 Feedback
|
Table Of Contents
Device Manager System Requirements
Cisco Network Assistant Compatibility
Finding the Software Version and Feature Set
Deciding Which Files to Download from Cisco.com
Upgrading a Switch by Using Network Assistant
Upgrading a Switch by Using the CLI
Copying the Current Startup Configuration from the Switch to TFTP Server
Using the CLI to Upgrade a Catalyst 2950 LRE or Catalyst 2940 Switch
Using the CLI to Upgrade a Catalyst 2955 Switch or Non-LRE Catalyst 2950 Switch
Recovering from Software Failure
Cisco IOS Limitations and Restrictions
LRE Limitations and Restrictions
Device Manager Limitations and Restriction
Catalyst 2950 Hardware and Software Compatibility Matrixes
Caveat Resolved in Cisco IOS Release 12.1(22)EA10b (Catalyst 2940 only)
Caveats Resolved in Cisco IOS Release 12.1(22)EA10a
Caveats Resolved in Cisco IOS Release 12.1(22)EA10
Updates for All Software Configuration Guides
Corrections to the "Configuring IEEE 802.1x Port-Based Authentication" Chapter
Corrections to the "Configuring Flex Links and the MAC Address-Table Move Update" Chapter
Correction to the "Configuring Voice VLAN" Chapter
Correction to the "Configuring SPAN and RSPAN" Chapter
Updates to the Catalyst 2940 Software Configuration Guide
Correction to the "Configuring DHCP Features" Chapter
Correction to the the "Configuring VLANs" Chapter
Updates to the "Configuring IEEE 802.1x Port-Based Authentication" Chapter
Updates to the Catalyst 2950 Software Configuration Guide
Updates to the "Overview" Chapter
Updates to the "Configuring UDLD" and "Configuring STP" Chapters
Updates to the "Configuring VTP "Chapter
Correction to the "Configuring SNMP" Chapter
Updates to the "Assigning the Switch IP Address and Default Gateway" Chapter
Updates to All Command References
Updates to the Catalyst 2940 Command Reference
Updates to the System Message Guides
Updates to the Regulatory Compliance and Safety Information
Update to the Hardware Installation Guides
Update to the Catalyst 2955 Hardware Installation Guide
Updates for the Catalyst 2950 Hardware Installation Guide
Updates for the Catalyst 2940 Hardware Installation Guide
Obtaining Documentation, Obtaining Support, and Security Guidelines
Release Notes for the Catalyst 2955, Catalyst 2950, and Catalyst 2940 Switches, Cisco IOS Release 12.1(22)EA10 and Later
Revised September 30, 2008
Cisco IOS Release 12.1(22)EA10 and 12.1(22)EA10a run on Catalyst 2955, Catalyst 2950, and Catalyst 2940 switches.
Cisco IOS Release 12.1(22)EA10b runs on the Catalyst 2940 switch.
Review the new software features, open caveats, and resolved caveats sections for information specific to your switch. The information in this document refers to all the switches, unless otherwise noted.
These release notes include important information about this release and any limitations, restrictions, and caveats that apply to it. To verify that these are the correct release notes for your switch:
•
If you are installing a new switch, see the Cisco IOS release label on the rear panel of your switch.
•
•
For the complete list of Catalyst 2955, Catalyst 2950, and Catalyst 2940 switch documentation, see the "Related Documentation" section.
You can download the switch software from this site (registered Cisco.com users with a login password):
http://www.cisco.com/public/sw-center/sw-lan.shtml
This Cisco IOS release is part of a special release of Cisco IOS software that is not released on the same 8-week maintenance cycle that is used for other platforms. As maintenance releases and future Cisco IOS releases become available, they will be posted to Cisco.com in the Cisco IOS software area.
Contents
This information is in the release notes:
•
•
•
•
•
•
System Requirements
The system requirements for this release are described in these sections:
•
•
•
Hardware Supported
The Catalyst 2950 switch is supported by either the standard software image (SI) or the enhanced software image (EI). The Catalyst 2950 Long-Reach Ethernet (LRE) and Catalyst 2955 switches are supported only by the EI. The Catalyst 2940 switch supports some of the features supported by a Catalyst 2950 switch.
The EI provides a richer set of features, including access control lists (ACLs), enhanced quality of service (QoS) features, and extended-range VLANs. The cryptographic SI and EI support the Secure Shell Version 2 (SSHv2) protocol.
For information about the software releases that support the switches listed in Table 1, see the "Catalyst 2950 Hardware and Software Compatibility Matrixes" section.
Table 1 and Table 2 list the hardware supported by this software release:
Table 1 Catalyst 2940, Catalyst 2950, and Catalyst 2955 Hardware Supported
Catalyst 2940-8TT-S
-1
8 10/100 Ethernet ports and 1 10/100/1000 Ethernet port
Catalyst 2940-8TF-S
-1
8 10/100 Ethernet ports, 1 SFP2 module slot, and 1 100BASE-FX port
Catalyst 2950-12
SI
12 fixed autosensing 10/100 Ethernet ports
Catalyst 2950-24
SI
24 fixed autosensing 10/100 Ethernet ports
Catalyst 2950C-24
EI
24 fixed autosensing 10/100 Ethernet ports and 2 100BASE-FX ports
Catalyst 2950G-12-EI
EI
12 fixed autosensing 10/100 Ethernet ports and 2 GBIC3 module slots
Catalyst 2950G-24-EI
EI
24 fixed autosensing 10/100 Ethernet ports and 2 GBIC module slots
Catalyst 2950G-24-EI-DC
EI
24 fixed autosensing 10/100 Ethernet ports and 2 GBIC module slots with DC-input power
Catalyst 2950G-48-EI
EI
48 fixed autosensing 10/100 Ethernet ports and 2 GBIC module slots
Catalyst 2950ST-8 LRE
EI
8 LRE ports, 2 10/100/1000 Ethernet ports4 , and 2 SFP module slots
Catalyst 2950ST-24 LRE
EI
24 LRE ports, 2 10/100/1000 Ethernet ports4, and 2 SFP module slots
Catalyst 2950ST-24 LRE 997
EI
24 LRE ports, 2 10/100/1000 Ethernet ports4, and 2 SFP module slots with DC-input power
Catalyst 2950SX-24
SI
24 fixed autosensing 10/100 Ethernet ports and 2 1000BASE-SX ports
Catalyst 2950SX-48-SI
SI
48 fixed autosensing10/100 Ethernet ports and 2 1000BASE-SX ports
Catalyst 2950T-24
EI
24 fixed autosensing 10/100 Ethernet ports and 2 10/100/1000 Ethernet ports5
Catalyst 2950T-48-SI
SI
48 fixed autosensing 10/100 Ethernet ports and 2 10/100/1000 Ethernet ports
Catalyst 2955C-12
EI
12 fixed autosensing 10/100 ports and 2 MM6 100BASE-FX ports
Catalyst 2955S-12
EI
12 fixed autosensing 10/100 ports and 2 SM7 100BASE-LX ports
Catalyst 2955T-12
EI
12 fixed autosensing 10/100 ports and 2 10/100/1000 Ethernet ports4
1 The Catalyst 2940 switch supports some of the features supported by a Catalyst 2950 switch.
2 SFP = small form-factor pluggable
3 GBIC = Gigabit Interface Converter
4 The 10/100/1000 ports on a Catalyst 2950 LRE or Catalyst 2955T-12 switch operate at 10 or 100 Mbps in either full- or half-duplex mode and at 1000 Mbps only in full-duplex mode.
5 The 10/100/1000 interfaces on the Catalyst 2950T-24 switch do not support the half keyword in the duplex command.
6 MM = multimode
7 SM = single mode
Table 2 Other Hardware Supported
Cisco 575 LRE CPE1
—
1 fixed 10/100 port
Cisco 576 LRE CPE 997
—
1 fixed 10/100 port
Cisco 585 LRE CPE
—
4 fixed 10/100 ports
GBIC modules
—
•
•
•
•
•
•
Redundant power system
—
•
•
•
SFP devices
—
•
•
•
•
•
1 CPE = customer premises equipment
2 CDWM = coarse wavelength-division multiplexing
3 This feature is only supported when your switch is running the EI.
4 DWDM = dense wavelength-division multiplexing
Hardware Not Supported
Table 3 lists the hardware that is not supported by this release.
