Manage Catalyst 9000 Switches Using the Web UI

Introduction

This document describes how to manage Catalyst 9000 switches through the Web UI.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on these software and hardware versions:

• Catalyst 9200
• Catalyst 9300
• Catalyst 9400
• Catalyst 9500
• Catalyst 9600
• Cisco IOS® XE 17.9.1 and later versions

Note: Consult the appropriate configuration guide for the commands that are used in order to enable these features on other Cisco platforms.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

The Web User Interface (Web UI) is an embedded GUI-based tool that provides the ability to manage the device to enhance the user experience. You can use Web UI to build configurations, monitor, and troubleshoot the device without having CLI expertise.

Note: Hardware system requirements for Web UI access are listed in the Release Notes for the each IOS XE version.

Configure

Web UI Access

In order to access the Web UI, these configurations are needed:

1. HTTP(S) server enabled (enabled by default) and using local authentication.
2. A Layer 3 interface that is reachable from the local PC.
3. A local user account.

Verify that the HTTP(S) server is enabled using  show running-config | section http  command. This command shows that the HTTP server is enabled and using local credentials for authentication:

Cat9k#show running-config | section http
ip http server                     <--- HTTP server enabled
ip http authentication local       <--- Use local credentials for authentication
ip http secure-server              <--- HTTPS server enabled
destination transport-method http

Also,  show ip http server status  command can be used to validate that the HTTP(S) server is enabled.

Cat9k#show ip http server status | include server status
HTTP server status: Enabled
HTTP secure server status: Enabled

Validate that a Layer 3 interface on the switch is reachable from the local PC. The Layer 3 interface can be the Management interface or a Switch Virtual Interface (SVI). Use these commands:

Cat9k#show running-config interface vlan 10
Building configuration...

Current configuration : 94 bytes
!
interface Vlan10
description MGMT
ip address 10.1.1.1 255.255.255.0      <--- IP address configured in the SVI VLAN 10
no ip redirects
end

Cat9k#show ip interface brief | exclude unassigned
Interface              IP-Address      OK? Method Status                Protocol
Vlan10                 10.1.1.1        YES manual up                    up      <--- SVI VLAN 10 is UP/UP

Cat9k#ping 10.1.1.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms   <--- Ping from the switch to the local PC is successful

Verify that there is a local user account configured with privilege level of 15. When a privilege level 1-14 is used, or privilege 15 is not explicitly configured, the Web UI is accessible only for monitoring purposes. Privilege level 15 grants full access to the Web UI configuration and management tools.

Cat9k#show running-config | include username
username cisco privilege 15 secret 9 $9$0hzcXmr/bfxxaU$XdMzC1B45nCyLJ.9Li3q94JHh9uDWEq9urVf4YUKfnQ  <--- User cisco with privilege level 15

Upgrade

Install Mode

The Web UI Software Management tool allows you to upgrade the switch using a software image file located in a local PC. With this method, the image file is copied to the switch through HTTP, so that there is no need to copy the image from an FTP/TFTP/SCP server or a USB flash drive.

Caution: Upgrade using the Web UI is supported in IOS XE 17.9.1 and later releases. Earlier software versions do not support upgrade or downgrade through the Web UI.

1. Access a supported internet browser, type the IP address of the Layer 3 interface configured on the switch.
2. Log on using the local credentials configured on the switch.
3. Navigate through  Administration > Software Management  and select the  Software Upgrade  page.Software Management Window
4. Under  Manage, click  Remove Inactive Files  to clean-up installation files (.bin, .pkg, .conf) that are not in use. A pop-up window is displayed asking for confirmation, select  Yes. Once this operation is started, a Status Panel is displayed, you can click  Show Logs  to display the progress of this operation. Once this operation is complete, ensure that there is at least 1GB of space in flash.Remove Inactive Files Operation
5. From the  Upgrade Mode  drop-down list, choose  INSTALL .
6. Select the One-Shot Install Upgrade checkbox so that the switch is reloaded post activation to bring it up with new software.
7. From the  Transport Type  drop-down list, choose  My Desktop  to upload the binary software image file (.bin file) from the local PC. If the .bin file is already located in the flash of the switch, you can choose Device  and select the file.
8. From the File System  drop-down list, choose  bootflash.
9. Under  Source File Path , click  Select File  and browse to the binary software image in the local PC.
10. Click  Download & Install  to start the upgrade process.A pop-up window is displayed asking for confirmation, select  Yes . Upon confirmation, the image is downloaded to the switch, installed and activated, then the switch reloads to commit the new software. Once this operation is started, a Status Panel is displayed, you can click  Show Logs  to display the progress of this operation.

Note: When the switch reloads, the session can time out. If so, reload the browser window and login.

