 Feedback
|
Table Of Contents
Device Manager System Requirements
Finding the Software Version and Feature Set
Catalyst 3750G Integrated Wireless LAN Controller Switch Software Compatibility
Upgrading a Switch by Using the Device Manager or Network Assistant
Upgrading a Switch by Using the CLI
Recovering from a Software Failure
Minimum Cisco IOS Release for Major Features
Stacking (Catalyst 3750 or Cisco EtherSwitch service module switch stack only)
Caveats Resolved in Cisco IOS Release 12.2(35)SE5
Resolved Caveats in Cisco IOS Release 12.2(35)SE2
Resolved Caveats in Cisco IOS Release 12.2(35)SE1
Resolved Caveats in Cisco IOS Release 12.2(35)SE
Updates for the System Message Guide
Update to the Catalyst 2960 Software Configuration Guide
Configuring Web Authentication
Update to the Catalyst 2960 Command Reference
Updates to the Catalyst 3750 Getting Started Guide
Updates for the Regulatory Compliance and Safety Information
Statement 361—VoIP and Emergency Calling Services do not Function if Power Fails
Obtaining Documentation, Obtaining Support, and Security Guidelines
Release Notes for the Catalyst 3750, 3560, 2970, and 2960 Switches, Cisco IOS Release 12.2(35)SE and Later
Revised June 10, 2008
Cisco IOS Release 12.2(35)SE and SE1 run on all Catalyst 3750, 3560, 2970, and 2960 switches and on Cisco EtherSwitch service modules. Cisco IOS Release 12.2(35)SE5 runs on Catalyst 3750 switches and Cisco EtherSwitch service modules.
The Catalyst 3750 switches and the Cisco EtherSwitch service modules support stacking through Cisco StackWise technology. The Catalyst 3560, 2970, and 2960 switches do not support switch stacking. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack.
These release notes include important information about Cisco IOS Release 12.2(35)SE and later and any limitations, restrictions, and caveats that apply to the releases. Verify that these release notes are correct for your switch:
•
If you are installing a new switch, see the Cisco IOS release label on the rear panel of your switch.
•
•
For the complete list of Catalyst 3750, 3560, 2970, and 2960 switch documentation and of Cisco EtherSwitch service module documentation, see the "Related Documentation" section.
You can download the switch software from this site (registered Cisco.com users with a login password):
http://www.cisco.com/public/sw-center/sw-lan.shtml
This software release is part of a special release of Cisco IOS software that is not released on the same 8-week maintenance cycle that is used for other platforms. As maintenance releases and future software releases become available, they will be posted to Cisco.com in the Cisco IOS software area.
/en/US/docs/ios/12_2s/release/notes/122Srn.html#wp2367913
Contents
This information is in the release notes:
•
•
•
•
•
•
•
System Requirements
The system requirements are described in these sections:
•
•
Hardware Supported
Table 1 lists the hardware supported on this release.
Table 1 Catalyst 3750, 3560, 2970, and 2960 Switches and Cisco EtherSwitch Service Modules Supported Hardware
Catalyst 3750G-24WS-S25
24 10/100/1000 PoE1 ports, 2 SFP2 module slots, and an integrated wireless LAN controller supporting up to 25 access points.
Cisco IOS Release 12.2(25)FZ or Cisco IOS Release 12.2(35)SE
Catalyst 3750G-24WS-S50
24 10/100/1000 PoE ports, 2 SFP module slots, and an integrated wireless LAN controller supporting up to 50 access points
Cisco IOS Release 12.2(25)FZ or Cisco IOS Release 12.2(35)SE
Catalyst 3750-24FS
24 100BASE-FX ports and 2 SFP module slots
Cisco IOS Release 12.2(25)SEB
Catalyst 3750-24PS
24 10/100 PoE ports and 2 SFP module slots
Cisco IOS Release 12.2(18)SE
Catalyst 3750-24TS
24 10/100 Ethernet ports and 2 SFP module slots
Cisco IOS Release 12.2(18)SE
Catalyst 3750-48PS
48 10/100 PoE ports and 4 SFP module slots
Cisco IOS Release 12.2(18)SE
Catalyst 3750-48TS
48 10/100 Ethernet ports and 4 SFP module slots
Cisco IOS Release 12.2(18)SE
Catalyst 3750G-12S
12 SFP module slots
Cisco IOS Release 12.2(18)SE
Catalyst 3750G-16TD
16 10/100/1000 Ethernet ports and 1 XENPAK 10-Gigabit Ethernet module slot
Cisco IOS Release 12.2(18)SE
Catalyst 3750G-24PS
24 10/100/1000 PoE ports and 4 SFP module slots
Cisco IOS Release 12.2(20)SE3
Catalyst 3750G-24T
24 10/100/1000 Ethernet ports
Cisco IOS Release 12.2(18)SE
Catalyst 3750G-24TS
24 10/100/1000 Ethernet ports and 4 SFP module slots
Cisco IOS Release 12.2(18)SE
Catalyst 3750G-24TS-1U
24 10/100/1000 Ethernet ports and 4 SFP module slots
Cisco IOS Release 12.2(20)SE3
Catalyst 3750G-48PS
48 10/100/1000 PoE ports and 4 SFP module slots
Cisco IOS Release 12.2(20)SE3
Catalyst 3750G-48TS
48 10/100/1000 Ethernet ports and 4 SFP module slots
Cisco IOS Release 12.2(20)SE3
Catalyst 3560-8PC
8 10/100 PoE ports and 1 dual-purpose port3 (one 10/100/1000BASE-T copper port and one SFP module slot)
Cisco IOS Release 12.2(35)SE
Catalyst 3560-24PS
24 10/100 PoE ports and 2 SFP module slots
Cisco IOS Release 12.2(18)SE
Catalyst 3560-24TS
24 10/100 ports and 2 SFP module slots
Cisco IOS Release 12.2(20)SE3
Catalyst 3560-48PS
48 10/100 PoE ports and 4 SFP module slots
Cisco IOS Release 12.2(18)SE
Catalyst 3560-48TS
48 10/100 ports and 4 SFP module slots
Cisco IOS Release 12.2(20)SE3
Catalyst 3560G-24PS
24 10/100 PoE ports and 4 SFP module slots
Cisco IOS Release 12.2(20)SE3
Catalyst 3560G-24TS
24 10/100/1000 Ethernet ports and 4 SFP module slots
Cisco IOS Release 12.2(20)SE3
Catalyst 3560G-48PS
48 10/100/1000 PoE ports and 4 SFP module slots
Cisco IOS Release 12.2(20)SE3
Catalyst 3560G-48TS
48 10/100/1000 Ethernet ports and 4 SFP module slots
Cisco IOS Release 12.2(20)SE3
Catalyst 2970G-24T
24 10/100/1000 Ethernet ports
Cisco IOS Release 12.2(18)SE
Catalyst 2970G-24TS
24 10/100/1000 Ethernet ports and 4 SFP module slots
Cisco IOS Release 12.2(18)SE
Catalyst 2960-8TC
8 10/100 Ethernet ports and 1 dual-purpose port ==(one 10/100/1000BASE-T copper port and one SFP module slot)
Cisco IOS Release 12.2(35)SE
Catalyst 2960G-8TC
7 10/100/1000 Ethernet ports and 1 dual-purpose port (one 10/100/1000BASE-T copper port and one SFP module slot)
Cisco IOS Release 12.2(35)SE
Catalyst 2960-24TC
24 10/100BASE-T Ethernet ports and 2 dual-purpose ports (two 10/100/1000BASE-T copper ports and two SFP module slots)
Cisco IOS Release 12.2(25)FX
Catalyst 2960-48TC
48 10/100BASE-T Ethernet ports and 2 dual-purpose ports (two 10/100/1000BASE-T copper ports and two SFP module slots)
Cisco IOS Release 12.2(25)FX
Catalyst 2960-24TT
24 10/100BASE-T Ethernet ports and 2 10/100/1000BASE-T Ethernet ports
Cisco IOS Release 12.2(25)FX
Catalyst 2960-48TT
48 10/100BASE-T Ethernet ports 2 10/100/1000BASE-T Ethernet ports
Cisco IOS Release 12.2(25)FX
Catalyst 2960G-24TC
24 10/100/1000BASE-T Ethernet ports, including 4 dual-purpose ports (four 10/100/1000BASE-T copper ports and four SFP module slots)
Cisco IOS Release 12.2(25)FX
NME-16ES-1G4
16 10/100 ports, 1 10/100/1000 Ethernet port, no StackWise connector ports, single-wide
Cisco IOS Release 12.2(25)SEC
NME-16ES-1G-P4
16 10/100 PoE ports, 1 10/100/1000 Ethernet port, no StackWise connector ports, single-wide
Cisco IOS Release 12.2(25)EZ
NME-X-23ES-1G4
23 10/100 ports, 1 10/100/1000 PoE port, no StackWise connector ports, extended single-wide
Cisco IOS Release 12.2(25)SEC
NME-X-23ES-1G-P4
23 10/100 PoE ports, 1 10/100/1000 PoE port, no StackWise connector ports, extended single-wide
Cisco IOS Release 12.2(25)EZ
NME-XD-24ES-1S-P4
24 10/100 PoE ports, 1 SFP module port, 2 StackWise connector ports, extended double-wide
Cisco IOS Release 12.2(25)EZ
NME-XD-48ES-2S-P4
48 10/100 PoE ports, 2 SFP module ports, no StackWise connector ports, extended double-wide
Cisco IOS Release 12.2(25)EZ
SFP modules (Catalyst 3750, 3560, and 2970)
1000BASE-CWDM5 , -LX, SX, -T, -ZX
100BASE-FX MMF6
GLC-BX-D , GLC-BS-U
Cisco IOS Release 12.2(18)SE
Cisco IOS Release 12.2(20)SE
Cisco IOS Release 12.2(35)SE
SFP modules (Catalyst 2960)
1000BASE-BX, -CWDM, -LX/LH, -SX, -ZX
100BASE-BX, FX, -LX
Cisco IOS Release 12.2(25)FX
XENPAK modules7
XENPAK-10-GB-ER, XENPAK-10-GB-LR, XENPAK-10-GB-LX4, XENPAK-10-GB-SR, and XENPAK-10-GB-CX4
Cisco IOS Release 12.2(18)SE
Redundant power systems
Cisco RPS 675 Redundant Power SystemCisco RPS 300 Redundant Power System (supported only on the Catalyst 2960 switch)
Supported on all software releases
1 PoE = Power over Ethernet
2 SFP = small form-factor pluggable
3 Each uplink port is considered a single interface with dual front ends (RJ-45 connector and SFP module slot). The dual front ends are not redundant interfaces, and only one port of the pair is active.
