release 12.2(53)SG11

Resolved Caveats for Cisco IOS Release 12.2(53)SG11

Open Caveats for Cisco IOS Release 12.2(53)SG10

Resolved Caveats in Cisco IOS Release 12.2(53)SG10

Open Caveats for Cisco IOS Release 12.2(53)SG9

Resolved Caveats in Cisco IOS Release 12.2(53)SG9

Open Caveats for Cisco IOS Release 12.2(53)SG8

Resolved Caveats in Cisco IOS Release 12.2(53)SG8

Open Caveats for Cisco IOS Release 12.2(53)SG7

Resolved Caveats in Cisco IOS Release 12.2(53)SG7

Open Caveats for Cisco IOS Release 12.2(53)SG6

Resolved Caveats in Cisco IOS Release 12.2(53)SG6

Open Caveats for Cisco IOS Release 12.2(53)SG5

Resolved Caveats in Cisco IOS Release 12.2(53)SG5

Open Caveats for Cisco IOS Release 12.2(53)SG4

Resolved Caveats in Cisco IOS Release 12.2(53)SG4

Open Caveats for Cisco IOS Release 12.2(53)SG3

Resolved Caveats in Cisco IOS Release 12.2(53)SG3

Open Caveats for Cisco IOS Release 12.2(53)SG2

Resolved Caveats in Cisco IOS Release 12.2(53)SG2

Open Caveats for Cisco IOS Release 12.2(53)SG1

Resolved Caveats in Cisco IOS Release 12.2(53)SG1

Open Caveats for Cisco IOS Release 12.2(53)SG

Resolved Caveats in Cisco IOS Release 12.2(53)SG

Open Caveats for Cisco IOS Release 12.2(52)XO

Resolved Caveats in Cisco IOS Release 12.2(52)XO

Open Caveats for Cisco IOS Release 12.2(52)SG

Resolved Caveats in Cisco IOS Release 12.2(52)SG

Open Caveats for Cisco IOS Release 12.2(50)SG8

Resolved Caveats in Cisco IOS Release 12.2(50)SG8

Open Caveats for Cisco IOS Release 12.2(50)SG7

Resolved Caveats in Cisco IOS Release 12.2(50)SG7

Open Caveats for Cisco IOS Release 12.2(50)SG6

Resolved Caveats in Cisco IOS Release 12.2(50)SG6

Open Caveats for Cisco IOS Release 12.2(50)SG5

Resolved Caveats in Cisco IOS Release 12.2(50)SG5

Open Caveats for Cisco IOS Release 12.2(50)SG4

Resolved Caveats in Cisco IOS Release 12.2(50)SG4

Open Caveats for Cisco IOS Release 12.2(50)SG3

Resolved Caveats in Cisco IOS Release 12.2(50)SG3

Open Caveats for Cisco IOS Release 12.2(50)SG2

Resolved Caveats in Cisco IOS Release 12.2(50)SG2

Open Caveats for Cisco IOS Release 12.2(50)SG1

Resolved Caveats in Cisco IOS Release 12.2(50)SG1

Open Caveats in Cisco IOS Release 12.2(50)SG

Resolved Caveats in Cisco IOS Release 12.2(50)SG

Open Caveats in Cisco IOS Release 12.2(46)SG

Resolved Caveats in Cisco IOS Release 12.2(46)SG

Open Caveats in Cisco IOS Release 12.2(44)SG1

Resolved Caveats in Cisco IOS Release 12.2(44)SG1

Open Caveats in Cisco IOS Release 12.2(44)SG

Resolved Caveats in Cisco IOS Release 12.2(44)SG

Open Caveats in Cisco IOS Release 12.2(40)SG

Resolved Caveats in Cisco IOS Release 12.2(40)SG

Troubleshooting

Netbooting from the ROMMON

Troubleshooting at the System Level

Troubleshooting Modules

Troubleshooting MIBs

Related Documentation

Hardware Documents

Software Documentation

Cisco IOS Documentation

Notices

OpenSSL/Open SSL Project

License Issues

Obtaining Documentation and Submitting a Service Request

Release Notes for the
Catalyst 4500 Series Switch,
Cisco IOS Releases 12.2(54)SGx and 12.2(53)SGx

Current Release
12.2(53)SG11—August 18, 2014

Previous Releases
12.2(54)SG1, 12.2(54)SG, 12.2(53)SG10, 12.2(53)SG9, 12.2(53)SG8, 12.2(53)SG7, 12.2(53)SG6, 12.2(53)SG5, 12.2(53)SG4, 12.2(53)SG3, 12..2(53)SG2, 12.2(53)SG1, 12.2(53)SG, 12.2(52)XO, 12.2(52)SG, 12.2(50)SG8, 12.2(50)SG7, 12.2(50)SG6, 12.2(50)SG5, 12.2(50)SG4, 12.2(50)SG3, 12.2(50)SG2, 12.2(50)SG1, 12.2(50)SG, 12.2(46)SG, 12.2(44)SG1, 12.2(44)SG, 12.2(40)SG

These release notes describe the features, modifications, and caveats for the Cisco IOS software on the Catalyst 4500 series switch. The most current software release is Cisco IOS Release 12.2(54)SG.

Support for Cisco IOS Software Release 12.2(54SG, the default image, follows the standard Cisco Systems® support policy, available at
http://www.cisco.com/en/US/products/products_end-of-life_policy.html


NoteAlthough their Release Notes are unique, the 4 platforms (Catalyst 4500, Catalyst 4900,
Catalyst ME 4900, and Catalyst 4900M/4948E) use the same Software Configuration Guide, Command Reference Guide, and System Message Guide.


For more information on the Catalyst 4500 series switches, visit the following URL:

http://www.cisco.com/go/cat4500/docs

Cisco IOS Software Packaging for the Cisco Catalyst 4500 Series

A new Cisco IOS Software package for Cisco Catalyst 4500 Series Switches was introduced in Cisco IOS Software Release 12.2(25)SG. It is a new foundation for features and functionality and provides consistency across all Cisco Catalyst switches. The new Cisco IOS Software release train is designated as 12.2SG.

Prior Cisco Catalyst 4500 Series IOS Software images for the Cisco Catalyst 4500 Series Switches, formerly known as Basic Layer 3 and Enhanced Layer 3, now map to IP Base and Enterprise Services, respectively. All currently shipping Cisco Catalyst 4500 software features based on Cisco IOS Software are supported in the IP Base image of Release 12.2(54)SG, with a few exceptions.

The IP Base image does not support enhanced routing features such as NSF/SSO, BGP, EIGRP, EIGRPv6, OSPF, OSPFv3, IS-IS, Internetwork Packet Exchange (IPX), AppleTalk, VRF-lite, and Policy-Based Routing (PBR). The IP Base image supports EIGRP-Stub for limited routing on Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, V-10GE, and 6-E.

The Enterprise Services image supports all Cisco Catalyst 4500 Series software features based on Cisco IOS Software, including enhanced routing. Customers planning to enable BGP for Supervisor Engine IV, V, or V-10GE will no longer need to purchase a separate BGP license (FR-IRC4) because BGP is included in the Enterprise Services package. Beginning with 12.2(53)SG2, we support the Enterprise Services image on Supervisor Engine 6L-E.

Cisco IOS Release 12.2(46)SG1 introduced a new LAN Base software and an IP upgrade image. These complement the existing IP Base and Enterprise Services images. The LAN base image is supported on the Supervisor Engine II-Plus-10GE and Supervisor Engine 6L-E starting with
Cisco IOS Release 12.2(52)XO. LAN Base image is primarily focused on customer access and Layer 2 requirements and therefore many of the IP Base features are not required. The IP upgrade image is available if at a later date you require some of those features.

Table 1 contrasts feature support on the LAN Base vs IP Base images.

For information on MiBs support, pls refer to this URL:

http://ftp.cisco.com/pub/mibs/supportlists/cat4000/cat4000-supportlist.html

 

Table 1 LAN Base/IP Base Image Support

Feature
LAN Base
IP Base
Enterprise Services

10G Uplink Use

12.2(46)SG1

Yes

Yes

802.1p prioritization

12.2(46)SG1

Yes

Yes

802.1p/802.1q

12.2(46)SG1

Yes

Yes

802.1w/802.1s

12.2(46)SG1

Yes

Yes

802.1X (w/ Guest VLAN and VLAN Assignment)

12.2(50)SG

Yes

Yes

802.1X and MAB with ACL assignment

12.2(50)SG

Yes

Yes

802.1X (Auth-Fail VLAN, Critical Auth, Accounting)

12.2(50)SG

Yes

Yes

802.1X Wake on LAN

12.2(50)SG

Yes

Yes

802.1X Web-Auth

12.2(50)SG

Yes

Yes

802.1X with Multiple authenticated, multi-host

12.2(50)SG

Yes

Yes

802.1X w/ MDA

12.2(50)SG

Yes

Yes

802.1X w/ Open Access

12.2(50)SG

Yes

Yes

802.3ad LACP

12.2(46)SG1

Yes

Yes

802.3x – Flow Control

12.2(46)SG1

Yes

Yes

ACL Logging

12.2(46)SG1

Yes

Yes

All Mibs

12.2(52)SG

Yes

Yes

Auto QoS

12.2(53)SG

Yes

Yes

Auto SmartPort

12.2(54)SG

Yes

Yes

Auto-MDIX

12.2(46)SG1

Yes

Yes

Auto-Voice VLAN (part of Auto QoS)

No support

Yes

Yes

BOOTP

12.2(46)SG1

Yes

Yes

Bootup GOLD

No support

Yes

Yes

Broadcast Suppression

12.2(46)SG1

Yes

Yes

CDP/CDPv2

12.2(46)SG1

Yes

Yes

Community PVLAN support

No support

Yes

Yes

Config File

12.2(46)SG1

Yes

Yes

Console Access

12.2(46)SG1

Yes

Yes

Control Plane Policing

12.2(46)SG1

Yes

Yes

Copy Command

12.2(46)SG1

Yes

Yes

CoS to DSCP Map

Yes

Yes

Yes

Debug Commands

12.2(46)SG1

Yes

Yes

Device Management

12.2(46)SG1

Yes

Yes

DHCP Server

12.2(46)SG1

Yes

Yes

DHCP Snooping

12.2(46)SG1

Yes

Yes

Diagnostics Tools

12.2(46)SG1

Yes

Yes

Downloading Software

12.2(46)SG1

Yes

Yes

DSCP to CoS Map

12.2(46)SG1

Yes

Yes

DSCP to egress queue mapping

12.2(46)SG1

Yes

Yes

Dynamic ARP inspection

12.2(46)SG1

Yes

Yes

EEM and EOT integration

No support

Yes

Yes

EIGRP Stub

No support

Yes

Yes

EnergyWise 1.0

12.2(53)SG

Yes

Yes

EPoE

12.2(53)SG

Yes

Yes

Ethernet Management Port (Fa1 interface)

12.(2(46)SG

Yes

Yes

Event Log

12.2(46)SG1

Yes

Yes

Factory Default Settings

12.2(46)SG1

Yes

Yes

File Management

12.2(46)SG1

Yes

Yes

Flex Link

12.2(53)SG

Yes

Yes

GLBP

No support

Yes

Yes

HSRP v1/VRRP

No support

Yes

Yes

HSRP v2 IPV4

No support

Yes

Yes

HSRP v2 IPV6

No support

No

Yes

ID 4.0 Voice Vlan assignment

12.2(46)SG1

Yes

Yes

ID4.1 Filter ID and per use ACL

12.2(46)SG1

Yes

Yes

IGMP

12.2(46)SG1

Yes

Yes

IGMP Snooping

12.2(46)SG1

Yes

Yes

Ingress Policing

12.2(46)SG1

Yes

Yes

Interface Access (Telnet, Console/Serial, Web)

12.2(46)SG1

Yes

Yes

IP Source Guard

12.2(46)SG1

Yes

Yes

IP Multicast

No support

Yes

Yes

IPv6 HSRP

No support

No

Yes

IPv6 MLD snooping V1 and V2

Future

Yes

Yes

IPv6 Reformation

NA

Yes

Yes

IPv6 Router Advertisement (RA) Guard

12.2(54)SG

Yes

Yes

ISL Trunk

12.2(46)SG1

Yes

Yes

ISSU

No support

Yes

Yes

Jumbo Frames

12.2(46)SG1

Yes

Yes

Layer 2 Debug

12.2(46)SG1

Yes

Yes

Layer 2 PT and QinQ

No support

Yes

Yes

Layer 2 Traceroute

12.2(46)SG1

Yes

Yes

Link State Tracking

12.2(54)SG

Yes

Yes

LLDP/LLDP-MED

12.2(52)SG

Yes

Yes

LLDP enhancements (PoE+Layer 2 COS)

12.2(54)SG

No

Yes

Local Web Auth

12.2(52)SG

Yes

Yes

MAB (MAC Authentication Bypass)

12.2(50)SG

Yes

Yes

MAC Address Filtering

12.2(50)SG

Yes

Yes

MAC Based Access List

12.2(50)SG

Yes

Yes

Management IPV6 port

12.2(52)SG

Yes

Yes

MLD Snooping

12.2(53)SG

Yes

Yes

Multicast Filtering

12.2(46)SG1

Yes

Yes

Multihop SXP (CTS)

No support

12.2(52SG

Yes

Network Edge Access Topology (NEAT)

No support

Yes

Yes

No. of QoS Filters

No. of Security ACE

Yes (4K entries)

Yes

Yes

No. of VLAN Support

2048

4096

Yes

OSPF for Routed Access

No support

Yes

Yes

PAgP

12.2(46)SG1

Yes

Yes

Passwords
Password clear protection

12.2(46)SG1

Yes

Yes

PIM SM/DM

No support

Yes

Yes

PoE (up to 15.4W only)

12.2(46)SG1

Yes

Yes

PoE+ Ready

Yes

Yes

Yes

Port Monitoring (interface Stats)

12.2(46)SG1

Yes

Yes

Port Security

12.2(46)SG1

Yes; only 1024 MACs

Yes

Post Status

12.2(46)SG1

Yes

Yes

PVST+

12.2(53)SG

Yes

Yes

Q-in-Q

No support

Yes

Yes

RACL (DSCP based)

12.2(46)SG1

Yes

Yes

RADIUS/TACACS+ (AAA)

12.2(46)SG1

Yes

Yes

RMON

12.2(46)SG1

Yes

Yes

Routing, Static

12.2(46)SG1

Yes

Yes

RIP

No

Yes

Yes

RPR

12.2(46)SG1

Yes

Yes

RPVST+

12.2(53)SG

Yes

Yes

RSPAN

12.2(46)SG1

Yes

Yes

Service Advertisement Framework (SAF)

No support

No

Yes

Smart Call Home

No support

Yes

Yes

SmartPorts (Role based MACRO)

12/2(53)SG

Yes

Yes

SNMP (including SNMv3)

12.2(46)SG1

Yes

Yes

Source port Filtering (Private VLAN)

12.2(46)SG1

Yes

Yes

SPAN (# of sessions) – Port Mirroring

12.2(46)SG1 (2 sessions)

Yes (8 bidirectional sessions)

Yes

SSHv2/Secure Copy, FTP, SSL, Syslog, Sys Information

12.2(46)SG1

Yes

Yes

Storm Control

12.2(46)SG1

Yes

Yes

TDR

No support

Yes

Yes

Time Protocols (SNTP, TimeP)

12.2(46)SG1

Yes

Yes

Time Protocols (SNTP, TimeP) master

12.2(52)SG

Yes

Yes

Time-based ACL

12.2(46)SG1

Yes

Yes

Traffic Mirroring (SPAN)

12.2(46)SG1

Yes

Yes

Trusted Boundary (LLDP & CDP Based)

12.2(46)SG1

Yes

Yes

UDLD

12.2(46)SG1

Yes

Yes

VACL and PACL

12.2(46)SG1

Yes

Yes

VLAN Mapping (VLAN Translation)

12.2(54)SG

Yes

Yes

Voice VLAN

12.2(46)SG1

Yes

Yes

VRRP

No support

Yes

Yes

VTP

12.2(46)SG1

Yes

Yes

WCCP

No support

Yes

Yes

XML-PI

12.2(54)SG

Yes

Yes

Orderable Product Numbers:

  • S49LB-12254SG(=)—Cisco IOS Software for Cisco Catalyst 4500 Series Switch (LAN Base image)
  • S49LBK9-12254SG(=)—Cisco IOS Software for Cisco Catalyst 4500 Series Switch (LAN Base image with Triple Data Encryption)
  • S49IPB-12254SG(=)—Cisco IOS Software for Cisco Catalyst 4500 Series Switch (IP Base image)
  • S49IPBK9-12254SG(=)—Cisco IOS Software for Cisco Catalyst 4500 Series Switch (IP Base image with Triple Data Encryption)
  • S49ES-12254SG(=)— Cisco IOS Software for Cisco Catalyst 4500 Series Switch (Enterprise Services image with BGP support)
  • S49ESK9-12254SG(=)—Cisco IOS Software for Cisco Catalyst 4500 Series Switch (Enterprise Services image with 3DES and BGP support)
  • S45ES-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engines IV, V, and V-10GE (Enterprise Services image with Border Gateway Protocol [BGP] support, without Crypto)
  • S45IPBK9-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, and V-10GE (IP Base image with Triple Data Encryption Standard [3DES])
  • S45IPB-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, and V-10GE (IP Base image without Crypto)
  • S45ESK9-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engines IV, V, and V-10GE (Enterprise Services image with 3DES and BGP support)
  • S45LB-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engine II-Plus-10GE (LAN Base image)
  • S45LBK9-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engine II-Plus-10GE (LAN Base image with 3DES)
  • S45IPBU-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engine II-Plus-10GE (IP Base Upgrade image)
  • S45IPBUK9-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engine II-Plus-10GE (IP Base Upgrade image with 3DES)
  • S45EES-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engine 6-E (Enterprise Services image)
  • S45EESK9-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engine 6-E (Enterprise Services image with 3DES)
  • S45EIPB-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Supervisor Engine 6-E and 6L-E (IP Base image)
  • S45EIPBK9-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engine 6-E and 6L-E (IP Base image with 3DES)
  • S45ELB-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engine 6L-E (LAN Base image)
  • S45ELBK9-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engine 6L-E (LAN Base image with 3DES)
  • S45EIPBU-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engine 6L-E (IP Base Upgrade image)
  • S45EIPBUK9-12253SG - Cisco IOS Software for the Cisco Catalyst 4500 Series Supervisor Engine 6L-E (IP Base Upgrade image with 3DES)
  • S45ELB-12252X0 - Cisco IOS software for the Catalyst 4500 Sup 6L-E (LAN Base, without crypto
  • S45ELBK9- 12252X0 Cisco IOS software for the Catalyst 4500 Sup 6L-E (LAN Base image with Triple Data Encryption Standard(3DES))
  • S45EIPB-12252X0 Cisco IOS software for the Catalyst 4500 Sup 6L-E (IP Base image without Crypto)
  • S45EIPBK9-12252X0 Cisco IOS software for the Catalyst 4500 Sup 6L-E (IP Base image with Triple Data Encryption Standard(3DES))
  • S45EIPBU-12252X0 Cisco IOS software for the Catalyst 4500 Sup 6L-E (IP upgrade image without Crypto)
  • S45EIPBUK9-12252X0 Cisco IOS software for the Catalyst 4500 Sup 6L-E (IP upgrade image with Triple Data Encryption Standard(3DES))
  • S45IPB-12252SG-Cisco IOS software for the Catalyst 4500 Series Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, and V-10GE (IP Base image, without Crypto) (cat4500-ipbase-mz)
  • S45IPBK9-12252SG-Cisco IOS software for the Catalyst 4500 Series Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, and V-10GE (IP Base image with Triple Data Encryption Standard (3DES)) (cat4500-ipbasek9-mz)
  • S45ES-12252SG-Cisco IOS software for the Catalyst 4500 Series Supervisor Engines IV, V, and V-10GE (Enterprise Services image with BGP support, without Crypto) (cat4500-entservices-mz)
  • S45ESK9-12252SG-Cisco IOS software for the Catalyst 4500 Series Supervisor Engines IV, V, and V-10GE (Enterprise Services image with 3DES and BGP support) (cat4500-entservicesk9-mz)
  • S45EIPB-12252SG-Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (IP Base Image)
  • S45EIPBK9-12252SG-Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (IP Base Image with 3DES) (cat4500-ipbasek9-mz)
  • S45EES-12252SG-Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (Enterprise Services image) (cat4500-ipbasek9-mz)
  • S45EESK9-12252SG-Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (Enterprise Services image) (cat4500-ipbasek9-mz)
  • S45IPB-12250SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, and V-10GE (IP Base image, without Crypto) (cat4500-ipbase-mz)
  • S45IPBK9-12250SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, and V-10GE (IP Base image with Triple Data Encryption Standard (3DES)) (cat4500-ipbasek9-mz)
  • S45ES-12250SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines IV, V, and V-10GE (Enterprise Services image with BGP support, without Crypto) (cat4500-entservices-mz)
  • S45ESK9-12250SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines IV, V, and V-10GE (Enterprise Services image with 3DES and BGP support) (cat4500-entservicesk9-mz)
  • S45EIPB-12250SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (IP Base Image)
  • S45EIPBK9-12250SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (IP Base Image with 3DES) (cat4500-ipbasek9-mz)
  • S45EES-12250SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (Enterprise Services image) (cat4500-ipbasek9-mz)
  • S45EESK9-12250SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (Enterprise Services image) (cat4500-ipbasek9-mz)
  • S45IPB-12246SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, and V-10GE (IP Base image, without Crypto) (cat4500-ipbase-mz)
  • S45IPBK9-12246SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, and V-10GE (IP Base image with Triple Data Encryption Standard (3DES)) (cat4500-ipbasek9-mz)
  • S45ES-12246SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines IV, V, and V-10GE (Enterprise Services image with BGP support, without Crypto) (cat4500-entservices-mz)
  • S45ESK9-12246SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines IV, V, and V-10GE (Enterprise Services image with 3DES and BGP support) (cat4500-entservicesk9-mz)
  • S45EIPB-12246SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (IP Base Image)
  • S45IPBK9-12246SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (IP Base Image with 3DES) (cat4500-ipbasek9-mz)
  • S45EES-12246SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (Enterprise Services image) (cat4500-ipbasek9-mz)
  • S45EESK9-12246SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (Enterprise Services image) (cat4500-ipbasek9-mz)
  • S45IPB-12244SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, and V-10GE (IP Base image, without Crypto) (cat4500-ipbase-mz)
  • S45IPBK9-12244SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, and V-10GE (IP Base image with Triple Data Encryption Standard (3DES)) (cat4500-ipbasek9-mz)
  • S45ES-12244SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines IV, V, and V-10GE (Enterprise Services image with BGP support, without Crypto) (cat4500-entservices-mz)
  • S45ESK9-12244SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines IV, V, and V-10GE (Enterprise Services image with 3DES and BGP support) (cat4500-entservicesk9-mz)
  • S45EIPB-12244SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (IP Base Image)
  • S45IPBK9-12244SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (IP Base Image with 3DES) (cat4500-ipbasek9-mz)
  • S45EES-12244SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (Enterprise Services image) (cat4500-ipbasek9-mz)
  • S45EESK9-12244SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (Enterprise Services image) (cat4500-ipbasek9-mz)
  • S45IPB-12240SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, and V-10GE (IP Base image, without Crypto) (cat4500-ipbase-mz)
  • S45IPBK9-12240SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, and V-10GE (IP Base image with Triple Data Encryption Standard (3DES)) (cat4500-ipbasek9-mz)
  • S45ES-12240SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines IV, V, and V-10GE (Enterprise Services image with BGP support, without Crypto) (cat4500-entservices-mz)
  • S45ESK9-12240SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engines IV, V, and V-10GE (Enterprise Services image with 3DES and BGP support) (cat4500-entservicesk9-mz)
  • S45EIPB-12240SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (IP Base Image)
  • S45IPBK9-12240SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (IP Base Image with 3DES) (cat4500-ipbasek9-mz)
  • S45EES-12240SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (Enterprise Services image) (cat4500e-entservices-mz)
  • S45EESK9-12240SG—Cisco IOS software for the Catalyst 4500 Series Supervisor Engine 6-E (Enterprise Services with 3DES image) (cat4500-entservicesk9-mz)

Catalyst 4500 Series Switch Cisco IOS Release Strategy

Cisco IOS Release 12.2SG train offers the latest features for the Catalyst 4500 Series supervisor engines. Customers with Catalyst 4500 Series supervisor engines who need the latest hardware support and software features should migrate to Cisco IOS Release 12.2(54)SG.


NoteAs part of the Cisco IOS Reformation effort, Cisco IOS Releases 12.2EW and 12.2SG are the same release train with a name change.


Catalyst 4500 Series has three maintenance trains. The Cisco IOS Release 12.2(31)SGA train is the longest living train. Currently, the Cisco IOS Release 12.2(31)SGA8 is the recommended release for customers who require a release with a maintenance train.The Cisco IOS Release 12.2(53)SG is the latest maintenance train and includes the most recent features including support for the WS-X45-Sup6L-E supervisor engine and OSPF for routed Access.

For more information on the Catalyst 4500 series switches, visit the following URL:

http://www.cisco.com/go/cat4500/docs

Cisco IOS Software Migration Guide

Figure 1 displays the two active, 12.2(31)SGA and 12.2(50)SG, and newly introduced 12.2(53)SG extended maintenance trains.

Figure 1 Software Release Strategy for the Catalyst 4500 Series Switch

 

Summary of Migration Plan

  • Customers requiring the latest Cisco Catalyst 4500 Series hardware and software features should migrate to Cisco IOS Software Release 12.2(54)SG.
  • Cisco IOS Software Release 12.2(31)SGA and 12.2(50)SG will continue offering maintenance releases. The latest release from the 12.2(31)SGA maintenance train is 12.2(31)SGA10. The latest release from the 12.2(50)SG maintenance train is 12.2(50)SG4

Support

Support for Cisco IOS Software Release 12.2(54)SG follows the standard Cisco Systems® support policy, available at
http://www.cisco.com/en/US/products/products_end-of-life_policy.html

System Requirements

This section describes the system requirements:

Supported Hardware on Catalyst 4500 Series Switch

Table 2 lists the hardware supported on the Catalyst 4500 Series Switch.

 

Table 2 Supported Hardware

Product Number (append with “=” for spares)
Product Description
Software Release
Minimum
Supervisor Engines

WS-X4013+=

Catalyst 4500 series switch Supervisor Engine II-Plus

Note This engine is supported only on 3, 6, and 7 slot chassis (not on 10-slot chassis).

12.1(19)EW

WS-X4013+TS

Catalyst 4500 series switch Supervisor Engine II-Plus-TS

Note This engine is supported only on 3 slot chassis.

12.2(20)EWA

WS-X4013+10GE

Catalyst 4500 series switch Supervisor Engine II-Plus-10GE

Note This engine is supported only on 3, 6, and 7 slot chassis (not on 10-slot chassis).

12.2(25)SG

WS-X4515=

Catalyst 4500 series switch Supervisor Engine IV

12.1(12c)EW

WS-X4515/2=

Catalyst 4507R series switch Redundant Supervisor Engine IV

12.1(12c)EW

WS-X4516=

Catalyst 4500 series switch Supervisor Engine V

12.2(18)EW

WS-X4516/2=

Catalyst 4507R series switch Redundant Supervisor Engine V

12.2(18)EW

WS-X4516-10GE=

Catalyst 4500 series switch Supervisor Engine V-10GE

12.2(25)EW

WS-X45-Sup6-E

Catalyst 4500 E-series switch Supervisor Engine 6-E

Note This engine is supported on legacy and E-series chassis.

12.2(40)SG

WS-X45-Sup6L-E

Catalyst 4500 E-series switch Supervisor Engine 6L-E

Note This engine is supported on legacy and E-series 3,6, and 7 slot chassis.

12.2(52)XO

Gigabit Ethernet Switching Modules

WS-X4302-GB

2-port 1000BASE-X (GBIC) Gigabit Ethernet module

12.1(19)EW

WS-X4306-GB

6-port 1000BASE-X (GBIC) Gigabit Ethernet switching module

12.1(8a)EW

WS-X4418-GB

18-port 1000BASE-X (GBIC) Gigabit Ethernet server switching module

12.1(8a)EW

WS-X4412-2GB-T

12-port 1000BASE-T Gigabit Ethernet and 2-GBIC ports switching module

12.1(8a)EW

WS-X4424-GB-RJ45

24-port 10/100/1000BASE-T Gigabit Ethernet RJ-45 switching module

12.1(8a)EW

WS-X4448-GB-LX

48-port 1000BASE-LX (small form-factor pluggable) Gigabit Ethernet fiber optic interface switching module

12.1(8a)EW

WS-X4448-GB-RJ45

48-port 10/100/1000BASE-T Gigabit Ethernet switching module

12.1(8a)EW

WS-X4448-GB-SFP

48-port 1000BASE-X (small form-factor pluggable) module

12.2(20)EW

WS-X4506-GB-T

6-port Alternately-Wired 10/100/1000BASE-T Catalyst 4500 series Power over Ethernet (PoE) 802.3af or 1000BASE-X SFP

12.2(20)EWA

WS-X4524-GB-RJ45V

24-port 10/100/1000BASE-T RJ-45 Catalyst 4500 series PoE 802.3af

12.2(18)EW

WS-X4548-GB-RJ45

48-port 10/100/1000BASE-T Gigabit Ethernet module

12.1(19)EW

WS-X4548-GB-RJ45V

48-port 10/100/1000BASE-T RJ-45 Catalyst 4500 series PoE 802.3af

12.2(18)EW

WS-X4548-RJ45V+

48-port 10/100/1000 Premium PoE line card

12.2(50)SG

WS-X4624-SFP-E

Non-blocking 24-port 1000BASEX (small form factor pluggable) module

12.2(44)SG

WS-X4648-RJ45V-E

48 port 10/100/1000 Mb with 2 to 1 oversubscription

12.2(40)SG

WS-X4648-RJ45V+E

48 port 10/100/1000 Mb with 2 to 1 oversubscription

12.2(40)SG

Fast Ethernet Switching Modules

WS-X4124-FX-MT

24-port 100BASE-FX Fast Ethernet MT-RJ multimode fiber switching module

12.1(8a)EW

WS-X4148-FX-MT

48-port 100BASE-FX Fast Ethernet MT-RJ multimode fiber switching module

12.1(8a)EW

WS-X4148-FE-LX-MT

48-port 100BASE-LX10 Fast Ethernet MT-RJ single-mode fiber switching module

12.1(13)EW

WS-X4148-FE-BD-LC

48-port 100BASE-BX10-D module

12.2(18)EW

WS-X4248-FE-SFP

48-port 100BASE-X SFP switching module

12.2(25)SG

WS-U4504-FX-MT

4-port 100BASE-FX (MT-RF) uplink daughter card

12.1(8a)EW

Ethernet/Fast Ethernet (10/100) Switching Modules

WS-X4124-RJ45

24-port 10/100 RJ-45 module

12.2(20)EW

WS-X4148-RJ

48-port 10/100 RJ-45 switching module

12.1(8a)EW

WS-X4148-RJ21

48-port 10/100 4xRJ-21 (telco connector) switching module

12.1(8a)EW

WS-X4148-RJ45V

48-port Pre-standard PoE 10/100BASE-T switching module

12.1(8a)EW for data support

12.1(11b)EW for data and inline power support

WS-X4224-RJ45V

24-port 10/100BASE-TX RJ-45 Cisco Catalyst 4500 series PoE 802.3af

12.2(20)EW

WS-X4232-GB-RJ

32-port 10/100 Fast Ethernet RJ-45, plus 2-port 1000BASE-X (GBIC) Gigabit Ethernet switching module

12.1(8a)EW

WS-X4248-RJ45V

48-port 10/100BASE-T RJ-45 Cisco Catalyst 4500 series PoE 802.3af

12.2(18)EW

WS-X4248-RJ21V

48-port 10/100 Fast Ethernet RJ-21 Cisco Catalyst 4500 series PoE 802.3af telco

12.2(18)EW

WS-X4232-RJ-XX

32-port 10/100 Fast Ethernet RJ-45 modular uplink switching module

12.1(8a)EW

Other Modules

MEM-C4K-FLD64M

Catalyst 4500 series switch CompactFlash, 64 MB Option

12.1(8a)EW

MEM-C4K-FLD128M

Catalyst 4500 series switch CompactFlash, 128 MB Option

12.1(8a)EW

WS-F4531

Catalyst 4500 series switch NetFlow Services Card on Catalyst 4500 series switch Supervisor Engines IV and V

12.1(13)EW

WS-X4590=

Catalyst 4500 series switch Fabric Redundancy Modules

12.2(18)EW

PWR-C45-1000AC

Catalyst 4500 series switch 1000 Watt AC power supply for chassis 4503, 4506, and 4507R (data only)

12.1(12c)EW

PWR-C45-1400DC

Catalyst 4500 series switch 1400 Watt DC triple input power supply (data-only)

12.2(25)EW

PWR-C45-1400DC-P

Catalyst 4500 series switch 1400 Watt DC power supply with integrated PEM

12.1(19)EW

PWR-C45-1400AC

Catalyst 4500 series switch 1400 Watt AC power supply (data-only)

12.1(12c)EW

PWR-C45-1300ACV

Catalyst 4500 series switch 1300 Watt AC power supply with integrated voice for chassis 4503, 4506, and 4507R

12.1(12c)EW

PWR-C45-2800ACV

Catalyst 4500 series switch 2800 Watt AC power supply with integrated voice (data and PoE) for chassis 4503, 4506, and 4507R

12.1(12c)EW

PWR-C45-4200ACV

Catalyst 4500 series switch 4200 Watt AC dual input power supply with integrated voice (data and PoE)

12.2(25)EWA5

WS-P4502-1PSU

Catalyst 4500 series switch auxiliary power shelf (25-slot), including one PWR-4502

12.1(19)EW

PWR-4502

Catalyst 4500 series switch auxiliary power shelf redundant power supply

12.1(19)EW

PWR-C45-6000ACV

Catalyst 4500 Series Switch 6000 W AC power supply

12.2(53)SG

For Catalyst 4500 transciever module compatibility information, see the url:

http://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html

Table 3 briefly describes the four chassis in the Catalyst 4500 Series Switch. For the chassis listed in the table, refer to Table 6 for software release information.

 

Table 3 Chassis Description for the Catalyst 4500 Series Switch

Product Number (append with “=” for spares)
Description of Modular Chassis

WS-C4503

Catalyst 4503 chassis includes these components:

  • 3 slots
  • Fan tray
  • Supports Supervisor Engine 6L-E, Supervisor Engine 6-E, Supervisor Engine V-10GE, Supervisor Engine V, Supervisor Engine IV, Supervisor Engine III, Supervisor Engine II-Plus-10GE, Supervisor Engine II-Plus-TS, Supervisor Engine II-Plus, and Supervisor Engine II

WS-C4506

Catalyst 4506 chassis includes these components:

  • 6 slots
  • Fan tray
  • Supports Supervisor Engine 6L-E, Supervisor Engine 6-E, Supervisor Engine V-10GE, Supervisor Engine V, Supervisor Engine IV, Supervisor Engine III, Supervisor Engine II-Plus-10GE, Supervisor Engine II-Plus, and Supervisor Engine II

WS-C4507R

Catalyst 4507R chassis includes these components:

  • 7 slots
  • Fan tray
  • Supports Supervisor Engine 6L-E, Supervisor Engine 6-E, Supervisor Engine V-10GE, Supervisor Engine V, Supervisor Engine IV, Supervisor Engine II-Plus-10GE, and Supervisor Engine II-Plus

WS-C4510R

Catalyst 4510R chassis includes these components:

  • 10 slots; slot 10 accepts only the Catalyst 4500 series 2-port Gigabit Ethernet line card (WS-X4302-GB with Supervisor Engine V)

Note The Supervisor Engine V-10GE does not have this restriction.

