Release Notes for Catalyst 3850 Series Switch, Cisco IOS XE Release 3.2.xSE

Cisco Prime Infrastructure (PI) 2.0

Cisco PI 2.0 manages both wired and wireless LAN devices such as Catalyst 3850 switches, Cisco 5760 controllers, Cisco 5500 series wireless controllers, and access points. PI 2.0 provides unified management for the features that are common to both switches and wireless controllers. After your devices are added to Prime Infrastructure, you can use the Initial Device Setup workflow to configure the wired and wireless features on switches and controllers.

For more details on PI 2.0, see the documents at this URL:

http://www.cisco.com/en/US/products/ps12239/tsd_products_support_series_home.html

Captive Portal Bypassing for Local Web Authentication

In Cisco IOS XE Release 3.2.2SE, Apple devices that need to resolve Wireless Internet Service Provider roaming (WISPr) and have support for captive portal bypass could not get local web authentication. This issue is resolved in Cisco IOS XE Release 3.2.3SE.

If you have configured virtual IP resulting in a successful web authentication, but when you log out, you receive a popup window prompting you to click a link to log out, you can disable this popup by following these steps:

For more information about captive portal bypassing, see http://www.cisco.com/en/US/docs/wireless/controller/7.5/config_guide/b_cg75_chapter_01010001.html

New and Enhanced GUI Features

In the earlier releases, the controller web user interface is accessed by entering http:// ipaddress (the ipaddress is the controller IP address) in the browser. Now, you can enter http:// ipaddress /wireless in the browser, which will also allow you to access the web user interface.

The controller web user interface is enhanced to support the following:

The Configuration Wizard—After initial configuration of the IP address and the local username/password or auth via the authentication server (privilege 15 needed), the wizard provides a method to complete the initial wireless configuration. Start the wizard through Configuration -> Wizard and follow the nine-step process to configure the following:

• Admin Users
• NMP System Summary
• Management Port
• Wireless Management
• RF Mobility and Country code
• Mobility configuration
• WLANs
• 802.11 Configuration
• Set Time

The Monitor tab:

• Displays summary details of controller, clients, and access points.
• Displays all radio and AP join statistics.
• Displays air quality on access points.
• Displays list of all Cisco Discovery Protocol (CDP) neighbors on all interfaces and the CDP traffic information.
• Displays all rogue access points based on their classification—friendly, malicious, ad hoc, classified, and unclassified.

The Configuration tab:

• Enables you to configure the controller for all initial operation using the web Configuration Wizard. The wizard allows you to configure user details, management interface, and so on.
• Enables you to configure the system, internal DHCP server, management, and mobility management parameters.
• Enables you to configure the controller, WLAN, and radios.
• Enables you to configure and set security policies on your controller.
• Enables you to access the controller operating system software management commands.

The Administration tab enables you to configure system logs.

Enhanced Bring Your Own Device (BYOD) Support

When supporting personal devices on a corporate network, you must protect network services and enterprise data by authenticating and authorizing users and their devices. A Cisco Identity Services Engine (ISE) Advanced License provides the tools that you need to allow employees to securely use personal devices on a corporate network.

• Device Profiling—When a client device tries to associate with a WLAN, the switch collects information related to DHCP, RADIUS, HTTP, and so on and sends that information in the form of RADIUS packets to the Cisco Identity Services Engine (ISE). As a result, the client type can be determined.
• Single SSID and Dual SSID support—In the single SSID scenario, one SSID is used for certificate enrollment, provisioning, and network access. In the dual SSID scenario, one SSID provides certificate enrollment and provisioning and a second SSID provides secure network access. This certificate is used by the client to authenticate with the ISE EAPTLS protocols after it is provisioned in the first SSID (open). For more details, see the Cisco Identity Services Engine User Guide at this URL:

http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_user_guide.html

Fast SSID Changing

Fast SSID changing allows wireless clients to move from one SSID to another without delay. For more information, see Configuring Fast SSID Changing.

Catalyst 3850 Switch Models

 

Network Modules

Table 2 lists the three optional uplink network modules with 1-Gigabit and 10-Gigabit slots. You should only operate the switch with either a network module or a blank module installed.

 

Optics Modules

The Catalyst 3850 switches support a wide range of optics. Because the list of supported optics is updated on a regular basis, consult the tables at this URL for the latest SFP compatibility information:

http://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html

Cisco Wireless LAN Controller Models

 

Other Supported Products

Table 4 lists the supported products of the Catalyst 3850 switch.

Supported Access Points

1.AP 1600 will not work with 5508/WiSM2 as MC in converged access mode.

Table 5 lists the specific supported Cisco access points.

 

Compatibility Matrix

Table 6 lists the software compatibility matrix.

 

2.IRCM Feature: Seamless roam between 5760 / 3850 and 5508 / WiSM2 with 7.3 MR1 running new mobility.

Hardware Requirements

 

3.We recommend 1 GHz. 4.We recommend 1 GB DRAM.

Software Requirements

• Windows 2000, XP, Vista, and Windows Server 2003.
• Internet Explorer 6.0, 7.0, Firefox 1.5, 2.0 or later with JavaScript enabled.

Software Requirements

• Microsoft Internet Explorer 6.0 and 7.0, and Mozilla Firefox up to version 26.0, with Java Script enabled

Table 8 Cisco IOS XE to Cisco IOS Version Number Mapping

Cisco IOS XE Version	Cisco IOSd Version	Cisco Wireless Control Module Version	Access Point Version
03.02.00SE	15.0(1)EX	10.0.100.0	152-2.JN
03.02.01SE	15.0(1)EX1	10.0.101.0	152-2.JN
03.02.02SE	15.0(1)EX2	10.0.111.0	152-2.JN
03.02.03SE	15.0(1)EX3	10.0.120.0	152-2.JN