4 Cisco EtherSwitch service module
5 CWDM = coarse wavelength-division multiplexer
6 MMF = multimode fiber
7 XENPAK modules are only supported on the Catalyst 3750G-16TD switches.
Device Manager System Requirements
These sections describes the hardware and software requirements for using the device manager:
•
•
Hardware Requirements
Table 2 lists the minimum hardware requirements for running the device manager.
Table 2 Minimum Hardware Requirements
Intel Pentium II1
64 MB2
256
1024 x 768
Small
1 We recommend Intel Pentium 4.
2 We recommend 256-MB DRAM.
Software Requirements
Table 3 lists the supported operating systems and browsers for using the device manager. The device manager verifies the browser version when starting a session to ensure that the browser is supported.
Note
Table 3 Supported Operating Systems and Browsers
Windows 2000
None
5.5 or 6.0
7.1
Windows XP
None
5.5 or 6.0
7.1
1 Service Pack 1 or higher is required for Internet Explorer 5.5.
Cluster Compatibility
You cannot create and manage switch clusters through the device manager. To create and manage switch clusters, use the command-line interface (CLI) or the Network Assistant application.
When creating a switch cluster or adding a switch to a cluster, follow these guidelines:
•
•
•
For additional information about clustering, see Getting Started with Cisco Network Assistant and Release Notes for Cisco Network Assistant (not orderable but available on Cisco.com), the software configuration guide, the command reference, and the Cisco EtherSwitch service module feature guide.
CNA Compatibility
Cisco IOS 12.2(35)SE and later is only compatible with Cisco Network Assistant (CNA) 5.0 and later. You can download Cisco Network Assistant from this URL:
http://www.cisco.com/pcgi-bin/tablebuild.pl/NetworkAssistant
For more information about Cisco Network Assistant, see the Release Notes for Cisco Network Assistant on Cisco.com.
Upgrading the Switch Software
These are the procedures for downloading software. Before downloading software, read this section for important information:
•
•
•
•
•
Finding the Software Version and Feature Set
The Cisco IOS image is stored as a bin file in a directory that is named with the Cisco IOS release. A subdirectory contains the files needed for web management. The image is stored on the system board flash device (flash:).
You can use the show version privileged EXEC command to see the software version that is running on your switch. The second line of the display shows the version.
Note
You can also use the dir filesystem: privileged EXEC command to see the directory names of other software images that you might have stored in flash memory.
Deciding Which Files to Use
The upgrade procedures in these release notes describe how to perform the upgrade by using a combined tar file. This file contains the Cisco IOS image file and the files needed for the embedded device manager. You must use the combined tar file to upgrade the switch through the device manager. To upgrade the switch through the command-line interface (CLI), use the tar file and the archive download-sw privileged EXEC command.
For the Catalyst 3750 and 3560 switches, Cisco IOS Release 12.2(25)SEA and earlier referred to the image that provides Layer 2+ features and basic Layer 3 routing as the standard multilayer image (SMI). The image that provides full Layer 3 routing and advanced services was referred to as the enhanced multilayer image (EMI).
Cisco IOS Release 12.2(25)SEB and later refers to the SMI as the IP base image and the EMI as the IP services image.
Cisco IOS Release 12.2(25)SEB and later refers to the Catalyst 2970 image as the LAN base image.
Table 4 lists the different file-naming conventions before and after Cisco IOS Release 12.2(25)SEB.
Table 4 Cisco IOS Image File Naming Convention
c3750-i9-mz (SMI1 )
c3750-ipbase-mz
c3750-i9k91-mz (SMI)
c3750-ipbasek9-mz
c3750-i5-mz (EMI2 )
c3750-ipservices-mz
c3750-i5k91-mz (EMI)
c3750-ipservicesk9-mz
c3560-i9-mz (SMI)
c3560-ipbase-mz
c3560-i9k91-mz (SMI)
c3560-ipbasek9-mz
c3560-i5-mz (EMI)
c3560-ipservices-mz
c3560-i5k91-mz (EMI)
c3560-ipservicesk9-mz
c2970-i6l2-mz
c2970-lanbase-mz
c2970-i6k91l2-mz
c2970-lanbasek9-mz
1 SMI = standard multilayer image
2 EMI = enhanced multilayer image
Table 5 lists the filenames for this software release.
Note
Table 5 Cisco IOS Software Image Files
Filename
c3750-ipbase-tar.122-35.SE5.tar
Catalyst 3750 IP base image and device manager files.
This image has Layer 2+ and basic Layer 3 routing features.
This image also runs on the Cisco EtherSwitch service modules.c3750-ipservices-tar.122-35.SE5.tar
Catalyst 3750 IP services image and device manager files.
This image has both Layer 2+ and full Layer 3 routing features.
This image also runs on the Cisco EtherSwitch service modules.c3750-ipbasek9-tar.122-35.SE5.tar
Catalyst 3750 IP base cryptographic image and device manager files.
This image has the Kerberos, SSH1 , Layer 2+, and basic Layer 3 routing features.
This image also runs on the Cisco EtherSwitch service modules.c3750-ipservicesk9-tar.122-35.SE5.tar
Catalyst 3750 IP services cryptographic image and device manager files.
This image has the Kerberos, SSH, Layer 2+, and full Layer 3 features.
This image also runs on the Cisco EtherSwitch service modules.c3750-advipservicesk9-tar.122-35.SE5.tar
Catalyst 3750 advanced IP services image, cryptographic file, and device manager files.
This image has all the IP services image (formerly known as the EMI) features and the capability for unicast routing of IPv6 packets.
This image also runs on the Cisco EtherSwitch service modules.c3560-ipbase-tar.122-35.SE5.tar
Catalyst 3560 IP base image file and device manager files.
This image has Layer 2+ and basic Layer 3 routing features.c3560-ipservices-tar.122-35.SE5.tar
Catalyst 3560 IP services image and device manager files.
This image has both Layer 2+ and full Layer 3 routing features.c3560-ipbasek9-tar.122-35.SE5.tar
Catalyst 3560 IP base cryptographic image and device manager files.
This image has the Kerberos, SSH, and Layer 2+, and basic Layer 3 routing features.c3560-ipservicesk9-tar.122-35.SE5.tar
Catalyst 3560 IP services cryptographic image and device manager files. This image has the Kerberos, SSH, Layer 2+, and full Layer 3 features.
c3560-advipservicesk9-tar.122-35.SE5.tar
Catalyst 3560 advanced IP services image, cryptographic file, and device manager files.
This image has all the IP services image (formerly known as the EMI) features and the capability for unicast routing of IPv6 packets.c2970-lanbase.122-35.SE5.tar
Catalyst 2970 image file and device manager files.
This image has Layer 2+ features.c2970-lanbasek9-tar.122-35.SE5.tar
Catalyst 2970 cryptographic image file and device manager files.
This image has the Kerberos and SSH features.c2960-lanbase-tar.122-35.SE5.tar
Catalyst 2960 image file and device manager files.
This image has Layer 2+ features.c2960-lanbasek9-tar.122-35.SE5.tar
Catalyst 2960 cryptographic image file and device manager files. This image has the Kerberos and SSH features.
