Release Note for the Cisco ME 4900 Series Ethernet Switch, Cisco IOS Release 12.2(54)SGx and 12.2(53)SGx
Available Languages
Table of Contents
Cisco IOS Software Packaging for the Cisco ME 4900 Series Ethernet Switch
Cisco ME 4900 Series Ethernet Switch Cisco IOS Release Strategy
New Hardware Features in Release12.2(54)SG
New Software Features in Release12.2(54)SG
New Hardware Features in Release 12.2(53)SG3
New Software Features in Release12.2(53)SG3
New Hardware Features in Release12.2(53)SG
New Software Features in Release12.2(53)SG
New Hardware Features in Release12.2(52)SG
New Software Features in Release12.2(52)SG
New Hardware Features in Release 12.2(50)SG1
New Software Features in Release12.2(50)SG1
New Hardware Features in Release12.2(50)SG
New Software Features in Release12.2(50)SG
New Hardware Features in Release12.2(46)SG
New Software Features in Release12.2(46)SG
New Hardware Features in Release12.2(44)SG
New Software Features in Release12.2(44)SG
New Hardware Features in Release12.2(40)SG
New Software Features in Release12.2(40)SG
New Hardware Features in Release12.2(37)SG
New Software Features in Release12.2(37)SG
New Hardware Features in Release12.2(31)SGA
New Software Features in Release12.2(31)SGA
Upgrading the ROMMON from the Console
Upgrading the ROMMON Remotely Using Telnet
Upgrading the Cisco IOS Software
Open Caveats in Cisco IOS Release 12.2(54)SG1
Resolved Caveats in Cisco IOS Release 12.2(54)SG1
Open Caveats in Cisco IOS Release 12.2(54)SG
Resolved Caveats in Cisco IOS Release 12.2(54)SG
Open Caveats in Cisco IOS Release 12.2(53)SG11
Resolved Caveats in Cisco IOS Release 12.2(53)SG11
Open Caveats in Cisco IOS Release 12.2(53)SG10
Resolved Caveats in Cisco IOS Release 12.2(53)SG10
Open Caveats in Cisco IOS Release 12.2(53)SG9
Resolved Caveats in Cisco IOS Release 12.2(53)SG9
Open Caveats in Cisco IOS Release 12.2(53)SG8
Resolved Caveats in Cisco IOS Release 12.2(53)SG8
Open Caveats in Cisco IOS Release 12.2(53)SG7
Resolved Caveats in Cisco IOS Release 12.2(53)SG7
Open Caveats in Cisco IOS Release 12.2(53)SG6
Resolved Caveats in Cisco IOS Release 12.2(53)SG6
Open Caveats in Cisco IOS Release 12.2(53)SG5
Resolved Caveats in Cisco IOS Release 12.2(53)SG5
Open Caveats in Cisco IOS Release 12.2(53)SG4
Resolved Caveats in Cisco IOS Release 12.2(53)SG4
Open Caveats in Cisco IOS Release 12.2(53)SG3
Resolved Caveats in Cisco IOS Release 12.2(53)SG3
Open Caveats in Cisco IOS Release 12.2(53)SG2
Resolved Caveats in Cisco IOS Release 12.2(53)SG2
Open Caveats in Cisco IOS Release 12.2(53)SG1
Resolved Caveats in Cisco IOS Release 12.2(53)SG1
Open Caveats in Cisco IOS Release 12.2(53)SG
Resolved Caveats in Cisco IOS Release 12.2(53)SG
Open Caveats in Cisco IOS Release 12.2(52)SG
Resolved Caveats in Cisco IOS Release 12.2(52)SG
Open Caveats in Cisco IOS Release 12.2(50)SG8
Resolved Caveats in Cisco IOS Release 12.2(50)SG8
Open Caveats in Cisco IOS Release 12.2(50)SG7
Resolved Caveats in Cisco IOS Release 12.2(50)SG7
Open Caveats in Cisco IOS Release 12.2(50)SG6
Resolved Caveats in Cisco IOS Release 12.2(50)SG6
Open Caveats in Cisco IOS Release 12.2(50)SG4
Resolved Caveats in Cisco IOS Release 12.2(50)SG4
Open Caveats in Cisco IOS Release 12.2(50)SG2
Resolved Caveats in Cisco IOS Release 12.2(50)SG2
Open Caveats in Cisco IOS Release 12.2(50)SG1
Resolved Caveats in Cisco IOS Release 12.2(50)SG1
Open Caveats in Cisco IOS Release 12.2(50)SG
Resolved Caveats in Cisco IOS Release 12.2(50)SG
Open Caveats in Cisco IOS Release 12.2(46)SG
Resolved Caveats in Cisco IOS Release 12.2(46)SG
Open Caveats in Cisco IOS Release 12.2(44)SG1
Resolved Caveats in Cisco IOS Release 12.2(44)SG1
Open Caveats in Cisco IOS Release 12.2(44)SG
Resolved Caveats in Cisco IOS Release 12.2(44)SG
Open Caveats in Cisco IOS Release 12.2(40)SG
Resolved Caveats in Cisco IOS Release 12.2(40)SG
Open Caveats in Cisco IOS Release 12.2(37)SG1
Resolved Caveats in Cisco IOS Release 12.2(37)SG1
Open Caveats in Cisco IOS Release 12.2(37)SG
Resolved Caveats in Cisco IOS Release 12.2(37)SG
Open Caveats in Cisco IOS Release 12.2(31)SGA11
Resolved Caveats in Cisco IOS Release 12.2(31)SGA11
Open Caveats in Cisco IOS Release 12.2(31)SGA10
Resolved Caveats in Cisco IOS Release 12.2(31)SGA10
Open Caveats in Cisco IOS Release 12.2(31)SGA9
Resolved Caveats in Cisco IOS Release 12.2(31)SGA9
Open Caveats in Cisco IOS Release 12.2(31)SGA8
Resolved Caveats in Cisco IOS Release 12.2(31)SGA8
Open Caveats in Cisco IOS Release 12.2(31)SGA7
Resolved Caveats in Cisco IOS Release 12.2(31)SGA7
Open Caveats in Cisco IOS Release 12.2(31)SGA6
Resolved Caveats in Cisco IOS Release 12.2(31)SGA6
Open Caveats in Cisco IOS Release 12.2(31)SGA5
Resolved Caveats in Cisco IOS Release 12.2(31)SGA5
Open Caveats in Cisco IOS Release 12.2(31)SGA4
Resolved Caveats in Cisco IOS Release 12.2(31)SGA4
Open Caveats in Cisco IOS Release 12.2(31)SGA3
Resolved Caveats in Cisco IOS Release 12.2(31)SGA3
Open Caveats in Cisco IOS Release 12.2(31)SGA2
Resolved Caveats in Cisco IOS Release 12.2(31)SGA2
Open Caveats in Cisco IOS Release 12.2(31)SGA1
Resolved Caveats in Cisco IOS Release 12.2(31)SGA1
Open Caveats in Cisco IOS Release 12.2(31)SGA
Troubleshooting at the System Level
Obtaining Documentation and Submitting a Service Request
Release Notes for the
Cisco ME 4900 Series Ethernet Switch, Cisco IOS Release 12.2(54)SGx and 12.2)53)SGx
Current Release
12.2(53)SG11—August 18, 2014Previous Releases
12.2(54)SG1, 12.2(54)SG, 12.2(53)SG10, 12.2(53)SG9, 12.2(53)SG8, 12.2(53)SG7, 12.2(53)SG6, 12.2(53)SG5, 12.2(53)SG4, 12.2(53)SG3, 12.2(53)SG2, 12.2(53)SG1, 12.2(53)SG, 12.2(52)SG, 12.2(50)SG8, 12.2(50)SG7, 12.2(50)SG6, 12.2(50)SG4, 12.2(50)SG2, 12.2(50)SG1, 12.2(50)SG, 12.2(46)SG, 12.2(44)SG1, 12.2(44)SG, 12.2(40)SG, 12.2(37)SG1, 12.2(37)SG, 12.2(31)SGA11, 12.2(31)SGA10, 12.2(31)SGA9, 12.2(31)SGA8, 12.2(31)SGA7, 12.2(31)SGA6, 12.2(31)SGA5, 12.2(31)SGA4, 1.2(31)SGA3, 12.2(31)SGA2, 12.2(31)SGA1, and 12.2(31)SGAThese release notes describe the features, modifications, and caveats for the Cisco IOS software on the Cisco ME 4900 Series Ethernet Switch. The software release is Cisco IOS Release 12.2(54)SG.
Support for Cisco IOS Software Release 12.2(54)SG, the default image, follows the standard Cisco Systems® support policy, available at
http://www.cisco.com/en/US/products/products_end-of-life_policy.html
Note
Although their Release Notes are unique, the 4 platforms (Catalyst 4500, Catalyst 4900,
Catalyst ME 4900, and Catalyst 4900M/4948E) use the same Software Configuration Guide, Command Reference Guide, and System Message Guide.
For more information on the Catalyst 4500 series switches, visit the following URL:
http://www.cisco.com/go/cat4500/docsContents
This publication consists of these sections:
- Cisco IOS Software Packaging for the Cisco ME 4900 Series Ethernet Switch
- Cisco ME 4900 Series Ethernet Switch Cisco IOS Release Strategy
- System Requirements
- New Information
- Upgrading the System Software
- Limitations and Restrictions
- Caveats
- Troubleshooting
- Related Documentation
- Notices
- Obtaining Documentation and Submitting a Service Request
Cisco IOS Software Packaging for the
Cisco ME 4900 Series Ethernet SwitchThe 12.2SG Cisco IOS software release train supports the Enterprise Services and IP Base images on the ME 4900 switch. All currently shipping Cisco Catalyst ME 4900 software features based on Cisco IOS Software are supported in the IP Base image of Release 12.2(50)SG with a few exceptions.
The IP Base image does not support enhanced routing features such as Nonstop Forwarding/Stateful Switchover (NSF/SSO), BGP, Enhanced Interior Gateway Routing Protocol (EIGRP), Open Shortest Path First (OSPF), Intermediate System-to-Intermediate System (IS-IS), Internetwork Packet Exchange (IPX), AppleTalk, Virtual Routing Forwarding (VRF-lite), GLBP, and policy-based routing (PBR). The IP Base image supports EIGRP-Stub for limited routing on Cisco Catalyst ME 4900 Series Switches.
Except for PBR, the Enterprise Services image supports all Cisco Catalyst ME 4900 Series software features based on Cisco IOS Software, including enhanced routing. BGP capability is included in the Enterprises Services package.
- S49LB-12254SG(=)—Cisco IOS Software for Cisco Catalyst 4900 Series Switch (LAN Base image)
- S49LBK9-12254SG(=)—Cisco IOS Software for Cisco Catalyst 4900 Series Switch (LAN Base image with Triple Data Encryption)
- S49IPB-12254SG(=)—Cisco IOS Software for Cisco Catalyst 4900 Series Switch (IP Base image)
- S49IPBK9-12254SG(=)—Cisco IOS Software for Cisco Catalyst 4900 Series Switch (IP Base image with Triple Data Encryption)
- S49ES-12254SG(=)— Cisco IOS Software for Cisco Catalyst 4900 Series Switch (Enterprise Services image with BGP support)
- S49ESK9-12254SG(=)—Cisco IOS Software for Cisco Catalyst 4900 Series Switch (Enterprise Services image with 3DES and BGP support)
- S49IPB-12253SG - Cisco IOS Software for Cisco Catalyst ME 4900 Series Switches (IP Base image)
- S49IPBK9-12253SG - Cisco IOS Software for Cisco Catalyst ME 4900 Series Switches (IP Base image with 3DES)
- S49ES-12253SG - Cisco IOS Software for Cisco Catalyst ME 4900 Series Switches (Enterprise Services image with BGP support)
- S49ESK9-12253SG - Cisco IOS Software for Cisco Catalyst ME 4900 Series Switches (Enterprise Services image with 3DES and BGP support)
- S49LB-12253SG - Cisco IOS Software for Cisco Catalyst 4900 Series Switches (LAN Base image)
- S49LBK9-12253SG - Cisco IOS Software for Cisco Catalyst 4900 Series Switches (LAN Base image with 3DES)
- S49IPB-12252SG—Cisco IOS software for the Catalyst 4900 Series (IP Base image) (cat4500-ipbase-mz)
- S49IPBK9-12252SG—Cisco IOS software for the Catalyst 4900 Series (IP Base image with Triple Data Encryption Standard (3DES)) (cat4500-ipbasek9-mz)
- S49ES-12252SG—Cisco IOS software for the Catalyst 4900 Series (Enterprise Services image with BGP support) (cat4500-entservices-mz)
- S49ESK9-12252SG—Cisco IOS software for the Catalyst 4900 Series (Enterprise Services image with 3DES and BGP) (cat4500-entservicesk9-mz)
- S49IPB-12250SG—Cisco IOS software for the Catalyst ME 4900 Series (IP Base image) (cat4500-ipbase-mz)
- S49IPBK9-12250SG—Cisco IOS software for the Catalyst ME 4900 Series (IP Base image with Triple Data Encryption Standard (3DES)) (cat4500-ipbasek9-mz)
- S49ES-12250SG—Cisco IOS software for the Catalyst ME 4900 Series (Enterprise Services image with BGP support) (cat4500-entservices-mz)
- S49ESK9-12250SG—Cisco IOS software for the Catalyst ME 4900 Series (Enterprise Services image with 3DES and BGP) (cat4500-entservicesk9-mz)
- S49IPB-12246SG—Cisco IOS software for the Catalyst ME 4900 Series (IP Base image) (cat4500-ipbase-mz)
- S49IPBK9-12246SG—Cisco IOS software for the Catalyst ME 4900 Series (IP Base image with Triple Data Encryption Standard (3DES)) (cat4500-ipbasek9-mz)
- S49ES-12246SG—Cisco IOS software for the Catalyst ME 4900 Series (Enterprise Services image with BGP support) (cat4500-entservices-mz)
- S49ESK9-12246SG—Cisco IOS software for the Catalyst ME 4900 Series (Enterprise Services image with 3DES and BGP) (cat4500-entservicesk9-mz)
- S49IPB-12244SG—Cisco IOS software for the Catalyst ME 4900 Series (IP Base image) (cat4500-ipbase-mz)
- S49IPBK9-12244SG—Cisco IOS software for the Catalyst ME 4900 Series (IP Base image with Triple Data Encryption Standard (3DES)) (cat4500-ipbasek9-mz)
- S49ES-12244SG—Cisco IOS software for the Catalyst ME 4900 Series (Enterprise Services image with BGP support) (cat4500-entservices-mz)
- S49ESK9-12244SG—Cisco IOS software for the Catalyst ME 4900 Series (Enterprise Services image with 3DES and BGP) (cat4500-entservicesk9-mz)
- S49IPB-12240SG—Cisco IOS software for the Catalyst ME 4900 Series (IP Base image) (cat4500-ipbase-mz)
- S49IPBK9-12240SG—Cisco IOS software for the Catalyst ME 4900 Series (IP Base image with Triple Data Encryption Standard (3DES)) (cat4500-ipbasek9-mz)
- S49ES-12240SG—Cisco IOS software for the Catalyst ME 4900 Series (Enterprise Services image with BGP support) (cat4500-entservices-mz)
- S49ESK9-12240SG—Cisco IOS software for the Catalyst ME 4900 Series (Enterprise Services image with 3DES and BGP) (cat4500-entservicesk9-mz)
- S49IPB-12237SG—Cisco IOS software for the Cisco ME 4900 Series Ethernet Switch (IP Base image) (cat4500-ipbase-mz)
- S49IPBK9-12237SG—Cisco IOS software for the Cisco ME 4900 Series Ethernet Switch (IP Base image with Triple Data Encryption Standard (3DES)) (cat4500-ipbasek9-mz)
- S49ES-12237SG—Cisco IOS software for the Cisco ME 4900 Series Ethernet Switch (Enterprise Services image with BGP) (cat4500-entservices-mz)
- S49ESK9-12237SG—Cisco IOS software for the Cisco ME 4900 Series Ethernet Switch (Enterprise Services image with 3DES and BGP) (cat4500-entservicesk9-mz)
Cisco ME 4900 Series Ethernet Switch
Cisco IOS Release StrategyCustomers with Catalyst ME 4900 series switches who need the latest hardware support and software features should migrate to Cisco IOS Release 12.2(54)SG.
