Release Notes for the Catalyst 4500 Series Switch, Cisco IOS Releases 12.2(37)SG to 12.2(25)SG
Available Languages
Table Of Contents
Release Notes for the
Catalyst 4500 Series Switch,
Cisco IOS Releases 12.2(37)SG to 12.2(25)SGCisco IOS Software Packaging for the Cisco Catalyst 4500 Series
Catalyst 4500 Series Switch Cisco IOS Release Strategy
Cisco IOS Software Migration Guide
Supported Hardware on Catalyst 4500 Series Switch
Supported Hardware on Catalyst 4500 E-Series Switch
Supported Features on the Catalyst 4500 Series Switch
Features Unique to Supervisor Engines 6-E and 6L-E
New Hardware Features in Release 12.2(37)SG
New Software Features in Release 12.2(37)SG
New Hardware Features in Release 12.2(31)SGA
New Software Features in Release 12.2(31)SGA
New Hardware Features in Release 12.2(31)SG
New Software Features in Release 12.2(31)SG
New Hardware Features in Release 12.2(25)SG
New Software Features in Release 12.2(25)SG
Guidelines for Upgrading the ROMMON
Upgrading the Supervisor Engine ROMMON from the Console
Upgrading the Supervisor Engine ROMMON Remotely Using Telnet
Upgrading the Cisco IOS Software
For Supervisor Engines II+Plus through V-10GE
For Supervisor Engine 6-E and Supervisor Engine 6L-E
Open Caveats in Cisco IOS Release 12.2(37)SG1
Resolved Caveats in Cisco IOS Release 12.2(37)SG1
Open Caveats in Cisco IOS Release 12.2(37)SG
Resolved Caveats in Cisco IOS Release 12.2(37)SG
Open Caveats in Cisco IOS Release 12.2(31)SGA11
Resolved Caveats in Cisco IOS Release 12.2(31)SGA11
Open Caveats in Cisco IOS Release 12.2(31)SGA10
Resolved Caveats in Cisco IOS Release 12.2(31)SGA10
Open Caveats in Cisco IOS Release 12.2(31)SGA9
Resolved Caveats in Cisco IOS Release 12.2(31)SGA9
Open Caveats in Cisco IOS Release 12.2(31)SGA8
Resolved Caveats in Cisco IOS Release 12.2(31)SGA8
Open Caveats in Cisco IOS Release 12.2(31)SGA7
Resolved Caveats in Cisco IOS Release 12.2(31)SGA7
Open Caveats in Cisco IOS Release 12.2(31)SGA6
Resolved Caveats in Cisco IOS Release 12.2(31)SGA6
Open Caveats in Cisco IOS Release 12.2(31)SGA5
Resolved Caveats in Cisco IOS Release 12.2(31)SGA5
Open Caveats in Cisco IOS Release 12.2(31)SGA4
Resolved Caveats in Cisco IOS Release 12.2(31)SGA4
Open Caveats in Cisco IOS Release 12.2(31)SGA3
Resolved Caveats in Cisco IOS Release 12.2(31)SGA3
Open Caveats in Cisco IOS Release 12.2(31)SGA2
Resolved Caveats in Cisco IOS Release 12.2(31)SGA2
Open Caveats in Cisco IOS Release 12.2(31)SGA1
Resolved Caveats in Cisco IOS Release 12.2(31)SGA1
Open Caveats in Cisco IOS Release 12.2(31)SGA
Resolved Caveats in Cisco IOS Release 12.2(31)SGA
Open Caveats in Cisco IOS Release 12.2(31)SG3
Resolved Caveats in Cisco IOS Release 12.2(31)SG3
Open Caveats in Cisco IOS Release 12.2(31)SG2
Resolved Caveats in Cisco IOS Release 12.2(31)SG2
Open Caveats in Cisco IOS Release 12.2(31)SG1
Resolved Caveats in Cisco IOS Release 12.2(31)SG1
Open Caveats in Cisco IOS Release 12.2(31)SG
Resolved Caveats in Cisco IOS Release 12.2(31)SG
Open Caveats in Cisco IOS Release 12.2(25)SG4
Resolved Caveats in Cisco IOS Release 12.2(25)SG4
Open Caveats in Cisco IOS Release 12.2(25)SG3
Resolved Caveats in Cisco IOS Release 12.2(25)SG3
Open Caveats in Cisco IOS Release 12.2(25)SG2
Resolved Caveats in Cisco IOS Release 12.2(25)SG2
Open Caveats in Cisco IOS Release 12.2(25)SG1
Resolved Caveats in Cisco IOS Release 12.2(25)SG1
Open Caveats in Cisco IOS Release 12.2(25)SG
Resolved Caveats in Cisco IOS Release 12.2(25)SG
Troubleshooting at the System Level
Obtaining Documentation and Submitting a Service Request
Release Notes for the
Catalyst 4500 Series Switch,
Cisco IOS Releases 12.2(37)SG to 12.2(25)SG
Current Release
12.2(54)SG1—February 7, 2011Previous Releases
12.2(37)SG1, 12.2(37)SG, 12.2(31)SGA11, 12.2(31)SGA10, 12.2(31)SGA9, 12.2(31)SGA8, 12.2(31)SGA7, 12.2(31)SGA6, 12.2(31)SGA5, 12.2(31)SGA4, 12.2(31)SGA3, 12.2(31)SGA2, 12.2(31)SGA1, 12.2(31)SGA, 12.2(31)SG3, 12.2(31)SG2, 12.2(31)SG1, 12.2(31)SG, 12.2(25)SG4, 12.2(25)SG3, 12.2(25)SG2, 12.2(25)SG1, 12.2(25)SGThese release notes describe the features, modifications, and caveats for the Cisco IOS software on the Catalyst 4500 series switch. The most current software release is Cisco IOS Release 12.2(54)SG.
Support for Cisco IOS Software Release 12.2(54SG, the default image, follows the standard Cisco Systems® support policy, available at
http://www.cisco.com/en/US/products/products_end-of-life_policy.html
Note
Although their Release Notes are unique, the 4 platforms (Catalyst 4500, Catalyst 4900,
Catalyst ME 4900, and Catalyst 4900M/4948E) use the same Software Configuration Guide, Command Reference Guide, and System Message Guide.
For more information on the Catalyst 4500 series switches, visit the following URL:
http://www.cisco.com/go/cat4500/docsContents
This publication consists of these sections:
•
•
•
•
Cisco IOS Software Packaging for the Cisco Catalyst 4500 Series
A new Cisco IOS Software package for Cisco Catalyst 4500 Series Switches was introduced in Cisco IOS Software Release 12.2(25)SG. It is a new foundation for features and functionality and provides consistency across all Cisco Catalyst switches. The new Cisco IOS Software release train is designated as 12.2SG.
Prior Cisco Catalyst 4500 Series IOS Software images for the Cisco Catalyst 4500 Series Switches, formerly known as Basic Layer 3 and Enhanced Layer 3, now map to IP Base and Enterprise Services, respectively. All currently shipping Cisco Catalyst 4500 software features based on Cisco IOS Software are supported in the IP Base image of Release 12.2(54)SG, with a few exceptions.
The IP Base image does not support enhanced routing features such as NSF/SSO, BGP, EIGRP, EIGRPv6, OSPF, OSPFv3, IS-IS, Internetwork Packet Exchange (IPX), AppleTalk, VRF-lite, and Policy-Based Routing (PBR). The IP Base image supports EIGRP-Stub for limited routing on Supervisor Engines II-Plus, II-Plus-TS, II-Plus-10GE, IV, V, V-10GE, and 6-E.
The Enterprise Services image supports all Cisco Catalyst 4500 Series software features based on Cisco IOS Software, including enhanced routing. Customers planning to enable BGP for Supervisor Engine IV, V, or V-10GE will no longer need to purchase a separate BGP license (FR-IRC4) because BGP is included in the Enterprise Services package. Beginning with 12.2(53)SG2, we support the Enterprise Services image on Supervisor Engine 6L-E.
Cisco IOS Release 12.2(46)SG1 introduced a new LAN Base software and an IP upgrade image. These complement the existing IP Base and Enterprise Services images. The LAN base image is supported on the Supervisor Engine II-Plus-10GE and Supervisor Engine 6L-E starting with
Cisco IOS Release 12.2(52)XO. LAN Base image is primarily focused on customer access and Layer 2 requirements and therefore many of the IP Base features are not required. The IP upgrade image is available if at a later date you require some of those features.Figure 1 illustrates feature support within the 3 packages: LAN Base, IP Base, and Enterprise Services. This is not a detailed list. Please visit Feature Navigator for full package details:
http://tools.cisco.com/ITDIT/CFN/Figure 1 Feature Support by Packages
Table 1 contrasts feature support on the LAN Base vs IP Base images.
