Release Notes for the Catalyst 4500 Series Switch, Cisco IOS Releases 12.2(54)SGx and 12.2(53)SGx
Cisco IOS Software Packaging for the Cisco Catalyst 4500 Series
Catalyst 4500 Series Switch Cisco IOS Release Strategy
Cisco IOS Software Migration Guide
Supported Hardware on Catalyst 4500 Series Switch
Supported Hardware on Catalyst 4500 E-Series Switch
Supported Features on the Catalyst 4500 Series Switch
Features Unique to Supervisor Engines 6-E and 6L-E
New Hardware Features in Release12.2(54)SG1
New Software Features in Release12.2(54)SG1
New Hardware Features in Release12.2(54)SG
New Software Features in Release12.2(54)SG
New Hardware Features in Release 12.2(53)SG6
New Software Features in Release 12.2(53)SG6
New Hardware Features in Release 12.2(53)SG5
New Software Features in Release 12.2(53)SG5
New Hardware Features in Release 12.2(53)SG4
New Software Features in Release 12.2(53)SG4
New Hardware Features in Release12.2(53)SG3
New Software Features in Release12.2(53)SG3
New Hardware Features in Release12.2(53)SG2
New Software Features in Release12.2(53)SG2
New Hardware Features in Release12.2(53)SG1
New Software Features in Release12.2(53)SG1
New Hardware Features in Release12.2(53)SG
New Software Features in Release12.2(53)SG
New Hardware Features in Release12.2(52)XO
New Software Features in Release12.2(52)XO
New Hardware Features in Release12.2(52)SG
New Software Features in Release12.2(52)SG
New Hardware Features in Release 12.2(50)SG3
New Software Features in Release 12.2(50)SG3
New Hardware Features in Release 12.2(50)SG2
New Software Features in Release 12.2(50)SG2
New Hardware Features in Release12.2(50)SG1
New Software Features in Release12.2(50)SG1
New Hardware Features in Release12.2(50)SG
New Software Features in Release12.2(50)SG
New Hardware Features in Release12.2(46)SG
New Software Features in Release12.2(46)SG
New Hardware Features in Release12.2(44)SG
New Software Features in Release12.2(44)SG
New Hardware Features in Release12.2(40)SG
New Software Features in Release12.2(40)SG
Identifying an +E Chassis and ROMMON
Guidelines for Upgrading the ROMMON
Upgrading the Supervisor Engine ROMMON from the Console
Upgrading the Supervisor Engine ROMMON Remotely Using Telnet
Upgrading the Cisco IOS Software
For Supervisor Engines II+Plus through V-10GE
For Supervisor Engine 6-E and Supervisor Engine 6L-E
Open Caveats for Cisco IOS Release 12.2(54)SG1
Resolved Caveats in Cisco IOS Release 12.2(54)SG1
Open Caveats for Cisco IOS Release 12.2(54)SG
Resolved Caveats in Cisco IOS Release 12.2(54)SG
Open Caveats for Cisco IOS Release 12.2(53)SG11
Resolved Caveats for Cisco IOS Release 12.2(53)SG11
Open Caveats for Cisco IOS Release 12.2(53)SG10
Resolved Caveats in Cisco IOS Release 12.2(53)SG10
Open Caveats for Cisco IOS Release 12.2(53)SG9
Resolved Caveats in Cisco IOS Release 12.2(53)SG9
Open Caveats for Cisco IOS Release 12.2(53)SG8
Resolved Caveats in Cisco IOS Release 12.2(53)SG8
Open Caveats for Cisco IOS Release 12.2(53)SG7
Resolved Caveats in Cisco IOS Release 12.2(53)SG7
Open Caveats for Cisco IOS Release 12.2(53)SG6
Resolved Caveats in Cisco IOS Release 12.2(53)SG6
Open Caveats for Cisco IOS Release 12.2(53)SG5
Resolved Caveats in Cisco IOS Release 12.2(53)SG5
Open Caveats for Cisco IOS Release 12.2(53)SG4
Resolved Caveats in Cisco IOS Release 12.2(53)SG4
Open Caveats for Cisco IOS Release 12.2(53)SG3
Resolved Caveats in Cisco IOS Release 12.2(53)SG3
Open Caveats for Cisco IOS Release 12.2(53)SG2
Resolved Caveats in Cisco IOS Release 12.2(53)SG2
Open Caveats for Cisco IOS Release 12.2(53)SG1
Resolved Caveats in Cisco IOS Release 12.2(53)SG1
Open Caveats for Cisco IOS Release 12.2(53)SG
Resolved Caveats in Cisco IOS Release 12.2(53)SG
Open Caveats for Cisco IOS Release 12.2(52)XO
Resolved Caveats in Cisco IOS Release 12.2(52)XO
Open Caveats for Cisco IOS Release 12.2(52)SG
Resolved Caveats in Cisco IOS Release 12.2(52)SG
Open Caveats for Cisco IOS Release 12.2(50)SG8
Resolved Caveats in Cisco IOS Release 12.2(50)SG8
Open Caveats for Cisco IOS Release 12.2(50)SG7
Resolved Caveats in Cisco IOS Release 12.2(50)SG7
Open Caveats for Cisco IOS Release 12.2(50)SG6
Resolved Caveats in Cisco IOS Release 12.2(50)SG6
Open Caveats for Cisco IOS Release 12.2(50)SG5
Resolved Caveats in Cisco IOS Release 12.2(50)SG5
Open Caveats for Cisco IOS Release 12.2(50)SG4
Resolved Caveats in Cisco IOS Release 12.2(50)SG4
Open Caveats for Cisco IOS Release 12.2(50)SG3
Resolved Caveats in Cisco IOS Release 12.2(50)SG3
Open Caveats for Cisco IOS Release 12.2(50)SG2
Resolved Caveats in Cisco IOS Release 12.2(50)SG2
Open Caveats for Cisco IOS Release 12.2(50)SG1
Resolved Caveats in Cisco IOS Release 12.2(50)SG1
Open Caveats in Cisco IOS Release 12.2(50)SG
Resolved Caveats in Cisco IOS Release 12.2(50)SG
Open Caveats in Cisco IOS Release 12.2(46)SG
Resolved Caveats in Cisco IOS Release 12.2(46)SG
Open Caveats in Cisco IOS Release 12.2(44)SG1
Resolved Caveats in Cisco IOS Release 12.2(44)SG1
Open Caveats in Cisco IOS Release 12.2(44)SG
Resolved Caveats in Cisco IOS Release 12.2(44)SG
Open Caveats in Cisco IOS Release 12.2(40)SG
Resolved Caveats in Cisco IOS Release 12.2(40)SG
Troubleshooting at the System Level
Obtaining Documentation and Submitting a Service Request
Current Release
12.2(53)SG11—August 18, 2014
Previous Releases
12.2(54)SG1, 12.2(54)SG, 12.2(53)SG10, 12.2(53)SG9, 12.2(53)SG8, 12.2(53)SG7, 12.2(53)SG6, 12.2(53)SG5, 12.2(53)SG4, 12.2(53)SG3, 12..2(53)SG2, 12.2(53)SG1, 12.2(53)SG, 12.2(52)XO, 12.2(52)SG, 12.2(50)SG8, 12.2(50)SG7, 12.2(50)SG6, 12.2(50)SG5, 12.2(50)SG4, 12.2(50)SG3, 12.2(50)SG2, 12.2(50)SG1, 12.2(50)SG, 12.2(46)SG, 12.2(44)SG1, 12.2(44)SG, 12.2(40)SG
These release notes describe the features, modifications, and caveats for the Cisco IOS software on the Catalyst 4500 series switch. The most current software release is Cisco IOS Release 12.2(54)SG.
Support for Cisco IOS Software Release 12.2(54SG, the default image, follows the standard Cisco Systems® support policy, available at
http://www.cisco.com/en/US/products/products_end-of-life_policy.html
Note Although their Release Notes are unique, the 4 platforms (Catalyst 4500, Catalyst 4900,
Catalyst ME 4900, and Catalyst 4900M/4948E) use the same Software Configuration Guide, Command Reference Guide, and System Message Guide.
For more information on the Catalyst 4500 series switches, visit the following URL:
http://www.cisco.com/go/cat4500/docs
This publication consists of these sections:
A new Cisco IOS Software package for Cisco Catalyst 4500 Series Switches was introduced in Cisco IOS Software Release 12.2(25)SG. It is a new foundation for features and functionality and provides consistency across all Cisco Catalyst switches. The new Cisco IOS Software release train is designated as 12.2SG.
Prior Cisco Catalyst 4500 Series IOS Software images for the Cisco Catalyst 4500 Series Switches, formerly known as Basic Layer 3 and Enhanced Layer 3, now map to IP Base and Enterprise Services, respectively. All currently shipping Cisco Catalyst 4500 software features based on Cisco IOS Software are supported in the IP Base image of Release 12.2(54)SG, with a few exceptions.
The IP Base image does not support enhanced routing features such as NSF/SSO, BGP, EIGRP, EIGRPv6, OSPF, OSPFv3, IS-IS, Internetwork Packet Exchange (IPX), AppleTalk, VRF-lite, and Policy-Based Routing (PBR). The IP Base image supports EIGRP-Stub for limited routing on Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, V-10GE, and 6-E.
The Enterprise Services image supports all Cisco Catalyst 4500 Series software features based on Cisco IOS Software, including enhanced routing. Customers planning to enable BGP for Supervisor Engine IV, V, or V-10GE will no longer need to purchase a separate BGP license (FR-IRC4) because BGP is included in the Enterprise Services package. Beginning with 12.2(53)SG2, we support the Enterprise Services image on Supervisor Engine 6L-E.
Cisco IOS Release 12.2(46)SG1 introduced a new LAN Base software and an IP upgrade image. These complement the existing IP Base and Enterprise Services images. The LAN base image is supported on the Supervisor Engine II-Plus-10GE and Supervisor Engine 6L-E starting with
Cisco IOS Release 12.2(52)XO. LAN Base image is primarily focused on customer access and Layer 2 requirements and therefore many of the IP Base features are not required. The IP upgrade image is available if at a later date you require some of those features.
Table 1 contrasts feature support on the LAN Base vs IP Base images.
For information on MiBs support, pls refer to this URL:
http://ftp.cisco.com/pub/mibs/supportlists/cat4000/cat4000-supportlist.html
Cisco IOS Release 12.2SG train offers the latest features for the Catalyst 4500 Series supervisor engines. Customers with Catalyst 4500 Series supervisor engines who need the latest hardware support and software features should migrate to Cisco IOS Release 12.2(54)SG.
Note As part of the Cisco IOS Reformation effort, Cisco IOS Releases 12.2EW and 12.2SG are the same release train with a name change.
Catalyst 4500 Series has three maintenance trains. The Cisco IOS Release 12.2(31)SGA train is the longest living train. Currently, the Cisco IOS Release 12.2(31)SGA8 is the recommended release for customers who require a release with a maintenance train.The Cisco IOS Release 12.2(53)SG is the latest maintenance train and includes the most recent features including support for the WS-X45-Sup6L-E supervisor engine and OSPF for routed Access.