The Cisco Catalyst ME 4900 platform has three maintenance trains. The Cisco IOS Release 12.2(31)SGA train is the longest living train. Currently, the Cisco IOS Release 12.2(31)SGA8 is the recommended release for customers who require a release with a maintenance train. The Cisco IOS Release 12.2(53)SG is the latest maintenance train.
Cisco IOS Software Migration
Figure 1 displays the two active, 12.2(31)SGA and 12.2(50)SG, and newly introduced 12.2(53)SG extended maintenance trains.
Figure 1 Software Release Strategy for the Catalyst ME 4900 Series Switch
Summary of Migration Plan
- Customers requiring the latest Cisco Catalyst ME 4900 Series hardware and software features should migrate to Cisco IOS Software Release 12.2(54)SG.
- Cisco IOS Release 12.2(31)SGA is the first release for the Cisco ME 4900 Series Ethernet Switch.
- Cisco IOS Software Release 12.2(31)SGA and 12.2(50)SG will continue offering maintenance releases. The latest release from the 12.2(31)SGA maintenance train is 12.2(31)SGA10. The latest release from the 12.2(50)SG maintenance train is 12.2(50)SG3
Support
Support for Cisco IOS Software Release 12.2(54)SG follows the standard Cisco Systems® support policy, available at
http://www.cisco.com/en/US/products/products_end-of-life_policy.htmlSystem Requirements
This section describes the system requirements:
Supported Hardware
Table 1 lists the hardware supported on the Cisco ME 4900 Series Ethernet Switch.
For Catalyst ME 4900 switch transciever module compatibility information, see the url:
http://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html
Table 1 provides a product description and the required software release for the ME-X4924-10GE.
Supported Features
Table 2 lists the Cisco IOS software features for the Cisco ME 4900 Series Ethernet Switch.
Table 2 Cisco IOS Software Feature Set for the Cisco ME 4900 Series Ethernet Switch
Layer 2 transparent bridging1
Layer 2 MAC2 learning, aging, and switching by software
VMPS3 Client
No. of VLAN support per switch: 2048 (for LAN base), 4096 (for IP Base)
Resilient Ethernet Protocol4
802.1Q Tunneling (Q in Q)5
ANCP Client6
IP and IP multicast routing and switching between Ethernet ports
Classless routing7
PBR8
CEF9 load balancing
Route Leaking10
Identity ACL Policy Enforcement11
IS-IS12
DTP13
RIP14 and RIP II
EIGRP15
OSPF16
BGP417
MBGP18
MSDP19
ICMP20 Router Discovery Protocol
PIM21—sparse and dense mode
DVMRP22
NTP23
VRRP24
SCP25
GLBP26
Load balancing for routed traffic, based on source and destination IP addresses
RSPAN27
Authentication, authorization, and accounting using TACACS+ and RADIUS protocol
HSRP28 over Ethernet, EtherChannels - 10/100/1000Mbps, 10 Gbps
IGMP29 snooping version1, version 2, and version 3 (Full Support)
SSH version 1 and version 230
UDLR31
SNMP32 version 1, version 2, and version 3
802.1X with voice VLAN ID33
Router standard and extended ACLs 34on all ports with no performance penalty
Identity ACL Policy Enforcement35
PACL36
Per-port QoS37 rate-limiting and shaping
Non-stop Forwarding Awareness for EIGRP-stub in IP base for all supervisor engines
WCCP38v2 Layer 2 Redirection
CNA39
EEM40
IP SLA41
DHCPv6 Relay - Persistent Interface ID option DHCPv6 Relay Agent notification for Prefix Delegation
PIM Accept Register - Rogue Multicast Server Protection42
10.Route Leaking from a global routing table into a VRF and Route Leaking from a VRF into a global routing table
Unsupported Features
These features are not supported in Cisco IOS Release 12.2(54)SG for the
Cisco ME 4900 Series Ethernet Switch:–
–
–
- ADSL and Dial access for IPv6
- AppleTalk EIGRP (use native AppleTalk routing instead)
- Bridge groups
- Cisco IOS software-based transparent bridging (also called “fallback bridging”)
- Connectionless (CLNS) routing; including IS-IS routing for CLNS. IS-IS is supported for IP routing only.
- DLSw (data-link switching)
- IGRP (use EIGRP instead)
- isis network point-to-point command
- Kerberos support for access control
- Lock and key
- NAT-PT for IPv6
- NetFlow
- PBR with Multiple Tracking Options
- QoS for IPv6
- Reflexive ACLs
- Routing IPv6 over an MPLS network
- Two-way community VLANs in private VLANs
- Automatic shutdown due to overtemperature
The IOS software sends system messages when the internal temperature (as read from sensors on the supervisor engine) reaches 75 and 95 degrees Celsius. A power supply may shut down when the ambient temperature exceeds 55 degrees C.
New Information
These sections describe the new information for the Cisco ME 4900 Series Ethernet Switch running Cisco IOS software:
- New Hardware Features in Release 12.2(54)SG
- New Software Features in Release 12.2(54)SG
- New Hardware Features in Release 12.2(53)SG
- New Software Features in Release 12.2(53)SG
- New Hardware Features in Release 12.2(52)SG
- New Software Features in Release 12.2(52)SG
- New Hardware Features in Release 12.2(52)SG
- New Software Features in Release 12.2(50)SG1
- New Hardware Features in Release 12.2(50)SG
- New Software Features in Release 12.2(50)SG
- New Hardware Features in Release 12.2(46)SG
- New Software Features in Release 12.2(46)SG
- New Hardware Features in Release 12.2(44)SG
- New Software Features in Release 12.2(44)SG
- New Hardware Features in Release 12.2(40)SG
- New Software Features in Release 12.2(40)SG
- New Hardware Features in Release 12.2(37)SG
- New Software Features in Release 12.2(37)SG
- New Hardware Features in Release 12.2(31)SGA
- New Software Features in Release 12.2(31)SGA
New Hardware Features in Release 12.2(54)SG
Release 12.2(54)SG provides the following new hardware on the Catalyst ME 4900 switch:
New Software Features in Release 12.2(54)SG
Release 12.2(54)SG provides the following new software features on the Catalyst ME 4900 switch:
- 802.1X with User Distribution ("Configuring 802.1X Port-Based Authentication" chapter)
- Auto SmartPort ("Configuring Auto SmartPort Macros" chapter)
- DSCP/CoS via LLDP ("Configuring LLDP, LLDP-MED, and Location Service" chapter
- EEM: Embedded Event Manager 3.2
For details, refer to the URL:
http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_eem_3.2.htmlFor details refer to the URL:
http://www.cisco.com/en/US/docs/ios/saf/configuration/guide/saf_cg.htmlFor details refer to the URL:
http://www.cisco.com/en/US/docs/switches/lan/energywise/phase2/ios/configuration/guide/ew_v2.html
- Identity 4.1 ACL Policy Enhancements ("Configuring Network Security with ACLs" chapter)
- Identity 4.1 Network Edge Access Topology ("Configuring 802.1X Port-Based Authentication" chapter)
- IPSG for Static Hosts (Refer to the Cisco IOS library)
- Layer Control Packet (extended to Supervisor 6)
- Link State Tracking ("Configuring EtherChannel and Link State Tracking" chapter)
- MAC move and replace ("Administering the Switch" chapter)
- Per-VLAN Learning ("Administering the Switch" chapter)
- PoEP via LLDP ("Configuring LLDP, LLDP-MED, and Location Service" chapter)
- RADIUS CoA ("Configuring 802.1X Port-Based Authentication" chapter)
- Sub-second UDLD (Configuring UDLD" chapter)
- VRF-aware TACACS+ ("Configuring VRF-lite" chapter)
- XML Programmatic Interface (Refer to the Cisco IOS library)
For details refer to the URL:
http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_xmlpi_v1.htmlNew Hardware Features in Release 12.2(53)SG3
Release 12.2(53)SG3 provides the following new hardware on the Catalyst ME 4900 series switch:
Note
New Software Features in Release 12.2(53)SG3
Release 12.2(53)SG3 provides no new features for the Catalyst ME 4900 series switch.
New Hardware Features in Release 12.2(53)SG
Release 12.2(53)SG provides no new hardware for the Catalyst ME 4900 series switch.
New Software Features in Release 12.2(53)SG
Release 12.2(53)SG provides the following Cisco IOS software features for the Catalyst ME 4900 series switch:
New Hardware Features in Release 12.2(52)SG
Release 12.2(52)SG provides no new hardware for the Catalyst ME 4900 series switch.
New Software Features in Release 12.2(52)SG
Release 12.2(52)SG provides the following new Cisco IOS software features for the Catalyst ME 4900 series switch:
–
–
New Hardware Features in Release 12.2(50)SG1
Release 12.2(50)SG1 provides no new hardware for the Catalyst ME 4900 series switch.
New Software Features in Release 12.2(50)SG1
Release 12.2(50)SG1 provides the following Cisco IOS software features for the Catalyst ME 4900 series switch:
New Hardware Features in Release 12.2(50)SG
Release 12.2(50)SG provides the following new hardware for the Catalyst ME 4900 series switch:
New Software Features in Release 12.2(50)SG
Release 12.2(50)SG provides the following Cisco IOS software features for the Catalyst ME 4900 series switch:
Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.
- IGMP Querier (“Configuring IGMP Snooping” chapter)
- OSPF and EIGRP fast convergence and protection (Refer to the Cisco IOS Release 12.4 documentation)
- CDP 2nd Port Status TLV (no configuration required on the switch)
- Flexible Authentication Sequencing (“Configuring 802.1X” chapter)
- Multi-Authentication (“Configuring 802.1X” chapter)
- Open Authentication (“Configuring 802.1X” chapter)
- Web Authentication (“Configuring Web Authentication” chapter)
- Inactivity Timer (“Configuring 802.1X” chapter)
- Downloadable ACLs (“Configuring Network Security with ACLs” chapter)
- ANCP Client (“Configuring ANCP Client” chapter)
- PPPoE Intermediate Agent (“PPPoE Circuit-Id Tag Processing” chapter)
- VTP version 3 (“Configuring VLANs, VTP, and VMPS” chapter)
- VRF-aware IP services (“Configuring VRF-Lite” chapter)
- boot config command (Refer to the Cisco IOS Release 12.2 documentation)
- Crashdump enhancement (Refer to the Cisco IOS Release 12.2 documentation)
- Unicast MAC filtering (“Configuring Network Security with ACLs” chapter)
- Configuration Rollback
- Cisco TrustSec SGT Exchange Protocol (SXP) IPv4
For more information, refer to the following URLs:
http://www.cisco.com/en/US/docs/switches/lan/trustsec/configuration/guide/trustsec.html
New Hardware Features in Release 12.2(46)SG
Release 12.2(46)SG provides no new hardware for the Catalyst 4900 series switch.
New Software Features in Release 12.2(46)SG
Release 12.2(46)SG provides the following Cisco IOS software features for the Catalyst 4900 series switch:
Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.
New Hardware Features in Release 12.2(44)SG
Release 12.2(44)SG provides no new hardware for the Catalyst ME 4900 series switch.
New Software Features in Release 12.2(44)SG
Release 12.2(44)SG provides the following Cisco IOS software features for the Catalyst ME 4900 series switch:
Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.
- REP (Refer to the “Configuring REP” chapter)
- EEM with ISSU (Refer to the Cisco IOS Release 12.2 documentation)
- VSS client with PagP+
After configuring VSS dual-active on a Catalyst 6500 switches, the Catalyst 4500 series switch can detect VSS dual-active with PagP+ support.