Table 3 Hardware Not Supported
GBIC module
1000BASE-T GBIC (model WS-G4582)
Redundant power system
Cisco RPS 600 redundant power system
Device Manager System Requirements
These sections describes the hardware and software requirements for using the device manager:
•
•
Hardware Requirements
Table 4 lists the minimum hardware requirements for running the device manager.
Table 4 Minimum Hardware Requirements
Intel Pentium II1
64 MB2
256
1024 x 768
Small
1 We recommend Intel Pentium 4.
2 We recommend 256-MB DRAM.
Software Requirements
Table 5 lists the supported operating systems and browsers for using the device manager. The device manager verifies the browser version when starting a session to ensure that the browser is supported.
Note
Table 5 Supported Operating Systems and Browsers
Windows 2000
None
5.5 or 6.0
7.1
Windows XP
None
5.5 or 6.0
7.1
1 Service Pack 1 or higher is required for Internet Explorer 5.5.
Cluster Compatibility
You cannot create and manage switch clusters through the device manager. To create and manage switch clusters, use the command-line interface (CLI) or the Network Assistant application.
When creating a switch cluster or adding a switch to a cluster, follow these guidelines:
•
•
•
For additional information about clustering, see Getting Started with Cisco Network Assistant and Release Notes for Cisco Network Assistant (not orderable but available on Cisco.com), the software configuration guide, and the command reference.
Cisco Network Assistant Compatibility
Cisco IOS 12.1(11)EA10 and later are compatible with Cisco Network Assistant 5.0 and later. You can download Cisco Network Assistant from this URL:
http://www.cisco.com/pcgi-bin/tablebuild.pl/NetworkAssistant
For more information about Cisco Network Assistant, see the Release Notes for Cisco Network Assistant on Cisco.com.
Upgrading the Switch Software
Before downloading software, read this section for important information. This section describes these procedures for downloading software:
•
•
•
•
•
•
For information about the software releases that support the switches, see the "Catalyst 2950 Hardware and Software Compatibility Matrixes" section.
Note
When you upgrade a switch, the switch continues to operate while the new software is copied to flash memory. If flash memory has enough space, the new image is copied to the selected switch but does not replace the running image until you reboot the switch. If a failure occurs during the copy process, you can still reboot your switch by using the old image. If flash memory does not have enough space for two images, the new image is copied over the existing one. Features provided by the new software are not available until you reload the switch.
If a failure occurs while copying a new image to the switch, and the old image has already been deleted, see the "Recovering from Corrupted Software" section in the "Troubleshooting" chapter of the software configuration guide for this release.
For information about upgrading the LRE switch firmware, see the "Upgrading LRE Switch Firmware" section in the software configuration guide for this release.
Caution
When you first upgrade the switch from a Cisco IOS noncryptographic image to a cryptographic image, the bootloader automatically upgrades. The new bootloader upgrade can take up to 30 seconds. Do not power cycle the switch the first time that you are upgrading the switch to a cryptographic Cisco IOS image. If a power failure occurs when you are copying this image to the switch, call Cisco Systems immediately.
Caution
Finding the Software Version and Feature Set
The image is stored as a bin file in a directory that is named with the Cisco IOS release. A subdirectory contains the files needed for web management. The image is stored on the system board flash device (flash:).
You can use the show version user EXEC command to see the software version that is running on your switch. In the display, check the line that begins with System image file is. This line shows the directory name in flash memory where the image is stored. A couple of lines below the image name, you see Running Enhanced Image if you are running the EI or Running Standard Image if you are running the SI.
You can also use the dir filesystem: privileged EXEC command to see the directory names of other software images that you might have stored in flash memory.
Deciding Which Files to Download from Cisco.com
The upgrade procedures in these release notes describe how to perform the upgrade by using a combined tar file. This file contains both the Cisco IOS image file and the embedded device manager files. You must use the combined tar file to upgrade the switch through the device manager.
The tar file is an archive file from which you can extract files by using the archive tar command.
Note
Table 6 lists the software filenames for this release. These files are posted on Cisco.com.
Table 6 Catalyst 2955, 2950, and Catalyst 2940 Cisco IOS Software Files
c2955-i6k2l2q4-tar.121-22.EA10a.tar
Catalyst 2955 EI files. This includes the cryptographic Cisco IOS image and the device manager files.
c2955-i6q4l2-tar.121-22.EA10a.tar
Catalyst 2955 EI files. This includes the Cisco IOS image and the device manager files.
c2950-i6k2l2q4-tar.121-22.EA10a.tar
Catalyst 2950 SI1 and EI files. This includes the cryptographic Cisco IOS image and the device manager files.
c2950-i6q4l2-tar.121-22.EA10a.tar
Catalyst 2950 SI and EI files. This includes the Cisco IOS image and the device manager files.
c2950lre-i6k2l2q4-tar.121-22.EA10a.tar
Catalyst 2950 LRE EI files. This includes the cryptographic Cisco IOS image and the device manager files.
c2950lre-i6l2q4-tar.121-22.EA10a.tar
Catalyst 2950 LRE EI files. This includes the Cisco IOS image and the device manager files.
c2940-i6k2l2q4-tar.121-22.EA10a.tar
Catalyst 2940 files. This includes the cryptographic Cisco IOS image and the device manager files.
c2940-i6q4l2-tar.121-22.EA10a.tar
Catalyst 2940 files. This includes the Cisco IOS image and the device manager files.
1 Switches that support only the SI cannot run the cryptographic image. For more information, see the SI-only switches listed in Table 1 and the "Cisco IOS Limitations and Restrictions" section.
Archiving Software Images
Before upgrading your switch software, make sure that you have archived copies of the current Cisco IOS release and the Cisco IOS release to which you are upgrading. You should keep these archived images until you have upgraded all devices in the network to the new Cisco IOS image and until you have verified that the new Cisco IOS image works properly in your network.
Cisco routinely removes old Cisco IOS versions from Cisco.com. See Product Bulletin 2863 for more information:
http://www.cisco.com/en/US/partner/products/sw/iosswrel/ps5187/prod_bulletin0900aecd80281c0e.
HtmlYou can copy the bin software image file on the flash memory to the appropriate TFTP directory on a host by using the copy flash: tftp: privileged EXEC command.
Note
You can also configure the switch as a TFTP server to copy files from one switch to another without using an external TFTP server by using the tftp-server global configuration command. For more information about the tftp-server command, see the "Additional File Transfer Commands" section of the Cisco IOS Configuration Fundamentals Command Reference, Release 12.1 at this URL:
Upgrading a Switch by Using Network Assistant
To upgrade a switch by using Network Assistant, choose Maintenance>Software Upgrade from the feature bar. For detailed instructions, click Help.
Note
Upgrading a Switch by Using the CLI
To upgrade the switch software by using the CLI, see Table 6 to decide which software files that you need, and then follow these procedures in this order:
1.
2.
3.
–
–
Downloading the Software
This procedure is for copying the combined tar file to a switch. You copy the file to the switch from a TFTP server and extract the files. You can download an image file and replace or keep the current image.
Follow these steps to download the software from Cisco.com to your management station:
Step 1
Go to this URL and log in to download the appropriate files:
http://www.cisco.com/public/sw-center/sw-lan.shtml
To download the files, click the link for your switch platform, and then follow the links on the page to select the correct tar image file.
Step 2
New features provided by the software are not available until you reload the software.
Copying the Current Startup Configuration from the Switch to TFTP Server
When you make changes to a switch configuration, your changes become part of the running configuration. When you enter the command to save those changes to the startup configuration, the switch copies the configuration to the config.text file in flash memory. To ensure that you can recreate the configuration if a switch fails, you might want to copy the config.text file from the switch to a TFTP server.
Beginning in privileged EXEC mode, follow these steps to copy a switch configuration file to the TFTP server.
Step 1
switch# copy flash:config.text tftpStep 2
Address or name of remote host []? ip_addressStep 3
Destination filename [config.text]? yes/noStep 4
Using the CLI to Upgrade a Catalyst 2950 LRE or Catalyst 2940 Switch
Use this procedure for upgrading your Catalyst 2950 LRE or Catalyst 2940 switch by using the archive download-sw privileged EXEC command to automatically extract and download the Cisco IOS image and the device manager files to the switch. The archive download-sw command initiates this process:
•
•
•
•
•
For further information on this command, see the command reference for this release.