---

---

---

---

Security

• IEEE 802.1x, DHCP snooping, IP Source Guard, Control Plane Protection, and Wireless Intrusion Prevention Systems (wIPS) security features are available. With a variety of wired and wireless users connecting to the network, the switch supports session-based networking, where each device connected to the network is identified as one session.
• Port security secures access based on MAC address. It limits the number of learned MAC addresses to deny MAC address flooding.
• DHCP snooping filters untrusted DHCP messages between untrusted hosts and DHCP servers.
• IP source guard restricts traffic on nonrouted interfaces by filtering traffic based on the DHCP snooping database and IP source bindings.
• Dynamic ARP inspection (DAI) prevents malicious attacks on the switch by not relaying invalid ARP requests and responses to other ports in the same VLAN.
• Flexible authentication supports multiple authentication mechanisms including 802.1X, MAC Authentication Bypass and web authentication using a single, consistent configuration.
• Open mode creates a user friendly environment for 802.1X operations.
• Comprehensive new RADIUS Change of Authorization capability provides for asynchronous policy management.
• Private VLANs restricts traffic between hosts in a common segment by segregating traffic at Layer 2, turning a broadcast segment into a non-broadcast, multiaccess-like segment.
• Private VLAN Edge provides security and isolation between switch ports, which helps ensure that users cannot snoop on other users' traffic.
• Unicast Reverse Path Forwarding (RPF) feature helps mitigate problems caused by the introduction of malformed or forged (spoofed) IP source addresses into a network by discarding IP packets that lack a verifiable IP source address.
• Multidomain Authentication allows an IP phone and a PC to authenticate on the same switch port while placing them on appropriate voice and data VLAN.
• Cisco security VLAN ACLs on all VLANs prevent unauthorized data flows from being bridged within VLANs.
• Cisco standard and extended IP security router ACLs define security policies on routed interfaces for control-plane and data-plane traffic. IPv6 ACLs can be applied to filter IPv6 traffic.
• Port-based ACLs for Layer 2 interfaces allow security policies to be applied on individual switch ports.
• Secure Shell (SSH) Protocol, Kerberos, and Simple Network Management Protocol Version 3.
• (SNMPv3) provide network security by encrypting administrator traffic during Telnet and SNMP sessions. SSH Protocol, Kerberos, and the cryptographic version of SNMPv3 require a special cryptographic software image because of U.S. export restrictions.
• Bidirectional data support on the Switched Port Analyzer (SPAN) port allows Cisco Intrusion Detection.
• System (IDS) enables taking action when an intruder is detected.
• TACACS+ and RADIUS authentication facilitates centralized control of the switch and restricts unauthorized users from altering the configuration.
• MAC address notification allows administrators to be notified of users added to or removed from the network.
• Multilevel security on console access prevents unauthorized users from altering the switch configuration.
• Bridge protocol data unit (BPDU) Guard shuts down Spanning Tree PortFast-enabled interfaces when BPDUs are received to avoid accidental topology loops.
• Spanning Tree Root Guard (STRG) prevents edge devices not in the network administrator's control from becoming Spanning Tree Protocol root nodes.
• IGMP filtering provides multicast authentication by filtering out nonsubscribers and limits the number of concurrent multicast streams available per port.
• Wireless end-to-end security offers control and provisioning of wireless access points (CAPWAP)-compliant DTLS encryption to ensure encryption between access points and controllers.
• Mobility and security provides secure, reliable wireless connectivity and a consistent end-user experience.
• Increased network availability is achieved through proactive blocking of known threats.

Ease of Operations

• Cisco Catalyst Smart Operations is a comprehensive set of capabilities that simplify LAN deployment, configuration, and troubleshooting. In addition to adaptive, always on technologies such as StackWise-480 and StackPower, Catalyst Smart Operations enable zero touch installation and replacement of switches and fast upgrade, as well as ease of troubleshooting with reduced operational cost. Catalyst Smart Operations is a set of features that includes Smart Install, Auto Smartports, Smart Configuration, and Smart Troubleshooting to enhance operational excellence:

– Cisco Smart Install is a transparent plug and play technology used to configure the Cisco IOS software image and switch configuration without user intervention. Smart Install utilizes dynamic IP address allocation and the assistance of other switches to facilitate installation providing transparent network plug and play.

– Cisco Auto Smartports provide automatic configuration as devices connect to the switch port, allowing auto detection and plug and play of the device onto the network.

– Cisco Smart Configuration provides a single point of management for a group of switches and in addition adds the ability to archive and back up configuration files to a file server or switch allowing seamless zero touch switch replacement.

– Cisco Smart Troubleshooting is an extensive array of debug diagnostic commands and system health checks within the switch, including Generic Online Diagnostics (GOLD) and Onboard Failure Logging (OBFL).

• Embedded Event Manager (EEM) is a powerful and flexible feature that provides real-time network event detection and onboard automation. Using EEM, customers can adapt the behavior of their network devices to align with their business needs. This feature requires the IP Base feature set.

Deployment and Control Features

• Consistent quality of service (QoS) and security for wired and wireless traffic.

– Modular QoS CLI (MQC) for defining and applying QoS common policies.

– Granular QoS policies per access point (AP), radio, SSID, and client.

– Session-based networking provides better control on devices connecting to the network. ACLs and QoS policies can be applied through the Identity Services Engine (ISE) to each session.

• Improved scale and bandwidth using the converged wired plus wireless functionality:

– Each 48-port Catalyst 3850 switch provides 40 Gbps of wireless throughput (20 Gbps for the 24 port model). This wireless capacity increases with the number of members in the stack.

– Mobility Agent—In this mode, the switch terminates the CAPWAP tunnels from access points and provides wireless connectivity to wireless clients. The switch enforces security and QoS policies for wireless clients and access points.

– Mobility Controller—In this mode, the switch performs all Mobility Agent tasks as well as Mobility coordination, Radio Resource Management (RRM), and clean air coordination.