  • Fan tray
  • Supports Supervisor Engine 6-E, Supervisor Engine V-10GE and Supervisor Engine V

 

Table 4 DOM Support on the Catalyst 4500 Series Switch

Transceiver Module
Support in Software Since...

CWDM- SFP-xx

12.2(20)EWA

DWDM-GBIC-xx

12.1(19)EW

DWDM-SFP

12.2(37)SG

DWDM-X2-xx

12.2(50)SG

GLC-BX-D

12.2(20)EWA

GLC-BX-U

12.2(20)EWA

SFP-10G-SR

12.2(54)SG

SFP-10G-LR

12.2(54)SG

SFP-10G-LRM

12.2(54)SG

Supported Hardware on Catalyst 4500 E-Series Switch

In addition to the classic line cards and supervisor engines, Cisco IOS Software Release 12.2(54)SG supports the next-generation high-performance E-Series Supervisor Engine 6-E with CenterFlex technology and E-Series line cards and chassis. A brief list of primary E-Series hardware supported on Catalyst 4500 series switch ( Table 5 ).

 

Table 5 Supported E-Series Hardware

Product Number
Description

WS-C4503-E

Cisco Catalyst 4500 E-Series 3-Slot Chassis

  • Fan tray
  • No Power Supply

WS-C4506-E

Cisco Catalyst 4500 E-Series 6-Slot Chassis

  • Fan tray
  • No Power Supply

WS-C4507R-E

Cisco Catalyst 4500 E-Series 7-Slot Chassis

  • Fan tray
  • No Power Supply
  • Redundant supervisor engine capability

WS-C4507R+E

Cisco Catalyst 4500 E-Series 7-Slot 48 GB-ready Chassis

  • Fan tray
  • No Power Supply
  • Redundant supervisor engine capability

WS-C4510R-E

Cisco Catalyst 4500 E-Series 10-Slot Chassis

  • Fan tray
  • No Power Supply
  • Redundant supervisor engine capability
  • All port card slots support 6, 24, and 48Gbps when used with Supervisor Engine 7-E. Slots 8, 9, and 10 are limited to 6Gbps when used with a Supervisor Engine 6-E.

WS-C4510R+E

Cisco Catalyst 4500 E-Series 10-Slot 48 GB-ready Chassis

  • Fan tray
  • No Power Supply
  • Redundant supervisor engine capability
  • You cannot place a linecard with a backplane traffic capacity exceeding 6Gbps in slots 8, 9 and 10 of a Catalyst 4510R+E chassis when used with a Supervisor Engine 6-E.

WS-X45-Sup6-E

Cisco Catalyst 4500 E-Series Sup 6-E, 2x10GE(X2) w/ TwinGig

WS-X45-Sup6L-E

Cisco Catalyst 4500 E-Series Sup 6L-E

WS-X4624-SFP-E

Cisco Catalyst 4500 E-series 24-Port 1000BaseX (small form factor pluggable) module

WS-X4648-RJ45V-E

Cisco Catalyst 4500 E-Series 48-Port PoE 802.3af 10/100/1000(RJ45)

WS-X4648-RJ45V+E

Cisco Catalyst 4500 E-Series 48-Port Premium PoE 10/100/1000

WS-X4606-X2-E

Cisco Catalyst 4500 E-Series 6-Port 10GbE (X2) w/ TwinGig

WS-X4648-RJ45-E

Cisco Catalyst 4500 E-Series 48-Port 10/100/1000(RJ45)

Table 6 outlines the chassis and supervisor engine compatibility.
(M=Minimum release, R=Recommended release)

 

Table 6 Chassis and Supervisor Compatiblity

Chassis
Sup II+
Sup II+TS
Sup II+10G
Sup IV
Sup V
Sup V-10GE
Sup 6-E
Sup 6L-E

WS-C4503-E

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M:
12.2(40)SG

R:
12.2(44)SG

M:
12.2(52)XO

R:
12.2(52)XO

WS-C4506-E

M: 12.2(31)SGA6

R: 12.2(31)SGA8

 

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M:
12.2(40)SG

R:
12.2(44)SG

M:
12.2(52)XO

R:
12.2(52)XO

WS-C4507R-E

M: 12.2(31)SGA6

R: 12.2(31)SGA8

 

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M:
12.2(40)SG

R:
12.2(44)SG

M:
12.2(52)XO

R:
12.2(52)XO

WS-C4507R+E

M: 12.2(54)SG

R:
12.2(54)SG

 

M: 12.2(54)SG

R:
12.2(54)SG

M: 12.2(54)SG

R:
12.2(54)SG

M:
12.2(54)SG

R:
12.2(54)SG

M:
12.2(54)SG

R:
12.2(54)SG

M: 12.2(54)SG

R:
12.2(54)SG

M: 12.2(54)SG

R:
12.2(54)SG

WS-C4510R-E

 

 

 

 

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M: 12.2(31)SGA6

R: 12.2(31)SGA8

M:
12.2(40)SG

R:
12.2(44)SG

 

WS-C4510R+E

 

 

 

 

M:
12.2(54)SG

R:
12.2(54)SG

M:
12.2(54)SG

R:
12.2(54)SG

M: 12.2(54)SG

R:
12.2(54)SG

 

Supported Features on the Catalyst 4500 Series Switch

Table 7 lists the Cisco IOS software features for the Catalyst 4500 Series Switch.

 

Table 7 Cisco IOS Software Feature Set for the Catalyst 4500 Series and E-Series Switch

Layer 2 Switching Features

Storm Control

Storm Control: Per-Port Multicast Suppression (Sup 6-E only)

Multicast Storm Control1

IP Source Guard

IP Source Guard for Static Hosts

PVRST+

Layer 2 protocol tunneling

Layer 2 transparent bridging2

Layer 2 MAC3 learning, aging, and switching by software

Unicast MAC address filtering

VMPS4 Client

Layer 2 hardware forwarding up to 102 Mpps

Layer 2 Control Policing (Sup 6-E and Sup 6L-E only)

Layer 2 switch ports and VLAN trunks

Spanning-Tree Protocol (IEEE 802.1D) per VLAN

802.1s and 802.1w

Layer 2 traceroute

Unidirectional Ethernet port

Per-VLAN spanning tree (PVST) and PVST+

Spanning-tree root guard

Spanning-tree Loop guard and PortFast BPDU Filtering

Support for 9216 byte frames

Port security on PVLANs

Private VLANs

Private VLAN DHCP snooping

Private VLAN promiscuous trunk

Private VLAN trunks5

Community PVLANs

ISL6-based VLAN encapsulation (excluding blocking ports on WS-X4418-GB and WS-X4412-2GB-T)7

IEEE 802.1Q-based VLAN encapsulation

Multiple VLAN access port

VLAN Trunking Protocol (VTP) and VTP domains

VTP v3

No. of VLAN support per switch: 2048 (for LAN Base), 4096 (for IP Base)

Unidirectional link detection (UDLD) and aggressive UDLD

Sub-second UDLD (Fast UDLD)

SNMP V3 support for Bridge-MIB with VLAN indexing

Resilient Ethernet Protocol

Ethernet CFM

Ethernet OAM Protocol

Layer 3 Routing, Switching, and Forwarding

802.1Q Tunneling (Q in Q)8

Pragmatic General Multicast

ANCP Client9

PIM-SSM mapping

Bidiectional PIM10

Auto RP Listener

IP and IP multicast routing and switching between Ethernet ports

IP Multicast Load Splitting (Equal Cost Multipath (ECMP) using S, G and Next-hop)

Static IP routing

Classless routing11

PBR12

Dynamic Buffer Limiting

Selective Dynamic Buffer Limiting

QoS-based forwarding based on IP precedence

Trusted boundary

Cisco Modular QoS Command-Line Interface (Sup 6-E and Sup 6L-E only)

Auto QoS

Match CoS for non-IPV4 traffic

IPv6 Forwarding in Hardware (Sup 6-E and Sup 6L-E only)

CoS Mutation

CEF13 load balancing

uRPF14 (Sup 6-E and Sup 6L-E only)

Hardware-based IP CEF routing at 48 Mpps

Up to 128,000 IP routes

Up to 32,000 IP host entries (Layer 3 adjacencies)

Up to 16,000 IP multicast route entries

Multicast flooding suppression for STP changes

Software routing of IPX, AppleTalk, and IPv6.

IGMPv1, IGMPv2, and IGMPv3 (Full Support)

IGMP Querier

VRF-lite

Multicast VRF-lite15

VRF-aware IP services

VRF-aware TACACS+

Route Leaking16

IP Unnumbered

SVI Autostate Exclude

Supported Protocols

IS-IS17

DTP18

RIP19 and RIP II

EIGRP20

EIGRP IPv6 (Sup 6-E and Sup 6L-E only)

OSPF21

OSPF for Routed Access22

BGP423

BGP route-map Continue

BGP Neighbor Policy

MBGP24

MSDP25

ICMP26 Router Discovery Protocol

PIM27—sparse and dense mode

Static routes

Classless interdomain routing (CIDR)

DVMRP28

SSM

NTP29

WCCP version 2 Layer 2 Redirection

VRRP30

SCP31

GLBP32

EtherChannel Features

Cisco EtherChannel technology - 10/100/1000 Mbps, 10 Gbps

Load balancing for routed traffic, based on source and destination IP addresses

Load sharing for bridged traffic based on MAC addresses

ISL on all EtherChannels

IEEE 802.1Q on all EtherChannels

Bundling of up to eight Ethernet ports

Up to 64 active Ethernet port channels

Trunk Port Security over EtherChannel

Link State Tracking

Additional Protocols and Features

Link Layer Discovery Protocol (LLDP)

Link Layer Discovery Protocol Media Endpoint Discovery (LLDP-MED)

PoEP via LLDP

DSCP/CoS via LLDP

Routed Jumbo Frame support

SPAN CPU port mirroring

SPAN packet-type filtering

SPAN destination in-packets option

SPAN ACL filtering

RSPAN

Enhanced VLAN statistics

Netflow version 8

NetFlow Statistics Collection

NetFlow Statistics Export Version 1 and Version 5

NetFlow Bridged IP Flow

Secondary addressing

Bootstrap protocol (BOOTP)

Authentication, authorization, and accounting using TACACS+ and RADIUS protocol

Cisco Discovery Protocol (CDP)

CDP 2nd Port Status TLV

MAC Address-Table Move Update

Flex Link Bi-directional Fast Convergence

Flex Link VLAN Load-Balancing

Flex Links

Flex Links Interface Preemption

802.1ab Link Layer Discovery Protocol (LLDP)

802.1ab LLDP Media Discovery (LLDP-MED)

Network Mobility Services Protocol

Selecting Mode of Capturing Control Packets (Not supported on Sup 6-E)

Sticky port security

Trunk port security

Voice VLAN Sticky port security

Cisco Group Management Protocol (CGMP) server support

HSRP33 over Ethernet, EtherChannels - 10/100/1000Mbps, 10 Gbps

HSRP v2 for IPv4

HSRP v2 for IPv6

IGMP snooping version1, version 2, and version 3 (Full Support)

IGMP filtering

Port Aggregation Protocol (PagP)

802.3ad LACP

SSH version 1 and version 234

Inline power preallocation

show interface capabilities command

IfIndex persistence

UDLR35

Enhanced SNMP MIB support

SNMP36 version 1, version 2, and version 3

SNMP version 3 (with encryption)

IPv6 Multicast Listener Discovery Snooping (Sup 6-E and 6L-E only)

IPv6 PACL (Sup 6-E and 6L-E only)

IPv6 RA Guard (Sup 6-E and 6L-E only)

IPv6 Interface Statistics (Sup 6-E and 6L-E only)

DHCP server and relay-agent

DHCP snooping

DHCP client autoconfiguration

DHCP Option 82 Pass Through

DHCP Relay Agent for IPv6 37

802.1X Multiple Domain Authentication and Multiple Authorization

802.1X with ACL Assignment and Redirect URLs

802.1X with per-user ACL and Filter-ID ACL

RADIUS-Provided Session Timeouts

RADIUS CoA

MAC Move and Replace

802.1X with Guest VLANs

802.1X port-based authentication

802.1X with port security

802.1X accounting

802.1X with voice VLAN ID

802.1X private VLAN assignment

802.1X private guest VLAN

802.1X RADIUS-supplied session timeout

802.1X authentication failure VLAN

802.1X MAC Authentication Bypass

802.1X Inaccessible Authentication Bypass

802.1X with User Distribution

802.1X Unidirectional Controlled Port

802.1X MDA with Voice Assignment

Cisco TrustSec SGT Exchange Protocol (SXP) IPv4

Flexible Authentication Sequencing

Multi-Authentication

Open Authentication

Web Authentication

Local Web Authentication (EPM syslog and Common session ID)

PPPoE Intermediate Agent38

Cisco NAC39 Layer 2 802.1X

Port flood blocking

Router standard and extended ACLs 40on all ports with no performance penalty

Identity 4.1 ACL Policy Enforcement41

Identity 4.1 Network Edge Access Topology

Extended IPX ACL

VLAN ACL

PACL42

Time-based ACL

Downloadable ACLs

Control Plane Policing

Two-Rate Three-Color Policing (Sup 6-E and Sup 6L-E only)

Local Proxy ARP

Dynamic ARP Inspection on PVLANs

Dynamic ARP Inspection

Dynamic Multi-Protocol Ternary Content Addressable Memory (Sup 6-E and Sup 6L-E only)

Per-port QoS43 rate-limiting and shaping

QoS for IPv6

Per-port Per-VLAN QoS

Per-VLAN CTI

ARP QoS (Sup 6-E and Sup 6L-E only)

Inline power support for Cisco IP phones

PoE44

Energy Wise

Enhanced Power over Ethernet Support (Sup 6-E and Sup 6L-E only)

Power redundancy

RPR45

SSO46

SSO Aware HSRP

SSO support for routed ports

Non-stop Forwarding Awareness

Non-stop Forwarding Awareness for EIGRP-stub in IP base for all supervisor engines

Non-stop Forwarding with Stateful Switchover

ISSU47

MAC Address Notification

Combined Mode Power Resiliency

SmartPort macros

AutoSmartPort macros

Forced 10/100 Auto Negotiation

802.1s standards compliance

IS-IS MIB

OSPF and EIGRP Fast Convergence48

Time Domain Reflectometry

CNA49

CLI to turn off Auto MDIX50

Logging redirection

Service-Aware Resource Allocation (Sup 6-E and Sup 6L-E only)

TwinGig Converter Module (Sup 6-E nd 6L-E only)

FAT File System (Sup 6-E and Sup 6L-E only)

High Availability: 2+2 10GE or 4+4 1GE active uplinks (Sup 6-E only)

EEM51

EEM with ISSU

VSS client with PagP+

IP/SLA52

Embedded management53

MAC notify MIB

Eight configurable queues per port (Sup 6-E and Sup 6L-E only)

X2 Link Debounce Timer

IP SLA

Enhanced Object Tracking subfeatures:

  • HSRP with EOT
  • VRRP with EOT
  • GLBP with EOT
  • IP SLA with EOT
  • Reliable Backup Static Routing with EOT

Management port

Management Port Features with IPv6

Inactivity Timer

OBFL54

boot config command

Crashdump enhancement

Unicast MAC filtering

Smart Call Home

DHCPv6 Ethernet Remote ID option

DHCPv6 Relay - Persistent Interface ID option DHCPv6 Relay Agent notification for Prefix Delegation

PIM SSM Mapping

VRF lite NSF support with routing protocols OSPF/EIGRP/BG

PIM Accept Register - Rogue Multicast Server Protection55

Configuration Rollback

Archiving crashfile information

Per-VLAN Learning

XML Programmatic Interface

VLAN Mapping (VLAN Translation)

GOLD Online Diagnostics (Sup 6-E and 6L-E only)

IPSG for Static Hosts

Layer Control Packet

Fa1 interface (Ethernet management port)56

1.Requires the Catalyst 4500 series switch Supervisor Engine V

2.Hardware-based transparent bridging within a VLAN

3.MAC = Media Access Control

4.VMPS = VLAN Management Policy Server

5.Only Supervisr Engine 6-E

6.ISL = Inter-Switch Link

7.Ports 3 thru 18 on the WS-X4418-GB and ports 1 thru 12 on the WS-X4412-2GB

8.Requires the Catalyst 4500 series switch Supervisor Engine V

9.not supported on E-Series Supervisor Engine 6-E

10.Only Supervisr Engine 6-E

11.The ip classless command is not supported as classless routing is enabled by default.

12.PBR = policy-based routing

13.CEF = Cisco Express Forwarding

14.uRPF = Unicast Reverse Path Forwarding

15.Only Supervisr Engine 6-E

16.Route Leaking from a global routing table into a VRF and Route Leaking from a VRF into a global routing table

17.IS-IS = Intermediate System to Intermediate System

18.DTP = Dynamic Trunking Protocol

19.RIP = Routing Information Protocol

20.EIGRP = Enhanced Interior Gateway Routing Protocol

21.OSPF = Open Shortest Path First

22.Support for Supervisor Engine 6-E and Supervisor Engine 6L-E only

23.BGP4 = Border Gateway Protocol 4

24.MBGP = Multicast Border Gateway Protocol

25.MSDP = Multicast Source Discovery Protocol

26.ICMP = Internet Control Message Protocol

27.PIM = Protocol Independent Multicast

28.DVMRP = Distance Vector Multicast Routing Protocol

29.NTP = Network Time Protocol

30.VRRP = Virtual Router Redundancy Protocol

31.SCP = Secure Copy Protocol

32.GLBP = Gateway Load Balancing Protocol

33.HSRP = Hot Standby Router Protocol

34.SSH = Secure Shell Protocol

35.UDLR = Unidirectional Link Routing

36.SNMP = Simple Network Management Protocol

37.only Sup 6-E and 6L-E

38.not supported on E-Series Supervisor Engine 6-E

39.NAC = Network Admission Control

40.ACLs = Access Control Lists

41.filter-ID and per-user ACL

42.PACL = Port Access Control List

43.QoS = Quality of Service

44.PoE = Power over Ethernet

45.RPR = Supervisor engine redundancy

46.SSO = Stateful switchover (includes Stateful IGMP Snooping and Stateful DHCP Snooping)

47.ISSU = In Service Software Upgrade Process

48.The Catalyst 4500 series switch supports Fast Hellos, ISPF, and LSA Throttling.

49.CNA = Cisco Network Assistant; Minimum CNA release that supports Releases 12.2(25)EW is 1.0(2). Minimum CNA release that supports Release 12.2(20)EWA is 1.0(1).

50.On supported linecards: WS-X4124-RJ45, WS-X4148-RJ (and WS-X4232-GB-RJ) with hardware revision 3.0 or higher

51.EEM = Embedded Event anager

52.Includes HTTPS-HTTP with SSL 3.0, CEF-MIB, Embedded Syslog Manage, ...

53.Includes SNMP over IPv6, SYSLOG, HTTP over IPv6.

54.OBFL = On Board Failure Logging; Supverisor Engine 6-E only

55.The route-map keyword is not supported.

56.Available starting with Cisco IOS Release 12.2(46)SG

Features Unique to Supervisor Engines 6-E and 6L-E

With Cisco IOS Release 12.2(54)SG, the following features are available only with
Supervisor Engine 6-E and Supervisor Engine 6L-E:

  • IPv6

IPv6 Addressing Architecture

CDP IPv6 Address Family

DNS resolver for AAAA over an IPv4 transport

DNS resolver for AAAA over an IPv6 transport

Extended ACL

Hop-by-Hop option header

ICMP Rate Limiting

ICMPv6

ICMPv6 Redirect

IPv6 over IEEE 802.1Q

ISATAP (supported in software only)

Loopback

MLD Snooping (supported in software and hardware on Catalyst 4900M, Catalyst 4948E, Supervisor Engine 6-E, and Catalyst 6L-E)

MLDv1/v2

MTU Path Discovery for IPv6

OSPFv3

RIPng

EIGRPv6

PACL

RA Guard

IPv6 Interface Statistics

  • FAT filesystem
  • PIM (SM, DM, SDM)
  • QoS

Two Rate three Color Policing

Table map support for marking

Class based queuing actions (shaping/bandwidth/queue-limit/dbl/strict priority)

  • Voltage Margining CLI
  • QoS for IPv6
  • ARP QoS

Unsupported Features

For all Supervisor Engines (II-Plus thru 6-E), the following features are not supported in Cisco IOS Release 12.2(54)SG for the Catalyst 4500 series switches:

  • The following ACL types:

Standard Xerox Network System (XNS) access list

Extended XNS access list

DECnet access list

Protocol type-code access list

  • ADSL and Dial access for IPv6
  • AppleTalk EIGRP (use native AppleTalk routing instead)
  • Bridge groups
  • CEF Accounting
  • Cisco IOS software IPX ACLs:

<1200-1299> IPX summary address access list

  • Cisco IOS software-based transparent bridging (also called “fallback bridging”)
  • Connectionless (CLNS) routing; including IS-IS routing for CLNS. IS-IS is supported for IP routing only.
  • DLSw (data-link switching)
  • IGRP (use EIGRP instead)
  • isis network point-to-point command
  • Kerberos support for access control
  • LLDP HA
  • Lock and key
  • NAT-PT for IPv6
  • NetFlow per-VRF
  • PBR with Multiple Tracking Options
  • QoS for IPv6 traffic (only supported on Supervisor 6)
  • Reflexive ACLs
  • Routing IPv6 over an MPLS network
  • Two-way community VLANs in private VLANs
  • WCCP version 1
  • CFM CoS
  • PBR with EOT

New and Changed Information

These sections describe the new and changed information for the Catalyst 4500 series switch running Cisco IOS software:

New Hardware Features in Release 12.2(54)SG1

Release 12.2(54)SG1 provides the following new hardware on the Catalyst 4500 series switch:

  • Catalyst 4948E-F—The Catalyst 4948E and Catalyst 4948E-F share the same internal hardware and software. The Catalyst 4948E draws cold air into the port side and exhausts hot air on the power supply side. The Catalyst 4948E-F draws cold air at the power supply side and exhaust hot air on the port side. This is the only difference between the Catalyst 4948E and the Catalyst 4948E-F.

New Software Features in Release 12.2(54)SG1

Release 12.2(54)SG provide no new software features on the Catalyst 4500 series switch.

New Hardware Features in Release 12.2(54)SG

Release 12.2(54)SG provides the following new hardware on the Catalyst 4500 series switch:

  • SFP-10G-LRM
  • WS-C4507R+E
  • WS-C4510R+E
  • Digital Optical Monitoring (DOM) support on all 10GE interfaces
  • CVR-X2-SFP10G (support introduced on Supervisor Engines II+ through V-10GE)

New Software Features in Release 12.2(54)SG

Release 12.2(54)SG provides the following new software features on the Catalyst 4500 series switch:

  • 802.1X with User Distribution ("Configuring 802.1X Port-Based Authentication" chapter)
  • Auto SmartPort ("Configuring Auto SmartPort Macros" chapter)
  • DSCP/CoS via LLDP ("Configuring LLDP, LLDP-MED, and Location Service" chapter
  • EEM: Embedded Event Manager 3.2

For details, refer to the URL:


http://www.cisco.com/en/US/docs/switches/datacenter/sw/5_x/nx-os/system_management/configuration/guide/sm_12eem.html

  • EIGRP Service Advertisement Framework

For details refer to the URL:

http://www.cisco.com/en/US/docs/ios/saf/configuration/guide/saf_cg.html

  • EnergyWise 2.0

For details refer to the URL:

http://www.cisco.com/en/US/docs/switches/lan/energywise/phase2/ios/configuration/guide/ew_v2.html

  • GOLD Online Diagnostics ("Performing Diagnostics" chapter; Supervisor E ngine 6-E only)
  • Identity 4.1 ACL Policy Enhancements ("Configuring Network Security with ACLs" chapter)
  • Identity 4.1 Network Edge Access Topology ("Configuring 802.1X Port-Based Authentication" chapter)
  • IPSG for Static Hosts (Refer to the Cisco IOS library)
  • IPv6 PACL ("Configuring Network Security with ACLs" chapter; Supervisor E ngine 6-E only)
  • IPv6 RA Guard ("Configuring Network Security with ACLs" chapter; Supervisor E ngine 6-E only)
  • IPv6 Interface Statistics ("Configuring Layer 3 Interfaces" chapter; Supervisor E ngine 6-E only)
  • IS-IS for IPv4 ad IPv6, extended to Supervisor Engine 6-E (Refer to the Cisco IOS library)
  • Layer Control Packet (extended to Supervisor 6)
  • Link State Tracking ("Configuring EtherChannel and Link State Tracking" chapter)
  • MAC move and replace ("Administering the Switch" chapter)
  • Per-VLAN Learning ("Administering the Switch" chapter)
  • PoEP via LLDP ("Configuring LLDP, LLDP-MED, and Location Service" chapter)
  • RADIUS CoA ("Configuring 802.1X Port-Based Authentication" chapter)
  • Sub-second UDLD (Configuring UDLD" chapter)
  • VLAN Translation ("Configuring 802.1Q Tunneling, VLAN Mapping, and Layer 2 Protocol Tunneling" chapter; Supervisor E ngine 6-E only)
  • VRF-aware TACACS+ ("Configuring VRF-lite" chapter)
  • XML Programmatic Interface (Refer to the Cisco IOS library)

For details refer to the URL:

http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_xmlpi_v1.html

New Hardware Features in Release 12.2(53)SG6

Release 12.2(53)SG6 provides no new hardware for the Catalyst 4500 series switch.

New Software Features in Release 12.2(53)SG6

Release 12.2(53)SG6 provides no new features for the Catalyst 4500 series switch.

New Hardware Features in Release 12.2(53)SG5

Release 12.2(53)SG5 provides no new hardware for the Catalyst 4500 series switch.

New Software Features in Release 12.2(53)SG5

Release 12.2(53)SG5 provides no new features for the Catalyst 4500 series switch.

New Hardware Features in Release 12.2(53)SG4

Release 12.2(53)SG4 provides the following new hardware on the Catalyst 4500 series switch:

  • WS-C4507-R+E
  • WS-C4510-R+E

New Software Features in Release 12.2(53)SG4

Release 12.2(53)SG4 provides no new features for the Catalyst 4500 series switch.

New Hardware Features in Release 12.2(53)SG3

Release 12.2(53)SG3 provides the following new hardware on the Catalyst 4500 series switch:


NoteThis set of optics is not supported on Cisco IOS Release 12.2(54)SG and Cisco IOS XE Release 3.1.0 SG. However, the same set of optics is supported on Cisco IOS Release 15.0(2)SG and Cisco IOS XE Release 3.2.0(SG).


  • DWDM-SFP-6141
  • DWDM-SFP-5736
  • DWDM-SFP-5332
  • DWDM-SFP-4931
  • DWDM-SFP-4532
  • DWDM-SFP-4134
  • DWDM-SFP-3739
  • DWDM-SFP-3346

New Software Features in Release 12.2(53)SG3

Release 12.2(53)SG3 provides no new features for the Catalyst 4500 series switch.

New Hardware Features in Release 12.2(53)SG2

Release 12.2(53)SG2 provides no new hardware for the Catalyst 4500 series switch.

New Software Features in Release 12.2(53)SG2

Release 12.2(53)SG2 provides no new features for the Catalyst 4500 series switch.

New Hardware Features in Release 12.2(53)SG1

Release 12.2(53)SG1 provides no new hardware for the Catalyst 4500 series switch.

New Software Features in Release 12.2(53)SG1

Release 12.2(53)SG1 provides no new features for the Catalyst 4500 series switch.

New Hardware Features in Release 12.2(53)SG

Release 12.2(53)SG does not provide any new hardware for the Catalyst 4500 series switch. However, it does integrate Supervisor Engine 6L-E, introduced in 12.2(52)XO.

New Software Features in Release 12.2(53)SG

Release 12.2(53)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:

  • IP Multicast Load Splitting (Equal Cost Multipath (ECMP) using S, G and Next-hop)
  • OSPF for Routed Access (Supervisor Engine 6-E and Supervisor Engine 6L-E)

OSPF for Routed Access is designed specifically to enable customers to extend Layer 3 routing capabilities to the access or Wiring Closet.


Note OSPF for Routed Access supports only one OSPFv2 and one OSPFv3 instance with a maximum number of 200 dynamically learned routes.


With the typical topology (hub and spoke) in a campus environment, where the wiring closets (spokes) are connected to the distribution switch (hub) forwarding all nonlocal traffic to the distribution layer, the wiring closet switch need not hold a complete routing table. A best practice design, where the distribution switch sends a default route to the wiring closet switch to reach inter-area and external routes (OSPF stub or totally stub area configuration) should be used when OSPF for Routed Access is used in the wiring closet.

http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/54sg/configuration/guide/automacr.html

The OSPF for Routed Access feature adheres to the following software restrictions:

Limit the number of OSPF instances to one on OSPFv2 and one on OSPFv3.

Limit number of dynamic routes learned through platform dependant work to 200.

Refer to the following link for more details:

http://www.cisco.com/en/US/docs/solutions/Enterprise/Campus/routed-ex.html

With Cisco IOS Release 12.2(53)SG, the IP Base image supports OSPF for routed access. The Enterprise Services image is required if you need multiple OSPFv2 and OSPFv3 instances without route restrictions. Additionally, Enterprise Services is required to enable the VRF-lite feature.

New Hardware Features in Release 12.2(52)XO

Release 12.2(52)XO provides the following new hardware for the Catalyst 4500 series switch:

  • WS-X45-Sup6L-E, Catalyst 4500 E-series switch Supervisor Engine 6L-E
  • PWR-C45-6000ACV, Catalyst 4500 series switch 6000 Watt AC power supply

Note Only supported on 3, 6, and 7 slot chassis and IP LAN and IP BASE images


New Software Features in Release 12.2(52)XO


NoteThis release is equivalent in functionality to 12.2(52)SG, but adds support for the new Sup6L-E supervisor. The only supervisor engine it supports is Supervisor Engine 6L-E; for all other supervisor engines, use 12.2(52)SG instead.


Release 12.2(52)XO provides the following Cisco IOS software features for the Catalyst 4500 series switch:

  • EnergyWise
  • Switch and IP Phone interaction for security features

Port Security

DHCP Snooping

Dynamic ARP Inspection

BPDU Guard

  • Network Mobility Services Protocol
  • Identity ACL Policy Enforcement Enhancement

Filter-ID

Per-user ACL

  • Smart Call Home*
  • Management Port Features with IPv6
  • Local WebAuth Enhancement
  • MDA with Voice Assignment
  • HSRP v2 for IPv4
  • HSRP v2 or IPv6
  • DHCPv6 Enhancements

DHCPv6 Ethernet Remote ID option

DHCPv6 Relay - Persistent Interface ID option DHCPv6 Relay Agent notification for Prefix Delegation

  • PIM SSM Mapping
  • VRF lite NSF support with routing protocols OSPF/EIGRP/BGP
  • Supported MIBs

Cisco Enhanced Image MIB

Cisco HSRP extension MIB

CISCO-CALLHOME-MIB.my

EnergyWise MIB

POE MIB

POE ext MIB

Entity-Diag-MIB

Bridge MIB

  • Time Protocols (SNTP, TimeP) master

On Supervisor Engine 6L-E

  • Community PVLAN support
  • Ethertype Classification
  • QinQ
  • PPPoE IA (or Intermediate Agent)

New Hardware Features in Release 12.2(52)SG

Release 12.2(52)SG provides the following new hardware for the Catalyst 4500 series switch:

  • PWR-C45-6000ACV, Catalyst 4500 series switch 6000 Watt AC power supply'

New Software Features in Release 12.2(52)SG

Release 12.2(52)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:

All Supervisor Engines

  • EnergyWise
  • Switch and IP Phone interaction for security features

Port Security

DHCP Snooping

Dynamic ARP Inspection

BPDU Guard

  • Network Mobility Services Protocol
  • Identity ACL Policy Enforcement Enhancement

Filter-ID

Per-user ACL

  • Smart Call Home*
  • Management Port Features with IPv6
  • Local WebAuth Enhancement
  • MDA with Voice Assignment
  • HSRP v2 for IPv4
  • HSRP v2 or IPv6
  • DHCPv6 Enhancements

DHCPv6 Ethernet Remote ID option

DHCPv6 Relay - Persistent Interface ID option DHCPv6 Relay Agent notification for Prefix Delegation

  • SSM Mapping
  • PIM Accept Register - Rogue Multicast Server Protection (route-map option is not supported)
  • VRF lite NSF support with routing protocols OSPF/EIGRP/BGP
  • Supported MIBs

Cisco Enhanced Image MIB

Cisco HSRP extension MIB

CISCO-CALLHOME-MIB.my

EnergyWise MIB

POE MIB

POE ext MIB

Entity-Diag-MIB

Bridge MIB

On Supervisor Engine 6-E

  • Community PVLAN support
  • Ethertype Classification
  • PBR
  • QinQ
  • PPPoE IA (or Intermediate Agent)

New Hardware Features in Release 12.2(50)SG3

Release 12.2(50)SG3 provides the following hardware for the Catalyst 4500 series switch:

  • CVR-X2-SFP10G

Hot-swappable input/output (I/O) converter module that fits into a 10-Gigabit Ethernet X2 slot on a switch or line card module. Hosts one 10-Gigabit Ethernet SFP+ transceiver module.

  • SFP-10G-SR, Cisco 10GBASE-SR SFP+ Module for MMF

New Software Features in Release 12.2(50)SG3

Release 12.2(50)SG3 provides no new features for the Catalyst 4500 series switch.

New Hardware Features in Release 12.2(50)SG2

Release 12.2(50)SG2 provides no new hardware for the Catalyst 4500 series switch.

New Software Features in Release 12.2(50)SG2

Release 12.2(50)SG2 provides no new features for the Catalyst 4500 series switch.

New Hardware Features in Release 12.2(50)SG1

Release 12.2(50)SG1 provides no new hardware for the Catalyst 4500 series switch.

New Software Features in Release 12.2(50)SG1

Release 12.2(50)SG1 provides the following Cisco IOS software features for the Catalyst 4500 series switch:

  • EEM version 2

For information on EEM, see the URL:

http://www.cisco.com/en/US/products/ps6815/products_ios_protocol_group_home.html

New Hardware Features in Release 12.2(50)SG


NoteIn addition to the classic line cards and supervisor engines, Cisco IOS Software Release 12.2(50)SG supports the next-generation high-performance E-Series Supervisor Engine 6-E with CenterFlex technology and E-Series line cards and chassis.


Release 12.2(50)SG provides the following new hardware for the Catalyst 4500 series switch:

  • X2-10GB-ZR optical module
  • X2-10GB-DWDM optical module
  • Classic Series 48-port 10/100/1000 Premium PoE line card

New Software Features in Release 12.2(50)SG

Release 12.2(50)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:


Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.



Note The implementation for multiple spanning tree (MST) changed from the previous release. Multiple STP (MSTP) complies with the IEEE 802.1s standard. Previous MSTP implementations were based on a draft of the IEEE 802.1s standard.


  • IGMP Querier (“Configuring IGMP Snooping” chapter)
  • OSPF and EIGRP fast convergence and protection (Refer to the Cisco IOS Release 12.4 documentation)
  • CDP 2nd Port Status TLV (no configuration required on the switch)

Note The link up/down information in the CDP Second Port Status TLV (added by the Cisco IP Phones Host Movement Detection enhancement) allows the switch to de-authenticate devices which were previously authenticated. The phone must have firmware release 8.1(1) or later to generate this CDP TLV.