Follow these steps to upgrade the switch software by using a TFTP transfer:
Step 1
Step 2
To start a Telnet session on your PC or workstation, enter this command:
server% telnet switch_ip_addressEnter the Telnet password if you are prompted to do so.
Step 3
switch> enable switch#Enter the password if you are prompted to do so.
Step 4
Switch# ping tftp-server-addressFor more information about assigning an IP address and default gateway to the switch, see the software configuration guide for this release.
Step 5
archive download-sw /overwrite /reload tftp:[[//location]/directory]/image-name.tarThe /overwrite option overwrites the software image in flash memory with the downloaded one.
Note
The /reload option reloads the system after downloading the image unless the configuration has been changed and not saved.
For //location, specify the IP address of the TFTP server.
For /directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case-sensitive.
This example shows how to download an image from a TFTP server at 198.30.20.19 and to overwrite the image on the switch:
Switch# archive download-sw /overwrite tftp://198.30.20.19/c2940-i612-tar.121-22.EA10.tarYou can also download the image file from the TFTP server to the switch and keep the current image by replacing the /overwrite option with the /leave-old-sw option.
Your Telnet session ends when the switch reloads.
After the switch reboots, use Telnet to return to the switch, and enter the show version user EXEC command to verify the upgrade procedure. If you have a previously opened browser session to the upgraded switch, close the browser, and start it again to ensure that you are using the latest HTML files.
Using the CLI to Upgrade a Catalyst 2955 Switch or Non-LRE Catalyst 2950 Switch
Use this procedure for upgrading your Catalyst 2955 or non-LRE Catalyst 2950 switch by copying the tar file to the switch. You copy the Cisco IOS image and the device manager files to the switch from a TFTP server and then extract the files by entering the archive tar command, with these results:
•
•
•
Caution
When you first upgrade the switch from a Cisco IOS noncryptographic image to a cryptographic image, the bootloader automatically upgrades. The new bootloader upgrade can take up to 30 seconds. Do not power cycle the switch the first time that you are upgrading the switch to a cryptographic Cisco IOS image. If a power failure occurs when you are copying this image to the switch, call Cisco Systems immediately.
Before downloading the new image, use the dir user EXEC command to confirm that you have enough space on the flash. The new image and HTML files will be slightly larger than the size of the tar file.
If you do not have enough space on the flash for the tar file, delete any old unused Cisco IOS images. If that does not free up enough flash space, delete the HTML files.
Caution
Step 1
Step 2
To start a Telnet session on your PC or workstation, enter this command:
server% telnet switch_ip_addressEnter the Telnet password if you are prompted to do so.
Step 3
switch> enable switch#Enter the password if you are prompted to do so.
Step 4
switch# delete /r /f flash:htmlwhere /r is for /recursive and /f is for /force. This command deletes all the switch HTML files and subdirectories.
Press Enter to confirm the deletion of each file. Do not press any other keys during this process.
Note
Step 5
Caution
switch# archive tar /x tftp://server_ip_address/path/filename.tar flash: Loading /path/filename.tar from server_ip_address (via VLAN1):!) extracting info (110 bytes)extracting c2950-i6q4l2-mz.121-13.EA1c.bin (2239579 bytes)!!!!!!!!!!!!!!!!!!!!html/ (directory)extracting html/Detective.html.gz (1139 bytes)!extracting html/ieGraph.html.gz (553 bytes)extracting html/DrawGraph.html.gz (787 bytes)extracting html/GraphFrame.html.gz (802 bytes)!...Depending on the TFTP server being used, you might need to enter only one slash (/) after the server_ip_address in the archive tar command.
Step 6
switch# show boot BOOT path-list: flash:current_image Config file: flash:config.text Enable Break: 1 Manual Boot: no HELPER path-list: NVRAM/Config file buffer size: 32768Step 7
switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z.Step 8
switch(config)# boot system flash:new_imageFor example:
switch(config)# boot system flash:c2950-i6q4l2-mz.121-13.EA1c.bin
Note
Step 9
switch(config)# endStep 10
switch# reload System configuration has been modified. Save? [yes/no]:y Proceed with reload? [confirm]Step 11
Your Telnet session ends when the switch reloads.
After the switch reboots, use Telnet to return to the switch, and enter the show version user EXEC command to verify the upgrade procedure. If you have a previously opened browser session to the upgraded switch, close the browser, and start it again to ensure that you are using the latest device manager files.
Recovering from Software Failure
If the software fails, you can reload the software. For detailed recovery procedures, see the "Troubleshooting" chapter in the software configuration guide for your switch.
Installation Notes
You can assign IP information to your switch by using one of these methods:
•
For more information about Express Setup, see the "Quick Setup" chapter in the Catalyst 2950 and Catalyst 2940 getting started guides.
•
This procedure is described in the Catalyst 2955, Catalyst 2950, and Catalyst 2940 hardware installation guides.
•
•
New Features
These sections describe the new supported hardware and the new software features provided in this release:
•
•
New Hardware Features
For a complete list of supported hardware, see the "Hardware Supported" section.
New Software Features
This is the new software feature in this release: DHCP-based autoconfiguration with a saved configuration file.
Limitations and Restrictions
You should review this section before you begin working with the switches. These are known limitations that will not be fixed, and there is not always a workaround. Some features might not work as documented, and some features could be affected by recent changes to the switch hardware or software.
Note
These sections describe the limitations and restrictions:
•
•
•
•
Cisco IOS Limitations and Restrictions
These limitations and restrictions apply to the Cisco IOS configuration:
•
–
–
–
•
•
•
•
The workaround is to make sure that the DHCP server contains reserved addresses that are bound to each switch by the switch hardware address so that the switch does not get its IP address from the dynamic pool. (CSCds58369)
•
•
•
–
–
There is no workaround. (CSCdt48011)
•
•
The workaround is to enable BackboneFast on all switches. (CSCdv02941)
•
The workaround is to manually re-initiate authentication by either logging off or detaching the link and then reconnecting it. (CSCdv19671)
•
The workaround is to not cross-connect VLANs. For example, do not use an access port to connect VLAN 1 to VLAN 65 on either the same switch or from one switch to another switch. (CSCdv27247)
•
•
The workaround is to set the mode to dynamic for Catalyst 2950 switches that are connected to IGMP-capable devices. The new group can join the multicast stream if another stream is dynamically removed from the group. (CSCdv45190)
•
The workaround is to connect Catalyst 3550 switches by using the access link on the command switches management VLAN or to configure an IEEE 802.1Q trunk with a native VLAN that is the same as the management VLAN of the command switch. (CSCdv49871)
•
The workaround is to configure both sides of a link to the same speed or use autonegotiation. (CSCdv62271)
•
The workaround is to manually enter the command again after a reboot. (CSCdv67047)
•
The workaround is to make sure that the management VLANs of all Catalyst 2900 XL or 3500 XL switches in the stack are set to VLAN 1. (CSCdv82224)
•
•
–
–
–
–
Note
There is no workaround. (CSCdw48441)
•
•
–
If the switch has 2 trunk ports, it can have up to 64 VLANs.
If the switch has 32 VLANs, it can have up to 4 trunk ports.
–
If your switch has a saved configuration that does not meet the previous conditions and you upgrade the switch software to the cryptographic software image, the switch might run out of memory. If this happens, the switch does not operate properly. For example, it might continuously reload.
If the switch runs out of memory, this message appears:
%SYS-2-MALLOCFAIL: Memory allocation of (number_of_bytes) bytes failed ...The workaround is to check your switch configuration and ensure that it meets the previous conditions. (CSCdw66805)
•
The workaround is to specify an action in the policy map. (CSCdx75308)
•
The workaround is to manually add the cluster community string with the VLAN entity on the member switches for all active VLANs shown in the show spanning-tree summary display. This is an example of such a change, where cluster member 3 has spanning tree on vlan 1-3, and the cluster commander community string is public@es3.