For more information on the Catalyst 4500 series switches, visit the following URL:
http://www.cisco.com/go/cat4500/docs
Figure 1 displays the two active, 12.2(31)SGA and 12.2(50)SG, and newly introduced 12.2(53)SG extended maintenance trains.
Figure 1 Software Release Strategy for the Catalyst 4500 Series Switch
Support for Cisco IOS Software Release 12.2(54)SG follows the standard Cisco Systems® support policy, available at
http://www.cisco.com/en/US/products/products_end-of-life_policy.html
This section describes the system requirements:
Table 2 lists the hardware supported on the Catalyst 4500 Series Switch.
For Catalyst 4500 transciever module compatibility information, see the url:
http://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html
Table 3 briefly describes the four chassis in the Catalyst 4500 Series Switch. For the chassis listed in the table, refer to Table 6 for software release information.
In addition to the classic line cards and supervisor engines, Cisco IOS Software Release 12.2(54)SG supports the next-generation high-performance E-Series Supervisor Engine 6-E with CenterFlex technology and E-Series line cards and chassis. A brief list of primary E-Series hardware supported on Catalyst 4500 series switch ( Table 5 ).
Table 6 outlines the chassis and supervisor engine compatibility.
(M=Minimum release, R=Recommended release)
Table 7 lists the Cisco IOS software features for the Catalyst 4500 Series Switch.
Storm Control: Per-Port Multicast Suppression (Sup 6-E only) |
Multicast Storm Control1 |
Layer 2 transparent bridging2 |
Layer 2 MAC3 learning, aging, and switching by software |
VMPS4 Client |
Private VLAN trunks5 |
ISL6-based VLAN encapsulation (excluding blocking ports on WS-X4418-GB and WS-X4412-2GB-T)7 |
No. of VLAN support per switch: 2048 (for LAN Base), 4096 (for IP Base) |
802.1Q Tunneling (Q in Q)8 |
ANCP Client9 |
Bidiectional PIM10 |
IP and IP multicast routing and switching between Ethernet ports |
IP Multicast Load Splitting (Equal Cost Multipath (ECMP) using S, G and Next-hop) |
Classless routing11 |
PBR12 |
Cisco Modular QoS Command-Line Interface (Sup 6-E and Sup 6L-E only) |
CEF13 load balancing |
uRPF14 (Sup 6-E and Sup 6L-E only) |
Multicast VRF-lite15 |
Route Leaking16 |
IS-IS17 |
DTP18 |
RIP19 and RIP II |
EIGRP20 |
OSPF21 |
OSPF for Routed Access22 |
BGP423 |
MBGP24 |
MSDP25 |
ICMP26 Router Discovery Protocol |
PIM27—sparse and dense mode |
DVMRP28 |
NTP29 |
VRRP30 |
SCP31 |
GLBP32 |
Load balancing for routed traffic, based on source and destination IP addresses |
Link Layer Discovery Protocol Media Endpoint Discovery (LLDP-MED) |
Authentication, authorization, and accounting using TACACS+ and RADIUS protocol |
Selecting Mode of Capturing Control Packets (Not supported on Sup 6-E) |
HSRP33 over Ethernet, EtherChannels - 10/100/1000Mbps, 10 Gbps |
IGMP snooping version1, version 2, and version 3 (Full Support) |
SSH version 1 and version 234 |
UDLR35 |
SNMP36 version 1, version 2, and version 3 |
IPv6 Multicast Listener Discovery Snooping (Sup 6-E and 6L-E only) |
DHCP Relay Agent for IPv6 37 |
802.1X Multiple Domain Authentication and Multiple Authorization |
PPPoE Intermediate Agent38 |
Cisco NAC39 Layer 2 802.1X |
Router standard and extended ACLs 40on all ports with no performance penalty |
Identity 4.1 ACL Policy Enforcement41 |
PACL42 |
Dynamic Multi-Protocol Ternary Content Addressable Memory (Sup 6-E and Sup 6L-E only) |
Per-port QoS43 rate-limiting and shaping |
PoE44 |
Enhanced Power over Ethernet Support (Sup 6-E and Sup 6L-E only) |
RPR45 |
SSO46 |
Non-stop Forwarding Awareness for EIGRP-stub in IP base for all supervisor engines |
ISSU47 |
OSPF and EIGRP Fast Convergence48 |
CNA49 |
CLI to turn off Auto MDIX50 |
Service-Aware Resource Allocation (Sup 6-E and Sup 6L-E only) |
High Availability: 2+2 10GE or 4+4 1GE active uplinks (Sup 6-E only) |
EEM51 |
IP/SLA52 |
Embedded management53 |
Eight configurable queues per port (Sup 6-E and Sup 6L-E only) |
OBFL54 |
DHCPv6 Relay - Persistent Interface ID option DHCPv6 Relay Agent notification for Prefix Delegation |
PIM Accept Register - Rogue Multicast Server Protection55 |
Fa1 interface (Ethernet management port)56 |
With Cisco IOS Release 12.2(54)SG, the following features are available only with
Supervisor Engine 6-E and Supervisor Engine 6L-E:
– IPv6 Addressing Architecture
– DNS resolver for AAAA over an IPv4 transport
– DNS resolver for AAAA over an IPv6 transport
– ISATAP (supported in software only)
– MLD Snooping (supported in software and hardware on Catalyst 4900M, Catalyst 4948E, Supervisor Engine 6-E, and Catalyst 6L-E)
– Two Rate three Color Policing
– Table map support for marking
– Class based queuing actions (shaping/bandwidth/queue-limit/dbl/strict priority)
For all Supervisor Engines (II-Plus thru 6-E), the following features are not supported in Cisco IOS Release 12.2(54)SG for the Catalyst 4500 series switches:
– Standard Xerox Network System (XNS) access list
– Protocol type-code access list
– <1200-1299> IPX summary address access list
These sections describe the new and changed information for the Catalyst 4500 series switch running Cisco IOS software:
Release 12.2(54)SG1 provides the following new hardware on the Catalyst 4500 series switch:
Release 12.2(54)SG provide no new software features on the Catalyst 4500 series switch.
Release 12.2(54)SG provides the following new hardware on the Catalyst 4500 series switch:
Release 12.2(54)SG provides the following new software features on the Catalyst 4500 series switch:
For details, refer to the URL:
http://www.cisco.com/en/US/docs/switches/datacenter/sw/5_x/nx-os/system_management/configuration/guide/sm_12eem.html
For details refer to the URL:
http://www.cisco.com/en/US/docs/ios/saf/configuration/guide/saf_cg.html
For details refer to the URL:
http://www.cisco.com/en/US/docs/switches/lan/energywise/phase2/ios/configuration/guide/ew_v2.html
For details refer to the URL:
http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_xmlpi_v1.html
Release 12.2(53)SG6 provides no new hardware for the Catalyst 4500 series switch.
Release 12.2(53)SG6 provides no new features for the Catalyst 4500 series switch.
Release 12.2(53)SG5 provides no new hardware for the Catalyst 4500 series switch.
Release 12.2(53)SG5 provides no new features for the Catalyst 4500 series switch.
Release 12.2(53)SG4 provides the following new hardware on the Catalyst 4500 series switch:
Release 12.2(53)SG4 provides no new features for the Catalyst 4500 series switch.
Release 12.2(53)SG3 provides the following new hardware on the Catalyst 4500 series switch:
Note This set of optics is not supported on Cisco IOS Release 12.2(54)SG and Cisco IOS XE Release 3.1.0 SG. However, the same set of optics is supported on Cisco IOS Release 15.0(2)SG and Cisco IOS XE Release 3.2.0(SG).
Release 12.2(53)SG3 provides no new features for the Catalyst 4500 series switch.
Release 12.2(53)SG2 provides no new hardware for the Catalyst 4500 series switch.
Release 12.2(53)SG2 provides no new features for the Catalyst 4500 series switch.
Release 12.2(53)SG1 provides no new hardware for the Catalyst 4500 series switch.
Release 12.2(53)SG1 provides no new features for the Catalyst 4500 series switch.
Release 12.2(53)SG does not provide any new hardware for the Catalyst 4500 series switch. However, it does integrate Supervisor Engine 6L-E, introduced in 12.2(52)XO.
Release 12.2(53)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:
OSPF for Routed Access is designed specifically to enable customers to extend Layer 3 routing capabilities to the access or Wiring Closet.
Note OSPF for Routed Access supports only one OSPFv2 and one OSPFv3 instance with a maximum number of 200 dynamically learned routes.
With the typical topology (hub and spoke) in a campus environment, where the wiring closets (spokes) are connected to the distribution switch (hub) forwarding all nonlocal traffic to the distribution layer, the wiring closet switch need not hold a complete routing table. A best practice design, where the distribution switch sends a default route to the wiring closet switch to reach inter-area and external routes (OSPF stub or totally stub area configuration) should be used when OSPF for Routed Access is used in the wiring closet.
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/54sg/configuration/guide/automacr.html
The OSPF for Routed Access feature adheres to the following software restrictions:
– Limit the number of OSPF instances to one on OSPFv2 and one on OSPFv3.
– Limit number of dynamic routes learned through platform dependant work to 200.
Refer to the following link for more details:
http://www.cisco.com/en/US/docs/solutions/Enterprise/Campus/routed-ex.html
With Cisco IOS Release 12.2(53)SG, the IP Base image supports OSPF for routed access. The Enterprise Services image is required if you need multiple OSPFv2 and OSPFv3 instances without route restrictions. Additionally, Enterprise Services is required to enable the VRF-lite feature.
Release 12.2(52)XO provides the following new hardware for the Catalyst 4500 series switch:
Note Only supported on 3, 6, and 7 slot chassis and IP LAN and IP BASE images
Note This release is equivalent in functionality to 12.2(52)SG, but adds support for the new Sup6L-E supervisor. The only supervisor engine it supports is Supervisor Engine 6L-E; for all other supervisor engines, use 12.2(52)SG instead.
Release 12.2(52)XO provides the following Cisco IOS software features for the Catalyst 4500 series switch:
– DHCPv6 Ethernet Remote ID option
– DHCPv6 Relay - Persistent Interface ID option DHCPv6 Relay Agent notification for Prefix Delegation
Release 12.2(52)SG provides the following new hardware for the Catalyst 4500 series switch:
Release 12.2(52)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:
– DHCPv6 Ethernet Remote ID option
– DHCPv6 Relay - Persistent Interface ID option DHCPv6 Relay Agent notification for Prefix Delegation
Release 12.2(50)SG3 provides the following hardware for the Catalyst 4500 series switch:
Hot-swappable input/output (I/O) converter module that fits into a 10-Gigabit Ethernet X2 slot on a switch or line card module. Hosts one 10-Gigabit Ethernet SFP+ transceiver module.
Release 12.2(50)SG3 provides no new features for the Catalyst 4500 series switch.