New Hardware Features in Release 12.2(40)SG
Release 12.2(40)SG provides no new hardware for the Catalyst ME 4900 series switch.
New Software Features in Release 12.2(40)SG
Release 12.2(40)SG provides the following Cisco IOS software features for the Catalyst ME 4900 series switch:
Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.
New Hardware Features in Release 12.2(37)SG
Release 12.2(37)SG provides no new hardware for the Cisco ME 4900 Series Switch.
New Software Features in Release 12.2(37)SG
Release 12.2(37)SG provides the following Cisco IOS software features for the
Cisco ME 4900 Series Ethernet Switch:
Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.
- Selective Dynamic Buffer Limiting (“Configuring QoS” chapter)
- SVI Autostate Exclude (“Configuring Layer 3 Interface” chapter)
- IP Source Guard for Static Hosts (“Configuring DHCP Snooping, IP Source Guard, and IPSG for Static Hosts” chapter)
- BGP route-map Continue Support for Outbound Policy
- Auto RP Listerner (Refer to the Cisco IOS Release 12.4 documentation)
New Hardware Features in Release 12.2(31)SGA
Note
Cisco ME 4900 Series Ethernet Switch.
New Software Features in Release 12.2(31)SGA
Release 12.2(31)SGA provides the following Cisco IOS software features for the
Cisco ME 4900 Series Ethernet Switch:
Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.
- Trunk Port Security over EtherChannel (“Configuring Port Security and Configuring EtherChannel” chapters)
- Match CoS for Non-IPv4 Traffic (“Configuring QoS” chapter)
- CoS Mutation (“Configuring QoS” chapter)
- Q inQ Tunneling and Protocol Tunneling (“Configuring 802.1Q and Layer 2 Protocol Tunneling” chapter)
- IP Unnumbered (“Configuring IP Unnunmbered Support” chapter)
Upgrading the System Software
The Cisco ME 4900 Series Ethernet Switch ships with the recommended IOS software and ROMMON. Software and ROMMON upgrades will be outlined in future releases.
The following sections describe how to upgrade your switch software:
- Upgrading the ROMMON from the Console
- Upgrading the ROMMON Remotely Using Telnet
- Upgrading the Cisco IOS Software
Upgrading the ROMMON from the Console
Caution To avoid actions that might make your system unable to boot, read this entire section before starting the upgrade.
Note
Follow this procedure to upgrade your supervisor engine ROMMON:
Step 1
Note
Step 2
The cat4000-ios-promupgrade-122_25r_EWA programs are available on Cisco.com at the same location from which you download Catalyst 4000 system images.
Step 3
squeeze bootflash: command to reclaim the space.Step 4
The following example shows how to download the PROM upgrade image cat4000-ios-promupgrade-122_25r_EWA from the remote host 172.20.58.78 to bootflash:
Switch# copy tftp: bootflash:
Address or name of remote host [172.20.58.78]?
Source filename [cat4000-ios-promupgrade-122_25r_EWA]?
Destination filename [cat4000-ios-promupgrade-122_25r_EWA]?
Accessing tftp://172.20.58.78/cat4000-ios-promupgrade-122_25r_EWA...
Loading cat4000-ios-promupgrade-122_25r_EWA from 172.20.58.78 (viaStep 5
The following example shows the output after a reset into ROMMON:
Step 6
boot bootflash:cat4000-ios-promupgrade-122_25r_EWA
Caution No intervention is necessary to complete the upgrade. To ensure a successful upgrade, do not interrupt the upgrade process. Do not perform a reset, power cycle, or OIR of the supervisor engine until the upgrade is complete.
The following example shows the output from a successful upgrade, followed by a system reset:
Step 7
Step 8
The following example shows how to delete the cat4000-ios-promupgrade-122_25r_EWA image from bootflash and reclaim unused space:
Step 9
Cisco IOS Software, Catalyst 4900 L3 Switch Software (cat4500-IPBASE-M), Version 12.2(25)EWA, RELEASE SOFTWARE (fc1)
The ROMMON has now been upgraded.
See the “Upgrading the Cisco IOS Software” section for instructions on how to upgrade the Cisco IOS software on your switch.
Upgrading the ROMMON Remotely Using Telnet
Caution To avoid actions that might make your system unable to boot, read this entire section before starting the upgrade.
Follow this procedure to upgrade your supervisor engine ROMMON to Release 12.2(25r)EWA. This procedure can be used when console access is not available and when the ROMMON upgrade must be performed remotely.
Note
Step 1
Note
Step 2
The cat4000-ios-promupgrade-122_25r_EWA programs are available on Cisco.com at the same location from which you download Catalyst 4000 system images.
Step 3
squeeze bootflash: command to reclaim the space.Step 4
copy tftp command.The following example shows how to download the PROM upgrade image cat4000-ios-promupgrade-122_25r_EWA from the remote host 10.5.5.5 to bootflash:
Source filename [cat4000-ios-promupgrade-122_25r_EWA]? /tftpboot/pjose/cat4000-ios-promupgrade-122_25r_EWAStep 5
Use the boot system flash bootflash:file_name command to set the BOOT variable. You will use two BOOT commands: one to upgrade the ROMMON and a second to load the Cisco IOS software image after the ROMMON upgrade is complete. Notice the order of the BOOT variables in the example below. At bootup the first BOOT variable command upgrades the ROMMON. When the upgrade is complete the supervisor engine will autoboot, and the second BOOT variable command will load the Cisco IOS software image specified by the second BOOT command.
Note The config-register must be set to autoboot.
In this example, we assume that the console port baud rate is set to 9600 bps and that the config-register is set to 0x0102.Use the config-register command to autoboot using image(s) specified by the BOOT variable. Configure the BOOT variable to upgrade the ROMMON and then autoboot the IOS image after the ROMMON upgrade is complete. In this example, we are upgrading the ROMMON to version 12.2(25r)EWA. After the ROMMON upgrade is complete, the supervisor engine will boot Cisco IOS software Release 12.2(25)EWA.Step 6
BOOT variable = bootflash:cat4000-ios-promupgrade-122_25r_EWA,1;bootflash:cat4500-ipbase-mz.122-25.EWAStep 7
Caution Verify the boot string in step 6. No intervention is necessary to complete the upgrade. To ensure a successful upgrade, do not interrupt the upgrade process. Do not perform a reset, power cycle, or OIR of the supervisor engine until the upgrade is complete.
The following example shows the console port output from a successful ROMMON upgrade followed by a system reset. Your Telnet session will be disconnected during the ROMMON upgrade, so you will not see this output. This step could take 2-3 minutes to complete. You will need to reconnect your Telnet session after 2-3 minutes when the Cisco IOS software image and the interfaces are loaded.
Cisco IOS Software, Catalyst 4900 L3 Switch Software (cat4500-IPBASE-M), Version 12.2(25)EWA, RELEASE SOFTWARE (fc1)Step 8
Step 9
Cisco IOS Software, Catalyst 4900 L3 Switch Software (cat4500-IPBASE-M), Version 12.2(25)EWA, RELEASE SOFTWARE (fc1)Step 10
The following example shows how to delete the cat4000-ios-promupgrade-122_25r_EWA image from bootflash and reclaim unused space:
Step 11
The ROMMON has now been upgraded.
See the “Upgrading the Cisco IOS Software” section for instructions on how to upgrade the Cisco IOS software on your switch.
Upgrading the Cisco IOS Software
Caution To avoid actions that might make your system unable to boot, please read this entire section before starting the upgrade.
Before you proceed, observe the following rules for hostname:
Uppercase and lowercase characters look the same to many internet software applications. It may seem appropriate to capitalize a name the same way you might do in English, but conventions dictate that computer names appear all lowercase. For more information, refer to RFC 1178, Choosing a Name for Your Computer.
- Must start with a letter and end with a letter or digit.
- Interior characters can only be letters, digits, and hyphens; periods and underscores not allowed.
- Names must be 63 characters or fewer; hostname of fewer than 10 characters is recommended.
- On most systems, a field of 30 characters is used for the host name and the prompt in the CLI. Longer configuration mode prompts may be truncated.
To upgrade the Cisco IOS software on your Catalyst 4900 series switch, use this procedure:
Step 1
Step 2
Step 3
The following example shows how to download the Cisco IOS software image cat4500-ipbase-mz.122-25.EWA from the remote host 172.20.58.78 to bootflash:
Step 4
The following example shows how to clear the BOOT variable:
Step 5
The following example shows how to add the cat4500-ipbase-mz.122-25.EWA image to the BOOT variable:
Step 6
The following example show how to set the second least significant bit in the configuration register:
Step 7
Caution No intervention is necessary to complete the upgrade. To ensure a successful upgrade, do not interrupt the upgrade process by performing a reset, power cycle, or OIR of the supervisor, for at least five minutes.
The following example shows the output from a successful upgrade followed by a system reset:
Step 8
Limitations and Restrictions
These sections list the limitations and restrictions for the current release of Cisco IOS software on the Cisco ME 4900 Series Ethernet Switch:
–
–
–
–
–
–
–
–
–
- IGRP not supported (use EIGRP, instead)
- IP classful routing is not supported; do not use the no ip classless command; it will have no effect, as only classless routing is supported. The command ip classless is not supported as classless routing is enabled by default.
- Catalyst 4500 supervisor engines will not be properly initialized if the VLAN configuration in the startup file does not match the information stored in the VLAN database file. This situation might occur if a backup configuration file was used.
- A Layer 2 LACP channel cannot be configured with the spanning tree PortFast feature.
- Netbooting using a boot loader image is not supported. See the “Troubleshooting” section for details on alternatives.
- An unsupported default CLI for mobile IP is displayed in the HSRP configuration. Although this CLI will not harm your system, you might want to remove it to avoid confusion.
Workaround: Display the configuration with the show standby command, then remove the CLI. Here is sample output of the show standby GigabitEthernet1/1 command:
- For HSRP “preempt delay” to function consistently, you must use the standby delay minimum command. Be sure to set the delay to more than 1 hello interval, thereby ensuring that a hello is received before HSRP leaves the initiate state.
Use the standby delay reload option if the router is rebooting after reloading the image.
- When you attempt to run OSPF between a Cisco router and a third party router, the two interfaces might get stuck in the Exstart/Exchange state. This problem occurs when the maximum transmission unit (MTU) settings for neighboring router interfaces do not match. If the router with the higher MTU sends a packet larger than the MTU set on the neighboring router, the neighboring router ignores the packet.
Workaround: Since the problem is caused by mismatched MTUs, the solution is to change the MTU on either router to match the neighbor’s MTU.
- The Ethernet management port on the supervisor module is active in ROMMON mode only.
- If an original packet is dropped due to transmit queue shaping and/or sharing configurations, a SPAN packet copy can still be transmitted on the SPAN port.
- All software releases support a maximum of 32,768 IGMP snooping group entries.
- Use the no ip unreachables command on all interfaces with ACLs configured for performance reasons.
- The threshold for the Dynamic Arp Inspection err-disable function is set to 15 ARP packets per second per interface. You should adjust this threshold depending on the network configuration. The CPU should not receive DHCP packets at a sustained rate greater than 1000 pps.
Workaround: Verify whether or not the Neighbor discovery cache has an entry, separate from regular troubleshooting areas of IPv6 address configurations and other configurations.
- If you first configure an IP address or IPv6 address on a Layer 3 port, then change the Layer 3 port to a Layer 2 port with the switchport command, and finally change it back to a Layer 3 port, the original IP/IPv6 address will be lost.
- By default, IPv6 is not enabled. To route IPv6, you must issue the IPv6 unicast-routing command. If you plan to use IPv6 multicast routing, use the IPv6 multicast-routing command.
- By default, CEF is not enabled for IPv6 (once IPv6 unicast routing is enabled). To prevent IPv6 traffic from being process-switched, use the IPv6 cef command.
- Multicast sources in community VLANs are not supported.
- Two-way community VLANs are not supported.
- Voice VLANs are not supported on community VLAN host interfaces.
- Private VLAN trunks do not carry community VLANs.
- The maximum number of unique private VLAN pairs supported by the
switchport private-vlan mapping trunk command above is 1000. For example, one thousand secondary VLANs could map to one primary VLAN, or one thousand secondary VLANs could map one to one to one thousand primary VLANs.- While configuring PVLAN promiscuous trunk ports, the maximum number of mappings is 500 primary VLANs to 500 secondary VLANs.
- 802.1X inaccessible authentication bypass feature is not supported with NAC LAN port IP feature.
- Changes to the console speed in "line console 0" configuration mode do not impact console speed in ROMMON mode. To apply the same console speed in ROMMON mode, use the "confreg" ROMMON utility and change ROMMON console speed.
- If a Cisco ME 4900 Series Ethernet Switch requests information from the Cisco Secure Access Control Server (ACS) and the message exchange times out because the server does not respond, a message similar to this appears:
If this message appears, check that there is network connectivity between the switch and the ACS. You should also check that the switch has been properly configured as an AAA client on the ACS.
- The bgp shutdown command is not supported in BGP router configuration mode. Executing this command might produce unexpected results.
- A spurious error message appears when an SSH connection disconnects after an idle timeout.
Workaround: Disable idle timeouts. (CSCec30214)
- IPSG for Static Hosts basically supports the same port mode as IPSG except that it does not support trunk port:
–
–
- IPSG for Static Hosts should not be used on uplink ports.
- Selective DBL is only supported for non-tagged or single-tagged IP packets. To achieve Selective DBL-like functionality with a non-IP packet (like Q-in-Q and IPX), apply an input policy map that matches COS values and specifies DBL in the class map.
- For Selective DBL, if the topology involves Layer 2 Q in Q tunneling, the match cos policy map will apply to the incoming port.
- If a set of DSCP values are already configured (e.g. 0-30, 0-63), specifying a subset of these DSCP values with the qos dbl dscp-based 0-7 command will not remove the unwanted DSCP values of 8 through 63. Rather, you must use the no form of the command to remove the extraneous values. In this case, the no qos dbl dscp-based 8-63 command will leave 0-7 selected.