Switch(config)# snmp community public@es3@1 ROSwitch(config)# snmp community public@es3@2 ROSwitch(config)# snmp community public@es3@3 ROThere is no workaround. (CSCdx95501)
•
If the join and leave messages arrive at high rate, the CPU can become busy processing these messages. For example, the CPU usage is approximately 50 percent when 50 pairs of join and leave messages are received each second. Depending on the rate at which join and leave messages are received, the CPU usage can go very high, even up to 100 percent, as the switch continues processing these messages.
The workaround is to only use the Immediate Leave processing feature on VLANs where a single host is connected to each port. (CSCdx95638)
•
The workaround is to manually assign an IP address to the switch. (CSCdy08716)
•
These are the workarounds:
–
–
•
•
The workaround is to configure the port as a static access port. (CSCdz32556)
•
There is no workaround. The number of interrupts does not affect the switch functionality. (CSCdz34545)
•
•
–
–
•
These are the workarounds:
–
switch# terminal length 0
–
–
•
The workaround is to match the configured VLANs on each side of the trunk port. (CSCea23138)
•
The workaround is to configure Port Fast globally by using the spanning-tree portfast global configuration command. (CSCea24969)
•
•
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to upThen the switch that restarted does not forward traffic until the spanning-tree state enters the forwarding state. This can occur on a switch running Cisco IOS Release 12.1(13)EA1 or later. (CSCea47230)
•
•
Note
The workaround is to place the ports in static-access mode for a single VLAN, if the topology supports this configuration. (CSCec13986)
•
This problem occurs when:
–
–
–
The workaround is to use fewer than 75 ACEs per port group when configuring the ports to trust DSCP. (CSCed11617)
•
The workaround is to configure the port for 10 Mbps and half duplex or to connect a hub or a nonaffected device to the switch. (CSCed39091)
•
These are the workarounds:
–
–
•
ERROR interrupt: PCI Fatal Error on DMA CH0This problem occurs when there is an EtherChannel between two switches, traffic is sent between the switches, and the RSPAN or SPAN source port is configured to monitor sent traffic.
The workaround is to stop the SPAN traffic, and then delete and recreate the VLAN. (CSCeh20389)
•
When two Catalyst 2950SX-48-SI, 2950G-24-EI, or 2950T-48-SI switches are connected back to back, and both sides of the link change from 100 Mbps half duplex to 10 Mbps half duplex, only one side of the link becomes error disabled. This error message appears:
Nov 22 19:03:10: %ETHCNTR-3-HALF_DUX_COLLISION_EXCEED_THRESHOLD: Half-duplex loopback detected, collision threshold exceeded on FastEthernet0/24.Nov 22 19:03:10: %PM-4-ERR_DISABLE: loopback error detected on Fa0/24, putting Fa0/24 in err-disable stateNov 22 19:03:11: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/24, changed state to downNov 22 19:03:12: %LINK-3-UPDOWN: Interface FastEthernet0/24, changed state to downThere is no workaround. (CSCsd43109)
•
Table 7 Port Security Incompatibility with Other Switch Features
No
No
Trunk port
No
No
Dynamic-access port3
No
No
SPAN source port
Yes
Yes
SPAN destination port
No
No
EtherChannel
No
No
Protected port
Yes
Yes
IEEE 802.1x port
-
Yes4
Voice VLAN port5
Yes
Yes
1 DTP = Dynamic Trunking Protocol
2 A port configured with the switchport mode dynamic interface configuration command.
3 A VLAN Query Protocol (VQP) port configured with the switchport access vlan dynamic interface configuration command.
4 The switch must be running the enhanced software image (EI).
5 You must set the maximum allowed secure addresses on the port to two plus the maximum number of secure addresses allowed on the access VLAN.
LRE Limitations and Restrictions
These limitations and restrictions apply only to Catalyst 2950 LRE switches:
•
There is no workaround. The Ethernet port on the Cisco 585 LRE CPE does not support VLANs. All the ports are assumed to be in the same VLAN. (CSCdx03708)
•
There is no workaround. You must ensure that the network does not send ISL tagged frames of sizes between 1537 and 1544 bytes to an LRE switch. (CSCdx25940)
•
There is no workaround; only 1000 buckets per interface are supported. (CSCdy38390)
•
The workaround is to use the Cisco 1000BASE-T GBIC only with compatible switches. (CSCdy53369)
•
•
The workaround is to use the switchport port-security maximum value interface configuration command to change the default value. For interfaces connected to Cisco 575 LRE and Cisco 576 LRE 997 CPEs, the default value can be 1. For interfaces connected to Cisco 585 LRE CPEs, the value can be 5 because the CPE has four Fast Ethernet ports and one additional MAC address. (CSCdy73748)
•
There is no workaround. These CPE Fast Ethernet statistics are supported by the Cisco 575 LRE CPE and the Cisco 576 LRE 997 CPE (CSCdy89348):
1 Transmit receive 0 bytes0 Bytes0 Unicast frames0 Broadcast frames0 Pause frames0 Alignment errors0 One collision frames0 Multiple collisions0 Undersize frames0 Late collisions0 Oversize frames0 Excess collisions0 FCS errors0 Deferred frames•
There is no workaround. (CSCdz06748)
•
•
There is no workaround. (CSCea41362)
•
•
The workaround is to reset the CPE port by using the cpe shutdown followed by the no cpe shutdown interface configuration command. This activates the Fast Ethernet link on the CPE port. (CSCeb35007)
•
Configure UDLD aggressive mode (using the udld port aggressive interface configuration command) on both the Catalyst switch and neighboring device, and change the error- disable recovery options by using the errdisable recovery cause udld and errdisable recovery interval 60 global configuration commands. (CSCee57059)
•
If the switch configuration is saved and the switch restarts, this does not affect the switch. However, if the flow control configuration for an LRE port is changed and the switch is not rebooted, the commands do not take effect unless you shut down and bring up the LRE link.
The workaround is to enter the shutdown and no shutdown interface configuration commands on an interface after entering a flowcontrol interface configuration command, such as the flowcontrol receive or the flowcontrol send command. (CSCef26565)
Device Manager Limitations and Restriction
These device manager limitations and restrictions:
•
•
The workaround is to click Yes when you are prompted to accept the certificate. (CSCef45718)
Catalyst 2950 Hardware and Software Compatibility Matrixes
Some Catalyst 2950 switches are not supported by certain software releases.
Table 8 lists the Catalyst 2950-12, 2950-24, 2950C-24, and 2950T-24 switches and the software releases supporting them. The serial numbers are on the switch rear panel. In this table, Yes means that the switch is supported by the software release; No means that the switch is not supported by the release.
The Catalyst 2950G-12-EI, 2950G-24-EI, 2950G-24-EI-DC, and 2950G-48-EI switches are supported by Cisco IOS Release 12.1(6)EA2 or later.
The Catalyst 2950SX-24 switches are supported by Cisco IOS Release 12.1(9)EA1d or later.
The Catalyst 2955 switches are supported by Cisco IOS Release 12.1(12c)EA1 or later.
The Catalyst 2950ST-8 LRE and 2950ST-24 LRE switches are supported by Cisco IOS Release 12.1(11)YJ or later.
The Catalyst 2950ST-24 LRE 997 switches are supported by Cisco IOS Release 12.1(11)YJ4 or later.
The Cisco LRE CPE devices are not supported by certain Catalyst 2950 LRE switches. In Table 9, Yes means that the CPE is supported by the switch; No means that the CPE is not supported by the switch.
Important Notes
Note
This section describes important informations related to this release:
•
Cisco IOS Notes
These are the important Cisco IOS configuration notes related to this release:
•
If you have IEEE 802.1x configured on the switch and you upgrade to Cisco IOS Release 12.1(14)EA1 or later, the configuration file does not contain the new commands, and IEEE 802.1x does not operate. After the upgrade is complete, make sure to globally enable IEEE 802.1x by using the dot1x system-auth-control global configuration command. For more information, see the software configuration guide for this release.
•
•
•
•
The workaround is to change the number of seconds between re-authentication attempts by using the dot1x timeout re-authperiod seconds global configuration command. (CSCdz38483)
•
The workaround is to either release and renew the IP address or to change the default timers. These examples show typical interface timer changes:
dot1x timeout quiet-period 3
dot1x timeout tx-period 5
•
•
00:02:57: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.20.246.206:1645,1646 is not responding.If this message appears, check that there is network connectivity between the switch and the ACS. You should also check that the switch has been properly configured as an AAA client on the ACS.