  • ANCP Client (not supported on E-Series Supervisor Engine 6-E; “Configuring ANCP Client” chapter)
  • boot config command (Refer to the Cisco IOS Release 12.2 documentation)
  • Archiving Crashinfo Files (“Configuring Command-Line Interfaces” chapter)
  • Boot Configuration/Crash Dump (refer to the Cisco IOS Release 12.2 documentation)
  • Downloadable ACLs (“Configuring Network Security with ACLs” chapter)
  • Ethernet Management Port (Refer to the “Configuring Interfaces” chapter)
  • Flexible Authentication Sequencing (“Configuring 802.1X” chapter)
  • Inactivity Timer (“Configuring 802.1X” chapter)
  • Multi-Authentication (“Configuring 802.1X” chapter)
  • Open Authentication (“Configuring 802.1X” chapter)
  • PPPoE Intermediate Agent (not supported on E-Series Supervisor Engine 6-E; “PPPoE Circuit-Id Tag Processing” chapter)
  • VRF-aware IP services (“Configuring VRF-Lite” chapter)
  • VTP version 3 (“Configuring VLANs, VTP, and VMPS” chapter)
  • Web Authentication (“Configuring Web Authentication” chapter)
  • Configuration Rollback
  • Cisco TrustSec SGT Exchange Protocol (SXP) IPv4

For more information, refer to the following URLs:

http://www.cisco.com/en/US/docs/switches/lan/trustsec/configuration/guide/trustsec.html

On Supervisor Engine 6-E

  • Bidirectional PIM (“Configuring IP Multicast” chapter)
  • Control Plane Policing (“Configuring CPP” chapter)
  • DHCP Relay Agent for IPv6 (refer to Cisco IOS Release 12.2 mainline documentation)
  • Multicast VRF-lite (“Configuring VRF-Lite” chapter)
  • On Board Failure Logging (refer to the Cisco IOS Release 12.2 documentation)
  • Private VLAN trunks (“Configuring Private VLANs” chapter)
  • SVI Auto State Exclude (“Configuring Layer 3 Interfaces” chapter)
  • Unicast MAC filtering (“Configuring Network Security with ACLs” chapter)
  • QoS for IPv6 (refer to the Cisco IOS Release 12.4T documentation)

New Hardware Features in Release 12.2(46)SG


NoteIn addition to the classic line cards and supervisor engines, Cisco IOS Software Release 12.2(46)SG supports the next-generation high-performance E-Series Supervisor Engine 6-E with CenterFlex technology and E-Series line cards and chassis.


Release 12.2(46)SG provides the following new hardware for the Catalyst 4500 series switch:

  • 20 W PoE linecard

New Software Features in Release 12.2(46)SG

Release 12.2(46)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:


Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.


On Supervisor Engine 6-E

  • 802.1X Enhancements (Refer to the “Configuring 802.1X” chapter)

802.1X Guest VLAN

802.1X Critical Authentication

Wake on LAN

Radius Accounting

Radius Supplied Timeout

  • ARP QoS (Refer to the “Configuring QoS” chapter)
  • Per-VLAN CTI (Refer to the “Configuring QoS” chapter)
  • Catalyst 4900M switch support for Layer 3 features
  • RSPAN (Refer to the “Configuring SPAN and RSPAN” chapter)

On all the Supervisor Engines (II-Plus thru 6-E)

  • FlexLink and FlexLink+ with MAC Address-Table Move Update (Refer to the “Configuring FlexLink” chapter)
  • LLDP-MED: location TLV and MIB (Refer to the “Configuring LLDP and LLDP-MED” chapter)
  • Auto-MDIX Disable (Refer to the “Configuring Interfaces” chapter)
  • Enhanced Object Tracking (EOT) (Refer to the Cisco IOS Release 12.2 documentation)

HSRP with EOT

VRRP with EOT

GLBP with EOT

IP SLA with EOT

Reliable Backup Static Routing with EOT

  • CFM 802.1ag (Refer to the “Configuring Ethernet CFM and OAM” chapter)
  • E-OAM 802.3ah (Refer to the “Configuring Ethernet CFM and OAM” chapter)

Note The implementation for multiple spanning tree (MST) changed from the previous release. Multiple STP (MSTP) complies with the IEEE 802.1s standard. Previous MSTP implementations were based on a draft of the IEEE 802.1s standard.


New Hardware Features in Release 12.2(44)SG


NoteIn addition to the classic line cards and supervisor engines, Cisco IOS Software Release 12.2(44)SG supports the next-generation high-performance E-Series Supervisor Engine 6-E with CenterFlex technology and E-Series line cards and chassis.


Release 12.2(44)SG provides the following new hardware for the Catalyst 4500 series switch:

  • WS-X4624-SFP-E

New Software Features in Release 12.2(44)SG

Release 12.2(44)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:


Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.


On Supervisor Engine 6-E

  • High availability on Supervisor Engine 6-E (SSO/NSF) (Refer to the “Configuring NSF on SSO” chapter)
  • High availability on Supervisor Engine 6-E (ISSU) (Refer to the “Configuring ISSU” chapter)
  • Embedded management (Refer to the Cisco IOS Release 12.4 documentation)
  • MAC notify MIB (Refer to the Cisco IOS Release 12.4 documentation)
  • IPv4_BGP, IPv6_BGP (Refer to the Cisco IOS Release 12.4 documentation)
  • 802.1X Dynamic VLAN Assignment (Refer to the “Configuring 802.1X” chapter)
  • 802.1X MAC Authentication Bypass (Refer to the “Configuring 802.1X” chapter)
  • 802.1X with VVID/PVID (Refer to the “Configuring 802.1X” chapter)
  • High availability, 2+2 10GE or 4+4 1GE active uplinks (Refer to the “Configuring Interfaces” chapter)
  • Enhanced Power over Ethernet Support ((Refer to the “Configuring Power over Ethernet” chapter)
  • Eight configurable queues per port (Refer to the “Configuring QoS” chapter)

On all the Supervisor Engines (II-Plus thru 6-E)

  • EEM with ISSU

For details, refer to the EEM Home Page:
http://www.cisco.com/en/US/products/ps6815/products_ios_protocol_group_home.html

  • ESM

For details, refer to the ESM Home Page:
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t2/feature/guide/gt_esm.html

  • VSS client with PagP+

After configuring VSS dual-active on a Catalyst 6500 switches, the Catalyst 4500 series switch can detect VSS dual-active with PagP+ support.

  • IP SLA (Refer to the Cisco IOS Release 12.2 documentation)
  • 802.1ab LLDP and 802.1ab LLDP-MED (Refer to the “Configuring LLDP and LLDP-MED” chapter)
  • X2 Link Debounce Timer (Refer to the “Configuring Interfaces” chapter)
  • Resilient Ethernet Protocol (REP) (Refer to the “Configuring REP” chapter)

Note The implementation for multiple spanning tree (MST) changed from the previous release. Multiple STP (MSTP) complies with the IEEE 802.1s standard. Previous MSTP implementations were based on a draft of the IEEE 802.1s standard.


New Hardware Features in Release 12.2(40)SG


NoteIn addition to the classic line cards and supervisor engines, Cisco IOS Software Release 12.2(40)SG supports the next-generation high-performance E-Series Supervisor Engine 6-E with CenterFlex technology and E-Series line cards and chassis.


A brief list of primary E-Series hardware supported by Cisco IOS Release 12.2(40)SG includes the following:

  • WS-C4503-E - Cisco Catalyst 4500 E-Series 3-Slot Chassis, fan, no power supply
  • WS-C4506-E - Cisco Catalyst 4500 E-Series 6-Slot Chassis, fan, no power supply
  • WS-C4507R-E - Cisco Catalyst 4500 E-Series 7-Slot Chassis, fan, no power supply, redundant supervisor capability
  • WS-C4510R-E - Cisco Catalyst 4500 E-Series 10-Slot Chassis, fan, no power supply, redundant supervisor capability
  • WS-X45-Sup6-E - Cisco Catalyst 4500 E-Series Sup 6-E, 2x10GE(X2) w/ TwinGig
  • WS-X4648-RJ45V-E - Cisco Catalyst 4500 E-Series 48-Port PoE 802.3af 10/100/1000(RJ45)
  • WS-X4648-RJ45V+E - Cisco Catalyst 4500 E-Series 48-Port Premium PoE 10/100/1000
  • WS-X4606-X2-E - Cisco Catalyst 4500 E-Series 6-Port 10GbE (X2)

New Software Features in Release 12.2(40)SG

Release 12.2(40)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:


Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.


Only available on Supervisor Engine 6-E

  • Dynamic Multi-Protocol Ternary Content Addressable Memory (Configuring Network Security with ACLs” chapter)
  • Service-Aware Resource Allocation (Refer to the Cisco IOS Release 12.4 documentation)
  • Unicast Reverse Path Forwarding (“Configuring Unicast Reverse Path Forwarding” chapter)
  • IPv6 Forwarding in Hardware (Refer to the Cisco IOS Release 12.4 documentation)
  • Enhanced Interior Gateway Routing Protocol IPv6 Support (Refer to the Cisco IOS Release 12.4 documentation)
  • IPv6 Multicast Listener Discovery Snooping (“Configuring MLD Snooping” chapter)
  • TwinGig Converter Module (“Configuring Interfaces” chapter)
  • Robust and Flexible File Management System (FAT File System) (Refer to the Cisco IOS Release 12.4 documentation)
  • Storm Control: Per-Port Multicast Suppression (“Configuring Storm Control” chapter)
  • Cisco Modular QoS Command-Line Interface (“Configuring QoS” chapter)
  • Two-Rate Three-Color Policing

Only available on Supervisor Engines II-Plus thru V-10GE

  • Selecting Mode of Capturing Control Packets (Configuring Network Security with ACLs” chapter)
  • Layer 2 Control Policing (“Configuring QoS” chapter)

Available on all Supervisor Engines (II-Plus thru 6-E)

  • Gateway Load Balancing Protocol (Refer to the Cisco IOS Release 12.4 documentation)
  • Option 82 Enhancement (“Configuring DHCP Snooping, IP Source Guard, and IPSG for Static Hosts” chapter)

Note The implementation for multiple spanning tree (MST) changed from the previous release. Multiple STP (MSTP) complies with the IEEE 802.1s standard. Previous MSTP implementations were based on a draft of the IEEE 802.1s standard.


Upgrading the System Software

In most cases, upgrading the switch to a newer release of Cisco IOS software does not require a ROMMON upgrade. However, if you are running an early release of Cisco IOS software and plan to upgrade, refer to the following tables for the minimum Cisco IOS image and the recommended ROMMON release, respectively.


NoteYou must upgrade to ROMMON Release 12.2(44r)SG5 to run Cisco IOS Release 12.2(54)SG on the Supervisor Engine 6-E and Supervisor Engine 6L-E.



Caution Most supervisor engines have the required ROMMON release. However, due to caveat CSCed25996, we recommend that you upgrade your ROMMON to the recommended release.

 

Table 8 Supervisor Engine and Minimum Cisco IOS Release

Supervisor Engine
Minimum Cisco IOS Release

IV

12.1(12c)EW or 12.1(14)E

II-Plus

12.1(19)EW

II-Plus-10GE

12.2(25)SG

V

12.2(18)EW

II-Plus-TS

12.2(20)EWA

V-10GE

12.2(25)EW

ME-X4924-10GE

12.2(31)SGA

6-E

12.2(40)SG

6L-E

12.2(52)XO

 

Table 9 Supervisor Engine and Recommended ROMMON Release

Supervisor Engine
Minimum ROMMON Release
Recommended ROMMON
Release

IV

12.1(12r)EW

12.2(31r)SGA1

II-Plus

12.1(19r)EW

12.2(31r)SGA1

II-Plus-10GE

12.2(25r)SG

12.2(31r)SGA3

V

12.1(20r)EW1

12.2(31r)SGA1

II-Plus-TS

12.2(20r)EW

12.2(31r)SGA1

V-10GE

12.2(25r)EW

12.2(31r)SGA3

ME-X4924-10GE

12.2(25r)EW

12.2(31r)SGA1

6-E

12.2(44r)SG5

12.2(44r)SG5

6L-E

12.2(44r)SG5

12.2(44r)SG5

Table 10 ROMMON Release and Promupgrade Programs

ROMMON Release
Promupgrade Program

12.1(11br)EW

cat4000-sup3-promupgrade-121_11br_EW

12.1(12r)EW

cat4000-sup3-promupgrade-121_12r_ew

12.1(19r)EW

cat4000-ios-promupgrade-121_19r_EW

12.1(20r)EW1

cat4000-ios-promupgrade-121_20r_EW1

12.1(20r)EW2

cat4000-ios-promupgrade-121_20r_EW2

12.2(20r)EW

cat4000-ios-promupgrade-122_20r_EW

12.2(20r)EW1

cat4000-ios-promupgrade-122_20r_EW1

12.2(31r)SG3

cat4500-ios-promupgrade-122_31r_SG3

12.2(31r)SGA1

cat4500-ios-promupgrade-122_31r_SGA1

12.2(31r)SGA

cat4500-e-ios-promupgrade-122_31r_SGA3

12.2(40r)SG

cat4500-e-ios-promupgrade-122_40r_SG

12.2(44r)SG1

cat4500-e-ios-promupgrade-122_44r_SG1

12.2(44r)SG5

cat4500-e-ios-promupgrade-122_44r_SG5

The following sections describe how to upgrade your switch software:

Identifying an +E Chassis and ROMMON

An +E chassis is identified by a FRU minor value in the chassis' idprom.

When supervisor engine 1 (sup1) is in ROMMON and supervisor engine 2 (sup2) is in IOS, only sup2 can read the idprom contents of chassis’ idprom. Chassis type is displayed as “+E” in the output of the show version command. Conversely, sup1 can only display the chassis type as “E.”

When both sup1 and sup2 are in ROMMON, both engines can read the chassis’ idprom. Chassis type is displayed correctly as “+E” in the output of the show version command.

When both sup1 and sup2 are in IOS, both engines can read the chassis’ idprom. Chassis type is displayed correctly as “+E” in the output of the show version command.

Guidelines for Upgrading the ROMMON


Caution If your supervisor engine is shipped with a newer version of ROMMON then do not downgrade! The new ROMMON will have board settings based on a hardware revision of components, and old settings will not work.

Upgrading the Supervisor Engine ROMMON from the Console


Caution To avoid actions that might make your system unable to boot, read this entire section before starting the upgrade.


NoteThe examples in this section use the programmable read-only memory (PROM) upgrade version 12.1(20r)EW1 and Cisco IOS Release 12.1(20)EW1. For other releases, replace the ROMMON release and Cisco IOS software release with the appropriate releases and filenames.


Follow this procedure to upgrade your supervisor engine ROMMON:


Step 1 Directly connect a serial cable to the console port of the supervisor engine.


NoteThis section assumes that the console baud rate is set to 9600 (default). If you want to use a different baud rate, change the configuration register value for your switch.


Step 2 Download the cat4000-ios-promupgrade-121_20r_EW1 program from Cisco.com, and place it on a TFTP server in a directory that is accessible from the switch that is upgraded.

The cat4000-ios-promupgrade-121_20r_EW1 programs are available on Cisco.com at the same location from which you download Catalyst 4000 system images.

Step 3 Use the dir bootflash: command to ensure that there is sufficient space in Flash memory to store the PROM upgrade image. If there is insufficient space, delete one or more images, and then enter the
squeeze bootflash: command to reclaim the space.

If you are using a CompactFlash card, replace bootflash: with slot0:.

Step 4 Download the cat4000-ios-promupgrade-121_20r_EW1 program into Flash memory using the copy tftp command.

The following example shows how to download the PROM upgrade image cat4000-ios-promupgrade-121_20r_EW1 from the remote host 172.20.58.78 to bootflash:

Switch# copy tftp: bootflash:
Address or name of remote host [172.20.58.78]?
Source filename [cat4000-ios-promupgrade-121_20r_EW1]?
Destination filename [cat4000-ios-promupgrade-121_20r_EW1]?
Accessing tftp://172.20.58.78/cat4000-ios-promupgrade-121_20r_EW1...
Loading cat4000-ios-promupgrade-121_20r_EW1 from 172.20.58.78 (via
FastEthernet2/1):!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!
[OK - 455620 bytes]
455620 bytes copied in 2.644 secs (172322 bytes/sec)
Switch#

Step 5 Enter the reload command to reset the switch, press Ctrl-C to stop the boot process, and re-enter ROMMON.

The following example shows the output after a reset into ROMMON:

Switch# reload
Proceed with reload? [confirm]
 
03:57:16:%SYS-5-RELOAD:Reload requested
 
 
 
**********************************************************
* *
* Welcome to Rom Monitor for WS-X4515 System. *
* Copyright (c) 2002 by Cisco Systems, Inc. *
* All rights reserved. *
* *
**********************************************************
 
Rom Monitor Program Version 12.1(12r)EW
 
 
.
.(output truncated)
.
 
Established physical link 100MB Half Duplex
Network layer connectivity may take a few seconds
rommon 1 >
 

Step 6 Run the PROM upgrade program by entering this command:
boot bootflash:cat4000-ios-promupgrade-121_20r_EW1


Caution No intervention is necessary to complete the upgrade. To ensure a successful upgrade, do not interrupt the upgrade process. Do not perform a reset, power cycle, or OIR of the supervisor engine until the upgrade is complete.

The following example shows the output from a successful upgrade, followed by a system reset:

rommon 2 > boot bootflash:cat4000-ios-promupgrade-121_20r_EW1
**********************************************************
* *
* Rom Monitor Upgrade Utility For WS-X4515 System *
* This upgrades flash Rom Monitor image to the latest *
* *
* Copyright (c) 2002, 2003 by Cisco Systems, Inc. *
* All rights reserved. *
* *
**********************************************************
 
Image size = 314.236 KBytes
 
Maximum allowed size = 511.75 KBytes
 
 
Upgrading your PROM... DO NOT RESET the system
unless instructed or upgrade of PROM will fail !!!
 
Beginning erase of 0x80000 bytes at offset 0x3f80000... Done!
 
Beginning write of prom (0x4e8ec bytes at offset 0x3f80000)...
 
This could take as little as 30 seconds or up to 2 minutes.
Please DO NOT RESET!
 
Success! The prom has been upgraded successfully.
System will reset itself and reboot in about 15
 

Step 7 Boot the Cisco IOS software image, and enter the show version command to verify that ROMMON has been upgraded to 12.1(20r)EW1.

Step 8 Use the delete command to delete the PROM upgrade program from bootflash and the squeeze command to reclaim unused space.

The following example shows how to delete the cat4000-ios-promupgrade-121_20r_EW1 image from bootflash and reclaim unused space:

Switch# delete bootflash:cat4000-ios-promupgrade-121_20r_EW1
Switch# squeeze bootflash:
 
All deleted files will be removed, proceed (y/n) [n]? y
 
Squeeze operation may take some time, proceed (y/n) [n]? y
Switch#
 

Step 9 Use the show version command to verify that the ROMMON has been upgraded

Switch#show version
Cisco Internetwork Operating System Software
IOS (tm) Catalyst 4500 L3 Switch Software (cat4500-I9S-M), Version 12.1(20)EW, E
ARLY DEPLOYMENT RELEASE SOFTWARE (fc1)
TAC Support: http://www.cisco.com/tac
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Wed 22-Oct-03 23:42 by kellmill
Image text-base: 0x00000000, data-base: 0x00F56DDC
 
ROM: 12.1(20r)EW1
Dagobah Revision 86, Swamp Revision 28
 
Switch uptime is 0 day, 0 hour, 5 minutes
System returned to ROM by reload
System image file is "bootflash:cat4500-i9s-mz.121-20.EW1"
 
cisco WS-C4503 (XPC8245) processor (revision 7) with 524288K bytes of memory.
Processor board ID FOX06460YD8
Last reset from Reload
3 Ethernet/IEEE 802.3 interface(s)
51 FastEthernet/IEEE 802.3 interface(s)
2 Gigabit Ethernet/IEEE 802.3 interface(s)
403K bytes of non-volatile configuration memory.
 
Configuration register is 0x2102
 
Switch#


 

The ROMMON has now been upgraded.

See the “Upgrading the Cisco IOS Software” section for instructions on how to upgrade the Cisco IOS software on your switch.

Upgrading the Supervisor Engine ROMMON Remotely Using Telnet


Caution To avoid actions that might make your system unable to boot, read this entire section before starting the upgrade.

Follow this procedure to upgrade your supervisor engine ROMMON to Release 12.1(20r)EW1. This procedure can be used when console access is not available and when the ROMMON upgrade must be performed remotely.


NoteIn the following section, use the PROM upgrade version cat4000-ios-promupgrade-121_20r_EW1.



Step 1 Establish a Telnet session to the supervisor engine.


NoteIn the following discussion, we assume that at least one IP address has been assigned to either an SVI or a routed port.


Step 2 Download the cat4000-ios-promupgrade-121_20r_EW1 program from Cisco.com, and place it on a TFTP server in a directory that is accessible from the switch to be upgraded.

The cat4000-ios-promupgrade-121_20r_EW1 programs are available on Cisco.com at the same location from which you download Catalyst 4500 system images.

Step 3 Use the dir bootflash: command to ensure that there is sufficient space in Flash memory to store the PROM upgrade image. If there is insufficient space, delete one or more images, and then enter the
squeeze bootflash: command to reclaim the space.

If you are using a CompactFlash card, replace bootflash: with slot0:.

Step 4 Download the cat4000-ios-promupgrade-121_20r_EW1 program into Flash memory using the
copy tftp command.

The following example shows how to download the PROM upgrade image cat4000-ios-promupgrade-121_20r_EW1 from the remote host 172.20.58.78 to bootflash:

 
Switch# copy tftp: bootflash:
Address or name of remote host [172.20.58.78]?
Source filename [cat4000-ios-promupgrade-121_20r_EW1]?
Destination filename [cat4000-ios-promupgrade-121_20r_EW1]?
Accessing tftp://172.20.58.78/cat4000-ios-promupgrade-121_20r_EW1...
Loading cat4000-ios-promupgrade-121_20r_EW1 from 172.20.58.78 (via
FastEthernet2/1):!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!
[OK - 455620 bytes]
455620 bytes copied in 2.644 secs (172322 bytes/sec)
Switch#
 

Step 5 Use the no boot system flash bootflash: file_name command to clear all BOOT variable commands in the configuration file. In this example, the BOOT variable was set to boot the image cat4000-i5s-mz.121-19.EW1.bin from bootflash:

Switch# configure terminal
Switch(config)# no boot system flash bootflash:cat4000-i5s-mz.121-19.EW1.bin
Switch(config)# exit
Switch# write
Building configuration...
Compressed configuration from 3641 to 1244 bytes [OK]
Switch#
 
Use the boot system flash bootflash:file_name command to set the BOOT variable. You will use two BOOT commands: one to upgrade the ROMMON and a second to load the Cisco IOS software image after the ROMMON upgrade is complete. Notice the order of the BOOT variables in the example below. At bootup the first BOOT variable command upgrades the ROMMON. When the upgrade is complete the supervisor engine will autoboot, and the second BOOT variable command will load the Cisco IOS software image specified by the second BOOT command.

Note The config-register must be set to autoboot.


In this example, we assume that the console port baud rate is set to 9600 bps and that the config-register is set to 0x0102.
 
Use the config-register command to autoboot using image(s) specified by the BOOT variable. Configure the BOOT variable to upgrade the ROMMON and then autoboot the IOS image after the ROMMON upgrade is complete. In this example, we are upgrading the ROMMON to version 12.1(20r)EW1. After the ROMMON upgrade is complete, the supervisor engine will boot Cisco IOS software Release 12.1(20)EW1.
 
config-register to 0x0102.
 
Switch# configure terminal
Switch(config)# boot system flash bootflash:cat4000-ios-promupgrade-121_20r_EW1
Switch(config)# boot system flash bootflash:cat4000-i9s-mz.121-20.EW1
Switch(config)# config-register 0x0102
Switch(config)# exit
Switch# write
Building configuration...
Compressed configuration from 3641 to 1244 bytes [OK]
Switch#
 

Step 6 Use the show bootvar command to verify the boot string. The BOOT variable in this example will first run the PROM upgrade to upgrade ROMMON. Then, the upgrade software will reload and the supervisor engine will load the Cisco IOS software image.

Switch# sh bootvar
BOOT variable = bootflash:cat4000-ios-promupgrade-121_20r_EW1,1;bootflash:cat400
0-i9s-mz.121-20.EW1,1
CONFIG_FILE variable does not exist
BOOTLDR variable does not exist
Configuration register is 0x2102
 

Step 7 Run the PROM upgrade program by issuing the reload command. Issuing this command will terminate your Telnet session.


Caution Verify the boot string in step 6. No intervention is necessary to complete the upgrade. To ensure a successful upgrade, do not interrupt the upgrade process. Do not perform a reset, power cycle, or OIR of the supervisor engine until the upgrade is complete.

The following example shows the console port output from a successful ROMMON upgrade followed by a system reset. Your Telnet session is disconnected during the ROMMON upgrade, so you will not see this output. This step could take 2-3 minutes to complete. You will need to reconnect your Telnet session after 2-3 minutes when the Cisco IOS software image and the interfaces are loaded.

Switch#reload
Proceed with reload? [confirm]
 
1d05h: %SYS-5-RELOAD: Reload requested
 
 
 
 
**********************************************************
* *
* Welcome to Rom Monitor for WS-X4515 System. *
* Copyright (c) 2002 by Cisco Systems, Inc. *
* All rights reserved. *
* *
**********************************************************
 
Rom Monitor Program Version 12.1(12r)EW
 
Board type 2, Board revision 7
Swamp FPGA revision 28, Dagobah FPGA revision 86
 
***** The system will autoboot in 5 seconds *****
 
 
Type control-C to prevent autobooting.
. . . . .
Established physical link 100MB Full Duplex
Network layer connectivity may take a few seconds
 
 
******** The system will autoboot now ********
 
 
config-register = 0x0102
Autobooting using BOOT variable specified file.....
 
Current BOOT file is --- bootflash:cat4000-ios-promupgrade-121_20r_EW1
 
 
 
 
**********************************************************
* *
* Rom Monitor Upgrade Utility For WS-X4515 System *
* This upgrades flash Rom Monitor image to the latest *
* *
* Copyright (c) 2002, 2003 by Cisco Systems, Inc. *
* All rights reserved. *
* *
**********************************************************
 
Image size = 314.236 KBytes
 
Maximum allowed size = 511.75 KBytes
 
 
Upgrading your PROM... DO NOT RESET the system
unless instructed or upgrade of PROM will fail !!!
 
Beginning erase of 0x80000 bytes at offset 0x3f80000... Done!
 
Beginning write of prom (0x4e8ec bytes at offset 0x3f80000)...
 
This could take as little as 30 seconds or up to 2 minutes.
Please DO NOT RESET!
 
Success! The prom has been upgraded successfully.
System will reset itself and reboot in about 15
.
.(output truncated)
.
******** The system will autoboot now ********
 
 
config-register = 0x0102
Autobooting using BOOT variable specified file.....
 
Current BOOT file is --- bootflash:cat4000-i9s-mz.121-20.EW1
 
Rommon reg: 0x56000380
 
Running IOS...
 
Decompressing the image
################################################################################
################################################################################
################################################################################
################################################################################
################################################################################
#################################################################### [OK]
 

Step 8 Use the no boot system flash bootflash: file_name command to clear the BOOT command used to upgrade the ROMMON.

Switch# configure terminal
Switch(config)# no boot system flash bootflash:cat4000-ios-promupgrade-121_20r_EW1
Switch(config)# exit
Switch# write
Building configuration...
Compressed configuration from 3641 to 1244 bytes [OK]
Switch#

Step 9 Use the show version command to verify that the ROMMON has been upgraded.

Switch#show version
Cisco Internetwork Operating System Software
IOS (tm) Catalyst 4000 L3 Switch Software (cat4000-I9S-M), Version 12.1(20)EW, E
ARLY DEPLOYMENT RELEASE SOFTWARE (fc1)
TAC Support: http://www.cisco.com/tac
Copyright (c) 1986-2003 by cisco Systems, Inc.
Compiled Wed 22-Oct-03 23:42 by kellmill
Image text-base: 0x00000000, data-base: 0x00F56DDC
 
ROM: 12.1(20r)EW1
Dagobah Revision 86, Swamp Revision 28
 
Switch uptime is 0 day, 0 hour, 5 minutes
System returned to ROM by reload
System image file is "bootflash:cat4000-i9s-mz.121-20.EW1"
 
cisco WS-C4503 (XPC8245) processor (revision 7) with 524288K bytes of memory.
Processor board ID FOX06460YD8
Last reset from Reload
3 Ethernet/IEEE 802.3 interface(s)
51 FastEthernet/IEEE 802.3 interface(s)
2 Gigabit Ethernet/IEEE 802.3 interface(s)
403K bytes of non-volatile configuration memory.
 
Configuration register is 0x0102
 
Switch#
 

Step 10 Use the delete command to delete the PROM upgrade program from bootflash and the squeeze command to reclaim unused space.

The following example shows how to delete the cat4000-ios-promupgrade-121_20r_EW1 image from bootflash and reclaim unused space:

Switch# delete bootflash:cat4000-ios-promupgrade-121_20r_EW1
Switch# squeeze bootflash:
 
All deleted files will be removed, proceed (y/n) [n]? y
 
Squeeze operation may take some time, proceed (y/n) [n]? y
Switch#
 

Step 11 Use the show bootvar command to verify that the ROMMON upgrade program has been removed from the BOOT variable.

Switch#sh bootvar
BOOT variable = bootflash:cat4000-i9s-mz.121-20.EW1,1
CONFIG_FILE variable does not exist
BOOTLDR variable does not exist
Configuration register is 0x0102


 

The ROMMON has now been upgraded.

See the “Upgrading the Cisco IOS Software” section for instructions on how to upgrade the Cisco IOS software on your switch.

Upgrading the Cisco IOS Software


Caution To avoid actions that might make your system unable to boot, please read this entire section before starting the upgrade.

Before you proceed, observe the following rules for hostname:

  • Do not expect case to be preserved

Uppercase and lowercase characters look the same to many internet software applications. It may seem appropriate to capitalize a name the same way you might do in English, but conventions dictate that computer names appear all lowercase. For more information, refer to RFC 1178, Choosing a Name for Your Computer.

  • Must start with a letter and end with a letter or digit.
  • Interior characters can only be letters, digits, and hyphens; periods and underscores not allowed.
  • Names must be 63 characters or fewer; hostname of fewer than 10 characters is recommended.
  • On most systems, a field of 30 characters is used for the host name and the prompt in the CLI. Longer configuration mode prompts may be truncated.

To upgrade the Cisco IOS software on your Catalyst 4500 series switch, use this procedure:


Step 1 Download Cisco IOS Release 12.1(20)EW from Cisco.com, and place the image on a TFTP server in a directory that is accessible from the supervisor engine that is upgraded.

Step 2 Use the dir bootflash: command to ensure that there is sufficient space in Flash memory to store the promupgrade image. If there is insufficient space, delete one or more images, and then enter the squeeze bootflash: command to reclaim the space.

If you are using a CompactFlash card, use slot0: instead of bootflash.

Step 3 Download the software image into Flash memory using the copy tftp command.

The following example shows how to download the Cisco IOS software image cat4000-is-mz.121-12c.EW from the remote host 172.20.58.78 to bootflash:

Switch# copy tftp: bootflash:
Address or name of remote host [172.20.58.78]?
Source filename [cat4000-is-mz121_12c.EW]?
Destination filename [cat4000-is-mz.121-12c.EW]?
Accessing tftp://172.20.58.78/cat4000-is-mz.121-12c.EW...
Loading cat4000-is-mz.121-12c.EW from 172.20.58.78 (via
FastEthernet2/1):!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK - 6923388/13846528 bytes]
 
6923388 bytes copied in 72.200 secs (96158 bytes/sec)
Switch#
 

Step 4 Use the no boot system flash bootflash: file_name command to clear the cat4000-is-mz.121-8a.EW file and to save the BOOT variable.

The following example shows how to clear the BOOT variable:

Switch# configure terminal
Switch(config)# no boot system flash bootflash:cat4000-is-mz.121-8a.EW
Switch(config)# exit
Switch# write
Building configuration...
Compressed configuration from 3641 to 1244 bytes [OK]
Switch#
 

Step 5 Use the boot system flash command to add the Cisco IOS software image to the BOOT variable.

The following example shows how to add the cat4000-is-mz.121-12c.EW image to the BOOT variable:

Switch# configure terminal
Switch(config)# boot system flash bootflash:cat4000-is-mz.121-12c.EW
Switch(config)# exit
Switch# write
Building configuration...
Compressed configuration from 3641 to 1244 bytes [OK]
Switch#
 

Step 6 Use the config-register command to set the configuration register to 0x2102.

The following example show how to set the second least significant bit in the configuration register:

Switch# configure terminal
Switch(config)# config-register 0x2102
Switch(config)# exit
Switch# write
Building configuration...
Compressed configuration from 3723 to 1312 bytes [OK]
Switch#
 

Step 7 Enter the reload command to reset the switch and load the software.


Caution No intervention is necessary to complete the upgrade. To ensure a successful upgrade, do not interrupt the upgrade process by performing a reset, power cycle, or OIR of the supervisor, for at least five minutes.

The following example shows the output from a successful upgrade followed by a system reset:

Switch# reload
Rommon reg: 0x2B004180
 
Upgrading FPGA...
 
Decompressing the image
############## [OK]
 
*******************************************************
* *
* WS-X4014 FPGA Upgrade Utility For WS-X4014 Machines *
* *
* Copyright (c) 2002 by Cisco Systems, Inc. *
* All rights reserved. *
* *
**********************************************************
 
Image size = 483.944 KBytes
 
Maximum allowed size = 1023.75 KBytes
 
 
Upgrading your FPGA image... DO NOT RESET the system
unless instructed or upgrade of FPGA will fail !!!
 
Beginning erase of 0x100000 bytes at offset 0x3d00000... Done!
 
Beginning write of fpga image (0x78fb0 bytes at offset 0x3d00000)...
 
This could take as little as 30 seconds or up to 2 minutes.
Please DO NOT RESET!
 
Success! FPGA image has been upgraded successfully.
System will reset itself and reboot in about 15 seconds.
0
 
 
 
 
**********************************************************
* *
* Welcome to Rom Monitor for WS-X4014 System. *
* Copyright (c) 2002 by Cisco Systems, Inc. *
* All rights reserved. *
* *
**********************************************************
 
Rom Monitor Program Version 12.1(12r)EW
 
Board type 1, Board revision 5
Swamp FPGA revision 16, Dagobah FPGA revision 47
 
 
MAC Address : 00-30-85-XX-XX-XX
IP Address : 10.10.10.91
Netmask : 255.255.255.0
Gateway : 10.10.10.1
TftpServer : Not set.
Main Memory : 256 MBytes
 
***** The system will autoboot in 5 seconds *****
 
 
Type control-C to prevent autobooting.
Switch#
 

Step 8 Use the show version command to verify that the new Cisco IOS release is operating on the switch.


 

Limitations and Restrictions

These sections list the limitations and restrictions for the current release of Cisco IOS software on the Catalyst 4500 series switch.

All Supervisor Engines

  • When you enter the permit any any ? command you will observe the octal option, which is unsupported in Cisco IOS Release 12.2(54)SG.

CSCsy31324

  • A Span destination of fa1 is not supported.
  • The "keepalive" CLI is not supported in interface mode on the switch, although it will appear in the running configuration. This behavious has no impact on functionality.
  • TDR is only supported on interfaces Gi1/1 through Gi1/48, at 1000BaseT under open or shorted cable conditions. TDR length resolution is +/- 10 m. If the cable is less than 10 m or if the cable is properly terminated, the TDR result displays "0" m. If the interface speed is not 1000BaseT, an "unsupported" result status displays. TDR results will be unreliable for cables extended with the use of jack panels or patch panels.
  • The following guidelines apply to Fast UDLD:

Fast UDLD is disabled by default.

Configure fast UDLD only on point-to-point links between network devices that support fast UDLD.

You can configure fast UDLD in either normal or aggressive mode.

Do not enter the link debounce command on fast UDLD ports.