- When using Port Security with Multi Domain Authentication (MDA) on an interface:
–
–
–
–
–
–
- After the fix for CSCsg08775, a GARP ACL entry is no longer part of the Static CAM area, but there is still a system-defined GARP class in Control Plane Policing (CPP). CPP is a macro with many CLIs and the GARP class creation CLI has been removed.
- When ipv6 is enabled on an interface via any CLI, it is possible to see the following message:
In such a scenario, the ipv6 MTU value programmed in hardware will be different from the ipv6 interface MTU value. This will happen if there is no room in the hw MTU table to store additional values.
You must free up some space in the table by unconfiguring some unused MTU values and subsequently disable/re-enable ipv6 on the interface or reapply the MTU configuration.
- To stop IPSG with Static Hosts on an interface, use the following commands in interface configuration submode:
To enable IPSG with Static Hosts on a port, issue the following commands:
Caution If you only configure the ip verify source tracking [port-security] interface configuration command on a port without enabling IP device tracking globally or setting an IP device tracking maximum on that interface, IPSG with Static Hosts will reject all the IP traffic from that interface.
Note
- Management port does not support non-VRF aware features.
- When you enter the permit any any ? command you will observe the octal option, which is unsupported in Cisco IOS Release 12.2(52)SG.
- A Span destination of fa1 is not supported.
- The "keepalive" CLI is not supported in interface mode on the switch, although it will appear in the running configuration. This behavious has no impact on functionality.
- TDR is only supported on interfaces Gi1/1 through Gi1/48, at 1000BaseT under open or shorted cable conditions. TDR length resolution is +/- 10 m. If the cable is less than 10 m or if the cable is properly terminated, the TDR result displays "0" m. If the interface speed is not 1000BaseT, an "unsupported" result status displays. TDR results will be unreliable for cables extended with the use of jack panels or patch panels.
- The following guidelines apply to Fast UDLD:
–
–
–
–
–
–
The outputs of certain commands, such as show ip route and show access-lists, contain non-deterministic text. While the output is easily understood, the output text does not contain strings that are consistently output. A general purpose specification file entry is unable to parse all possible output.
While a general purpose specification file entry may not be possible, a specification file entry might be created that returns the desired text by searching for text that is guaranteed to be in the output. If a string is guaranteed to be in the output, it can be used for parsing.
For example, the output of the show ip access-lists SecWiz_Gi3_17_out_ip command is this:
The first line is easily parsed because access list is guaranteed to be in the output:
The remaining lines all contain the term host. As a result, the specification file may report the desired values by specifying that string. For example, this line
will produce the following for the first and second rules
and the following for the third statement
Request the output of the show running-config command using NETCONF and parse that output for the desired strings. This is useful when the desired lines contain nothing in common. For example, the rules in this access list do not contain a common string and the order (three permits, then a deny, then another permit), prevent the spec file entry from using permit as a search string, as in the following example:
The XML output of show running-config command includes the following, which can then be parsed programmatically, as desired:
<X-Interface> permit 0000.0000.ffef ffff.ffff.0000 0000.00af.bcef ffff.ff00.0000 appletalk</X-Interface>
- Although the Catalyst ME 4900 series switch still supports legacy 802.1X commands used in Cisco IOS Release 12.2(46)SG and earlier releases (that is, they are accepted on the CLI), they do not display in the CLI help menu.
- Current IOS software cannot support filenames exceeding 64 characters.
- If you use MDA or multi-auth host mode in conjunction with pre-authentication open access, a switch ignores unicast EAPOL responses.
–
Caveats
Caveats describe unexpected behavior in Cisco IOS releases. Caveats listed as open in a prior release are carried forward to the next release as either open or resolved.
Note
http://tools.cisco.com/security/center/publicationListing
Open Caveats in Cisco IOS Release 12.2(54)SG1
This section lists the open caveats in Cisco IOS Release 12.2(54)SG1:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- When you remove an SFP+ from a OneX converter in a X2 slot, it takes roughly 45 seconds for the system to recognize this. Any commands during this time will indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can result in Duplicate Seeprom error message.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
–
–
–
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command. CSCsx42157
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct. CSCsz20149
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored. CSCsz34522
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command. CSCta16492
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range. CSCte51948
- On a peer interface on a Catalyst 4948E Ethernet Switch, if errdisabled mode flap detection is set to a very small number (such as 2 flaps in 10 sec), a 10GE link flap may cause the peer interface to enter the errdisabled state.
Workarounds: The Cisco switch default link-flap detection value is 5 flaps in 10 seconds. Use the default value or larger numbers. CSCtg07677
- If you disable and re-enable IGMP Snooping on a VLAN, the output of the show mac address command does not display the [term] Switch against the multicast entry. Multicast traffic is not impacted.
Workaround: Do shut, then no shut on the SVI. CSCtg72559
- When Fallback WebAuth and Multi-host is configured on a port and no PACL exists, "permit ip any any" is installed in the TCAM and all traffic from the host is allowed to pass.
Workaround: Configure an ACL on the port. CSCte18760
- With a NEAT configuration on an ASW (Catalyst 4500 series switch) connected to an SSW (Catalyst 3750 series switch) serving as a root bridge and with redundant links between ASW and SSW, the following occur:
–
Workaround: Configure the ASW or any other switch upstream as the root-bridge for all the VLANs. CSCtg71030
- If host-mode multi-domain is configured and authorization succeeds, traffic may not pass from an IP phone or a data device.
- When a switch is configured for MAC Authentication Bypass (MAB) EAP and the AAA server requests EAP-TLS (as the EAP method) first, MAB fails.
–
–
Resolved Caveats in Cisco IOS Release 12.2(54)SG1
This section lists the resolved caveats in Release 12.2(54)SG1:
- Catalyst 4500 series switches may lose the per-vlan maximum mac addresses for port-security when the link goes down. This applies to the following interface configuration :
Workaround: None. CSCti74791..ALL
- If no vtp is configured on ports that receive VTP updates, a switch no longer processes Layer 2 control traffic (STP and CDP).
Workaround: Upgrade to 12.2(53)SG3, 12.2(50)SG8, or later. CSCth00398 .....ALL
- When the show ip ospf int command is paused while the backup designated router neighbor goes down, a switch may reload when you enter the show ip ospf int command:
The next line in the output of the show ip ospf int command is the following:
If you now advance the output by pressing either Enter or the space bar, the device reloads and the following error message displays:
Open Caveats in Cisco IOS Release 12.2(54)SG
This section lists the open caveats in Cisco IOS Release 12.2(54)SG:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- When you remove an SFP+ from a OneX converter in a X2 slot, it takes roughly 45 seconds for the system to recognize this. Any commands during this time will indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can result in Duplicate Seeprom error message.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
–
–
–
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command. CSCsx42157
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct. CSCsz20149
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored. CSCsz34522
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command. CSCta16492
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range. CSCte51948
- On a peer interface on a Catalyst 4948E Ethernet Switch, if errdisabled mode flap detection is set to a very small number (such as 2 flaps in 10 sec), a 10GE link flap may cause the peer interface to enter the errdisabled state.
Workarounds: The Cisco switch default link-flap detection value is 5 flaps in 10 seconds. Use the default value or larger numbers. CSCtg07677
- If you disable and re-enable IGMP Snooping on a VLAN, the output of the show mac address command does not display the [term] Switch against the multicast entry. Multicast traffic is not impacted.
Workaround: Do shut, then no shut on the SVI. CSCtg72559
- When Fallback WebAuth and Multi-host is configured on a port and no PACL exists, "permit ip any any" is installed in the TCAM and all traffic from the host is allowed to pass.
Workaround: Configure an ACL on the port. CSCte18760
- With a NEAT configuration on an ASW (Catalyst 4500 series switch) connected to an SSW (Catalyst 3750 series switch) serving as a root bridge and with redundant links between ASW and SSW, the following occur:
–
Workaround: Configure the ASW or any other switch upstream as the root-bridge for all the VLANs. CSCtg71030
- If host-mode multi-domain is configured and authorization succeeds, traffic may not pass from an IP phone or a data device.
- When a switch is configured for MAC Authentication Bypass (MAB) EAP and the AAA server requests EAP-TLS (as the EAP method) first, MAB fails.
–
–
Resolved Caveats in Cisco IOS Release 12.2(54)SG
This section lists the resolved caveats in Release 12.2(54)SG:
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface. (CSCso50921)
Workaround: None. (CSCsv42869)
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules. CSCsz05888Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port. CSCta04665
- A switch crashes if a PBR policy, configured to match on prefix-list(s) instead of ACL(s), is attached to an interface.
This happens provided on the following conditions apply:
–
–
Workaround: Configure the route map for PBR to only match on ACLs. CSCtg22126
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- After three failed authentication attempts, WinXP stops responding to EAPOL requests from the switch that caused the 802.1X timeout (default or configured). After the timeout, WinXP moves to auth-fail VLAN.
Workaround: Attempt an authorization after a timeout. CSCte84432
- The switch may reload after destroying the expExpressionTable row via SNMP when you enter the debug management expression evaluator command.
Workaround: Disable the debug management expression evaluator command. (CSCsu67323)
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- When you load an unsupported Catalyst 4500 software version on WS-C4507R+E and WS-C4510R+E, the following log messages are seen and none of the ports come up:
"%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type""%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type""%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)Workaround: Load Cisco IOS Release 12.2(54)SG or 12.2(53)SG4 on WS-C4507R+E and WS-C4510R+E.
Open Caveats in Cisco IOS Release 12.2(53)SG11
This section lists the open caveats in Cisco IOS Release 12.2(53)SG11:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command.
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
- On a switch running Cisco IOS Release 12.2(52)SG, the Auto Install feature does not work on the management port. The auto process status aborts.
Workaround: Configure the DHCP server on the same vrf; add the configuration vrf mgmtVrf to
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
- If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
- The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on the console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis typeThe active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailedWhile active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
Resolved Caveats in Cisco IOS Release 12.2(53)SG11
This section lists the resolved caveats in Release 12.2(53)SG11:
- If a switch is running IOS Release 12.2(53)SG6 with Supervisor Engine 2 and a phone and PC are authenticated (or authorized) via MAB while connected to a port in multi-auth mode (with authentication open), both sessions are removed after 30 seconds without any reason:
Open Caveats in Cisco IOS Release 12.2(53)SG10
This section lists the open caveats in Cisco IOS Release 12.2(53)SG10:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command.
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct.
- On a switch running Cisco IOS Release 12.2(52)SG, the Auto Install feature does not work on the management port. The auto process status aborts.
Workaround: Configure the DHCP server on the same vrf; add the configuration vrf mgmtVrf to
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
- If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
- The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on the console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis typeThe active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailedWhile active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
Resolved Caveats in Cisco IOS Release 12.2(53)SG10
This section lists the resolved caveats in Release 12.2(53)SG10:
- The following message appears during MAC aging or learning on ports where dot1x or port security is configured:
Open Caveats in Cisco IOS Release 12.2(53)SG9
This section lists the open caveats in Cisco IOS Release 12.2(53)SG9:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command.
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct.
- On a switch running Cisco IOS Release 12.2(52)SG, the Auto Install feature does not work on the management port. The auto process status aborts.
Workaround: Configure the DHCP server on the same vrf; add the configuration vrf mgmtVrf to
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
- If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
- The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on the console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis typeThe active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailedWhile active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
- If a port is configured for Private VLAN and is authorized in a guest VLAN, a traceback appears on the console.
- The following message appears during MAC aging or learning on ports where dot1x or port security is configured:
Resolved Caveats in Cisco IOS Release 12.2(53)SG9
This section lists the resolved caveats in Release 12.2(53)SG9:
- When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Open Caveats in Cisco IOS Release 12.2(53)SG8
This section lists the open caveats in Cisco IOS Release 12.2(53)SG8:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command.
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct.
- On a switch running Cisco IOS Release 12.2(52)SG, the Auto Install feature does not work on the management port. The auto process status aborts.
Workaround: Configure the DHCP server on the same vrf; add the configuration vrf mgmtVrf to
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
- If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
- The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on the console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis typeThe active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailedWhile active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis. CSCtl84092
- If a port is configured for Private VLAN and is authorized in a guest VLAN, a traceback appears on the console.
- When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Resolved Caveats in Cisco IOS Release 12.2(53)SG8
This section lists the resolved caveats in Release 12.2(53)SG8:
- While processing a CDP frame, a switch may crash after displaying SYS-2-FREEFREE and SYS-6-MTRACE messages.
Workaround: Enter the no cdp run command to disable CDP. CSCub45763
Open Caveats in Cisco IOS Release 12.2(53)SG7
This section lists the open caveats in Cisco IOS Release 12.2(53)SG7:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command.
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct.
- On a switch running Cisco IOS Release 12.2(52)SG, the Auto Install feature does not work on the management port. The auto process status aborts.
Workaround: Configure the DHCP server on the same vrf; add the configuration vrf mgmtVrf to
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
- If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
- The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on the console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis typeThe active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailedWhile active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
- If a port is configured for Private VLAN and is authorized in a guest VLAN, a traceback appears on the console.
- While processing a CDP frame, a switch may crash after displaying SYS-2-FREEFREE and SYS-6-MTRACE messages.
Workaround: Enter the no cdp run command to disable CDP. CSCub45763
- When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Resolved Caveats in Cisco IOS Release 12.2(53)SG7
This section lists the resolved caveats in Release 12.2(53)SG7:
- If you use AAA accounting with the broadcast keyword, a switch may either display unpredictable behavior or crash.
Workaround: Do not use AAA accounting with the broadcast keyword. CSCts56125
- A vulnerability exists in the Cisco IOS software that may allow a remote application or device to exceed its authorization level when authentication, authorization, and accounting (AAA) authorization is used. This vulnerability requires that the HTTP or HTTPS server is enabled on the Cisco IOS device.
Products that are not running Cisco IOS software are not vulnerable.
Cisco has released free software updates that address these vulnerabilities.