1 SSH = Secure Shell
Catalyst 3750G Integrated Wireless LAN Controller Switch Software Compatibility
The Catalyst 3750 Integrated Wireless LAN Controller Switch is an integrated Catalyst 3750 switch and Cisco 4400 series wireless LAN controller that supports up to 25 or 50 lightweight access points. The switch and the internal controller run separate software versions, which must be upgraded separately. If the image versions are not compatible, the wireless LAN controller switch could stop functioning. Table 6 is the compatibility matrix for Catalyst 3750 and wireless controller.
For information about this controller software release, see the Release Notes for Cisco Wireless LAN Controllers and Lightweight Access Point, Release 4.0.x.0. For controller software upgrade procedure, see the Cisco Wireless LAN Controller Configuration Guide Release 4.0.
Archiving Software Images
Before upgrading your switch software, make sure that you have archived copies of the current Cisco IOS release and the Cisco IOS release to which you are upgrading. You should keep these archived images until you have upgraded all devices in the network to the new Cisco IOS image and until you have verified that the new Cisco IOS image works properly in your network.
Cisco routinely removes old Cisco IOS versions from Cisco.com. See Product Bulletin 2863 for more information:
http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/prod_bulletin0900aecd80281c0e.html
You can copy the bin software image file on the flash memory to the appropriate TFTP directory on a host by using the copy flash: tftp: privileged EXEC command.
Note
You can also configure the switch as a TFTP server to copy files from one switch to another without using an external TFTP server by using the tftp-server global configuration command. For more information about the tftp-server command, see the "Basic File Transfer Services Commands" section of the Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 at this URL:
/en/US/docs/ios/12_2/configfun/command/reference/frf011.html#wp1018426
Upgrading a Switch by Using the Device Manager or Network Assistant
You can upgrade switch software by using the device manager or Network Assistant. For detailed instructions, click Help.
Note
Upgrading a Switch by Using the CLI
This procedure is for copying the combined tar file to the switch. You copy the file to the switch from a TFTP server and extract the files. You can download an image file and replace or keep the current image.
To download software, follow these steps:
Step 1
Step 2
http://www.cisco.com/public/sw-center/sw-lan.shtml
To download the image for a Catalyst 2960 switch, click Catalyst 2960 software. To obtain authorization and to download the cryptographic software files, click Catalyst 2960 3DES Cryptographic Software.
To download the image for a Catalyst 2970 switch, click Catalyst 2970 software. To obtain authorization and to download the cryptographic software files, click Catalyst 2970 3DES Cryptographic Software.
To download the IP services image (formerly known as the EMI) or IP base image (formerly known as the SMI) files for a Catalyst 3560 switch, click Catalyst 3560 software. To obtain authorization and to download the cryptographic software files, click Catalyst 3560 3DES Cryptographic Software.
To download the IP services image (formerly known as the EMI) or IP base image (formerly known as the SMI) files for a Catalyst 3750 switch, click Catalyst 3750 software. To obtain authorization and to download the cryptographic software files, click Catalyst 3750 3DES Cryptographic Software.
Caution
Step 3
For more information, see Appendix B in the software configuration guide for this release.
Step 4
Step 5
Switch# ping tftp-server-addressFor more information about assigning an IP address and default gateway to the switch, see the software configuration guide for this release.
Step 6
Switch# archive download-sw /overwrite /reload tftp:[[//location]/directory]/image-name.tarThe /overwrite option overwrites the software image in flash memory with the downloaded one.
The /reload option reloads the system after downloading the image unless the configuration has been changed and not saved.
For //location, specify the IP address of the TFTP server.
For /directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive.
This example shows how to download an image from a TFTP server at 198.30.20.19 and to overwrite the image on the switch:
Switch# archive download-sw /overwrite tftp://198.30.20.19/c3750-ipservices-tar.122-35.SE.tarYou can also download the image file from the TFTP server to the switch and keep the current image by replacing the /overwrite option with the /leave-old-sw option.
Recovering from a Software Failure
For additional recovery procedures, see the "Troubleshooting" chapter in the software configuration guide for this release.
Installation Notes
You can assign IP information to your switch by using these methods:
•
•
•
•
Note
Note
New Features
These sections describe the new supported hardware and the new and updated software features provided in this release:
•
•
•
New Hardware Features
There are no new hardware features for this release. For a list of all supported hardware, see the "Hardware Supported" section.
New Software Features
These are the new software features for this release:
•
•
•
•
•
•
•
•
•
Note
•
•
Starting with Cisco IOS Release 12.2(25)SEE1, the device manager GUI, online help, and the Catalyst 2960 Switch Getting Started Guide are now available in Chinese (simplified), English, French, German, Italian, Japanese, and Spanish.
To display a translated version of the GUI and online help, select your language from the Language field located at the top of the device manager window.
The translated getting started guides are available at this URL:
http://www.cisco.com/en/US/products/ps6406/tsd_products_support_series_home.html
Modifed Software Feature
The Catalyst 2960 device manager Dashboard window now displayed the Product ID and Version ID of the switch. The Product ID field replaced the Type field.
Minimum Cisco IOS Release for Major Features
Table 7 lists the minimum software release required to support the major features of the Catalyst 3750, 3560, 2970, and 2960 switches and the Cisco EtherSwitch service modules.
Table 7 Catalyst 3750, 3560, 2970, and 2960 Switches and Cisco EtherSwitch Service Module Features and the Minimum Cisco IOS Release Required
Multidomain authentication (MDA)
12.2(35)SE
3750, 3560
Web authentication
12.2(35)SE
3750, 3560, 2960
MAC inactivity aging
12.2(35)SE
3750, 3560
Support for IPv6 with Express Setup
12.2(35)SE
3750, 3560
Generic online diagnostics to test the hardware functionality of the supervisor engine.
12.2(35)SE
3560
Stack MAC persistent timer and archive download enhancements
12.2(35)SE
3750
HSRP enhanced object tracking
12.2(35)SE
3750, 3560
OSPF and EIGRP Nonstop forwarding capability (IP services image only)
12.2(35)SE
3750
IPv6 router ACLs for inbound Layer 3 management traffic in the IP base and IP services image
12.2(35)SE
3750, 3560
Generic online diagnostics to test the hardware functionality of the supervisor engine.
12.2(25)SEE
3750
DHCP Option 82 configurable remote ID and circuit ID
12.2(25)SEE
3750, 3560, 2970
EIGRP stub routing in the IP base image
12.2(25)SEE
3750, 3560
/31 bit mask support for unicast traffic
12.2(25)SEE
3750, 3560
Access SDM templates.
12.2(25)SED
3750, 3560
Cisco EtherSwitch service modules
IPv6 ACLs
12.2(25)SED
3750, 3560
Cisco EtherSwitch service modules
IPv6 Multicast Listener Discovery (MLD) snooping
12.2(25)SED
3750, 3560
Cisco EtherSwitch service modules
QoS hierarchical policy maps on a port
12.2(25)SED
3750, 3560, and 2970
Cisco EtherSwitch service modules
NAC Layer 2 IEEE 802.1x validation
12.2(25)SED
3750, 3560, 2970, and 2960
Cisco EtherSwitch service modules
NAC Layer 2 IP validation
12.2(25)SED
3750, 3560
Cisco EtherSwitch service modules
IEEE 802.1x inaccessible authentication bypass.