Note
For information on MiBs support, pls refer to this URL:
http://ftp.cisco.com/pub/mibs/supportlists/cat4000/cat4000-supportlist.html
Table 1 LAN Base/IP Base Image Support
10G Uplink Use
12.2(46)SG1
Yes
802.1p prioritization
12.2(46)SG1
Yes
802.1p/802.1q
12.2(46)SG1
Yes
802.1w/802.1s
12.2(46)SG1
Yes
802.1X (w/ Guest VLAN and VLAN Assignment)
12.2(50)SG
Yes
802.1X and MAB with ACL assignment
12.2(50)SG
Yes
802.1X (Auth-Fail VLAN, Critical Auth, Accounting)
12.2(50)SG
Yes
802.1X Wake on LAN
12.2(50)SG
Yes
802.1X Web-Auth
12.2(50)SG
Yes
802.1X with Multiple authenticated, multi-host
12.2(50)SG
Yes
802.1X w/ MDA
12.2(50)SG
Yes
802.1X w/ Open Access
12.2(50)SG
Yes
802.3ad LACP
12.2(46)SG1
Yes
802.3x - Flow Control
12.2(46)SG1
Yes
ACL Logging
12.2(46)SG1
Yes
All Mibs
12.2(52)SG
Yes
Auto QoS
12.2(53)SG
Yes
Auto SmartPort
12.2(54)SG
Yes
Auto-MDIX
12.2(46)SG1
Yes
Auto-Voice VLAN (part of Auto QoS)
No support
Yes
BOOTP
12.2(46)SG1
Yes
Bootup GOLD
No support
Yes
Broadcast Suppression
12.2(46)SG1
Yes
CDP/CDPv2
12.2(46)SG1
Yes
Community PVLAN support
No support
Yes
Config File
12.2(46)SG1
Yes
Console Access
12.2(46)SG1
Yes
Control Plane Policing
12.2(46)SG1
Yes
Copy Command
12.2(46)SG1
Yes
CoS to DSCP Map
Yes
Yes
Debug Commands
12.2(46)SG1
Yes
Device Management
12.2(46)SG1
Yes
DHCP Server
12.2(46)SG1
Yes
DHCP Snooping
12.2(46)SG1
Yes
Diagnostics Tools
12.2(46)SG1
Yes
Downloading Software
12.2(46)SG1
Yes
DSCP to CoS Map
12.2(46)SG1
Yes
DSCP to egress queue mapping
12.2(46)SG1
Yes
Dynamic ARP inspection
12.2(46)SG1
Yes
EEM and EOT integration
12.2(46)SG1
No
EIGRP Stub
No support
Yes
EnergyWise 1.0
12.2(53)SG
Yes
EPoE
12.2(53)SG
Yes
Event Log
12.2(46)SG1
Yes
Factory Default Settings
12.2(46)SG1
Yes
File Management
12.2(46)SG1
Yes
Flex Link
12.2(53)SG
Yes
GLBP
No support
Yes
HSRP v1/VRRP
No support
Yes
HSRP v2 IPV41
No support
Yes
HSRP v2 IPV62
No support
No
ID 4.0 Voice Vlan assignment
12.2(46)SG1
Yes
ID4.1 Filter ID and per use ACL
12.2(46)SG1
Yes
IGMP
12.2(46)SG1
Yes
IGMP Snooping
12.2(46)SG1
Yes
Ingress Policing
12.2(46)SG1
Yes
Interface Access (Telnet, Console/Serial, Web)
12.2(46)SG1
Yes
IP Source Guard
12.2(46)SG1
Yes
IP Multicast
No support
Yes
IPV6 reformation
NA
Yes
IPV6 MLD snooping V1 and V2
Future
Yes
IPV6 Router Advertisement (RA) Guard
12.2(54)SG
Yes
ISL Trunk
12.2(46)SG1
Yes
ISSU
No support
Yes
Jumbo Frames
12.2(46)SG1
Yes
Layer 2 Debug
12.2(46)SG1
Yes
Layer 2 PT and QinQ
No support
Yes
Layer 2 Traceroute
12.2(46)SG1
Yes
Link State Tracking
12.2(54)SG
Yes
LLDP/LLDP-MED
12.2(52)SG
Yes
LLDP enhancements (PoE+Layer 2 COS)
12.2(54)SG
No
Local Web Auth
12.2(52)SG
Yes
MAB (MAC Authentication Bypass)
12.2(50)SG
Yes
MAC Address Filtering
12.2(50)SG
Yes
MAC Based Access List
12.2(50)SG
Yes
Management IPV6 port
12.2(52)SG
Yes
MLD Snooping
12.2(53)SG
Yes
Multicast Filtering
12.2(46)SG1
Yes
Multihop SXP (CTS)
No support
12.2(52SG
Network Edge Access Topology (NEAT)
No support
Yes
No. of QoS Filters
No. of Security ACE
Yes (4K entries)
Yes
No. of VLAN Support
2048
4096
OSPF for Routed Access3
No support
Yes
PAgP
12.2(46)SG1
Yes
Passwords
Password clear protection12.2(46)SG1
Yes
PIM SM/DM
No support
Yes
PoE (up to 15.4W only)
12.2(46)SG1
Yes
PoE+ Ready
Yes
Yes
Port Monitoring (interface Stats)
12.2(46)SG1
Yes
Port Security
12.2(46)SG1
Yes; only 1024 MACs
Post Status
12.2(46)SG1
Yes
PVST+
12.2(53)SG
Yes
Q-in-Q
No support
Yes
RACL (DSCP based)
12.2(46)SG1
Yes
RADIUS/TACACS+ (AAA)
12.2(46)SG1
Yes
RMON
12.2(46)SG1
Yes
Routing - RIP, Static
12.2(46)SG1
Yes
RPR
12.2(46)SG1
Yes
RPVST+
12.2(53)SG
Yes
RSPAN
12.2(46)SG1
Yes
Service Advertisement Framework (SAF)
No support
No
Smart Call Home
No support
Yes
SmartPorts (Role based MACRO)
12/2(53)SG
Yes
SNMP (including SNMv3)
12.2(46)SG1
Yes
Source port Filtering (Private VLAN)
12.2(46)SG1
Yes
SPAN (# of sessions) - Port Mirroring
12.2(46)SG1 (2 sessions)
Yes (8 bidirectional sessions)
SSHv2/Secure Copy, FTP, SSL, Syslog, Sys Information
12.2(46)SG1
Yes
Storm Control
12.2(46)SG1
Yes
TDR
No support
Yes
Time Protocols (SNTP, TimeP)
12.2(46)SG1
Yes
Time-based ACL
12.2(46)SG1
Yes
Traffic Mirroring (SPAN)
12.2(46)SG1
Yes
Trusted Boundary (LLDP & CDP Based)
12.2(46)SG1
Yes
UDLD
12.2(46)SG1
Yes
VACL and PACL
12.2(46)SG1
Yes
VLAN Mapping (VLAN Translation)
12.2(54)SG
Yes
Voice VLAN
12.2(46)SG1
Yes
VRRP
No support
Yes
VTP
12.2(46)SG1
Yes
WCCP
No support
Yes
XML-PI
12.2(54)SG
Yes
1 Supported on all supervisor engines.
2 Supported only for Catalyst 4900M and Supervisor Engines 6-E/6L-E.
3 Supported on WS-X45-SUP6-E and WS-X45-SUP6L-E
Orderable Product Numbers:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Catalyst 4500 Series Switch Cisco IOS Release Strategy
Cisco IOS Release 12.2SG train offers the latest features for the Catalyst 4500 Series supervisor engines. Customers with Catalyst 4500 Series supervisor engines who need the latest hardware support and software features should migrate to Cisco IOS Release 12.2(54)SG.
Note
Catalyst 4500 Series has three maintenance trains. The Cisco IOS Release 12.2(31)SGA train is the longest living train. Currently, the Cisco IOS Release 12.2(31)SGA8 is the recommended release for customers who require a release with a maintenance train.The Cisco IOS Release 12.2(53)SG is the latest maintenance train and includes the most recent features including support for the WS-X45-Sup6L-E supervisor engine and OSPF for routed Access.
For more information on the Catalyst 4500 series switches, visit the following URL:
http://www.cisco.com/go/cat4500/docsCisco IOS Software Migration Guide
Figure 2 displays the two active, 12.2(31)SGA and 12.2(50)SG, and newly introduced 12.2(53)SG extended maintenance trains.
Figure 2 Software Release Strategy for the Catalyst 4500 Series Switch
Summary of Migration Plan
•
•
Support
Support for Cisco IOS Software Release 12.2(54)SG follows the standard Cisco Systems® support policy, available at
http://www.cisco.com/en/US/products/products_end-of-life_policy.htmlSystem Requirements
This section describes the system requirements:
•
•
Supported Hardware on Catalyst 4500 Series Switch
Table 2 lists the hardware supported on the Catalyst 4500 Series Switch.
For Catalyst 4500 transciever module compatibility information, see the url:
http://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html
Table 3 briefly describes the supported CWDM wavelengths in the Catalyst 4500 Classic Series Switch.
Table 4 briefly describes the supported DWDM wavelengths in the Catalyst 4500 Classic Series Switch.