• Cisco StackWise-480 technology creates a resilient single unified system (a stack) of up to four switches. With a stack bandwidth of 480 Gbps, the stack functions as a single switching unit that is managed by the active switch. If the active switch fails, the standby switch assumes the role of the active switch, keeping the stack operational. Access points connected to operational switches in the stack remain connected during an active to standby switchover.
• Cisco Stack Power technology unifies the individual power supplies installed in the switches in a stack and allows them to be shared as a common resource. Up to four switches can be configured in a StackPower stack with the special connector at the back of the switch using the StackPower cable. StackPower can be deployed in either power sharing mode or redundancy mode. In power-sharing mode, the power of all the power supplies in the stack is aggregated and distributed among the switches in the stack. In redundant mode, some power is held in reserve and used to maintain power to switches and attached devices when one power supply fails, enabling the network to operate without interruption.
• Express Setup for quickly configuring a switch for the first time with basic IP information, contact information, switch and Telnet passwords, and Simple Network Management Protocol (SNMP) information through a browser-based program.
• IP service-level agreements (SLAs) enable customers to assure new business-critical IP applications, as well as IP services that utilize data, voice, and video, in an IP network. This feature requires IP Services feature set.
• Dynamic Host Configuration Protocol (DHCP) Auto-configuration of multiple switches through a boot server eases switch deployment.
• Automatic QoS (AutoQoS) simplifies QoS configuration in voice over IP (VoIP) networks by issuing interface and global switch commands to detect Cisco IP phones, classify traffic, and help enable egress queue configuration.
• Cisco StackWise-480 technology helps ensure that all switches are automatically upgraded when the active switch receives a new software version. Automatic software version checking and updating help ensure that all stack members have the same software version.
• Auto-negotiation on all ports automatically selects half- or full-duplex transmission mode to optimize bandwidth.
• Dynamic Trunking Protocol (DTP) facilitates dynamic trunk configuration across all switch ports.
• Port Aggregation Protocol (PAgP) automates the creation of Cisco Fast EtherChannel groups and Gigabit groups.
• EtherChannel groups to link to another switch, router, or server.
• Link Aggregation Control Protocol (LACP) allows the creation of Ethernet channeling with devices that conform to IEEE 802.3ad. This feature is similar to Cisco EtherChannel technology and PAgP.
• Automatic media-dependent interface crossover (MDIX) automatically adjusts transmit and receive pairs if an incorrect cable type (crossover or straight-through) is installed.
• Unidirectional Link Detection Protocol (UDLD) and Aggressive UDLD allow unidirectional links caused by incorrect fiber-optic wiring or port faults to be detected and disabled on fiber-optic interfaces.
• Switching Database Manager (SDM) templates—VLAN template (specific to LAN Base license level) and Advanced template allow the administrator to automatically optimize the TCAM memory allocation to the desired features based on deployment-specific requirements.
• Local Proxy Address Resolution Protocol (ARP) works in conjunction with Private VLAN Edge to minimize broadcasts and maximize available bandwidth.
• Optimized multicast for wired and wireless traffic.
• Internet Group Management Protocol (IGMP) v1, v2, v3 Snooping for IPv4. MLD v1 and v2 Snooping provide fast client joins and leaves of multicast streams and limit bandwidth-intensive video traffic to only the requestors.
• Voice VLAN simplifies telephony installations by keeping voice traffic on a separate VLAN for easier administration and troubleshooting.
• Cisco VLAN Trunking Protocol (VTP) version 3 supports dynamic VLANs and dynamic trunk configuration across all switches.
• Remote Switch Port Analyzer (RSPAN) allows administrators to remotely monitor ports in a Layer 2 switch network from any other switch in the same network.
• The Embedded Remote Monitoring (RMON) software agent supports four RMON groups (history, statistics, alarms, and events) for enhanced traffic management, monitoring, and analysis.
• Layer 2 traceroute eases troubleshooting by identifying the physical path that a packet takes from source to destination.
• Wireless RF management provides both real-time and historical information about RF interference impacting network performance across controllers, via system-wide Cisco CleanAir technology integration.
• Trivial File Transfer Protocol (TFTP) reduces the cost of administering software upgrades by downloading from a centralized location.
• Network Time Protocol (NTP) provides an accurate and consistent timestamp to all intranet switches.

High Availability

• Cross-Stack EtherChannel provides the ability to configure Cisco EtherChannel technology across different members of the stack for high resiliency.
• FlexLink provides link redundancy with convergence time less than 100 ms.
• IEEE 802.1s/w Rapid Spanning Tree Protocol (RSTP) and Multiple Spanning Tree Protocol (MSTP) provide rapid spanning-tree convergence independent of spanning-tree timers and also offers the benefit of Layer 2 load balancing and distributed processing. Stacked units behave as a single spanning-tree node.
• Per-VLAN Rapid Spanning Tree (PVRST+) allows rapid spanning-tree reconvergence on a per-VLAN spanning-tree basis, without requiring the implementation of spanning-tree instances.
• Switch-port auto-recovery (Err-disable) automatically attempts to reactivate a link that is disabled because of a network error.
• StackWise-480 provides switch redundancy based on the resilient Cisco IOS Stateful Switchover (SSO) mechanism.
• StackPower provides power supply redundancy across the stack without an external RPS.
• Resilient wireless deployment which is a hierarchical deployment model using the mobility controller and mobility.

High-Performance IP Routing

• IP unicast routing protocols (Static, Routing Information Protocol Version 1 [RIPv1], and RIPv2, RIPng, EIGRP stub) are supported for small-network routing applications with IP Base feature set.
• Advanced IP unicast routing protocols (OSPF, EIGRP, BGPv4, and IS-ISv4) are supported for load balancing and constructing scalable LANs. IPv6 routing (OSPFv3, EIGRPv6) is supported in hardware for maximum performance. OSPF for routed access is included in the IP Base image. The IP Services feature set is required for full OSPF, EIGRP, BGPv4, and IS-ISv4.
• Equal-cost routing facilitates Layer 3 load balancing and redundancy across the stack.
• Policy-based routing (PBR) allows superior control by facilitating flow redirection regardless of the routing protocol configured. The IP Services feature set is required.
• Protocol Independent Multicast (PIM) for IP multicast routing is supported, including PIM sparse mode (PIM- SM), PIM dense mode (PIM-DM), PIM sparse-dense mode and Source Specific Multicast (SSM). The IP Services feature set is required.
• Virtual routing and forwarding (VRF)-Lite enables a service provider to support two or more VPNs, with overlapping IP addresses. IP Services feature set is required.
• IPv6 addressing is supported on interfaces with appropriate show commands for monitoring and troubleshooting.