12.2(25)SED
3750, 3560
Cisco EtherSwitch service modules
IEEE 802.1x with restricted VLAN
12.2(25)SED
3750, 3560, and 2970
Cisco EtherSwitch service modules
Budgeting power for devices connected to PoE ports
12.2(25)SEC
3750 and 3560
Cisco EtherSwitch service modules
Multiple spanning-tree (MST) based on the IEEE 802.1s standard
12.2(25)SEC
12.2(25)SED3750, 3560, and 2970
Cisco EtherSwitch service modules
2960
Unique device identifier (UDI)
12.2(25)SEC
3750, 3560, 2970
Cisco EtherSwitch service modules
VRF Lite
12.2(25)SEC
3750, 3560
Cisco EtherSwitch service modules
IEEE 802.1x with wake-on-LAN
12.2(25)SEC
12.2(25)SED
3750, 3560, 2970
Cisco EtherSwitch service modules
Nonstop forwarding (NSF) awareness
12.2(25)SEC
3750 and 3560
Cisco EtherSwitch service modules
Configuration logging
12.2(25)SEC
12.2(25)SED
3750, 3560, 2970
Cisco EtherSwitch service modules
Secure Copy Protocol
12.2(25)SEC
12.2(25)SED
3750, 3560, 2970
Cisco EtherSwitch service modules
Cross-stack EtherChannel
12.2(25)SEC
3750
Cisco EtherSwitch service modules
Support for configuring private-VLAN ports on interfaces that are configured for dynamic ARP inspection (IP base image [formerly known as the SMI] only)
12.2(25)SEB
3750 and 3560
Support for IP source guard on private VLANs (IP base image [formerly known as the SMI] only)
12.2(25)SEB
3750 and 3560
Support for configuring an IEEE 802.1x restricted VLAN
12.2(25)SED
3750, 3560, 2970, and 2960
IGMP leave timer
12.2(25)SEB
3750, 3560, and 2970
IGMP snooping querier
12.2(25)SEA
12.2(25)FX
3750, 3560, 2970, and 2960
Advanced IP services
12.2(25)SEA
3750, 3560
Support for DSCP transparency
12.2(25)SE
12.2(25)FX
3750, 3560, 2970, and 2960
Support for VLAN-based QoS1 and hierarchical policy maps on SVIs2
12.2(25)SE
3750, 3560, 2970
Device manager
12.2(25)SE
12.2(25)FX
3750, 3560, 2970, and 2960
IEEE 802.1Q tunneling and Layer 2 protocol tunneling
12.2(25)SE
3750, 3560
Layer 2 point-to-point tunneling and Layer 2 point-to-point tunneling bypass
12.2(25)SE
3750, 3560
Support for SSL version 3.0 for secure HTTP communication (cryptographic images only)
12.2(25)SE
12.2(25)FX
3750, 3560, 2970, and 2960
Support for configuring private-VLAN ports on interfaces that are configured for dynamic ARP inspection (IP services image [formerly known as the EMI] only)
12.2(25)SE
3750 and 3560
Support for IP source guard on private VLANs (IP services image [formerly known as the EMI] only)
12.2(25)SE
3750 and 3560
Cisco intelligent power management to limit the power allowed on a port, or pre-allocate (reserve) power for a port.
12.2(25)SE
3750 and 3560
IEEE 802.1x accounting and MIBs (IEEE 8021-PAE-MIB and CISCO-PAE-MIB)
12.2(20)SE
12.2(25)FX
3750, 3560, 2970, and 2960
Dynamic ARP inspection (IP services image [formerly known as the EMI] only)
12.2(20)SE
3750 and 3560
Flex Links
12.2(20)SE
12.2(25)FX
3750, 3560, 2970, and 2960
Software upgrade (device manager or Network Assistant only)
12.2(20)SE
12.2(25)FX
3750, 3560, 2970, and 2960
IP source guard (IP services image [formerly known as the EMI] only)
12.2(20)SE
3750, 3560
Private VLAN (IP services image [formerly known as the EMI] only)
12.2(20)SE
3750, 3560
SFP module diagnostic management interface
12.2(20)SE
12.2(25)FX
3750, 3560, 2970, and 2960
Switch stack offline configuration
12.2(20)SE
3750
Stack-ring activity statistics
12.2(20)SE
3750
Smartports macros
12.2(18)SE
12.2(25)FX
3750, 3560, 2970, and 2960
Generic online diagnostics (GOLD)
12.2(25)SEE
3750
Flex Links Preemptive Switchover
12.2(25)SEE
3750, 3560, 2970, and 2960
1 QoS = quality of service
2 SVIs = switched virtual interfaces
Limitations and Restrictions
You should review this section before you begin working with the switch. These are known limitations that will not be fixed, and there is not always a workaround. Some features might not work as documented, and some features could be affected by recent changes to the switch hardware or software.
This section contains these limitations:
•
•
Cisco IOS Limitations
Unless otherwise noted, these limitations apply to the Catalyst 3750, 3560, 2970, and 2960 switches and the Cisco EtherSwitch service modules:
•
Configuration
These are the configuration limitations:
•
This problem occurs under these conditions:
–
–
–
The workaround is to reconfigure the static IP address. (CSCea71176 and CSCdz11708)
•
•
1.
2.
3.
•
–
–
–
No workaround is necessary; these are the designed behaviors. (CSCed50819)
•
However, when dynamic ARP inspection is not enabled and a jumbo MTU is configured, ARP and RARP packets are correctly bridged in hardware. (CSCed79734)
•
The workaround is to configure the port for 10 Mbps and half duplex or to connect a hub or a nonaffected device to the switch. (CSCed39091)
•
When you enter the show ip arp inspection log privileged EXEC command, the log entries from all switches in the stack are moved to the switch on which you entered the command.
There is no workaround. (CSCed95822)
•
The workaround is to enter the no switchport block unicast interface configuration command on that specific interface. (CSCee93822)
•
There is no workaround. This is a cosmetic error and does not affect the functionality of the switch. (CSCef59331)
•
To change the baud rate, reload the Cisco EtherSwitch service module with the bootloader prompt. You can then change the baud rate and change the speed on the TTY line of the router connected to the Cisco EtherSwitch Service module console.
There is no workaround. (CSCeh50152)
•
The workaround is to use switch ports other than those specified for redundancy and for applications that immediately detect active links. (CSCeh70503)
•
Ethernet
These are the Ethernet limitations:
•
–
–
–
These are the workarounds:
–
–
–
For more information, enter CSCea77032 in the Bug Toolkit at this URL:
http://www.cisco.com/pcgi-bin/Support/Bugtool/home.pl
•
If the Cisco EtherSwitch service module is in access mode, the workaround is to enter the spanning-tree portfast interface configuration command on the internal Gigabit Ethernet interface. If the service module is in trunk mode, there is no workaround.
•
If this happens, uneven traffic distribution will happen on EtherChannel ports.
Changing the load balance distribution method or changing the number of ports in the EtherChannel can resolve this problem. Use any of these workarounds to improve EtherChannel load balancing:
–
–
–
–
For example, with load balance configured as dst-ip with 150 distinct incrementing destination IP addresses, and the number of ports in the EtherChannel set to either 2, 4, or 8, load distribution is optimal.(CSCeh81991)
Fallback Bridging
These are the fallback bridging limitations:
•
•
HSRP
This is the Hot Standby Routing Protocol (HSRP) limitation:
When the active switch fails in a switch cluster that uses HSRP redundancy, the new active switch might not contain a full cluster member list. The workaround is to ensure that the ports on the standby cluster members are not in the spanning-tree blocking state. To verify that these ports are not in the blocking state, see the "Configuring STP" chapter in the software configuration guide. (CSCec76893)
IP
These are the IP limitations:
•
•
IP Telephony
These are the IP telephony limitations:
•
•
•
The workaround for networks with pre-standard powered devices is to leave the maximum wattage set at the default value (15.4 W). You can also configure the maximum wattage for the port for no less than the value the powered device reports as the power consumption through CDP messages. For networks with IEEE Class 0, 3, or 4 devices, do not configure the maximum wattage for the port at less than the default 15.4 W (15,400 milliwatts). (CSCee80668)
•
The workaround is to enable PoE and to configure the switch to recover from the PoE error-disabled state. (CSCsf32300)
Management
CiscoWorks is not supported on the Catalyst 3750-24FS switch.
MAC Addressing
This is the MAC addressing limitation:
(Catalyst 3750 or 3560 switches and Cisco EtherSwitch service modules) When a MAC address is configured for filtering on the internal VLAN of a routed port, incoming packets from the MAC address to the routed port are not dropped. (CSCeb67937)
Multicasting
These are the multicasting limitations:
•
•
•
•
•
•
•
•
–
–
There is no workaround. (CSCec20128)
•
The switchport block multicast interface configuration command is only applicable to non-IP multicast traffic.
There is no workaround. (CSCee16865)
•
–
–
The workaround is to enter the clear ip mroute privileged EXEC command on the interface. (CSCef42436)
After you configure a switch to join a multicast group by entering the ip igmp join-group group-address interface configuration command, the switch does not receive join packets from the client, and the switch port connected to the client is removed from the IGMP snooping forwarding table.
Use one of these workarounds:
–
–
•
The workaround is to enable IP routing or to disable multicast routing on the switch. You can also use the ip igmp snooping querier global configuration command if IP multicast routing is enabled for queries on a multicast router port. (CSCsc02995)
Power
These are the powers limitation for the Cisco EtherSwitch service modules:
•
There is no workaround. You should use the power inline never interface configuration command on Cisco EtherSwitch service module ports that are not connected to PoE devices. (CSCee71979)
•
Router# show power inlinePowerSupply SlotNum. Maximum Allocated Status----------- -------- ------- --------- ------INT-PS 0 360.000 121.000 PS1 GOOD PS2 ABSENTInterface Config Device Powered PowerAllocated--------- ------ ------ ------- --------------Gi4/0 auto Unknown On 121.000 WattsThis is not a problem because the display correctly shows the total used power and the remaining power available on the system. (CSCeg74337)
•
The workaround is to enter the shutdown and the no shutdown interface configuration commands on the Fast Ethernet interface of a new IP phone that is attached to the service module port after the internal link is brought up. (CSCeh45465)
QoS
These are the quality of service (QoS) limitations:
•
•
Routing
These are the routing limitations:
•
•
•
%SYS-2-MALLOCFAIL: Memory allocation of 4252 bytes failed from 0x179C80, alignment 0Pool: I/O Free: 77124 Cause: Memory fragmentationAlternate Pool: None Free: 0 Cause: No Alternate poolThis error message means there is a temporary memory shortage that normally recovers by itself. You can verify that the switch stack has recovered by entering the show cef line user EXEC command and verifying that the line card states are up and sync. No workaround is required because the problem is self-correcting. (CSCea71611)
•
–
–
–
The workaround is to change any one of the listed conditions. (CSCed53633)
SPAN and RSPAN
These are the SPAN and Remote SPAN (RSPAN) limitations.