Table 4 DWDM SFP Supported Wavelengths for the Catalyst 4500 Classic Series Switch
DWDM-SFP-6061=
Cisco 1000BASE-DWDM SFP 1560.61 nm
12.2(37)SG
DWDM-SFP-5979=
Cisco 1000BASE-DWDM SFP 1559.79 nm
12.2(37)SG
DWDM-SFP-5898=
Cisco 1000BASE-DWDM SFP 1558.98 nm
12.2(37)SG
DWDM-SFP-5817=
Cisco 1000BASE-DWDM SFP 1558.17 nm
12.2(37)SG
DWDM-SFP-5655=
Cisco 1000BASE-DWDM SFP 1556.55 nm
12.2(37)SG
DWDM-SFP-5575=
Cisco 1000BASE-DWDM SFP 1555.75 nm
12.2(37)SG
DWDM-SFP-5413=
Cisco 1000BASE-DWDM SFP 1554.13 nm
12.2(37)SG
DWDM-SFP-5494=
Cisco 1000BASE-DWDM SFP 1554.94 nm
12.2(37)SG
DWDM-SFP-5252=
Cisco 1000BASE-DWDM SFP 1552.52 nm
12.2(37)SG
DWDM-SFP-5172=
Cisco 1000BASE-DWDM SFP 1551.72 nm
12.2(37)SG
DWDM-SFP-5092=
Cisco 1000BASE-DWDM SFP 1550.92 nm
12.2(37)SG
DWDM-SFP-5012=
Cisco 1000BASE-DWDM SFP 1550.12 nm
12.2(37)SG
DWDM-SFP-4851=
Cisco 1000BASE-DWDM SFP 1548.51 nm
12.2(37)SG
DWDM-SFP-4772=
Cisco 1000BASE-DWDM SFP 1547.72 nm
12.2(37)SG
DWDM-SFP-4692=
Cisco 1000BASE-DWDM SFP 1546.92 nm
12.2(37)SG
DWDM-SFP-4612=
Cisco 1000BASE-DWDM SFP 1546.12 nm
12.2(37)SG
DWDM-SFP-4453=
Cisco 1000BASE-DWDM SFP 1544.53 nm
12.2(37)SG
DWDM-SFP-4373=
Cisco 1000BASE-DWDM SFP 1543.73 nm
12.2(37)SG
DWDM-SFP-4694=
Cisco 1000BASE-DWDM SFP 1542.94 nm
12.2(37)SG
DWDM-SFP-4614=
Cisco 1000BASE-DWDM SFP 1542.14 nm
12.2(37)SG
DWDM-SFP-4056=
Cisco 1000BASE-DWDM SFP 1540.56 nm
12.2(37)SG
DWDM-SFP-3977=
Cisco 1000BASE-DWDM SFP 1539.77 nm
12.2(37)SG
DWDM-SFP-3898=
Cisco 1000BASE-DWDM SFP 1539.98 nm
12.2(37)SG
DWDM-SFP-3819=
Cisco 1000BASE-DWDM SFP 1538.19 nm
12.2(37)SG
DWDM-SFP-3661=
Cisco 1000BASE-DWDM SFP 1536.61 nm
12.2(37)SG
DWDM-SFP-3582=
Cisco 1000BASE-DWDM SFP 1535.82 nm
12.2(37)SG
DWDM-SFP-3504=
Cisco 1000BASE-DWDM SFP 1535.04 nm
12.2(37)SG
DWDM-SFP-3425=
Cisco 1000BASE-DWDM SFP 1534.25 nm
12.2(37)SG
DWDM-SFP-3268=
Cisco 1000BASE-DWDM SFP 1532.68 nm
12.2(37)SG
DWDM-SFP-3190=
Cisco 1000BASE-DWDM SFP 1531.90 nm
12.2(37)SG
DWDM-SFP-3112=
Cisco 1000BASE-DWDM SFP 1531.12 nm
12.2(37)SG
DWDM-SFP-3033=
Cisco 1000BASE-DWDM SFP 1530.33 nm
12.2(37)SG
DWDM-SFP-6141=1
Cisco 1000BASE-DWDM SFP 1561.41 nm
12.2(53)SG3
DWDM-SFP-5736=2
Cisco 1000BASE-DWDM SFP 1557.36 nm
12.2(53)SG3
DWDM-SFP-5332=3
Cisco 1000BASE-DWDM SFP 1553.32 nm
12.2(53)SG3
DWDM-SFP-4931=4
Cisco 1000BASE-DWDM SFP 1540.31 nm
12.2(53)SG3
DWDM-SFP-4532=5
Cisco 1000BASE-DWDM SFP 1545.32 nm
12.2(53)SG3
DWDM-SFP-4134=6
Cisco 1000BASE-DWDM SFP 1541.34 nm
12.2(53)SG3
DWDM-SFP-3739=7
Cisco 1000BASE-DWDM SFP 1537.39 nm
12.2(53)SG3
DWDM-SFP-3346=8
Cisco 1000BASE-DWDM SFP 1533.46 nm
12.2(53)SG3
1 Not supported on Cisco IOS Release 12.2(54)SG and Cisco IOS XE Release 3.1.0 SG.
2 Not supported on Cisco IOS Release 12.2(54)SG and Cisco IOS XE Release 3.1.0 SG.
3 Not supported on Cisco IOS Release 12.2(54)SG and Cisco IOS XE Release 3.1.0 SG.
4 Not supported on Cisco IOS Release 12.2(54)SG and Cisco IOS XE Release 3.1.0 SG.
5 Not supported on Cisco IOS Release 12.2(54)SG and Cisco IOS XE Release 3.1.0 SG.
6 Not supported on Cisco IOS Release 12.2(54)SG and Cisco IOS XE Release 3.1.0 SG.
7 Not supported on Cisco IOS Release 12.2(54)SG and Cisco IOS XE Release 3.1.0 SG.
8 Not supported on Cisco IOS Release 12.2(54)SG and Cisco IOS XE Release 3.1.0 SG.
Table 5 briefly describes the four chassis in the Catalyst 4500 Series Switch. For the chassis listed in the table, refer to Table 6 for software release information.
Supported Hardware on Catalyst 4500 E-Series Switch
In addition to the classic line cards and supervisor engines, Cisco IOS Software Release 12.2(54)SG supports the next-generation high-performance E-Series Supervisor Engine 6-E with CenterFlex technology and E-Series line cards and chassis. A brief list of primary E-Series hardware supported on Catalyst 4500 series switch (Table 7).
Table 8 outlines the chassis and supervisor engine compatibility.
(M=Minimum release, R=Recommended release)
Supported Features on the Catalyst 4500 Series Switch
Table 9 lists the Cisco IOS software features for the Catalyst 4500 Series Switch.
Table 9 Cisco IOS Software Feature Set for the Catalyst 4500 Series and E-Series Switch
Storm Control
Storm Control: Per-Port Multicast Suppression (Sup 6-E only)
Multicast Storm Control1
IP Source Guard
IP Source Guard for Static Hosts
PVRST+
Layer 2 protocol tunneling
Layer 2 transparent bridging2
Layer 2 MAC3 learning, aging, and switching by software
Unicast MAC address filtering
VMPS4 Client
Layer 2 hardware forwarding up to 102 Mpps
Layer 2 Control Policing (Sup 6-E and Sup 6L-E only)
Layer 2 switch ports and VLAN trunks
Spanning-Tree Protocol (IEEE 802.1D) per VLAN
802.1s and 802.1w
Layer 2 traceroute
Unidirectional Ethernet port
Per-VLAN spanning tree (PVST) and PVST+
Spanning-tree root guard
Spanning-tree Loop guard and PortFast BPDU Filtering
Support for 9216 byte frames
Port security on PVLANs
Private VLANs
Private VLAN DHCP snooping
Private VLAN promiscuous trunk
Private VLAN trunks5
Community PVLANs
ISL6 -based VLAN encapsulation (excluding blocking ports on WS-X4418-GB and WS-X4412-2GB-T)7
IEEE 802.1Q-based VLAN encapsulation
Multiple VLAN access port
VLAN Trunking Protocol (VTP) and VTP domains
VTP v3
No. of VLAN support per switch: 2048 (for LAN Base), 4096 (for IP Base)
Unidirectional link detection (UDLD) and aggressive UDLD
Sub-second UDLD (Fast UDLD)
SNMP V3 support for Bridge-MIB with VLAN indexing
Resilient Ethernet Protocol
Ethernet CFM
Ethernet OAM Protocol
802.1Q Tunneling (Q in Q)8
Pragmatic General Multicast
ANCP Client9
PIM-SSM mapping
Bidiectional PIM10
Auto RP Listener
IP and IP multicast routing and switching between Ethernet ports
IP Multicast Load Splitting (Equal Cost Multipath (ECMP) using S, G and Next-hop)
Static IP routing
Classless routing11
PBR12
Dynamic Buffer Limiting
Selective Dynamic Buffer Limiting
QoS-based forwarding based on IP precedence
Trusted boundary
Cisco Modular QoS Command-Line Interface (Sup 6-E and Sup 6L-E only)
Auto QoS
Match CoS for non-IPV4 traffic
IPv6 Forwarding in Hardware (Sup 6-E and Sup 6L-E only)
CoS Mutation
CEF13 load balancing
uRPF14 (Sup 6-E and Sup 6L-E only)
Hardware-based IP CEF routing at 48 Mpps
Up to 128,000 IP routes
Up to 32,000 IP host entries (Layer 3 adjacencies)
Up to 16,000 IP multicast route entries
Multicast flooding suppression for STP changes
Software routing of IPX, AppleTalk, and IPv6.