The HTTP server may be disabled as a workaround for the vulnerability described in this advisory.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-paiAdditional information on Cisco's security vulnerability policy can be found at the URL:
http://www.cisco.com/en/US/products/csa/cisco-sa-20110126-csg2.html
- A switch operating as a DHCP server where sessions receive DHCP information from a RADIUS server may experience a crash and DHCP related errors.
- A vulnerability in the Multicast Source Discovery Protocol (MSDP) implementation of Cisco IOS Software and Cisco IOS XE Software could allow a remote, unauthenticated attacker to cause a reload of an affected device. Repeated attempts to exploit this vulnerability could result in a sustained denial of service (DoS) condition.
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-msdp
Note The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.
Individual publication links are in ''Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication'' at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html%AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (Unknown MAC) on Interface Gi5/39 AuditSessionID AC156241000000670001BC9.provided the following conditions apply:
–
authentication event server dead action authorize...
authenticaton event server alive action reinitalize
–
The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.
Open Caveats in Cisco IOS Release 12.2(53)SG6
This section lists the open caveats in Cisco IOS Release 12.2(53)SG6:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command.
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct.
- On a switch running Cisco IOS Release 12.2(52)SG, the Auto Install feature does not work on the management port. The auto process status aborts.
Workaround: Configure the DHCP server on the same vrf; add the configuration vrf mgmtVrf to
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
- If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
- The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on the console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis typeThe active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailedWhile active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
- If a port is configured for Private VLAN and is authorized in a guest VLAN, a traceback appears on the console.
%AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (Unknown MAC) on Interface Gi5/39 AuditSessionID AC156241000000670001BC9.provided the following conditions apply:
–
authentication event server dead action authorize...
authenticaton event server alive action reinitalize
–
The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.
- When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Resolved Caveats in Cisco IOS Release 12.2(53)SG6
This section lists the resolved caveats in Release 12.2(53)SG6:
Workaround: Re-enter the rep preempt segment command.
Workaround: Ensure that a policy is configured on an interface prior to changing a default next-hop in route-map. CSCtr31759
–
–
Workaround: Perform the following task:
1. Disable the SNMP engine with the no snmp-server command.
2. Configure an IPv4 address and an IPv6 address on loopback interfaces.
Workaround: Perform the following task:
1. Disable the SNMP engine with the no snmp-server command.
2. Configure an IP address and an IPv6 address on loopback interfaces.
- When flex link load balancing is used, MAC addresses sourced over the backup interface are not programmed into the dynamic MAC address table. Source address learning is triggered for all traffic from these MAC addresses, which may cause high CPU.
Workaround: Configure static MAC addresses for the source addresses on the backup flex link interface. CSCtr40070
- On networks with round-trip-time (RTT) delay of 5 milisec and over, IP SLA ethernet jitter probes are stuck in NoConnection/Busy/Timeout state:
Issue is likely not to appear in environments with low latency (<5msec).
–
–
- A system may crash if it receives more than 10 MA (Management Address) TLVs per LLDP neighbor entry.
Workaround: Disable LLDP MA TLV sending on the peers. CSCtj22354
Workaround: Use getnext rather than get to list valid indicies for the MIB OID. CSCtr52740
- Flooded multicast traffic is not sent over a port channel interface after a member link or port-channel flaps.
–
–
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
Open Caveats in Cisco IOS Release 12.2(53)SG5
This section lists the open caveats in Cisco IOS Release 12.2(53)SG5:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command.
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct.
- On a switch running Cisco IOS Release 12.2(52)SG, the Auto Install feature does not work on the management port. The auto process status aborts.
Workaround: Configure the DHCP server on the same vrf; add the configuration vrf mgmtVrf to
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
- If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
- The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on the console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis typeThe active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailedWhile active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
- If a port is configured for Private VLAN and is authorized in a guest VLAN, a traceback appears on the console.
%AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (Unknown MAC) on Interface Gi5/39 AuditSessionID AC156241000000670001BC9.provided the following conditions apply:
–
authentication event server dead action authorize...
authenticaton event server alive action reinitalize
–
The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.
- When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Resolved Caveats in Cisco IOS Release 12.2(53)SG5
This section lists the resolved caveats in Release 12.2(53)SG5:
- When you specify a proxy ACL ACE with an extra space, the proxy ACL is not programmed for authenticated and authorized hosts.
–
–
- When reconnecting to a switch using IP device tracking, a Windows Vista, Windows 2008, or Windows 2007 device registers a duplicate address message.
Workaround: Disable gratuitous ARP on the Windows device. CSCtn27420
–
–
Workaround: Disable AAA accounting. CSCtl77241
- When IP SLA probes are configured and active for a period of 72 weeks, and you poll the rttmon mib for probe statistics, the router reloads.
The problem is not observed for another 72 weeks.
- If a device is connected to multiple ports on the switch and no ip routing is configured, ARP entries display in an incorrect VLAN (pv vlan appears in the entry).
Workaround: Configure ip routing. CSCtj20399
- When a switch is using 802.X with web authentication, and you open an http session, you see a login screen using http, rather than https.
This happens only if you use a custom banner configured like the following:
Workaround: Remove the custom banner. CSCtb77378
- If you change the authentication method for a client to webauth before removing the fallback configuration, web authentication is triggered.
–
–
- LLDP packets are sent (.1q) tagged when the native VLAN of the of the dot1q trunk is not the default (VLAN 1).
LLDP IEEE standard requires frames sent untagged. With this issue, some peer devices may reject the tagged LLDP frame.
Workaround: Use the default native VLAN for the trunks. CSCtn29321
- When a redundant power supply is turned off, ciscoEnvMonAlarmContacts returns 00 even though the LED on the supervisor engine is orange.
Workaround: If you include snmp-server enable traps envmon in the device configuration, a ciscoEnvMonSuppStatusChangeNotification is generated when the power supply either turns off or fails. CSCtl72109
- A switch might crash if ip cef accounting non-recursive is configured and BGP routes are being supplied.
Workaround: Disable IP cef accounting. CSCtn68186
–
–
- A power supply can be listed as removed, but continues to function normally. This behavior is illustrated by the following system messages:
%C4K_CHASSIS-3-INSUFFICIENTPOWERSUPPLIESDETECTED: Insufficient power supplies present for specified configuration
- High CPU results from constant MAC learning when multiple REP rings are used, each with a different VLAN list.
Workaround: Ensure that all trunk ports in the REP ring topology have the same list of VLANs, including ports in other REP rings that export STCNs into the REP ring where the problem is observed. CSCto67625
- DHCP clients renewing through a load-balanced DHCP relay on an unnumbered interface may be unable to renew their lease because the renew ACK is lost.
Workaround: Avoid using DHCP load balancing. CSCth00482
- If a switch is configured for multiple authentication host-mode, and an interface on that switch is configured for 802.1X, that interface disallows unidirectional port control, breaking the functionality of Wake on LAN.
Workaround: Use a different host-mode. CSCti92970
Workaround: Allow SSH connections only from trusted hosts. CSCth87458
- If you provide extra space anywhere in between while specifying a proxy ACL ACE, the proxy ACL is not programmed for authenticated and authorized hosts.
–
–
- In multi-auth mode, when you disconnect a PC behind a Cisco IP phone, the data session is not removed.
This behavior is anticipated. In multi-auth mode, the system cannot distinguish between the data client that is attached to the phone and those that are attached to the switch through a hub.
- A switch crashes when you use no set extcommunity cost to remove set extcommunity cost in a route-map and you enter show run.
Workaround: Remove the entire route-map and re-create it. CSCsr23563
- On a SSH and telnet-configured switch, if you configure a banner, then SSH to the router, the banner shows incorrectly:
Here is how you configured the banner:
If you telnet to the router, the banner shows correctly as follows:
- After you boot a reloaded switch in a REP ring topology, the soon-to-be alternate port forwards traffic and causes a loop. This continues until you enter shut and no shut on the alternate port.
Workaround: Enter shut and no shut on the alternate interface. CSCtn03533
- If a static route is configured for an RP address that is reachable from a directly connected network, the switch does not send a PIM register toward the RP.
Workaround: Avoid configuring overlapping IP addresses. CSCtj96095
Open Caveats in Cisco IOS Release 12.2(53)SG4
This section lists the open caveats in Cisco IOS Release 12.2(53)SG4:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command.
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct.
- On a switch running Cisco IOS Release 12.2(52)SG, the Auto Install feature does not work on the management port. The auto process status aborts.
Workaround: Configure the DHCP server on the same vrf; add the configuration vrf mgmtVrf to
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
- If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
- The following messages are displayed when you load an supported version of Catalyst 4500 software on WS-C4507R+E and WS-C4510R+E and none of the ports come up:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4507R-E, but chassis' serial eeprom chassis type is Unknown chassis type%C4K_CHASSIS-2-MUXBUFFERTYPENOTSUPPORTED: Mux Buffer in slot <n> of unsupported type 14" (where n is a slot number)Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
- A proxy ACL is not programmed for authenticated and authorized hosts, when you specify a proxy ACL ACE with an extra space
–
–
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on the console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you load software images earlier than Cisco IOS Release 12.2(53)SG4, 12.54(SG) or 15.0(1)SG on a redundant WS-C4510R+E or WS-C4507R+E chassis, the active supervisor engines displays the following log message:
%C4K_CHASSIS-3-CHASSISTYPEMISMATCHINSPROM: Supervisor's FPGA register chassis type is WS-C4510R-E, but chassis' serial eeprom chassis type is Unknown chassis typeThe active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
%C4K_REDUNDANCY-2-POSTFAIL_RESET: Power-On Self Test (POST) failure on ACTIVE supervisor detected. Detected the Standby Supervisor bootupFailedWhile active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
%AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (Unknown MAC) on Interface Gi5/39 AuditSessionID AC156241000000670001BC9.provided the following conditions apply:
–
authentication event server dead action authorize...
authenticaton event server alive action reinitalize
–
The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.
- When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Resolved Caveats in Cisco IOS Release 12.2(53)SG4
This section lists the resolved caveats in Release 12.2(53)SG4:
- If you are using a large custom Webauth login page on a switch running Cisco IOS Release 12.2(53)SG3 or IOS-XE 3.1.0 SG and multiple user are trying to access custom HTML pages, the switch might reload.
Workaround: Unconfigure the customized HTML page to use default internal Webauth pages and reload the switch after changing the configuration. CSCti81874
- When you remove an SFP+ from a OneX converter in a X2 slot, it takes roughly 45 seconds for the system to recognize this. Any commands during this time will indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can result in Duplicate Seeprom error message.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
–
–
Open Caveats in Cisco IOS Release 12.2(53)SG3
This section lists the open caveats in Cisco IOS Release 12.2(53)SG3:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- When you remove an SFP+ from a OneX converter in a X2 slot, it takes roughly 45 seconds for the system to recognize this. Any commands during this time will indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can result in Duplicate Seeprom error message.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
–
–
–
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command.
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct.
- On a switch running Cisco IOS Release 12.2(52)SG, the Auto Install feature does not work on the management port. The auto process status aborts.
Workaround: Configure the DHCP server on the same vrf; add the configuration vrf mgmtVrf to
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
- If you observe a periodic increase in call or packet drops and a constant decrease in free memory available in your switch, you could use the show memory debug leak command. However, this command is CPU intensive; it might tear down your call or data session if used on live network.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
- If you are using a large custom Webauth login page on a switch running Cisco IOS Release 12.2(53)SG3 or IOS-XE 3.1.0 SG and multiple user are trying to access custom HTML pages, the switch might reload.
Workaround: Unconfigure the customized HTML page to use default internal Webauth pages and reload the switch after changing the configuration. CSCti81874
%AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (Unknown MAC) on Interface Gi5/39 AuditSessionID AC156241000000670001BC9.provided the following conditions apply:
–
authentication event server dead action authorize...
authenticaton event server alive action reinitalize
–
The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.
- When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Resolved Caveats in Cisco IOS Release 12.2(53)SG3
This section lists the resolved caveats in Release 12.2(53)SG3:
- When you configure switchport block multicast on a switch running
Cisco IOS Release 12.2(53)SG1 or 12.2(50)SG6, Layer 2 multicast is not blocked.Prior to Cisco IOS Release 12.2(53)SG1, 12.2(50)SG6, the switchport block multicast command would block IP Multicast, Layer 2 multicast, and broadcast traffic (CSCta61825).
- A switch crashes if a PBR policy, configured to match on prefix-list(s) instead of ACL(s), is attached to an interface.
This happens provided on the following conditions apply:
–
–
Workaround: Configure the route map for PBR to only match on ACLs. CSCtg22126
- Under SSH configuration, when using access-class vty-login in, you cannot telnet on an interfaces in a VRF. SSH is still avail but not enabled. As documented, if the vrf-also keyword is not used in access-class, the SSH to interface in VRF will not work.
After upgrading to Cisco IOS Release 12.2(53)SG3, ensure that the vrf-also keyword follows any access-class under the SSH configuration.
Open Caveats in Cisco IOS Release 12.2(53)SG2
This section lists the open caveats in Cisco IOS Release 12.2(53)SG2:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- When you remove an SFP+ from a OneX converter in a X2 slot, it takes roughly 45 seconds for the system to recognize this. Any commands during this time will indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can result in Duplicate Seeprom error message.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
–
–
–
Workaround: None. (CSCsv42869)
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command.
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct.
- On a switch running Cisco IOS Release 12.2(52)SG, the Auto Install feature does not work on the management port. The auto process status aborts.
Workaround: Configure the DHCP server on the same vrf; add the configuration vrf mgmtVrf to
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
- When you configure switchport block multicast on a switch running
Cisco IOS Release 12.2(53)SG1 or 12.2(50)SG6, Layer 2 multicast is not blocked.Prior to Cisco IOS Release 12.2(53)SG1, 12.2(50)SG6, the switchport block multicast command would block IP Multicast, Layer 2 multicast, and broadcast traffic (CSCta61825).
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
- A switch crashes if a PBR policy, configured to match on prefix-list(s) instead of ACL(s), is attached to an interface.