Release 12.2(50)SG2 provides no new hardware for the Catalyst 4500 series switch.
Release 12.2(50)SG2 provides no new features for the Catalyst 4500 series switch.
Release 12.2(50)SG1 provides no new hardware for the Catalyst 4500 series switch.
Release 12.2(50)SG1 provides the following Cisco IOS software features for the Catalyst 4500 series switch:
For information on EEM, see the URL:
http://www.cisco.com/en/US/products/ps6815/products_ios_protocol_group_home.html
Note In addition to the classic line cards and supervisor engines, Cisco IOS Software Release 12.2(50)SG supports the next-generation high-performance E-Series Supervisor Engine 6-E with CenterFlex technology and E-Series line cards and chassis.
Release 12.2(50)SG provides the following new hardware for the Catalyst 4500 series switch:
Release 12.2(50)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:
Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.
Note The implementation for multiple spanning tree (MST) changed from the previous release. Multiple STP (MSTP) complies with the IEEE 802.1s standard. Previous MSTP implementations were based on a draft of the IEEE 802.1s standard.
Note The link up/down information in the CDP Second Port Status TLV (added by the Cisco IP Phones Host Movement Detection enhancement) allows the switch to de-authenticate devices which were previously authenticated. The phone must have firmware release 8.1(1) or later to generate this CDP TLV.
For more information, refer to the following URLs:
http://www.cisco.com/en/US/docs/switches/lan/trustsec/configuration/guide/trustsec.html
Note In addition to the classic line cards and supervisor engines, Cisco IOS Software Release 12.2(46)SG supports the next-generation high-performance E-Series Supervisor Engine 6-E with CenterFlex technology and E-Series line cards and chassis.
Release 12.2(46)SG provides the following new hardware for the Catalyst 4500 series switch:
Release 12.2(46)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:
Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.
– 802.1X Critical Authentication
On all the Supervisor Engines (II-Plus thru 6-E)
– Reliable Backup Static Routing with EOT
Note The implementation for multiple spanning tree (MST) changed from the previous release. Multiple STP (MSTP) complies with the IEEE 802.1s standard. Previous MSTP implementations were based on a draft of the IEEE 802.1s standard.
Note In addition to the classic line cards and supervisor engines, Cisco IOS Software Release 12.2(44)SG supports the next-generation high-performance E-Series Supervisor Engine 6-E with CenterFlex technology and E-Series line cards and chassis.
Release 12.2(44)SG provides the following new hardware for the Catalyst 4500 series switch:
Release 12.2(44)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:
Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.
On all the Supervisor Engines (II-Plus thru 6-E)
For details, refer to the EEM Home Page:
http://www.cisco.com/en/US/products/ps6815/products_ios_protocol_group_home.html
For details, refer to the ESM Home Page:
http://www.cisco.com/en/US/docs/ios/12_3t/12_3t2/feature/guide/gt_esm.html
After configuring VSS dual-active on a Catalyst 6500 switches, the Catalyst 4500 series switch can detect VSS dual-active with PagP+ support.
Note The implementation for multiple spanning tree (MST) changed from the previous release. Multiple STP (MSTP) complies with the IEEE 802.1s standard. Previous MSTP implementations were based on a draft of the IEEE 802.1s standard.
Note In addition to the classic line cards and supervisor engines, Cisco IOS Software Release 12.2(40)SG supports the next-generation high-performance E-Series Supervisor Engine 6-E with CenterFlex technology and E-Series line cards and chassis.
A brief list of primary E-Series hardware supported by Cisco IOS Release 12.2(40)SG includes the following:
Release 12.2(40)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:
Note The following chapter references are for the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.
Only available on Supervisor Engine 6-E
Only available on Supervisor Engines II-Plus thru V-10GE
Available on all Supervisor Engines (II-Plus thru 6-E)
Note The implementation for multiple spanning tree (MST) changed from the previous release. Multiple STP (MSTP) complies with the IEEE 802.1s standard. Previous MSTP implementations were based on a draft of the IEEE 802.1s standard.
In most cases, upgrading the switch to a newer release of Cisco IOS software does not require a ROMMON upgrade. However, if you are running an early release of Cisco IOS software and plan to upgrade, refer to the following tables for the minimum Cisco IOS image and the recommended ROMMON release, respectively.
Note You must upgrade to ROMMON Release 12.2(44r)SG5 to run Cisco IOS Release 12.2(54)SG on the Supervisor Engine 6-E and Supervisor Engine 6L-E.
The following sections describe how to upgrade your switch software:
An +E chassis is identified by a FRU minor value in the chassis' idprom.
When supervisor engine 1 (sup1) is in ROMMON and supervisor engine 2 (sup2) is in IOS, only sup2 can read the idprom contents of chassis’ idprom. Chassis type is displayed as “+E” in the output of the show version command. Conversely, sup1 can only display the chassis type as “E.”
When both sup1 and sup2 are in ROMMON, both engines can read the chassis’ idprom. Chassis type is displayed correctly as “+E” in the output of the show version command.
When both sup1 and sup2 are in IOS, both engines can read the chassis’ idprom. Chassis type is displayed correctly as “+E” in the output of the show version command.
Note The examples in this section use the programmable read-only memory (PROM) upgrade version 12.1(20r)EW1 and Cisco IOS Release 12.1(20)EW1. For other releases, replace the ROMMON release and Cisco IOS software release with the appropriate releases and filenames.
Follow this procedure to upgrade your supervisor engine ROMMON:
Step 1 Directly connect a serial cable to the console port of the supervisor engine.
Note This section assumes that the console baud rate is set to 9600 (default). If you want to use a different baud rate, change the configuration register value for your switch.
Step 2 Download the cat4000-ios-promupgrade-121_20r_EW1 program from Cisco.com, and place it on a TFTP server in a directory that is accessible from the switch that is upgraded.
The cat4000-ios-promupgrade-121_20r_EW1 programs are available on Cisco.com at the same location from which you download Catalyst 4000 system images.
Step 3 Use the dir bootflash: command to ensure that there is sufficient space in Flash memory to store the PROM upgrade image. If there is insufficient space, delete one or more images, and then enter the
squeeze bootflash: command to reclaim the space.
If you are using a CompactFlash card, replace bootflash: with slot0:.
Step 4 Download the cat4000-ios-promupgrade-121_20r_EW1 program into Flash memory using the copy tftp command.
The following example shows how to download the PROM upgrade image cat4000-ios-promupgrade-121_20r_EW1 from the remote host 172.20.58.78 to bootflash:
Step 5 Enter the reload command to reset the switch, press Ctrl-C to stop the boot process, and re-enter ROMMON.
The following example shows the output after a reset into ROMMON:
Step 6 Run the PROM upgrade program by entering this command:
boot bootflash:cat4000-ios-promupgrade-121_20r_EW1
The following example shows the output from a successful upgrade, followed by a system reset:
Step 7 Boot the Cisco IOS software image, and enter the show version command to verify that ROMMON has been upgraded to 12.1(20r)EW1.
Step 8 Use the delete command to delete the PROM upgrade program from bootflash and the squeeze command to reclaim unused space.
The following example shows how to delete the cat4000-ios-promupgrade-121_20r_EW1 image from bootflash and reclaim unused space:
Step 9 Use the show version command to verify that the ROMMON has been upgraded
The ROMMON has now been upgraded.
See the “Upgrading the Cisco IOS Software” section for instructions on how to upgrade the Cisco IOS software on your switch.
Follow this procedure to upgrade your supervisor engine ROMMON to Release 12.1(20r)EW1. This procedure can be used when console access is not available and when the ROMMON upgrade must be performed remotely.
Note In the following section, use the PROM upgrade version cat4000-ios-promupgrade-121_20r_EW1.
Step 1 Establish a Telnet session to the supervisor engine.
Note In the following discussion, we assume that at least one IP address has been assigned to either an SVI or a routed port.
Step 2 Download the cat4000-ios-promupgrade-121_20r_EW1 program from Cisco.com, and place it on a TFTP server in a directory that is accessible from the switch to be upgraded.
The cat4000-ios-promupgrade-121_20r_EW1 programs are available on Cisco.com at the same location from which you download Catalyst 4500 system images.
Step 3 Use the dir bootflash: command to ensure that there is sufficient space in Flash memory to store the PROM upgrade image. If there is insufficient space, delete one or more images, and then enter the
squeeze bootflash: command to reclaim the space.
If you are using a CompactFlash card, replace bootflash: with slot0:.
Step 4 Download the cat4000-ios-promupgrade-121_20r_EW1 program into Flash memory using the
copy tftp command.
The following example shows how to download the PROM upgrade image cat4000-ios-promupgrade-121_20r_EW1 from the remote host 172.20.58.78 to bootflash:
Step 5 Use the no boot system flash bootflash: file_name command to clear all BOOT variable commands in the configuration file. In this example, the BOOT variable was set to boot the image cat4000-i5s-mz.121-19.EW1.bin from bootflash:
Note The config-register must be set to autoboot.
Step 6 Use the show bootvar command to verify the boot string. The BOOT variable in this example will first run the PROM upgrade to upgrade ROMMON. Then, the upgrade software will reload and the supervisor engine will load the Cisco IOS software image.
Step 7 Run the PROM upgrade program by issuing the reload command. Issuing this command will terminate your Telnet session.
The following example shows the console port output from a successful ROMMON upgrade followed by a system reset. Your Telnet session is disconnected during the ROMMON upgrade, so you will not see this output. This step could take 2-3 minutes to complete. You will need to reconnect your Telnet session after 2-3 minutes when the Cisco IOS software image and the interfaces are loaded.
Step 8 Use the no boot system flash bootflash: file_name command to clear the BOOT command used to upgrade the ROMMON.
Step 9 Use the show version command to verify that the ROMMON has been upgraded.
Step 10 Use the delete command to delete the PROM upgrade program from bootflash and the squeeze command to reclaim unused space.
The following example shows how to delete the cat4000-ios-promupgrade-121_20r_EW1 image from bootflash and reclaim unused space:
Step 11 Use the show bootvar command to verify that the ROMMON upgrade program has been removed from the BOOT variable.
The ROMMON has now been upgraded.
See the “Upgrading the Cisco IOS Software” section for instructions on how to upgrade the Cisco IOS software on your switch.
Before you proceed, observe the following rules for hostname:
Uppercase and lowercase characters look the same to many internet software applications. It may seem appropriate to capitalize a name the same way you might do in English, but conventions dictate that computer names appear all lowercase. For more information, refer to RFC 1178, Choosing a Name for Your Computer.
To upgrade the Cisco IOS software on your Catalyst 4500 series switch, use this procedure:
Step 1 Download Cisco IOS Release 12.1(20)EW from Cisco.com, and place the image on a TFTP server in a directory that is accessible from the supervisor engine that is upgraded.
Step 2 Use the dir bootflash: command to ensure that there is sufficient space in Flash memory to store the promupgrade image. If there is insufficient space, delete one or more images, and then enter the squeeze bootflash: command to reclaim the space.