Software Upgrade in Progress

Remove Inactive Files Logs

Here is an example of the logs displayed during a  Remove Inactive Files  operation:

Initiating install_remove_inactive to remove inactive files
install_remove: START Wed Jan 31 17:49:42 UTC 2024
Cleaning up unnecessary package files
No path specified, will use booted path bootflash:packages.conf
Cleaning bootflash:
  Scanning boot directory for packages ... done.
  Preparing packages list to delete ... 
    cat9k-cc_srdriver.17.09.01.SPA.pkg
      File is in use, will not delete.
    cat9k-espbase.17.09.01.SPA.pkg
      File is in use, will not delete.
    cat9k-guestshell.17.09.01.SPA.pkg
      File is in use, will not delete.
    cat9k-lni.17.09.01.SPA.pkg
      File is in use, will not delete.
    cat9k-rpbase.17.09.01.SPA.pkg
      File is in use, will not delete.
    cat9k-rpboot.17.09.01.SPA.pkg
      File is in use, will not delete.
    cat9k-sipbase.17.09.01.SPA.pkg
      File is in use, will not delete.
    cat9k-sipspa.17.09.01.SPA.pkg
      File is in use, will not delete.
    cat9k-srdriver.17.09.01.SPA.pkg
      File is in use, will not delete.
    cat9k-webui.17.09.01.SPA.pkg
      File is in use, will not delete.
    cat9k-wlc.17.09.01.SPA.pkg
      File is in use, will not delete.
    packages.conf
      File is in use, will not delete.
  done.
  
The following files will be deleted:
[R0]:
/bootflash/cat9k-cc_srdriver.17.09.04a.SPA.pkg
/bootflash/cat9k-espbase.17.09.04a.SPA.pkg
/bootflash/cat9k-guestshell.17.09.04a.SPA.pkg
/bootflash/cat9k-lni.17.09.04a.SPA.pkg
/bootflash/cat9k-rpbase.17.09.04a.SPA.pkg
/bootflash/cat9k-rpboot.17.09.04a.SPA.pkg
/bootflash/cat9k-sipbase.17.09.04a.SPA.pkg
/bootflash/cat9k-sipspa.17.09.04a.SPA.pkg
/bootflash/cat9k-srdriver.17.09.04a.SPA.pkg
/bootflash/cat9k-webui.17.09.04a.SPA.pkg
/bootflash/cat9k-wlc.17.09.04a.SPA.pkg
/bootflash/cat9k_iosxe.17.09.01.SPA.bin
/bootflash/cat9k_iosxe.17.09.01.SPA.conf
/bootflash/cat9k_iosxe.17.09.04a.CSCwf83348.SPA.smu.bin
/bootflash/cat9k_iosxe.17.09.04a.CSCwh82668.SPA.smu.bin
/bootflash/cat9k_iosxe.17.09.04a.SPA.bin
/bootflash/cat9k_iosxe.17.09.04a.SPA.conf
[R0]:
Deleting file bootflash:cat9k-cc_srdriver.17.09.04a.SPA.pkg ... done.
Deleting file bootflash:cat9k-espbase.17.09.04a.SPA.pkg ... done.
Deleting file bootflash:cat9k-guestshell.17.09.04a.SPA.pkg ... done.
Deleting file bootflash:cat9k-lni.17.09.04a.SPA.pkg ... done.
Deleting file bootflash:cat9k-rpbase.17.09.04a.SPA.pkg ... done.
Deleting file bootflash:cat9k-rpboot.17.09.04a.SPA.pkg ... done.
Deleting file bootflash:cat9k-sipbase.17.09.04a.SPA.pkg ... done.
Deleting file bootflash:cat9k-sipspa.17.09.04a.SPA.pkg ... done.
Deleting file bootflash:cat9k-srdriver.17.09.04a.SPA.pkg ... done.
Deleting file bootflash:cat9k-webui.17.09.04a.SPA.pkg ... done.
Deleting file bootflash:cat9k-wlc.17.09.04a.SPA.pkg ... done.
Deleting file bootflash:cat9k_iosxe.17.09.01.SPA.bin ... done.
Deleting file bootflash:cat9k_iosxe.17.09.01.SPA.conf ... done.
Deleting file bootflash:cat9k_iosxe.17.09.04a.CSCwf83348.SPA.smu.bin ... done.
Deleting file bootflash:cat9k_iosxe.17.09.04a.CSCwh82668.SPA.smu.bin ... done.
Deleting file bootflash:cat9k_iosxe.17.09.04a.SPA.bin ... done.
Deleting file bootflash:cat9k_iosxe.17.09.04a.SPA.conf ... done.
SUCCESS: Files deleted.
--- Starting Post_Remove_Cleanup ---
Performing Post_Remove_Cleanup on Active/Standby
  [1] Post_Remove_Cleanup package(s) on R0
  [1] Finished Post_Remove_Cleanup on R0
Checking status of Post_Remove_Cleanup on [R0]
Post_Remove_Cleanup: Passed on [R0]
Finished Post_Remove_Cleanup

SUCCESS: install_remove  Wed Jan 31 17:52:28 UTC 2024

Install Logs

Here is an example of the logs displayed during a successful upgrade:

install_add_activate_commit: START Wed Jan 31 18:02:27 UTC 2024
install_add_activate_commit: Adding PACKAGE
install_add_activate_commit: Checking whether new add is allowed ....