Configure fast UDLD on at least two links between each connected network device. This reduces the likelihood of fast UDLD incorrectly error disabling a link due to false positives.

Fast UDLD does not report a unidirectional link if the same error occurs simultaneously on more than one link to the same neighbor device.

  • A XML-PI specification file entry does not return the desired CLI output.

The outputs of certain commands, such as show ip route and show access-lists, contain non-deterministic text. While the output is easily understood, the output text does not contain strings that are consistently output. A general purpose specification file entry is unable to parse all possible output.

Workaround (1):

While a general purpose specification file entry may not be possible, a specification file entry might be created that returns the desired text by searching for text that is guaranteed to be in the output. If a string is guaranteed to be in the output, it can be used for parsing.

For example, the output of the show ip access-lists SecWiz_Gi3_17_out_ip command is this:

Extended IP access list SecWiz_Gi3_17_out_ip
10 deny ip 76.0.0.0 0.255.255.255 host 65.65.66.67
20 deny ip 76.0.0.0 0.255.255.255 host 44.45.46.47
30 permit ip 76.0.0.0 0.255.255.255 host 55.56.57.57
 

The first line is easily parsed because access list is guaranteed to be in the output:

<Property name="access list" alias="Name" distance="1.0" length="-1" type="String" />
 

The remaining lines all contain the term host. As a result, the specification file may report the desired values by specifying that string. For example, this line

<Property name="host" alias="rule" distance="s.1" length="1" type="String" />
 

will produce the following for the first and second rules

<rule>
deny
</rule>
 

and the following for the third statement

<rule>
permit
<rule>
 

Workaround (2):

Request the output of the show running-config command using NETCONF and parse that output for the desired strings. This is useful when the desired lines contain nothing in common. For example, the rules in this access list do not contain a common string and the order (three permits, then a deny, then another permit), prevent the spec file entry from using permit as a search string, as in the following example:

Extended MAC access list MACCOY
permit 0000.0000.ffef ffff.ffff.0000 0000.00af.bcef ffff.ff00.0000 appletalk
permit any host 65de.edfe.fefe xns-idp
permit any any protocol-family rarp-non-ipv4
deny host 005e.1e5d.9f7d host 3399.e3e1.ff2c dec-spanning
permit any any
 

The XML output of show running-config command includes the following, which can then be parsed programmatically, as desired:

<mac><access-list><extended><ACLName>MACCOY</ACLName></extended></access-list></mac>
<X-Interface> permit 0000.0000.ffef ffff.ffff.0000 0000.00af.bcef ffff.ff00.0000 appletalk</X-Interface>
<X-Interface> permit any host 65de.edfe.fefe xns-idp</X-Interface>
<X-Interface> permit any any protocol-family rarp-non-ipv4</X-Interface>
<X-Interface> deny host 005e.1e5d.9f7d host 3399.e3e1.ff2c dec-spanning</X-Interface>
<X-Interface> permit any any</X-Interface>
 
  • Although the Catalyst 4500 series switch still supports legacy 802.1X commands used in Cisco IOS Release 12.2(46)SG and earlier releases (that is, they are accepted on the CLI), they do not display in the CLI help menu.
  • Current IOS software cannot support filenames exceeding 64 characters.
  • All software releases support a maximum of 32,768 IGMP snooping group entries.
  • For any configuration where the source-interface keyword is used, if you provide an SVI that is associated with a secondary private VLAN, configuration involving the secondary VLAN may be lost when the switch is reloaded. In such scenarios, always use the primary private VLAN.

For Supervisor Engines II+Plus through V-10GE

  • For the IP Unnumbered feature, the following are not supported:

Dynamic routing protocols

HSRP/VRRP

Static ARP

Unnumbered interface and numbered interface in different VRFs

  • For WCCP version 2, the following are not supported:

GRE encapsulation forwarding method

Hash bucket based assignment method

Redirection on an egress interface (redirection out)

Redirect-list ACL

  • For IPX software routing, the following are not supported:

NHRP (Next Hop Resolution Protocol)

NLSP

Jumbo Frames

  • For AppleTalk software routing, the following are not supported:

AURP

AppleTalk Control Protocol for PPP

Jumbo Frames

EIGRP

  • For the NetFlow feature, the following limitations apply:

NetFlow will not account for control packets, packets that encountered link-level errors, and ARP/RARP packets.

The software cache for NetFlow is fixed, users cannot change the size.

The statistical distribution row that displays the distribution across various packet sizes is not available.

  • For the PBR feature, the following limitations apply:

Packet length-based matching policies are not supported.

IP Precedence, TOS and Qos groups are fixed.

ACL/Route-map statistics are not updated.

  • IGRP is not supported (use EIGRP instead).
  • The MAC address table is cleared when you switch between supervisor engines if either the 802.1s or 802.1w Spanning Tree Protocol is configured. To minimize address clearing and subsequent packet flooding, configure the edge ports as spanning-tree portfast and the link type as
    spanning-tree link-type point-to-point.
  • While running NSF and IS-IS IETF mode, if you enter the issu runversion command within 5 minutes of entering the issu loadversion command, packet loss may occur during an ISSU upgrade.

Workaround: Configure the NSF interval timer to 0 minutes, or delay entering the issu runversion command until the NSF interval timer expires and NSF restarts.

  • Routes may not be properly redistributed from one routing protocol to another when NSF is enabled on the switch. The success of the redistribution depends on the order in which the routing protocols converge after an NSF switchover.

Workaround: None.

  • IP classful routing is not supported; do not use the no ip classless command; it will have no effect because only classless routing is supported. The ip classless command is not supported because classless routing is enabled by default.
  • The Catalyst 4510R switch does not support Supervisor Engines II-Plus, III, IV, and II-Plus-10GE. Installing an unsupported supervisor engine causes unpredictable hardware behavior that cannot be controlled by the software. Using an unsupported supervisor engine in a redundant slot might cause a supported supervisor engine in the other slot to malfunction.
  • Supervisor Engine II-Plus cannot read a CompactFlash card formatted by Supervisor Engine III or Supervisor Engine IV in a prior release.
  • Catalyst 4500 supervisor engines will not be properly initialized if the VLAN configuration in the startup file does not match the information stored in the VLAN database file. This situation might occur if a backup configuration file was used.
  • A Layer 2 LACP channel cannot be configured with the spanning tree PortFast feature.
  • Netbooting using a boot loader image is not supported. See the “Troubleshooting” section for alternatives.
  • You cannot downgrade to Cisco IOS Release 12.1(8a)EW1 after running Release 12.1(13)EW (or higher). If you need to downgrade, contact your TAC representative for further instructions, and mention caveat CSCdz59058.
  • Observe the following standard Cisco IOS software behavior when deploying redundant supervisor engines in a Catalyst 4507R chassis: While the startup configuration file is being parsed, the configuration file is not applied to hardware that does not exist.

For example, if the active supervisor engine is in slot 1, and you have configured interface Gi1/1, the supervisor engine in slot 2 becomes active if you remove the active supervisor engine from the chassis. In addition, while the startup configuration file is being parsed, you will receive an error message indicating that interface Gi1/1 is no longer present. This behavior is correct. When the formerly active supervisor engine is reinserted into slot 1, there is no configuration for interface Gi1/1.

This situation does not occur when both supervisor engines are present in the chassis.

Workaround: Copy the startup configuration file into the running configuration:

Switch# copy startup-config running-config
 
  • An unsupported default CLI for mobile IP is displayed in the HSRP configuration. Although this CLI will not damage your system, you might want to remove it to avoid confusion.

Workaround: Display the configuration with the show standby command, then remove the CLI. Here is an example of the show standby GigabitEthernet1/1 command output:

switch(config)# interface g1/1
switch(config)# no standby 0 name (0 is hsrp group number)
 
  • For HSRP preempt delay to function consistently, you must use the standby delay minimum command. Be sure to set the delay to more than 1 hello interval, which ensures that a hello is received before HSRP leaves the initiate state.

Use the standby delay reload option if the router is rebooting after reloading the image.

  • When you attempt to run OSPF between a Cisco router and a third-party router, the two interfaces might get stuck in the Exstart/Exchange state. This problem occurs when the maximum transmission unit (MTU) settings for neighboring router interfaces do not match. If the router with the higher MTU sends a packet larger than the MTU set on the neighboring router, the neighboring router ignores the packet.

Workaround: Because the problem is caused by mismatched MTUs, you should change the MTU on either router to match the other’s MTU.

  • You can run .1q-in-.1q packet passthrough with a Supervisor Engine III and a Supervisor Engine IV, but you can run only .1q-in-.1q encapsulation with a Supervisor Engine II+10GE, Supervisor Engine V, and Supervisor Engine V-10GE.
  • For PVST and Catalyst 4500 E-Series switch VLAN, Cisco IOS Release 12.1(13)EW supports a maximum of 3000 spanning tree port instances. If you want to use more instances, use MST rather than PVST.
  • Only ports 1 and 2 on the WS-X4418-GB module and ports 13 and 14 on the WS-X4412-2GB-T module can be set as ISL trunks.
  • If an original packet is dropped due to transmit queue shaping or sharing configurations, a SPAN packet copy can still be transmitted on the SPAN port.
  • For all software releases, do not use over 100,000 routes.
  • Use the no ip unreachables command on all interfaces with ACLs configured for performance reasons.
  • Layer 3 path load-balancing metrics are not supported in Cisco IOS Releases 12.1(8a)EW, 12.1(11b)EW, 12.1(12c)EW, 12.1(13)EW, 12.1(19)EW, and 12.1(20)EW. (CSCdv10578)
  • The threshold for the Dynamic ARP Inspection err-disable function is set to 15 ARP packets per second per interface. You should adjust this threshold depending on the network configuration. The CPU should not receive DHCP packets at a sustained rate greater than 1000 pps.
  • A limited number of ACL bindings are dynamically installed by the IP source guard feature on a Catalyst 4500 series switch Supervisor Engine II-Plus. To take full advantage of the IP source guard feature, you should use Supervisor Engine IV.
  • If you first configure an IP address or IPv6 address on a Layer 3 port, then change the Layer 3 port to a Layer 2 port with the switchport command, and finally change it back to a Layer 3 port, the original IP/IPv6 address is lost.
  • By default, IPv6 is not enabled. To route IPv6, you must enter the IPv6 unicast-routing command. If you plan to use IPv6 multicast routing, use the IPv6 multicast-routing command.
  • By default, CEF is not enabled for IPv6 (after IPv6 unicast routing is enabled). To prevent IPv6 traffic from being process-switched, use the IPv6 cef command.
  • Multicast sources in community VLANs are not supported.
  • Two-way community VLANs are not supported.
  • Voice VLANs are not supported on community VLAN host interfaces.
  • Private VLAN trunks do not carry community VLANs.
  • When you use private VLANs on the WS-4516 module, old ARP entries will not tim eout of the ARP cache if you do not manually clear the entry. This event has no affect on production.
  • Compact flash formatted in Cisco IOS Release 12.2(20)EW should be reformatted in Release 12.2(25)EW on both Supervisor Engine V-10GE and non-Supervisor V-10GE systems. Compact flash formatted on any other release does not need to be reformatted on non-Supervisor Engine V-10GE systems.
  • In a redundant system, do not remove and reinsert the standby supervisor engine while the active supervisor engine is booting up. Doing so may cause a failure in the online diagnostics test.

Workaround: Remove and reinsert the standby supervisor engine after the active supervisor engine boots. (CSCsa66509)

  • When used in conjunction with a 10-slot chassis, Supervisor Engine V only supports the
    Catalyst 4500 series two-port Gigabit Ethernet line card (WS-X4302-GB) in the 10th slot.
  • The maximum number of unique private VLAN pairs supported by the
    switchport private-vlan mapping trunk command is 500. For example, one thousand secondary VLANs could map to one primary VLAN, or one thousand secondary VLANs could map one to one to one thousand primary VLANs.
  • Support for PoE depends on the use of line cards and power supplies that support PoE.

PoE switching modules:

WS-X4148-RJ45V

WS-X4224-RJ45V

WS-X4248-RJ45V

WS-X4248-RJ21V

WS-X4524-GB-RJ45V

WS-X4548-GB-RJ45V

'WS-X4548-GB-RJ45V+

PoE-enabled power supplies:

PWR-C45-1300ACV

PWR-C45-1400DC

PWR-C4K-2800AC

PWR-C45-1400AC

PWR-C45-1300ACV

'PWR-C45-6000ACV'

  • The maximum number of mappings for configuring PVLAN promiscuous trunk ports is 500 primary VLANs to 500 secondary VLANs.
  • The 802.1X inaccessible authentication bypass feature is not supported with the NAC LAN port IP feature.
  • Changes to the console speed in line console 0 configuration mode do not affect console speed in ROMMON. To apply the same console speed in ROMMON, use the confreg ROMMON utility.
  • Supervisor Engine II-Plus does not support compact flashes formatted by an Cisco IOS image prior to Cisco IOS Release 12.2(19)EW.
  • If a Catalyst 4500 series switch requests information from the Cisco Secure Access Control Server (ACS) and the message exchange times out because the server does not respond, a message similar to following appears:
00:02:57: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.20.246.206:1645,1646 is not responding.
 

If this message appears, verify that the switch is connected to the ACS. You should also ensure that the switch has been properly configured as an AAA client on the ACS.

  • The bgp shutdown command is not supported in BGP router configuration mode. Entering this command might produce unexpected results.
  • A spurious error message appears when an SSH connection disconnects after an idle timeout.

Workaround: Disable idle timeouts. (CSCec30214)

  • Interfaces on the module WS-X4148-RJ45V may not establish a link with a Daiden DN-2800G media converter when both the switch and the media converter interfaces are configured to operate at 100 Mbps and full duplex. This situation occurs when the interface on the module is configured to automatically detect and power up devices inline with the power inline auto command. This caveat appears in all software releases.

Workarounds:

1. Disable inline power on the switch ports using the power inline never command.

2. Configure the media converter to autonegotiate the speed and duplex instead of running them at 100 Mbps and full duplex. (CSCee62109)

  • IPSG for static hosts supports the same port mode as IPSG except that it does not support trunk port:

It supports Layer 2 access port and PVLAN host port (isolated or community port).

It does not support trunk port, Layer 3 port, or EtherChannel.

  • IPSG for static hosts should not be used on uplink ports.
  • Selective DBL is only supported for non-tagged or single-tagged IP packets. To achieve Selective DBL-like functionality with a non-IP packet (like Q-in-Q and IPX), apply an input policy map that matches CoS values and specifies DBL in the class map.
  • For Selective DBL, if the topology involves Layer 2 Q in Q tunneling, the match cos policy map will apply to the incoming port.
  • If a set of DSCP values are already configured (for example, 0-30, 0-63), specifying a subset of these DSCP values with the qos dbl dscp-based 0-7 command will not remove the unwanted DSCP values of 8 through 63. You must use the no form of the command to remove the extraneous values. In this case, the no qos dbl dscp-based 8-63 command will leave 0-7 selected.
  • When you use Port Security with Multi Domain Authentication (MDA) on an interface:

Allow for at least three MAC addresses to access the switch: two for the phone (the MAC address of a phone gets registered to the Data domain and Voice domain), and one for the PC.

Ensure that the data and voice VLAN IDs differ.

  • For IP Port Security (IPSG) for static hosts, the following apply:

As IPSG learns the static hosts on each interface, the switch CPU may achieve 100 percent if there are a large number of hosts to learn. CPU usage will drop after the hosts are learned.

IPSG violations for static hosts are printed as they occur. If multiple violations occur simultaneously on different interfaces, the CLI displays the last violation. For example, if IPSG is configured for 10 ports and violations exist on ports 3, 6, and 9, the violation messages are printed only for port 9.

Inactive host bindings will appear in the device tracking table when either a VLAN is associated with another port or a port is removed from a VLAN. So, as hosts are moved across subnets, the hosts appear in the device tracking table as Inactive.

Autostate SVI does not work on EtherChannel.

  • With the resolution of CSCsg08775, a GARP ACL entry is no longer part of the Static CAM area. However, a system-defined GARP class in Control Plane Policing (CPP) still exists.
  • Certain configurations on the Catalyst 4507R and Catalyst 4510R chassis exceed the available maximum data power. These configurations include a combination of the follow PIDs:

Seven-slot configuration

Chassis WS-C4507R-E, WS-C4510R-E

Dual supervisor WS-X45-Sup6-E

One or more of the models WS-X4448-GB-RJ45 or WS-X4148-FX-MT

To maximize the 10/100/1000 port density of 7- and 10-slot chassis when using redundant Supervisor Engine 6-E, install WS-X4548-GB-RJ45 instead of WS-X4448-GB-RJ45 line cards. If you require WS-X4448-GB-RJ45 line cards, two options are available:

Option 1

Only four line card slots can be used on the Catalyst 4507R and six line card slots on the
Catalyst 4510R chassis.

Option 2

When all slots are required, only one model WS-X4448-GB-RJ45 line card can be used.

To maximize the 100-BASE-FX port density of 7 and 10 slot chassis when using Supervisor Engine 6-E install WS-4248-FE-SFP line cards with FX optics instead of WS-X4148-FX-MT line cards. If WS-X4148-FX-MT line cards are required, two options are available:

Option 1

You can use only 4 linecard slots on the Cat4507R chassis and 6 line card slots on the Cat4510R chassis.

Option 2

When all slots are required, you can only use one WS-X4448-GB-RJ45 line card.

  • When IPv6 is enabled on an interface through any CLI, you might see the following message:
% Hardware MTU table exhausted
 

In such a scenario, the IPv6 MTU value programmed in hardware differs from the IPv6 interface MTU value. This will happen if no room exists in the hardware MTU table to store additional values.

To create room in the table, unconfigure some unused MTU values. Then, either disable or reenable IPv6 on the interface, or reapply the MTU configuration.

  • To stop IPSG with static hosts on an interface, use the following commands in interface configuration submode:
Switch(config-if)# no ip verify source
Switch(config-if)# no ip device tracking max
 

To enable IPSG with static hosts on a port, enter the following commands:

Switch(config)# ip device tracking ****enable IP device tracking globally
Switch(config)# ip device tracking max <n> ***set an IP device tracking maximum on int
Switch(config-if)# ip verify source tracking [port-security] ****activate IPSG on port

Caution If you configure the ip verify source tracking [port-security] interface configuration command on a port without enabling IP device tracking globally or setting an IP device tracking maximum on that interface, IPSG with static hosts reject all the IP traffic from that interface.


NoteThe preceding condition also applies to IPSG with static hosts on a PVLAN host port.


  • You must disable hardware control plane policing by removing the system-cpp-policy named ACL from the controlplane before performing an ISSU upgrade between Cisco IOS Release 12.2(40)SG and a previous release. You cannot detach system-cpp-policy named ACL from the controlplane in previous releases. If you are running a previous release, you must first upgrade to the latest maintenance release in the Cisco IOS Release 12.2(31) SGAx while performing an ISSU upgrade to Cisco IOS Release 12.2(40)SG.
  • On a Supervisor Engine V-10GE (WS-X4516-10GE), if a startup configuration with a new uplink mode is copied into flash memory and the system is power cycled, the system will not start with the new uplink mode. After you copy the startup configuration with the new uplink mode into flash memory, you must change the uplink mode to the new uplink mode through the command interface before the system is power cycled. This ensures that the system starts in the new uplink mode.
  • When you use Supervisor Engine V in a Catalyst 4510R or 4510R-E chassis, slot 10 (FlexSlot) only supports the following linecards: the two-port GBIC (WS-X4302-GB) and the Access Gateway Module (WS-X4604-GWY). Supervisor Engine V-10GE has this same restriction when you configure its uplink select mode to all. Supervisor Engine V-10GE supports all Catalyst 4500 Series linecards in slot 10 when its uplink select mode is configured as tengigabitethernet or gigabitethernet. Supervisor Engine 6-E supports all Catalyst 4500 series linecards in slot 10.
  • Prior to Cisco IOS Release 12.2(50)SG, on switches with Supervisor Engines V, V-10GE and earlier, class-map hit statistics on a user defined class-map in system-cpp-policy are not updated properly. With Cisco IOS Release 12.2(50)SG, the hit statistics for user-defined class-map in the system-cpp-policy are updated properly. However, in per-vlan capture mode, the hit stats for system defined in system-cpp-policy are not updated. In the global capture mode, hit stats for all class-maps (user-defined and system-defined) in the system-cpp-policy are updated properly.
  • If you use MDA or multi-auth host mode in conjunction with pre-authentication open access, a switch ignores unicast EAPOL responses.

Workarounds:

Force the supplicant to use multicast EAPOL.

Avoid authentication open mode

CSCtq33048

For Supervisor Engine 6-E and Supervisor Engine 6L-E

  • The Catalyst 4510R switch does not support Supervisor Engines 6L-E. Installing an unsupported supervisor engine causes unpredictable hardware behavior that cannot be controlled by the software. Using an unsupported supervisor engine in a redundant slot might cause a supported supervisor engine in the other slot to malfunction.
  • The MAC address table is cleared while you switch between supervisor engines if either the 802.1s or 802.1w Spanning Tree Protocol is configured. To minimize address clearing and subsequent packet flooding, configure the edge ports as spanning-tree portfast and the link type as spanning-tree link-type point-to-point.
  • IP classful routing is not supported; do not use the no ip classless command; it will have no effect, because only classless routing is supported. The command ip classless is not supported because classless routing is enabled by default.
  • A Layer 2 LACP channel cannot be configured with the spanning tree PortFast feature.
  • Netbooting using a boot loader image is not supported. See the “Troubleshooting” section for alternatives.
  • When you deploy redundant supervisors in a Catalyst 4507R, for hardware that does not exist while the startup configuration file is being parsed, the configuration file for the hardware is not applied.

For example, if the active supervisor engine is in slot 1, and you have configured interface Gi1/1, the supervisor engine in slot 2 becomes active if you remove the active supervisor engine from the chassis. In addition, while the startup configuration file is being parsed, you will receive an error message indicating that interface Gi1/1 is no longer present. This behavior is correct. When the formerly active supervisor engine is reinserted into slot 1, there is no configuration for interface Gi1/1.

This situation will not occur when both supervisor engines are physically in the chassis.

Workaround: Copy the startup configuration file into the running configuration:

Switch# copy startup-config running-config
 
  • An unsupported default CLI for mobile IP is displayed in the HSRP configuration. Although this CLI will not harm your system, you might want to remove it to avoid confusion.

Workaround: Display the configuration with the show standby command, then remove the CLI. Here is an example of show standby GigabitEthernet1/1 command output:

switch(config)# interface g1/1
switch(config)# no standby 0 name (0 is hsrp group number)
 
  • For HSRP preempt delay to function consistently, you must use the standby delay minimum command. Be sure to set the delay to more than 1 hello interval, thereby ensuring that a hello is received before HSRP leaves the initiate state.

Use the standby delay reload option if the router is rebooting after reloading the image.

  • When you attempt to run OSPF between a Cisco router and a third party router, the two interfaces might get stuck in the Exstart/Exchange state. This problem occurs when the maximum transmission unit (MTU) settings for neighboring router interfaces do not match. If the router with the higher MTU sends a packet larger than the MTU set on the neighboring router, the neighboring router ignores the packet.

Workaround: Ensure that the MTUs match.

  • You can run only .1q-in-.1q packet pass-through with Supervisor Engine 6-E.
  • For PVST and Catalyst 4500 E-Series switch VLAN, Cisco IOS Release 12.1(13)EW support a maximum of 3000 spanning tree port instances. If you want to use more instances, use MST rather than PVST.
  • Because the Supervisor Engine 6-E supports the FAT filesystem, the following restrictions apply:

The verify and squeeze commands are not supported.

The rename command is supported in FAT file system.

For Supervisor Engine 6-E, the rename command is available for bootflash and slot0. For all other supervisor engines, the rename command is supported for nvram devices only.

The fsck command is supported for slot0 device. It is not supported in the file systems on supervisor engines other than 6-E.

In the FAT file system, the IOS format bootflash: command erases user files only. It does not erase system configuration.

The FAT file system supports a maximum of 63 characters for file/directory name. The maximum for path length is 127 characters.

The FAT file system does not support the following characters in file/directory names:{}#%^ and space characters.

The FAT file system honors the Microsoft Windows file attribute of read-only and read-write, but it does not support the Windows file hidden attribute.

Supervisor Engine 6-E uses the FAT file system for compact flash (slot0). If a compact flash is not formatted in FAT file system (such as compact flash on a supervisor engine other than 6-E), the switch does not recognize it.

  • If an original packet is dropped because of transmit queue shaping or sharing configurations, a SPAN packet copy can still be transmitted on the SPAN port.
  • All software releases support a maximum of 16,000 IGMP snooping group entries.
  • To maximize performance, use the no ip unreachables command on all interfaces that are configured for ACLs.
  • The threshold for the Dynamic Arp Inspection err-disable function is set to 15 ARP packets per second per interface. You should adjust this threshold depending on the network configuration. The CPU should not receive DHCP packets at a sustained rate greater than 1000 pps.
  • If you first configure an IP address or IPv6 address on a Layer 3 port, then change the Layer 3 port to a Layer 2 port with the switchport command, and finally change it back to a Layer 3 port, the original IP/IPv6 address is lost.
  • In a redundant system, do not remove and reinsert the standby supervisor engine while the active supervisor engine is booting. Doing so may cause the online diagnostics test to fail.

Workaround: Remove and reinsert the standby supervisor engine after the active supervisor engine boots. (CSCsa66509)

  • The switchport private-vlan mapping trunk command supports a maximum of 500 unique private VLAN pairs. For example, 500 secondary VLANs could map to one primary VLAN, or 500 secondary VLANs could map to 500 primary VLANs.
  • Support for PoE depends on the use of the following line cards and power supplies.

PoE switching modules:

WS-X4148-RJ45V

WS-X4224-RJ45V

WS-X4248-RJ45V

WS-X4248-RJ21V

WS-X4524-GB-RJ45V

WS-X4548-GB-RJ45V

WS-X4648-RJ45V-E

WS-X4648-RJ45V+E

WS-X4548-GB-RJ45V+

PoE enabled power supplies:

PWR-C45-1300ACV

PWR-C45-1400DC

PWR-C4K-2800AC

PWR-C45-1400AC

PWR-C45-1300ACV

PWR-C45-6000ACV

  • If a Catalyst 4500 series switch requests information from the Cisco Secure Access Control Server (ACS) and the message exchange times out because the server does not respond, a message similar to this appears:
00:02:57: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.20.246.206:1645,1646 is not responding.
 

If this message appears, ensure network connectivity exists between the switch and the ACS. Also check that the switch has been properly configured as an AAA client on the ACS.

  • For IP Port Security (IPSG) for static hosts, the following apply:

As IPSG learns the static hosts on each interface, the switch CPU may achieve 100 percent if there are a large number of hosts to learn. The CPU usage will drop after the hosts are learned.

IPSG violations for static hosts are printed as they occur. If multiple violations occur simultaneously on different interfaces, the CLI displays the last violation. For example, if IPSG is configured for 10 ports and violations exist on ports 3,6, and 9, the violation messages are printed only for port 9.

Inactive host bindings will appear in the device tracking table when either a VLAN is associated with another port or a port is removed from a VLAN. So, as hosts are moved across subnets, the hosts appear in the device tracking table as inactive.

Autostate SVI does not work on EtherChannel.

  • When IPv6 is enabled on an interface with any CLI, you might see the following message:
% Hardware MTU table exhausted
 

In such a scenario, the IPv6 MTU value programmed in hardware differs from the IPv6 interface MTU value. This occurs if no room exists in the hardware MTU table to store additional values.

To create room, unconfigure some unused MTU values. Then, either disable or re-enable IPv6 on the interface, or reapply the MTU configuration.

  • To stop IPSG with static hosts on an interface, use the following commands in interface configuration submode:
Switch(config-if)# no ip verify source
Switch(config-if)# no ip device tracking max
 

To enable IPSG with static hosts on a port, enter the following commands:

Switch(config)# ip device tracking ****enable IP device tracking globally
Switch(config)# ip device tracking max <n> ***set an IP device tracking maximum on int
Switch(config-if)# ip verify source tracking [port-security] ****activate IPSG on port

Caution If you configure the ip verify source tracking [port-security] interface configuration command on a port without enabling IP device tracking globally or setting an IP device tracking maximum on that interface, IPSG with static hosts reject all the IP traffic from that interface.


NoteThe preceding condition also applies to IPSG with static hosts on a PVLAN host port.


  • uRPF supports up to four paths. If a packet arrives at one of the valid VLANs that is not programmed as one of the RPF VLAN in hardware, it is dropped. If traffic may arrive from any other interfaces without RPF configured, it can be switched.
  • Input and output ACLs cannot override or filter traffic received on an uRPF interface.
  • No CLI command exists to reflect uRPF drop packets during hardware switching. The sh ip traffic and show cef int commands do not reflect uRPF drops.
  • IPv6 ACL is not supported on a switchport. IPv6 packets cannot be filtered on switchports using any of the known methods: PACL, VACL, or MACLs.
  • Class-map match statements using match ip prec | dscp match only IPv4 packets, whereas matches performed with match prec | dscp match both IPv4 and IPv6 packets.
  • IPv6 QoS hardware switching is disabled if the policy-map contains IPv6 ACL and match CoS in the same class-map with the IPv6 access-list has any mask within the range /81 and /127. This situation causes forwarding packets to software, which efficiently disables the QoS.
  • When the following data-only Catalyst 4500 linecards are used in a Catalyst 4507R-E or 4510R-E chassis with Supervisor Engine 6-Es, the capacity of the power supply may be exceeded:

WS-X4148-FX-MT Cisco Catalyst 4500 Fast Ethernet Switching Module, 48-port 100BASE-FX (MT-RJ)

WS-X4448-GB-RJ45 Cisco Catalyst 4500 48-port 10/100/1000 Module (RJ-45)

The Catalyst 4503-E and Catalyst 4506-E have no caveats. The Catalyst 4507R-E configurations that use power supplies rated at 1400 W or above also have no caveats.

The following replacement switching modules will not exceed the power supply capacity for any Catalyst 4500-E chassis:

 

Recommended Replacement
Description

WS-X4148-FX-MT

WS-X4248-FE-SFP

Fast Ethernet, 48-port 100BASE-X (SFP)

WS-X4448-GB-RJ45

WS-X4548-GB-RJ45

Enhanced 48-port 10/100/1000 Module (RJ-45)

WS-X4448-GB-RJ45

WS-X4648-RJ45V-E

E-Series 48-port 802.3af PoE 10/100/1000 (RJ-45)

Refer to the Catalyst 4500 Series Module Installation Guide to determine the power requirements for all of the Catalyst 4500 linecards and the power capacities of the Catalyst 4500 power supplies.

  • Supervisor Engine 6-E only supports Catalyst 4500 Series linecards in slots 8-10.
  • If you remove a line card from a redundant switch and initiate an SSO switch-over, then reinsert the line card, all interfaces are shutdown. The remaining configuration on the original line card is preserved.

This situation only occurs if a switch reached SSO before you removed the line card.

  • On Supervisor Engine 6-E, upstream ports support flow control auto negotiation in 1G mode only, and flow control is forced in 10G mode. If the interface is configured to auto-negotiate the flow control, and the interface is operating in 10G mode, the system forces flow control to ON and does not auto-negotiate.
  • Supervisor Engine 6-E supports fast UDLD on a maximum of 32 ports.
  • With Cisco IOS Release 12.2(53)SG3 (and 12.2(54)SG), we changed the default behavior such that your single supervisor, RPR, or fixed configuration switch does not reload automatically. To configure automatic reload, you must enter the diagnostic fpga soft-error recover aggressive command. (CSCth16953)

Caveats

Caveats describe unexpected behavior in Cisco IOS releases. Caveats listed as open in a prior release are carried forward to the next release as either open or resolved.


NoteAll caveats in Release 12.4 also apply to the corresponding 12.1 E releases. Refer to the Caveats for Cisco IOS Release 12.4 publication at the following URL:

http://www.cisco.com/en/US/docs/ios/12_4/release/notes/124MCAVS.html



NoteFor the latest information on PSIRTS, refer to the Security Advisories on CCO at the following URL:

http://tools.cisco.com/security/center/publicationListing.x


Open Caveats for Cisco IOS Release 12.2(54)SG1

This section lists the open caveats for Cisco IOS Release 12.2(54)SG1:

  • In rare instances, when you are using MAC ACL-based policers, the output of the
    show policy-map interface fa6/1 command does not display the packets being matched:
Switch# show policy-map int fa6/1
 
Service-policy output: p1
 
Class-map: c1 (match-all)
0 packets <--------It stays at '0' despite of traffic being received
Match: access-group name fnacl21
police: Per-interface
Conform: 9426560 bytes Exceed: 16573440 bytes
 

Workaround: Verify that the MAC addresses being transmitted through the system are learned.

(CSCef01798)

  • After an SSO switchover, you may receive a “PM-4-PORT_INCONSISTENT” error message on the switch console if you enter the shutdown command, and then enter the no shutdown command on the port that is in UDLD disable state. This does not affect the switch; the port remains in UDLD disable state. Reentering the shutdown command, and then entering the no shutdown command on the same port will ensure that the error message does not reappear.

Workaround: None. (CSCeg48586)

  • When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.

If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.

If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.

On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.

Workaround: Reconnect. (CSCsb11964)

  • After upgrading to 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release. The following table reflects this change.

This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.

QueueID
Old QueueName
New QueueName

 

5

control-packet

control-packet

 

6

rpf-failure

control-packet

 

7

adj-same-if

control-packet

 

8

<unused queue>

control-packet

 

11

<unused queue>

adj-same-if

 

13

acl input log

rfp-failure

 

14

acl input forward

acl input log

Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:

Switch(config)# no monitor session n source cpu queue all rx
Switch(config)# monitor session n source cpu queue <new_Queue_Name>
 

(CSCsc94802)

  • To enable IP CEF (if it is disabled by hardware exhaustion), enter the ip cef distributed command.

Workaround: None. (CSCsc11726)

  • An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.

This situation could occur for these reasons:

A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.

The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.

Workarounds:

Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.

Configure the correct default gateway on the host side. (CSCse75660)

  • When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
    qos account layer2 encapsulation command.

Workaround: None. (CSCsg58526)

  • When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.

This does not affect performance.

Workaround: Enter the no shutdown command. (CSCsg27395)

  • When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.

Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693)

  • When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
%XDR-6-XDRINVALIDHDR: XDR for client (CEF push) dropped (slots:2 from slot:3 context:145 length:11) due to: invalid context
 

Workaround: None. This is an informational message. (CSCsi60898)

  • When you send traffic on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225 ms.

Workaround: None. (CSCsm30320)

  • An IP unnumbered configuration is lost after a switch reloads.

Workarounds: Do one of the following:

After a reload, copy the startup-config to the running-config.

Use a loopback interface as the target of the ip unnumbered command.

Change the CLI configuration so that during bootup the router port is created first.

(CSCsq63051)

  • In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
%PM-4-PORT_INCONSISTENT: STANDBY:Port is inconsistent:
 

Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)

  • VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, you will not see the VLAN updates on the other switches in the VTP domain.

Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)

  • When you remove a line card containing ports configured with IGMP snooping while booting a standby supervisor engine, the active supervisor engine does not synchronize this configuration to the standby supervisor engine as a part of a bulk synchronization. When you reinstall the line card, the configuration in the active and standby supervisor engines will differ.

Workaround: Do one of the following:

Reload the standby switch again with the line card in place.

Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.

(CSCsv44866)

  • After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
 

This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG

Workaround: None. (CSCsw14005)

  • The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.

If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.

Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661

  • Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.

Workaround: None. CSCsy72343

  • If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
    show policy-map interface command are wrong.

Workaround: None.

The queue transmit counters as well as the policing statistics (if any) are correct. CSCsz20149

  • On a wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.

This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.

Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.

The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.

CSCsz34522

  • On a Layer 2 port (that is, a switchport) of Siupervisor Engine II+ thru V-10GE, the
    |auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.

Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command. CSCta16492

  • When you run Cisco IOS Release 12.2(53)SG1, 12.2(50)SG6, or later releases and configure switchport block multicast on a switch, Layer 2 multicast is not blocked. IPv4 and IPV6 unknown multicast traffic is blocked.

Prior to Cisco IOS Release 12.2(53)SG1 and 12.2(50)SG6, the switchport block multicast command blocks IP Multicast, Layer 2 multicast, and broadcast traffic. (CSCta61825)

Workaround: None CSCtb30327

  • If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for a Catalyst 4900M switch, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.

Despite the different default value, you can configure any value in the time range.

Workaround: None. CSCte51948

  • If VLAN load balancing is progressing, and you reconfigure VLAN load balancing to reflect different blocking ports, manual preemption does not occur.

Workaround: Reconfigure VLAN load balancing with a different configuration, by performing the following task:

a. Reconfigure the VLAN load balancing configuration on the desired REP ports.

b. Use the shut command on any one REP port in the segment to cause a failure in that segment.

c. Use the no-shut on the same port to restore normal REP topology with one ALT port.

d. Invoke manual preemption on a primary edge port to obtain VLAN load balancing with the new configuration.

CSCsv69853

  • When you remove an SFP+ from a OneX converter in a X2 slot, it takes approximately 45 seconds for the system to recognize this action. During this time, all commands indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can cause a “duplicate seeprom” error message.

Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:

Enter any commands for that port.

Insert an SFP+ in that port.

Reinsert the removed SFP+ in any other port.

CSCsv90044

  • On a peer interface on a Catalyst 4948E Ethernet Switch, if errdisabled mode flap detection is set to a very small number (such as 2 flaps in 10 sec), a 10GE link flap may cause the peer interface to enter the errdisabled state.

Workarounds: The Cisco switch default link-flap detection value is 5 flaps in 10 seconds. Use the default value or larger numbers. CSCtg07677

  • If you disable and re-enable IGMP Snooping on a VLAN, the output of the show mac address command does not display the [term] Switch against the multicast entry. Multicast traffic is not impacted.

Workaround: Do shut, then no shut on the SVI. CSCtg72559

  • When a connected data device behind a phone disconnects from a port configured for multi-auth host mode, a new session for the device is restarted even though the device is absent.

The CDP TLV generated to indicate that a data device has disconnected is ignored. This is done to avoid disconnecting other connected data clients, if any. (Refer to CSCta47293.)

Workarounds: Enter either of the following commands:

clear authentication session interface

authentication timer inactivity

CSCtg83631

  • If an X2 or SFP is in an inactive uplink port on a Supervisor Engine V-10GE, Supervisor II+10GE, Supervisor 6-E, or Supervisor 6-LE, it may cause threshold violations to be reported once every 10 minutes.

Workaround: Remove the X2 or SFP from the port. CSCth08212

  • When Fallback WebAuth and Multi-host are configured on a port and no PACL exists, permit ip any any is installed in the TCAM and all traffic from the host is allowed to pass.

Workaround: Configure an ACL on the port. CSCte18760

  • After you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.

Similarly, the show epm sessions command always displays the authentication method as DOT1X.

Workaround: To view the authentication method used for a client, enter the
show authentication sessions command. CSCsx42157

  • With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with hardware control plane policing.

Workaround: None. (CSCso93282)

  • If host-mode multi-domain is configured and authorization succeeds, traffic may not pass from an IP phone or a data device.

Workaround: None. CSCtj56811

  • A switch may crash while loading BGP routes if the ip cef accounting non-recursive command is already configured.

Workaround: Disable the ip cef accounting non-recursive command.

(CSCtn68186)

  • When a switch is configured for MAC Authentication Bypass (MAB) EAP and the AAA server requests EAP-TLS (as the EAP method) first, MAB fails.

Workarounds:

Configure the switch port for mab rather than mab eap.

Configure the AAA server to propose EAP-MD5 first rather than EAP-TLS for MAB EAP requests. CSCti78674

Supervisor Engine 6-E and Supervisor Engine 6L-E Specific Caveats

  • A Catalyst 4500 series switch with Supervisor Engine 6-E supports a maximum of 32 MTU values system wide.

On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.

Workaround: None. (CSCsk52542)

  • Occasionally, if you use an X2 SR transceiver on a WS-X4706-10GE running
    Cisco IOS Release 12.2(40)SG, you observe CRC errors after a reload or power cycle upon inserting the card or X2.

Workaround: Reinsert the X2. (CSCsk43618)

  • If burst is not explicitly configured for a single rate policer, the show policy-map command displays an incorrect burst value.

Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)

  • When you enter the show policy-map vlan vlan command, unconditional marking actions that are configured on the VLAN are not shown.

Workaround: None.

If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)

  • Supervisor Engine II-Plus-TS in a Catalyst 4503-E chassis running ROMMON lists the chassis type as Unknown. After booting Cisco IOS, the chassis type is listed properly.

Workaround: None. (CSCsl72868)

  • Uplinks go down when you upgrade the ROMMON of an WS-X45-SUP6-E supervisor from version 0.34 to a later version.

This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.

Workarounds: To resume normal operation, do one of the following:

Reload both supervisor engines with the redundancy reload shelf command.

Power-cycle the standby supervisor engine by briefly pulling it from the chassis.

There is no workaround for the link flap issue. (CSCsm81875)

  • Changing the flow control configuration with traffic and pause frames causes some traffic loss.

This problem can happen when pause frames are sent to a switch port and the flow control receive configuration is toggled on a 10-Gigabit Ethernet port.

Workaround: Change the flow control receive configuration when no traffic exists. CSCso71647

  • If an EtherChannel is a member of a FlexLink pair, then static MAC addresses configured on the EtherChannel are not moved to the alternate port when the EtherChannel fails (FlexLink failure).

Workaround: None. (CSCsq99468)

  • When a CFM Inward Facing MEP (IFM) is configured on a VLAN that is not allocated on a switch port that is DOWN, the show ethernet cfm maintenance-points local command displays the
    IFM CC Status as inactive. When you allocate the VLAN, the CC-status remains inactive.

You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then later allocate the same VLAN.

Workaround: Unconfigure, and then reconfigure the IFM on the port.

  • When you configure vlan dot1q tag native globally on Supervisor Engine 6-E, MST control packets are tagged on egress on the native VLAN. This conflicts with 802.1s. The Cisco 7600 Series router drops its MST proposal agreements (because it expects the native VLAN MST control packets to be untagged), causing 30 seconds of traffic loss while spanning tree converges.

Workaround: Disable native VLAN tagging on the trunk port of the switch by entering the
no switchport trunk native vlan tag command. CSCsz12611

  • When CX1 or SFP+ is plugged into a OneX converter (CVR-X2-SFP10G) in a WS-X4908-10GE, the later requires 1 minute to boot the link.

Workaround: None. CSCtc46340

  • Before large PACLs are fully loaded in hardware, you might observe a false completion messages like the following:
Dec 1 18:44:59.926: %C4K_COMMONHWACLMAN-4-HWPROGSUCCESS: Input Security: pacl - now fully loaded in hardware *Dec 1 18:44:59.926: %C4K_COMMONHWACLMAN-4-ALLACLINHW: All configured ACLs now fully loaded in hardware - hardware switching / QoS restored.
 

Workaround: No functional impact.

You must wait for the ACLs to be programmed before performing other TCAM related changes. CSCtd57063

  • RA Guard counters are not incremented in the output of the show ipv6 first-hop counters interface command when Router Advertisement and Router Redirect packets with Destination address FF02::x are dropped.

Workaround: None. CSCtf69108

  • ND/NS packets are dropped when an IPv6 ACL is attached to an Layer 3 interface.

Workaround: Add the following permit ACEs to the ACL:

permit icmp any any nd-ns
permit icmp any any nd-na
 

CSCtg77035

  • A switch crashes when attaching a service-policy to a target, provided the service-policy contains more than 56 classes each with an explicit marking action, such as :
policy-map pm
class c0
set dscp default
set cos 0
class c1
set dscp 1
set cos 1
class c2
set dscp 2
set cos 2
... ...
class c56
set dscp cs7
set cos 0
 

Workaround: Use tablemap-based marking. CSC99836

Resolved Caveats in Cisco IOS Release 12.2(54)SG1

This section lists the resolved caveats in Release 12.2(54)SG1:

  • Catalyst 4500 series switches may lose the per-vlan maximum mac addresses for port-security when the link goes down. This applies to the following interface configuration :
switchport port-security maximum <number> vlan access
switchport port-security maximum <number> vlan voice
 

Workaround: None. CSCti74791

  • If no vtp is configured on ports that receive VTP updates, a switch no longer processes Layer 2 control traffic (STP and CDP).

Workaround: Upgrade to 12.2(53)SG3, 12.2(50)SG8, or later. CSCth00398

  • In a redundant chassis with numerous PoE linecards (WS-X4548-GB-RJ45V, WS-X4548-RJ45V+), undergoing a switchover, the CPU utilization exceeds 80 percent on the new active supervisor engine.

Note In a non-redundant chassis with the same PoE linecards , CPU utilization will not reach 80 percent.


This issue is not applicable to fixed config chassis.

Workaround: None. CSCti08570

  • A Supervisor Engine 6-E or Supervisor Engine 6L-E running cat4500e-ipbasek9-mz.122-53.SG1 might experience a reload because of interface flapping.

Workaround: None. CSCtf49878

  • When software reads the hardware status of a linecard before it fully initializes, a supervisor engine experiences a software-initiated crash.

Workaround: None. CSCtf82009

  • The Spanning Tree process disables VLAN on a trunk interface if it was configured for VLAN Mapping Translation.

Workaround: Configure spanning-tree bpdufilter enable in configuration interface mode.

CSCtj21636

  • When at least one 1:1 translation is configured, same to same VLAN mapping is disallowed. This impacts customers who want to switch packets on certain VLANs without VLAN Translation.

Workaround: None

CSCti22918

  • Pinging to SVI fails when VLAN mapping is configured (1 to 1 same VLAN and different VLAN mapping).

If you randomly add or remove VLANs in a VLAN database, SVI traffic stops on some VLANs.

Workaround: None. CSCtk03191

  • When the show ip ospf int command is paused while the backup designated router neighbor goes down, a switch may reload when you enter the show ip ospf int command:
c3560sw2# show ip ospf int
Vlan804 is up, line protocol is up
Internet Address 10.0.0.2/24, Area 0
Process ID 1, Router ID 10.0.0.2, Network Type BROADCAST, Cost: 1
Transmit Delay is 1 sec, State DR, Priority 1
Designated Router (ID) 10.0.0.2, Interface address 10.0.0.2
--More--
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8,
changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan804, changed
state to down
%OSPF-5-ADJCHG: Process 1, Nbr 10.0.0.1 on Vlan804 from FULL to DOWN,
Neighbor Down: Interface down or detached
%LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to down
 

The next line in the output of the show ip ospf int command is the following:

Backup Designated router (ID) 10.0.0.1, Interface address 10.0.0.1
 

If you now advance the output by pressing either Enter or the space bar, the device reloads and the following error message displays:

Unexpected exception to CPUvector 2000, PC = 261FC60
 

Workaround: None. CSCtd73256

  • The show tacacs+ command does not provide private tacacs+ server statistics.

Workaround: None. CSCta96363

  • A switch can crash with a Watchdog NMI Vector 000 and CRC error as follows:
"%C4K_SUPERVISOR-2-FPGASOFTERROR: Memory inconsistency detected" have
appeared on the switch followed by link flaps, transceiver (HAMM module, X2,
sfp) insertion/removal on uplinks (base board ports on 4900M)
 

Workarounds:

Reload the switch when the error message displays.

Upgrade to Cisco Catalyst Release 12.2(54)SG1, Cisco Catalyst Release 12.2(53)SG4 (and later), when available.

CSCtk75675

Open Caveats for Cisco IOS Release 12.2(54)SG

This section lists the open caveats for Cisco IOS Release 12.2(54)SG:

  • In rare instances, when you are using MAC ACL-based policers, the output of the
    show policy-map interface fa6/1 command does not display the packets being matched:
Switch# show policy-map int fa6/1
 
Service-policy output: p1
 
Class-map: c1 (match-all)
0 packets <--------It stays at '0' despite of traffic being received
Match: access-group name fnacl21
police: Per-interface
Conform: 9426560 bytes Exceed: 16573440 bytes
 

Workaround: Verify that the MAC addresses being transmitted through the system are learned.

(CSCef01798)

  • After an SSO switchover, you may receive a “PM-4-PORT_INCONSISTENT” error message on the switch console if you enter the shutdown command, and then enter the no shutdown command on the port that is in UDLD disable state. This does not affect the switch; the port remains in UDLD disable state. Reentering the shutdown command, and then entering the no shutdown command on the same port will ensure that the error message does not reappear.

Workaround: None. (CSCeg48586)

  • When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.

If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.

If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.

On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.

Workaround: Reconnect. (CSCsb11964)

  • After upgrading to 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release. The following table reflects this change.

This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.

QueueID
Old QueueName
New QueueName

 

5

control-packet

control-packet

 

6

rpf-failure

control-packet

 

7

adj-same-if

control-packet

 

8

<unused queue>

control-packet

 

11

<unused queue>

adj-same-if

 

13

acl input log

rfp-failure

 

14

acl input forward

acl input log

Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:

Switch(config)# no monitor session n source cpu queue all rx
Switch(config)# monitor session n source cpu queue <new_Queue_Name>
 

(CSCsc94802)

  • To enable IP CEF (if it is disabled by hardware exhaustion), enter the ip cef distributed command.

Workaround: None. (CSCsc11726)

  • An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.

This situation could occur for these reasons:

A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.

The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.

Workarounds:

Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.

Configure the correct default gateway on the host side. (CSCse75660)

  • When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
    qos account layer2 encapsulation command.

Workaround: None. (CSCsg58526)

  • When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.

This does not affect performance.

Workaround: Enter the no shutdown command. (CSCsg27395)

  • When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.

Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693)

  • When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
%XDR-6-XDRINVALIDHDR: XDR for client (CEF push) dropped (slots:2 from slot:3 context:145 length:11) due to: invalid context
 

Workaround: None. This is an informational message. (CSCsi60898)

  • When you send traffic on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225 ms.

Workaround: None. (CSCsm30320)

  • An IP unnumbered configuration is lost after a switch reloads.

Workarounds: Do one of the following:

After a reload, copy the startup-config to the running-config.

Use a loopback interface as the target of the ip unnumbered command.

Change the CLI configuration so that during bootup the router port is created first.

(CSCsq63051)

  • In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
%PM-4-PORT_INCONSISTENT: STANDBY:Port is inconsistent:
 

Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)

  • VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, you will not see the VLAN updates on the other switches in the VTP domain.

Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)

  • When you remove a line card containing ports configured with IGMP snooping while booting a standby supervisor engine, the active supervisor engine does not synchronize this configuration to the standby supervisor engine as a part of a bulk synchronization. When you reinstall the line card, the configuration in the active and standby supervisor engines will differ.

Workaround: Do one of the following:

Reload the standby switch again with the line card in place.

Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.

(CSCsv44866)

  • After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
 

This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG

Workaround: None. (CSCsw14005)

  • The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.

If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.

Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661

  • Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.

Workaround: None. CSCsy72343

  • If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
    show policy-map interface command are wrong.

Workaround: None.

The queue transmit counters as well as the policing statistics (if any) are correct. CSCsz20149

  • On a wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.

This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.

Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.

The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.

CSCsz34522

  • On a Layer 2 port (that is, a switchport) of Siupervisor Engine II+ thru V-10GE, the
    |auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.

Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command. CSCta16492

  • When you run Cisco IOS Release 12.2(53)SG1, 12.2(50)SG6, or later releases and configure switchport block multicast on a switch, Layer 2 multicast is not blocked. IPv4 and IPV6 unknown multicast traffic is blocked.

Prior to Cisco IOS Release 12.2(53)SG1 and 12.2(50)SG6, the switchport block multicast command blocks IP Multicast, Layer 2 multicast, and broadcast traffic. (CSCta61825)

Workaround: None CSCtb30327

  • If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for a Catalyst 4900M switch, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.

Despite the different default value, you can configure any value in the time range.

Workaround: None. CSCte51948

  • If VLAN load balancing is progressing, and you reconfigure VLAN load balancing to reflect different blocking ports, manual preemption does not occur.

Workaround: Reconfigure VLAN load balancing with a different configuration, by performing the following task:

a. Reconfigure the VLAN load balancing configuration on the desired REP ports.

b. Use the shut command on any one REP port in the segment to cause a failure in that segment.

c. Use the no-shut on the same port to restore normal REP topology with one ALT port.

d. Invoke manual preemption on a primary edge port to obtain VLAN load balancing with the new configuration.

CSCsv69853

  • When you remove an SFP+ from a OneX converter in a X2 slot, it takes approximately 45 seconds for the system to recognize this action. During this time, all commands indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can cause a “duplicate seeprom” error message.

Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:

Enter any commands for that port.

Insert an SFP+ in that port.

Reinsert the removed SFP+ in any other port.

CSCsv90044

  • On a peer interface on a Catalyst 4948E Ethernet Switch, if errdisabled mode flap detection is set to a very small number (such as 2 flaps in 10 sec), a 10GE link flap may cause the peer interface to enter the errdisabled state.

Workarounds: The Cisco switch default link-flap detection value is 5 flaps in 10 seconds. Use the default value or larger numbers. CSCtg07677

  • If you disable and re-enable IGMP Snooping on a VLAN, the output of the show mac address command does not display the [term] Switch against the multicast entry. Multicast traffic is not impacted.

Workaround: Do shut, then no shut on the SVI. CSCtg72559

  • When a connected data device behind a phone disconnects from a port configured for multi-auth host mode, a new session for the device is restarted even though the device is absent.

The CDP TLV generated to indicate that a data device has disconnected is ignored. This is done to avoid disconnecting other connected data clients, if any. (Refer to CSCta47293.)

Workarounds: Enter either of the following commands:

clear authentication session interface

authentication timer inactivity

CSCtg83631

  • If an X2 or SFP is in an inactive uplink port on a Supervisor Engine V-10GE, Supervisor II+10GE, Supervisor 6-E, or Supervisor 6-LE, it may cause threshold violations to be reported once every 10 minutes.

Workaround: Remove the X2 or SFP from the port. CSCth08212

  • When Fallback WebAuth and Multi-host are configured on a port and no PACL exists, permit ip any any is installed in the TCAM and all traffic from the host is allowed to pass.

Workaround: Configure an ACL on the port. CSCte18760

  • After you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.

Similarly, the show epm sessions command always displays the authentication method as DOT1X.

Workaround: To view the authentication method used for a client, enter the
show authentication sessions command. CSCsx42157

  • With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with hardware control plane policing.

Workaround: None. (CSCso93282)

  • If host-mode multi-domain is configured and authorization succeeds, traffic may not pass from an IP phone or a data device.

Workaround: None. CSCtj56811

  • A switch may crash while loading BGP routes if the ip cef accounting non-recursive command is already configured.

Workaround: Disable the ip cef accounting non-recursive command.

(CSCtn68186)

  • When a switch is configured for MAC Authentication Bypass (MAB) EAP and the AAA server requests EAP-TLS (as the EAP method) first, MAB fails.

Workarounds:

Configure the switch port for mab rather than mab eap.

Configure the AAA server to propose EAP-MD5 first rather than EAP-TLS for MAB EAP requests. CSCti78674

Supervisor Engine 6-E and Supervisor Engine 6L-E Specific Caveats

  • A Catalyst 4500 series switch with Supervisor Engine 6-E supports a maximum of 32 MTU values system wide.

On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.

Workaround: None. (CSCsk52542)

  • Occasionally, if you use an X2 SR transceiver on a WS-X4706-10GE running
    Cisco IOS Release 12.2(40)SG, you observe CRC errors after a reload or power cycle upon inserting the card or X2.

Workaround: Reinsert the X2. (CSCsk43618)

  • If burst is not explicitly configured for a single rate policer, the show policy-map command displays an incorrect burst value.

Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)

  • When you enter the show policy-map vlan vlan command, unconditional marking actions that are configured on the VLAN are not shown.

Workaround: None.

If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)

  • Supervisor Engine II-Plus-TS in a Catalyst 4503-E chassis running ROMMON lists the chassis type as Unknown. After booting Cisco IOS, the chassis type is listed properly.

Workaround: None. (CSCsl72868)

  • Uplinks go down when you upgrade the ROMMON of an WS-X45-SUP6-E supervisor from version 0.34 to a later version.

This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.

Workarounds: To resume normal operation, do one of the following:

Reload both supervisor engines with the redundancy reload shelf command.

Power-cycle the standby supervisor engine by briefly pulling it from the chassis.

There is no workaround for the link flap issue. (CSCsm81875)

  • Changing the flow control configuration with traffic and pause frames causes some traffic loss.

This problem can happen when pause frames are sent to a switch port and the flow control receive configuration is toggled on a 10-Gigabit Ethernet port.

Workaround: Change the flow control receive configuration when no traffic exists. CSCso71647

  • If an EtherChannel is a member of a FlexLink pair, then static MAC addresses configured on the EtherChannel are not moved to the alternate port when the EtherChannel fails (FlexLink failure).

Workaround: None. (CSCsq99468)

  • When a CFM Inward Facing MEP (IFM) is configured on a VLAN that is not allocated on a switch port that is DOWN, the show ethernet cfm maintenance-points local command displays the
    IFM CC Status as inactive. When you allocate the VLAN, the CC-status remains inactive.

You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then later allocate the same VLAN.

Workaround: Unconfigure, and then reconfigure the IFM on the port.

  • When you configure vlan dot1q tag native globally on Supervisor Engine 6-E, MST control packets are tagged on egress on the native VLAN. This conflicts with 802.1s. The Cisco 7600 Series router drops its MST proposal agreements (because it expects the native VLAN MST control packets to be untagged), causing 30 seconds of traffic loss while spanning tree converges.

Workaround: Disable native VLAN tagging on the trunk port of the switch by entering the
no switchport trunk native vlan tag command. CSCsz12611

  • When CX1 or SFP+ is plugged into a OneX converter (CVR-X2-SFP10G) in a WS-X4908-10GE, the later requires 1 minute to boot the link.

Workaround: None. CSCtc46340

  • Before large PACLs are fully loaded in hardware, you might observe a false completion messages like the following:
Dec 1 18:44:59.926: %C4K_COMMONHWACLMAN-4-HWPROGSUCCESS: Input Security: pacl - now fully loaded in hardware *Dec 1 18:44:59.926: %C4K_COMMONHWACLMAN-4-ALLACLINHW: All configured ACLs now fully loaded in hardware - hardware switching / QoS restored.
 

Workaround: No functional impact.

You must wait for the ACLs to be programmed before performing other TCAM related changes. CSCtd57063

  • RA Guard counters are not incremented in the output of the show ipv6 first-hop counters interface command when Router Advertisement and Router Redirect packets with Destination address FF02::x are dropped.

Workaround: None. CSCtf69108

  • ND/NS packets are dropped when an IPv6 ACL is attached to an Layer 3 interface.

Workaround: Add the following permit ACEs to the ACL:

permit icmp any any nd-ns
permit icmp any any nd-na
 

CSCtg77035

  • A switch crashes when attaching a service-policy to a target, provided the service-policy contains more than 56 classes each with an explicit marking action, such as :
policy-map pm
class c0
set dscp default
set cos 0
class c1
set dscp 1
set cos 1
class c2
set dscp 2
set cos 2
... ...
class c56
set dscp cs7
set cos 0
 

Workaround: Use tablemap-based marking. CSC99836

Resolved Caveats in Cisco IOS Release 12.2(54)SG

This section lists the resolved caveats in Release 12.2(54)SG:

  • When you configure switchport block multicast on a switch running
    Cisco IOS Release 12.2(53)SG1 or 12.2(50)SG6, Layer 2 multicast is not blocked.

Prior to Cisco IOS Release 12.2(53)SG1, 12.2(50)SG6, the switchport block multicast command would block IP Multicast, Layer 2 multicast, and broadcast traffic .

Workaround: None. CSCta61825

  • If a host is authenticated in the data VLAN, the STP state of the VLAN is blocked.

Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.

The connected host is authenticated so it should be able to send traffic and the STP state should be forwarding.

Workaround: Enter shut, then no shut on the port. CSCta04665

  • When you request an on demand Call Home message send without specifying a profile name and the specified module returns an unknown diagnostic result, the following error message displays:
Switch# call-home send alert-group diagnostic module 2
Sending diagnostic info call-home message ...
Please wait. This may take some time ...
Switch#
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)
 

Workaround: Specify a profile name when you enter the diagnostic command.

You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules. CSCsz05888

  • When .1X with MDA is set in host mode and guest VLAN is enabled, when you forward traffic from a traffic generator at a high rate, a security violation is wrongly flagged.

Workaround: None. CSCsy38640

  • On a switch running Cisco IOS Release 12.2(54)SG, when the access VLAN is deleted and then restored on a port configured with 802.1X multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a disabled state after the access VLAN is restored.

Workaround: Shut down then reopen the interface. CSCso50921

  • When you configure ip source binding statically on an interface, and then remove the linecard on which the interface resides, the entries are not removed from the running configuration.

Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)

  • Performing a default interface operation on an interface with auto-QoS enabled results in an error message and the loss of the auto-QoS configuration. For example, the following sequence of operation results in a loss of the configuration:
config-if# auto qos voip cisco-phone
config# default interface interface-name
 

Workaround: Replace the default interface command with the following:

config# interface interface-number
config-if# switchport
 

(CSCsq47116)

  • Initially, REP configured with VLAN Load Balancing (VLB) works correctly. When you issue a force-switchover on the switch that has a port acting as the secondary ALT port, a loop is induced in the topology.

Workaround: Enter shut, then no-shut on any REP port (of the same segment in which VLB is configured) in the topology. (CSCsq75342)

  • IPv6 entries are active in the CAM; the CPU receives IPv6 packets.

Workaround: Unconfigure any generic QOS policies from the system. The QoS policies with the match any attribute cause IPv6 entries to become active. If the switch is a pure Layer 2 device, remove the generic protocol family attributes and narrow it to the protocol family. (CSCsq84796)

  • IPv6 MLD entries are active even if an IPv6 MLD related configuration does not exist.

Workaround: Unconfigure all generic QOS policies from the system. CSCsq84853

  • You observe a .05% loss on WS-X4908-10GE when sending traffic at 99% of the port capacity.

Workaround: None. CSCsl39767

  • Under some conditions, one or more flows continue to be dropped because of DBL even after DBL has been removed from the service-policy.

When an output service-policy is attached to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued to the queue are subjected to the DBL algorithm. If one or more flows are classified as belligerent (flows do not back-off in response to drops because of congestion in the queue), those flows continue to be classified as belligerent even when DBL is disabled on that queue.

For this condition to persist, the transmit queues in question must remain congested for a long period of time and that congestion must be caused by flows that remain belligerent.

Workaround: Detach and re-attach the service-policy, provided the queue in question is non-default (queuing actions are not configured in the class-default class of the policy-map).

If this occurs on the default queue, modify and reset some queuing parameters like bandwidth or shape. CSCsk62457

  • Control plane policing applied to DHCP traffic as identified by the system class-maps system-cpp-dhcp-cs, system-cpp-dhcp-sc, and system-cpp-dhcp-ss may not be effective.

Workaround: None. CSCsk67395)

  • A switch fails if you configure a PBR policy to match on prefix-list(s) instead of ACL(s).

Workaround: Configure the route map to only match on ACL(s). CSCtg22126

For the SFP+ optical modules SFP-10G-LRM, SFP-10G-LR, and SFP-10G-SRA, a Tx low power alarm displays when either IOS boots or you replace the module. This is an initial false alarm upon detection of a new SFP+ module; subsequently, it clears.

SFP and 10GBASE-CU SFP+ modules do not show this problem.

Workaround: None. CSCtg82213

  • If a third-party non-PoE device is connected to a WS-4648-RJ45V-E or WS-4648-RJ45V+E and PoE is enabled, when the device reboots, the link does not come up. An error message might display on the device.

Workaround: Disable PoE (through entering the power inline never command in interface configuration mode.

In Cisco IOS Release 12.2(54)SG, you can enter the power inline autoneg-advertise command in global config mode to enable linkup. CSCtb78851

  • On a redundant switch running Cisco IOS Release 12.2(52)SG, after a port is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.

The statistics are displayed properly on the active supervisor.

Workaround: None. CSCsx64308

  • Systems running Cisco IOS Release 12.2(40)SG do not support the handling of .1Q packets for software QoS lookup.

Workaround: None. (CSCsk66449)

  • When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.

Workaround: None. CSCsu35604

  • A switch crashes if a PBR policy, configured to match on prefix-list(s) instead of ACL(s), is attached to an interface.

This happens provided one the following conditions apply:

A route map matching on prefix-list is attached to an input interface as a PBR policy.

A route map for PBR (already attached to an interface) is configured or modified to match on prefix-list(s) instead of ACL(s).

Workaround: Configure the route map for PBR to only match on ACLs.

  • When the CPU transmits a .1X packet on an interface that has an attached egress QoS policy, the packet is not matched and exits without any QoS marking actions.

When a packet is sent to the CPU it may ported out another interface. If so, the original CoS value for a .1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).

Workaround: None.

Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a .1X packet. (CSCsk72544)

  • Graphics referenced in HTML pages may not be displayed in a user's browser during web authentication.

Workaround: Embed the graphic into the HTML file with a maximum of 256 kilobytes (according to RFC 2397).

The following browsers support RFC 2397:

Internet Explorer 8

Mozilla Firefox

Safari

(CSCsu37834)

  • When a link in a REP segment connecting two switches fails, 1 out of 3 attempts causes convergence timing to exceed 300ms.

Workaround: None. CSCsw42967

  • When a link fails on a closed REP segment of 16 nodes configured with VLANs on each node, the convergence time exceeds 250ms especially for multicast traffic.

Workaround: None.

This impacts restoration timing but not REP functionality. After a REP segment fails, traffic restoration time sometimes exceeds 200ms.

CSCsx55704

  • The 10Gig uplink on a standby supervisor WS-X45-SUP6-E stops transmitting or receiving traffic after the old standby engine becomes active through an OIR (if the OIR is done quickly, within 5 seconds) of the active supervisor engine.

Workaround: Reload the active and standby supervisor engine.

While performing OIR of the supervisor engines, you must remove the engines completely before re-insertion.

CSCsy70428

  • If you configure OFM on an EtherChannel (with at least two interfaces), when you shut or remove the first member that joined the channel, you lose the CFM neighbor.

Workaround: Clear the errors with the clear ethernet cfm errors command. CSCsv43819

  • The IP router option may not work with IGMP version 2.

Workaround: None. CSCsv42869

  • When you specify a DBL action for the class-default class map in a policy map, it might not work depending on the size of the default queue.

Workaround: Enter the queue-limit command to specify an explicit queue size. CSCso06422

  • After three failed authentication attempts, WinXP stops responding to EAPOL requests from the switch that caused the 802.1X timeout (default or configured). After the timeout, WinXP moves to auth-fail VLAN.

Workaround: Attempt an authorization after a timeout. CSCte84432

  • The switch may reload after destroying the expExpressionTable row via SNMP when you enter the debug management expression evaluator command.

Workaround: Disable the debug management expression evaluator command. (CSCsu67323)

  • When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.

This occurs only if the following conditions are satisfied:

Multi-host mode is configured on the port with the authentication host-mode multi-host command.

Default ACL (the IP access-list) is configured on the interface specifies deny ip any any.

Dynamic policy authorization for the client specifies permit ip any any.

Workaround: None.

CSCsz63739

  • When you load an unsupported Catalyst 4500 software version on WS-C4507R+E and WS-C4510R+E, the following log messages are seen and none of the ports come up:
"%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type"
Or
"%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type"
 
"%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)
 

Workaround: Load Cisco IOS Release 12.2(54)SG or 12.2(53)SG4 on WS-C4507R+E and WS-C4510R+E. CSCtl70275

Open Caveats for Cisco IOS Release 12.2(53)SG11

  • When you enter the access-list N permit host hostname command on a redundant chassis operating in SSO mode, you might observe the following syslog messages. The command is not synchronized with the redundant supervisor engine, and keepalive warnings appear.
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
 

Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)

  • In rare instances, when you are using MAC ACL-based policers, the output of the
    show policy-map interface fa6/1 command does not display the packets being matched:
Switch# show policy-map int fa6/1
 
Service-policy output: p1
 
Class-map: c1 (match-all)
0 packets <--------It stays at '0' despite of traffic being received
Match: access-group name fnacl21
police: Per-interface
Conform: 9426560 bytes Exceed: 16573440 bytes
 

Workaround: Verify that the MAC addresses being transmitted through the system are learned.

(CSCef01798)

  • After an SSO switchover, you may receive a “PM-4-PORT_INCONSISTENT” error message on the switch console if you enter the shutdown command, and then enter the no shutdown command on the port that is in UDLD disable state. This does not affect the switch; the port remains in UDLD disable state. Reentering the shutdown command, and then entering the no shutdown command on the same port will ensure that the error message does not reappear.

Workaround: None. (CSCeg48586)

  • When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.

If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.

If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.

On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.

Workaround: Reconnect. (CSCsb11964)

  • After upgrading to 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release. The following table reflects this change.

This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.

QueueID
Old QueueName
New QueueName

 

5

control-packet

control-packet

 

6

rpf-failure

control-packet

 

7

adj-same-if

control-packet

 

8

<unused queue>

control-packet

 

11

<unused queue>

adj-same-if

 

13

acl input log

rfp-failure

 

14

acl input forward

acl input log

Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:

Switch(config)# no monitor session n source cpu queue all rx
Switch(config)# monitor session n source cpu queue <new_Queue_Name>
 

(CSCsc94802)

  • To enable IP CEF (if it is disabled by hardware exhaustion), enter the ip cef distributed command.

Workaround: None. (CSCsc11726)

  • An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.

This situation could occur for these reasons:

A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.

The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.

Workarounds:

Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.

Configure the correct default gateway on the host side. (CSCse75660)

  • When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
    qos account layer2 encapsulation command.

Workaround: None. (CSCsg58526)

  • When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.

This does not affect performance.

Workaround: Enter the no shutdown command. (CSCsg27395)

  • When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.

Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).

  • When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
%XDR-6-XDRINVALIDHDR: XDR for client (CEF push) dropped (slots:2 from slot:3 context:145 length:11) due to: invalid context
 

Workaround: None. This is an informational message. (CSCsi60898)

  • When you send traffic on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225 ms.

Workaround: None. (CSCsm30320)

  • An IP unnumbered configuration is lost after a switch reloads.

Workarounds: Do one of the following:

After a reload, copy the startup-config to the running-config.

Use a loopback interface as the target of the ip unnumbered command.

Change the CLI configuration so that during bootup the router port is created first.

(CSCsq63051)

  • In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
%PM-4-PORT_INCONSISTENT: STANDBY:Port is inconsistent:
 

Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)

  • When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running configuration.

Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)

  • On a Catalyst 4500 switch running Cisco IOS Release 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the restoration.

Workaround: Shut down, and then reopen the interface. (CSCso50921)

  • VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, you will not see the VLAN updates on the other switches in the VTP domain.

Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)

  • A switch crashes while deleting an expExpressionTable row with SNMP and setting expExpressionEntryStatus to 6.
  • When you remove a line card containing ports configured with IGMP snooping while booting a standby supervisor engine, the active supervisor engine does not synchronize this configuration to the standby supervisor engine as a part of a bulk synchronization. When you reinstall the line card, the configuration in the active and standby supervisor engines will differ.

Workaround: Do one of the following:

Reload the standby switch again with the line card in place.

Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.

(CSCsv44866)

  • After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
 

This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG

Workaround: None. (CSCsw14005)

  • The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.

If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.

Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661

  • When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.

Workaround: None.

CSCsy38640

  • On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.