If you are using a CompactFlash card, use slot0: instead of bootflash.
Step 3 Download the software image into Flash memory using the copy tftp command.
The following example shows how to download the Cisco IOS software image cat4000-is-mz.121-12c.EW from the remote host 172.20.58.78 to bootflash:
Step 4 Use the no boot system flash bootflash: file_name command to clear the cat4000-is-mz.121-8a.EW file and to save the BOOT variable.
The following example shows how to clear the BOOT variable:
Step 5 Use the boot system flash command to add the Cisco IOS software image to the BOOT variable.
The following example shows how to add the cat4000-is-mz.121-12c.EW image to the BOOT variable:
Step 6 Use the config-register command to set the configuration register to 0x2102.
The following example show how to set the second least significant bit in the configuration register:
Step 7 Enter the reload command to reset the switch and load the software.
The following example shows the output from a successful upgrade followed by a system reset:
Step 8 Use the show version command to verify that the new Cisco IOS release is operating on the switch.
These sections list the limitations and restrictions for the current release of Cisco IOS software on the Catalyst 4500 series switch.
– Fast UDLD is disabled by default.
– Configure fast UDLD only on point-to-point links between network devices that support fast UDLD.
– You can configure fast UDLD in either normal or aggressive mode.
– Do not enter the link debounce command on fast UDLD ports.
– Configure fast UDLD on at least two links between each connected network device. This reduces the likelihood of fast UDLD incorrectly error disabling a link due to false positives.
– Fast UDLD does not report a unidirectional link if the same error occurs simultaneously on more than one link to the same neighbor device.
The outputs of certain commands, such as show ip route and show access-lists, contain non-deterministic text. While the output is easily understood, the output text does not contain strings that are consistently output. A general purpose specification file entry is unable to parse all possible output.
While a general purpose specification file entry may not be possible, a specification file entry might be created that returns the desired text by searching for text that is guaranteed to be in the output. If a string is guaranteed to be in the output, it can be used for parsing.
For example, the output of the show ip access-lists SecWiz_Gi3_17_out_ip command is this:
The first line is easily parsed because access list is guaranteed to be in the output:
The remaining lines all contain the term host. As a result, the specification file may report the desired values by specifying that string. For example, this line
will produce the following for the first and second rules
and the following for the third statement
Request the output of the show running-config command using NETCONF and parse that output for the desired strings. This is useful when the desired lines contain nothing in common. For example, the rules in this access list do not contain a common string and the order (three permits, then a deny, then another permit), prevent the spec file entry from using permit as a search string, as in the following example:
The XML output of show running-config command includes the following, which can then be parsed programmatically, as desired:
– Unnumbered interface and numbered interface in different VRFs
– GRE encapsulation forwarding method
– Hash bucket based assignment method
– Redirection on an egress interface (redirection out)
– NHRP (Next Hop Resolution Protocol)
– AppleTalk Control Protocol for PPP
– NetFlow will not account for control packets, packets that encountered link-level errors, and ARP/RARP packets.
– The software cache for NetFlow is fixed, users cannot change the size.
– The statistical distribution row that displays the distribution across various packet sizes is not available.
– Packet length-based matching policies are not supported.
– IP Precedence, TOS and Qos groups are fixed.
– ACL/Route-map statistics are not updated.
Workaround: Configure the NSF interval timer to 0 minutes, or delay entering the issu runversion command until the NSF interval timer expires and NSF restarts.
For example, if the active supervisor engine is in slot 1, and you have configured interface Gi1/1, the supervisor engine in slot 2 becomes active if you remove the active supervisor engine from the chassis. In addition, while the startup configuration file is being parsed, you will receive an error message indicating that interface Gi1/1 is no longer present. This behavior is correct. When the formerly active supervisor engine is reinserted into slot 1, there is no configuration for interface Gi1/1.
This situation does not occur when both supervisor engines are present in the chassis.
Workaround: Copy the startup configuration file into the running configuration:
Workaround: Display the configuration with the show standby command, then remove the CLI. Here is an example of the show standby GigabitEthernet1/1 command output:
Use the standby delay reload option if the router is rebooting after reloading the image.
Workaround: Because the problem is caused by mismatched MTUs, you should change the MTU on either router to match the other’s MTU.
Workaround: Remove and reinsert the standby supervisor engine after the active supervisor engine boots. (CSCsa66509)
If this message appears, verify that the switch is connected to the ACS. You should also ensure that the switch has been properly configured as an AAA client on the ACS.
Workaround: Disable idle timeouts. (CSCec30214)
1. Disable inline power on the switch ports using the power inline never command.
2. Configure the media converter to autonegotiate the speed and duplex instead of running them at 100 Mbps and full duplex. (CSCee62109)
– It supports Layer 2 access port and PVLAN host port (isolated or community port).
– It does not support trunk port, Layer 3 port, or EtherChannel.
– Allow for at least three MAC addresses to access the switch: two for the phone (the MAC address of a phone gets registered to the Data domain and Voice domain), and one for the PC.
– Ensure that the data and voice VLAN IDs differ.
– As IPSG learns the static hosts on each interface, the switch CPU may achieve 100 percent if there are a large number of hosts to learn. CPU usage will drop after the hosts are learned.
– IPSG violations for static hosts are printed as they occur. If multiple violations occur simultaneously on different interfaces, the CLI displays the last violation. For example, if IPSG is configured for 10 ports and violations exist on ports 3, 6, and 9, the violation messages are printed only for port 9.
– Inactive host bindings will appear in the device tracking table when either a VLAN is associated with another port or a port is removed from a VLAN. So, as hosts are moved across subnets, the hosts appear in the device tracking table as Inactive.
– Autostate SVI does not work on EtherChannel.
– Chassis WS-C4507R-E, WS-C4510R-E
– Dual supervisor WS-X45-Sup6-E
– One or more of the models WS-X4448-GB-RJ45 or WS-X4148-FX-MT
To maximize the 10/100/1000 port density of 7- and 10-slot chassis when using redundant Supervisor Engine 6-E, install WS-X4548-GB-RJ45 instead of WS-X4448-GB-RJ45 line cards. If you require WS-X4448-GB-RJ45 line cards, two options are available:
Only four line card slots can be used on the Catalyst 4507R and six line card slots on the
Catalyst 4510R chassis.
When all slots are required, only one model WS-X4448-GB-RJ45 line card can be used.
To maximize the 100-BASE-FX port density of 7 and 10 slot chassis when using Supervisor Engine 6-E install WS-4248-FE-SFP line cards with FX optics instead of WS-X4148-FX-MT line cards. If WS-X4148-FX-MT line cards are required, two options are available:
You can use only 4 linecard slots on the Cat4507R chassis and 6 line card slots on the Cat4510R chassis.
When all slots are required, you can only use one WS-X4448-GB-RJ45 line card.
In such a scenario, the IPv6 MTU value programmed in hardware differs from the IPv6 interface MTU value. This will happen if no room exists in the hardware MTU table to store additional values.
To create room in the table, unconfigure some unused MTU values. Then, either disable or reenable IPv6 on the interface, or reapply the MTU configuration.
To enable IPSG with static hosts on a port, enter the following commands:
Note The preceding condition also applies to IPSG with static hosts on a PVLAN host port.
– Force the supplicant to use multicast EAPOL.
For example, if the active supervisor engine is in slot 1, and you have configured interface Gi1/1, the supervisor engine in slot 2 becomes active if you remove the active supervisor engine from the chassis. In addition, while the startup configuration file is being parsed, you will receive an error message indicating that interface Gi1/1 is no longer present. This behavior is correct. When the formerly active supervisor engine is reinserted into slot 1, there is no configuration for interface Gi1/1.
This situation will not occur when both supervisor engines are physically in the chassis.
Workaround: Copy the startup configuration file into the running configuration:
Workaround: Display the configuration with the show standby command, then remove the CLI. Here is an example of show standby GigabitEthernet1/1 command output:
Use the standby delay reload option if the router is rebooting after reloading the image.
Workaround: Ensure that the MTUs match.
– The verify and squeeze commands are not supported.
– The rename command is supported in FAT file system.
For Supervisor Engine 6-E, the rename command is available for bootflash and slot0. For all other supervisor engines, the rename command is supported for nvram devices only.
– The fsck command is supported for slot0 device. It is not supported in the file systems on supervisor engines other than 6-E.
– In the FAT file system, the IOS format bootflash: command erases user files only. It does not erase system configuration.
– The FAT file system supports a maximum of 63 characters for file/directory name. The maximum for path length is 127 characters.
– The FAT file system does not support the following characters in file/directory names:{}#%^ and space characters.
– The FAT file system honors the Microsoft Windows file attribute of read-only and read-write, but it does not support the Windows file hidden attribute.
– Supervisor Engine 6-E uses the FAT file system for compact flash (slot0). If a compact flash is not formatted in FAT file system (such as compact flash on a supervisor engine other than 6-E), the switch does not recognize it.
Workaround: Remove and reinsert the standby supervisor engine after the active supervisor engine boots. (CSCsa66509)
If this message appears, ensure network connectivity exists between the switch and the ACS. Also check that the switch has been properly configured as an AAA client on the ACS.
– As IPSG learns the static hosts on each interface, the switch CPU may achieve 100 percent if there are a large number of hosts to learn. The CPU usage will drop after the hosts are learned.
– IPSG violations for static hosts are printed as they occur. If multiple violations occur simultaneously on different interfaces, the CLI displays the last violation. For example, if IPSG is configured for 10 ports and violations exist on ports 3,6, and 9, the violation messages are printed only for port 9.
– Inactive host bindings will appear in the device tracking table when either a VLAN is associated with another port or a port is removed from a VLAN. So, as hosts are moved across subnets, the hosts appear in the device tracking table as inactive.
– Autostate SVI does not work on EtherChannel.
In such a scenario, the IPv6 MTU value programmed in hardware differs from the IPv6 interface MTU value. This occurs if no room exists in the hardware MTU table to store additional values.
To create room, unconfigure some unused MTU values. Then, either disable or re-enable IPv6 on the interface, or reapply the MTU configuration.
To enable IPSG with static hosts on a port, enter the following commands:
Note The preceding condition also applies to IPSG with static hosts on a PVLAN host port.
– WS-X4148-FX-MT Cisco Catalyst 4500 Fast Ethernet Switching Module, 48-port 100BASE-FX (MT-RJ)
– WS-X4448-GB-RJ45 Cisco Catalyst 4500 48-port 10/100/1000 Module (RJ-45)
The Catalyst 4503-E and Catalyst 4506-E have no caveats. The Catalyst 4507R-E configurations that use power supplies rated at 1400 W or above also have no caveats.
The following replacement switching modules will not exceed the power supply capacity for any Catalyst 4500-E chassis:
Refer to the Catalyst 4500 Series Module Installation Guide to determine the power requirements for all of the Catalyst 4500 linecards and the power capacities of the Catalyst 4500 power supplies.
This situation only occurs if a switch reached SSO before you removed the line card.