Quality of Service

• Granular wireless bandwidth management to provide hierarchical bandwidth management at line rate. Policies can be configured at the AP, radio, SSID, and client levels.
• Approximate Fair Drop (AFD) to enable fair sharing across users within an SSID.
• Cross-stack QoS to enable QoS configuration across the entire stack.
• 802.1p class of service (CoS) and differentiated services code point (DSCP) field classification are provided, using marking and reclassification on a per-packet basis by source and destination IP address, MAC address, or Layer 4 TCP/UDP port number.
• Data-plane QoS ACLs on all ports to ensure proper marking on a per-packet basis.
• Eight egress queues per port for wired traffic and four egress queues for wireless to enable differentiated management of different traffic types across the stack for wired traffic.
• Shaped Round Robin (SRR) scheduling to ensure differential prioritization of packet flows.
• Weighted Tail Drop (WTD) to minimize congestion at the ingress and egress queues before a disruption occurs.
• Strict priority queuing to ensure that the highest-priority packets are serviced ahead of all other traffic.
• The Cisco committed information rate (CIR) function provides bandwidth in increments as low as 8 Kbps.
• Rate limiting based on source and destination IP address, source and destination MAC address, Layer 4 TCP/UDP information, or any combination of these fields, using QoS ACLs (IP ACLs or MAC ACLs), class maps, and policy maps.
• Up to 2000 aggregate policers available per switch.

Wireless Features

Table 9 is a detailed list of wireless features supported on the device.

.

Table 10 Client Types

Client Type and Name	Version
Laptop
Intel 4965	11.5.1.15 or 12.4.4.5, v13.4
Intel 5100/6300	v14.3.0.6
Intel 6205	v14.3.0.6
Dell 1395/1397	XP/Vista: 5.60.18.8 Win7: 5.30.21.0
Dell 1505/1510/Broadcom 4321MCAG/4322HM	5.60.18.8
Dell 1515 (Atheros)	8.0.0.239
Dell 1520/Broadcom 43224HMS	5.60.48.18
Dell 1530 (Broadcom BCM4359)	v5.100.235.12
Cisco CB21	v1.3.0.532
Atheros HB95	7.7.0.358
MacBook Pro (Broadcom)	5.10.91.26
Handheld Devices
Apple iPad	iOS 5.0.1
Apple iPad2	iOS 6.0.1
Apple iPad3	iOS 6.0.1
Samsung Galaxy Tab	Android 3.2
Intermec CK70	Windows Mobile 6.5 / 2.01.06.0355
Intermec CN50	Windows Mobile 6.1 / 2.01.06.0333
Symbol MC5590	Windows Mobile 6.5 / 3.00.0.0.051R
Symbol MC75	Windows Mobile 6.5 / 3.00.2.0.006R
Phones and Printers
Cisco 7921G	1.4.2.LOADS
Cisco 7925G	1.4.2.LOADS
Ascom i75	1.8.0
Spectralink 8030	119.081/131.030/132.030
Vocera B1000A	4.1.0.2817
Vocera B2000	4.0.0.345
Apple iPhone 4	iOS 6.0.1
Apple iPhone 4S	iOS 6.0.1
Apple iPhone 5	iOS 6.0.1
Ascom i62	2.5.7
HTC Sensation	Android 2.3.3
Samsung Galaxy S II	Android 2.3.3
SpectraLink 8450	3.0.2.6098/5.0.0.8774
Samsung Galaxy Nexus	Android 4.0.2

Open Caveats

• CSCua75283

The following tracebacks are noticed on normal setup:

DATACORRUPTION-1-DATAINCONSISTENCY: strstr_s: dmax exceeds max, -PC= 0x240BE60Cz

-Traceback= 190BA74z 182D4C8z 5E68CD5z 5E68B63z 55817EBz 55815D7z 558154Dz 5580E60z 5580444z 55802CAz

There is no workaround. There is no functional impact.

• CSCub21979

When a VLAN filter is configured on an RSPAN monitor session, duplicate packets are captured on the RSPAN destination port.

There is no workaround.

• CSCuc09296

Following a switchover in a four-member stack, full reconciliation of high availability (HA) services may be delayed by up to 15 seconds. The re-association of wireless clients is similarly delayed.

There is no workaround.

• CSCuc12774

When the Ethernet management port receives a frame whose destination MAC address is not FA1, it does not drop the traffic. Instead, the port uses the vrf mgmtVrf routing table to route the traffic back.

There is no workaround.

• CSCuc24608

When the NetFlow collector address for the Flow Exporter is configured in the VRF route table, flow records are exported to the same IP address in the global route table.

The workaround is to connect the NetFlow collector in the global route table instead of the VRF route table.

• CSCuc45552

IPV6 first-hop security does not work with EtherChannel.

• CSCuc50127

Layer 3 multicast traffic is not transmitted on a statically joined port after using the shutdown and no shutdown commands on an SVI.

The workaround is to unconfigure the static join and configure it again.

• CSCuc56470

When policy maps are PRE chained in conjunction with concurrent or sequential authentication sessions, events associated with each authentication method's chained policy are evaluated and executed instead of only those events associated with the method for which the session was authorized. For example, a policy specifies that sessions be authenticated using dot1x or mab, and upon success of either method, chain (attach) a child policy map. If both authentication methods succeed, the session, based on priority, is authorized with dot1x. Subsequent events are matched against both the MAB and dot1x chained policy maps instead of the dot1x chained policy map.

The workaround is to avoid using PRE chaining with concurrently authenticated sessions.

• CSCuc95293

In very rare cases, all traffic to and from the switch ceases; all access points and LAG links disconnect as the switchfails to transmit the LACP PDUs; however, the management interfaces function.

Run the sh platform punt statistics port-asic 0 cpuq -1 direction tx command to verify whether the suspend/unsuspend count is stuck for any of the transmission queues. Run the command several times to make sure that the suspend/unsuspend counters are no longer incrementing, and the TX suspend count = TX unsuspend count + 1. If you see this problem on any of the transmission queues, open a case with the TAC, or contact your Cisco technical support representative.

There is no workaround. Reboot the switch.

• CSCud03402

The following message may appear in the switch logs:

 

There is no workaround. There is no functional impact.