IGMPv1, IGMPv2, and IGMPv3 (Full Support)
IGMP Querier
VRF-lite
Multicast VRF-lite15
VRF-aware IP services
VRF-aware TACACS+
Route Leaking16
IP Unnumbered
SVI Autostate Exclude
IS-IS17
DTP18
RIP19 and RIP II
EIGRP20
EIGRP IPv6 (Sup 6-E and Sup 6L-E only)
OSPF21
OSPF for Routed Access22
BGP423
BGP route-map Continue
BGP Neighbor Policy
MBGP24
MSDP25
ICMP26 Router Discovery Protocol
PIM27 —sparse and dense mode
Static routes
Classless interdomain routing (CIDR)
DVMRP28
SSM
NTP29
WCCP version 2 Layer 2 Redirection
VRRP30
SCP31
GLBP32
Cisco EtherChannel technology - 10/100/1000 Mbps, 10 Gbps
Load balancing for routed traffic, based on source and destination IP addresses
Load sharing for bridged traffic based on MAC addresses
ISL on all EtherChannels
IEEE 802.1Q on all EtherChannels
Bundling of up to eight Ethernet ports
Up to 64 active Ethernet port channels
Trunk Port Security over EtherChannel
Link State Tracking
Link Layer Discovery Protocol (LLDP)
Link Layer Discovery Protocol Media Endpoint Discovery (LLDP-MED)
PoEP via LLDP
DSCP/CoS via LLDP
Routed Jumbo Frame support
SPAN CPU port mirroring
SPAN packet-type filtering
SPAN destination in-packets option
SPAN ACL filtering
RSPAN
Enhanced VLAN statistics
Netflow version 8
NetFlow Statistics Collection
NetFlow Statistics Export Version 1 and Version 5
NetFlow Bridged IP Flow
Secondary addressing
Bootstrap protocol (BOOTP)
Authentication, authorization, and accounting using TACACS+ and RADIUS protocol
Cisco Discovery Protocol (CDP)
CDP 2nd Port Status TLV
FlexLink and MAC Address-Table Move Update
802.1ab Link Layer Discovery Protocol (LLDP)
802.1ab LLDP Media Discovery (LLDP-MED)
Network Mobility Services Protocol
Selecting Mode of Capturing Control Packets (Not supported on Sup 6-E)
Sticky port security
Trunk port security
Voice VLAN Sticky port security
Cisco Group Management Protocol (CGMP) server support
HSRP33 over Ethernet, EtherChannels - 10/100/1000Mbps, 10 Gbps
HSRP v2 for IPv4
HSRP v2 for IPv6
IGMP snooping version1, version 2, and version 3 (Full Support)
IGMP filtering
Port Aggregation Protocol (PagP)
802.3ad LACP
SSH version 1 and version 234
Inline power preallocation
show interface capabilities command
IfIndex persistence
UDLR35
Enhanced SNMP MIB support
SNMP36 version 1, version 2, and version 3
SNMP version 3 (with encryption)
IPv6 Multicast Listener Discovery Snooping (Sup 6-E and 6L-E only)
IPv6 PACL (Sup 6-E and 6L-E only)
IPv6 RA Guard (Sup 6-E and 6L-E only)
IPv6 Interface Statistics (Sup 6-E and 6L-E only)
DHCP server and relay-agent
DHCP snooping
DHCP client autoconfiguration
DHCP Option 82 Pass Through
DHCP Relay Agent for IPv6 37
802.1X Multiple Domain Authentication and Multiple Authorization
802.1X with ACL Assignment and Redirect URLs
802.1X with per-user ACL and Filter-ID ACL
RADIUS-Provided Session Timeouts
RADIUS CoA
MAC Move and Replace
802.1X with Guest VLANs
802.1X port-based authentication
802.1X with port security
802.1X accounting
802.1X with voice VLAN ID
802.1X private VLAN assignment
802.1X private guest VLAN
802.1X RADIUS-supplied session timeout
802.1X authentication failure VLAN
802.1X MAC Authentication Bypass
802.1X Inaccessible Authentication Bypass
802.1X with User Distribution
802.1X Unidirectional Controlled Port
802.1X MDA with Voice Assignment
Cisco TrustSec SGT Exchange Protocol (SXP) IPv4
Flexible Authentication Sequencing
Multi-Authentication
Open Authentication
Web Authentication
Local Web Authentication (EPM syslog and Common session ID)
PPPoE Intermediate Agent38
Cisco NAC39 Layer 2 802.1X
Port flood blocking
Router standard and extended ACLs 40 on all ports with no performance penalty
Identity 4.1 ACL Policy Enforcement41
Identity 4.1 Network Edge Access Topology
Extended IPX ACL
VLAN ACL
PACL42
Time-based ACL
Downloadable ACLs
Control Plane Policing
Two-Rate Three-Color Policing (Sup 6-E and Sup 6L-E only)
Local Proxy ARP
Dynamic ARP Inspection on PVLANs
Dynamic ARP Inspection
Dynamic Multi-Protocol Ternary Content Addressable Memory (Sup 6-E and Sup 6L-E only)
Per-port QoS43 rate-limiting and shaping
QoS for IPv6
Per-port Per-VLAN QoS
Per-VLAN CTI
ARP QoS (Sup 6-E and Sup 6L-E only)
Inline power support for Cisco IP phones
PoE44
Energy Wise
Enhanced Power over Ethernet Support (Sup 6-E and Sup 6L-E only)
Power redundancy
RPR45
SSO46
SSO Aware HSRP
SSO support for routed ports
Non-stop Forwarding Awareness
Non-stop Forwarding Awareness for EIGRP-stub in IP base for all supervisor engines
Non-stop Forwarding with Stateful Switchover
ISSU47
MAC Address Notification
Combined Mode Power Resiliency
SmartPort macros
AutoSmartPort macros
Forced 10/100 Auto Negotiation
802.1s standards compliance
IS-IS MIB
OSPF and EIGRP Fast Convergence48
Time Domain Reflectometry
CNA49
CLI to turn off Auto MDIX50
Logging redirection
Service-Aware Resource Allocation (Sup 6-E and Sup 6L-E only)
TwinGig Converter Module (Sup 6-E nd 6L-E only)
FAT File System (Sup 6-E and Sup 6L-E only)
High Availability: 2+2 10GE or 4+4 1GE active uplinks (Sup 6-E only)
EEM51
EEM with ISSU
VSS client with PagP+
IP/SLA52
Embedded management53
MAC notify MIB
Eight configurable queues per port (Sup 6-E and Sup 6L-E only)
X2 Link Debounce Timer
IP SLA
Enhanced Object Tracking subfeatures:
•
•
•
•
•
Management port
Management Port Features with IPv6
Inactivity Timer
OBFL54
boot config command
Crashdump enhancement
Unicast MAC filtering
Smart Call Home
DHCPv6 Ethernet Remote ID option
DHCPv6 Relay - Persistent Interface ID option DHCPv6 Relay Agent notification for Prefix Delegation
PIM SSM Mapping
VRF lite NSF support with routing protocols OSPF/EIGRP/BG
PIM Accept Register - Rogue Multicast Server Protection55
Configuration Rollback
Archiving crashfile information
Per-VLAN Learning
XML Programmatic Interface
VLAN Mapping (VLAN Translation)
GOLD Online Diagnostics (Sup 6-E and 6L-E only)
IPSG for Static Hosts
Layer Control Packet
1 Requires the Catalyst 4500 series switch Supervisor Engine V
2 Hardware-based transparent bridging within a VLAN
3 MAC = Media Access Control
4 VMPS = VLAN Management Policy Server
5 Only Supervisr Engine 6-E
6 ISL = Inter-Switch Link
7 Ports 3 thru 18 on the WS-X4418-GB and ports 1 thru 12 on the WS-X4412-2GB
8 Requires the Catalyst 4500 series switch Supervisor Engine V
9 not supported on E-Series Supervisor Engine 6-E
10 Only Supervisr Engine 6-E
11 The ip classless command is not supported as classless routing is enabled by default.
12 PBR = policy-based routing
13 CEF = Cisco Express Forwarding
14 uRPF = Unicast Reverse Path Forwarding
15 Only Supervisr Engine 6-E
16 Route Leaking from a global routing table into a VRF and Route Leaking from a VRF into a global routing table
17 IS-IS = Intermediate System to Intermediate System
18 DTP = Dynamic Trunking Protocol
19 RIP = Routing Information Protocol
20 EIGRP = Enhanced Interior Gateway Routing Protocol
21 OSPF = Open Shortest Path First
22 Support for Supervisor Engine 6-E and Supervisor Engine 6L-E only
23 BGP4 = Border Gateway Protocol 4
24 MBGP = Multicast Border Gateway Protocol
25 MSDP = Multicast Source Discovery Protocol
26 ICMP = Internet Control Message Protocol
27 PIM = Protocol Independent Multicast
28 DVMRP = Distance Vector Multicast Routing Protocol
29 NTP = Network Time Protocol
30 VRRP = Virtual Router Redundancy Protocol
31 SCP = Secure Copy Protocol
32 GLBP = Gateway Load Balancing Protocol
33 HSRP = Hot Standby Router Protocol
34 SSH = Secure Shell Protocol
35 UDLR = Unidirectional Link Routing
36 SNMP = Simple Network Management Protocol
37 only Sup 6-E and 6L-E
38 not supported on E-Series Supervisor Engine 6-E
39 NAC = Network Admission Control
40 ACLs = Access Control Lists
41 filter-ID and per-user ACL
42 PACL = Port Access Control List
43 QoS = Quality of Service
44 PoE = Power over Ethernet
45 RPR = Supervisor engine redundancy
46 SSO = Stateful switchover (includes Stateful IGMP Snooping and Stateful DHCP Snooping)
47 ISSU = In Service Software Upgrade Process
48 The Catalyst 4500 series switch supports Fast Hellos, ISPF, and LSA Throttling.
49 CNA = Cisco Network Assistant; Minimum CNA release that supports Releases 12.2(25)EW is 1.0(2). Minimum CNA release that supports Release 12.2(20)EWA is 1.0(1).
50 On supported linecards: WS-X4124-RJ45, WS-X4148-RJ (and WS-X4232-GB-RJ) with hardware revision 3.0 or higher
51 EEM = Embedded Event anager
52 Includes HTTPS-HTTP with SSL 3.0, CEF-MIB, Embedded Syslog Manage, ...
53 Includes SNMP over IPv6, SYSLOG, HTTP over IPv6.
54 OBFL = On Board Failure Logging; Supverisor Engine 6-E only
55 The route-map keyword is not supported.
Features Unique to Supervisor Engines 6-E and 6L-E
With Cisco IOS Release 12.2(54)SG, the following features are available only with
Supervisor Engine 6-E and Supervisor Engine 6L-E:•
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
–
•
•
•
–
–
–
•
•
•
Unsupported Features
For all Supervisor Engines (II-Plus thru 6-E), the following features are not supported in Cisco IOS Release 12.2(54)SG for the Catalyst 4500 series switches:
•
–
–
–
–
•
•
•
•
–
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
New and Changed Information
These sections describe the new and changed information for the Catalyst 4500 series switch running Cisco IOS software:
•
•
•
•
•
•
•
•
New Hardware Features in Release 12.2(37)SG
Note
Release 12.2(37)SG provides the following new hardware for the Catalyst 4500 series switch:
•
•
New Software Features in Release 12.2(37)SG
Release 12.2(37)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:
Note
•
•
•
•
•
For details, locate the feature entry in the Feature Information Table located toward the end of the "Connecting to a Service Provider Using External BGP" module
•
•
Note
New Hardware Features in Release 12.2(31)SGA
Note
Following hardware was supported:
•
New Software Features in Release 12.2(31)SGA
Release 12.2(31)SGA provides the following Cisco IOS software features for the Catalyst 4500 series switch:
Note
•
•
•
•
•
•
•
Note
New Hardware Features in Release 12.2(31)SG
Release 12.2(31)SG provides the following new hardware for the Catalyst 4500 series switch:
•
New Software Features in Release 12.2(31)SG
Release 12.2(31)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:
Note
•
•
•
•
•
•
•
•
•
•
•
•
•
Note
New Hardware Features in Release 12.2(25)SG
Release 12.2(25)SG provides the following new hardware for the Catalyst 4500 series switch:
•
•
•
•
•
•
New Software Features in Release 12.2(25)SG
Note
Release 12.2(25)SG provides the following Cisco IOS software features for the Catalyst 4500 series switch:
•
Note
•
•
•
•
•
•
•
•
•
•
•
Note
Upgrading the System Software
In most cases, upgrading the switch to a newer release of Cisco IOS software does not require a ROMMON upgrade. However, if you are running an early release of Cisco IOS software and plan to upgrade, refer to the following tables for the minimum Cisco IOS image and the recommended ROMMON release, respectively.