This happens provided on the following conditions apply:
–
–
Workaround: Configure the route map for PBR to only match on ACLs.
%AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (Unknown MAC) on Interface Gi5/39 AuditSessionID AC156241000000670001BC9.provided the following conditions apply:
–
authentication event server dead action authorize...
authenticaton event server alive action reinitalize
–
The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.
- When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Resolved Caveats in Cisco IOS Release 12.2(53)SG2
This section lists the resolved caveats in Release 12.2(53)SG2:
- A 802.1X port enabled for multi-authentication might not begin learning the MAC address of a successfully authenticated phone.
Workaround: Configure the port in multi-domain mode (rather than multi-auth mode) with the authentication host-mode multi-domain command
- A PBR policy is not honored on a Supervisor Engine 6 running Cisco IOS Release 12.2(53)SG or 12.2(52)SG. Packets are forwarded through the normal routing table instead of through policy based routing.
This is a side effect of a heavily shared path.
- Upon upgrading to Cisco IOS Releases 12.2(52)SG, 12.2(52)XO, 12.2(53)SG, or 12.2(53)SG1, if the flash device name differs from the default name flash:, you might observe the following message continuously on your console:
Workaround: Rename the flash device to the default name flash:.
- MAC learning does not work with Guest VLAN, Wake-on-LAN, and port security. When these features are enabled simultaneously in an interface, MAC learning does not work; none of the packets are forwarded.
You will need to disableWake-on-LAN on the interface.
Workaround: Reconfigure tracking on the newly created interface. (CSCsr66876)
- When a PVLAN isolated port is connected to a router serving as a multicast source, and you enable igmp snooping, the routers connected to the isolated ports display as PIM neighbors.
Workaround: Do one of the following:
–
–
–
Workarounds: Do one of the following:
–
–
- After a .1X port is enabled for Guest VLAN, if you shut down the port connected to the RADIUS server so that the server goes dead and EAPOL packets are sent on that port, it is authorized in the access VLAN although the server is unreachable.
Workaround: Enter shut, then no shut on the port.
- When a switch enabled for explicit host tracking runs IGMPv3, ports that stopped sending IGMPv3 reports are displayed in the IGMPv3 table until a timeout. This behavior didn’t exist in Cisco IOS Release 12.2(50)SG.
Workaround: Disable explicit host tracking in the affected VLANs.
- A switch running Cisco IOS Release 12.2(53)SG displays the message
%C4K_EBM-4-HOSTFLAPPING: happening between master loopback port and the source port during layer3 (IPv4 and IPv6) packets loop using ethernet oam (EOAM)This message is does not impact performance.
- EnergyWise is enabled and you use the energywise level level recurrence importance importance at minute hour day_of_month month day_of_week interface configuration command to configure a recurring event on a switch. After the time changes from daylight savings time to standard time, the switch might
–
–
This occurs when the time change for the next year occurs after the time change for the current year.
Before the time change occurs, use one of these workarounds:
–
–
–
This problem is observed on images later than Cisco IOS Release 12.2(46)SG.
Open Caveats in Cisco IOS Release 12.2(53)SG1
This section lists the open caveats in Cisco IOS Release 12.2(53)SG1:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- If you configure OFM on an Etherchannel (with at least two interfaces), when you shut or remove the first member that joined the channel, the CFM neighbor is lost.
Workaround: Clear the errors with the clear ethernet cfm errors command in EXEC mode. (CSCsv43819)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
Workarounds: Do one of the following:
–
–
- When you remove an SFP+ from a OneX converter in a X2 slot, it takes roughly 45 seconds for the system to recognize this. Any commands during this time will indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can result in Duplicate Seeprom error message.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
–
–
–
- When a PVLAN isolated port is connected to a router serving as a multicast source, and you enable igmp snooping, the routers connected to the isolated ports display as PIM neighbors.
Workaround: Do one of the following:
–
–
–
Workaround: Reconfigure tracking on the newly created interface. (CSCsr66876)
Workaround: None. (CSCsv42869)
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command.
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- When the ports connecting a RADIUS server and a client are placed in different VLANs, and you enter the ip radius source-interface command and perform two SSO switchovers, the authenticated session is lost.
Workaround: Re-authenticate the client.
- When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
- When an access-list is attached to an interface under extreme hardware resource exhaustion, the ACL may not be automatically loaded into the hardware even if hardware resources later become available.
No TCAM entries are available for the new access-list.
Workaround: Manually remove and reapply the ACL after freeing hardware TCAM resources by removing or shortening other classification policies on the switch.
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct.
- On a switch running Cisco IOS Release 12.2(52)SG, the Auto Install feature does not work on the management port. The auto process status aborts.
Workaround: Configure the DHCP server on the same vrf; add the configuration vrf mgmtVrf to
- After a .1X port is enabled for Guest VLAN, if you shut down the port connected to the RADIUS server so that the server goes dead and EAPOL packets are sent on that port, it is authorized in the access VLAN although the server is unreachable.
Workaround: Enter shut, then no shut on the port.
- When a switch enabled for explicit host tracking runs IGMPv3, ports that stopped sending IGMPv3 reports are displayed in the IGMPv3 table until a timeout. This behavior didn’t exist in Cisco IOS Release 12.2(50)SG.
Workaround: Disable explicit host tracking in the affected VLANs.
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
- A 802.1X port enabled for multi-authentication might not begin learning the MAC address of a successfully authenticated phone.
Workaround: Configure the port in multi-domain mode (rather than multi-auth mode) with the authentication host-mode multi-domain command
- When you configure switchport block multicast on a switch running
Cisco IOS Release 12.2(53)SG1 or 12.2(50)SG6, Layer 2 multicast is not blocked.Prior to Cisco IOS Release 12.2(53)SG1, 12.2(50)SG6, the switchport block multicast command would block IP Multicast, Layer 2 multicast, and broadcast traffic (CSCta61825).
- A switch running Cisco IOS Release 12.2(53)SG displays the message
%C4K_EBM-4-HOSTFLAPPING: happening between master loopback port and the source port during layer3 (IPv4 and IPv6) packets loop using ethernet oam (EOAM)This message is does not impact performance.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- EnergyWise is enabled and you use the energywise level level recurrence importance importance at minute hour day_of_month month day_of_week interface configuration command to configure a recurring event on a switch. After the time changes from daylight savings time to standard time, the switch might
–
–
This occurs when the time change for the next year occurs after the time change for the current year.
Before the time change occurs, use one of these workarounds:
–
–
–
- Upon upgrading to Cisco IOS Releases 12.2(52)SG, 12.2(52)XO, 12.2(53)SG, or 12.2(53)SG1, if the flash device name differs from the default name flash:, you might observe the following message continuously on your console:
Workaround: Rename the flash device to the default name flash:.
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
%AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (Unknown MAC) on Interface Gi5/39 AuditSessionID AC156241000000670001BC9.provided the following conditions apply:
–
authentication event server dead action authorize...
authenticaton event server alive action reinitalize
–
The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.
- When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Resolved Caveats in Cisco IOS Release 12.2(53)SG1
This section lists the resolved caveats in Release 12.2(53)SG1:
- When a service-policy is attached to a port-channel and that service-policy is configured to match CPU generated packets, the classification statistics do not increment for the CPU generated packets.
Workaround: Configure an access-list to permit the CPU generated packets and apply the ACL to the class-map.
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- If many ARP entries (47k) exist and you clear the ARP table, the system reloads and the switch crashes with the message:
Downgrade to Cisco IOS Release 12.2(50)SG3 if needed.
- If you enable VTP pruning after a switch is moved to VTP version 3, VLAN pruning does not happen on the trunks.
Workaround: Change the VTP version from 3 to version 2 or 1 and then revert to version 3.
- On a switch running Cisco IOS Release 12.2(50)SG or 12.2(52)SG, when an 802.1X port configured with PVLAN community VLAN receives a new PVLAN assignment from the AAA server, resetting the configuration on this interface may cause the switch to reload.
- When the vlan-port state changes on flexlink ports, the following two messages appear on the console:
A syslog warning message "%SM-4-BADEVENT: Event 'forward' is invalid for the current state 'present': pm_vp .."This issue happens only on flexlink ports under the following two scenarios:
–
–
The syslog and Traceback do not impact functionality. Flexlink states end up with correct states and there is no impact on traffic forwarding.
- Per vlan-port error disable features (dhcp-rate-limit and arp-inspection) do not work on flexlink (without VLAN load balancing). When a violation occurs on the Active link, the corresponding vlan-port will not be error disabled.
The existing per-port error disable (that is, when a violation happens, the entire port will be error disabled) still works on flexlink.
Workaround: Use flexlink with VLAN load balancing.
If you do not want to use vlan load balancing, then enter the
switchport backup interface perfer vlan command on the Active interface, where vlan z is set to an unused vlan on the system
- If a switch running Cisco IOS Release 12.2(52)SG receives MPLS packets, SA miss and host learning will cause high CPU.
–
Open Caveats in Cisco IOS Release 12.2(53)SG
This section lists the open caveats in Cisco IOS Release 12.2(53)SG:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- If you configure OFM on an Etherchannel (with at least two interfaces), when you shut or remove the first member that joined the channel, the CFM neighbor is lost.
Workaround: Clear the errors with the clear ethernet cfm errors command in EXEC mode. (CSCsv43819)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
Workarounds: Do one of the following:
–
–
- When you remove an SFP+ from a OneX converter in a X2 slot, it takes roughly 45 seconds for the system to recognize this. Any commands during this time will indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can result in Duplicate Seeprom error message.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
–
–
–
- When a PVLAN isolated port is connected to a router serving as a multicast source, and you enable igmp snooping, the routers connected to the isolated ports display as PIM neighbors.
Workaround: Do one of the following:
–
–
–
Workaround: Reconfigure tracking on the newly created interface. (CSCsr66876)
Workaround: None. (CSCsv42869)
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command.
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- When the ports connecting a RADIUS server and a client are placed in different VLANs, and you enter the ip radius source-interface command and perform two SSO switchovers, the authenticated session is lost.
Workaround: Re-authenticate the client.
- When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
- If you enable VTP pruning after a switch is moved to VTP version 3, VLAN pruning does not happen on the trunks.
Workaround: Change the VTP version from 3 to version 2 or 1 and then revert to version 3.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
- When an access-list is attached to an interface under extreme hardware resource exhaustion, the ACL may not be automatically loaded into the hardware even if hardware resources later become available.
No TCAM entries are available for the new access-list.
Workaround: Manually remove and reapply the ACL after freeing hardware TCAM resources by removing or shortening other classification policies on the switch.
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct.
- On a switch running Cisco IOS Release 12.2(52)SG, the Auto Install feature does not work on the management port. The auto process status aborts.
Workaround: Configure the DHCP server on the same vrf; add the configuration vrf mgmtVrf to
- On a switch running Cisco IOS Release 12.2(50)SG or 12.2(52)SG, when an 802.1X port configured with PVLAN community VLAN receives a new PVLAN assignment from the AAA server, resetting the configuration on this interface may cause the switch to reload.
- After a .1X port is enabled for Guest VLAN, if you shut down the port connected to the RADIUS server so that the server goes dead and EAPOL packets are sent on that port, it is authorized in the access VLAN although the server is unreachable.
Workaround: Enter shut, then no shut on the port.
- When a switch enabled for explicit host tracking runs IGMPv3, ports that stopped sending IGMPv3 reports are displayed in the IGMPv3 table until a timeout. This behavior didn’t exist in Cisco IOS Release 12.2(50)SG.
Workaround: Disable explicit host tracking in the affected VLANs.
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
- On a Layer 2 port (that is, a switchport) of Supervisor Engine II+ thru V-10GE, the
|auto qos voice trust command auto generates qos trust cos configuration, in addition to other parameters. However, when the port is converted from Layer 2 to Layer 3 with the no switchport command, the qos trust dscp command should be generated.Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
- When the vlan-port state changes on flexlink ports, the following two messages appear on the console:
A syslog warning message "%SM-4-BADEVENT: Event 'forward' is invalid for the current state 'present': pm_vp .."This issue happens only on flexlink ports under the following two scenarios:
–
–
The syslog and Traceback do not impact functionality. Flexlink states end up with correct states and there is no impact on traffic forwarding.
- Per vlan-port error disable features (dhcp-rate-limit and arp-inspection) do not work on flexlink (without VLAN load balancing). When a violation occurs on the Active link, the corresponding vlan-port will not be error disabled.
The existing per-port error disable (that is, when a violation happens, the entire port will be error disabled) still works on flexlink.
Workaround: Use flexlink with VLAN load balancing.
If you do not want to use vlan load balancing, then enter the
switchport backup interface perfer vlan command on the Active interface, where vlan z is set to an unused vlan on the system
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If a switch running Cisco IOS Release 12.2(52)SG receives MPLS packets, SA miss and host learning will cause high CPU.
–
–
- EnergyWise is enabled and you use the energywise level level recurrence importance importance at minute hour day_of_month month day_of_week interface configuration command to configure a recurring event on a switch. After the time changes from daylight savings time to standard time, the switch might
–
–
This occurs when the time change for the next year occurs after the time change for the current year.
Before the time change occurs, use one of these workarounds:
–
–
–
- Upon upgrading to Cisco IOS Releases 12.2(52)SG, 12.2(52)XO, 12.2(53)SG, or 12.2(53)SG1, if the flash device name differs from the default name flash:, you might observe the following message continuously on your console:
Workaround: Rename the flash device to the default name flash:.
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
%AUTHMGR-7-RESULT: Authentication result 'success' from 'dot1x' for client (Unknown MAC) on Interface Gi5/39 AuditSessionID AC156241000000670001BC9.provided the following conditions apply:
–
authentication event server dead action authorize...
authenticaton event server alive action reinitalize
–
The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.
- When a trunk port is configured with a native VLAN other than VLAN 1, REP packets are not sent on that VLAN.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Resolved Caveats in Cisco IOS Release 12.2(53)SG
This section lists the resolved caveats in Release 12.2(53)SG:
- Entering shut/no shut on the port after configuring port-security vp err disable and a violation occurs.