The statistics are displayed properly on the active supervisor.

Workaround: None.

CSCsx64308

  • When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
ethernet oam link-monitor frame-seconds window
ethernet oam link-monitor frame-seconds threshold low
 

Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.

CSCsy37181

  • When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
Switch# call-home send alert-group diagnostic module 2
Sending diagnostic info call-home message ...
Please wait. This may take some time ...
Switch#
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)
 

Workaround: Specify a profile name when you enter the diagnostic command.

You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.

CSCsz05888

  • Packets entering a switch as fragments or with a non-zero fragment offset field are not be subjected to PBR.

Workaround: None.

CSCsz06719 (4500 + 4900, for now)

  • On a wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.

This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.

Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.

The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.

CSCsz34522

  • If a host is authenticated in the data VLAN, the STP state of the VLAN is blocked.

Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.

The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.

Workaround: Enter shut, then no shut on the port.

CSCta04665

  • On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
    |auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.

Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.

CSCta16492

  • When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.

This occurs only if the following conditions are satisfied:

Multi-host mode configured on the port with the authentication host-mode multi-host command.

Default ACL (the IP access-list) configured on the interface specifies deny ip any any.

Dynamic policy authorization for the client specifies permit ip any any.

Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.

CSCsz63739

  • If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.

Workaround: None.

Despite the different default value, you can configure any value in the time range.

CSCte51948

  • WS-X4548-GB-RJ45V stops supplying inline power to interfaces 1-8 after you perform a switchover to the redundant supervisor engine and expire the watchdog timer.

Workaround: Reload the linecard by entering the hw-module reset command.

CSCti17849

  • If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.

The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.

Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986

  • A switch might fail an ftp to a dhcp-snooping file if the file’s size is 0 Kb.

Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:

Switch(config)# no ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.$
Switch(config)# ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.log
 

CSCsk38763

  • The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type

or

%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type

and

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)
 

Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.

CSCtl70275

  • If a port is configured for Private VLAN and is authorized in a guest VLAN, a traceback appears on the console.

Workaround: None.

CSCtq73579

  • A switch crashes when configuring SCP functionality with the archive command in time-period mode.

Workaround: None. CSCuq36900

Not Supported on Supervisor Engine 6-E

  • With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with hardware control plane policing.

Workaround: None. (CSCso93282)

When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:

" ERROR!
Sup II+10GE 10GE (X2), 1000BaseX (SFP) not supported in WS-C4510R-E chassis, system can not boot
Rebooting in 10 seconds...
10 09 08 07 06 05 04 03 02 01 "
 

Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.

Workarounds:

Place the Supervisor Engine II+10GE in a seven-slot chassis.

Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.

CSCtl80173

Supervisor Engine 6-E Specific Caveats

  • Systems running Cisco IOS Release 12.2(40)SG do not support the handling of .1Q packets for software QoS lookup.

Workaround: None. (CSCsk66449)

  • Under some conditions, one or more flows continue to be dropped because of DBL even after DBL has been removed from the service policy.

When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.

For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.

Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.

If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457

  • A Catalyst 4500 series switch with Supervisor Engine 6-E supports a maximum of 32 MTU values system wide.

On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.

Workaround: None. (CSCsk52542)

  • On rare occasions, if you use an X2 SR transceiver on a WS-X4706-10GE running
    Cisco IOS Release 12.2(40)SG, you observe CRC errors after a reload or power cycle upon inserting the card or X2.

Workaround: Reinsert the X2. (CSCsk43618)

  • When the CPU transmits a .1X packet on an interface that has an attached egress QoS policy, the packet is not matched and exits without any QoS marking actions.

When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a .1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).

Workaround: None.

Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a .1X packet. (CSCsk72544)

  • If burst is not explicitly configured for a single rate policer, the show policy-map command displays an incorrect burst value.

Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)

  • When you enter the show policy-map vlan vlan command, unconditional marking actions that are configured on the VLAN are not shown.

Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)

  • Supervisor Engine II-Plus-TS in a Catalyst 4503-E chassis running ROMMON lists the chassis type as Unknown. After booting Cisco IOS, the chassis type is listed properly.

Workaround: None. (CSCsl72868)

  • When you specify a DBL action for the class-default class map in a policy map, it might not work depending on the size of the default queue.

Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)

  • Uplinks go down when upgrading the ROMMON of an WS-X45-SUP6-E supervisor from version 0.34 to a later version.

This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.

Workarounds: To resume normal operation, do one of the following:

Reload both supervisor engines with the redundancy reload shelf command.

Power-cycle the standby supervisor engine by briefly pulling it from the chassis.

There is no workaround for the link flap issue. (CSCsm81875)

  • Changing flow control configuration with traffic and pause frames causes some traffic loss.

This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.

Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)

  • When a packet is switched through software on the switch, you might see that the input QoS marking action on that packet does not take effect.

The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.

Workaround: None.

(CSCso96660)

  • If an EtherChannel is a member of a FlexLink pair, then static MAC addresses configured on the EtherChannel are not moved to the alternate port when the EtherChannel fails (FlexLink failure).

Workaround: None. (CSCsq99468)

  • When a CFM Inward Facing MEP (IFM) is configured on a VLAN that is not allocated on a switch port that is DOWN, the show ethernet cfm maintenance-points local command displays the
    IFM CC Status as inactive. When you allocate the VLAN, the CC-status remains inactive.

You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.

Workaround: Unconfigure, and then reconfigure the IFM on the port.

  • When you configure vlan dot1q tag native globally on Supervisor Engine 6-E, MST control packets are tagged on egress on the native VLAN. This conflicts with 802.1s. The Cisco 7600 Series router drops its MST proposal agreements (because it expects the native VLAN MST control packets to be untagged), causing 30 seconds of traffic loss while spanning tree converges.

Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.

CSCsz12611

  • When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type
 

The active supervisor engine also displays following log message for each linecard slot in the chassis:

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14
 

where n is the slot number

If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:

%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailed
 

While active supervisor engine is up, no traffic can be handled by the switch.

The two supervisor engines might alternately reboot continuously.

Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.

CSCtl84092

  • When a LAN Base image from Cisco IOS Release 12.2(53)SG3 or earlier is loaded on a WS-C4510R+E or WS-C4507R+E chassis, the system hangs and there is no error message.

Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.

Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.

CSCtl89329

  • If Supervisor Engine 6-E or Supervisor Engine 6L-E is inserted in a 4507R+E or 4510R+E chassis, ROMMON incorrectly reports the chassis as 4507R-E or 4510R-E.

Workaround: None. CSCtl74638

Resolved Caveats for Cisco IOS Release 12.2(53)SG11

  • A switch running Cisco IOS Release 12.2(53)SG10 crashes when you try to login via SSH.

Workaround: None. CSCun08435

  • If a switch is running IOS Release 12.2(53)SG6 with Supervisor Engine 2 and a phone and PC are authenticated (or authorized) via MAB while connected to a port in multi-auth mode (with authentication open), both sessions are removed after 30 seconds without any reason:
AUTH-FEAT-MDA-EVENT (Fa3/6): Deleting all clients in domain DATA
 

Workaround: None. CSCuo56266

  • If a switch is running IOS Release 12.2(53)SG6 with Supervisor Engine II, the data client receives an authentication session but the session for the voice client is not created in authentication monitor mode (authentication open) with host-mode configured with multi-auth on the port.

Workaround: None. CSCuo56625

  • If you configure OFM on an EtherChannel (with at least two interfaces), when you shut or remove the first member that joined the channel, you lose the CFM neighbor.

Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)

Open Caveats for Cisco IOS Release 12.2(53)SG10

This section lists the open caveats for Cisco IOS Release 12.2(53)SG10:

  • When you enter the access-list N permit host hostname command on a redundant chassis operating in SSO mode, you might observe the following syslog messages. The command is not synchronized with the redundant supervisor engine, and keepalive warnings appear.
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
 

Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)

  • In rare instances, when you are using MAC ACL-based policers, the output of the
    show policy-map interface fa6/1 command does not display the packets being matched:
Switch# show policy-map int fa6/1
 
Service-policy output: p1
 
Class-map: c1 (match-all)
0 packets <--------It stays at '0' despite of traffic being received
Match: access-group name fnacl21
police: Per-interface
Conform: 9426560 bytes Exceed: 16573440 bytes
 

Workaround: Verify that the MAC addresses being transmitted through the system are learned.

(CSCef01798)

  • After an SSO switchover, you may receive a “PM-4-PORT_INCONSISTENT” error message on the switch console if you enter the shutdown command, and then enter the no shutdown command on the port that is in UDLD disable state. This does not affect the switch; the port remains in UDLD disable state. Reentering the shutdown command, and then entering the no shutdown command on the same port will ensure that the error message does not reappear.

Workaround: None. (CSCeg48586)

  • When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.

If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.

If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.

On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.

Workaround: Reconnect. (CSCsb11964)

  • After upgrading to 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release. The following table reflects this change.

This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.

QueueID
Old QueueName
New QueueName

 

5

control-packet

control-packet

 

6

rpf-failure

control-packet

 

7

adj-same-if

control-packet

 

8

<unused queue>

control-packet

 

11

<unused queue>

adj-same-if

 

13

acl input log

rfp-failure

 

14

acl input forward

acl input log

Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:

Switch(config)# no monitor session n source cpu queue all rx
Switch(config)# monitor session n source cpu queue <new_Queue_Name>
 

(CSCsc94802)

  • To enable IP CEF (if it is disabled by hardware exhaustion), enter the ip cef distributed command.

Workaround: None. (CSCsc11726)

  • An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.

This situation could occur for these reasons:

A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.

The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.

Workarounds:

Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.

Configure the correct default gateway on the host side. (CSCse75660)

  • When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
    qos account layer2 encapsulation command.

Workaround: None. (CSCsg58526)

  • When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.

This does not affect performance.

Workaround: Enter the no shutdown command. (CSCsg27395)

  • When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.

Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).

  • When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
%XDR-6-XDRINVALIDHDR: XDR for client (CEF push) dropped (slots:2 from slot:3 context:145 length:11) due to: invalid context
 

Workaround: None. This is an informational message. (CSCsi60898)

  • When you send traffic on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225 ms.

Workaround: None. (CSCsm30320)

  • An IP unnumbered configuration is lost after a switch reloads.

Workarounds: Do one of the following:

After a reload, copy the startup-config to the running-config.

Use a loopback interface as the target of the ip unnumbered command.

Change the CLI configuration so that during bootup the router port is created first.

(CSCsq63051)

  • In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
%PM-4-PORT_INCONSISTENT: STANDBY:Port is inconsistent:
 

Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)

  • When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running configuration.

Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)

  • If you configure OFM on an EtherChannel (with at least two interfaces), when you shut or remove the first member that joined the channel, you lose the CFM neighbor.

Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)

  • On a Catalyst 4500 switch running Cisco IOS Release 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the restoration.

Workaround: Shut down, and then reopen the interface. (CSCso50921)

  • VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, you will not see the VLAN updates on the other switches in the VTP domain.

Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)

  • A switch crashes while deleting an expExpressionTable row with SNMP and setting expExpressionEntryStatus to 6.
  • When you remove a line card containing ports configured with IGMP snooping while booting a standby supervisor engine, the active supervisor engine does not synchronize this configuration to the standby supervisor engine as a part of a bulk synchronization. When you reinstall the line card, the configuration in the active and standby supervisor engines will differ.

Workaround: Do one of the following:

Reload the standby switch again with the line card in place.

Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.

(CSCsv44866)

  • After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
 

This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG

Workaround: None. (CSCsw14005)

  • The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.

If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.

Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661

  • Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.

Workaround: None. CSCsy72343

  • When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.

Workaround: None.

CSCsy38640

  • When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.

Workaround: None.

CSCsu35604

  • On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.

The statistics are displayed properly on the active supervisor.

Workaround: None.

CSCsx64308

  • When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
ethernet oam link-monitor frame-seconds window
ethernet oam link-monitor frame-seconds threshold low
 

Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.

CSCsy37181

  • When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
Switch# call-home send alert-group diagnostic module 2
Sending diagnostic info call-home message ...
Please wait. This may take some time ...
Switch#
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)
 

Workaround: Specify a profile name when you enter the diagnostic command.

You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.

CSCsz05888

  • If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
    show policy-map interface command are wrong.

Workaround: None.

The queue transmit counters as well as the policing statistics (if any) are correct.

CSCsz20149

  • Packets entering a switch as fragments or with a non-zero fragment offset field are not be subjected to PBR.

Workaround: None.

CSCsz06719 (4500 + 4900, for now)

  • On a wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.

This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.

Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.

The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.

CSCsz34522

  • If a host is authenticated in the data VLAN, the STP state of the VLAN is blocked.

Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.

The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.

Workaround: Enter shut, then no shut on the port.

CSCta04665

  • On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
    |auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.

Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.

CSCta16492

  • When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.

This occurs only if the following conditions are satisfied:

Multi-host mode configured on the port with the authentication host-mode multi-host command.

Default ACL (the IP access-list) configured on the interface specifies deny ip any any.

Dynamic policy authorization for the client specifies permit ip any any.

Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.

CSCsz63739

  • If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.

Workaround: None.

Despite the different default value, you can configure any value in the time range.

CSCte51948

  • WS-X4548-GB-RJ45V stops supplying inline power to interfaces 1-8 after you perform a switchover to the redundant supervisor engine and expire the watchdog timer.

Workaround: Reload the linecard by entering the hw-module reset command.

CSCti17849

  • If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.

The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.

Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986

  • A switch might fail an ftp to a dhcp-snooping file if the file’s size is 0 Kb.

Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:

Switch(config)# no ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.$
Switch(config)# ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.log
 

CSCsk38763

  • The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type

or

%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type

and

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)
 

Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.

CSCtl70275

  • If a port is configured for Private VLAN and is authorized in a guest VLAN, a traceback appears on the console.

Workaround: None.

CSCtq73579

Not Supported on Supervisor Engine 6-E

  • With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with hardware control plane policing.

Workaround: None. (CSCso93282)

When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:

" ERROR!
Sup II+10GE 10GE (X2), 1000BaseX (SFP) not supported in WS-C4510R-E chassis, system can not boot
Rebooting in 10 seconds...
10 09 08 07 06 05 04 03 02 01 "
 

Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.

Workarounds:

Place the Supervisor Engine II+10GE in a seven-slot chassis.

Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.

CSCtl80173

Supervisor Engine 6-E Specific Caveats

  • Systems running Cisco IOS Release 12.2(40)SG do not support the handling of .1Q packets for software QoS lookup.

Workaround: None. (CSCsk66449)

  • Under some conditions, one or more flows continue to be dropped because of DBL even after DBL has been removed from the service policy.

When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.

For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.

Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.

If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457

  • A Catalyst 4500 series switch with Supervisor Engine 6-E supports a maximum of 32 MTU values system wide.

On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.

Workaround: None. (CSCsk52542)

  • On rare occasions, if you use an X2 SR transceiver on a WS-X4706-10GE running
    Cisco IOS Release 12.2(40)SG, you observe CRC errors after a reload or power cycle upon inserting the card or X2.

Workaround: Reinsert the X2. (CSCsk43618)

  • When the CPU transmits a .1X packet on an interface that has an attached egress QoS policy, the packet is not matched and exits without any QoS marking actions.

When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a .1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).

Workaround: None.

Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a .1X packet. (CSCsk72544)

  • If burst is not explicitly configured for a single rate policer, the show policy-map command displays an incorrect burst value.

Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)

  • When you enter the show policy-map vlan vlan command, unconditional marking actions that are configured on the VLAN are not shown.

Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)

  • Supervisor Engine II-Plus-TS in a Catalyst 4503-E chassis running ROMMON lists the chassis type as Unknown. After booting Cisco IOS, the chassis type is listed properly.

Workaround: None. (CSCsl72868)

  • When you specify a DBL action for the class-default class map in a policy map, it might not work depending on the size of the default queue.

Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)

  • Uplinks go down when upgrading the ROMMON of an WS-X45-SUP6-E supervisor from version 0.34 to a later version.

This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.

Workarounds: To resume normal operation, do one of the following:

Reload both supervisor engines with the redundancy reload shelf command.

Power-cycle the standby supervisor engine by briefly pulling it from the chassis.

There is no workaround for the link flap issue. (CSCsm81875)

  • Changing flow control configuration with traffic and pause frames causes some traffic loss.

This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.

Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)

  • When a packet is switched through software on the switch, you might see that the input QoS marking action on that packet does not take effect.

The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.

Workaround: None.

(CSCso96660)

  • If an EtherChannel is a member of a FlexLink pair, then static MAC addresses configured on the EtherChannel are not moved to the alternate port when the EtherChannel fails (FlexLink failure).

Workaround: None. (CSCsq99468)

  • When a CFM Inward Facing MEP (IFM) is configured on a VLAN that is not allocated on a switch port that is DOWN, the show ethernet cfm maintenance-points local command displays the
    IFM CC Status as inactive. When you allocate the VLAN, the CC-status remains inactive.

You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.

Workaround: Unconfigure, and then reconfigure the IFM on the port.

  • When you configure vlan dot1q tag native globally on Supervisor Engine 6-E, MST control packets are tagged on egress on the native VLAN. This conflicts with 802.1s. The Cisco 7600 Series router drops its MST proposal agreements (because it expects the native VLAN MST control packets to be untagged), causing 30 seconds of traffic loss while spanning tree converges.

Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.

CSCsz12611

  • When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type
 

The active supervisor engine also displays following log message for each linecard slot in the chassis:

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14
 

where n is the slot number

If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:

%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailed
 

While active supervisor engine is up, no traffic can be handled by the switch.

The two supervisor engines might alternately reboot continuously.

Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.

CSCtl84092

  • When a LAN Base image from Cisco IOS Release 12.2(53)SG3 or earlier is loaded on a WS-C4510R+E or WS-C4507R+E chassis, the system hangs and there is no error message.

Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.

Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.

CSCtl89329

  • If Supervisor Engine 6-E or Supervisor Engine 6L-E is inserted in a 4507R+E or 4510R+E chassis, ROMMON incorrectly reports the chassis as 4507R-E or 4510R-E.

Workaround: None. CSCtl74638

Resolved Caveats in Cisco IOS Release 12.2(53)SG10

This section lists the resolved caveats in Release 12.2(53)SG10:

  • The following message appears during MAC aging or learning on ports where dot1x or port security is configured:
%C4K_HWL2MAN-4-ADDRESSNOTLOADABLE message appears
 

Workaround: None. The message is cosmetic.CSCue77562

  • After TCAM resources are first exhausted, then freed, CPU remains high.

Workaround: Reconfigure ACLs on all interfaces.CSCuf93866

Open Caveats for Cisco IOS Release 12.2(53)SG9

This section lists the open caveats for Cisco IOS Release 12.2(53)SG9:

  • When you enter the access-list N permit host hostname command on a redundant chassis operating in SSO mode, you might observe the following syslog messages. The command is not synchronized with the redundant supervisor engine, and keepalive warnings appear.
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
 

Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)

  • In rare instances, when you are using MAC ACL-based policers, the output of the
    show policy-map interface fa6/1 command does not display the packets being matched:
Switch# show policy-map int fa6/1
 
Service-policy output: p1
 
Class-map: c1 (match-all)
0 packets <--------It stays at '0' despite of traffic being received
Match: access-group name fnacl21
police: Per-interface
Conform: 9426560 bytes Exceed: 16573440 bytes
 

Workaround: Verify that the MAC addresses being transmitted through the system are learned.

(CSCef01798)

  • After an SSO switchover, you may receive a “PM-4-PORT_INCONSISTENT” error message on the switch console if you enter the shutdown command, and then enter the no shutdown command on the port that is in UDLD disable state. This does not affect the switch; the port remains in UDLD disable state. Reentering the shutdown command, and then entering the no shutdown command on the same port will ensure that the error message does not reappear.

Workaround: None. (CSCeg48586)

  • When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.

If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.

If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.

On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.

Workaround: Reconnect. (CSCsb11964)

  • After upgrading to 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release. The following table reflects this change.

This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.

QueueID
Old QueueName
New QueueName

 

5

control-packet

control-packet

 

6

rpf-failure

control-packet

 

7

adj-same-if

control-packet

 

8

<unused queue>

control-packet

 

11

<unused queue>

adj-same-if

 

13

acl input log

rfp-failure

 

14

acl input forward

acl input log

Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:

Switch(config)# no monitor session n source cpu queue all rx
Switch(config)# monitor session n source cpu queue <new_Queue_Name>
 

(CSCsc94802)

  • To enable IP CEF (if it is disabled by hardware exhaustion), enter the ip cef distributed command.

Workaround: None. (CSCsc11726)

  • An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.

This situation could occur for these reasons:

A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.

The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.

Workarounds:

Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.

Configure the correct default gateway on the host side. (CSCse75660)

  • When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
    qos account layer2 encapsulation command.

Workaround: None. (CSCsg58526)

  • When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.

This does not affect performance.

Workaround: Enter the no shutdown command. (CSCsg27395)

  • When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.

Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).

  • When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
%XDR-6-XDRINVALIDHDR: XDR for client (CEF push) dropped (slots:2 from slot:3 context:145 length:11) due to: invalid context
 

Workaround: None. This is an informational message. (CSCsi60898)

  • When you send traffic on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225 ms.

Workaround: None. (CSCsm30320)

  • An IP unnumbered configuration is lost after a switch reloads.

Workarounds: Do one of the following:

After a reload, copy the startup-config to the running-config.

Use a loopback interface as the target of the ip unnumbered command.

Change the CLI configuration so that during bootup the router port is created first.

(CSCsq63051)

  • In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
%PM-4-PORT_INCONSISTENT: STANDBY:Port is inconsistent:
 

Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)

  • When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running configuration.

Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)

  • If you configure OFM on an EtherChannel (with at least two interfaces), when you shut or remove the first member that joined the channel, you lose the CFM neighbor.

Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)

  • On a Catalyst 4500 switch running Cisco IOS Release 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the restoration.

Workaround: Shut down, and then reopen the interface. (CSCso50921)

  • VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, you will not see the VLAN updates on the other switches in the VTP domain.

Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)

  • A switch crashes while deleting an expExpressionTable row with SNMP and setting expExpressionEntryStatus to 6.
  • When you remove a line card containing ports configured with IGMP snooping while booting a standby supervisor engine, the active supervisor engine does not synchronize this configuration to the standby supervisor engine as a part of a bulk synchronization. When you reinstall the line card, the configuration in the active and standby supervisor engines will differ.

Workaround: Do one of the following:

Reload the standby switch again with the line card in place.

Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.

(CSCsv44866)

  • After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
 

This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG

Workaround: None. (CSCsw14005)

  • The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.

If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.

Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661

  • Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.

Workaround: None. CSCsy72343

  • When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.

Workaround: None.

CSCsy38640

  • When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.

Workaround: None.

CSCsu35604

  • On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.

The statistics are displayed properly on the active supervisor.

Workaround: None.

CSCsx64308

  • When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
ethernet oam link-monitor frame-seconds window
ethernet oam link-monitor frame-seconds threshold low
 

Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.

CSCsy37181

  • When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
Switch# call-home send alert-group diagnostic module 2
Sending diagnostic info call-home message ...
Please wait. This may take some time ...
Switch#
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)
 

Workaround: Specify a profile name when you enter the diagnostic command.

You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.

CSCsz05888

  • If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
    show policy-map interface command are wrong.

Workaround: None.

The queue transmit counters as well as the policing statistics (if any) are correct.

CSCsz20149

  • Packets entering a switch as fragments or with a non-zero fragment offset field are not be subjected to PBR.

Workaround: None.

CSCsz06719 (4500 + 4900, for now)

  • On a wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.

This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.

Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.

The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.

CSCsz34522

  • If a host is authenticated in the data VLAN, the STP state of the VLAN is blocked.

Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.

The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.

Workaround: Enter shut, then no shut on the port.

CSCta04665

  • On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
    |auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.

Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.

CSCta16492

  • When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.

This occurs only if the following conditions are satisfied:

Multi-host mode configured on the port with the authentication host-mode multi-host command.

Default ACL (the IP access-list) configured on the interface specifies deny ip any any.

Dynamic policy authorization for the client specifies permit ip any any.

Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.

CSCsz63739

  • If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.

Workaround: None.

Despite the different default value, you can configure any value in the time range.

CSCte51948

  • WS-X4548-GB-RJ45V stops supplying inline power to interfaces 1-8 after you perform a switchover to the redundant supervisor engine and expire the watchdog timer.

Workaround: Reload the linecard by entering the hw-module reset command.

CSCti17849

  • If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.

The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.

Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986

  • A switch might fail an ftp to a dhcp-snooping file if the file’s size is 0 Kb.

Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:

Switch(config)# no ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.$
Switch(config)# ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.log
 

CSCsk38763

  • The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type

or

%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type

and

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)
 

Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.

CSCtl70275

  • If a port is configured for Private VLAN and is authorized in a guest VLAN, a traceback appears on the console.

Workaround: None.

CSCtq73579

  • The following message appears during MAC aging or learning on ports where dot1x or port security is configured:
%C4K_HWL2MAN-4-ADDRESSNOTLOADABLE message appears
 

Workaround: None. The message is cosmetic.CSCue77562

  • After TCAM resources are first exhausted, then freed, CPU remains high.

Workaround: Reconfigure ACLs on all interfaces.CSCuf93866

Not Supported on Supervisor Engine 6-E

  • With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with hardware control plane policing.

Workaround: None. (CSCso93282)

When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:

" ERROR!
Sup II+10GE 10GE (X2), 1000BaseX (SFP) not supported in WS-C4510R-E chassis, system can not boot
Rebooting in 10 seconds...
10 09 08 07 06 05 04 03 02 01 "
 

Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.

Workarounds:

Place the Supervisor Engine II+10GE in a seven-slot chassis.

Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.

CSCtl80173

Supervisor Engine 6-E Specific Caveats

  • Systems running Cisco IOS Release 12.2(40)SG do not support the handling of .1Q packets for software QoS lookup.

Workaround: None. (CSCsk66449)

  • Under some conditions, one or more flows continue to be dropped because of DBL even after DBL has been removed from the service policy.

When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.

For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.

Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.

If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457

  • A Catalyst 4500 series switch with Supervisor Engine 6-E supports a maximum of 32 MTU values system wide.

On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.

Workaround: None. (CSCsk52542)

  • On rare occasions, if you use an X2 SR transceiver on a WS-X4706-10GE running
    Cisco IOS Release 12.2(40)SG, you observe CRC errors after a reload or power cycle upon inserting the card or X2.

Workaround: Reinsert the X2. (CSCsk43618)

  • When the CPU transmits a .1X packet on an interface that has an attached egress QoS policy, the packet is not matched and exits without any QoS marking actions.

When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a .1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).

Workaround: None.

Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a .1X packet. (CSCsk72544)

  • If burst is not explicitly configured for a single rate policer, the show policy-map command displays an incorrect burst value.

Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)

  • When you enter the show policy-map vlan vlan command, unconditional marking actions that are configured on the VLAN are not shown.

Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)

  • Supervisor Engine II-Plus-TS in a Catalyst 4503-E chassis running ROMMON lists the chassis type as Unknown. After booting Cisco IOS, the chassis type is listed properly.

Workaround: None. (CSCsl72868)

  • When you specify a DBL action for the class-default class map in a policy map, it might not work depending on the size of the default queue.

Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)

  • Uplinks go down when upgrading the ROMMON of an WS-X45-SUP6-E supervisor from version 0.34 to a later version.

This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.

Workarounds: To resume normal operation, do one of the following:

Reload both supervisor engines with the redundancy reload shelf command.

Power-cycle the standby supervisor engine by briefly pulling it from the chassis.

There is no workaround for the link flap issue. (CSCsm81875)

  • Changing flow control configuration with traffic and pause frames causes some traffic loss.

This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.

Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)

  • When a packet is switched through software on the switch, you might see that the input QoS marking action on that packet does not take effect.

The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.

Workaround: None.

(CSCso96660)

  • If an EtherChannel is a member of a FlexLink pair, then static MAC addresses configured on the EtherChannel are not moved to the alternate port when the EtherChannel fails (FlexLink failure).

Workaround: None. (CSCsq99468)

  • When a CFM Inward Facing MEP (IFM) is configured on a VLAN that is not allocated on a switch port that is DOWN, the show ethernet cfm maintenance-points local command displays the
    IFM CC Status as inactive. When you allocate the VLAN, the CC-status remains inactive.

You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.

Workaround: Unconfigure, and then reconfigure the IFM on the port.

  • When you configure vlan dot1q tag native globally on Supervisor Engine 6-E, MST control packets are tagged on egress on the native VLAN. This conflicts with 802.1s. The Cisco 7600 Series router drops its MST proposal agreements (because it expects the native VLAN MST control packets to be untagged), causing 30 seconds of traffic loss while spanning tree converges.

Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.

CSCsz12611

  • When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type
 

The active supervisor engine also displays following log message for each linecard slot in the chassis:

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14
 

where n is the slot number

If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:

%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailed
 

While active supervisor engine is up, no traffic can be handled by the switch.

The two supervisor engines might alternately reboot continuously.

Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.

CSCtl84092

  • When a LAN Base image from Cisco IOS Release 12.2(53)SG3 or earlier is loaded on a WS-C4510R+E or WS-C4507R+E chassis, the system hangs and there is no error message.

Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.

Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.

CSCtl89329

  • If Supervisor Engine 6-E or Supervisor Engine 6L-E is inserted in a 4507R+E or 4510R+E chassis, ROMMON incorrectly reports the chassis as 4507R-E or 4510R-E.

Workaround: None. CSCtl74638

Resolved Caveats in Cisco IOS Release 12.2(53)SG9

This section lists the resolved caveats in Release 12.2(53)SG9:

  • When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.

Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521

  • The Cisco IOS Software implementation of the virtual routing and forwarding (VRF) aware network address translation (NAT) feature contains a vulnerability when translating IP packets that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.

Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-nat

Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication.

Individual publication links are in “Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication” at the following link:

http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html

CSCtg47129

Open Caveats for Cisco IOS Release 12.2(53)SG8

This section lists the open caveats for Cisco IOS Release 12.2(53)SG8:

  • When you enter the access-list N permit host hostname command on a redundant chassis operating in SSO mode, you might observe the following syslog messages. The command is not synchronized with the redundant supervisor engine, and keepalive warnings appear.
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
 

Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)

  • In rare instances, when you are using MAC ACL-based policers, the output of the
    show policy-map interface fa6/1 command does not display the packets being matched:
Switch# show policy-map int fa6/1
 
Service-policy output: p1
 
Class-map: c1 (match-all)
0 packets <--------It stays at '0' despite of traffic being received
Match: access-group name fnacl21
police: Per-interface
Conform: 9426560 bytes Exceed: 16573440 bytes
 

Workaround: Verify that the MAC addresses being transmitted through the system are learned.

(CSCef01798)

  • After an SSO switchover, you may receive a “PM-4-PORT_INCONSISTENT” error message on the switch console if you enter the shutdown command, and then enter the no shutdown command on the port that is in UDLD disable state. This does not affect the switch; the port remains in UDLD disable state. Reentering the shutdown command, and then entering the no shutdown command on the same port will ensure that the error message does not reappear.

Workaround: None. (CSCeg48586)

  • When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.

If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.

If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.

On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.

Workaround: Reconnect. (CSCsb11964)

  • After upgrading to 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release. The following table reflects this change.

This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.

QueueID
Old QueueName
New QueueName

 

5

control-packet

control-packet

 

6

rpf-failure

control-packet

 

7

adj-same-if

control-packet

 

8

<unused queue>

control-packet

 

11

<unused queue>

adj-same-if

 

13

acl input log

rfp-failure

 

14

acl input forward

acl input log

Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:

Switch(config)# no monitor session n source cpu queue all rx
Switch(config)# monitor session n source cpu queue <new_Queue_Name>
 

(CSCsc94802)

  • To enable IP CEF (if it is disabled by hardware exhaustion), enter the ip cef distributed command.

Workaround: None. (CSCsc11726)

  • An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.

This situation could occur for these reasons:

A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.

The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.

Workarounds:

Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.

Configure the correct default gateway on the host side. (CSCse75660)

  • When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
    qos account layer2 encapsulation command.

Workaround: None. (CSCsg58526)

  • When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.

This does not affect performance.

Workaround: Enter the no shutdown command. (CSCsg27395)

  • When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.

Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).

  • When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
%XDR-6-XDRINVALIDHDR: XDR for client (CEF push) dropped (slots:2 from slot:3 context:145 length:11) due to: invalid context
 

Workaround: None. This is an informational message. (CSCsi60898)

  • When you send traffic on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225 ms.

Workaround: None. (CSCsm30320)

  • An IP unnumbered configuration is lost after a switch reloads.

Workarounds: Do one of the following:

After a reload, copy the startup-config to the running-config.

Use a loopback interface as the target of the ip unnumbered command.

Change the CLI configuration so that during bootup the router port is created first.

(CSCsq63051)

  • In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
%PM-4-PORT_INCONSISTENT: STANDBY:Port is inconsistent:
 

Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)

  • When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running configuration.

Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)

  • If you configure OFM on an EtherChannel (with at least two interfaces), when you shut or remove the first member that joined the channel, you lose the CFM neighbor.

Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)

  • On a Catalyst 4500 switch running Cisco IOS Release 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the restoration.

Workaround: Shut down, and then reopen the interface. (CSCso50921)

  • VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, you will not see the VLAN updates on the other switches in the VTP domain.

Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)

  • A switch crashes while deleting an expExpressionTable row with SNMP and setting expExpressionEntryStatus to 6.
  • When you remove a line card containing ports configured with IGMP snooping while booting a standby supervisor engine, the active supervisor engine does not synchronize this configuration to the standby supervisor engine as a part of a bulk synchronization. When you reinstall the line card, the configuration in the active and standby supervisor engines will differ.

Workaround: Do one of the following:

Reload the standby switch again with the line card in place.

Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.

(CSCsv44866)

  • After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
 

This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG

Workaround: None. (CSCsw14005)

  • The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.

If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.

Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661

  • Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.

Workaround: None. CSCsy72343

  • When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.

Workaround: None.

CSCsy38640

  • When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.

Workaround: None.

CSCsu35604

  • On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.

The statistics are displayed properly on the active supervisor.

Workaround: None.

CSCsx64308

  • When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
ethernet oam link-monitor frame-seconds window
ethernet oam link-monitor frame-seconds threshold low
 

Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.

CSCsy37181

  • When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
Switch# call-home send alert-group diagnostic module 2
Sending diagnostic info call-home message ...
Please wait. This may take some time ...
Switch#
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)
 

Workaround: Specify a profile name when you enter the diagnostic command.

You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.

CSCsz05888

  • If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
    show policy-map interface command are wrong.

Workaround: None.

The queue transmit counters as well as the policing statistics (if any) are correct.

CSCsz20149

  • Packets entering a switch as fragments or with a non-zero fragment offset field are not be subjected to PBR.

Workaround: None.

CSCsz06719 (4500 + 4900, for now)

  • On a wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.

This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.

Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.

The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.

CSCsz34522

  • If a host is authenticated in the data VLAN, the STP state of the VLAN is blocked.

Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.

The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.

Workaround: Enter shut, then no shut on the port.

CSCta04665

  • On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
    |auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.

Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.

CSCta16492

  • When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.

This occurs only if the following conditions are satisfied:

Multi-host mode configured on the port with the authentication host-mode multi-host command.

Default ACL (the IP access-list) configured on the interface specifies deny ip any any.

Dynamic policy authorization for the client specifies permit ip any any.

Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.

CSCsz63739

  • If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.

Workaround: None.

Despite the different default value, you can configure any value in the time range.

CSCte51948

  • WS-X4548-GB-RJ45V stops supplying inline power to interfaces 1-8 after you perform a switchover to the redundant supervisor engine and expire the watchdog timer.

Workaround: Reload the linecard by entering the hw-module reset command.

CSCti17849

  • If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.

The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.

Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986

  • A switch might fail an ftp to a dhcp-snooping file if the file’s size is 0 Kb.

Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:

Switch(config)# no ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.$
Switch(config)# ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.log
 

CSCsk38763

  • The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type

or

%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type

and

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)
 

Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later. CSCtl70275

  • If a port is configured for Private VLAN and is authorized in a guest VLAN, a traceback appears on the console.

Workaround: None. CSCtq73579

  • When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.

Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521

  • After TCAM resources are first exhausted, then freed, CPU remains high.

Workaround: Reconfigure ACLs on all interfaces.CSCuf93866

Not Supported on Supervisor Engine 6-E

  • With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with hardware control plane policing.

Workaround: None. (CSCso93282)

When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:

" ERROR!
Sup II+10GE 10GE (X2), 1000BaseX (SFP) not supported in WS-C4510R-E chassis, system can not boot
Rebooting in 10 seconds...
10 09 08 07 06 05 04 03 02 01 "
 

Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.

Workarounds:

Place the Supervisor Engine II+10GE in a seven-slot chassis.

Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.

CSCtl80173

Supervisor Engine 6-E Specific Caveats

  • Systems running Cisco IOS Release 12.2(40)SG do not support the handling of .1Q packets for software QoS lookup.

Workaround: None. (CSCsk66449)

  • Under some conditions, one or more flows continue to be dropped because of DBL even after DBL has been removed from the service policy.

When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.

For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.

Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.

If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457

  • A Catalyst 4500 series switch with Supervisor Engine 6-E supports a maximum of 32 MTU values system wide.

On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.

Workaround: None. (CSCsk52542)

  • On rare occasions, if you use an X2 SR transceiver on a WS-X4706-10GE running
    Cisco IOS Release 12.2(40)SG, you observe CRC errors after a reload or power cycle upon inserting the card or X2.

Workaround: Reinsert the X2. (CSCsk43618)

  • When the CPU transmits a .1X packet on an interface that has an attached egress QoS policy, the packet is not matched and exits without any QoS marking actions.

When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a .1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).

Workaround: None.

Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a .1X packet. (CSCsk72544)

  • If burst is not explicitly configured for a single rate policer, the show policy-map command displays an incorrect burst value.

Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)

  • When you enter the show policy-map vlan vlan command, unconditional marking actions that are configured on the VLAN are not shown.

Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)

  • Supervisor Engine II-Plus-TS in a Catalyst 4503-E chassis running ROMMON lists the chassis type as Unknown. After booting Cisco IOS, the chassis type is listed properly.

Workaround: None. (CSCsl72868)

  • When you specify a DBL action for the class-default class map in a policy map, it might not work depending on the size of the default queue.

Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)

  • Uplinks go down when upgrading the ROMMON of an WS-X45-SUP6-E supervisor from version 0.34 to a later version.

This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.

Workarounds: To resume normal operation, do one of the following:

Reload both supervisor engines with the redundancy reload shelf command.

Power-cycle the standby supervisor engine by briefly pulling it from the chassis.

There is no workaround for the link flap issue. (CSCsm81875)

  • Changing flow control configuration with traffic and pause frames causes some traffic loss.

This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.

Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)

  • When a packet is switched through software on the switch, you might see that the input QoS marking action on that packet does not take effect.

The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.

Workaround: None.

(CSCso96660)

  • If an EtherChannel is a member of a FlexLink pair, then static MAC addresses configured on the EtherChannel are not moved to the alternate port when the EtherChannel fails (FlexLink failure).

Workaround: None. (CSCsq99468)

  • When a CFM Inward Facing MEP (IFM) is configured on a VLAN that is not allocated on a switch port that is DOWN, the show ethernet cfm maintenance-points local command displays the
    IFM CC Status as inactive. When you allocate the VLAN, the CC-status remains inactive.

You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.

Workaround: Unconfigure, and then reconfigure the IFM on the port.

  • When you configure vlan dot1q tag native globally on Supervisor Engine 6-E, MST control packets are tagged on egress on the native VLAN. This conflicts with 802.1s. The Cisco 7600 Series router drops its MST proposal agreements (because it expects the native VLAN MST control packets to be untagged), causing 30 seconds of traffic loss while spanning tree converges.

Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.

CSCsz12611

  • When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type
 

The active supervisor engine also displays following log message for each linecard slot in the chassis:

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14
 

where n is the slot number

If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:

%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailed
 

While active supervisor engine is up, no traffic can be handled by the switch.

The two supervisor engines might alternately reboot continuously.

Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.

CSCtl84092

  • When a LAN Base image from Cisco IOS Release 12.2(53)SG3 or earlier is loaded on a WS-C4510R+E or WS-C4507R+E chassis, the system hangs and there is no error message.

Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.

Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.

CSCtl89329

  • If Supervisor Engine 6-E or Supervisor Engine 6L-E is inserted in a 4507R+E or 4510R+E chassis, ROMMON incorrectly reports the chassis as 4507R-E or 4510R-E.

Workaround: None. CSCtl74638

Resolved Caveats in Cisco IOS Release 12.2(53)SG8

This section lists the resolved caveats in Release 12.2(53)SG8:

  • While processing a CDP frame, a switch may crash after displaying SYS-2-FREEFREE and SYS-6-MTRACE messages.

Workaround: Enter the no cdp run command to disable CDP. CSCub45763

Open Caveats for Cisco IOS Release 12.2(53)SG7

This section lists the open caveats for Cisco IOS Release 12.2(53)SG7:

  • When you enter the access-list N permit host hostname command on a redundant chassis operating in SSO mode, you might observe the following syslog messages. The command is not synchronized with the redundant supervisor engine, and keepalive warnings appear.
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
 

Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)

  • In rare instances, when you are using MAC ACL-based policers, the output of the
    show policy-map interface fa6/1 command does not display the packets being matched:
Switch# show policy-map int fa6/1
 
Service-policy output: p1
 
Class-map: c1 (match-all)
0 packets <--------It stays at '0' despite of traffic being received
Match: access-group name fnacl21
police: Per-interface
Conform: 9426560 bytes Exceed: 16573440 bytes
 

Workaround: Verify that the MAC addresses being transmitted through the system are learned.

(CSCef01798)

  • After an SSO switchover, you may receive a “PM-4-PORT_INCONSISTENT” error message on the switch console if you enter the shutdown command, and then enter the no shutdown command on the port that is in UDLD disable state. This does not affect the switch; the port remains in UDLD disable state. Reentering the shutdown command, and then entering the no shutdown command on the same port will ensure that the error message does not reappear.

Workaround: None. (CSCeg48586)

  • When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.

If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.

If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.

On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.

Workaround: Reconnect. (CSCsb11964)

  • After upgrading to 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release. The following table reflects this change.

This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.

QueueID
Old QueueName
New QueueName

 

5

control-packet

control-packet

 

6

rpf-failure

control-packet

 

7

adj-same-if

control-packet

 

8

<unused queue>

control-packet

 

11

<unused queue>

adj-same-if

 

13

acl input log

rfp-failure

 

14

acl input forward

acl input log

Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:

Switch(config)# no monitor session n source cpu queue all rx
Switch(config)# monitor session n source cpu queue <new_Queue_Name>
 

(CSCsc94802)

  • To enable IP CEF (if it is disabled by hardware exhaustion), enter the ip cef distributed command.

Workaround: None. (CSCsc11726)

  • An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.

This situation could occur for these reasons:

A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.

The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.

Workarounds:

Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.

Configure the correct default gateway on the host side. (CSCse75660)

  • When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
    qos account layer2 encapsulation command.

Workaround: None. (CSCsg58526)

  • When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.

This does not affect performance.

Workaround: Enter the no shutdown command. (CSCsg27395)

  • When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.

Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).

  • When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
%XDR-6-XDRINVALIDHDR: XDR for client (CEF push) dropped (slots:2 from slot:3 context:145 length:11) due to: invalid context
 

Workaround: None. This is an informational message. (CSCsi60898)

  • When you send traffic on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225 ms.

Workaround: None. (CSCsm30320)

  • An IP unnumbered configuration is lost after a switch reloads.

Workarounds: Do one of the following:

After a reload, copy the startup-config to the running-config.

Use a loopback interface as the target of the ip unnumbered command.

Change the CLI configuration so that during bootup the router port is created first.

(CSCsq63051)

  • In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
%PM-4-PORT_INCONSISTENT: STANDBY:Port is inconsistent:
 

Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)

  • When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running configuration.

Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)

  • If you configure OFM on an EtherChannel (with at least two interfaces), when you shut or remove the first member that joined the channel, you lose the CFM neighbor.

Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)

  • On a Catalyst 4500 switch running Cisco IOS Release 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the restoration.

Workaround: Shut down, and then reopen the interface. (CSCso50921)

  • VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, you will not see the VLAN updates on the other switches in the VTP domain.

Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)

  • A switch crashes while deleting an expExpressionTable row with SNMP and setting expExpressionEntryStatus to 6.
  • When you remove a line card containing ports configured with IGMP snooping while booting a standby supervisor engine, the active supervisor engine does not synchronize this configuration to the standby supervisor engine as a part of a bulk synchronization. When you reinstall the line card, the configuration in the active and standby supervisor engines will differ.

Workaround: Do one of the following:

Reload the standby switch again with the line card in place.

Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.

(CSCsv44866)

  • After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
 

This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG

Workaround: None. (CSCsw14005)

  • The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.

If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.

Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661

  • Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.

Workaround: None. CSCsy72343

  • When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.

Workaround: None.

CSCsy38640

  • When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.

Workaround: None.

CSCsu35604

  • On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.

The statistics are displayed properly on the active supervisor.

Workaround: None.

CSCsx64308

  • When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
ethernet oam link-monitor frame-seconds window
ethernet oam link-monitor frame-seconds threshold low
 

Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.

CSCsy37181

  • When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
Switch# call-home send alert-group diagnostic module 2
Sending diagnostic info call-home message ...
Please wait. This may take some time ...
Switch#
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)
 

Workaround: Specify a profile name when you enter the diagnostic command.

You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.

CSCsz05888

  • If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
    show policy-map interface command are wrong.

Workaround: None.

The queue transmit counters as well as the policing statistics (if any) are correct.

CSCsz20149

  • Packets entering a switch as fragments or with a non-zero fragment offset field are not be subjected to PBR.

Workaround: None.

CSCsz06719 (4500 + 4900, for now)

  • On a wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.

This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.

Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.

The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.

CSCsz34522

  • If a host is authenticated in the data VLAN, the STP state of the VLAN is blocked.

Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.

The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.

Workaround: Enter shut, then no shut on the port.

CSCta04665

  • On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
    |auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.

Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.

CSCta16492

  • When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.

This occurs only if the following conditions are satisfied:

Multi-host mode configured on the port with the authentication host-mode multi-host command.

Default ACL (the IP access-list) configured on the interface specifies deny ip any any.

Dynamic policy authorization for the client specifies permit ip any any.

Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.

CSCsz63739

  • If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.

Workaround: None.

Despite the different default value, you can configure any value in the time range.

CSCte51948

  • WS-X4548-GB-RJ45V stops supplying inline power to interfaces 1-8 after you perform a switchover to the redundant supervisor engine and expire the watchdog timer.

Workaround: Reload the linecard by entering the hw-module reset command.

CSCti17849

  • If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.

The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.

Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986

  • A switch might fail an ftp to a dhcp-snooping file if the file’s size is 0 Kb.

Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:

Switch(config)# no ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.$
Switch(config)# ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.log
 

CSCsk38763

  • The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type

or

%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type

and

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)
 

Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.

CSCtl70275

  • If a port is configured for Private VLAN and is authorized in a guest VLAN, a traceback appears on the console.

Workaround: None. CSCtq73579

  • While processing a CDP frame, a switch may crash after displaying SYS-2-FREEFREE and SYS-6-MTRACE messages.

Workaround: Enter the no cdp run command to disable CDP. CSCub45763

  • When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.

Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521

  • After TCAM resources are first exhausted, then freed, CPU remains high.

Workaround: Reconfigure ACLs on all interfaces.CSCuf93866

Not Supported on Supervisor Engine 6-E

  • With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with hardware control plane policing.

Workaround: None. (CSCso93282)

When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:

" ERROR!
Sup II+10GE 10GE (X2), 1000BaseX (SFP) not supported in WS-C4510R-E chassis, system can not boot
Rebooting in 10 seconds...
10 09 08 07 06 05 04 03 02 01 "
 

Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.

Workarounds:

Place the Supervisor Engine II+10GE in a seven-slot chassis.

Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.

CSCtl80173

Supervisor Engine 6-E Specific Caveats

  • Systems running Cisco IOS Release 12.2(40)SG do not support the handling of .1Q packets for software QoS lookup.

Workaround: None. (CSCsk66449)

  • Under some conditions, one or more flows continue to be dropped because of DBL even after DBL has been removed from the service policy.

When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.

For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.

Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.

If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457

  • A Catalyst 4500 series switch with Supervisor Engine 6-E supports a maximum of 32 MTU values system wide.

On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.

Workaround: None. (CSCsk52542)

  • On rare occasions, if you use an X2 SR transceiver on a WS-X4706-10GE running
    Cisco IOS Release 12.2(40)SG, you observe CRC errors after a reload or power cycle upon inserting the card or X2.

Workaround: Reinsert the X2. (CSCsk43618)

  • When the CPU transmits a .1X packet on an interface that has an attached egress QoS policy, the packet is not matched and exits without any QoS marking actions.

When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a .1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).

Workaround: None.

Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a .1X packet. (CSCsk72544)

  • If burst is not explicitly configured for a single rate policer, the show policy-map command displays an incorrect burst value.

Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)

  • When you enter the show policy-map vlan vlan command, unconditional marking actions that are configured on the VLAN are not shown.

Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)

  • Supervisor Engine II-Plus-TS in a Catalyst 4503-E chassis running ROMMON lists the chassis type as Unknown. After booting Cisco IOS, the chassis type is listed properly.

Workaround: None. (CSCsl72868)

  • When you specify a DBL action for the class-default class map in a policy map, it might not work depending on the size of the default queue.

Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)

  • Uplinks go down when upgrading the ROMMON of an WS-X45-SUP6-E supervisor from version 0.34 to a later version.

This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.

Workarounds: To resume normal operation, do one of the following:

Reload both supervisor engines with the redundancy reload shelf command.

Power-cycle the standby supervisor engine by briefly pulling it from the chassis.

There is no workaround for the link flap issue. (CSCsm81875)

  • Changing flow control configuration with traffic and pause frames causes some traffic loss.

This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.

Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)

  • When a packet is switched through software on the switch, you might see that the input QoS marking action on that packet does not take effect.

The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.

Workaround: None.

(CSCso96660)

  • If an EtherChannel is a member of a FlexLink pair, then static MAC addresses configured on the EtherChannel are not moved to the alternate port when the EtherChannel fails (FlexLink failure).

Workaround: None. (CSCsq99468)

  • When a CFM Inward Facing MEP (IFM) is configured on a VLAN that is not allocated on a switch port that is DOWN, the show ethernet cfm maintenance-points local command displays the
    IFM CC Status as inactive. When you allocate the VLAN, the CC-status remains inactive.

You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.

Workaround: Unconfigure, and then reconfigure the IFM on the port.

  • When you configure vlan dot1q tag native globally on Supervisor Engine 6-E, MST control packets are tagged on egress on the native VLAN. This conflicts with 802.1s. The Cisco 7600 Series router drops its MST proposal agreements (because it expects the native VLAN MST control packets to be untagged), causing 30 seconds of traffic loss while spanning tree converges.

Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.

CSCsz12611

  • When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type
 

The active supervisor engine also displays following log message for each linecard slot in the chassis:

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14
 

where n is the slot number

If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:

%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailed
 

While active supervisor engine is up, no traffic can be handled by the switch.

The two supervisor engines might alternately reboot continuously.

Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.

CSCtl84092

  • When a LAN Base image from Cisco IOS Release 12.2(53)SG3 or earlier is loaded on a WS-C4510R+E or WS-C4507R+E chassis, the system hangs and there is no error message.

Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.

Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.

CSCtl89329

  • If Supervisor Engine 6-E or Supervisor Engine 6L-E is inserted in a 4507R+E or 4510R+E chassis, ROMMON incorrectly reports the chassis as 4507R-E or 4510R-E.

Workaround: None. CSCtl74638

Resolved Caveats in Cisco IOS Release 12.2(53)SG7

This section lists the resolved caveats in Release 12.2(53)SG7:

  • If you use AAA accounting with the broadcast keyword, a switch may either display unpredictable behavior or crash.

Workaround: Do not use AAA accounting with the broadcast keyword. CSCts56125

  • A vulnerability exists in the Cisco IOS software that may allow a remote application or device to exceed its authorization level when authentication, authorization, and accounting (AAA) authorization is used. This vulnerability requires that the HTTP or HTTPS server is enabled on the Cisco IOS device.

Products that are not running Cisco IOS software are not vulnerable.

Cisco has released free software updates that address these vulnerabilities.

The HTTP server may be disabled as a workaround for the vulnerability described in this advisory.

This advisory is available at the following link:


http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai

Additional information on Cisco's security vulnerability policy can be found at the URL:


http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html

CSCtr91106

  • A switch operating as a DHCP server where sessions receive DHCP information from a RADIUS server may experience a crash and DHCP related errors.

Workaround: None. CSCtj48387

  • A vulnerability in the Multicast Source Discovery Protocol (MSDP) implementation of Cisco IOS Software and Cisco IOS XE Software could allow a remote, unauthenticated attacker to cause a reload of an affected device. Repeated attempts to exploit this vulnerability could result in a sustained denial of service (DoS) condition.

Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link:


http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-msdp


Note The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.


Individual publication links are in ''Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication'' at the following link:


http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html

CSCtr28857

  • A switch crashes after displaying the message:
%AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (Unknown MAC) on Interface Gi5/39 AuditSessionID AC156241000000670001BC9.
 

provided the following conditions apply:

A switchport is configured with the following:

authentication event server dead action authorize...

authenticaton event server alive action reinitalize

The RADIUS server was down previously, and a port without traffic (for example, a hub with no devices attached) was authorized into the inaccessible authentication bypass (IAB) VLAN without an associated MAC address.

The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.

Workaround: None. CSCtx61557

Open Caveats for Cisco IOS Release 12.2(53)SG6

This section lists the open caveats for Cisco IOS Release 12.2(53)SG6:

  • When you enter the access-list N permit host hostname command on a redundant chassis operating in SSO mode, you might observe the following syslog messages. The command is not synchronized with the redundant supervisor engine, and keepalive warnings appear.
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
 

Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)

  • In rare instances, when you are using MAC ACL-based policers, the output of the
    show policy-map interface fa6/1 command does not display the packets being matched:
Switch# show policy-map int fa6/1
 
Service-policy output: p1
 
Class-map: c1 (match-all)
0 packets <--------It stays at '0' despite of traffic being received
Match: access-group name fnacl21
police: Per-interface
Conform: 9426560 bytes Exceed: 16573440 bytes
 

Workaround: Verify that the MAC addresses being transmitted through the system are learned.

(CSCef01798)

  • After an SSO switchover, you may receive a “PM-4-PORT_INCONSISTENT” error message on the switch console if you enter the shutdown command, and then enter the no shutdown command on the port that is in UDLD disable state. This does not affect the switch; the port remains in UDLD disable state. Reentering the shutdown command, and then entering the no shutdown command on the same port will ensure that the error message does not reappear.

Workaround: None. (CSCeg48586)

  • When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.

If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.

If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.

On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.

Workaround: Reconnect. (CSCsb11964)

  • After upgrading to 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release. The following table reflects this change.

This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.

QueueID
Old QueueName
New QueueName

 

5

control-packet

control-packet

 

6

rpf-failure

control-packet

 

7

adj-same-if

control-packet

 

8

<unused queue>

control-packet

 

11

<unused queue>

adj-same-if

 

13

acl input log

rfp-failure

 

14

acl input forward

acl input log

Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:

Switch(config)# no monitor session n source cpu queue all rx
Switch(config)# monitor session n source cpu queue <new_Queue_Name>
 

(CSCsc94802)

  • To enable IP CEF (if it is disabled by hardware exhaustion), enter the ip cef distributed command.

Workaround: None. (CSCsc11726)

  • An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.

This situation could occur for these reasons:

A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.

The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.

Workarounds:

Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.

Configure the correct default gateway on the host side. (CSCse75660)

  • When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
    qos account layer2 encapsulation command.

Workaround: None. (CSCsg58526)

  • When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.

This does not affect performance.

Workaround: Enter the no shutdown command. (CSCsg27395)

  • When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.

Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).

  • When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
%XDR-6-XDRINVALIDHDR: XDR for client (CEF push) dropped (slots:2 from slot:3 context:145 length:11) due to: invalid context
 

Workaround: None. This is an informational message. (CSCsi60898)

  • When you send traffic on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225 ms.

Workaround: None. (CSCsm30320)

  • An IP unnumbered configuration is lost after a switch reloads.

Workarounds: Do one of the following:

After a reload, copy the startup-config to the running-config.

Use a loopback interface as the target of the ip unnumbered command.

Change the CLI configuration so that during bootup the router port is created first.

(CSCsq63051)

  • In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
%PM-4-PORT_INCONSISTENT: STANDBY:Port is inconsistent:
 

Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)

  • When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running configuration.

Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)

  • If you configure OFM on an EtherChannel (with at least two interfaces), when you shut or remove the first member that joined the channel, you lose the CFM neighbor.

Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)

  • On a Catalyst 4500 switch running Cisco IOS Release 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the restoration.

Workaround: Shut down, and then reopen the interface. (CSCso50921)

  • VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, you will not see the VLAN updates on the other switches in the VTP domain.

Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)

  • A switch crashes while deleting an expExpressionTable row with SNMP and setting expExpressionEntryStatus to 6.
  • When you remove a line card containing ports configured with IGMP snooping while booting a standby supervisor engine, the active supervisor engine does not synchronize this configuration to the standby supervisor engine as a part of a bulk synchronization. When you reinstall the line card, the configuration in the active and standby supervisor engines will differ.

Workaround: Do one of the following:

Reload the standby switch again with the line card in place.

Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.

(CSCsv44866)

  • After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
 

This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG

Workaround: None. (CSCsw14005)

  • The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.

If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.

Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661

  • Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.

Workaround: None. CSCsy72343

  • When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.

Workaround: None.

CSCsy38640

  • When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.

Workaround: None.

CSCsu35604

  • On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.

The statistics are displayed properly on the active supervisor.

Workaround: None.

CSCsx64308

  • When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
ethernet oam link-monitor frame-seconds window
ethernet oam link-monitor frame-seconds threshold low
 

Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.

CSCsy37181

  • When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
Switch# call-home send alert-group diagnostic module 2
Sending diagnostic info call-home message ...
Please wait. This may take some time ...
Switch#
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)
 

Workaround: Specify a profile name when you enter the diagnostic command.

You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.

CSCsz05888

  • If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
    show policy-map interface command are wrong.

Workaround: None.

The queue transmit counters as well as the policing statistics (if any) are correct.

CSCsz20149

  • Packets entering a switch as fragments or with a non-zero fragment offset field are not be subjected to PBR.

Workaround: None.

CSCsz06719 (4500 + 4900, for now)

  • On a wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.

This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.

Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.

The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.

CSCsz34522

  • If a host is authenticated in the data VLAN, the STP state of the VLAN is blocked.

Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.

The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.

Workaround: Enter shut, then no shut on the port.

CSCta04665

  • On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
    |auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.

Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.

CSCta16492

  • When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.

This occurs only if the following conditions are satisfied:

Multi-host mode configured on the port with the authentication host-mode multi-host command.

Default ACL (the IP access-list) configured on the interface specifies deny ip any any.

Dynamic policy authorization for the client specifies permit ip any any.

Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.

CSCsz63739

  • If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.

Workaround: None.

Despite the different default value, you can configure any value in the time range.

CSCte51948

  • WS-X4548-GB-RJ45V stops supplying inline power to interfaces 1-8 after you perform a switchover to the redundant supervisor engine and expire the watchdog timer.

Workaround: Reload the linecard by entering the hw-module reset command.

CSCti17849

  • If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.

The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.

Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986

  • A switch might fail an ftp to a dhcp-snooping file if the file’s size is 0 Kb.

Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:

Switch(config)# no ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.$
Switch(config)# ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.log
 

CSCsk38763

  • The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type

or

%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type

and

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)
 

Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.

CSCtl70275

  • If a port is configured for Private VLAN and is authorized in a guest VLAN, a traceback appears on the console.

Workaround: None.

CSCtq73579

  • If you use AAA accounting with the broadcast keyword, a switch may either display unpredictable behavior or crash.

Workaround: Do not use AAA accounting with the broadcast keyword. CSCts56125

  • A vulnerability exists in the Cisco IOS software that may allow a remote application or device to exceed its authorization level when authentication, authorization, and accounting (AAA) authorization is used. This vulnerability requires that the HTTP or HTTPS server is enabled on the Cisco IOS device.

Products that are not running Cisco IOS software are not vulnerable.

Cisco has released free software updates that address these vulnerabilities.

The HTTP server may be disabled as a workaround for the vulnerability described in this advisory.

This advisory is available at the following link:


http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai

Additional information on Cisco's security vulnerability policy can be found at the URL:


http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html

CSCtr91106

  • A switch operating as a DHCP server where sessions receive DHCP information from a RADIUS server may experience a crash and DHCP related errors.

Workaround: None. CSCtj48387

  • A vulnerability in the Multicast Source Discovery Protocol (MSDP) implementation of Cisco IOS Software and Cisco IOS XE Software could allow a remote, unauthenticated attacker to cause a reload of an affected device. Repeated attempts to exploit this vulnerability could result in a sustained denial of service (DoS) condition.

Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link:


http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-msdp


Note The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.


Individual publication links are in ''Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication'' at the following link:


http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html

CSCtr28857

  • A switch crashes after displaying the message:
%AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (Unknown MAC) on Interface Gi5/39 AuditSessionID AC156241000000670001BC9.
 

provided the following conditions apply:

A switchport is configured with the following:

authentication event server dead action authorize...

authenticaton event server alive action reinitalize

The RADIUS server was down previously, and a port without traffic (for example, a hub with no devices attached) was authorized into the inaccessible authentication bypass (IAB) VLAN without an associated MAC address.

The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.

Workaround: None. CSCtx61557

  • When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.

Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521

  • After TCAM resources are first exhausted, then freed, CPU remains high.

Workaround: Reconfigure ACLs on all interfaces.CSCuf93866

Not Supported on Supervisor Engine 6-E

  • With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with hardware control plane policing.

Workaround: None. (CSCso93282)

When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:

" ERROR!
Sup II+10GE 10GE (X2), 1000BaseX (SFP) not supported in WS-C4510R-E chassis, system can not boot
Rebooting in 10 seconds...
10 09 08 07 06 05 04 03 02 01 "
 

Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.

Workarounds:

Place the Supervisor Engine II+10GE in a seven-slot chassis.

Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.

CSCtl80173

Supervisor Engine 6-E Specific Caveats

  • Systems running Cisco IOS Release 12.2(40)SG do not support the handling of .1Q packets for software QoS lookup.

Workaround: None. (CSCsk66449)

  • Under some conditions, one or more flows continue to be dropped because of DBL even after DBL has been removed from the service policy.

When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.

For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.

Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.

If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457

  • A Catalyst 4500 series switch with Supervisor Engine 6-E supports a maximum of 32 MTU values system wide.

On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.

Workaround: None. (CSCsk52542)

  • On rare occasions, if you use an X2 SR transceiver on a WS-X4706-10GE running
    Cisco IOS Release 12.2(40)SG, you observe CRC errors after a reload or power cycle upon inserting the card or X2.

Workaround: Reinsert the X2. (CSCsk43618)

  • When the CPU transmits a .1X packet on an interface that has an attached egress QoS policy, the packet is not matched and exits without any QoS marking actions.

When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a .1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).

Workaround: None.

Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a .1X packet. (CSCsk72544)

  • If burst is not explicitly configured for a single rate policer, the show policy-map command displays an incorrect burst value.

Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)

  • When you enter the show policy-map vlan vlan command, unconditional marking actions that are configured on the VLAN are not shown.

Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)

  • Supervisor Engine II-Plus-TS in a Catalyst 4503-E chassis running ROMMON lists the chassis type as Unknown. After booting Cisco IOS, the chassis type is listed properly.

Workaround: None. (CSCsl72868)

  • When you specify a DBL action for the class-default class map in a policy map, it might not work depending on the size of the default queue.

Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)

  • Uplinks go down when upgrading the ROMMON of an WS-X45-SUP6-E supervisor from version 0.34 to a later version.

This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.

Workarounds: To resume normal operation, do one of the following:

Reload both supervisor engines with the redundancy reload shelf command.

Power-cycle the standby supervisor engine by briefly pulling it from the chassis.

There is no workaround for the link flap issue. (CSCsm81875)

  • Changing flow control configuration with traffic and pause frames causes some traffic loss.

This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.

Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)

  • When a packet is switched through software on the switch, you might see that the input QoS marking action on that packet does not take effect.

The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.

Workaround: None.

(CSCso96660)

  • If an EtherChannel is a member of a FlexLink pair, then static MAC addresses configured on the EtherChannel are not moved to the alternate port when the EtherChannel fails (FlexLink failure).

Workaround: None. (CSCsq99468)

  • When a CFM Inward Facing MEP (IFM) is configured on a VLAN that is not allocated on a switch port that is DOWN, the show ethernet cfm maintenance-points local command displays the
    IFM CC Status as inactive. When you allocate the VLAN, the CC-status remains inactive.

You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.

Workaround: Unconfigure, and then reconfigure the IFM on the port.

  • When you configure vlan dot1q tag native globally on Supervisor Engine 6-E, MST control packets are tagged on egress on the native VLAN. This conflicts with 802.1s. The Cisco 7600 Series router drops its MST proposal agreements (because it expects the native VLAN MST control packets to be untagged), causing 30 seconds of traffic loss while spanning tree converges.

Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.

CSCsz12611

  • When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type
 

The active supervisor engine also displays following log message for each linecard slot in the chassis:

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14
 

where n is the slot number

If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:

%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailed
 

While active supervisor engine is up, no traffic can be handled by the switch.

The two supervisor engines might alternately reboot continuously.

Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.

CSCtl84092

  • When a LAN Base image from Cisco IOS Release 12.2(53)SG3 or earlier is loaded on a WS-C4510R+E or WS-C4507R+E chassis, the system hangs and there is no error message.

Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.

Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.

CSCtl89329

  • If Supervisor Engine 6-E or Supervisor Engine 6L-E is inserted in a 4507R+E or 4510R+E chassis, ROMMON incorrectly reports the chassis as 4507R-E or 4510R-E.

Workaround: None. CSCtl74638

Resolved Caveats in Cisco IOS Release 12.2(53)SG6

This section lists the resolved caveats in Release 12.2(53)SG6:

  • A switch ignores unicast EAPOL responses, when you use MDA or multi-auth host mode combination with authentication open.

Workarounds:

Force the supplicant to use multicast EAPOL.

Avoid authentication open mode. CSCtq33048

  • When you enter the rep preempt segment command, the MAC might not flush.

Workaround: Re-enter the rep preempt segment command.

CSCtr89862

  • A switch crashes following changes to policy-based routing (route-map).

Workaround: Ensure that a policy is configured on an interface prior to changing a default next-hop in route-map. CSCtr31759

  • The following problems are experienced with IPv6 SNMP, when an IPv4 address is not configured:

Traps are not sent through IPv6.

SNMP GETs sent to a switch IPv6 address trigger a traceback.

Workaround: Perform the following task:

1. Disable the SNMP engine with the no snmp-server command.

2. Configure an IPv4 address and an IPv6 address on loopback interfaces.

3. Enable the SNMP engine.

CSCsw76894

  • If you enable SNMP before assigning an IPv4 address, SNMP does not listen for requests.

Workaround: Perform the following task:

1. Disable the SNMP engine with the no snmp-server command.

2. Configure an IP address and an IPv6 address on loopback interfaces.

3. Enable the SNMP engine.

CSCsw92921

  • When flex link load balancing is used, MAC addresses sourced over the backup interface are not programmed into the dynamic MAC address table. Source address learning is triggered for all traffic from these MAC addresses, which may cause high CPU.

Workaround: Configure static MAC addresses for the source addresses on the backup flex link interface. CSCtr40070

  • On networks with round-trip-time (RTT) delay of 5 milisec and over, IP SLA ethernet jitter probes are stuck in NoConnection/Busy/Timeout state:
uPE1#sh ip sla stat | inc Timeout
Latest RTT: NoConnection/Busy/Timeout
 

Issue is likely not to appear in environments with low latency (<5msec).

Workarounds:

None (regarding ethernet jitter probe)

Consider using the IP sla ethernet echo probes to collect RTT statistics. CSCtb96522

  • A system may crash if it receives more than 10 MA (Management Address) TLVs per LLDP neighbor entry.

Workaround: Disable LLDP MA TLV sending on the peers. CSCtj22354

  • Querying rttMonHistory objects using an invalid index causes a switch to crash.

Workaround: Use getnext rather than get to list valid indicies for the MIB OID. CSCtr52740

  • Registering a TCL policy may cause the switch to hang.

Workaround: None. CSCto72927

  • Flooded multicast traffic is not sent over a port channel interface after a member link or port-channel flaps.

Workarounds:

Delete and add impacted VLAN with no vlan vlan_id and vlan vlan_id commands.

Flap the impacted port channel with the shutdown and no shutdown commands. CSCtr17251

  • If VLAN load balancing is progressing, and you reconfigure VLAN load balancing to reflect different blocking ports, manual preemption does not occur.

Workaround: Reconfigure VLAN load balancing with a different configuration, by performing the following task:

a. Reconfigure the VLAN load balancing configuration on the desired REP ports.

b. Use the shut command on any one REP port in the segment to cause a failure in that segment.

c. Use the no-shut on the same port to restore normal REP topology with one ALT port.

d. Invoke manual preemption on a primary edge port to obtain VLAN load balancing with the new configuration.

(CSCsv69853)

Open Caveats for Cisco IOS Release 12.2(53)SG5

This section lists the open caveats for Cisco IOS Release 12.2(53)SG5:

  • When you enter the access-list N permit host hostname command on a redundant chassis operating in SSO mode, you might observe the following syslog messages. The command is not synchronized with the redundant supervisor engine, and keepalive warnings appear.
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
 

Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)

  • In rare instances, when you are using MAC ACL-based policers, the output of the
    show policy-map interface fa6/1 command does not display the packets being matched:
Switch# show policy-map int fa6/1
 
Service-policy output: p1
 
Class-map: c1 (match-all)
0 packets <--------It stays at '0' despite of traffic being received
Match: access-group name fnacl21
police: Per-interface
Conform: 9426560 bytes Exceed: 16573440 bytes
 

Workaround: Verify that the MAC addresses being transmitted through the system are learned.

(CSCef01798)

  • After an SSO switchover, you may receive a “PM-4-PORT_INCONSISTENT” error message on the switch console if you enter the shutdown command, and then enter the no shutdown command on the port that is in UDLD disable state. This does not affect the switch; the port remains in UDLD disable state. Reentering the shutdown command, and then entering the no shutdown command on the same port will ensure that the error message does not reappear.

Workaround: None. (CSCeg48586)

  • When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.

If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.

If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.

On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.

Workaround: Reconnect. (CSCsb11964)

  • After upgrading to 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release. The following table reflects this change.

This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.

QueueID
Old QueueName
New QueueName

 

5

control-packet

control-packet

 

6

rpf-failure

control-packet

 

7

adj-same-if

control-packet

 

8

<unused queue>

control-packet

 

11

<unused queue>

adj-same-if

 

13

acl input log

rfp-failure

 

14

acl input forward

acl input log

Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:

Switch(config)# no monitor session n source cpu queue all rx
Switch(config)# monitor session n source cpu queue <new_Queue_Name>
 

(CSCsc94802)

  • To enable IP CEF (if it is disabled by hardware exhaustion), enter the ip cef distributed command.

Workaround: None. (CSCsc11726)

  • An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.

This situation could occur for these reasons:

A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.

The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.

Workarounds:

Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.

Configure the correct default gateway on the host side. (CSCse75660)

  • When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
    qos account layer2 encapsulation command.