• CSCud11467

When the same PV HQOS policies are applied to both directions of an interface, the output policy stops working when the input policy is removed.

The workaround is to detach the output policy and reapply it to the interface.

• CSCud11552

After a HQOS policy is attached to interface and the interface speed or bandwidth is changed while the policy is attached, the HQOS policy gets detached from the interface.

The workaround is to detach the policy, change the bandwidth or speed of the interface, and reattach the policy.

• CSCud13091

When Layer 3 interfaces on the active switch in a switch stack are deleted and reapplied, the new member switch that joins the stack may reload.

The workaround is to reload the stack.

• CSCud13283

After a switchover, and a default to a Layer 3 interface, the CLI may not respond for several minutes.

There is no workaround.

• CSCud17361

After a switchover on a switch stack, the show interface status command displays the status of the Uplink SFP as unknown.

The workaround is to use the show inventory command on the interface.

• CSCud27939

When you update the power or channel on a four-member stack using the snmp set command, the operation fails on the standby switch, and the following error message is displayed:

There is no workaround.

• CSCud33835

When the switch stack is running in install mode and set to boot with the boot system switch all flash:packages.conf command, the show boot system command does not properly display the BOOT variable for the standby and member switches. The effect is only on the show commands; there is no effect on operations.

There is no workaround.

• CSCud40163

Rogue Location Discovery Protocol (RLDP) does not work when the AP is in local mode. This problem occurs when there is no WLAN configured in controller or monitor mode AP.

The workaround is to ensure that you configure one SSID on the controller when AP is in local mode. RLDP does not work when the AP is in monitor mode and there is no workaround.

• CSCud51031

The mac-address table is updated with BPDU SA from neighbor switch. This is a default behavior. The workaround is to use the test matm ctrl_pkt_lrn command in the enable mode to disable this feature.

• CSCud54501

The class video counters for the AP port policy appear as zero when you use the show policy-map interface wireless ap command.

There is no workaround.

• CSCud54725

When a class is removed from a queuing policy map that is attached to a wired port, the queue programming in the hardware is removed.

The workaround is to remove the policy from the port before making modifications.

• CSCud55333

When the incoming rate is far beyond the rate configured in a policy map through policing, the traffic is not properly shaped.

The workaround is to configure the policy map with priority level 1 percent and priority level 2 percent instead of configuring the policy with priority level x and policing.

• CSCud56426

When you modify the webauth virtual IP while there are active webauth sessions, the session stays in the pending-delete state and you cannot create a new session.

The workaround is to not make CLI changes when authorized webauth sessions are in use.

• CSCud60008

When a policy with priority and a policer is attached to a range of interfaces on an uplink, in some scenarios, any change made to the policer rate causes the policy to be unprogrammed on one or more ports.

The workaround is to remove the policy from the affected ports and reattach it.

• CSCud60070

When configuring policy maps using absolute values, the maximum rate is limited to 2G/second.

The workaround is to configure policy maps using the priority level 1 percent x command instead of configuring absolute values with the priority level 1 x command.

• CSCud62982

When policers are attached to uplink interfaces using the range command, the policers do not always work.

The workaround is to attach the policy to each port, one by one.

• CSCud63110

In a hierarchical queueing policy, a table map under the child policy continues to mark traffic after the policy is detached from an interface.

The workaround is to attach a default policy, for example:

 

You then detach it.

• CSCud63823

After a queuing policy is deleted from one uplink port (10 G), the queueing policy on the other 1-G uplink stops working.

The workaround is to detach the policy and reattach it.

• CSCud65034

When using hierarchical policies, the child classification does not work properly when its matching value is a subset of the parent class's matching values for COS, DSCP, UP, and PREC classes.

The workaround is to configure hierarchical policies to achieve one of these results:

– The parent user-defined class is match vlan.

– The parent class has only class-default and the child class has user-defined classes.

– The parent class has user-defined classes and the child has only class-default.

• CSCud68142

When the standby switch in a switch stack is reloaded and added back to the stack as a member, sometimes the Feature Forwarding Manager (FFM) process fails, causing a reload. This problem occurs in configurations with a combination of Layer-3 routing, PBR and ACL features.

There is no workaround.

• CSCud71747

The snmp get command on cLMobilityExtMoMcLinkStatus for a given mobility controller (MC) and on cLMobilityExtMcAssocTime for a given mobility controller's client returns incorrect values.

The workaround is to use the following commands:

– show wireless mobility oracle summary to display the link status between the mobility oracle and the mobility controller

– show wireless mobility controller client summary to display the client association time.

• CSCud72626

After a per-VLAN policy is removed from a port, the policer stays active. The VLAN has an SVI with a policy attached that is performing a set.

The workaround is to remove the policy from the SVI before removing it from the port.

• CSCud84240

You cannot apply both IPv6 and IPv4 ACLs to an snmp-server group.

The workaround is to use the snmp-server user command instead.

• CSCud90586

During a configuration synchronization, the passwd key zeroize command can cause the standby switch in the stack to stop functioning.

The workaround is to remove the passwd key zeroize command from the configuration and use the
crypto key zeroize rsa command instead.

• CSCuf86171

The DHCP snooping database agent fails to start while changing the DNS entry that the URL pointed to or when restarting the DHCP server. To avoid this issue, use another file transport mechanism like SCP or TFTP.

The workaround is to reload the switch.

• CSCuf93185

When a 1-G port on a Catalyst 3850 switch is connected to a 10-G port on a 5760 controller with a 1-G SFP module, the 10-G controller port stays up even when the switch port is shut down.

There is no workaround.

• CSCug29756

The show power inline command does not accurately reflect changes to the amount of available power.

There is no workaround. There is no functional impact.

• CSCug38523

In WebUI, it takes up to 10 to 15 seconds for the home page to load.

There is no workaround.

• CSCug41165

If you copy and paste several wireless configuration lines into the configuration, the system drops the first few characters from every other line. The number of characters dropped appears to be related to how long the command takes to execute. The issue does not occur on non-wireless configuration lines.

The workaround is to copy and paste line by line.