Caveats describe unexpected behavior in Cisco IOS releases. Caveats listed as open in a prior release are carried forward to the next release as either open or resolved.
Note All caveats in Release 12.4 also apply to the corresponding 12.1 E releases. Refer to the Caveats for Cisco IOS Release 12.4 publication at the following URL:
http://www.cisco.com/en/US/docs/ios/12_4/release/notes/124MCAVS.html
Note For the latest information on PSIRTS, refer to the Security Advisories on CCO at the following URL:
http://tools.cisco.com/security/center/publicationListing.x
This section lists the open caveats for Cisco IOS Release 12.2(54)SG1:
Workaround: Verify that the MAC addresses being transmitted through the system are learned.
Workaround: None. (CSCeg48586)
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. (CSCsb11964)
This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
This situation could occur for these reasons:
– A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.
– The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.
– Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.
– Configure the correct default gateway on the host side. (CSCse75660)
Workaround: None. (CSCsg58526)
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693)
Workaround: None. This is an informational message. (CSCsi60898)
Workaround: None. (CSCsm30320)
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)
Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
Workaround: None. (CSCsw14005)
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
The queue transmit counters as well as the policing statistics (if any) are correct. CSCsz20149
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command. CSCta16492
Prior to Cisco IOS Release 12.2(53)SG1 and 12.2(50)SG6, the switchport block multicast command blocks IP Multicast, Layer 2 multicast, and broadcast traffic. (CSCta61825)
Despite the different default value, you can configure any value in the time range.
Workaround: Reconfigure VLAN load balancing with a different configuration, by performing the following task:
a. Reconfigure the VLAN load balancing configuration on the desired REP ports.
b. Use the shut command on any one REP port in the segment to cause a failure in that segment.
c. Use the no-shut on the same port to restore normal REP topology with one ALT port.
d. Invoke manual preemption on a primary edge port to obtain VLAN load balancing with the new configuration.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
– Enter any commands for that port.
– Insert an SFP+ in that port.
– Reinsert the removed SFP+ in any other port.
Workarounds: The Cisco switch default link-flap detection value is 5 flaps in 10 seconds. Use the default value or larger numbers. CSCtg07677
Workaround: Do shut, then no shut on the SVI. CSCtg72559
The CDP TLV generated to indicate that a data device has disconnected is ignored. This is done to avoid disconnecting other connected data clients, if any. (Refer to CSCta47293.)
Workarounds: Enter either of the following commands:
– clear authentication session interface
– authentication timer inactivity
Workaround: Remove the X2 or SFP from the port. CSCth08212
Workaround: Configure an ACL on the port. CSCte18760
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command. CSCsx42157
Workaround: None. (CSCso93282)
Workaround: Disable the ip cef accounting non-recursive command.
– Configure the switch port for mab rather than mab eap.
– Configure the AAA server to propose EAP-MD5 first rather than EAP-TLS for MAB EAP requests. CSCti78674
On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.
Workaround: None. (CSCsk52542)
Workaround: Reinsert the X2. (CSCsk43618)
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)
If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)
Workaround: None. (CSCsl72868)
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. (CSCsm81875)
This problem can happen when pause frames are sent to a switch port and the flow control receive configuration is toggled on a 10-Gigabit Ethernet port.
Workaround: Change the flow control receive configuration when no traffic exists. CSCso71647
Workaround: None. (CSCsq99468)
You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then later allocate the same VLAN.
Workaround: Unconfigure, and then reconfigure the IFM on the port.
Workaround: Disable native VLAN tagging on the trunk port of the switch by entering the
no switchport trunk native vlan tag command. CSCsz12611
Workaround: No functional impact.
You must wait for the ACLs to be programmed before performing other TCAM related changes. CSCtd57063
This section lists the resolved caveats in Release 12.2(54)SG1:
Workaround: Upgrade to 12.2(53)SG3, 12.2(50)SG8, or later. CSCth00398
Note In a non-redundant chassis with the same PoE linecards, CPU utilization will not reach 80 percent.
This issue is not applicable to fixed config chassis.
Workaround: Configure spanning-tree bpdufilter enable in configuration interface mode.
If you randomly add or remove VLANs in a VLAN database, SVI traffic stops on some VLANs.
The next line in the output of the show ip ospf int command is the following:
If you now advance the output by pressing either Enter or the space bar, the device reloads and the following error message displays:
– Reload the switch when the error message displays.
– Upgrade to Cisco Catalyst Release 12.2(54)SG1, Cisco Catalyst Release 12.2(53)SG4 (and later), when available.
This section lists the open caveats for Cisco IOS Release 12.2(54)SG:
Workaround: Verify that the MAC addresses being transmitted through the system are learned.
Workaround: None. (CSCeg48586)
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. (CSCsb11964)
This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
This situation could occur for these reasons:
– A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.
– The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.
– Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.
– Configure the correct default gateway on the host side. (CSCse75660)
Workaround: None. (CSCsg58526)
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693)
Workaround: None. This is an informational message. (CSCsi60898)
Workaround: None. (CSCsm30320)
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)
Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
Workaround: None. (CSCsw14005)
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
The queue transmit counters as well as the policing statistics (if any) are correct. CSCsz20149
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command. CSCta16492
Prior to Cisco IOS Release 12.2(53)SG1 and 12.2(50)SG6, the switchport block multicast command blocks IP Multicast, Layer 2 multicast, and broadcast traffic. (CSCta61825)
Despite the different default value, you can configure any value in the time range.
Workaround: Reconfigure VLAN load balancing with a different configuration, by performing the following task:
a. Reconfigure the VLAN load balancing configuration on the desired REP ports.
b. Use the shut command on any one REP port in the segment to cause a failure in that segment.
c. Use the no-shut on the same port to restore normal REP topology with one ALT port.
d. Invoke manual preemption on a primary edge port to obtain VLAN load balancing with the new configuration.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
– Enter any commands for that port.
– Insert an SFP+ in that port.
– Reinsert the removed SFP+ in any other port.
Workarounds: The Cisco switch default link-flap detection value is 5 flaps in 10 seconds. Use the default value or larger numbers. CSCtg07677
Workaround: Do shut, then no shut on the SVI. CSCtg72559
The CDP TLV generated to indicate that a data device has disconnected is ignored. This is done to avoid disconnecting other connected data clients, if any. (Refer to CSCta47293.)
Workarounds: Enter either of the following commands:
– clear authentication session interface
– authentication timer inactivity
Workaround: Remove the X2 or SFP from the port. CSCth08212
Workaround: Configure an ACL on the port. CSCte18760
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command. CSCsx42157
Workaround: None. (CSCso93282)
Workaround: Disable the ip cef accounting non-recursive command.
– Configure the switch port for mab rather than mab eap.
– Configure the AAA server to propose EAP-MD5 first rather than EAP-TLS for MAB EAP requests. CSCti78674
On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.
Workaround: None. (CSCsk52542)
Workaround: Reinsert the X2. (CSCsk43618)
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)
If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)
Workaround: None. (CSCsl72868)
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. (CSCsm81875)
This problem can happen when pause frames are sent to a switch port and the flow control receive configuration is toggled on a 10-Gigabit Ethernet port.
Workaround: Change the flow control receive configuration when no traffic exists. CSCso71647
Workaround: None. (CSCsq99468)
You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then later allocate the same VLAN.
Workaround: Unconfigure, and then reconfigure the IFM on the port.
Workaround: Disable native VLAN tagging on the trunk port of the switch by entering the
no switchport trunk native vlan tag command. CSCsz12611
Workaround: No functional impact.
You must wait for the ACLs to be programmed before performing other TCAM related changes. CSCtd57063
This section lists the resolved caveats in Release 12.2(54)SG:
Prior to Cisco IOS Release 12.2(53)SG1, 12.2(50)SG6, the switchport block multicast command would block IP Multicast, Layer 2 multicast, and broadcast traffic.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be forwarding.
Workaround: Enter shut, then no shut on the port. CSCta04665
Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules. CSCsz05888
Workaround: Shut down then reopen the interface. CSCso50921
Workaround: Before removing a linecard, delete the statically configured ip source binding entries on any of the interfaces on the line-card. (CSCsv54529)
Workaround: Replace the default interface command with the following:
Workaround: Enter shut, then no-shut on any REP port (of the same segment in which VLB is configured) in the topology. (CSCsq75342)
Workaround: Unconfigure any generic QOS policies from the system. The QoS policies with the match any attribute cause IPv6 entries to become active. If the switch is a pure Layer 2 device, remove the generic protocol family attributes and narrow it to the protocol family. (CSCsq84796)
Workaround: Unconfigure all generic QOS policies from the system. CSCsq84853
When an output service-policy is attached to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued to the queue are subjected to the DBL algorithm. If one or more flows are classified as belligerent (flows do not back-off in response to drops because of congestion in the queue), those flows continue to be classified as belligerent even when DBL is disabled on that queue.
For this condition to persist, the transmit queues in question must remain congested for a long period of time and that congestion must be caused by flows that remain belligerent.
Workaround: Detach and re-attach the service-policy, provided the queue in question is non-default (queuing actions are not configured in the class-default class of the policy-map).
If this occurs on the default queue, modify and reset some queuing parameters like bandwidth or shape. CSCsk62457
Workaround: Configure the route map to only match on ACL(s). CSCtg22126
For the SFP+ optical modules SFP-10G-LRM, SFP-10G-LR, and SFP-10G-SRA, a Tx low power alarm displays when either IOS boots or you replace the module. This is an initial false alarm upon detection of a new SFP+ module; subsequently, it clears.
SFP and 10GBASE-CU SFP+ modules do not show this problem.
Workaround: Disable PoE (through entering the power inline never command in interface configuration mode.
In Cisco IOS Release 12.2(54)SG, you can enter the power inline autoneg-advertise command in global config mode to enable linkup. CSCtb78851
The statistics are displayed properly on the active supervisor.
Workaround: None. (CSCsk66449)
This happens provided one the following conditions apply:
– A route map matching on prefix-list is attached to an input interface as a PBR policy.
– A route map for PBR (already attached to an interface) is configured or modified to match on prefix-list(s) instead of ACL(s).
Workaround: Configure the route map for PBR to only match on ACLs.
When a packet is sent to the CPU it may ported out another interface. If so, the original CoS value for a.1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).
Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a.1X packet. (CSCsk72544)
Workaround: Embed the graphic into the HTML file with a maximum of 256 kilobytes (according to RFC 2397).
The following browsers support RFC 2397:
This impacts restoration timing but not REP functionality. After a REP segment fails, traffic restoration time sometimes exceeds 200ms.
Workaround: Reload the active and standby supervisor engine.
While performing OIR of the supervisor engines, you must remove the engines completely before re-insertion.
Workaround: Clear the errors with the clear ethernet cfm errors command. CSCsv43819
Workaround: Enter the queue-limit command to specify an explicit queue size. CSCso06422
Workaround: Attempt an authorization after a timeout. CSCte84432
Workaround: Disable the debug management expression evaluator command. (CSCsu67323)
This occurs only if the following conditions are satisfied:
– Multi-host mode is configured on the port with the authentication host-mode multi-host command.