Note
Caution
The following sections describe how to upgrade your switch software:
•
•
•
•
Guidelines for Upgrading the ROMMON
Caution
Upgrading the Supervisor Engine ROMMON from the Console
Caution
Note
Follow this procedure to upgrade your supervisor engine ROMMON:
Step 1
Note
Step 2
The cat4000-ios-promupgrade-121_20r_EW1 programs are available on Cisco.com at the same location from which you download Catalyst 4000 system images.
Step 3
squeeze bootflash: command to reclaim the space.If you are using a CompactFlash card, replace bootflash: with slot0:.
Step 4
The following example shows how to download the PROM upgrade image cat4000-ios-promupgrade-121_20r_EW1 from the remote host 172.20.58.78 to bootflash:
Switch# copy tftp: bootflash: Address or name of remote host [172.20.58.78]? Source filename [cat4000-ios-promupgrade-121_20r_EW1]? Destination filename [cat4000-ios-promupgrade-121_20r_EW1]? Accessing tftp://172.20.58.78/cat4000-ios-promupgrade-121_20r_EW1... Loading cat4000-ios-promupgrade-121_20r_EW1 from 172.20.58.78 (viaFastEthernet2/1):!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!![OK - 455620 bytes]455620 bytes copied in 2.644 secs (172322 bytes/sec) Switch#Step 5
The following example shows the output after a reset into ROMMON:
Switch# reloadProceed with reload? [confirm]03:57:16:%SYS-5-RELOAD:Reload requested*********************************************************** ** Welcome to Rom Monitor for WS-X4515 System. ** Copyright (c) 2002 by Cisco Systems, Inc. ** All rights reserved. ** ***********************************************************Rom Monitor Program Version 12.1(12r)EW..(output truncated).Established physical link 100MB Half DuplexNetwork layer connectivity may take a few secondsrommon 1 >Step 6
boot bootflash:cat4000-ios-promupgrade-121_20r_EW1
Caution
The following example shows the output from a successful upgrade, followed by a system reset:
rommon 2 > boot bootflash:cat4000-ios-promupgrade-121_20r_EW1*********************************************************** ** Rom Monitor Upgrade Utility For WS-X4515 System ** This upgrades flash Rom Monitor image to the latest ** ** Copyright (c) 2002, 2003 by Cisco Systems, Inc. ** All rights reserved. ** ***********************************************************Image size = 314.236 KBytesMaximum allowed size = 511.75 KBytesUpgrading your PROM... DO NOT RESET the systemunless instructed or upgrade of PROM will fail !!!Beginning erase of 0x80000 bytes at offset 0x3f80000... Done!Beginning write of prom (0x4e8ec bytes at offset 0x3f80000)...This could take as little as 30 seconds or up to 2 minutes.Please DO NOT RESET!Success! The prom has been upgraded successfully.System will reset itself and reboot in about 15Step 7
Step 8
The following example shows how to delete the cat4000-ios-promupgrade-121_20r_EW1 image from bootflash and reclaim unused space:
Switch# delete bootflash:cat4000-ios-promupgrade-121_20r_EW1Switch# squeeze bootflash:All deleted files will be removed, proceed (y/n) [n]? ySqueeze operation may take some time, proceed (y/n) [n]? ySwitch#Step 9
Switch#show versionCisco Internetwork Operating System SoftwareIOS (tm) Catalyst 4500 L3 Switch Software (cat4500-I9S-M), Version 12.1(20)EW, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)TAC Support: http://www.cisco.com/tacCopyright (c) 1986-2003 by cisco Systems, Inc.Compiled Wed 22-Oct-03 23:42 by kellmillImage text-base: 0x00000000, data-base: 0x00F56DDCROM: 12.1(20r)EW1Dagobah Revision 86, Swamp Revision 28Switch uptime is 0 day, 0 hour, 5 minutesSystem returned to ROM by reloadSystem image file is "bootflash:cat4500-i9s-mz.121-20.EW1"cisco WS-C4503 (XPC8245) processor (revision 7) with 524288K bytes of memory.Processor board ID FOX06460YD8Last reset from Reload3 Ethernet/IEEE 802.3 interface(s)51 FastEthernet/IEEE 802.3 interface(s)2 Gigabit Ethernet/IEEE 802.3 interface(s)403K bytes of non-volatile configuration memory.Configuration register is 0x2102Switch#
The ROMMON has now been upgraded.
See the "Upgrading the Cisco IOS Software" section for instructions on how to upgrade the Cisco IOS software on your switch.
Upgrading the Supervisor Engine ROMMON Remotely Using Telnet
Caution
Follow this procedure to upgrade your supervisor engine ROMMON to Release 12.1(20r)EW1. This procedure can be used when console access is not available and when the ROMMON upgrade must be performed remotely.
Note
Step 1
Note
Step 2
The cat4000-ios-promupgrade-121_20r_EW1 programs are available on Cisco.com at the same location from which you download Catalyst 4500 system images.
Step 3
squeeze bootflash: command to reclaim the space.If you are using a CompactFlash card, replace bootflash: with slot0:.
Step 4
copy tftp command.The following example shows how to download the PROM upgrade image cat4000-ios-promupgrade-121_20r_EW1 from the remote host 172.20.58.78 to bootflash:
Switch# copy tftp: bootflash: Address or name of remote host [172.20.58.78]? Source filename [cat4000-ios-promupgrade-121_20r_EW1]? Destination filename [cat4000-ios-promupgrade-121_20r_EW1]? Accessing tftp://172.20.58.78/cat4000-ios-promupgrade-121_20r_EW1... Loading cat4000-ios-promupgrade-121_20r_EW1 from 172.20.58.78 (viaFastEthernet2/1):!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! [OK - 455620 bytes]455620 bytes copied in 2.644 secs (172322 bytes/sec) Switch#Step 5
Switch# configure terminalSwitch(config)# no boot system flash bootflash:cat4000-i5s-mz.121-19.EW1.binSwitch(config)# exitSwitch# writeBuilding configuration...Compressed configuration from 3641 to 1244 bytes [OK]Switch#Use the boot system flash bootflash:file_name command to set the BOOT variable. You will use two BOOT commands: one to upgrade the ROMMON and a second to load the Cisco IOS software image after the ROMMON upgrade is complete. Notice the order of the BOOT variables in the example below. At bootup the first BOOT variable command upgrades the ROMMON. When the upgrade is complete the supervisor engine will autoboot, and the second BOOT variable command will load the Cisco IOS software image specified by the second BOOT command.
Note
In this example, we assume that the console port baud rate is set to 9600 bps and that the config-register is set to 0x0102.Use the config-register command to autoboot using image(s) specified by the BOOT variable. Configure the BOOT variable to upgrade the ROMMON and then autoboot the IOS image after the ROMMON upgrade is complete. In this example, we are upgrading the ROMMON to version 12.1(20r)EW1. After the ROMMON upgrade is complete, the supervisor engine will boot Cisco IOS software Release 12.1(20)EW1.config-register to 0x0102.Switch# configure terminalSwitch(config)# boot system flash bootflash:cat4000-ios-promupgrade-121_20r_EW1Switch(config)# boot system flash bootflash:cat4000-i9s-mz.121-20.EW1Switch(config)# config-register 0x0102Switch(config)# exitSwitch# writeBuilding configuration...Compressed configuration from 3641 to 1244 bytes [OK]Switch#Step 6
Switch# sh bootvarBOOT variable = bootflash:cat4000-ios-promupgrade-121_20r_EW1,1;bootflash:cat4000-i9s-mz.121-20.EW1,1CONFIG_FILE variable does not existBOOTLDR variable does not existConfiguration register is 0x2102Step 7
Caution
The following example shows the console port output from a successful ROMMON upgrade followed by a system reset. Your Telnet session is disconnected during the ROMMON upgrade, so you will not see this output. This step could take 2-3 minutes to complete. You will need to reconnect your Telnet session after 2-3 minutes when the Cisco IOS software image and the interfaces are loaded.