• CSCug58178

Multicast traffic travels on the WLAN-mapped VLAN rather than on the AP-group mapped VLAN when an AP is placed in an AP group where VLAN is overridden for the SSID and a client associates with the AP that is broadcasting this SSID.

There is no workaround.

• CSCuh17479

In a switch stack, the Wireless Control Module (WCM) on the active switch stops working due to high CPU usage.

There is no workaround.

• CSCuh20848

The console displays %IPC-5-WATERMARK log messages repeatedly.

There is no workaround. There is no functional impact.

• CSCuh25601

ARP traffic is occasionally dropped. The ARP loss corresponds with buffer counter under “failures” incrementing in the output of show platform punt client.

If IP device tracking is not required and neither dot1x or DAI is used, then the workaround is to add the nmsp attachment suppress command at the interface level of all switchports. This stops ARP snooping from being enabled on the ports.

• CSCuh44542

When voice and data clients are authorized in multi authentication mode and the host-mode is subsequently changed to multi-domain authentication (MDA) mode, the switch unexpectedly reboots.

There is no workaround.

• CSCuh66931

In a switch stack, a member switch stops working due to a loop with the NGWC Learning Process. This loop can occur when multiple MAC addresses flap between ports, for example, after a wired to wireless MAC move.

There is no workaround.

• CSCui51050

Stack port change messages are not properly trapped and displayed with the SNMP trap snmp-server enable traps stackwise.

The workaround is to configure an EEM script to pull the correct OID. For example:

• CSCui57827

When a fiber interface is configured with the default configuration, the following error message is displayed:

and the interface is placed in the error-disabled state.

The workaround is to configure the interface with the no keepalive command.

• CSCui59004

When the Network Time Protocol (NTP) configuration is removed from the switch, the Cisco IOS software unexpectedly halts.

There is no workaround.

• CSCui84215

A WLAN configured to authenticate users with the local webauth method uses the default network authorization method instead of the configured network authorization method. For example, with this global configuration:

 

and this WLAN configuration:

 

authentication goes through the RADIUS server and not through local authentication.

The workaround is to use the aaa authorization network default local command to configure the default network authorization method as local.

Resolved Caveats

Caveats Resolved in Cisco IOS XE Release 3.2.3SE

Caveats Resolved in Cisco IOS XE Release 3.2.2SE

Caveats Resolved in Cisco IOS XE Release 3.2.1SE

Caveats Resolved in Cisco IOS XE Release 3.2.3SE

• CSCtu10646

Inconsistencies are displayed or the switch unexpectedly resets when you try to remove an existing password from the console or a VTY (telnet port). Use the show running | be line command to verify. This problem occurs while the switch is used in a stack.

The workaround is to avoid using a login password for VTY lines and minimize password configuration changes; the use of AAA for login is recommended. If you need to make password configuration changes, ensure that you save the configuration in a standalone switch, and then include the switch in the stack.

Here is an example of AAA configuration using local username and password:

• CSCud06451

During many simultaneous dot1x authentication operations, sessions may time out and fail to correctly authenticate. The console will continuously report authorization and authentication messages.

There is no workaround.

• CSCue93229

The router crashes when polling ipMRouteEntry while executing the clear ip mroute command.

The workaround is to not query ipMRouteEntry and use the clear ip mroute command at the same time.

• CSCuf77489

The switch can crash when there are concurrent sessions and you try remove an existing password from the console or VTY. Various inconsistencies can be seen in the running configuration that can result in a crash.

The workaround is to minimize configuration changes to the password, and to use a standalone switch when making such changes.

• CSCug34943

The switch fails to create extended VLANs on a 9-member switch stack.

There is no workaround.

• CSCug75799

All wireless clients become stuck in idle state. Once idle, the clients cannot reconnect to the wireless network. New clients can connect, but will become idle on disconnect.

The workaround is to reload the affected device or stack and upgrade to release 3.3.0(SE) or greater.

• CSCug80708

A port channel is in the “not connect” status when BPDU packets are received.

There is no workaround.

• CSCug83616

When sending traffic from two IXIA ports, the switch packet counter (InUcastPkts and OutUcastPkts) frame value is displayed incorrectly.

There is no workaround.

• CSCug84023

Active to backup conversion of FlexLink is slow when the network module C3850-NM-2-10G is used.

There is no workaround.

• CSCug87540

Layer 3 traffic routed on one switch or stack member fails for newly added devices.

There is no direct workaround. Reload the impacted switch to recover.

• CSCug90789

When the internal process takes more than 3 seconds to process the mobility state change request, the client can be stuck in local state on the foreign switch. As a result, traffic is not forwarded through the anchor; instead, traffic is forwarded through the foreign switch.

There is no workaround.

• CSCuh08087

You cannot use a Microsoft NLB deployment to assign a static ARP entry to a non-IPv4 multicast MAC address.

There is no workaround.

• CSCuh09405

When multiple activities such as the following are running in parallel, the switch may unexpectedly reboot.

– multiple SSH sessions

– multiple Telnet sessions

– several invalid logins

– multiple show-tech CLI commands executed

There is no workaround.

• CSCuh09941

There is an QoS ACL matching issue when multiple classes match in the ACL range.

The workaround is to remove auto qos voip cisco-softphone from all attaching interfaces and then reattach the policy.

• CSCuh93075

BW of the show interfaces port-channel privileged EXEC command does not display correctly.

There is no workaround.

• CSCui05366

The standby switch in a stack of Catalyst 3850 switches fails to boot up when the speed nonegotiate command is configured on an interface and a switch is either reset, or powered up after the command is configured. This may cause all the member switches to reset.

The workaround is to remove speed nonegotiate from all interfaces using the no speed nonegotiate command, or to use the redundancy config-sync ignore mismatched privileged EXEC commands.

• CSCui12946

Some WS-C3850-48T-S switches do not recognize GLC-T SFPs in the uplink module.

The workaround is to use a downlink 1 Gbps copper port.

• CSCui21897

Output sensor 1 or HotSpot sensor 2 has an incorrect yellow threshold. This can cause intermittent false SNMP alarms on the SNMP server. New threshold values are set to address the issue.

There is no workaround.

• CSCui23050

The external webauth page redirect stops working after some time.

The workaround is to reboot the system.