–
–
–
- When port-security is configured on normal trunks carrying primary and secondary private VLANs, its configuration can be erased from the running-config under the following circumstances:
Entering shut/no shut on the port after deleting a secondary VLAN.
–
–
Open Caveats in Cisco IOS Release 12.2(52)SG
This section lists the open caveats in Cisco IOS Release 12.2(52)SG:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- If you configure OFM on an Etherchannel (with at least two interfaces), when you shut or remove the first member that joined the channel, the CFM neighbor is lost.
Workaround: Clear the errors with the clear ethernet cfm errors command in EXEC mode. (CSCsv43819)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
Workarounds: Do one of the following:
–
–
- When you remove an SFP+ from a OneX converter in a X2 slot, it takes roughly 45 seconds for the system to recognize this. Any commands during this time will indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can result in Duplicate Seeprom error message.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
–
–
–
- When a PVLAN isolated port is connected to a router serving as a multicast source, and you enable igmp snooping, the routers connected to the isolated ports display as PIM neighbors.
Workaround: Do one of the following:
–
–
–
Workaround: Reconfigure tracking on the newly created interface. (CSCsr66876)
Workaround: None. (CSCsv42869)
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When .1X with MDA is set in host mode and guest VLAN is enabled, when you pump traffic from a traffic generator at a high rate, a Security violation is wrongly flagged.
- When you enter the show adjacency x.x.x.x internal command for an adjacency, the packet counters are increment correctly but the byte counters remain 0.
- When you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command.
- On a redundant switch running Cisco IOS Release 12.2(52)SG, after a ports is authorized through 802.1X, the show dot1x interface statistics command may display empty values on the standby supervisor engine.
The statistics are displayed properly on the active supervisor.
- When the ports connecting a RADIUS server and a client are placed in different VLANs, and you enter the ip radius source-interface command and perform two SSO switchovers, the authenticated session is lost.
Workaround: Re-authenticate the client.
- When multiple streams of CRC errors are encountered on a WS-C4900M chassis configured with OAM monitoring of frame errored seconds, OAM does not report the value of errored frame seconds correctly if you configure the following CLIs:
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
- If you enable VTP pruning after a switch is moved to VTP version 3, VLAN pruning does not happen on the trunks.
Workaround: Change the VTP version from 3 to version 2 or 1 and then revert to version 3.
- When you request an on demand Call Home message send without specifying a profile name & the specified module returns an unknown diagnostic result, the following error message displays:
*Jan 3 01:54:24.471: %CALL_HOME-3-ONDEMAND_MESSAGE_FAILED: call-home on-demand message failed to send (ERR 18, The alert group is not subscribed)Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
- When an access-list is attached to an interface under extreme hardware resource exhaustion, the ACL may not be automatically loaded into the hardware even if hardware resources later become available.
No TCAM entries are available for the new access-list.
Workaround: Manually remove and reapply the ACL after freeing hardware TCAM resources by removing or shortening other classification policies on the switch.
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.The queue transmit counters as well as the policing statistics (if any) are correct.
- On a switch running Cisco IOS Release 12.2(52)SG, the Auto Install feature does not work on the management port. The auto process status aborts.
Workaround: Configure the DHCP server on the same vrf; add the configuration vrf mgmtVrf to
- On a switch running Cisco IOS Release 12.2(50)SG or 12.2(52)SG, when an 802.1X port configured with PVLAN community VLAN receives a new PVLAN assignment from the AAA server, resetting the configuration on this interface may cause the switch to reload.
- After a .1X port is enabled for Guest VLAN, if you shut down the port connected to the RADIUS server so that the server goes dead and EAPOL packets are sent on that port, it is authorized in the access VLAN although the server is unreachable.
Workaround: Enter shut, then no shut on the port.
- When a switch enabled for explicit host tracking runs IGMPv3, ports that stopped sending IGMPv3 reports are displayed in the IGMPv3 table until a timeout. This behavior didn’t exist in Cisco IOS Release 12.2(50)SG.
Workaround: Disable explicit host tracking in the affected VLANs.
- When you configure EnergyWise power control on PoE ports with a time-based execution schedule, time entry executes without adjusting for daylight savings time.
Workaround: Manually re-enter all entries with new time settings.
- On wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS. Specifically, the IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
- When port-security is configured on normal trunks carrying primary and secondary private VLANs, its configuration can be erased from the running-config under the following circumstances:
Entering shut/no shut on the port after deleting a secondary VLAN. (CSCsz73895)
–
–
Entering shut/no shut on the port after configuring port-security vp err disable and a violation occurs. (CSCsz80415)
–
–
–
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If a switch running Cisco IOS Release 12.2(52)SG receives MPLS packets, SA miss and host learning will cause high CPU.
–
–
- EnergyWise is enabled and you use the energywise level level recurrence importance importance at minute hour day_of_month month day_of_week interface configuration command to configure a recurring event on a switch. After the time changes from daylight savings time to standard time, the switch might
–
–
This occurs when the time change for the next year occurs after the time change for the current year.
Before the time change occurs, use one of these workarounds:
–
–
–
- Upon upgrading to Cisco IOS Releases 12.2(52)SG, 12.2(52)XO, 12.2(53)SG, or 12.2(53)SG1, if the flash device name differs from the default name flash:, you might observe the following message continuously on your console:
Workaround: Rename the flash device to the default name flash:.
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
Resolved Caveats in Cisco IOS Release 12.2(52)SG
This section lists the resolved caveats in Release 12.2(52)SG:
- Under control place policing, control plane classes (the classes that are auto created by the
macro global apply system-cpp command and use predefined ACLs to match traffic) increment both their packet and byte count. So, both counters are non-zero.In contrast, data plane classes (the classes that are configured manually by user written ACLs), the byte counter increments as expected, but the packet count remains 0.
- On a Catalyst 4500, if an isolated private VLAN trunk interface flaps, the ingress and egress per-port per-vlan service policies are no longer applied on the port.
This impacts Cisco IOS Releases 12.2(31)SGA08, 12.2(37)SG, 12.2(40)SG, 12.2(44)SG, 12.2(46)SG, 12.2(50)SG, and 12.2(50)SG1.
For a Classic Series Supervisor Engine, disable and configure QoS on the port.
For example, to configure Gig 2/1 as an isolated private VLAN trunk port, do the following:
You can configure the following EEM script to automate this workaround. QoS will be disabled and re-enabled whenever a port flaps.
- When you run an SNMP (getmany) query on cbQosPoliceStatsTable and cbQosREDClassStatsTable with a single SSH window (session), CPU utilization achives 99 per cent. If you query cbQosPoliceStatsTable and cbQosREDClassStatsTable from 18 SSH sessions, a CPU-HOG error message displays.
Workaround: None, other than stopping the query.
- On a supervisor engine running Cisco IOS Release 12.2(50)SG or later releases with one or more ports configured for single-host mode, MAB, and authentication control-direction in, hosts are not authenticated through MAB when a port is configured for single-host mode and you enter the unidirectional control in command (Wake-on-LAN).
Workaround: Disable the authentication control-direction in command.
If you require authentication control-direction in, configure the port for multi-authentication or Multi-Domain Authentication (MDA).
- On a redundant switch running Cisco IOS Releases 12.2(50)SG or 12.2(50)SG1 where
802.1X VVID and port security are configured on a port, CDP MAC from the non 802.1X capable Cisco IP phone might not be added to the port security table on the standby supervisor engine.This problem is fixed in Cisco IOS Releases 12.2(50)SG2 and 12.2(52)SG.
- On a switch running Cisco IOS Release 12.2(50)SG or 12.2(50)SG1 where 802.1X VVID and port security are configured on a port, inserting a non 802.1X capable Cisco IP phone with LLDP capability and a PC behind it may trigger a security violation.
Workaround: Turn off LLDP (on the switch) and the phone (from Call Manager).
This problem is fixed in 12.2(50)SG2 and 12.2(52)SG.
The key pieces of data are "VECTOR 0" and a MCSR value of 40000000, 20000000, or 10000000.
Workaround: Enter the show platform cpu cache command to launch an IOS algorithm that detects and recovers from parity errors in the CPU's cache. You will obtain a running count of the number of CPU cache parity errors that have been successfully detected and corrected on a running system:
- On a switch running Cisco IOS Release12.2(50)SG, supplicants authorized on PVLAN in multi-auth host mode are not moved to an Unauthorized state when the PVLAN is removed.
This problem occurs only when a port is configured with PVLAN and 802.1X multi-auth.
Workaround: Shut down then reopen the interface. (CSCsr58573)
- The switch does not accept the snmp mib target list vrf command. This CLI is rejected even if the vrf is present in the DUT.
Workaround: None. (CSCsr95941)
- When the switch port configured with 802.1X Multi-Domain Authentication (MDA) and Guest VLAN is connected to a non-802.1X supplicant PC through a hub, the port falls back to guest VLAN. Subsequently, it is stuck in the guest VLAN and ignores all EAPOL traffic from another 802.1X supplicant PC connected to the hub.
Workaround: None. (CSCsu42775)
- The switch may reload after destroying the expExpressionTable row via SNMP when you enable the debug management expression evaluator command.
Workaround: Remove the above debug command. (CSCsu67323)
- A router may crash when a privilege-level 15 user logs on with the callback or callback-dialstring attribute.
'This problem is seen on all Catalyst 4500 or 4900 chassis running Cisco IOS Release 12.2.(50)SG. The problem occurs when the following conditions are present:
–
–
–
Workarounds: Do not configure the callback or callback-dialstring attribute for the user. If you use the callback-dialstring attribute in the TACACS+ profile, ensure that the NULL value is not configured. (CSCei62358)
- When you attempt an ISSU upgrade or downgrade between Cisco IOS Release 12.2(50)SG and 12.2(44)SG or 12.2(46)SG, the switch displays a traceback.
Workaround: None. (CSCsw32519)
- Entering the channel-group x mode or channel-protocol followed by lacp or pagp command on an fa1 management interface causes the active supervisor engine to reload.
Port-channel functionality is not supported on the management interface.
This is a configuration error.
Workaround: None. (CSCsv91302)
- On classic series supervisors and Supervisor Engine 6-E running Cisco IOS Release 12.2(50)SG and later releases, egress traffic is not allowed on ports configured for Wake-on-LAN (through the authentication control-direction in command) and Multi-domain Authentication (MDA) (through the authentication host-mode multi-domain command) before the port is authorized.
This problem is first seen in 12.2(40)SG.
Workaround: Manually apply the configuration that is generated by AutoQoS. Do not use Auto QoS. CSCsv03316
- An Unhandled Rommon Exception occurs while booting a WS-X4013+10GE for Cisco IOS Releases 12.2(31)SGA8, 12.2(31)SGA9, 12.2(46)SG, 12.2(46)SG1, 12.2(50)SG, 12.2(50)SG1.
Workaround: Upgrade to ROMMON version 1.2(31r)SGA4.
Workaround: Reapply the identity policy on the interface with the permit icmp command. (CSCsu03507
- When you use a WCCPv2 service group employing promiscuous TCP mode on an interface, the switch redirects GRE traffic to one of the WAAS devices in the group.
Workaround: Remove the WCCP redirection.
If the WAAS device drops this unexpected GRE traffic, the WCCP service group with promiscuous mode cannot be used on the interface. Conversely, if the WAAS device returns the traffic to the switch, the switch routes it normally to the original destination.
- On a switch running Cisco IOS 12.2(52)SG, when a port configured with 802.1X enters per vp errdisable mode because of a violation triggered by port security, DAI, DHCP snooping, or BPDU guard, the port’s 802.1X sessions are not cleared despite the linkdown.
Do not configure 802.1X with other per vp errdisable features.
This problem is first seen in Cisco IOS Release 12.2(40)SG.
Workaround: Manually apply the configuration that would be generated by Auto QoS.
Open Caveats in Cisco IOS Release 12.2(50)SG8
This section lists the open caveats in Cisco IOS Release 12.2(50)SG8:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- If you configure OFM on an Etherchannel (with at least two interfaces), when you shut or remove the first member that joined the channel, the CFM neighbor is lost.
Workaround: Clear the errors with the clear ethernet cfm errors command in EXEC mode. (CSCsv43819)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- When the switch port configured with 802.1X Multi-Domain Authentication (MDA) and Guest VLAN is connected to a non-802.1X supplicant PC through a hub, the port falls back to guest VLAN. Subsequently, it is stuck in the guest VLAN and ignores all EAPOL traffic from another 802.1X supplicant PC connected to the hub.
Workaround: None. (CSCsu42775)
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- When you remove an SFP+ from a OneX converter in a X2 slot, it takes roughly 45 seconds for the system to recognize this. Any commands during this time will indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can result in Duplicate Seeprom error message.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
–
–
–
Workaround: Reconfigure tracking on the newly created interface. (CSCsr66876)
- The switch may reload after destroying the expExpressionTable row via SNMP when you enable the debug management expression evaluator command.
Workaround: Remove the above debug command. (CSCsu67323)
Workaround: None. (CSCsv42869)
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
Resolved Caveats in Cisco IOS Release 12.2(50)SG8
This section lists the resolved caveats in Release 12.2(50)SG8:
- The switch does not accept the snmp mib target list vrf command. This CLI is rejected even if the vrf is present in the DUT.
Workaround: None. (CSCsr95941)
Workaround: Configure the route map to only match on ACL(s).
Open Caveats in Cisco IOS Release 12.2(50)SG7
This section lists the open caveats in Cisco IOS Release 12.2(50)SG7:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- If you configure OFM on an Etherchannel (with at least two interfaces), when you shut or remove the first member that joined the channel, the CFM neighbor is lost.
Workaround: Clear the errors with the clear ethernet cfm errors command in EXEC mode. (CSCsv43819)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- When the switch port configured with 802.1X Multi-Domain Authentication (MDA) and Guest VLAN is connected to a non-802.1X supplicant PC through a hub, the port falls back to guest VLAN. Subsequently, it is stuck in the guest VLAN and ignores all EAPOL traffic from another 802.1X supplicant PC connected to the hub.