Switch#reloadProceed with reload? [confirm]1d05h: %SYS-5-RELOAD: Reload requested*********************************************************** ** Welcome to Rom Monitor for WS-X4515 System. ** Copyright (c) 2002 by Cisco Systems, Inc. ** All rights reserved. ** ***********************************************************Rom Monitor Program Version 12.1(12r)EWBoard type 2, Board revision 7Swamp FPGA revision 28, Dagobah FPGA revision 86***** The system will autoboot in 5 seconds *****Type control-C to prevent autobooting.. . . . .Established physical link 100MB Full DuplexNetwork layer connectivity may take a few seconds******** The system will autoboot now ********config-register = 0x0102Autobooting using BOOT variable specified file.....Current BOOT file is --- bootflash:cat4000-ios-promupgrade-121_20r_EW1*********************************************************** ** Rom Monitor Upgrade Utility For WS-X4515 System ** This upgrades flash Rom Monitor image to the latest ** ** Copyright (c) 2002, 2003 by Cisco Systems, Inc. ** All rights reserved. ** ***********************************************************Image size = 314.236 KBytesMaximum allowed size = 511.75 KBytesUpgrading your PROM... DO NOT RESET the systemunless instructed or upgrade of PROM will fail !!!Beginning erase of 0x80000 bytes at offset 0x3f80000... Done!Beginning write of prom (0x4e8ec bytes at offset 0x3f80000)...This could take as little as 30 seconds or up to 2 minutes.Please DO NOT RESET!Success! The prom has been upgraded successfully.System will reset itself and reboot in about 15..(output truncated).******** The system will autoboot now ********config-register = 0x0102Autobooting using BOOT variable specified file.....Current BOOT file is --- bootflash:cat4000-i9s-mz.121-20.EW1Rommon reg: 0x56000380Running IOS...Decompressing the image#################################################################################################################################################################################################################################################################################################################################################################################################################################################################################### [OK]Step 8
Switch# configure terminalSwitch(config)# no boot system flash bootflash:cat4000-ios-promupgrade-121_20r_EW1Switch(config)# exitSwitch# writeBuilding configuration...Compressed configuration from 3641 to 1244 bytes [OK]Switch#Step 9
Switch#show versionCisco Internetwork Operating System SoftwareIOS (tm) Catalyst 4000 L3 Switch Software (cat4000-I9S-M), Version 12.1(20)EW, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)TAC Support: http://www.cisco.com/tacCopyright (c) 1986-2003 by cisco Systems, Inc.Compiled Wed 22-Oct-03 23:42 by kellmillImage text-base: 0x00000000, data-base: 0x00F56DDCROM: 12.1(20r)EW1Dagobah Revision 86, Swamp Revision 28Switch uptime is 0 day, 0 hour, 5 minutesSystem returned to ROM by reloadSystem image file is "bootflash:cat4000-i9s-mz.121-20.EW1"cisco WS-C4503 (XPC8245) processor (revision 7) with 524288K bytes of memory.Processor board ID FOX06460YD8Last reset from Reload3 Ethernet/IEEE 802.3 interface(s)51 FastEthernet/IEEE 802.3 interface(s)2 Gigabit Ethernet/IEEE 802.3 interface(s)403K bytes of non-volatile configuration memory.Configuration register is 0x0102Switch#Step 10
The following example shows how to delete the cat4000-ios-promupgrade-121_20r_EW1 image from bootflash and reclaim unused space:
Switch# delete bootflash:cat4000-ios-promupgrade-121_20r_EW1Switch# squeeze bootflash:All deleted files will be removed, proceed (y/n) [n]? ySqueeze operation may take some time, proceed (y/n) [n]? ySwitch#Step 11
Switch#sh bootvarBOOT variable = bootflash:cat4000-i9s-mz.121-20.EW1,1CONFIG_FILE variable does not existBOOTLDR variable does not existConfiguration register is 0x0102
The ROMMON has now been upgraded.
See the "Upgrading the Cisco IOS Software" section for instructions on how to upgrade the Cisco IOS software on your switch.
Upgrading the Cisco IOS Software
Caution
Before you proceed, observe the following rules for hostname:
•
Uppercase and lowercase characters look the same to many internet software applications. It may seem appropriate to capitalize a name the same way you might do in English, but conventions dictate that computer names appear all lowercase. For more information, refer to RFC 1178, Choosing a Name for Your Computer.
•
•
•
•
To upgrade the Cisco IOS software on your Catalyst 4500 series switch, use this procedure:
Step 1
Step 2
If you are using a CompactFlash card, use slot0: instead of bootflash.
Step 3
The following example shows how to download the Cisco IOS software image cat4000-is-mz.121-12c.EW from the remote host 172.20.58.78 to bootflash:
Switch# copy tftp: bootflash:Address or name of remote host [172.20.58.78]?Source filename [cat4000-is-mz121_12c.EW]?Destination filename [cat4000-is-mz.121-12c.EW]?Accessing tftp://172.20.58.78/cat4000-is-mz.121-12c.EW...Loading cat4000-is-mz.121-12c.EW from 172.20.58.78 (viaFastEthernet2/1):!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!|!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!![OK - 6923388/13846528 bytes]6923388 bytes copied in 72.200 secs (96158 bytes/sec)Switch#Step 4
The following example shows how to clear the BOOT variable:
Switch# configure terminalSwitch(config)# no boot system flash bootflash:cat4000-is-mz.121-8a.EWSwitch(config)# exitSwitch# writeBuilding configuration...Compressed configuration from 3641 to 1244 bytes [OK]Switch#Step 5
The following example shows how to add the cat4000-is-mz.121-12c.EW image to the BOOT variable:
Switch# configure terminalSwitch(config)# boot system flash bootflash:cat4000-is-mz.121-12c.EWSwitch(config)# exitSwitch# writeBuilding configuration...Compressed configuration from 3641 to 1244 bytes [OK]Switch#Step 6
The following example show how to set the second least significant bit in the configuration register:
Switch# configure terminalSwitch(config)# config-register 0x2102Switch(config)# exitSwitch# writeBuilding configuration...Compressed configuration from 3723 to 1312 bytes [OK]Switch#Step 7
Caution
The following example shows the output from a successful upgrade followed by a system reset:
Switch# reloadRommon reg: 0x2B004180Upgrading FPGA...Decompressing the image############## [OK]******************************************************** ** WS-X4014 FPGA Upgrade Utility For WS-X4014 Machines ** ** Copyright (c) 2002 by Cisco Systems, Inc. ** All rights reserved. ** ***********************************************************Image size = 483.944 KBytesMaximum allowed size = 1023.75 KBytesUpgrading your FPGA image... DO NOT RESET the systemunless instructed or upgrade of FPGA will fail !!!Beginning erase of 0x100000 bytes at offset 0x3d00000... Done!Beginning write of fpga image (0x78fb0 bytes at offset 0x3d00000)...This could take as little as 30 seconds or up to 2 minutes.Please DO NOT RESET!Success! FPGA image has been upgraded successfully.System will reset itself and reboot in about 15 seconds.0*********************************************************** ** Welcome to Rom Monitor for WS-X4014 System. ** Copyright (c) 2002 by Cisco Systems, Inc. ** All rights reserved. ** ***********************************************************Rom Monitor Program Version 12.1(12r)EWBoard type 1, Board revision 5Swamp FPGA revision 16, Dagobah FPGA revision 47MAC Address : 00-30-85-XX-XX-XXIP Address : 10.10.10.91Netmask : 255.255.255.0Gateway : 10.10.10.1TftpServer : Not set.Main Memory : 256 MBytes***** The system will autoboot in 5 seconds *****Type control-C to prevent autobooting.Switch#Step 8
Limitations and Restrictions
These sections list the limitations and restrictions for the current release of Cisco IOS software on the Catalyst 4500 series switch.
All Supervisor Engines
•
CSCsy31324
•
•
•
•
–
–
–
–
–
–
•
The outputs of certain commands, such as show ip route and show access-lists, contain non-deterministic text. While the output is easily understood, the output text does not contain strings that are consistently output. A general purpose specification file entry is unable to parse all possible output.
Workaround (1):
While a general purpose specification file entry may not be possible, a specification file entry might be created that returns the desired text by searching for text that is guaranteed to be in the output. If a string is guaranteed to be in the output, it can be used for parsing.
For example, the output of the show ip access-lists SecWiz_Gi3_17_out_ip command is this:
Extended IP access list SecWiz_Gi3_17_out_ip10 deny ip 76.0.0.0 0.255.255.255 host 65.65.66.6720 deny ip 76.0.0.0 0.255.255.255 host 44.45.46.4730 permit ip 76.0.0.0 0.255.255.255 host 55.56.57.57The first line is easily parsed because access list is guaranteed to be in the output:
<Property name="access list" alias="Name" distance="1.0" length="-1" type="String" />The remaining lines all contain the term host. As a result, the specification file may report the desired values by specifying that string. For example, this line
<Property name="host" alias="rule" distance="s.1" length="1" type="String" />will produce the following for the first and second rules
<rule>deny</rule>and the following for the third statement
<rule>permit<rule>Workaround (2):
Request the output of the show running-config command using NETCONF and parse that output for the desired strings. This is useful when the desired lines contain nothing in common. For example, the rules in this access list do not contain a common string and the order (three permits, then a deny, then another permit), prevent the spec file entry from using permit as a search string, as in the following example:
Extended MAC access list MACCOYpermit 0000.0000.ffef ffff.ffff.0000 0000.00af.bcef ffff.ff00.0000 appletalkpermit any host 65de.edfe.fefe xns-idppermit any any protocol-family rarp-non-ipv4deny host 005e.1e5d.9f7d host 3399.e3e1.ff2c dec-spanningpermit any anyThe XML output of show running-config command includes the following, which can then be parsed programmatically, as desired:
<mac><access-list><extended><ACLName>MACCOY</ACLName></extended></access-list></mac><X-Interface> permit 0000.0000.ffef ffff.ffff.0000 0000.00af.bcef ffff.ff00.0000 appletalk</X-Interface><X-Interface> permit any host 65de.edfe.fefe xns-idp</X-Interface><X-Interface> permit any any protocol-family rarp-non-ipv4</X-Interface><X-Interface> deny host 005e.1e5d.9f7d host 3399.e3e1.ff2c dec-spanning</X-Interface><X-Interface> permit any any</X-Interface>•
•
•
For Supervisor Engines II+Plus through V-10GE
•
–
–
–
–
•
–
–
–
–
•
–
–
–
•
–
–
–
–
•
–
–
–
•
–
–
–
•
•
spanning-tree link-type point-to-point.•
Workaround: Configure the NSF interval timer to 0 minutes, or delay entering the issu runversion command until the NSF interval timer expires and NSF restarts.
•
Workaround: None.
•
•
•
•
•
•
•
•
For example, if the active supervisor engine is in slot 1, and you have configured interface Gi1/1, the supervisor engine in slot 2 becomes active if you remove the active supervisor engine from the chassis. In addition, while the startup configuration file is being parsed, you will receive an error message indicating that interface Gi1/1 is no longer present. This behavior is correct. When the formerly active supervisor engine is reinserted into slot 1, there is no configuration for interface Gi1/1.
This situation does not occur when both supervisor engines are present in the chassis.