Device Manager Notes
These notes apply to the device manager:
•
From Microsoft Internet Explorer:
1.
2.
3.
4.
5.
•
Beginning in privileged EXEC mode, follow these steps to configure the HTTP server interface:
•
If you change the HTTP port, you must include the new port number when you enter the IP address in the browser Location or Address field (for example, http://10.1.126.45:184, where 184 is the new HTTP port number). You should write down the port number through which you are connected. Use care when changing the switch IP information.
If you are not using the default method of authentication (the enable password), configure the HTTP server interface with the method of authentication used on the switch.
Beginning in privileged EXEC mode, follow these steps to configure the HTTP server interface:
•
Open Caveats
This section describes the open caveats that might cause possible unexpected activity in this software release. Unless otherwise noted, these severity 3 Cisco IOS configuration caveats apply to the Catalyst 2955, 2950, and 2940 switches.
There are no open caveats for this release.
Resolved Caveats
These sections describe the caveats that have been resolved in these releases:
•
•
•
Note
Caveat Resolved in Cisco IOS Release 12.1(22)EA10b (Catalyst 2940 only)
This caveat was resolved in Cisco IOS Release 12.1(22)EA10b for the Catalyst 2940 switch:
•
When booting up a Catalyst 2940 switch, you no longer receive an Assert Failure error message.
Caveats Resolved in Cisco IOS Release 12.1(22)EA10a
These are the Cisco IOS caveats resolved in Cisco IOS Release 12.1(22)EA10a:
•
The switch no longer might reload with a signal 10 exception.
•
When an IEEE 802.1x-enabled interface has MAC authentication bypass (MAB) and guest VLAN enabled and the multiple-host mode configured, the switch no longer reloads if it receives traffic that is not an Extensible Authentication Protocol (EAP) frame and has a MAC address that is not in the MAB profile.
Caveats Resolved in Cisco IOS Release 12.1(22)EA10
These are the Cisco IOS caveats resolved in Cisco IOS Release 12.1(22)EA10:
•
Cisco IOS device may crash while processing malformed Secure Sockets Layer (SSL) packets. In order to trigger these vulnerabilities, a malicious client must send malformed packets during the SSL protocol exchange with the vulnerable device.
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
•
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. There are workarounds available to mitigate the effects of these vulnerabilities.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-SSL.shtml.
Note
A combined software table for Cisco IOS is available to aid customers in choosing a software releases that fixes all security vulnerabilities published as of May 22, 2007. This software table is available at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20070522-cry-bundle.shtml.
•
Cisco IOS device may crash while processing malformed Secure Sockets Layer (SSL) packets. In order to trigger these vulnerabilities, a malicious client must send malformed packets during the SSL protocol exchange with the vulnerable device.
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
Cisco IOS is affected by the following vulnerabilities:
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. There are workarounds available to mitigate the effects of these vulnerabilities.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-SSL.shtml.
Note
A combined software table for Cisco IOS is available to aid customers in choosing a software releases that fixes all security vulnerabilities published as of May 22, 2007. This software table is available at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20070522-cry-bundle.shtml.
•
Cisco IOS device may crash while processing malformed Secure Sockets Layer (SSL) packets. In order to trigger these vulnerabilities, a malicious client must send malformed packets during the SSL protocol exchange with the vulnerable device.
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
Cisco IOS is affected by the following vulnerabilities:
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. There are workarounds available to mitigate the effects of these vulnerabilities.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-SSL.shtml.
Note
A combined software table for Cisco IOS is available to aid customers in choosing a software releases that fixes all security vulnerabilities published as of May 22, 2007. This software table is available at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20070522-cry-bundle.shtml.
•
Two crafted Protocol Independent Multicast (PIM) packet vulnerabilities exist in Cisco IOS software that may lead to a denial of service (DoS) condition. Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-multicast.shtml.
•
Multiple vulnerabilities exist in the Session Initiation Protocol (SIP) implementation in Cisco IOS that can be exploited remotely to trigger a memory leak or to cause a reload of the Cisco IOS device.
Cisco has released free software updates that address these vulnerabilities. Fixed Cisco IOS software listed in the Software Versions and Fixes section contains fixes for all vulnerabilities addressed in this advisory.
There are no workarounds available to mitigate the effects of any of the vulnerabilities apart from disabling the protocol or feature itself, if administrators do not require the Cisco IOS device to provide voice over IP services.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml.
•
Open Shortest Path First (OSPF) routes now appear in the routing table after a topology change if Incremental SPF (iSPF) is enabled.
•
Cisco uBR10012 series devices automatically enable Simple Network Management Protocol (SNMP) read/write access to the device if configured for linecard redundancy. This can be exploited by an attacker to gain complete control of the device. Only Cisco uBR10012 series devices that are configured for linecard redundancy are affected.
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20080924-ubr.shtml
•
When a Cisco IP phone is connected to the switch, only the voice VLAN ID (VVID) learns the switch MAC address.
After dynamic MAC addresses are deleted, only the voice VLAN relearns the IP phone MAC address. (In previous releases, the MAC address was learned on both the Voice VLAN and PVID.)
•
Multiple Cisco products contain either of two authentication vulnerabilities in the Simple Network Management Protocol version 3 (SNMPv3) feature. These vulnerabilities can be exploited when processing a malformed SNMPv3 message. These vulnerabilities could allow the disclosure of network information or may enable an attacker to perform configuration changes to vulnerable devices. The SNMP server is an optional service that is disabled by default. Only SNMPv3 is impacted by these vulnerabilities. Workarounds are available for mitigating the impact of the vulnerabilities described in this document.
The United States Computer Emergency Response Team (US-CERT) has assigned Vulnerability Note VU#878044 to these vulnerabilities.
Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-0960 has been assigned to these vulnerabilities.
This advisory will be posted at http://www.cisco.com/warp/public/707/cisco-sa-20080610-snmpv3.shtml
•
A series of segmented Skinny Call Control Protocol (SCCP) messages may cause a Cisco IOS device that is configured with the Network Address Translation (NAT) SCCP Fragmentation Support feature to reload.
Cisco has released free software updates that address this vulnerability. A workaround that mitigates this vulnerability is available.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-sccp.shtml.
•
On a switch running Cisco IOS Release 12.2(22)EA7 or later, when you enter the IEEE 802.1x max-reauth-req 1 interface configuration command on an IEEE 802.1x-enabled port, the IEEE authentication process no longer consumes up to 99 percent of the CPU usage.
•
On a Catalyst switch cluster with clustering and an HSRP standby management address configured on the switches in the cluster, a copy of user IP and UDP traffic with the UDP destination port equal to 1985 is no longer sent to the MAC address of the default gateway configured on the switch.
•
Multiple vulnerabilities exist in the Session Initiation Protocol (SIP) implementation in Cisco IOS that can be exploited remotely to trigger a memory leak or to cause a reload of the Cisco IOS device.
Cisco has released free software updates that address these vulnerabilities. Fixed Cisco IOS software listed in the Software Versions and Fixes section contains fixes for all vulnerabilities addressed in this advisory.
There are no workarounds available to mitigate the effects of any of the vulnerabilities apart from disabling the protocol or feature itself, if administrators do not require the Cisco IOS device to provide voice over IP services.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml.
•
Cisco IOS software configured for Cisco IOS firewall Application Inspection Control (AIC) with a HTTP configured application-specific policy are vulnerable to a Denial of Service when processing a specific malformed HTTP transit packet. Successful exploitation of the vulnerability may result in a reload of the affected device.
Cisco has released free software updates that address this vulnerability.
A mitigation for this vulnerability is available. See the "Workarounds" section of the advisory for details.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosfw.shtml.
•
A vulnerability exists in the Cisco IOS software implementation of Layer 2 Tunneling Protocol (L2TP), which affects limited Cisco IOS software releases.
Several features enable the L2TP mgmt daemon process within Cisco IOS software, including but not limited to Layer 2 virtual private networks (L2VPN), Layer 2 Tunnel Protocol Version 3 (L2TPv3), Stack Group Bidding Protocol (SGBP) and Cisco Virtual Private Dial-Up Networks (VPDN). Once this process is enabled the device is vulnerable.