•
This is a hardware limitation and only applies to these switches (CSCdy72835):
–
–
–
–
–
–
–
–
–
–
–
•
This is a hardware limitation and only applies to these switches (CSCdy81521):
–
–
–
–
–
–
–
–
–
–
–
–
–
•
This is a hardware limitation and only applies to these switches (CSCea72326):
–
–
–
–
–
–
–
–
–
–
–
–
–
•
•
•
Stacking (Catalyst 3750 or Cisco EtherSwitch service module switch stack only)
These are the Catalyst 3750 and Cisco EtherSwitch service module switch stack limitations:
•
•
•
•
•
There is no workaround. (CSCed54150)
•
The workaround is to complete the MAC address update by entering the clear arp privileged EXEC command. (CSCed62409)
•
•
Private VLAN is enabled or disabled on a switch stack, depending on whether or not the stack master is running the IP services image (formerly known as the EMI) or the IP base image (formerly known as the SMI):
–
–
This occurs after a stack master re-election when the previous stack master was running the IP services image (formerly known as the EMI) and the new stack master is running the IP base image (formerly known as the SMI). The stack members are configured with private VLAN, but any new switch that joins the stack will have private VLAN disabled.
These are the workarounds. Only one of these is necessary:
–
–
•
This is the expected behavior of the offline configuration (provisioning) feature. There is no workaround. (CSCee12431)
•
The workaround is to copy the bootable image to the parent directory or first directory. (CSCei69329)
•
The workaround is to assign a lower path cost to the forwarding port. (CSCsd95246)
•
This can but does not always occur during link flaps and does not last for more than a few milliseconds. This problem can happen for cross-stack EtherChannels with the mode set to ON or LACP.
There is no workaround. No manual intervention is needed. The problem corrects itself within a short interval after the link flap as all the switches in the stack synchronize with the new load-balance configuration. (CSCse75508)
•
The workaround is to reboot the new member switch. Use the remote command all show run privileged EXEC command to compare the running configurations of the stack members. (CSCsf31301)
Trunking
These are the trunking limitations:
•
•
•
•
VLAN
These are the VLAN limitations:
•
The workaround is to reduce the number of VLANs or trunks. (CSCeb31087)
•
There is no workaround. (CSCed71422)
•
The workaround is to define another policy-map name for the second-level policy-map with the same configuration to be used for another policy-map. (CSCef47377)
Device Manager Limitations
These are the device manager limitations:
•
The workaround is to click Yes when you are prompted to accept the certificate. (CSCef45718)
Important Notes
These sections describe the important notes related to this software release for the Catalyst 3750, 3560, 2970, and 2960 switches and for the Cisco EtherSwitch service modules:
•
Switch Stack Notes
These notes apply to switch stacks:
•
•
•
Cisco IOS Notes
These notes apply to Cisco IOS software:
•
•
–
–
In Cisco IOS Release 12.2(18)SE and later, you can only use the logging on and then the no logging console global configuration commands to disable logging to the console. (CSCec71490)
•
•
00:02:57: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.20.246.206:1645,1646 is not responding.If this message appears, check that there is network connectivity between the switch and the ACS. You should also check that the switch has been properly configured as an AAA client on the ACS.
Device Manager Notes
These notes apply to the device manager:
•
•
•
•
•
From Microsoft Internet Explorer:
1.
2.
3.
4.
5.
•
Beginning in privileged EXEC mode, follow these steps to configure the HTTP server interface:
•
If you change the HTTP port, you must include the new port number when you enter the IP address in the browser Location or Address field (for example, http://10.1.126.45:184 where 184 is the new HTTP port number). You should write down the port number through which you are connected. Use care when changing the switch IP information.
If you are not using the default method of authentication (the enable password), you need to configure the HTTP server interface with the method of authentication used on the switch.
Beginning in privileged EXEC mode, follow these steps to configure the HTTP server interface:
•
Open Caveats
This section describes the open caveats with possible unexpected activity in this software release. Unless otherwise noted, these severity 3 Cisco IOS configuration caveats apply to the Catalyst 3750, 3560, 2970, and 2960 switches and to Cisco EtherSwitch service modules:
•
Phone detection events that are generated by many IEEE phones connected to the switch ports can consume a significant amount of CPU time if the switch ports cannot power the phones because the internal link is down.
The workaround is to enter the power inline never interface configuration command on all the Fast Ethernet ports that are not powered by but are connected to IP phones if the problem persists.
•
When connected to the router through an auxiliary port in a session to a Cisco EtherSwitch service module, the service module session fails when you enter the shutdown and the no shutdown interface configuration commands on the service module router interface.
These are the workarounds:
–
–
•
A duplex mismatch occurs when two Fast Ethernet interfaces that are directly connected on two EtherSwitch service modules are configured as both 100 Mbps and full duplex and as automatic speed and duplex settings. This is expected behavior for the PHY on the Cisco EtherSwitch service modules.
There is no workaround.
•
When the router is rebooted after it is powered on (approximately once in 10 to 15 reboots), the Router Blade Communication Protocol (RBCP) between the router and the EtherSwitch service module might not be reestablished, and this message appears:
[date]: %Y88E8K-3-ILP_MSG_TIMEOUT_ERROR: GigabitEthernet1/0: EtherSwitch Service Module RBCP ILP messages timeoutThe workaround is to reload the EtherSwitch service module software without rebooting the router. You can reload the switching software by using the reload user EXEC command at the EtherSwitch service module prompt or by using the service-module g slot_numer /0 reset privileged EXEC command at the router prompt.
•
If traffic is passing through VMPS ports and you perform a shut operation, a dynamic VLAN is not assigned and a VLAN with a null ID appears.
The workaround is to clear the MAC address table. This forces the VMPS server to correctly reassign the VLAN.
•
This error message appears during authentication when a method list is used and one of the methods in the method list is removed:
AAA-3-BADMETHODERROR:Cannot process authentication method 218959117There is no workaround. However, this is only an informational message and does not affect switch functionality.
•
The switch might display tracebacks similar to these examples when a large number of IEEE 802.1x supplicants try to repeatedly log in and log out.
Examples:
Jan 3 17:54:32 L3A3 307: Jan 3 18:04:13.459: %SM-4-BADEVENT: Event 'eapReq' is invalid for the current state 'auth_bend_idle': dot1x_auth_bend Fa9
Jan 3 17:54:32 L3A3 308: -Traceback= B37A84 18DAB0 2FF6C0 2FF260 8F2B64 8E912C Jan 3 19:06:13 L3A3 309: Jan 3 19:15:54.720: %SM-4-BADEVENT: Event 'eapReq_no_reAuthMax' is invalid for the current ate 'auth_restart': dot1x_auth Fa4
Jan 3 19:06:13 L3A3 310: -Traceback= B37A84 18DAB0 3046F4 302C80 303228 8F2B64 8E912C Jan 3 20:41:44 L3A3 315: .Jan 3 20:51:26.249: %SM-4-BADEVENT: Event 'eapSuccess' is invalid for the current state 'auth_restart': dot1x_auth Fa9
Jan 3 20:41:44 L3A3 316: -Traceback= B37A84 18DAB0 304648 302C80 303228 8F2B64 8E912C
There is no workaround.
•
Entering the reload privileged EXEC command might not reload the switch after these events occur in the order listed:
a.
b.
c.
The workaround is to not copy an SNMP configuration with a configuration file that contains crypto key generate rsa. If the switch has existing keys, the Cisco IOS operating system expects either a Yes or No response that you want to replace the existing keys. If the switch does not have existing keys, the system expects the key size. The system never receives the Yes or No response nor the key size because the copy operation is performed from SNMP.
•
•
When IEEE 802.1x is globally disabled on the switch by using the no dot1x system-auth-control global configuration command, some interface level configuration commands, including the dot1x timeout and dot1x mac-auth-bypass commands, become unavailable.
The workaround is to enable the dot1x system-auth-control global configuration command before attempting to configure interface level IEEE 802.1x parameters.
on command to the configuration and re-establishes communication with the RADIUS server.
•
The error message %DOT1X_SWITCH-5-ERR_VLAN_NOT_FOUND might appear in a switch stack under these conditions:
–
–
–
•
When dynamic ARP inspection is configured on a VLAN, and the ARP traffic on a port in the VLAN is within the configured rate limit, the port might go into an error-disabled state.
The workaround is to configure the burst interval to more than 1 second.