– Default ACL (the IP access-list) is configured on the interface specifies deny ip any any.
– Dynamic policy authorization for the client specifies permit ip any any.
Workaround: Load Cisco IOS Release 12.2(54)SG or 12.2(53)SG4 on WS-C4507R+E and WS-C4510R+E. CSCtl70275
Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
Workaround: Verify that the MAC addresses being transmitted through the system are learned.
Workaround: None. (CSCeg48586)
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. (CSCsb11964)
This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
This situation could occur for these reasons:
– A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.
– The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.
– Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.
– Configure the correct default gateway on the host side. (CSCse75660)
Workaround: None. (CSCsg58526)
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
Workaround: None. This is an informational message. (CSCsi60898)
Workaround: None. (CSCsm30320)
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)
Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)
Workaround: Shut down, and then reopen the interface. (CSCso50921)
Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
Workaround: None. (CSCsw14005)
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
The statistics are displayed properly on the active supervisor.
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
CSCsz06719 (4500 + 4900, for now)
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
This occurs only if the following conditions are satisfied:
– Multi-host mode configured on the port with the authentication host-mode multi-host command.
– Default ACL (the IP access-list) configured on the interface specifies deny ip any any.
– Dynamic policy authorization for the client specifies permit ip any any.
Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.
Despite the different default value, you can configure any value in the time range.
Workaround: Reload the linecard by entering the hw-module reset command.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
Workaround: None. (CSCso93282)
When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:
Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.
– Place the Supervisor Engine II+10GE in a seven-slot chassis.
– Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.
Workaround: None. (CSCsk66449)
When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.
For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.
Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.
If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457
On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.
Workaround: None. (CSCsk52542)
Workaround: Reinsert the X2. (CSCsk43618)
When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a.1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).
Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a.1X packet. (CSCsk72544)
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)
Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)
Workaround: None. (CSCsl72868)
Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. (CSCsm81875)
This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.
Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)
The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.
Workaround: None. (CSCsq99468)
You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.
Workaround: Unconfigure, and then reconfigure the IFM on the port.
Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.
The active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
While active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.
Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.
Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)
This section lists the open caveats for Cisco IOS Release 12.2(53)SG10:
Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
Workaround: Verify that the MAC addresses being transmitted through the system are learned.
Workaround: None. (CSCeg48586)
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. (CSCsb11964)
This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
This situation could occur for these reasons:
– A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.
– The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.
– Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.
– Configure the correct default gateway on the host side. (CSCse75660)
Workaround: None. (CSCsg58526)
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
Workaround: None. This is an informational message. (CSCsi60898)
Workaround: None. (CSCsm30320)
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)
Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)
Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)
Workaround: Shut down, and then reopen the interface. (CSCso50921)
Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
Workaround: None. (CSCsw14005)
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
The statistics are displayed properly on the active supervisor.
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
The queue transmit counters as well as the policing statistics (if any) are correct.
CSCsz06719 (4500 + 4900, for now)
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
This occurs only if the following conditions are satisfied:
– Multi-host mode configured on the port with the authentication host-mode multi-host command.
– Default ACL (the IP access-list) configured on the interface specifies deny ip any any.
– Dynamic policy authorization for the client specifies permit ip any any.
Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.
Despite the different default value, you can configure any value in the time range.
Workaround: Reload the linecard by entering the hw-module reset command.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
Workaround: None. (CSCso93282)
When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:
Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.
– Place the Supervisor Engine II+10GE in a seven-slot chassis.
– Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.
Workaround: None. (CSCsk66449)
When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.
For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.
Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.
If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457
On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.
Workaround: None. (CSCsk52542)
Workaround: Reinsert the X2. (CSCsk43618)
When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a.1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).
Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a.1X packet. (CSCsk72544)
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)
Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)
Workaround: None. (CSCsl72868)
Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. (CSCsm81875)
This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.
Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)
The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.
Workaround: None. (CSCsq99468)
You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.
Workaround: Unconfigure, and then reconfigure the IFM on the port.
Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.
The active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
While active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.
Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.
This section lists the resolved caveats in Release 12.2(53)SG10:
This section lists the open caveats for Cisco IOS Release 12.2(53)SG9:
Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
Workaround: Verify that the MAC addresses being transmitted through the system are learned.
Workaround: None. (CSCeg48586)
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. (CSCsb11964)
This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
This situation could occur for these reasons:
– A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.
– The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.
– Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.
– Configure the correct default gateway on the host side. (CSCse75660)
Workaround: None. (CSCsg58526)
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
Workaround: None. This is an informational message. (CSCsi60898)
Workaround: None. (CSCsm30320)
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)
Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)
Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)
Workaround: Shut down, and then reopen the interface. (CSCso50921)
Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
Workaround: None. (CSCsw14005)
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
The statistics are displayed properly on the active supervisor.
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
The queue transmit counters as well as the policing statistics (if any) are correct.
CSCsz06719 (4500 + 4900, for now)
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
This occurs only if the following conditions are satisfied:
– Multi-host mode configured on the port with the authentication host-mode multi-host command.
– Default ACL (the IP access-list) configured on the interface specifies deny ip any any.
– Dynamic policy authorization for the client specifies permit ip any any.
Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.
Despite the different default value, you can configure any value in the time range.
Workaround: Reload the linecard by entering the hw-module reset command.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
Workaround: None. (CSCso93282)
When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:
Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.
– Place the Supervisor Engine II+10GE in a seven-slot chassis.
– Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.
Workaround: None. (CSCsk66449)
When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.
For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.
Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.
If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457
On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.
Workaround: None. (CSCsk52542)
Workaround: Reinsert the X2. (CSCsk43618)
When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a.1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).
Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a.1X packet. (CSCsk72544)
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)
Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)
Workaround: None. (CSCsl72868)
Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. (CSCsm81875)
This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.
Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)
The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.
Workaround: None. (CSCsq99468)
You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.
Workaround: Unconfigure, and then reconfigure the IFM on the port.
Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.
The active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
While active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.
Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.
This section lists the resolved caveats in Release 12.2(53)SG9:
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-nat
Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication.
Individual publication links are in “Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication” at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html
This section lists the open caveats for Cisco IOS Release 12.2(53)SG8:
Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
Workaround: Verify that the MAC addresses being transmitted through the system are learned.
Workaround: None. (CSCeg48586)
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. (CSCsb11964)
This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
This situation could occur for these reasons:
– A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.
– The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.
– Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.
– Configure the correct default gateway on the host side. (CSCse75660)
Workaround: None. (CSCsg58526)
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
Workaround: None. This is an informational message. (CSCsi60898)
Workaround: None. (CSCsm30320)
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)
Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)
Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)
Workaround: Shut down, and then reopen the interface. (CSCso50921)
Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
Workaround: None. (CSCsw14005)
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
The statistics are displayed properly on the active supervisor.
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
The queue transmit counters as well as the policing statistics (if any) are correct.
CSCsz06719 (4500 + 4900, for now)
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
This occurs only if the following conditions are satisfied:
– Multi-host mode configured on the port with the authentication host-mode multi-host command.
– Default ACL (the IP access-list) configured on the interface specifies deny ip any any.
– Dynamic policy authorization for the client specifies permit ip any any.
Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.
Despite the different default value, you can configure any value in the time range.
Workaround: Reload the linecard by entering the hw-module reset command.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later. CSCtl70275
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Workaround: None. (CSCso93282)
When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:
Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.
– Place the Supervisor Engine II+10GE in a seven-slot chassis.
– Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.
Workaround: None. (CSCsk66449)
When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.
For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.
Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.
If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457
On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.
Workaround: None. (CSCsk52542)
Workaround: Reinsert the X2. (CSCsk43618)
When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a.1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).
Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a.1X packet. (CSCsk72544)
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)
Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)
Workaround: None. (CSCsl72868)
Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. (CSCsm81875)
This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.
Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)
The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.
Workaround: None. (CSCsq99468)
You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.
Workaround: Unconfigure, and then reconfigure the IFM on the port.
Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.
The active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
While active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.
Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.
This section lists the resolved caveats in Release 12.2(53)SG8:
Workaround: Enter the no cdp run command to disable CDP. CSCub45763
This section lists the open caveats for Cisco IOS Release 12.2(53)SG7:
Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
Workaround: Verify that the MAC addresses being transmitted through the system are learned.
Workaround: None. (CSCeg48586)
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. (CSCsb11964)
This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
This situation could occur for these reasons:
– A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.
– The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.
– Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.
– Configure the correct default gateway on the host side. (CSCse75660)
Workaround: None. (CSCsg58526)
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
Workaround: None. This is an informational message. (CSCsi60898)
Workaround: None. (CSCsm30320)
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)
Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)
Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)
Workaround: Shut down, and then reopen the interface. (CSCso50921)
Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
Workaround: None. (CSCsw14005)
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
The statistics are displayed properly on the active supervisor.
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
The queue transmit counters as well as the policing statistics (if any) are correct.
CSCsz06719 (4500 + 4900, for now)
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
This occurs only if the following conditions are satisfied:
– Multi-host mode configured on the port with the authentication host-mode multi-host command.
– Default ACL (the IP access-list) configured on the interface specifies deny ip any any.
– Dynamic policy authorization for the client specifies permit ip any any.
Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.
Despite the different default value, you can configure any value in the time range.
Workaround: Reload the linecard by entering the hw-module reset command.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
Workaround: Enter the no cdp run command to disable CDP. CSCub45763
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Workaround: None. (CSCso93282)
When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:
Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.
– Place the Supervisor Engine II+10GE in a seven-slot chassis.
– Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.
Workaround: None. (CSCsk66449)
When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.
For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.
Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.
If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457
On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.
Workaround: None. (CSCsk52542)
Workaround: Reinsert the X2. (CSCsk43618)
When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a.1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).
Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a.1X packet. (CSCsk72544)
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)
Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)
Workaround: None. (CSCsl72868)
Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. (CSCsm81875)
This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.
Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)
The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.
Workaround: None. (CSCsq99468)
You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.
Workaround: Unconfigure, and then reconfigure the IFM on the port.
Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.
The active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
While active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.
Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.
This section lists the resolved caveats in Release 12.2(53)SG7:
Workaround: Do not use AAA accounting with the broadcast keyword. CSCts56125
Products that are not running Cisco IOS software are not vulnerable.
Cisco has released free software updates that address these vulnerabilities.
The HTTP server may be disabled as a workaround for the vulnerability described in this advisory.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai
Additional information on Cisco's security vulnerability policy can be found at the URL:
http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-msdp
Note The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.
Individual publication links are in ''Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication'' at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html
provided the following conditions apply:
– A switchport is configured with the following:
authentication event server dead action authorize...
authenticaton event server alive action reinitalize
– The RADIUS server was down previously, and a port without traffic (for example, a hub with no devices attached) was authorized into the inaccessible authentication bypass (IAB) VLAN without an associated MAC address.
The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.
This section lists the open caveats for Cisco IOS Release 12.2(53)SG6:
Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
Workaround: Verify that the MAC addresses being transmitted through the system are learned.