This vulnerability will result in a reload of the device when processing a specially crafted L2TP packet.
Cisco has released free software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are available in the "workarounds" section of the advisory.
The advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-l2tp.shtml.
•
On Catalyst 2950 switches running Cisco IOS Release 12.1(22)EA10 or later, MAC address entries no longer remain in the linkdown physical interface of the port channel.
•
A Cisco IOS device may crash while processing an SSL packet. This can happen during the termination of an SSL-based session. The offending packet is not malformed and is normally received as part of the packet exchange.
Cisco has released free software updates that address this vulnerability.
Aside from disabling affected services, there are no available workarounds to mitigate an exploit of this vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-ssl.shtml.
•
A series of segmented Skinny Call Control Protocol (SCCP) messages may cause a Cisco IOS device that is configured with the Network Address Translation (NAT) SCCP Fragmentation Support feature to reload.
Cisco has released free software updates that address this vulnerability. A workaround that mitigates this vulnerability is available.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-sccp.shtml.
•
A Catalyst 2940 switch running Cisco IOS Release 12.1(22)EA10 or later no longer reloads when IEEE 802.1x clients are authenticating.
•
Multiple vulnerabilities exist in the Session Initiation Protocol (SIP) implementation in Cisco IOS that can be exploited remotely to trigger a memory leak or to cause a reload of the Cisco IOS device.
Cisco has released free software updates that address these vulnerabilities. Fixed Cisco IOS software listed in the Software Versions and Fixes section contains fixes for all vulnerabilities addressed in this advisory.
There are no workarounds available to mitigate the effects of any of the vulnerabilities apart from disabling the protocol or feature itself, if administrators do not require the Cisco IOS device to provide voice over IP services.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml.
•
Two crafted Protocol Independent Multicast (PIM) packet vulnerabilities exist in Cisco IOS software that may lead to a denial of service (DoS) condition. Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-multicast.shtml.
•
Multiple vulnerabilities exist in the Session Initiation Protocol (SIP) implementation in Cisco IOS that can be exploited remotely to trigger a memory leak or to cause a reload of the Cisco IOS device.
Cisco has released free software updates that address these vulnerabilities. Fixed Cisco IOS software listed in the Software Versions and Fixes section contains fixes for all vulnerabilities addressed in this advisory.
There are no workarounds available to mitigate the effects of any of the vulnerabilities apart from disabling the protocol or feature itself, if administrators do not require the Cisco IOS device to provide voice over IP services.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml.
•
The Cisco IOS Intrusion Prevention System (IPS) feature contains a vulnerability in the processing of certain IPS signatures that use the SERVICE.DNS engine. This vulnerability may cause a router to crash or hang, resulting in a denial of service condition.
Cisco has released free software updates that address this vulnerability. There is a workaround for this vulnerability.
NOTE: This vulnerability is not related in any way to CVE-2008-1447 - Cache poisoning attacks. Cisco Systems has published a Cisco Security Advisory for that vulnerability, which can be found at http://www.cisco.com/en/US/products/products_security_advisory09186a00809c2168.shtml.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080924-iosips.shtml.
Documentation Updates
These are the updates to the product documentation:
•
•
•
•
•
•
•
•
•
•
Updates for All Software Configuration Guides
Although the IEEE 802.1x inaccessible authentication bypass feature is mentioned in the Catalyst 2940 Switch Software Configuration Guide and the Catalyst 2950 Switch Software Configuration Guide, Catalyst 2950 and 2940 switches do not support this feature.
The information about the IGMP querier feature in the Catalyst 2955, 2950, and 2940 Switch Software Configuration Guide is incorrect. The Catalyst 2955 switch does not support the IGMP querier feature.
Corrections to the "Configuring IEEE 802.1x Port-Based Authentication" Chapter
This information about the dot1x timeout tx-period seconds interface configuration command is incorrect:
The range for seconds is from 5 to 65535.
The correct range is from 1 to 65535 seconds.
Corrections to the "Configuring Flex Links and the MAC Address-Table Move Update" Chapter
This information in the "MAC Address-Table Move Update" section is incorrect:
The switch then starts forwarding traffic from the server to the PC through port 4, which reduces the loss of traffic from the server to the PC.
This is the correct information:
Switch A does not need to wait for the MAC address-table update. The switch detects a failure on port 1 and immediately starts forwarding server traffic from port 2, the new forwarding port. This change occurs in 100 milliseconds (ms). The PC is directly connected to switch A, and the connection status does not change. Switch A does not need to update the PC entry in the MAC address table.
Correction to the "Configuring Voice VLAN" Chapter
The native VLAN was changed from VLAN 0 to VLAN 1 in the "Configuring Voice VLAN" chapter.
Correction to the "Configuring SPAN and RSPAN" Chapter
The following guideline was updated in the RSPAN Configuration Guidelines in the "Configuring SPAN and RSPAN" chapter:
RSPAN does not support BPDU packet monitoring or other Layer 2 switch protocols or any other traffic to or from the switch IP address and the MAC address, including management traffic.
Updates to the Catalyst 2940 Software Configuration Guide
Correction to the "Configuring DHCP Features" Chapter
Removed ip dhcp snooping limit rate, ip dhcp snooping trust, and ip dhcp snooping verify mac-address commands in the "Configuring DHCP Features" chapter.
Correction to the the "Configuring VLANs" Chapter
The "Configuring VLANs" chapter of the Catalyst 2940 software configuration guide states that the switches support 64 spanning-tree instances. Previous versions of the software configuration guide stated that the switches only support 10 spanning-tree instances.
Updates to the "Configuring IEEE 802.1x Port-Based Authentication" Chapter
These sections were added to the "Configuring IEEE 802.1x Port-Based Authentication" chapter:
•
•
Using IEEE 802.1x Authentication with MAC Authentication Bypass
You can configure the switch to authorize clients based on the client MAC address by using the MAC authentication bypass feature. For example, you can enable this feature on IEEE 802.1x ports connected to devices such as printers.
If IEEE 802.1x authentication times out while waiting for an EAPOL response from the client, the switch tries to authorize the client by using MAC authentication bypass.
When the MAC authentication bypass feature is enabled on an IEEE 802.1x port, the switch uses the MAC address as the client identity. The authentication server has a database of client MAC addresses that are allowed network access. After detecting a client on an IEEE 802.1x port, the switch waits for an Ethernet packet from the client. The switch sends the authentication server a RADIUS-access/request frame with a username and password based on the MAC address. If authorization succeeds, the switch grants the client access to the network. If authorization fails, the switch assigns the port to the guest VLAN if one is configured.
If an EAPOL packet is detected on the interface during the lifetime of the link, the switch determines that the device connected to that interface is an IEEE 802.1x-capable supplicant and uses IEEE 802.1x authentication (not MAC authentication bypass) to authorize the interface. EAPOL history is cleared if the interface link status goes down.
If the switch already authorized a port by using MAC authentication bypass and detects an IEEE 802.1x supplicant, the switch does not unauthorize the client connected to the port. When re-authentication occurs, the switch uses IEEE 802.1x authentication as the preferred re-authentication process if the previous session ended because the Termination-Action RADIUS attribute value is DEFAULT.
Clients that were authorized with MAC authentication bypass can be re-authenticated. The re-authentication process is the same as that for clients that were authenticated with IEEE 802.1x authentication. During re-authentication, the port remains in the previously assigned VLAN. If re-authentication is successful, the switch keeps the port in the same VLAN. If re-authentication fails, the switch assigns the port to the guest VLAN, if one is configured.
If re-authentication is based on the Session-Timeout RADIUS attribute (Attribute[27]) and the Termination-Action RADIUS attribute (Attribute [29]) and if the Termination-Action RADIUS attribute (Attribute [29]) action is Initialize, (the attribute value is DEFAULT), the MAC authentication bypass session ends, and connectivity is lost during re-authentication. If MAC authentication bypass is enabled and the IEEE 802.1x authentication times out, the switch uses the MAC authentication bypass feature to initiate re-authorization. For more information about these AV pairs, see RFC 3580, "IEEE 802.1X Remote Authentication Dial In User Service (RADIUS) Usage Guidelines."