Workaround: None. (CSCsu42775)
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
- When you remove an SFP+ from a OneX converter in a X2 slot, it takes roughly 45 seconds for the system to recognize this. Any commands during this time will indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can result in Duplicate Seeprom error message.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
–
–
–
- The switch does not accept the snmp mib target list vrf command. This CLI is rejected even if the vrf is present in the DUT.
Workaround: None. (CSCsr95941)
Workaround: Reconfigure tracking on the newly created interface. (CSCsr66876)
- The switch may reload after destroying the expExpressionTable row via SNMP when you enable the debug management expression evaluator command.
Workaround: Remove the above debug command. (CSCsu67323)
Workaround: None. (CSCsv42869)
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
Workaround: Configure the route map to only match on ACL(s).
Resolved Caveats in Cisco IOS Release 12.2(50)SG7
This section lists the resolved caveats in Release 12.2(50)SG7:
This problem is observed on images later than Cisco IOS Release 12.2(46)SG.
- A PBR policy is not honored on a Supervisor Engine 6 running Cisco IOS Release 12.2(53)SG or 12.2(52)SG. Packets are forwarded through the normal routing table instead of through policy based routing.
This is a side effect of a heavily shared path.
- In Cisco IOS Releases 12.2(50)SG, 12.2(52)SG and 12.2(53)SG, some GBICs may be deemed incompatible after you upgrade to 12.2(50)SG. The following message may be displayed:
Workarounds: Do one of the following
–
–
- When a PVLAN isolated port is connected to a router serving as a multicast source, and you enable igmp snooping, the routers connected to the isolated ports display as PIM neighbors.
Workaround: Do one of the following:
–
–
–
Workarounds: Do one of the following:
–
–
- On a Catalyst 4900 series switch running Cisco IOS Release 12.2(46)SG and later versions, if you enter the clear port-security dynamic interface fastethernet1 command, the switch reloads.
Do not enter this command if port security is not configured on the interface.
Open Caveats in Cisco IOS Release 12.2(50)SG6
This section lists the open caveats in Cisco IOS Release 12.2(50)SG6:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- If you configure OFM on an Etherchannel (with at least two interfaces), when you shut or remove the first member that joined the channel, the CFM neighbor is lost.
Workaround: Clear the errors with the clear ethernet cfm errors command in EXEC mode. (CSCsv43819)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- When the switch port configured with 802.1X Multi-Domain Authentication (MDA) and Guest VLAN is connected to a non-802.1X supplicant PC through a hub, the port falls back to guest VLAN. Subsequently, it is stuck in the guest VLAN and ignores all EAPOL traffic from another 802.1X supplicant PC connected to the hub.
Workaround: None. (CSCsu42775)
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
Workarounds: Do one of the following:
–
–
- When you remove an SFP+ from a OneX converter in a X2 slot, it takes roughly 45 seconds for the system to recognize this. Any commands during this time will indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can result in Duplicate Seeprom error message.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
–
–
–
- The switch does not accept the snmp mib target list vrf command. This CLI is rejected even if the vrf is present in the DUT.
Workaround: None. (CSCsr95941)
- The switch does not accept the snmp mib target list vrf command. This CLI is rejected even if the vrf is present in the DUT.
Workaround: None. (CSCsr95941)
- When a PVLAN isolated port is connected to a router serving as a multicast source, and you enable igmp snooping, the routers connected to the isolated ports display as PIM neighbors.
Workaround: Do one of the following:
–
–
–
Workaround: Reconfigure tracking on the newly created interface. (CSCsr66876)
- The switch may reload after destroying the expExpressionTable row via SNMP when you enable the debug management expression evaluator command.
Workaround: Remove the above debug command. (CSCsu67323)
Workaround: None. (CSCsv42869)
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- On a Catalyst 4900 series switch running Cisco IOS Release 12.2(46)SG and later versions, if you enter the clear port-security dynamic interface fastethernet1 command, the switch reloads.
Do not enter this command if port security is not configured on the interface.
Do not enter this command on fa1.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for C4900M, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
Resolved Caveats in Cisco IOS Release 12.2(50)SG6
This section lists the resolved caveats in Release 12.2(50)SG6:
- If many ARP entries (47k) exist and you clear the ARP table, the system reloads and the switch crashes with the message:
Downgrade to Cisco IOS Release 12.2(50)SG3 if needed.
- ARP entries learned on PVLAN SVIs are not aged out even if the no ip sticky arp command is configured globally.
ARP entries learned on normal SVIs are unaffected.
Workaround: Clear these ARP entries with the clear ip arp command.
- When port security and ARP inspection are configured together, the first ARP packet from a host, which is connected to the switch, could bypass the ARP inspection and be bridged out mistakenly.
Workaround: Disable port security.
- When you exit policy-map configuration mode without making changes to a policy-map on a switch configured with a service-policy for QoS, configuring an output service policy on an EtherChannel interface causes a link flap.
Workarounds: Configure identical policy-maps with different names so that each EtherChannel has its own policy. This action restricts the effect of this link flap to a limited number of EtherChannels.
Open Caveats in Cisco IOS Release 12.2(50)SG4
This section lists the open caveats in Cisco IOS Release 12.2(50)SG4:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- If you configure OFM on an Etherchannel (with at least two interfaces), when you shut or remove the first member that joined the channel, the CFM neighbor is lost.
Workaround: Clear the errors with the clear ethernet cfm errors command in EXEC mode. (CSCsv43819)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
- On a Catalyst 4500 switch running 12.2(50)SG, when the access VLAN is deleted and then restored on a port configured with 802.1x multi-auth, authorized 802.1X clients cannot pass traffic because the spanning tree remains in a Disabled state after the access VLAN is restored.
This problem occurs when an 802.1X client is authorized on a multi-auth port. After the access VLAN is deleted, then restored, the client is reauthorized but the spanning tree state of the access VLAN remains Disabled.
Workaround: Shut down then reopen the interface.
- When the switch port configured with 802.1X Multi-Domain Authentication (MDA) and Guest VLAN is connected to a non-802.1X supplicant PC through a hub, the port falls back to guest VLAN. Subsequently, it is stuck in the guest VLAN and ignores all EAPOL traffic from another 802.1X supplicant PC connected to the hub.
Workaround: None. (CSCsu42775)
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, users will not see the VLAN updates on the other switches in the VTP domain.
Workaround: For VTP database propagation, configure ISL/dot1q trunk port. (CSCsu43445)
Workarounds: Do one of the following:
–
–
- When you remove an SFP+ from a OneX converter in a X2 slot, it takes roughly 45 seconds for the system to recognize this. Any commands during this time will indicate that the SFP+ is still present. Reinserting the SFP+ in another port or inserting another SFP+ in the same port can result in Duplicate Seeprom error message.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
–
–
–
- The switch does not accept the snmp mib target list vrf command. This CLI is rejected even if the vrf is present in the DUT.
Workaround: None. (CSCsr95941)
- The switch does not accept the snmp mib target list vrf command. This CLI is rejected even if the vrf is present in the DUT.
Workaround: None. (CSCsr95941)
- When a PVLAN isolated port is connected to a router serving as a multicast source, and you enable igmp snooping, the routers connected to the isolated ports display as PIM neighbors.
Workaround: Do one of the following:
–
–
–
Workaround: Reconfigure tracking on the newly created interface. (CSCsr66876)
- The switch may reload after destroying the expExpressionTable row via SNMP when you enable the debug management expression evaluator command.
Workaround: Remove the above debug command. (CSCsu67323)
Workaround: None. (CSCsv42869)
- If VLAN Load Balancing is progressing, and you reconfigure VLAN Load Balancing to reflect different blocking ports, manual preemption does not occur.
Workaround: To reconfigure VLAN Load Balancing with a different configuration, do the following:
a.
b.
c.
d.
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.101 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8%SM-4-BADEVENT: Event 'eouAAAAuthor' is invalid for the current state 'eou_abort': eou_auth 4.1.0.102 Traceback= 101D9A88 10B76BB0 10B76FE0 10B7A114 10B7A340 1066A678 106617F8This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SGWorkaround: None. (CSCsw14005)
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- Class-map hit counters do not increment on the egress policy-map when it is attached to the primary VLAN on a PVLAN trunk ports. However, the traffic is properly classified and the actions configured in the policy are applied properly.
- On a Catalyst 4900 series switch running Cisco IOS Release 12.2(46)SG and later versions, if you enter the clear port-security dynamic interface fastethernet1 command, the switch reloads.
Do not enter this command if port security is not configured on the interface.
Do not enter this command on fa1.
- When using dynamic policy installation for a client or host that is authenticated on a secure port, the traffic from the client is not permitted even though the permit ip any any command is specified as the dynamic policy for the client.
This occurs only if the following conditions are satisfied:
–
–
–
Resolved Caveats in Cisco IOS Release 12.2(50)SG4
This section lists the resolved caveats in Release 12.2(50)SG4:
- A router may crash when a privilege-level 15 user logs on with the callback or callback-dialstring attribute.
'This problem is seen on all Catalyst 4500 or 4900 chassis running Cisco IOS Release 12.2.(50)SG. The problem occurs when the following conditions are present:
–
–
–
Workarounds: Do not configure the callback or callback-dialstring attribute for the user. If you use the callback-dialstring attribute in the TACACS+ profile, ensure that the NULL value is not configured. (CSCei62358)
- On a switch running Cisco IOS Release12.2(50)SG, supplicants authorized on PVLAN in multi-auth host mode are not moved to an Unauthorized state when the PVLAN is removed.
This problem occurs only when a port is configured with PVLAN and 802.1X multi-auth.
Workaround: Shut down then reopen the interface. (CSCsr58573)
Workaround: Reapply the identity policy on the interface with the permit icmp command. (CSCsu03507
This problem is first seen in 12.2(40)SG.
Workaround: Manually apply the configuration that is generated by AutoQoS. Do not use Auto Qos. CSCsv03316
- Entering the channel-group x mode or channel-protocol followed by lacp or pagp command on an fa1 management interface causes the active supervisor engine to reload.
Port-channel functionality is not supported on the management interface.
This is a configuration error.
Workaround: None. (CSCsv91302)
- When you attempt an ISSU upgrade or downgrade between Cisco IOS Release 12.2(50)SG and 12.2(44)SG or 12.2(46)SG, the switch displays a traceback.
Workaround: None. (CSCsw32519)
- On classic series supervisors and Supervisor Engine 6-E running Cisco IOS Release 12.2(50)SG and later releases, egress traffic is not allowed on ports configured for Wake-on-LAN (through the authentication control-direction in command) and Multi-domain Authentication (MDA) (through the authentication host-mode multi-domain command) before the port is authorized.
- Cisco IOS Software configured with Authentication Proxy for HTTP(S), Web Authentication or the consent feature, contains a vulnerability that may allow an unauthenticated session to bypass the authentication proxy server or bypass the consent webpage.
There are no workarounds that mitigate this vulnerability.
- Cisco IOS Software contains a vulnerability that could allow an attacker to cause a Cisco IOS device to reload by remotely sending a crafted encryption packet. Cisco has released free software updates that address this vulnerability. CSCsq24002
- Cisco devices running affected versions of Cisco IOS Software are vulnerable to a denial of service (DoS) attack if configured for IP tunnels and Cisco Express Forwarding.
Cisco has released free software updates that address this vulnerability.
This problem is first seen in Cisco IOS Release 12.2(40)SG.
Workaround: Manually apply the configuration that would be generated by Auto QoS.
Open Caveats in Cisco IOS Release 12.2(50)SG2
This section lists the open caveats in Cisco IOS Release 12.2(50)SG2:
- In rare instances, when you are using MAC ACL-based policers, the packet match counters in
show policy-map interface fa6/1 do not show the packets being matched:Workaround: Verify that the MAC addresses being transmitted through the system are learned.
- When you issue the ip http secure-server command (or if the system reads it from the startup configuration), the device will check for the existence of a persistent self-signed certificate during boot up.
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
- After upgrading to Cisco IOS 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release.
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG and later releases.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
- An IP redirect may not be sent out if the outgoing interface on a Catalyst 4500 series switch is an IP unnumbered port.
This could occur for these reasons:
–
–
–
–
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you configure
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
- When hardcoded duplex and speed settings are deleted after an interface shuts down, an "a-" is added to the duplex and speed in the output from the show interface status command.
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message is displayed and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
- When traffic is sent on a VLAN ID higher than 3000, the convergence timing caused by a failure exceeds 225ms.
Workaround: None. (CSCsm30320)
Workaround: None. (CSCsq72572)
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with HWCOPP (HW Control Plane Policing).
Workaround: None. (CSCso93282)
Workarounds: Do one of the following:
–
–
–
- In SSO mode, when a port-channel is created, deleted, and re-created on an active supervisor engine with the same channel-number, the standby port-channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the portchannel, create a new channel. (CSCsr00333)
- During an ISSU upgrade or downgrade from v122_31_sg_throttle to v122_46_sg_throttle, the following error message displays on console of the active supervisor engine:
Workaround: None. (CSCso68331)
- When you configure ip source binding statically on an interface, and then remove linecard on which the interface resides, the entries are not removed from the running config.
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
- If you configure OFM on an Etherchannel (with at least two interfaces), when you shut or remove the first member that joined the channel, the CFM neighbor is lost.
Workaround: Clear the errors with the clear ethernet cfm errors command in EXEC mode. (CSCsv43819)
- Duplicate serial number error messages are reported on switching One X Convertor with SFP+, SFP+, X2 to another port, the inserted port enters a faulty status.
This problem impacts X2, OneX converters, and SFP+ on the Supervisor Engine 6-E, and linecards.
Workaround: Remove and reinsert the One X Convertor with SFP+, SFP+ alone, or X2 after some perceivable delay. (CSCsu43461)
Workaround: Reapply the identity policy on the interface with the permit icmp command. (CSCsu03507