•
When the dynamic ARP inspection trust setting is removed from a large number of ports across multiple members of a stack, a %PLATFORM_RPC-3-MSG_THROTTLED message might appear.
The workaround is to remove the trust settings on a small number of ports one switch at a time. If the problem still occurs, continue to reduce the number of ports.
•
When cross-stack UplinkFast (CSUF) is configured on a switch and one of the member ports is flapping, packets transmitted from an EtherChannel port might be duplicated.
There is no workaround.
•
The error message %HPSECURE-6-ADDR_REMOVED might appear in a switch stack under these conditions:
–
–
–
There is no workaround.
•
When there are more than five switches in a stack or when four or more switches join a stack, there might be a long delay between the time the Ready prompt appears and a switch that is starting up begins carrying traffic. This delay can last several minutes.
There is no workaround. However, this condition only causes a delay during switch startup, and no data is lost.
•
When dynamic ARP inspection is enabled and IP validation is disabled, the switch drops ARP requests that have a source address of 0.0.0.0.
The workaround is to configure an ARP access control list (ACL) that permits IP packets with a source IP address of 0.0.0.0 (and any MAC) address) and apply the ARP ACL to the desired DAI VLANs.
•
When MAC addresses are learned on an Etherchannel port, the addresses are incorrectly deleted from the MAC address table even when the MAC address table aging timeout value is configured to be longer than the ARP timeout value. This causes intermittent unicast packet flooding in the network.
The MAC address is automatically relearned after the ARP refresh. The workaround is to enter the ping ip address privileged EXEC command from the switch to the next hop router to avoid the intermittent flooding.
•
When you configure an IP address on a switch virtual interface (SVI) with DCHP and enable DHCP snooping on the SVI VLAN, the switch SVI cannot obtain an IP address.
The workaround is to not enable DCHP snooping on the SVI VLAN or to use a static IP address for the SVI.
•
Clearing secure addresses by entering the clear port-security global configuration command in a stack member might cause traffic to be dropped from the switch. Some secure addresses learned on the stack master might not be learned on a stack member. Packets with a secure source address might also be dropped.
These are the workarounds. You only need to do one of these:
–
–
CSCsg70039 (Catalyst 3750 and 3560 switches)
When both an authorized data domain and an authorized voice domain is present on a port, and you change the VLAN configuration on the port to equal the assigned VLAN, a traceback error appears. This problem only occurs on the ports of a member switch.
The workaround is to change the voice VLAN to a value that does not match the assigned VLAN or VLAN feature (such as a guest VLAN).
•
During repeated reauthentication of supplicants on an IEEE 802.1x-enabled switch, if the RADIUS server is repeatedly going out of service and then coming back up, the available switch memory might deplete over time, eventually causing the switch to shut down.
There is no work-around, except to ensure that the RADIUS server is stable.
•
When a device is attached to a multidomain authentication (MDA)- enabled port that has IEEE 802.1x guest VLAN configured but not MAC authentication bypass (MAB), if the switch gets its MAC address from that port, the device is authenticated in the guest VLAN but appears as an IEEE 802.1x-authenticated device.
The workaround is to enable MAB by entering the dot1x mac-auth-bypass interface configuration command, or enter the dot1x timeout tx-period 1 to set the IEEE 802.1x timeout period to 1 second.
•
If IEEE 802.1x critical authentication is not enabled and the RADIUS authentication server is temporarily unavailable during a reauthentication, when the RADIUS server comes back up, MAC authentication bypass (MAB) does not authenticate a previously authenticated client.
The workaround is to enter the shutdown interface configuration command followed by the no shutdown command on the port connected to the client. An alternative, to prevent the problem from occurring, is to enable critical authentication by entering the dot1x critical {eapol | recovery delay milliseconds} global configuration command.
•
An IEEE 802.1x port configured for Multi-Domain Authentication does not allow access to the guest VLAN if an IEEE 802.1x supplicant has previously authenticated and then logged off.
On a Catalyst 3750 or Catalyst 3560 switch running Cisco IOS Release 12.2(35)SE or later, when an 802.1x port is configured for Multi-Domain Authentication and Guest VLAN, the guest VLAN feature is disabled once an 802.1X-enabled client has attached on the port. The feature remains disabled until the link goes down on the port. The result is that if an IEEE802.1x-enabled host is attached to the switch through an IP phone and is later replaced by a non-IEEE802.1x enabled host, the new host is not able to access the network via the guest VLAN. Instead, the port keeps trying to authenticate the new host (via IEEE802.1x or MAC Authentication Bypass indefinitely.
The workaround is to enter the dot1x guest-vlan supplicant global configuration command to allow access to the guest VLAN even after EAPoL packets have been seen on a port.
Resolved Caveats
This sections describes the caveats that have been resolved in this release:
Unless otherwise noted, these resolved caveats apply to the Catalyst 3750, 3560, 2970, and 2960 switches and the Cisco EtherSwitch service modules.
•
•
•
•
Caveats Resolved in Cisco IOS Release 12.2(35)SE5
•
The output of the show ip route privileged EXEC command now correctly displays the default gateway.
•
The stack master switch no longer resets with an error message when you enter the show storm-control user EXEC command and specify a stack member interface that is not configured for storm control.
•
The switch no longer reloads when the write core privileged EXEC command is entered when testing a core dump configuration and FTP is selected as the file transfer protocol.
•
A switch no longer displays this error message when reading from or writing to the configuration file:
%DATACORRUPTION-1-DATAINCONSISTENCY: write of 11 bytes to 10 bytes-Traceback= 0x41186A90 0x411A3960 0x411C1F88 0x413C24B8 0x4031EEDC 0x4032D144 0x411C3974 0x41193D9C 0x4119420C 0x411DF55C 0x411C70AC 0x411E3184 0x425590F4 0x4254BD7C 0x421B5CE0 0x421B5CC4•
When DHCP snooping is enabled on a VLAN, the broadcast DHCP request is now correctly sent over the trusted port and the connected hosts correctly receive their IP addresses.
Resolved Caveats in Cisco IOS Release 12.2(35)SE2
These caveats were resolved in Cisco IOS Release 12.2(35)SE2:
•
A vulnerability has been discovered in a third party cryptographic library which is used by a number of Cisco products. This vulnerability may be triggered when a malformed Abstract Syntax Notation One (ASN.1) object is parsed. Due to the nature of the vulnerability it may be possible, in some cases, to trigger this vulnerability without a valid certificate or valid application-layer credentials (such as a valid username or password).
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
The vulnerable cryptographic library is used in the following Cisco products:
–
–
–
–
–
This vulnerability is also being tracked by CERT/CC as VU#754281.
Cisco has made free software available to address this vulnerability for affected customers. There are no workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-crypto.shtml.
Note
•
A Gigabit Ethernet port on a Catalyst 3750 switch running Cisco IOS Release 12.2(35)SE1 shows linkup but no data goes through the port, including pinging the host through the port. This problem is fixed in Cisco IOS Release 12.2(35)SE2.
•
On a Catalyst 3750 switch, changing the MAC address or VLAN ID associated with an IPv4 or IPv6 address present in the ARP table or neighbor table no longer might impact traffic forwarding.
Resolved Caveats in Cisco IOS Release 12.2(35)SE1
These caveats were resolved in Cisco IOS Release 12.2(35)SE1:
•
DHCP snooping now works when the switch is in VTP server mode and VLANs with IDs greater than 255 (256 and above) are created.
•
When multiple hosts are authenticated on an IEEE 802.1X-enabled port that is configured with multidomain authentication (MDA), a START/STOP RADIUS Attribute-Value (AV) pair is now sent for each host.
•
Access control lists that are applied to routed ports on a member switch are now programmed into the switch hardware.
•
The MAC access bypass (MAB) inactivity timer is no longer applied to an IP phone (Cisco or non-Cisco) connected to an IEEE 802.1x-enabled port that is configured with multidomain authentication (MDA).
•
A query of the SNMP MIB object chassisFanStatus.0 no longer returns a value of 4 (which indicates that the fan is faulty) when the fan is operating properly.
Resolved Caveats in Cisco IOS Release 12.2(35)SE
These caveats were resolved in Cisco IOS Release 12.2(35)SE:
•
If two or more switches in a stack of PoE switches restarted at the same time and you entered the no switch stack-member-number provision global configuration command, this message no longer appears on the console:
%Command not applied to switch x, remote error
•
When an IEEE 802.1x restricted VLAN is configured on a port and a hub with multiple devices are connected to that port, syslog messages are now generated.
This is not a supported configuration. Only one host should be connected to an IEEE 802.1x restricted VLAN port.
•
When a switch joins a stack running Cisco IOS 12.2(20)SE1 or earlier, the boot auto-copy-sw now works correctly.
•
If two Cisco EtherSwitch service modules were directly connected through Fast Ethernet interfaces configured as both 100 Mbps and full duplex and as automatic speed and duplex settings, one interface might have detected the other as a Cisco-powered device.