MAC authentication bypass interacts with these features:
•
•
•
•
•
•
•
•
Configuring MAC Authentication Bypass
These are the MAC authentication bypass configuration guidelines:
•
•
•
•
Beginning in privileged EXEC mode, follow these steps to enable MAC authentication bypass. This procedure is optional.
To disable MAC authentication bypass, use the no dot1x mac-auth-bypass interface configuration command.
This example shows how to enable MAC authentication bypass:
Switch(config-if)# dot1x mac-auth-bypassUpdates to the Catalyst 2950 Software Configuration Guide
Updates to the "Overview" Chapter
Information about DHCP-based autoconfiguration with a saved file feature was added to the "Overview" chapter:
Ease of Use and Deployment Features—DHCP-base autoconfiguration automatically configures a switch at startup with an IP address.
Updates to the "Configuring UDLD" and "Configuring STP" Chapters
Caution
Updates to the "Configuring VTP "Chapter
Note
Correction to the "Configuring SNMP" Chapter
When you configure a trap by using the notification type port-security, configure the port security trap first, and then configure the port security trap rate:
•
•
Updates to the "Assigning the Switch IP Address and Default Gateway" Chapter
Information about DHCP-based autoconfiguration with a saved file feature was added to the "Assigning the Switch IP Address and Default Gateway" chapter:
Understanding DHCP-Based Autoconfiguration with a Saved Configuration File
DHCP-based autoconfiguration with a saved configuration file works exactly the same as DHCP-based autoconfiguration except that you can now enable an autoconfiguration on a switch that already contains a basic configuration file in its memory.
Configuring DHCP-Based Autoconfiguration with a Saved Configuration File
Beginning in privileged EXEC mode, follow these steps to configure DHCP-based autoconfiguration with a saved configuration file:
This example shows how to configure an interface with a backup interface and to verify the configuration:
Switch# configure terminalSwitch(conf)# boot host dhcpSwitch(conf)# boot host retry timeout 420Switch(conf)# banner config-save ^C Caution - Downloading running configuration file ^CSwitch(conf)#Switch(conf)# show bootThe boot buffersize global configuration command is not supported.
Updates to All Command References
The information about the IGMP querier feature in the Catalyst 2955, 2950, and 2940 Switch Command Reference is incorrect. The Catalyst 2955 switch does not support the IGMP querier feature.
These corrections were added to all of the command references:
•
The message timer is set at 60 seconds.
This is the correct information:
The message timer is set at 15 seconds.
•
These are the correct usage guidelines for the set command:
Environment variables are case sensitive and must be entered as documented.
Environment variables that have values are stored in flash memory outside of the flash file system.
Under normal circumstances, it is not necessary to alter the setting of the environment variables.
The MANUAL_BOOT environment variable can also be set by using the boot manual global configuration command.
The BOOT environment variable can also be set by using the boot system filesystem:/file-url global configuration command.
The ENABLE_BREAK environment variable can also be set by using the boot enable-break global configuration command.
The HELPER environment variable can also be set by using the boot helper filesystem:/file-url global configuration command.
The CONFIG_FILE environment variable can also be set by using the boot config-file flash:/file-url global configuration command.
The HELPER_CONFIG_FILE environment variable can also be set by using the boot helper-config-file filesystem:/file-url global configuration command.
The bootloader prompt string (PS1) can be up to 120 printable characters except the equal sign (=).
These are the correct guidelines for the unset command:
Under normal circumstances, it is not necessary to alter the setting of the environment variables.
The MANUAL_BOOT environment variable can also be reset by using the no boot manual global configuration command.
The BOOT environment variable can also be reset by using the no boot system global configuration command.
The ENABLE_BREAK environment variable can also be reset by using the no boot enable-break global configuration command.
The HELPER environment variable can also be reset by using the no boot helper global configuration command.
The CONFIG_FILE environment variable can also be reset by using the no boot config-file global configuration command.
The HELPER_CONFIG_FILE environment variable can also be reset by using the no boot helper-config-file global configuration command.
Updates to the Catalyst 2940 Command Reference
These commands were added or updated in the Catalyst 2940 command reference:
•
dot1x mac-auth-bypass
Use the dot1x mac-auth-bypass interface configuration command to enable the MAC authentication bypass feature. Use the no form of this command to disable MAC authentication bypass feature.
dot1x mac-auth-bypass
no dot1x mac-auth-bypass
Syntax Description
This command has no arguments or keywords.
Defaults
MAC authentication bypass is disabled.
Command Modes
Interface configuration
Command History
Usage Guidelines
Unless otherwise stated, the MAC authentication bypass usage guidelines are the same as the IEEE 802.1x authentication guidelines.
If you disable MAC authentication bypass from a port after the port has been authenticated with its MAC address, the port state is not affected.
If the port is in the unauthorized state and the client MAC address is not the authentication-server database, the port remains in the unauthorized state. However, if the client MAC address is added to the database, the switch can use MAC authentication bypass to re-authorize the port.
If the port is in the authorized state, the port remains in this state until re-authorization occurs.
Clients that were authorized with MAC authentication bypass can be re-authenticated.
For more information about how MAC authentication bypass and IEEE 802.lx authentication interact, see the "Understanding IEEE 802.1x Authentication with MAC Authentication Bypass" section and the "IEEE 802.1x Authentication Configuration Guidelines" section in the "Configuring IEEE 802.1x Port-Based Authentication" chapter of the software configuration guide.
Examples
This example shows how to enable MAC authentication bypass:
Switch(config-if)# dot1x mac-auth-bypassYou can verify your settings by entering the show dot1x [interface interface-id] privileged EXEC command.
Related Commands
show dot1x [interface interface-id]
Displays IEEE 802.1x status for the specified port.
show dot1x
Use the show dot1x privileged EXEC command to display IEEE 802.1x statistics, administrative status, and operational status for the switch or for the specified interface.
show dot1x [all] | [interface interface-id] | [statistics [interface interface-id]] [ | {begin | exclude | include} expression]
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
If you do not specify an interface, global parameters and a summary appear. If you specify an interface, details for that interface appear.
If you specify the statistics keyword without the interface interface-id option, statistics appear for all interfaces. If you specify the statistics keyword with the interface interface-id option, statistics appear for the specified interface.
Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output do not appear, but the lines that contain Output appear.
Examples
These are examples of output from the show dot1x and the show dot1x all privileged EXEC commands:
Switch# show dot1xSysauthcontrol = EnabledSupplicant Allowed In Guest Vlan = DisabledDot1x Protocol Version = 1Dot1x Oper Controlled Directions = BothDot1x Admin Controlled Directions = BothSwitch# show dot1x allDot1x Info for interface FastEthernet 0/3----------------------------------------------------Supplicant MAC 00d0.b71b.35deAuthSM State = CONNECTINGBendSM State = IDLEPortStatus = UNAUTHORIZEDMaxReq = 2HostMode = SinglePort Control = AutoQuietPeriod = 60 SecondsRe-authentication = DisabledReAuthPeriod = 3600 SecondsServerTimeout = 30 SecondsSuppTimeout = 30 SecondsTxPeriod = 30 SecondsGuest-Vlan = 0Dot1x Info for interface FastEthernet 0/7----------------------------------------------------PortStatus = UNAUTHORIZEDMaxReq = 2HostMode = MultiPort Control = AutoQuietPeriod = 60 SecondsRe-authentication = DisabledReAuthPeriod = 3600 SecondsServerTimeout = 30 SecondsSuppTimeout = 30 SecondsTxPeriod = 30 SecondsGuest-Vlan = 0This is an example of output from the show dot1x all privileged EXEC command when a restricted VLAN is configured:
Switch# show dot1x allDot1x Info for interface GigabitEthernet0/1----------------------------------------------------Supplicant MAC 0002.b3eb.0df6AuthSM State = AUTHENTICATED(AUTH-FAIL-VLAN)BendSM State = IDLEPosture = N/APortStatus = AUTHORIZED(AUTH-FAIL-VLAN)MaxReq = 2MaxAuthReq = 2HostMode = SinglePortControl = AutoControlDirection = BothQuietPeriod = 10 SecondsRe-authentication = DisabledReAuthPeriod = 3600 SecondsServerTimeout = 30 SecondsSuppTimeout = 30 SecondsTxPeriod = 10 SecondsGuest-Vlan = 3AuthFail-Vlan = 4AuthFail-Max-Attempts = 3This is an example of output from the show dot1x interface fastethernet0/3 privileged EXEC command. In this example, MAC authentication bypass is enabled:
Switch# show dot1x interface fastethernet0/3Supplicant MAC 00d0.b71b.35deAuthSM State = AUTHENTICATED (AUTH-FAIL-VLAN)BendSM State = IDLEReAuthPeriod = 4000 Seconds { (From Authentication Server) | (Locally Configured) }ReAuthAction = {Terminate | Reauthenticate}TimeToNextReauth = 1453 SecondsPortStatus = AUTHORIZEDMaxReq = 2HostMode = Single (AUTH-FAIL-VLAN)Port Control = AutoQuietPeriod = 60 SecondsRe-authentication = DisabledReAuthPeriod = 3600 SecondsServerTimeout = 30 SecondsSuppTimeout = 30 SecondsTxPeriod = 30 SecondsGuest-Vlan = 0Mac-Auth-Bypass = EnabledThis is an example of output from the show dot1x statistics interface fastethernet0/3 command. Table 10 describes the fields in the display.