• CSCui25555

When a switch port detects a false short it never recovers to power an IEEE PD. This happens when a PoE port is connected to a PC that has no power and the cable is moved to connect IEEE PD devices.

There are two workarounds. The first is to use the shutdown and no shutdown commands to restart the port. The second workaround is to connect the port to a powered on non-PD (like a PC) and wait for the link up. After removing the non-PD link, the port regains the PD detection capability. Then connect the port to the desired PD to get power.

• CSCui36124

The input queue size counter may exceed the maximum defined threshold of 10, and does not increment any drops.

There is no workaround.

• CSCui38959

A Catalyst 3850 stack produces an FCS-Err on some ports. The counter is either 18446744073709551614 or 18446744073709551615.

The show interface command does not show any CRC errors and functionality is not affected.

The workaround is to bounce the interface to reset the counter to zero.

• CSCui39507

One switch in a stack of three Catalyst 3850 switches reboots randomly when QoS is enabled.

There is no workaround.

• CSCui40588

After a TACACS authentication, the wireless GUI is not available on the switch.

The workaround is to use CLI interface (Telnet, Console, SSH) and configure the device.

• CSCui47662

Segmentation fault crash in process cpf_msg_rcvq_process.

There is no workaround.

• CSCuj48089

The broadcast queue can become stuck and the switch drops all packets destined to that queue.

The workaround is to reload the switch. In the case of ARP traffic, you can re-enable NMSP using the no nmsp attachment suppress command to enable ARP traffic to be processed.

Caveats Resolved in Cisco IOS XE Release 3.2.2SE

• CSCud35278

The results of the snmp get command entered on the SNMP MIB bsnMobileStationRssiData from bsnMobileStationRssiDataTableon are incorrect.

The workaround is to use one of the following commands in the AP console:

show wireless client mac-address mac_address detail

show controller

• CSCud36670

The ranges for cLQd11aRadioMaxStreams/cLQd11bRadioMaxStreams and cLQd11aClientMaxStreams/cLQd11aClientMaxStreams do not start at 0. This situation occurs when you perform an snmp set on cLQd11aRadioMaxStreams or cLQd11bRadioMaxStreams under cLQd11aCACConfig. The same situation exists for a Radio type.

There is no workaround.

• CSCud37684

The switch stack fails to generate a system report log when reloaded.

The workaround is to manually delete older system reports in the crashinfo partition.

• CSCud47308

In a four-member stack, large IPv6 RACLs are attached to an ingress port and QoS with policy rate is attached to egress port. When a change is made to the QoS policy map, the switch member unexpectedly reloads.

There is no workaround.

• CSCud51806

After reloading a member switch, the NetFlow configuration previously applied to an interface does not work.

The workaround is to remove the NetFlow configuration from the interface and apply it again.

• CSCud53860

The snmp get command returns an incorrect value on bsnMobileStationWepState from bsnMobileStationTable.

The workaround is to use the show wlan name profile-name command.

• CSCud57372

After a roam operation, when you enter the show policy command, the police-conformed rate state under a child policy is displayed incorrectly.

There is no workaround.

• CSCud60212

When LoopGuard is enabled globally, the edge access ports that do not have PortFast configured are moved to a blocking state due to loop inconsistency. This problem occurs when edge ports configured as Layer 2 ports without PortFast perform a switchover.

The workaround is to enable PortFast on Layer 2 edge ports if LoopGuard is enabled.

• CSCud61298

After a switchover on a switch stack running Rapid-PVST in which the root port goes down as part the switchover, uplink connectivity is lost.

The workaround is to use the shutdown command followed by the no shutdown command to enable the new root port. Another option is to configure the root port as a Layer 2 port channel so that it will not go down as part of the switchover.

• CSCud68770

When you perform a continuous SNMPWALK on the table's attributes, the output is inconsistent.

When you perform a set on the cLD11ClientCalibTable, SNMPWALK gives the correct data for the first few minutes and then it does not return any data.

There is no workaround.

• CSCud68775

When you hotswap an FRU or hotswap a 10-G SFP with a 1-G SFP, uplink port traffic fails. In a standalone WS-3850 or a stack of WS-3850 switches, the following operations do not work:

– Inserting a FRU for the first time when the switch is already in READY state

– Replacing a FRU with another type of FRU

– Replacing a 1-G SFP with a 10-G SFP or a 10-G SFP with a 1-G SFP on a FRU that supports
10-G interfaces.

The workaround for the first two scenarios is to reload the switch where the FRU uplink was inserted or swapped. The workaround for the third scenario is to use the clear errdisable interface interface recover-uplink on the uplink where SFP module was inserted or swapped.

• CSCud84381

The options under the errdisable recovery cause ? command are located on the right side of the display.

There is no workaround.

• CSCud84155

When wireless clients use downloadable ACLs with multiple RADIUS servers configured to authenticate clients, the switch reloads.

The workaround is to use the named ACL with Filter-ID instead of downloadable ACLs when there are multiple RADIUS servers in the network.

• CSCud86601

When the standby switch and a member switch are being reloaded while the active switch is up and running, the Table_manager process on the active switch fails, causing a reload.

There is no workaround.

• CSCud88468

When the startup configuration has the exception dump device second usbflash0: command configured and the stack undergoes a staggered boot, the standby switch is reset due to a bulk synchronization failure.

The workaround is to boot all switches simultaneously. Another workaround is to remove the exception dump device command from the configuration and after all the switches are up and running, add the exception dump device second usbflash0: command to the configuration.

• CSCud88714

When a nonhierarchical policy is installed on SSID output and when you try to overwrite it with a new policy which is in a hierarchical format, the policy change fails. This problem occurs only when a nonhierarchical policy is overwritten with a hierarchical policy.

The workaround is to unconfigure the existing policy and apply the new policy.

• CSCud93812

With an emergency install, the timestamp for the installed package files and the conf file is set to Dec 31 1969.

• CSCud93998

After a switchover, when 500 or more clients are trying to join, a few clients do not reassociate.

The workaround is to manually reassociate the failed clients.