•
Cisco IOS device may crash while processing malformed Secure Sockets Layer (SSL) packets. In order to trigger these vulnerabilities, a malicious client must send malformed packets during the SSL protocol exchange with the vulnerable device.
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
Cisco IOS is affected by the following vulnerabilities:
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. There are workarounds available to mitigate the effects of these vulnerabilities.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-SSL.shtml.
Note
A combined software table for Cisco IOS is available to aid customers in choosing a software releases that fixes all security vulnerabilities published as of May 22, 2007. This software table is available at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20070522-cry-bundle.shtml.
•
Cisco IOS device may crash while processing malformed Secure Sockets Layer (SSL) packets. In order to trigger these vulnerabilities, a malicious client must send malformed packets during the SSL protocol exchange with the vulnerable device.
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
Cisco IOS is affected by the following vulnerabilities:
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. There are workarounds available to mitigate the effects of these vulnerabilities.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-SSL.shtml.
Note
A combined software table for Cisco IOS is available to aid customers in choosing a software releases that fixes all security vulnerabilities published as of May 22, 2007. This software table is available at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20070522-cry-bundle.shtml.
•
An extra index no longer appears in the port table of the ciscoStpExtensions MIB.
•
When a stack of Catalyst 3750 switches are configured with a Layer 3 LACP EtherChannel, tracebacks are no longer generated when a stack master failover occurred.
•
When a Catalyst 3750 stack master fails or leaves the stack, a cross-stack EtherChannel in trunk mode running Link Aggregation Control Protocol (LACP) protocol no longer stops forwarding traffic on some VLANs.
•
When a Cisco device is configured for Network Admission Control and the EAP over UDP port number changes from its default value and then changes back with the eou default switch configuration command, the port change now takes effect.
•
When you configure a Cisco IP Phone to use Network Admission Control, the CDP packet is no longer delayed, and the phone is no longer identified as an agentless host without an identity profile.
•
A nonstackable EtherSwitch Service Module no longer boots with this provisioned switch error message:
switch 1 provision NME-X-23ES-1G-P^% Invalid input detected at '^' marker.Failed to generate persistent self-signed certificate.Secure server will use temporary self-signed certificate.
•
When you configure a MAC address filter by entering the mac-address-table static vlan drop global configuration command, IEEE 802.1X no longer authenticates supplicants using that address. If a supplicant with that address is authenticated, its authorization is revoked.
•
When you remove the bridge topology change trap with the no snmp-server enable traps bridge topologychange configuration command, the stpx root-inconsistency trap is now active.
•
When reloading a Cisco EtherSwitch service module that is a member of a switch stack and port security is enabled on the stack, a PSECURE traceback error no longer appears.
•
When you reload the stack master and a stack member at the same time, the entPhysicalIndex in the entPhysicalTable (ENTITY-MIB) for the SFP modules is now correct.
•
A switch no longer fails when the VPN Routing and Forwarding (VRF) configuration is removed under these conditions (in this order):
–
–
–
–
VRF is removed by using the no ip vrf global configuration command.
•
When the switch is running Ethernet over multiprotocol label switching (EoMPLS) in Cisco IOS Release 12.2(25)SED, the switch virtual interface (SVI) service policy now polices data traffic according to its defined policy.
•
When you reload a switch stack, the SFP module information now appears in the entPhysicalTable (ENTITY-MIB).
•
If you insert a defective SFP module into the switch SFP module slot, HSRP links flap and CPUHOG error messages are no longer sent.
•
When you clear the ARP by entering the clear arp user [interface <name>] EXEC command or when the ARP entry times out, the switch now sends packets with the correct destination MAC address.
•
When IGMP snooping is enabled and an EtherChannel member interface goes down, the switch now forwards multicast traffic on the rest of the EtherChannel member interfaces.
•
When IEEE 802.1x authentication was configured on a voice VLAN port, the switch did not forward traffic if the attached PC was configured for both machine authentication and user authentication.
An authenticated 802.1X port might not have forwarded traffic in these conditions:
–
–
–
•
Sometimes the switch dropped a fragmented multicast packet when it did not have the (S,G) entry, and more than 600 packets per second (pps) of other multicast traffic were sent to the switch CPU.
•
When you apply the mls qos trust dscp global configuration command to a port, this error message no longer appears:
Master sets trust failed, sets to untrust modetrust type updatefailed on ifc GigabitEthernetx/xSwitch(config-if)#Tcam write failed trust dscp%QOSMGR-4-COMMAND_FAILURE: Execution of slave:HQM_IDBTRUST_CMDcommand failed on GigabitEthernetx/x
•
When you remove and reconfigure a loopback interface, it no longer appears in the ifTable.
•
When you configure the ip cef load-sharing algorithm universal <id> global configuration command on the master switch, the command now appears in the stack member's running configuration. If the command is not configured on the master, it does not appear on the stack member switches.
•
The output from the show interface global configuration command now shows private VLANs for notconnect ports.
•
Cisco IOS device may crash while processing malformed Secure Sockets Layer (SSL) packets. In order to trigger these vulnerabilities, a malicious client must send malformed packets during the SSL protocol exchange with the vulnerable device.
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
Cisco IOS is affected by the following vulnerabilities:
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. There are workarounds available to mitigate the effects of these vulnerabilities.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-SSL.shtml.
Note
A combined software table for Cisco IOS is available to aid customers in choosing a software releases that fixes all security vulnerabilities published as of May 22, 2007. This software table is available at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20070522-cry-bundle.shtml.
•
EtherChannels with very long allowed VLAN lists no longer experience a link flap when a master failover occurs.
•
A routing protocol flap no longer occurs when a stack member joins the stack.
•
When you remove a voice VLAN that has no per-VLAN configuration from a secure port, a PORT_SECURITY-6-VLAN_REMOVED message no longer appears.
Note: If an address was learned on a VLAN, the error message still appears when that VLAN is aged out or removed. However, this does not affect switch functionality.
•
If a switch is connected to a third-party router through an EtherChannel and the EtherChannel is running in Link Aggregation Control Protocol (LACP) mode, the interfaces in the EtherChannel no longer fail after you enter the switchport trunk native vlan vlan-id interface configuration command to change the native VLAN from VLAN 1 (the default) to a different VLAN ID.
•
If a Putty client is used to change the configuration to a device with SSH, the switch no longer stops responding to incoming traffic, such as SSH, Telnet, or ping packets.
•
If fallback bridging is enabled on a routed port connected to an IEEE 802.1Q trunk port that is an EtherChannel member, the EtherChannel is no longer disabled after receiving the DTP frames.
•
Multiple Cisco products contain either of two authentication vulnerabilities in the Simple Network Management Protocol version 3 (SNMPv3) feature. These vulnerabilities can be exploited when processing a malformed SNMPv3 message. These vulnerabilities could allow the disclosure of network information or may enable an attacker to perform configuration changes to vulnerable devices. The SNMP server is an optional service that is disabled by default. Only SNMPv3 is impacted by these vulnerabilities. Workarounds are available for mitigating the impact of the vulnerabilities described in this document.
The United States Computer Emergency Response Team (US-CERT) has assigned Vulnerability Note VU#878044 to these vulnerabilities.
Common Vulnerabilities and Exposures (CVE) identifier CVE-2008-0960 has been assigned to these vulnerabilities.
This advisory will be posted at http://www.cisco.com/warp/public/707/cisco-sa-20080610-snmpv3.shtml
Documentation Updates
This section provides these updates to the product documentation for the Catalyst 3750, 3560, 2970, and 2960 switches:
•
•
•
•
EtherChannel Update
When you configure one end of an EtherChannel in either PAgP or LACP mode, the system negotiates with the other end of the channel to determine which ports should become active. In previous releases, the incompatible ports were suspended. Beginning with Cisco IOS Release 12.2(35)SE, instead of a suspended state, the local port is put into an independent state and continues to carry data traffic as would any other single link. The port configuration does not change, but the port does not participate in the EtherChannel.
Updates for the System Message Guide
For new messages in this release, see the Catalyst 3750, 3560, 3550, 2970, and 2960 Switch System Message Guide, 12.2(35)SE at this URL: http://www.cisco.com/en/US/products/hw/switches/ps5023/products_system_message_guides_list.html
Update to the Catalyst 2960 Software Configuration Guide
These sections were added to the "Configuring IEEE 802.1x" chapter:
Using Web Authentication
You can use a web browser to authenticate a client that does not support IEEE 802.1x functionality.
You can configure a port to use only web authentication. You can also configure the port to first try and use IEEE 802.1x authentication and then to use web authorization if the client does not support IEEE 802.1x authentication.
Web authentication requires two Cisco Attribute-Value (AV) pair attributes:
•
•
For example:
proxyacl# 10=permit ip any 10.0.0.0 255.0.0.0proxyacl# 20=permit ip any 11.1.0.0 255.255.0.0proxyacl# 30=permit udp any any eq syslogproxyacl# 40=permit udp any any eq tftp
Note
For more information, see the "Configuring Web Authentication" section.