--- Starting Add ---
Performing Add on Active/Standby
  [1] Add package(s) on R0
  [1] Finished Add on R0
Checking status of Add on [R0]
Add: Passed on [R0]
Finished Add

Image added. Version: 17.09.04a.0.6
install_add_activate_commit: Activating PACKAGE
Following packages shall be activated:
/bootflash/cat9k-wlc.17.09.04a.SPA.pkg
/bootflash/cat9k-webui.17.09.04a.SPA.pkg
/bootflash/cat9k-srdriver.17.09.04a.SPA.pkg
/bootflash/cat9k-sipspa.17.09.04a.SPA.pkg
/bootflash/cat9k-sipbase.17.09.04a.SPA.pkg
/bootflash/cat9k-rpboot.17.09.04a.SPA.pkg
/bootflash/cat9k-rpbase.17.09.04a.SPA.pkg
/bootflash/cat9k-lni.17.09.04a.SPA.pkg
/bootflash/cat9k-guestshell.17.09.04a.SPA.pkg
/bootflash/cat9k-espbase.17.09.04a.SPA.pkg
/bootflash/cat9k-cc_srdriver.17.09.04a.SPA.pkg
--- Starting Activate ---
Performing Activate on Active/Standby
  [1] Activate package(s) on R0
    --- Starting list of software package changes ---
    Old files list:
      Modified cat9k-cc_srdriver.17.09.01.SPA.pkg
      Modified cat9k-espbase.17.09.01.SPA.pkg
      Modified cat9k-guestshell.17.09.01.SPA.pkg
      Modified cat9k-lni.17.09.01.SPA.pkg
      Modified cat9k-rpbase.17.09.01.SPA.pkg
      Modified cat9k-rpboot.17.09.01.SPA.pkg
      Modified cat9k-sipbase.17.09.01.SPA.pkg
      Modified cat9k-sipspa.17.09.01.SPA.pkg
      Modified cat9k-srdriver.17.09.01.SPA.pkg
      Modified cat9k-webui.17.09.01.SPA.pkg
      Modified cat9k-wlc.17.09.01.SPA.pkg
    New files list:
      Added cat9k-cc_srdriver.17.09.04a.SPA.pkg
      Added cat9k-espbase.17.09.04a.SPA.pkg
      Added cat9k-guestshell.17.09.04a.SPA.pkg
      Added cat9k-lni.17.09.04a.SPA.pkg
      Added cat9k-rpbase.17.09.04a.SPA.pkg
      Added cat9k-rpboot.17.09.04a.SPA.pkg
      Added cat9k-sipbase.17.09.04a.SPA.pkg
      Added cat9k-sipspa.17.09.04a.SPA.pkg
      Added cat9k-srdriver.17.09.04a.SPA.pkg
      Added cat9k-webui.17.09.04a.SPA.pkg
      Added cat9k-wlc.17.09.04a.SPA.pkg
    Finished list of software package changes
  [1] Finished Activate on R0
Checking status of Activate on [R0]
Activate: Passed on [R0]
Finished Activate

--- Starting Commit ---
Performing Commit on Active/Standby
  [1] Commit package(s) on R0
  [1] Finished Commit on R0
Checking status of Commit on [R0]
Commit: Passed on [R0]
Finished Commit

Send model notification for install_add_activate_commit before reload
Install will reload the system now!
SUCCESS: install_add_activate_commit  Wed Jan 31 18:09:14 UTC 2024
Requesting RP pvp reload

Manage Files

Copy From/To the Switch

The Web UI File Manager tool allows you to copy files from the switch to a local PC and vice versa, eliminating the need of using an external FTP/TFTP/SCP server. This is useful when troubleshooting an issue and files need to be extracted from the switch, such as Binary trace files, packet captures, crash files and system reports. 

Note: The maximum file size allowed for upload is 1GB.

1. Access a supported internet browser, type the IP address of the Layer 3 interface configured on the switch.
2. Log on using the local credentials configured on the switch.
3. Navigate through  Administration > Management > File Manager .
4. Select  bootflash:, this is the directory to copy files to/from.File Manager Window
5. To download a file, right click on it and choose  Download.Download a File using the File Manager
6. To upload a file, click on  Upload, then select the file to upload. The file is uploaded to the selected directory. A progress bar at the top of the screen displays the progress of the upload.

Related Information

• Upgrade Guide for Catalyst 9000 Switches
• Release Notes for Cisco Catalyst 9500 Series Switches, Cisco IOS® XE Cupertino 17.9.x (Chapter: Compatibility Matrix and Web UI System Requirements)
• Cisco Technical Support & Downloads  

Cisco Bug IDs

• Cisco bug ID CSCwh87343  - Cisco IOS® XE Software Web UI Privilege Escalation Vulnerability