Switch# show dot1x statistics interface fastethernet0/3PortStatistics Parameters for Dot1x--------------------------------------------TxReqId = 15 TxReq = 0 TxTotal = 15RxStart = 4 RxLogoff = 0 RxRespId = 1 RxResp = 1RxInvalid = 0 RxLenErr = 0 RxTotal= 6RxVersion = 1 LastRxSrcMac 00d0.b71b.35de
Related Commands
dot1x control-direction
Resets the configurable IEEE 802.1x parameters to their default values.
These commands were removed from the Catalyst 2940 command reference:
•
•
Updates to the System Message Guides
These messages were added to the Catalyst 3550, 2955, 2950 and 2940 Switch System Message Guide:
Error Message ETHCNTR-3-LOOP_BACK_DETECTED: Loop-back detected on [chars].Explanation A loopback condition might be the result of a balun cable incorrectly connected to a port. [chars] is the interface name.
Recommended Action Check the cables. If a balun cable is connected and the loopback condition is desired, no action is required. Otherwise, connect the correct cable, and then enable the port.
Error Message HARDWARE-2-FAN_ERROR: Fan [chars] FailureExplanation The switch fan is not working. [chars] is the fan name.
Recommended Action This is a hardware failure. The fan might recover automatically. If the fan failure persists, copy the message exactly as it appears on the console or in the system log. Research and attempt to resolve the error by using the Output Interpreter. Use the Bug Toolkit to look for similar reported problems.If you still require assistance, contact Cisco technical support and provide the representative with the gathered information. For more information about the online tools and about contacting Cisco, see the "Error Message Traceback Reports" section in the "System Message Overview" chapter.
Error Message RADIUS-3-NOACCOUNTINGRESPONSE: Accounting message [chars] for session [chars] failed to receive Accounting Response.Explanation Make sure that there is network connectivity between the switch and the RADIUS server and that the server is running.
Recommended Action The RADIUS server has not responded after the maximum number of retransmissions. The first [chars] is the type of accounting message, and the second [chars] is the accounting session identifier.
Error Message DOT1X-5-ERR_INVALID_AAA_MANDATORY_AV: Received unknown mandatory AV: [chars]=[chars]Explanation During authentication, authorization, and accounting (AAA) authorization, the switch received an unexpected mandatory Attribute-Value (AV) pair. The first [chars] is the AV pair name, and the second [chars] is the type of packet.
Recommended Action Review the RADIUS server configuration, and ensure that the switch does not send the AV pair to the RADIUS server as part of the user profile information.
Error Message SPANTREE-7-PORTDEL_SUCCESS: [chars] deleted from Vlan [dec]Explanation The interface has been deleted from the specified VLAN. [chars] is the interface, and [dec] is the VLAN ID.
Recommended Action No action is required.
Updates to the Regulatory Compliance and Safety Information
This information was added to the Regulatory Compliance and Safety Information for the Catalyst 2950 and 2940 switches:
Statement 361—VoIP and Emergency Calling Services do not Function if Power Fails
Update to the Hardware Installation Guides
Cisco Ethernet Switches are equipped with cooling mechanisms, such as fans and blowers. However, these fans and blowers can draw dust and other particles, causing contaminant buildup inside the chassis, which can result in a system malfunction.
You must install this equipment in an environment as free as possible from dust and foreign conductive material (such as metal flakes from construction activities).
These standards provide guidelines for acceptable working environments and acceptable levels of suspended particulate matter:
–
–
–
This applies to all Cisco Ethernet switches except for these compact models:
–
–
–
Update to the Catalyst 2955 Hardware Installation Guide
The information about ordering the power-and-relay connectors (PWR-2955-CONNECT=) has been revised in Chapter 2, "Overview," Chapter 3, "Installation," Chapter 4, "Installation in a Hazardous Environment," and Appendix B, "Cable and Adapter Specifications." This is the new ordering information:
Note
Updates for the Catalyst 2950 Hardware Installation Guide
The hardware installation guide shows has an incorrect bandwidth-utilization illustration for a Catalyst 2950-24, 2950C-24, 2950SX-24, and 2950T-24 2950-12 switch. Figure 1 is the correct illustration.
Figure 1 Bandwidth Utilization on Catalyst 2950-24, 2950C-24, 2950SX-24, and 2950T-24 Switches
If all LEDs on a Catalyst 2950-24, 2950C-24, 2950SX-24, and 2950T-24 2950-12 switch are green (no amber showing), the switch is using 50 percent or more of the total bandwidth. If the far-right LED is off, the switch is using more than 25 but less than 50 percent of the total bandwidth, and so on. If only the far-left LED is green, the switch is using less than 0.0488 percent of the total bandwidth.
Updates for the Catalyst 2940 Hardware Installation Guide
These are the updates for the Catalyst 2940 hardware installation guide:
•
Warning
This unit should be mounted at the bottom of the rack if it is the only unit in the rack.
When mounting this unit in a partially filled rack, load the rack from the bottom to the top with the heaviest component at the bottom of the rack.
If the rack is provided with stabilizing devices, install the stabilizers before mounting or servicing the unit in the rack.
Statement 1006
Follow these steps:
Step 1
Step 2
Step 3
Step 4
Statement 1006—Chassis Warning for Rack-Mounting and Servicing
•
You can identify a crossover cable by comparing the two modular cable ends. Hold the cable ends side-by-side, with the tab at the back, right plug, as shown in Figure 2.
Figure 2 Identifying a Crossover Cable
On a crossover cable, the wire connected to the pin on the outside of the left plug should be the same color as the wire connected to the pin on the outside of the right plug.
Related Documentation
You can find complete information about these Catalyst switches on Cisco.com:
•
http://www.cisco.com/en/US/products/ps6738/tsd_products_support_series_home.html
•
http://www.cisco.com/en/US/products/hw/switches/ps628/tsd_products_support_series_home.html
•
http://www.cisco.com/en/US/products/hw/switches/ps4916/tsd_products_support_series_home.html
•
http://www.cisco.com/en/US/products/hw/switches/ps5213/tsd_products_support_series_home.html
You can order printed copies of documents with a DOC-xxxxxx= number from the Cisco.com sites and from the telephone numbers listed in the URL referenced in the "Obtaining Documentation, Obtaining Support, and Security Guidelines" section.
•
These publications provide more information about the Catalyst 2955 and Catalyst 2950 switches:
•
•
•
•
•
•
•
These publications provide more information about the Catalyst 2940 switches:
•
•
•
•
•
•
For other information about related products, see these documents:
•
•
•
•
•
•
•
•
•
•
http://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html
–
–
–
–
Obtaining Documentation, Obtaining Support, and Security Guidelines
For information on obtaining documentation, obtaining support, providing documentation feedback, security guidelines, and also recommended aliases and general Cisco documents, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCVP, the Cisco logo, and Welcome to the Human Network are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networkers, Networking Academy, Network Registrar, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0710R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2007 Cisco Systems, Inc. All rights reserved.