Workaround: Copy the startup configuration file into the running configuration:
Switch# copy startup-config running-config•
Workaround: Display the configuration with the show standby command, then remove the CLI. Here is an example of the show standby GigabitEthernet1/1 command output:
switch(config)# interface g1/1switch(config)# no standby 0 name (0 is hsrp group number)•
Use the standby delay reload option if the router is rebooting after reloading the image.
•
Workaround: Because the problem is caused by mismatched MTUs, you should change the MTU on either router to match the other's MTU.
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Workaround: Remove and reinsert the standby supervisor engine after the active supervisor engine boots. (CSCsa66509)
•
Catalyst 4500 series two-port Gigabit Ethernet line card (WS-X4302-GB) in the 10th slot.•
switchport private-vlan mapping trunk command is 500. For example, one thousand secondary VLANs could map to one primary VLAN, or one thousand secondary VLANs could map one to one to one thousand primary VLANs.•
PoE switching modules:
–
–
–
–
–
–
–
PoE-enabled power supplies:
–
–
–
–
–
–
•
•
•
•
•
00:02:57: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.20.246.206:1645,1646 is not responding.If this message appears, verify that the switch is connected to the ACS. You should also ensure that the switch has been properly configured as an AAA client on the ACS.
•
•
Workaround: Disable idle timeouts. (CSCec30214)
•
Workarounds:
1. Disable inline power on the switch ports using the power inline never command.
2. Configure the media converter to autonegotiate the speed and duplex instead of running them at 100 Mbps and full duplex. (CSCee62109)
•
–
–
•
•
•
•
•
–
–
•
–
–
–
–
•
•
–
–
–
–
To maximize the 10/100/1000 port density of 7- and 10-slot chassis when using redundant Supervisor Engine 6-E, install WS-X4548-GB-RJ45 instead of WS-X4448-GB-RJ45 line cards. If you require WS-X4448-GB-RJ45 line cards, two options are available:
–
Only four line card slots can be used on the Catalyst 4507R and six line card slots on the
Catalyst 4510R chassis.–
When all slots are required, only one model WS-X4448-GB-RJ45 line card can be used.
To maximize the 100-BASE-FX port density of 7 and 10 slot chassis when using Supervisor Engine 6-E install WS-4248-FE-SFP line cards with FX optics instead of WS-X4148-FX-MT line cards. If WS-X4148-FX-MT line cards are required, two options are available:
–
You can use only 4 linecard slots on the Cat4507R chassis and 6 line card slots on the Cat4510R chassis.
–
When all slots are required, you can only use one WS-X4448-GB-RJ45 line card.
•
% Hardware MTU table exhaustedIn such a scenario, the IPv6 MTU value programmed in hardware differs from the IPv6 interface MTU value. This will happen if no room exists in the hardware MTU table to store additional values.
To create room in the table, unconfigure some unused MTU values. Then, either disable or reenable IPv6 on the interface, or reapply the MTU configuration.
•
Switch(config-if)# no ip verify sourceSwitch(config-if)# no ip device tracking maxTo enable IPSG with static hosts on a port, enter the following commands:
Switch(config)# ip device tracking ****enable IP device tracking globallySwitch(config)# ip device tracking max <n> ***set an IP device tracking maximum on intSwitch(config-if)# ip verify source tracking [port-security] ****activate IPSG on port
Caution
Note
•
•
•
•
For Supervisor Engine 6-E and Supervisor Engine 6L-E
•
•
•
•
•
•
For example, if the active supervisor engine is in slot 1, and you have configured interface Gi1/1, the supervisor engine in slot 2 becomes active if you remove the active supervisor engine from the chassis. In addition, while the startup configuration file is being parsed, you will receive an error message indicating that interface Gi1/1 is no longer present. This behavior is correct. When the formerly active supervisor engine is reinserted into slot 1, there is no configuration for interface Gi1/1.
This situation will not occur when both supervisor engines are physically in the chassis.
Workaround: Copy the startup configuration file into the running configuration:
Switch# copy startup-config running-config•
Workaround: Display the configuration with the show standby command, then remove the CLI. Here is an example of show standby GigabitEthernet1/1 command output:
switch(config)# interface g1/1switch(config)# no standby 0 name (0 is hsrp group number)•
Use the standby delay reload option if the router is rebooting after reloading the image.
•
Workaround: Ensure that the MTUs match.
•
•
•
–
–
For Supervisor Engine 6-E, the rename command is available for bootflash and slot0. For all other supervisor engines, the rename command is supported for nvram devices only.
–
–
–
–
–
–
•
•
•
•
•
•
Workaround: Remove and reinsert the standby supervisor engine after the active supervisor engine boots. (CSCsa66509)
•
•
PoE switching modules:
–
–
–
–
–
–
–
–
–
PoE enabled power supplies:
–
–
–
–
–
–
•
00:02:57: %RADIUS-4-RADIUS_DEAD: RADIUS server 172.20.246.206:1645,1646 is not responding.If this message appears, ensure network connectivity exists between the switch and the ACS. Also check that the switch has been properly configured as an AAA client on the ACS.
•
–
–
–
–
•
% Hardware MTU table exhaustedIn such a scenario, the IPv6 MTU value programmed in hardware differs from the IPv6 interface MTU value. This occurs if no room exists in the hardware MTU table to store additional values.
To create room, unconfigure some unused MTU values. Then, either disable or re-enable IPv6 on the interface, or reapply the MTU configuration.
•
Switch(config-if)# no ip verify sourceSwitch(config-if)# no ip device tracking maxTo enable IPSG with static hosts on a port, enter the following commands:
Switch(config)# ip device tracking ****enable IP device tracking globallySwitch(config)# ip device tracking max <n> ***set an IP device tracking maximum on intSwitch(config-if)# ip verify source tracking [port-security] ****activate IPSG on port
Caution
Note
•
•
•
•
•
•
•
–
–
The Catalyst 4503-E and Catalyst 4506-E have no caveats. The Catalyst 4507R-E configurations that use power supplies rated at 1400 W or above also have no caveats.
The following replacement switching modules will not exceed the power supply capacity for any Catalyst 4500-E chassis:
Refer to the Catalyst 4500 Series Module Installation Guide to determine the power requirements for all of the Catalyst 4500 linecards and the power capacities of the Catalyst 4500 power supplies.
•
•
This situation only occurs if a switch reached SSO before you removed the line card.
•
•
Caveats
Caveats describe unexpected behavior in Cisco IOS releases. Caveats listed as open in a prior release are carried forward to the next release as either open or resolved.
Note
http://www.cisco.com/en/US/docs/ios/12_4/release/notes/124MCAVS.html
Note
http://www.cisco.com/en/US/products/products_security_advisories_listing.html
Open Caveats in Cisco IOS Release 12.2(37)SG1
This section lists the open caveats in Cisco IOS Release 12.2(37)SG1:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
This only affects a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: None. (CSCsc11726)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
00:10:34: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum (20000). Dampening is OFF00:10:06: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum 000). Dampening is OFFAt this point, if you revert back to the bgp dampening command on the active supervisor engine, the new command is not synchronized with the standby supervisor engine.
Workarounds: Enter the no bgp dampening command, then the bgp dampening command. (CSCse12485)
•
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
•
Workaround: Monitor the switch and note the number of occurrences as well as any changes on the network prior to the reload. (CSCsh13318)
•
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
•
Workaround: Upgrade to Cisco IOS Release 12.2(31)SG or later and resize the TCAM with the
access-list hardware region balance command to support the ACL Verify TCAM utilization with the show platform hardware acl statistics utilization brief command. (CSCsh50565)•
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
•
Workaround: Enter shut/no shut on the port to authorize the PC correctly. (CSCsi31362
•
This is a temporary issue and is expected to be resolved in future IOS releases
Workaround: None. (CSCsi40783)
•
The traffic loss only occurs when the interfaces, which the traffic travel through, are configured with HSRP and currently in HSRP Active state.
Workaround: None. (CSCsi40980)
•
%CHKPT-4-INVALID: Invalid checkpoint client ID (189)Workaround: None. This message is an informational message. (CSCsi60913)
•
%XDR-6-XDRINVALIDHDR: XDR for client (CEF push) dropped (slots:2 from slot:3 context:145 length:11) due to: invalid contextWorkaround: None. This is an informational message. (CSCsi60898)
•
Workaround: None. (CSCsj83688)
•
At ACTIVE:ISSU_PROCESS-3-SYSTEM: Failed to set Standby ISSU state to the local ISSU state.At STANDBY:ISSU_PROCESS-3-SYSTEM: STANDBY:System not in [Init (Commit Version)] or [Init (Commit Version)] for transitioning to [*]where "*" can be "Init", "Load Version", etc.Workaround: None. These are informative messages. (CSCsj89384)
•
Workaround: None. (CSCsl72868)
Resolved Caveats in Cisco IOS Release 12.2(37)SG1
This section lists the resolved caveats in Release 12.2(37)SG1:
•
This feature has been introduced in select Cisco IOS Software releases published after April 5, 2007.
The %DATACORRUPTION-1-DATAINCONSISTENCY error message is preceded by a timestamp:
May 17 10:01:27.815 UTC: %DATACORRUPTION-1-DATAINCONSISTENCY: copy errorThe error message is then followed by a traceback.
Workaround: Gather the output from the show tech-support command and open a service request with the Technical Assistance Center (TAC) or designated support organization. (CSCsj44081)
•
–
–
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. Fixed Cisco IOS software listed in the Software Versions and Fixes section contains fixes for all vulnerabilities mentioned in this advisory.
There are no workarounds available to mitigate the effects of any of the vulnerabilities apart from disabling the protocol or feature itself.
(CSCeb21064)
•
–
–
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. Fixed Cisco IOS software listed in the Software Versions and Fixes section contains fixes for all vulnerabilities mentioned in this advisory.
There are no workarounds available to mitigate the effects of any of the vulnerabilities apart from disabling the protocol or feature itself.
(CSCsd81407)
•
–
–
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. Fixed Cisco IOS software listed in the Software Versions and Fixes section contains fixes for all vulnerabilities mentioned in this advisory.