• CSCud94109

If a client is roaming from Mobility Agent (MA) to Mobility Controller (MC) and joins another MA in a different peer group before complete authentication to MC, and then tries to rejoin to MC, the client entry cannot be deleted from the database. The client will not be able to join on the AP connected to MC but can join anywhere else in the network.

The workaround is to use the test platform llm clear-database client_mac_address true command to remove the client entry on MC.

• CSCue44402

The switch displays the following message:

There is no workaround.

• CSCue55762

The switch crashes after about 200 days of uptime.

There is no workaround

• CSCuf49309

When UDLD aggressive is configured between two switches and the send port ID and receive port IDs are the same, UDLD detects an error.

The workaround is to use a different port ID when connecting two switches with a fiber cable.

• CSCuf89784

When you apply auto qos trust on a port on one of the expansion modules of a non-active switch in a switch stack, errors are displayed.

There is no workaround.

• CSCug23120

The show environment power all command randomly displays a power supply failure message and displays the wattage is displayed incorrectly as 235 W.

There is no workaround.

• CSCug29704

The Layer 2 or Layer 3 path is breaks, all SNMP packets are dropped, or all wireless clients are idle.

The workaround is to reload the affected member switch and restore service.

• CSCug52183

When significant traffic (~ 4 billion packets) has traversed the CPU, the switch reloads unexpectedly. Depending on the control traffic pattern, it can take days or weeks for CPU-bound traffic to reach 4 billion. To check for this condition use the
show platform punt stat port-asic 0 cpuq -1 direction rx command.

There is no workaround.

• CSCug65693

A Macbook client bug causes connectivity problems with a recent OS X update. This problem is triggered by the client sending an out of sequence packet.

The workaround is to disable A-MPDU.

• CSCug85580

When the auto qos voip cisco-phone command is applied to a port, data traffic over 10 (or 20) Mb/s is dropped at ingress ports.

The workaround is to remove the policer from the following class-map policy:

Service-policy input: AutoQos-4.0-CiscoPhone-Input-Policy

Class AutoQos-4.0-Default-Class

set dscp default

police cir 10000000 bc 8000 be 8000

conform-action transmit

exceed-action set-dscp-transmit dscp table policed-dscp

violate-action drop

• CSCug87904

Auto QoS policy maps, class maps, and access lists are incorrectly generated in Cisco IOS XE Release 3.2.0 and 3.2.1. If you are upgrading your system from Cisco IOS XE Release 3.2.1 or eariler, to Cisco IOS XE Release 3.2.2 or later, refer to the “Upgrading the Switch Software” section.

• CSCuh10007

Phones that are connected to the switch does not register or get an IP address.

There is no workaround.

• CSCuh21506

When the switch is in VTP client mode, all broadcast traffic is blocked for a given VLAN when a vtp prune event is immediately followed by a re-join event. ARP does not complete and consequently MAC addresses on upstream devices are not learned.

The workaround is to set the VTP mode to transparent.

Caveats Resolved in Cisco IOS XE Release 3.2.1SE

• CSCue76684

In certain boot sequences, the BOOT variable is removed from the switch. At the next reboot attempt, the reboot fails, and the switch remains in the bootloader prompt.

The workaround is to:

– Boot the switch with boot flash:file_name command.

or

– Set the BOOT variable explicitly in the bootloader using BOOT=flash: file_name and, then boot the switch using boot command.

Catalyst 3850 Switch Hardware Installation Guide

Product Overview

• The hardware installation guide erroneously describes Cisco Expandable Power System (XPS) 2200 support. XPS 2200 is not supported in this release.
• This note was added to the “Front Panel and LEDs” section:

---

Note The Catalyst 3850 switches might have slight cosmetic differences on the bezels.

Switch Installation

• The rack-mounting bracket number shown in Figure 2-11 is incorrect. The correct number for the rack-mounting bracket is C3850-RACK-KIT.

Power Supply Installation

• The dual-hole ground lug is optional and is not included with the switch.

Switch Models

• “Table 1: Catalyst 3850 Switch Models” is incomplete. The following should be included:

 

Network Modules

• The description of the network module is incorrect. It should read:

C3850-NM-2-10G

Four-slot SFP module: Two slots (left side) support only 1-Gigabit SFP modules and two slots (right side) support either 1-Gigabit SFP or 10-Gigabit SFP modules. Supported combinations of SFP and SFP+ modules: Slots 1, 2, 3, and 4 populated with 1-Gigabit SFP modules. Slots 1 and 2 populated with 1-Gigabit SFP modules and Slot 3 and 4 populated with 10-Gigabit SFP+ module.

SFP and SFP+ Modules

• The list of SFP modules supported on Catalyst 3850 switches is incomplete. It should include the SFP-GE-Z module.

Technical Specifications

• The dimension for the depth of the switch is incorrect. The correct dimension is 17.5 inches.
• The dimension for the height of the power supply is incorrect. The correct dimension is 1.58 inches.
• The note associated with the power supply dimension information should read:

Dimensions shown exclude the extraction handle, which measures 1.55 in. (3.9 cm) and the keying feature which measures 0.44 in (1.1 cm).

Catalyst 3850 Switch Getting Started Guide

• In the “Running Express Setup” section, Step 8 contains an error. It should read:

Step 8

Start a browser session on the PC, and enter the IP address https://10.0.0.1. When prompted, enter the default password, cisco. Note: The switch ignores text in the username field. Troubleshooting: If the Express Setup window does not appear, make sure that any browser pop-up blockers or proxy settings are disabled and that any wireless client is disabled on your PC or laptop.

• In the “Running Express Setup” section, Step 11 erroneously implies that you need to enable IPv6. IPv6 is enabled by default.

System Management Configuration Guide, Cisco IOS XE Release 3SE (Catalyst 3850 Switches)

Configuring Fast SSID Changing

When the client sends a new association for a different SSID and fast SSID changing is disabled, the client entry in the controller connection table is cleared before the client is added to the new SSID. This means that the controller enforces a delay before clients are allowed to move to a new SSID. When fast SSID changing is enabled, there is no delay, and clients move more quickly from one SSID to another.

Beginning in privileged EXEC mode, follow these steps to configure fast SSID changing:

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2013 Cisco Systems, Inc. All rights reserved.