Workaround: None. (CSCsg58526)

  • When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.

This does not affect performance.

Workaround: Enter the no shutdown command. (CSCsg27395)

  • When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.

Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).

  • When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
%XDR-6-XDRINVALIDHDR: XDR for client (CEF push) dropped (slots:2 from slot:3 context:145 length:11) due to: invalid context
 

Workaround: None. This is an informational message. (CSCsi60898)

  • When you send traffic on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225 ms.

Workaround: None. (CSCsm30320)

  • An IP unnumbered configuration is lost after a switch reloads.

Workarounds: Do one of the following:

After a reload, copy the startup-config to the running-config.

Use a loopback interface as the target of the ip unnumbered command.

Change the CLI configuration so that during bootup the router port is created first.

(CSCsq63051)

  • In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
%PM-4-PORT_INCONSISTENT: STANDBY:Port is inconsistent:
 

Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)

  • When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running configuration.

Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)

  • If you configure OFM on an EtherChannel (with at least two interfaces), when you shut or remove the first member that joined the channel, you lose the CFM neighbor.

Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)

  • On a Catalyst 4500 switch running Cisco IOS Release 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the restoration.

Workaround: Shut down, and then reopen the interface. (CSCso50921)

  • VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, you will not see the VLAN updates on the other switches in the VTP domain.

Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)

  • A switch crashes while deleting an expExpressionTable row with SNMP and setting expExpressionEntryStatus to 6.
  • When you remove a line card containing ports configured with IGMP snooping while booting a standby supervisor engine, the active supervisor engine does not synchronize this configuration to the standby supervisor engine as a part of a bulk synchronization. When you reinstall the line card, the configuration in the active and standby supervisor engines will differ.

Workaround: Do one of the following:

Reload the standby switch again with the line card in place.

Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.

(CSCsv44866)

  • If VLAN load balancing is progressing, and you reconfigure VLAN load balancing to reflect different blocking ports, manual preemption does not occur.

Workaround: Reconfigure VLAN load balancing with a different configuration, by performing the following task:

a. Reconfigure the VLAN load balancing configuration on the desired REP ports.

b. Use the shut command on any one REP port in the segment to cause a failure in that segment.

c. Use the no-shut on the same port to restore normal REP topology with one ALT port.

d. Invoke manual preemption on a primary edge port to obtain VLAN load balancing with the new configuration.

(CSCsv69853)

  • After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
 

This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG

Workaround: None. (CSCsw14005)

  • The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.

If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.

Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661

  • Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.

Workaround: None. CSCsy72343

  • When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.

Workaround: None.

CSCsy38640

  • When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.

Workaround: None.

CSCsu35604

  • On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.

The statistics are displayed properly on the active supervisor.

Workaround: None.

CSCsx64308

  • When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
ethernet oam link-monitor frame-seconds window
ethernet oam link-monitor frame-seconds threshold low
 

Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.

CSCsy37181

  • When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
Switch# call-home send alert-group diagnostic module 2
Sending diagnostic info call-home message ...
Please wait. This may take some time ...
Switch#
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)
 

Workaround: Specify a profile name when you enter the diagnostic command.

You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.

CSCsz05888

  • If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
    show policy-map interface command are wrong.

Workaround: None.

The queue transmit counters as well as the policing statistics (if any) are correct.

CSCsz20149

  • Packets entering a switch as fragments or with a non-zero fragment offset field are not be subjected to PBR.

Workaround: None.

CSCsz06719 (4500 + 4900, for now)

  • On a wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.

This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.

Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.

The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.

CSCsz34522

  • If a host is authenticated in the data VLAN, the STP state of the VLAN is blocked.

Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.

The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.

Workaround: Enter shut, then no shut on the port.

CSCta04665

  • On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
    |auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.

Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.

CSCta16492

  • When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.

This occurs only if the following conditions are satisfied:

Multi-host mode configured on the port with the authentication host-mode multi-host command.

Default ACL (the IP access-list) configured on the interface specifies deny ip any any.

Dynamic policy authorization for the client specifies permit ip any any.

Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.

CSCsz63739

  • If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.

Workaround: None.

Despite the different default value, you can configure any value in the time range.

CSCte51948

  • WS-X4548-GB-RJ45V stops supplying inline power to interfaces 1-8 after you perform a switchover to the redundant supervisor engine and expire the watchdog timer.

Workaround: Reload the linecard by entering the hw-module reset command.

CSCti17849

  • If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.

The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.

Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986

  • A switch might fail an ftp to a dhcp-snooping file if the file’s size is 0 Kb.

Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:

Switch(config)# no ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.$
Switch(config)# ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.log
 

CSCsk38763

  • The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type

or

%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type

and

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)
 

Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.

CSCtl70275

  • If a port is configured for Private VLAN and is authorized in a guest VLAN, a traceback appears on the console.

Workaround: None.

CSCtq73579

  • If you use AAA accounting with the broadcast keyword, a switch may either display unpredictable behavior or crash.

Workaround: Do not use AAA accounting with the broadcast keyword. CSCts56125

  • A vulnerability exists in the Cisco IOS software that may allow a remote application or device to exceed its authorization level when authentication, authorization, and accounting (AAA) authorization is used. This vulnerability requires that the HTTP or HTTPS server is enabled on the Cisco IOS device.

Products that are not running Cisco IOS software are not vulnerable.

Cisco has released free software updates that address these vulnerabilities.

The HTTP server may be disabled as a workaround for the vulnerability described in this advisory.

This advisory is available at the following link:


http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai

Additional information on Cisco's security vulnerability policy can be found at the URL:


http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html

CSCtr91106

  • A switch operating as a DHCP server where sessions receive DHCP information from a RADIUS server may experience a crash and DHCP related errors.

Workaround: None. CSCtj48387

  • A vulnerability in the Multicast Source Discovery Protocol (MSDP) implementation of Cisco IOS Software and Cisco IOS XE Software could allow a remote, unauthenticated attacker to cause a reload of an affected device. Repeated attempts to exploit this vulnerability could result in a sustained denial of service (DoS) condition.

Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link:


http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-msdp


Note The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.


Individual publication links are in ''Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication'' at the following link:


http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html

CSCtr28857

  • A switch crashes after displaying the message:
%AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (Unknown MAC) on Interface Gi5/39 AuditSessionID AC156241000000670001BC9.
 

provided the following conditions apply:

A switchport is configured with the following:

authentication event server dead action authorize...

authenticaton event server alive action reinitalize

The RADIUS server was down previously, and a port without traffic (for example, a hub with no devices attached) was authorized into the inaccessible authentication bypass (IAB) VLAN without an associated MAC address.

The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.

Workaround: None. CSCtx61557

  • When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.

Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521

  • After TCAM resources are first exhausted, then freed, CPU remains high.

Workaround: Reconfigure ACLs on all interfaces.CSCuf93866

Not Supported on Supervisor Engine 6-E

  • With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with hardware control plane policing.

Workaround: None. (CSCso93282)

When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:

" ERROR!
Sup II+10GE 10GE (X2), 1000BaseX (SFP) not supported in WS-C4510R-E chassis, system can not boot
Rebooting in 10 seconds...
10 09 08 07 06 05 04 03 02 01 "
 

Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.

Workarounds:

Place the Supervisor Engine II+10GE in a seven-slot chassis.

Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.

CSCtl80173

Supervisor Engine 6-E Specific Caveats

  • Systems running Cisco IOS Release 12.2(40)SG do not support the handling of .1Q packets for software QoS lookup.

Workaround: None. (CSCsk66449)

  • Under some conditions, one or more flows continue to be dropped because of DBL even after DBL has been removed from the service policy.

When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.

For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.

Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.

If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457

  • A Catalyst 4500 series switch with Supervisor Engine 6-E supports a maximum of 32 MTU values system wide.

On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.

Workaround: None. (CSCsk52542)

  • On rare occasions, if you use an X2 SR transceiver on a WS-X4706-10GE running
    Cisco IOS Release 12.2(40)SG, you observe CRC errors after a reload or power cycle upon inserting the card or X2.

Workaround: Reinsert the X2. (CSCsk43618)

  • When the CPU transmits a .1X packet on an interface that has an attached egress QoS policy, the packet is not matched and exits without any QoS marking actions.

When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a .1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).

Workaround: None.

Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a .1X packet. (CSCsk72544)

  • If burst is not explicitly configured for a single rate policer, the show policy-map command displays an incorrect burst value.

Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)

  • When you enter the show policy-map vlan vlan command, unconditional marking actions that are configured on the VLAN are not shown.

Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)

  • Supervisor Engine II-Plus-TS in a Catalyst 4503-E chassis running ROMMON lists the chassis type as Unknown. After booting Cisco IOS, the chassis type is listed properly.

Workaround: None. (CSCsl72868)

  • When you specify a DBL action for the class-default class map in a policy map, it might not work depending on the size of the default queue.

Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)

  • Uplinks go down when upgrading the ROMMON of an WS-X45-SUP6-E supervisor from version 0.34 to a later version.

This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.

Workarounds: To resume normal operation, do one of the following:

Reload both supervisor engines with the redundancy reload shelf command.

Power-cycle the standby supervisor engine by briefly pulling it from the chassis.

There is no workaround for the link flap issue. (CSCsm81875)

  • Changing flow control configuration with traffic and pause frames causes some traffic loss.

This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.

Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)

  • When a packet is switched through software on the switch, you might see that the input QoS marking action on that packet does not take effect.

The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.

Workaround: None.

(CSCso96660)

  • If an EtherChannel is a member of a FlexLink pair, then static MAC addresses configured on the EtherChannel are not moved to the alternate port when the EtherChannel fails (FlexLink failure).

Workaround: None. (CSCsq99468)

  • When a CFM Inward Facing MEP (IFM) is configured on a VLAN that is not allocated on a switch port that is DOWN, the show ethernet cfm maintenance-points local command displays the
    IFM CC Status as inactive. When you allocate the VLAN, the CC-status remains inactive.

You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.

Workaround: Unconfigure, and then reconfigure the IFM on the port.

  • When you configure vlan dot1q tag native globally on Supervisor Engine 6-E, MST control packets are tagged on egress on the native VLAN. This conflicts with 802.1s. The Cisco 7600 Series router drops its MST proposal agreements (because it expects the native VLAN MST control packets to be untagged), causing 30 seconds of traffic loss while spanning tree converges.

Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.

CSCsz12611

  • When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type
 

The active supervisor engine also displays following log message for each linecard slot in the chassis:

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14
 

where n is the slot number

If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:

%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailed
 

While active supervisor engine is up, no traffic can be handled by the switch.

The two supervisor engines might alternately reboot continuously.

Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.

CSCtl84092

  • When a LAN Base image from Cisco IOS Release 12.2(53)SG3 or earlier is loaded on a WS-C4510R+E or WS-C4507R+E chassis, the system hangs and there is no error message.

Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.

Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.

CSCtl89329

  • If Supervisor Engine 6-E or Supervisor Engine 6L-E is inserted in a 4507R+E or 4510R+E chassis, ROMMON incorrectly reports the chassis as 4507R-E or 4510R-E.

Workaround: None. CSCtl74638

Resolved Caveats in Cisco IOS Release 12.2(53)SG5

This section lists the resolved caveats in Release 12.2(53)SG5:

  • When you specify a proxy ACL ACE with an extra space, the proxy ACL is not programmed for authenticated and authorized hosts.

Workarounds:

Do not provide an extra space while specifying a proxy ACL ACE.

Use a Downloadable ACL or a Filter-ID ACL rather than a proxy ACL. CSCtk67010

  • When the egress policy-map is applied to an “single” active port, you cannot modify the multicast control packets (HSRP and OSPF) IP ToS field.

Workaround: None. CSCtg60011

  • Interfaces connected to a Catalyst 4500 series switch remain linked up though no active supervisor engines exist.

This occurs when a peer switch is connected to a line card in a non-redundant switch and you reload the active supervisor engine. Some interfaces on some linecards remain linked up. Far-end switches must rely on protocol timeouts to detect the switch’s reload.

This situation only occurs with the WS-X4648-RJ45-E and WS-X4548-RJ45-V-E line cards.

Workaround: Reset the linecards with the hw module module n command, then reload the switch. CSCtl11764

  • Some non-powered devices fail to linkup when connected to a 4648-RJ45-E/+E line card port with a 2 or 4-wire cable (1,2,3,6).

Workarounds:

Use a 4-pair wire.

Enter the power inline never command.

Enter the speed auto 10 100 command. CSCtn43537

  • When reconnecting to a switch using IP device tracking, a Windows Vista, Windows 2008, or Windows 2007 device registers a duplicate address message.

Workaround: Disable gratuitous ARP on the Windows device. CSCtn27420

  • 802.1X supplicants connected to ports in a guest VLAN fail the initial authentication.

Workarounds:

Configure the supplicant to retry 802.1X.

Connect or disconnect to the port. CSCtl89361

  • The switch crashes when AAA accounting packets are generated for web authentications.

Workaround: Disable AAA accounting. CSCtl77241

  • When IP SLA probes are configured and active for a period of 72 weeks, and you poll the rttmon mib for probe statistics, the router reloads.

The problem is not observed for another 72 weeks.

Workaround: None. CSCsl70722

  • If a device is connected to multiple ports on the switch and no ip routing is configured, ARP entries display in an incorrect VLAN (pv vlan appears in the entry).

Workaround: Configure ip routing. CSCtj20399

  • When a switch is using 802.X with web authentication, and you open an http session, you see a login screen using http, rather than https.

This happens only if you use a custom banner configured like the following:

ip auth-proxy auth-proxy-banner http ^C Custom Banner here ^C
 

Workaround: Remove the custom banner. CSCtb77378

  • If you change the authentication method for a client to webauth before removing the fallback configuration, web authentication is triggered.

Workarounds:

Reconfigure 802.1X with the no dot1x pae authenticator/dot1x pae authenticator command.

Reload the switch. CSCtd43793

  • LLDP packets are sent (.1q) tagged when the native VLAN of the of the dot1q trunk is not the default (VLAN 1).

LLDP IEEE standard requires frames sent untagged. With this issue, some peer devices may reject the tagged LLDP frame.

Workaround: Use the default native VLAN for the trunks. CSCtn29321

  • When a redundant power supply is turned off, ciscoEnvMonAlarmContacts returns 00 even though the LED on the supervisor engine is orange.

Workaround: If you include snmp-server enable traps envmon in the device configuration, a ciscoEnvMonSuppStatusChangeNotification is generated when the power supply either turns off or fails. CSCtl72109

  • A switch might crash if ip cef accounting non-recursive is configured and BGP routes are being supplied.

Workaround: Disable IP cef accounting. CSCtn68186

  • A port channel will not establish correctly if the following conditions apply:

vlan dot1q tag native is configured.

Either the native VLAN is not allowed on the trunk, or the peer does not accept tagged channel protocol packets.

Workaround: None. CSCtj90471

  • A power supply can be listed as removed, but continues to function normally. This behavior is illustrated by the following system messages:
%C4K_IOSMODPORTMAN-4-POWERSUPPLYREMOVED: Power supply 1 has been removed
%C4K_CHASSIS-3-INSUFFICIENTPOWERSUPPLIESDETECTED: Insufficient power supplies present for specified configuration
%C4K_CHASSIS-2-INSUFFICIENTPOWERDETECTED: Insufficient power available for the
 

Workaround: None. CSCtn38000

  • High CPU results from constant MAC learning when multiple REP rings are used, each with a different VLAN list.

Workaround: Ensure that all trunk ports in the REP ring topology have the same list of VLANs, including ports in other REP rings that export STCNs into the REP ring where the problem is observed. CSCto67625

  • DHCP clients renewing through a load-balanced DHCP relay on an unnumbered interface may be unable to renew their lease because the renew ACK is lost.

Workaround: Avoid using DHCP load balancing. CSCth00482

  • If a switch is configured for multiple authentication host-mode, and an interface on that switch is configured for 802.1X, that interface disallows unidirectional port control, breaking the functionality of Wake on LAN.

Workaround: Use a different host-mode. CSCti92970

  • A memory leak caused by corrupted SSH packets is detected in SSH process during internal testing.

Workaround: Allow SSH connections only from trusted hosts. CSCth87458

  • If you provide extra space anywhere in between while specifying a proxy ACL ACE, the proxy ACL is not programmed for authenticated and authorized hosts.

Workarounds

Do not provide any extra space while specifying a proxy ACL ACE.

Use DACL or Filter-Id ACL instead of proxy ACLs. CSCtk67010

  • In multi-auth mode, when you disconnect a PC behind a Cisco IP phone, the data session is not removed.

This behavior is anticipated. In multi-auth mode, the system cannot distinguish between the data client that is attached to the phone and those that are attached to the switch through a hub.

Workaround: None. CSCtd70009

  • A switch crashes when you use no set extcommunity cost to remove set extcommunity cost in a route-map and you enter show run.

Workaround: Remove the entire route-map and re-create it. CSCsr23563

  • On a SSH and telnet-configured switch, if you configure a banner, then SSH to the router, the banner shows incorrectly:
pqiu@apt-cse-613% ssh cisco@10.66.79.211
"$(hostname) via line $(line) $(line-desc)"
 

Here is how you configured the banner:

banner login ^CC
$(hostname) via line $(line) $(line-desc)
^C
!
 

If you telnet to the router, the banner shows correctly as follows:

"SV-9-5 via line 67"
 

Workaround: None. CSCei24145

  • After you boot a reloaded switch in a REP ring topology, the soon-to-be alternate port forwards traffic and causes a loop. This continues until you enter shut and no shut on the alternate port.

Workaround: Enter shut and no shut on the alternate interface. CSCtn03533

  • If a static route is configured for an RP address that is reachable from a directly connected network, the switch does not send a PIM register toward the RP.

Workaround: Avoid configuring overlapping IP addresses. CSCtj96095

Open Caveats for Cisco IOS Release 12.2(53)SG4

This section lists the open caveats for Cisco IOS Release 12.2(53)SG4:

  • When you enter the access-list N permit host hostname command on a redundant chassis operating in SSO mode, you might observe the following syslog messages. The command is not synchronized with the redundant supervisor engine, and keepalive warnings appear.
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
 

Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)

  • In rare instances, when you are using MAC ACL-based policers, the output of the
    show policy-map interface fa6/1 command does not display the packets being matched:
Switch# show policy-map int fa6/1
 
Service-policy output: p1
 
Class-map: c1 (match-all)
0 packets <--------It stays at '0' despite of traffic being received
Match: access-group name fnacl21
police: Per-interface
Conform: 9426560 bytes Exceed: 16573440 bytes
 

Workaround: Verify that the MAC addresses being transmitted through the system are learned.

(CSCef01798)

  • After an SSO switchover, you may receive a “PM-4-PORT_INCONSISTENT” error message on the switch console if you enter the shutdown command, and then enter the no shutdown command on the port that is in UDLD disable state. This does not affect the switch; the port remains in UDLD disable state. Reentering the shutdown command, and then entering the no shutdown command on the same port will ensure that the error message does not reappear.

Workaround: None. (CSCeg48586)

  • When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.

If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.

If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.

On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.

Workaround: Reconnect. (CSCsb11964)

  • After upgrading to 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release. The following table reflects this change.

This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.

QueueID
Old QueueName
New QueueName

 

5

control-packet

control-packet

 

6

rpf-failure

control-packet

 

7

adj-same-if

control-packet

 

8

<unused queue>

control-packet

 

11

<unused queue>

adj-same-if

 

13

acl input log

rfp-failure

 

14

acl input forward

acl input log

Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:

Switch(config)# no monitor session n source cpu queue all rx
Switch(config)# monitor session n source cpu queue <new_Queue_Name>
 

(CSCsc94802)

  • To enable IP CEF (if it is disabled by hardware exhaustion), enter the ip cef distributed command.

Workaround: None. (CSCsc11726)

  • An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.

This situation could occur for these reasons:

A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.

The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.

Workarounds:

Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.

Configure the correct default gateway on the host side. (CSCse75660)

  • When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
    qos account layer2 encapsulation command.

Workaround: None. (CSCsg58526)

  • When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.

This does not affect performance.

Workaround: Enter the no shutdown command. (CSCsg27395)

  • When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.

Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).

  • When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
%XDR-6-XDRINVALIDHDR: XDR for client (CEF push) dropped (slots:2 from slot:3 context:145 length:11) due to: invalid context
 

Workaround: None. This is an informational message. (CSCsi60898)

  • When you send traffic on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225 ms.

Workaround: None. (CSCsm30320)

  • An IP unnumbered configuration is lost after a switch reloads.

Workarounds: Do one of the following:

After a reload, copy the startup-config to the running-config.

Use a loopback interface as the target of the ip unnumbered command.

Change the CLI configuration so that during bootup the router port is created first.

(CSCsq63051)

  • In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
%PM-4-PORT_INCONSISTENT: STANDBY:Port is inconsistent:
 

Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)

  • When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running configuration.

Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)

  • If you configure OFM on an EtherChannel (with at least two interfaces), when you shut or remove the first member that joined the channel, you lose the CFM neighbor.

Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)

  • On a Catalyst 4500 switch running Cisco IOS Release 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the restoration.

Workaround: Shut down, and then reopen the interface. (CSCso50921)

  • VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, you will not see the VLAN updates on the other switches in the VTP domain.

Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)

  • A switch crashes while deleting an expExpressionTable row with SNMP and setting expExpressionEntryStatus to 6.
  • When you remove a line card containing ports configured with IGMP snooping while booting a standby supervisor engine, the active supervisor engine does not synchronize this configuration to the standby supervisor engine as a part of a bulk synchronization. When you reinstall the line card, the configuration in the active and standby supervisor engines will differ.

Workaround: Do one of the following:

Reload the standby switch again with the line card in place.

Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.

(CSCsv44866)

  • If VLAN load balancing is progressing, and you reconfigure VLAN load balancing to reflect different blocking ports, manual preemption does not occur.

Workaround: Reconfigure VLAN load balancing with a different configuration, by performing the following task:

a. Reconfigure the VLAN load balancing configuration on the desired REP ports.

b. Use the shut command on any one REP port in the segment to cause a failure in that segment.

c. Use the no-shut on the same port to restore normal REP topology with one ALT port.

d. Invoke manual preemption on a primary edge port to obtain VLAN load balancing with the new configuration.

(CSCsv69853)

  • After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8
 

This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG

Workaround: None. (CSCsw14005)

  • The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.

If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.

Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661

  • Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.

Workaround: None. CSCsy72343

  • When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.

Workaround: None.

CSCsy38640

  • When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.

Workaround: None.

CSCsu35604

  • On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.

The statistics are displayed properly on the active supervisor.

Workaround: None.

CSCsx64308

  • When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
ethernet oam link-monitor frame-seconds window
ethernet oam link-monitor frame-seconds threshold low
 

Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.

CSCsy37181

  • When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
Switch# call-home send alert-group diagnostic module 2
Sending diagnostic info call-home message ...
Please wait. This may take some time ...
Switch#
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)
 

Workaround: Specify a profile name when you enter the diagnostic command.

You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.

CSCsz05888

  • If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
    show policy-map interface command are wrong.

Workaround: None.

The queue transmit counters as well as the policing statistics (if any) are correct.

CSCsz20149

  • Packets entering a switch as fragments or with a non-zero fragment offset field are not be subjected to PBR.

Workaround: None.

CSCsz06719 (4500 + 4900, for now)

  • On a wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.

This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.

Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.

The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.

CSCsz34522

  • If a host is authenticated in the data VLAN, the STP state of the VLAN is blocked.

Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.

The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.

Workaround: Enter shut, then no shut on the port.

CSCta04665

  • On a Layer 2 port (that is, a switchport) of Siupervisor Engine II+ thru V-10GE, the
    |auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.

Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.

CSCta16492

  • When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.

This occurs only if the following conditions are satisfied:

Multi-host mode configured on the port with the authentication host-mode multi-host command.

Default ACL (the IP access-list) configured on the interface specifies deny ip any any.

Dynamic policy authorization for the client specifies permit ip any any.

Workaround: None.

CSCsz63739

  • If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.

Workaround: None.

Despite the different default value, you can configure any value in the time range.

CSCte51948

  • WS-X4548-GB-RJ45V stops supplying inline power to interfaces 1-8 after you perform a switchover to the redundant superviser engine and expire the watchdog timer.

Workaround: Reload the linecard by entering the hw-module reset command.

CSCti17849

  • If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.

The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.

Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986

  • A switch might fail an ftp to a dhcp-snooping file if the file’s size is 0 Kb.

Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:

Switch(config)# no ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.$
Switch(config)# ip dhcp snooping database ftp://griff:ddd@192.168.1.4/test1.log
 

CSCsk38763

  • The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type

or

%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type

and

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)
 

Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.

CSCtl70275

  • A proxy ACL is not programmed for authenticated and authorized hosts, when you specify a proxy ACL ACE with an extra space

Workarounds:

Do not provide an extra space while specifying a proxy ACL ACE.

Use a Downloadable ACL or a Filter-ID ACL instead of a proxy ACL.

CSCtk67010l

  • A switch may crash while loading BGP routes if the ip cef accounting non-recursive command is already configured.

Workaround: Disable the ip cef accounting non-recursive command.

(CSCtn68186)

  • If you use AAA accounting with the broadcast keyword, a switch may either display unpredictable behavior or crash.

Workaround: Do not use AAA accounting with the broadcast keyword. CSCts56125

  • A vulnerability exists in the Cisco IOS software that may allow a remote application or device to exceed its authorization level when authentication, authorization, and accounting (AAA) authorization is used. This vulnerability requires that the HTTP or HTTPS server is enabled on the Cisco IOS device.

Products that are not running Cisco IOS software are not vulnerable.

Cisco has released free software updates that address these vulnerabilities.

The HTTP server may be disabled as a workaround for the vulnerability described in this advisory.

This advisory is available at the following link:


http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai

Additional information on Cisco's security vulnerability policy can be found at the URL:


http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html

CSCtr91106

  • A switch operating as a DHCP server where sessions receive DHCP information from a RADIUS server may experience a crash and DHCP related errors.

Workaround: None. CSCtj48387

  • A vulnerability in the Multicast Source Discovery Protocol (MSDP) implementation of Cisco IOS Software and Cisco IOS XE Software could allow a remote, unauthenticated attacker to cause a reload of an affected device. Repeated attempts to exploit this vulnerability could result in a sustained denial of service (DoS) condition.

Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link:


http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-msdp


Note The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.


Individual publication links are in ''Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication'' at the following link:


http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html

CSCtr28857

  • A switch crashes after displaying the message:
%AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (Unknown MAC) on Interface Gi5/39 AuditSessionID AC156241000000670001BC9.
 

provided the following conditions apply:

A switchport is configured with the following:

authentication event server dead action authorize...

authenticaton event server alive action reinitalize

The RADIUS server was down previously, and a port without traffic (for example, a hub with no devices attached) was authorized into the inaccessible authentication bypass (IAB) VLAN without an associated MAC address.

The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.

Workaround: None. CSCtx61557

  • When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.

Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521

  • After TCAM resources are first exhausted, then freed, CPU remains high.

Workaround: Reconfigure ACLs on all interfaces.CSCuf93866

Not Supported on Supervisor Engine 6-E

  • With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with hardware control plane policing.

Workaround: None. (CSCso93282)

When Supervisor Engine II+10GE attempts to boot in a non-production 4510R+E chassis, the following error message is displayed:

" ERROR!
Sup II+10GE 10GE (X2), 1000BaseX (SFP) not supported in WS-C4510R-E chassis, system can not boot
Rebooting in 10 seconds...
10 09 08 07 06 05 04 03 02 01 "
 

Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.

Workarounds:

Place the Supervisor Engine II+10GE in a seven-slot chassis.

Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.

CSCtl80173

Supervisor Engine 6-E Specific Caveats

  • Systems running Cisco IOS Release 12.2(40)SG do not support the handling of .1Q packets for software QoS lookup.

Workaround: None. (CSCsk66449)

  • Under some conditions, one or more flows continue to be dropped because of DBL even after DBL has been removed from the service policy.

When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.

For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.

Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.

If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457

  • A Catalyst 4500 series switch with Supervisor Engine 6-E supports a maximum of 32 MTU values system wide.

On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.

Workaround: None. (CSCsk52542)

  • On rare occasions, if you use an X2 SR transceiver on a WS-X4706-10GE running
    Cisco IOS Release 12.2(40)SG, you observe CRC errors after a reload or power cycle upon inserting the card or X2.

Workaround: Reinsert the X2. (CSCsk43618)

  • When the CPU transmits a .1X packet on an interface that has an attached egress QoS policy, the packet is not matched and exits without any QoS marking actions.

When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a .1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).

Workaround: None.

Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a .1X packet. (CSCsk72544)

  • If burst is not explicitly configured for a single rate policer, the show policy-map command displays an incorrect burst value.

Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)

  • When you enter the show policy-map vlan vlan command, unconditional marking actions that are configured on the VLAN are not shown.

Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)

  • Supervisor Engine II-Plus-TS in a Catalyst 4503-E chassis running ROMMON lists the chassis type as Unknown. After booting Cisco IOS, the chassis type is listed properly.

Workaround: None. (CSCsl72868)

  • When you specify a DBL action for the class-default class map in a policy map, it might not work depending on the size of the default queue.

Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)

  • Uplinks go down when upgrading the ROMMON of an WS-X45-SUP6-E supervisor from version 0.34 to a later version.

This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.

Workarounds: To resume normal operation, do one of the following:

Reload both supervisor engines with the redundancy reload shelf command.

Power-cycle the standby supervisor engine by briefly pulling it from the chassis.

There is no workaround for the link flap issue. (CSCsm81875)

  • Changing flow control configuration with traffic and pause frames causes some traffic loss.

This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.

Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)

  • When a packet is switched through software on the switch, you might see that the input QoS marking action on that packet does not take effect.

The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.

Workaround: None.

(CSCso96660)

  • If an EtherChannel is a member of a FlexLink pair, then static MAC addresses configured on the EtherChannel are not moved to the alternate port when the EtherChannel fails (FlexLink failure).

Workaround: None. (CSCsq99468)

  • When a CFM Inward Facing MEP (IFM) is configured on a VLAN that is not allocated on a switch port that is DOWN, the show ethernet cfm maintenance-points local command displays the
    IFM CC Status as inactive. When you allocate the VLAN, the CC-status remains inactive.

You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.

Workaround: Unconfigure, and then reconfigure the IFM on the port.

  • When you configure vlan dot1q tag native globally on Supervisor Engine 6-E, MST control packets are tagged on egress on the native VLAN. This conflicts with 802.1s. The Cisco 7600 Series router drops its MST proposal agreements (because it expects the native VLAN MST control packets to be untagged), causing 30 seconds of traffic loss while spanning tree converges.

Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.

CSCsz12611

  • When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type
 

The active supervisor engine also displays following log message for each linecard slot in the chassis:

%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14
 

where n is the slot number

If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:

%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailed
 

While active supervisor engine is up, no traffic can be handled by the switch.

The two supervisor engines might alternately reboot continuously.

Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.

CSCtl84092

  • When a LAN Base image from Cisco IOS Release 12.2(53)SG3 or earlier is loaded on a WS-C4510R+E or WS-C4507R+E chassis, the system hangs and there is no error message.

Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.

Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.

CSCtl89329

  • If Supervisor Engine 6-E or Supervisor Engine 6L-E is inserted in a 4507R+E or 4510R+E chassis, ROMMON incorrectly reports the chassis as 4507R-E or 4510R-E.

Workaround: None. CSCtl74638

Resolved Caveats in Cisco IOS Release 12.2(53)SG4

This section lists the resolved caveats in Release 12.2(53)SG4:

  • When a link fails on a closed REP segment of 16 nodes configured with VLANs on each node, the convergence time exceeds 250ms especially for multicast traffic.

Workaround: None.

This does not impact REP functionality, but it impacts restoration timing. Traffic restoration time after the failure of a REP segment sometimes exceeds 200ms.

CSCsx55704

  • When a link in a REP segment connecting two switches fails, 1 out of 3 attempts result in convergence timing exceeding 300ms.

Workaround: None.

CSCsw42967

  • When CX1 or SFP+ are plugged into a OneX converter (CVR-X2-SFP10G) in a WS-X4908-10GE, the later requires 1 minute to boot the link.

Workaround: None.

CSCtc46340

  • If you are using a large custom Webauth login page on a switch running Cisco IOS Release 12.2(53)SG3 or IOS-XE 3.1.0 SG and multiple user are trying to access custom HTML pages, the switch might reload.

Workaround: Unconfigure the customized HTML page to use default internal Webauth pages and reload the switch after changing the configuration. CSCti81874

  • When you remove an SFP+ from a OneX converter in a X2 slot, it takes approximately 45 seconds for the system to recognize this action. During this time, all commands indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can cause a “duplicate seeprom” error message.

Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:

Enter any commands for that port.

Insert an SFP+ in that port.

Reinsert the removed SFP+ in any other port.

(CSCsv90044)

Open Caveats for Cisco IOS Release 12.2(53)SG3

This section lists the open caveats for Cisco IOS Release 12.2(53)SG3:

  • When you enter the access-list N permit host hostname command on a redundant chassis operating in SSO mode, you might observe the following syslog messages. The command is not synchronized with the redundant supervisor engine, and keepalive warnings appear.
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby
 

Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)

  • In rare instances, when you are using MAC ACL-based policers, the output of the
    show policy-map interface fa6/1 command does not display the packets being matched:
Switch# show policy-map int fa6/1
 
Service-policy output: p1
 
Class-map: c1 (match-all)
0 packets <--------It stays at '0' despite of traffic being received
Match: access-group name fnacl21
police: Per-interface
Conform: 9426560 bytes Exceed: 16573440 bytes
 

Workaround: Verify that the MAC addresses being transmitted through the system are learned.

(CSCef01798)

  • After an SSO switchover, you may receive a “PM-4-PORT_INCONSISTENT” error message on the switch console if you enter the shutdown command, and then enter the no shutdown command on the port that is in UDLD disable state. This does not affect the switch; the port remains in UDLD disable state. Reentering the shutdown command, and then entering the no shutdown command on the same port will ensure that the error message does not reappear.

Workaround: None. (CSCeg48586)

  • When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.

If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.

If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.

On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.

Workaround: Reconnect. (CSCsb11964)

  • After upgrading to 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release. The following table reflects this change.

This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.

QueueID
Old QueueName
New QueueName

 

5

control-packet

control-packet

 

6

rpf-failure

control-packet

 

7

adj-same-if

control-packet

 

8

<unused queue>

control-packet

 

11

<unused queue>

adj-same-if

 

13

acl input log

rfp-failure

 

14

acl input forward

acl input log

Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:

Switch(config)# no monitor session n source cpu queue all rx
Switch(config)# monitor session n source cpu queue <new_Queue_Name>
 

(CSCsc94802)

  • To enable IP CEF (if it is disabled by hardware exhaustion), enter the ip cef distributed command.

Workaround: None. (CSCsc11726)

  • An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.

This situation could occur for these reasons:

A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.

The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.

Workarounds:

Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.

Configure the correct default gateway on the host side. (CSCse75660)

  • When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
    qos account layer2 encapsulation command.

Workaround: None. (CSCsg58526)

  • When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.

This does not affect performance.

Workaround: Enter the no shutdown command. (CSCsg27395)

  • When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.

Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).

  • When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
%XDR-6-XDRINVALIDHDR: XDR for client (CEF push) dropped (slots:2 from slot:3 context:145 length:11) due to: invalid context
 

Workaround: None. This is an informational message. (CSCsi60898)

  • When you send traffic on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225 ms.

Workaround: None. (CSCsm30320)

  • An IP unnumbered configuration is lost after a switch reloads.

Workarounds: Do one of the following:

After a reload, copy the startup-config to the running-config.

Use a loopback interface as the target of the ip unnumbered command.

Change the CLI configuration so that during bootup the router port is created first.

(CSCsq63051)

  • In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
%PM-4-PORT_INCONSISTENT: STANDBY:Port is inconsistent:
 

Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)

  • When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running configuration.

Workaround: Before removing a line card, delete the static