Configuring Web Authentication
Beginning in privileged EXEC mode, follow these steps to configure authentication, authorization, accounting (AAA) and RADIUS on a switch before configuring web authentication. The steps enable AAA by using RADIUS authentication and enable device tracking.
This example shows how to enable AAA, use RADIUS authentication and enable device tracking:
Switch(config) configure terminalSwitch(config)# aaa new-modelSwitch(config)# aaa authentication login default group radiusSwitch(config)# aaa authorization auth-proxy default group radiusSwitch(config)# radius-server host key key1Switch(config)# radius-server attribute 8 include-in-access-reqSwitch(config)# radius-server vsa send authenticationSwitch(config)# ip device trackingSwitch(config) endBeginning in privileged EXEC mode, follow these steps to configure a port to use web authentication:
This example shows how to configure only web authentication on a switch port:
Switch# configure terminalSwitch(config)# ip admission name rule1 proxy httpSwitch(config)# interface gigabit1/0/1Switch(config-if)# switchport mode accessSwitch(config-if)# ip access-group policy1 inSwitch(config-if)# ip admission rule1Switch(config-if)# endBeginning in privileged EXEC mode, follow these steps to configure a switch port for IEEE 802.1x authentication with web authentication as a fallback method:
This example shows how to configure IEEE 802.1x authentication with web authentication as a fallback method.
Switch(config) configure terminalSwitch(config)# ip admission name rule1 proxy httpSwitch(config)# fallback profile fallback1Switch(config-fallback-profile)# ip access-group default-policy in Switch(config-fallback-profile)# ip admission rule1Switch(config-fallback-profile)# exitSwitch(config)# interface gigabit1/0/1Switch(config-if)# switchport mode accessSwitch(config-if)# dot1x port-control autoSwitch(config-if)# dot1x fallback fallback1Switch(config-if)# endFor more information about the ip admission name and dot1x fallback commands, see the command reference for this release.
Update to the Catalyst 2960 Command Reference
These commands were added:
•
•
dot1x fallback
Use the dot1xfallback interface configuration command on the switch stack or on a standalone switch to configure a port to use web authentication as a fallback method for clients that do not support IEEE 802.1x authentication. To return to the default setting, use the no form of this command.
dot1x fallback fallback-profile
no dot1x fallback
Syntax Description
fallback-profile
Specify a fallback profile for clients that do not support IEEE 802.1x authentication.
Defaults
No fallback is enabled.
Command Modes
Interface configuration
Command History
Usage Guidelines
You must enter the dot1x port-control auto interface configuration command on a switch port before entering this command.
Examples
This example shows how to specify a fallback profile to a switch port that has been configured for IEEE 802.1x authentication:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitethernet1/0/3Switch(config-if)# dot1x fallback profile1Switch(config-fallback-profile)# exitSwitch(config)# endYou can verify your settings by entering the show dot1x [interface interface-id] privileged EXEC command.
Related Commands
fallback profile
Use the fallback profile global configuration command on the switch stack or on a standalone switch to create a fallback profile for web authentication. To return to the default setting, use the no form of this command.
fallback profile profile
no fallback profile
Syntax Description
Defaults
No fallback profile is configured.
Command Modes
Global configuration
Command History
Usage Guidelines
The fallback profile is used to define the IEEE 802.1x fallback behavior for IEEE 802.1x ports that do not have supplicants. The only supported behavior is to fall back to web authentication.
After entering the fallback profile command, you enter profile configuration mode, and these configuration commands are available:
•
•
•
Examples
This example shows how to create a fallback profile to be used with web authentication:
Switch# configure terminalSwitch(config)# ip admission name rule1 proxy httpSwitch(config)# fallback profile profile1Switch(config-fallback-profile)# ip access-group default-policy in Switch(config-fallback-profile)# ip admission rule1Switch(config-fallback-profile)# exitSwitch(config)# interface gigabitethernet 1/0/1Switch(config-if)# dot1x fallback profile1 Switch(config-if)# endYou can verify your settings by entering the show running-configuration [interface interface-id] privileged EXEC command.
Related Commands
ip admission
Use the ip admission interface configuration command to enable web authentication. You can also use this command in fallback-profile mode. Use the no form of this command to disable web authentication.
ip admission rule
no ip admission
Syntax Description
Command Modes
Global configuration
Command History
Usage Guidelines
The ip admission command applies a web authentication rule to a switch port.
Examples
This example shows how to apply a web authentication rule to a switchport:
Switch# configure terminalSwitch(config)# interface gigabitethernet1/0/1Switch(config-if)# ip admission rule1This example shows how to apply a web authentication rule to a fallback profile for use on an IEEE 802.1x enabled switch port.
Switch# configure terminalSwitch(config)# fallback profile profile1Switch(config)# ip admission name rule1Switch(config)# endRelated Commands
ip admission name proxy http
Use the ip admission name proxy http global configuration command to enable web authentication. Use the no form of this command to disable web authentication.
ip admission name proxy http
no ip admission name proxy http
Syntax Description
This command has no arguments or keywords.
Defaults
Web authentication is disabled.
Command Modes
Global configuration
Command History
Usage Guidelines
The ip admission name proxy http command globally enables web authentication on a switch.
After you enable web authentication on a switch, use the ip access-group in and ip admission web-rule interface configuration commands to enable web authentication on a specific interface.
Examples
This example shows how to configure only web authentication on a switchport:
Switch# configure terminalSwitch(config) ip admission name http-rule proxy httpSwitch(config)# interface gigabitethernet1/0/1Switch(config-if)# ip access-group 101 inSwitch(config-if)# ip admission ruleSwitch(config-if)# endThis example shows how to configure IEEE 802.1x authentication with web authentication as a fallback mechanism on a switchport.
Switch# configure terminalSwitch(config)# ip admission name rule2 proxy httpSwitch(config)# fallback profile profile1Switch(config)# ip access group 101 inSwitch(config)# ip admission name rule2Switch(config)# interface gigabitethernet1/0/1Switch(config-if)# dot1x port-control autoSwitch(config-if)# dot1x fallback profile1Switch(config-if)# endRelated Commands
show fallback profile
Use the show fallback profile privileged EXEC command to display the fallback profiles that are configured on a switch.
show fallback profile [append | begin | exclude | include | {[redirect | tee] url} expression]
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the show fallback profile privileged EXEC command to display profiles that are configured on the switch.
Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.
Examples
This is an example of output from the show fallback profile command:
switch# show fall profileProfile Name: dot1x-www------------------------------------Description : NONEIP Admission Rule : webauth-fallbackIP Access-Group IN: default-policyProfile Name: dot1x-www-lpip------------------------------------Description : NONEIP Admission Rule : web-lpipIP Access-Group IN: default-policyProfile Name: profile1------------------------------------Description : NONEIP Admission Rule : NONEIP Access-Group IN: NONERelated Commands
Updates to the Catalyst 3750 Getting Started Guide
The Express Setup configuration windows were updated in the getting started guide. This is the complete procedure:
Running Express Setup
When you first set up the switch, you should use Express Setup to enter the initial IP information. This enables the switch to connect to local routers and the Internet. You can then access the switch through the IP address for further configuration.
To run Express Setup:
Updates for the Regulatory Compliance and Safety Information
This information was added to the Regulatory Compliance and Safety Information for the Catalyst 3750, 3560, 2970, and 2960 switches.
Statement 361—VoIP and Emergency Calling Services do not Function if Power Fails
Related Documentation
These documents provide complete information about the Catalyst 3750, 3560, 2970, and 2960 switches and the Cisco EtherSwitch service modules and are available at Cisco.com:
•
•
•
•
You can order printed copies of documents with a DOC-xxxxxx= number from the Cisco.com sites listed in the "Obtaining Documentation, Obtaining Support, and Security Guidelines" section.
These documents provide complete information about the Catalyst 3750 switches and the Cisco EtherSwitch service modules:
•
•
•
•
•
•
•
These documents provide complete information about the Catalyst 3750G Integrated Wireless LAN Controller Switch and the integrated wireless LAN controller and are available at cisco.com:
•
•
•
•
These documents provide complete information about the Catalyst 3560 switches:
•
•
•
•
•
•
These documents provide complete information about the Catalyst 2970 switches:
•
•
•
•
•
•
These documents provide complete information about the Catalyst 2960 switches:
•
•
•
•
•
Note
•
•
•
•
•
•
•
•
For other information about related products, see these documents:
•
•
•
•
•
•
•
•
•
http://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html
–
–
–
–
Obtaining Documentation, Obtaining Support, and Security Guidelines
For information on obtaining documentation, obtaining support, providing documentation feedback, security guidelines, and also recommended aliases and general Cisco documents, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCVP, the Cisco logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networking Academy, Network Registrar, Packet, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0705R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
Copyright © 2007 Cisco Systems, Inc. All rights reserved.