Workaround: None. (CSCeg48586)
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. (CSCsb11964)
This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
This situation could occur for these reasons:
– A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.
– The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.
– Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.
– Configure the correct default gateway on the host side. (CSCse75660)
Workaround: None. (CSCsg58526)
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
Workaround: None. This is an informational message. (CSCsi60898)
Workaround: None. (CSCsm30320)
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)
Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)
Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)
Workaround: Shut down, and then reopen the interface. (CSCso50921)
Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
Workaround: None. (CSCsw14005)
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
The statistics are displayed properly on the active supervisor.
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
The queue transmit counters as well as the policing statistics (if any) are correct.
CSCsz06719 (4500 + 4900, for now)
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
This occurs only if the following conditions are satisfied:
– Multi-host mode configured on the port with the authentication host-mode multi-host command.
– Default ACL (the IP access-list) configured on the interface specifies deny ip any any.
– Dynamic policy authorization for the client specifies permit ip any any.
Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.
Despite the different default value, you can configure any value in the time range.
Workaround: Reload the linecard by entering the hw-module reset command.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
Workaround: Do not use AAA accounting with the broadcast keyword. CSCts56125
Products that are not running Cisco IOS software are not vulnerable.
Cisco has released free software updates that address these vulnerabilities.
The HTTP server may be disabled as a workaround for the vulnerability described in this advisory.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai
Additional information on Cisco's security vulnerability policy can be found at the URL:
http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-msdp
Note The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.
Individual publication links are in ''Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication'' at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html
provided the following conditions apply:
– A switchport is configured with the following:
authentication event server dead action authorize...
authenticaton event server alive action reinitalize
– The RADIUS server was down previously, and a port without traffic (for example, a hub with no devices attached) was authorized into the inaccessible authentication bypass (IAB) VLAN without an associated MAC address.
The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Workaround: None. (CSCso93282)
When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:
Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.
– Place the Supervisor Engine II+10GE in a seven-slot chassis.
– Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.
Workaround: None. (CSCsk66449)
When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.
For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.
Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.
If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457
On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.
Workaround: None. (CSCsk52542)
Workaround: Reinsert the X2. (CSCsk43618)
When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a.1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).
Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a.1X packet. (CSCsk72544)
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)
Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)
Workaround: None. (CSCsl72868)
Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. (CSCsm81875)
This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.
Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)
The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.
Workaround: None. (CSCsq99468)
You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.
Workaround: Unconfigure, and then reconfigure the IFM on the port.
Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.
The active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
While active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.
Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.
This section lists the resolved caveats in Release 12.2(53)SG6:
– Force the supplicant to use multicast EAPOL.
– Avoid authentication open mode. CSCtq33048
Workaround: Re-enter the rep preempt segment command.
Workaround: Ensure that a policy is configured on an interface prior to changing a default next-hop in route-map. CSCtr31759
– Traps are not sent through IPv6.
– SNMP GETs sent to a switch IPv6 address trigger a traceback.
Workaround: Perform the following task:
1. Disable the SNMP engine with the no snmp-server command.
2. Configure an IPv4 address and an IPv6 address on loopback interfaces.
Workaround: Perform the following task:
1. Disable the SNMP engine with the no snmp-server command.
2. Configure an IP address and an IPv6 address on loopback interfaces.
Workaround: Configure static MAC addresses for the source addresses on the backup flex link interface. CSCtr40070
Issue is likely not to appear in environments with low latency (<5msec).
– None (regarding ethernet jitter probe)
– Consider using the IP sla ethernet echo probes to collect RTT statistics. CSCtb96522
Workaround: Disable LLDP MA TLV sending on the peers. CSCtj22354
Workaround: Use getnext rather than get to list valid indicies for the MIB OID. CSCtr52740
– Delete and add impacted VLAN with no vlan vlan_id and vlan vlan_id commands.
– Flap the impacted port channel with the shutdown and no shutdown commands. CSCtr17251
Workaround: Reconfigure VLAN load balancing with a different configuration, by performing the following task:
a. Reconfigure the VLAN load balancing configuration on the desired REP ports.
b. Use the shut command on any one REP port in the segment to cause a failure in that segment.
c. Use the no-shut on the same port to restore normal REP topology with one ALT port.
d. Invoke manual preemption on a primary edge port to obtain VLAN load balancing with the new configuration.
This section lists the open caveats for Cisco IOS Release 12.2(53)SG5:
Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
Workaround: Verify that the MAC addresses being transmitted through the system are learned.
Workaround: None. (CSCeg48586)
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. (CSCsb11964)
This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
This situation could occur for these reasons:
– A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.
– The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.
– Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.
– Configure the correct default gateway on the host side. (CSCse75660)
Workaround: None. (CSCsg58526)
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
Workaround: None. This is an informational message. (CSCsi60898)
Workaround: None. (CSCsm30320)
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)
Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)
Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)
Workaround: Shut down, and then reopen the interface. (CSCso50921)
Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.
Workaround: Reconfigure VLAN load balancing with a different configuration, by performing the following task:
a. Reconfigure the VLAN load balancing configuration on the desired REP ports.
b. Use the shut command on any one REP port in the segment to cause a failure in that segment.
c. Use the no-shut on the same port to restore normal REP topology with one ALT port.
d. Invoke manual preemption on a primary edge port to obtain VLAN load balancing with the new configuration.
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
Workaround: None. (CSCsw14005)
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
The statistics are displayed properly on the active supervisor.
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
The queue transmit counters as well as the policing statistics (if any) are correct.
CSCsz06719 (4500 + 4900, for now)
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
This occurs only if the following conditions are satisfied:
– Multi-host mode configured on the port with the authentication host-mode multi-host command.
– Default ACL (the IP access-list) configured on the interface specifies deny ip any any.
– Dynamic policy authorization for the client specifies permit ip any any.
Workaround: Add entries to the Default ACL in addition to 'deny ip any any'.
Despite the different default value, you can configure any value in the time range.
Workaround: Reload the linecard by entering the hw-module reset command.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
Workaround: Do not use AAA accounting with the broadcast keyword. CSCts56125
Products that are not running Cisco IOS software are not vulnerable.
Cisco has released free software updates that address these vulnerabilities.
The HTTP server may be disabled as a workaround for the vulnerability described in this advisory.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai
Additional information on Cisco's security vulnerability policy can be found at the URL:
http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-msdp
Note The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.
Individual publication links are in ''Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication'' at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html
provided the following conditions apply:
– A switchport is configured with the following:
authentication event server dead action authorize...
authenticaton event server alive action reinitalize
– The RADIUS server was down previously, and a port without traffic (for example, a hub with no devices attached) was authorized into the inaccessible authentication bypass (IAB) VLAN without an associated MAC address.
The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Workaround: None. (CSCso93282)
When Supervisor Engine II+10GE attempts to boot in a 4510R+E chassis, the following error message is displayed:
Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.
– Place the Supervisor Engine II+10GE in a seven-slot chassis.
– Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.
Workaround: None. (CSCsk66449)
When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.
For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.
Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.
If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457
On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.
Workaround: None. (CSCsk52542)
Workaround: Reinsert the X2. (CSCsk43618)
When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a.1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).
Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a.1X packet. (CSCsk72544)
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)
Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)
Workaround: None. (CSCsl72868)
Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. (CSCsm81875)
This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.
Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)
The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.
Workaround: None. (CSCsq99468)
You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.
Workaround: Unconfigure, and then reconfigure the IFM on the port.
Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.
The active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
While active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.
Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.
This section lists the resolved caveats in Release 12.2(53)SG5:
– Do not provide an extra space while specifying a proxy ACL ACE.
– Use a Downloadable ACL or a Filter-ID ACL rather than a proxy ACL. CSCtk67010
This occurs when a peer switch is connected to a line card in a non-redundant switch and you reload the active supervisor engine. Some interfaces on some linecards remain linked up. Far-end switches must rely on protocol timeouts to detect the switch’s reload.
This situation only occurs with the WS-X4648-RJ45-E and WS-X4548-RJ45-V-E line cards.
Workaround: Reset the linecards with the hw module module n command, then reload the switch. CSCtl11764
– Enter the power inline never command.
– Enter the speed auto 10 100 command. CSCtn43537
Workaround: Disable gratuitous ARP on the Windows device. CSCtn27420
– Configure the supplicant to retry 802.1X.
– Connect or disconnect to the port. CSCtl89361
Workaround: Disable AAA accounting. CSCtl77241
The problem is not observed for another 72 weeks.
Workaround: Configure ip routing. CSCtj20399
This happens only if you use a custom banner configured like the following:
Workaround: Remove the custom banner. CSCtb77378
– Reconfigure 802.1X with the no dot1x pae authenticator/dot1x pae authenticator command.
– Reload the switch. CSCtd43793
LLDP IEEE standard requires frames sent untagged. With this issue, some peer devices may reject the tagged LLDP frame.
Workaround: Use the default native VLAN for the trunks. CSCtn29321
Workaround: If you include snmp-server enable traps envmon in the device configuration, a ciscoEnvMonSuppStatusChangeNotification is generated when the power supply either turns off or fails. CSCtl72109
Workaround: Disable IP cef accounting. CSCtn68186
– vlan dot1q tag native is configured.
– Either the native VLAN is not allowed on the trunk, or the peer does not accept tagged channel protocol packets.
Workaround: Ensure that all trunk ports in the REP ring topology have the same list of VLANs, including ports in other REP rings that export STCNs into the REP ring where the problem is observed. CSCto67625
Workaround: Avoid using DHCP load balancing. CSCth00482
Workaround: Use a different host-mode. CSCti92970
Workaround: Allow SSH connections only from trusted hosts. CSCth87458
– Do not provide any extra space while specifying a proxy ACL ACE.
– Use DACL or Filter-Id ACL instead of proxy ACLs. CSCtk67010
This behavior is anticipated. In multi-auth mode, the system cannot distinguish between the data client that is attached to the phone and those that are attached to the switch through a hub.
Workaround: Remove the entire route-map and re-create it. CSCsr23563
Here is how you configured the banner:
If you telnet to the router, the banner shows correctly as follows:
Workaround: Enter shut and no shut on the alternate interface. CSCtn03533
Workaround: Avoid configuring overlapping IP addresses. CSCtj96095
This section lists the open caveats for Cisco IOS Release 12.2(53)SG4:
Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
Workaround: Verify that the MAC addresses being transmitted through the system are learned.
Workaround: None. (CSCeg48586)
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. (CSCsb11964)
This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
This situation could occur for these reasons:
– A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.
– The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.
– Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.
– Configure the correct default gateway on the host side. (CSCse75660)
Workaround: None. (CSCsg58526)
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
Workaround: None. This is an informational message. (CSCsi60898)
Workaround: None. (CSCsm30320)
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)
Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)
Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)
Workaround: Shut down, and then reopen the interface. (CSCso50921)
Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.
Workaround: Reconfigure VLAN load balancing with a different configuration, by performing the following task:
a. Reconfigure the VLAN load balancing configuration on the desired REP ports.
b. Use the shut command on any one REP port in the segment to cause a failure in that segment.
c. Use the no-shut on the same port to restore normal REP topology with one ALT port.
d. Invoke manual preemption on a primary edge port to obtain VLAN load balancing with the new configuration.
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
Workaround: None. (CSCsw14005)
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
The statistics are displayed properly on the active supervisor.
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
The queue transmit counters as well as the policing statistics (if any) are correct.
CSCsz06719 (4500 + 4900, for now)
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
This occurs only if the following conditions are satisfied:
– Multi-host mode configured on the port with the authentication host-mode multi-host command.
– Default ACL (the IP access-list) configured on the interface specifies deny ip any any.
– Dynamic policy authorization for the client specifies permit ip any any.
Despite the different default value, you can configure any value in the time range.
Workaround: Reload the linecard by entering the hw-module reset command.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: When creating the file, enter some characters, remove the ftp command, then re-enter it as follows:
Workaround: Load Cisco IOS Releases 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later.
– Do not provide an extra space while specifying a proxy ACL ACE.
– Use a Downloadable ACL or a Filter-ID ACL instead of a proxy ACL.
Workaround: Disable the ip cef accounting non-recursive command.
Workaround: Do not use AAA accounting with the broadcast keyword. CSCts56125
Products that are not running Cisco IOS software are not vulnerable.
Cisco has released free software updates that address these vulnerabilities.
The HTTP server may be disabled as a workaround for the vulnerability described in this advisory.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai
Additional information on Cisco's security vulnerability policy can be found at the URL:
http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-msdp
Note The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.
Individual publication links are in ''Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication'' at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html
provided the following conditions apply:
– A switchport is configured with the following:
authentication event server dead action authorize...
authenticaton event server alive action reinitalize
– The RADIUS server was down previously, and a port without traffic (for example, a hub with no devices attached) was authorized into the inaccessible authentication bypass (IAB) VLAN without an associated MAC address.
The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Workaround: None. (CSCso93282)
When Supervisor Engine II+10GE attempts to boot in a non-production 4510R+E chassis, the following error message is displayed:
Supervisor Engine II+10GE is not supported on a ten-slot chassis. So, the correct message is displayed but the chassis type listed is WS-C4510R-E instead of WS-C4510R+E.
– Place the Supervisor Engine II+10GE in a seven-slot chassis.
– Place a supervisor engine that is supported in a ten-slot chassis. The discrepancy in identifying the chassis type is purely cosmetic.
Workaround: None. (CSCsk66449)
When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.
For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.
Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.
If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457
On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.
Workaround: None. (CSCsk52542)
Workaround: Reinsert the X2. (CSCsk43618)
When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a.1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).
Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a.1X packet. (CSCsk72544)
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)
Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)
Workaround: None. (CSCsl72868)
Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. (CSCsm81875)
This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.
Workaround: Change the flow control receive configuration when no traffic exists. (CSCso71647)
The issue is observed only for packets that are logically switched but are internally controlled such that on egress the system is generated by the switch itself. This can happen for certain snooping features such as DAI, IGMP snooping, DHCP snooping, and MLD snooping. This can also happen for IPv4/v6 packets with IP options/ extension headers that need processing in software.
Workaround: None. (CSCsq99468)
You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then at a later time allocate the same VLAN.
Workaround: Unconfigure, and then reconfigure the IFM on the port.
Workaround: Disable native VLAN tagging on the trunk port of the switch using the
no switchport trunk native vlan tag command.
The active supervisor engine also displays following log message for each linecard slot in the chassis:
If the standby supervisor engine boots, the active supervisor engine displays the following message and reboots:
While active supervisor engine is up, no traffic can be handled by the switch.
The two supervisor engines might alternately reboot continuously.
Workaround: Use Cisco IOS Release 12.2(53)SG4, 12.2(54)SG, 15.0(1)SG or later images with WS-C4510R+E and WS-C4507R+E chassis.
Cisco IOS Release 12.2(53)SG3 and earlier are not supported on WS-C4510R+E and WS-4507R+E chassis and should display a valid error message when loaded.
Workaround: Load a LAN Base image from Cisco IOS Release 12.2(53)SG4 and later.
This section lists the resolved caveats in Release 12.2(53)SG4:
This does not impact REP functionality, but it impacts restoration timing. Traffic restoration time after the failure of a REP segment sometimes exceeds 200ms.
Workaround: Unconfigure the customized HTML page to use default internal Webauth pages and reload the switch after changing the configuration. CSCti81874
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
– Enter any commands for that port.
– Insert an SFP+ in that port.
This section lists the open caveats for Cisco IOS Release 12.2(53)SG3:
Workaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
Workaround: Verify that the MAC addresses being transmitted through the system are learned.
Workaround: None. (CSCeg48586)
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing keypair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. (CSCsb11964)
This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Workaround: None. (CSCsc11726)
This situation could occur for these reasons:
– A packet requires an IP redirect to an IP unnumbered outgoing port within 3 minutes of booting the Catalyst 4500 series switch.
– The switch administrator enters the shutdown and no shutdown commands on an outgoing interface that has enabled IP unnumbered. The switch receives packets that require redirection; and the destination MAC address is already in ARP table.
– Do not inject packets that require an IP redirect sent out to an IP unnumbered port within 3 minutes of booting the Catalyst 4500 series switch.
– Configure the correct default gateway on the host side. (CSCse75660)
Workaround: None. (CSCsg58526)
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
Workaround: None. This is an informational message. (CSCsi60898)
Workaround: None. (CSCsm30320)
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. (CSCsr00333)
Workaround: Before removing a line card, delete the statically configured ip source binding entries on any of the interfaces on the line card. (CSCsv54529)
Workaround: Clear the errors with the clear ethernet cfm errors command. (CSCsv43819)
Workaround: Shut down, and then reopen the interface. (CSCso50921)
Workaround: Configure an ISL/dot1q trunk port. (CSCsu43445)
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change.
Workaround: Reconfigure VLAN load balancing with a different configuration, by performing the following task:
a. Reconfigure the VLAN load balancing configuration on the desired REP ports.
b. Use the shut command on any one REP port in the segment to cause a failure in that segment.
c. Use the no-shut on the same port to restore normal REP topology with one ALT port.
d. Invoke manual preemption on a primary edge port to obtain VLAN load balancing with the new configuration.
Workaround: When a log message appears indicating that the SFP+ has been removed, do one of the following:
– Enter any commands for that port.
– Insert an SFP+ in that port.
– Reinsert the removed SFP+ in any other port.
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
Workaround: None. (CSCsw14005)
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
This does not impact REP functionality, but it impacts restoration timing. Traffic restoration time after the failure of a REP segment sometimes exceeds 200ms.
The statistics are displayed properly on the active supervisor.
Workaround: Configure a lower value for the low threshold so that the frame errors are seen divided into the expected number of frame errored seconds.
Workaround: Specify a profile name when you enter the diagnostic command.
You might want to avoid requesting on demand send for invalid modules. First, enter the
show module command to check for valid or present modules.
The queue transmit counters as well as the policing statistics (if any) are correct.
CSCsz06719 (4500 + 4900, for now)
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
Assuming that you configured authentication open on the port and a host is authenticated on that port, if you unconfigure open auth (no authentication open), the STP state becomes blocked on an authenticated port.
The connected host is authenticated so it should be able to send traffic and the STP state should be Forwarding.
Workaround: Enter shut, then no shut on the port.
Workaround: When interface mode is changed from Layer2 to Layer3, manually change interface trust state by enter the cos trust dscp command.
This occurs only if the following conditions are satisfied:
– Multi-host mode configured on the port with the authentication host-mode multi-host command.
– Default ACL (the IP access-list) configured on the interface specifies deny ip any any.
– Dynamic policy authorization for the client specifies permit ip any any.
Despite the different default value, you can configure any value in the time range.
Workaround: Reload the linecard by entering the hw-module reset command.
The show memory debug leak lowmem command can work in extremely low memory conditions but might crash the switch due to its very high CPU intensity. It also takes between 20 and 90 minutes to complete.
Workaround: If call or packet drops persist, contact TAC rather than entering these commands on your own. CSCsi48986
Workaround: Unconfigure the customized HTML page to use default internal Webauth pages and reload the switch after changing the configuration. CSCti81874
Workaround: Disable the ip cef accounting non-recursive command.
Workaround: Do not use AAA accounting with the broadcast keyword. CSCts56125
Products that are not running Cisco IOS software are not vulnerable.
Cisco has released free software updates that address these vulnerabilities.
The HTTP server may be disabled as a workaround for the vulnerability described in this advisory.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai
Additional information on Cisco's security vulnerability policy can be found at the URL:
http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-msdp
Note The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.
Individual publication links are in ''Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication'' at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html
provided the following conditions apply:
– A switchport is configured with the following:
authentication event server dead action authorize...
authenticaton event server alive action reinitalize
– The RADIUS server was down previously, and a port without traffic (for example, a hub with no devices attached) was authorized into the inaccessible authentication bypass (IAB) VLAN without an associated MAC address.
The RADIUS server becomes available again, and the IAB-authorized port transitions to another state.
Workaround: Retain the default setting (VLAN 1) for the native VLAN on trunks ports. CSCud05521
Workaround: None. (CSCsk66449)
When an output service policy attaches to an interface and if the policy is configured to apply DBL on a queue, the flows that are enqueued are subjected to the DBL algorithm. One or more flows that are classified as belligerent (flows that do not back off in response to drops because of congestion in the queue) continue to be classified as belligerent even when DBL is disabled on that queue.
For this condition to persist, the transmit queues in question must remain congested for a long period of time, and that congestion must be caused by flows that remain belligerent.
Workaround: Provided the queue in question is nondefault (queuing actions are not configured in the class-default class of the policy map), detach and reattach the service policy.
If this happens on the default queue, modifying and resetting some queuing parameters such as bandwidth and shape resolves the problem. (CSCsk62457
On a switch running Cisco IOS Release 12.2(40)SG, all MTU values configured on a line card are set to default when the module is reset. MTU values are not retained for modules that are physically moved.
Workaround: None. (CSCsk52542)
Workaround: Reinsert the X2. (CSCsk43618)
When a packet is sent to the CPU it may get sent out on some other interface. If so, the original CoS value for a.1X packet cannot be matched by software QoS (according to CSCsk66449). The packet is transmitted with the CoS value it was generated with (7, for the MLDv1 packets described here).
Part of the root cause of this problem is captured in CSCsk66449, which indicates that the software QoS cannot match a.1X packet. (CSCsk72544)
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. (CSCsi71036)
Workaround: None. If you enter the show policy-map name, however, the unconditional marking actions appear. (CSCsi94144)
Workaround: None. (CSCsl72868)
Workaround: To ensure that the DBL action operates on the default queue, use the queue-limit command to specify an explicit queue size. This command dictates the size range. (CSCso06422)
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. (CSCsm81875)
This problem can happen when pause frames are sent to the switch port and the flow control receive configuration is toggled on 10-Gb port.
Workaround: Change the flow control receive configuration when no traffic exists. (