There are no workarounds available to mitigate the effects of any of the vulnerabilities apart from disabling the protocol or feature itself.
(CSCsi60004)
•
NHRP is a primary component of the Dynamic Multipoint Virtual Private Network (DMVPN) feature.
NHRP can operate in three ways: at the link layer (Layer 2), over Generic Routing Encapsulation (GRE) and multipoint GRE (mGRE) tunnels and directly on IP (IP protocol number 54). This vulnerability affects all three methods of operation.
NHRP is not enabled by default for Cisco IOS.
This vulnerability is addressed by Cisco bug IDs CSCin95836 for non-12.2 mainline releases and CSCsi23231 for 12.2 mainline releases.
(CSCin95836)
•
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available.
(CSCsi01470)
Open Caveats in Cisco IOS Release 12.2(37)SG
This section lists the open caveats in Cisco IOS Release 12.2(37)SG:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
This only affects a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: None. (CSCsc11726)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
00:10:34: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum (20000). Dampening is OFF00:10:06: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum 000). Dampening is OFFAt this point, if you revert back to the bgp dampening command on the active supervisor engine, the new command is not synchronized with the standby supervisor engine.
Workarounds: Enter the no bgp dampening command, then the bgp dampening command. (CSCse12485)
•
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
•
Workaround: Monitor the switch and note the number of occurrences as well as any changes on the network prior to the reload. (CSCsh13318)
•
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
•
Workaround: Upgrade to Cisco IOS Release 12.2(31)SG or later and resize the TCAM with the
access-list hardware region balance command to support the ACL Verify TCAM utilization with the show platform hardware acl statistics utilization brief command. (CSCsh50565)•
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
•
Workaround: Enter shut/no shut on the port to authorize the PC correctly. (CSCsi31362
•
This is a temporary issue and is expected to be resolved in future IOS releases
Workaround: None. (CSCsi40783)
•
The traffic loss only occurs when the interfaces, which the traffic travel through, are configured with HSRP and currently in HSRP Active state.
Workaround: None. (CSCsi40980)
•
%CHKPT-4-INVALID: Invalid checkpoint client ID (189)Workaround: None. This message is an informational message. (CSCsi60913)
•
%XDR-6-XDRINVALIDHDR: XDR for client (CEF push) dropped (slots:2 from slot:3 context:145 length:11) due to: invalid contextWorkaround: None. This is an informational message. (CSCsi60898)
•
Workaround: None. (CSCsl72868)
Resolved Caveats in Cisco IOS Release 12.2(37)SG
This section lists the resolved caveats in Release 12.2(37)SG:
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, enter shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
Workaround:When this happens, the mismatched command list can be displayed on the active supervisor engine by issuing the show issu config-sync failures mcl command. The WS-X4418-GB module only supports the default dot1q encapsulation. The command mismatch can be fixed by removing the switchport trunk encapsulation dot1q subinterface command from each of the interfaces associated with the WS-X4418-GB module on the active supervisor engine and then rebooting the standby supervisor engine. Please verify that the above encapsulation command is removed in the running configuration on the active supervisor engine for the above interfaces. The standby supervisor engine will now boot up into SSO mode. Save the configuration on the active supervisor engine after making the above changes. (CSCse86228)
•
This problem only occurs if the interface configured with port security is in violation restrict mode (through the switchport port-security violation restrict command). Moreover, the interface must be in security violation state when you apply the default interface command.
Workarounds: Bring the interface into shutdown mode before you apply the default interface command. (CSCsf30157)
•
Workaround: None. (CSCse43697)
•
%C4K_LINECARDMGMTPROTOCOL-4-ONGOINGTIMEOUTWARNING: Astro 2-2(Fa2/9-16) -consecutive management requests timed out.Workaround: Remove the switchport voice VLAN untagged configuration from the switch port. (CSCsg76374)
•
Nov 19 05:11:02 MET: %IPC-5-WATERMARK: 1801 messages pending in rcv forthe port CF : Standby(2020000.11) seat 2020000Such messages indicate that there are pending messages for active and standby supervisor engine inter-process communication. This condition does not affect switching traffic.
Workaround: None. (CSCsg83090)
•
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
Cisco IOS is affected by the following vulnerabilities:
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. There are workarounds available to mitigate the effects of these vulnerabilities.
Note
A combined software table for Cisco IOS is available to aid customers in choosing a software releases that fixes all security vulnerabilities published as of May 22, 2007.
(CSCsb12598)
•
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
Cisco IOS is affected by the following vulnerabilities:
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. There are workarounds available to mitigate the effects of these vulnerabilities.
Note
A combined software table for Cisco IOS is available to aid customers in choosing a software releases that fixes all security vulnerabilities published as of May 22, 2007. .
(CSCsb40304)
•
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
Cisco IOS is affected by the following vulnerabilities:
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. There are workarounds available to mitigate the effects of these vulnerabilities.
Note
A combined software table for Cisco IOS is available to aid customers in choosing a software releases that fixes all security vulnerabilities published as of May 22, 2007. (CSCsd92405)
•
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
The vulnerable cryptographic library is used in the following Cisco products:
–
–
–
–
–
This vulnerability is also being tracked by CERT/CC as VU#754281.
Cisco has made free software available to address this vulnerability for affected customers. There are no workarounds available to mitigate the effects of the vulnerability.
Note
(CSCsd85587)
•
Cisco is providing fixed software to address this issue. There are workarounds available to mitigate the effects of the vulnerability.
(CSCse56501)
•
Workaround: Upgrade to Cisco IOS Release 12.2(31)SG or later and resize the TCAM with the
access-list hardware region balance command to support the ACL Verify TCAM utilization with the show platform hardware acl statistics utilization brief command. (CSCsh50565)Open Caveats in Cisco IOS Release 12.2(31)SGA11
This section lists the open caveats in Cisco IOS Release 12.2(31)SGA11:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater# sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, enter shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
This only affects a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: None. (CSCsc11726)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
This problem only occurs if the interface configured with port security is in violation restrict mode (through the switchport port-security violation restrict command). Moreover, the interface must be in security violation state when you apply the default interface command.
Workarounds: Bring the interface into shutdown mode before you apply the default interface command. (CSCsf30157)
•
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
•
Workaround: Monitor the switch and note the number of occurrences as well as any changes on the network prior to the reload. (CSCsh13318)
•
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
•
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
•
Workaround: Remove all configurations that require the loopback interface before removing the loopback interface. (CSCsf06946)
Resolved Caveats in Cisco IOS Release 12.2(31)SGA11
This section lists the resolved caveats in Cisco IOS Release 12.2(31)SGA11:
•
%SYS-2-NOBLOCK: idle with blocking disabled.-Process= "Cat4k Mgmt HiPri", ipl= 0, pid= 42-Traceback= 10677608 11127844 11129E2C 1109C640 103D3448 103D2008 103D3C10 1054BA14 10056108 1005F378 11301CDC 11811E7C 11395664 113971D41139B2F8 1139EBA0When running Cisco IOS Release 12.2(40)SG, having a 3rd generation phone (7961/41/70/71) running firmware 8-3-3 or greater to generate LLDP frames might cause the switch to crash.
This behavior occurs because LLDP is sent out from the phone to the switch un-tagged and is flagged as a security violation.
If you enter the debug dot1x all command, you see the following security violation.
12:59:51: dot1x-ev:Potential Security Violation Packet on GigabitEthernet2/1 with MAC = 001b.d584.6873, Vlan = 712:59:51: dot1x-ev:Passing CDP packet from IP Phone with MAC = 001b.d584.6873, VLAN = 7 through to CDP handler12:59:51: dot1x-ev:Dot1x Querying CDP for 001b.d584.6873 Mac12:59:51: dot1x-ev:dot1x_switch_addr_add: Host access entry already exists for 001b.d584.6873 1512:59:51: dot1x-ev:dot1x_switch_addr_add: Added MAC 001b.d584.6873 to vlan 15 on interface GigabitEthernet2/112:59:51: dot1x-ev:dot1x_switch_secure_vvid_pkt:Secured Phone MAC = 001b.d584.6873 on Vlan = 15VLAN 7 is the data VLAN and VLAN 15 is the voice VLAN.
Workaround: Disable LLDP on the IP phone.
CSCsq34665
•
- Chassis Type : WS-C4510R- SUP: WS-X4516-10GE(2ea. Redundancy)- 12.2(31)SGA8- PIM Sparse Mode / MSDP- The problem was happened on two C4510Rs(Active/Standby)#sh proc cpu | ex 0.0CPU utilization for five seconds: 61%/0%; one minute: 26%; five minutes:20%PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process34 1150480 695383 1654 0.13% 0.15% 0.15% 0 IDB Work40 26451856 202703548 130 4.50% 6.97% 6.90% 0 Cat4k Mgmt HiPri82 2545752 54203550 46 0.62% 0.46% 0.41% 0 IP Input109 181684 514353 353 46.22% 3.72% 0.77% 0 IGMPSN151 4226436 64869492 65 0.96% 0.57% 0.60% 0 IP SNMP152 760372 23713135 32 0.20% 0.12% 0.12% 0 PDU DISPATCHER153 5295944 26411152 200 1.38% 0.85% 0.88% 0 SNMP ENGINE EWorkaround: None.
CSCsx75612
•
This only happens to ARP entries learned on SVIs that are mapped to PVLANs. ARP entries learned on normal SVIs are not impacted.
Workaround: Clear the ARP entries with the clear ip arp command.
CSCtb37718
•
00:33:49: %C4K_IOSMODPORTMAN-4-POWERSUPPLYOUTPUTDECREASED: Powersupply 2 output has decreased00:33:49: %C4K_CHASSIS-3-MIXINPOWERDETECTED: Power supplies in thechassis are of different types (AC/DC) or wattage00:33:49: %C4K_CHASSIS-2-INSUFFICIENTPOWERDETECTED: Insufficient poweravailable for the current chassis configuration00:33:54: %C4K_CHASSIS-2-INSUFFICIENTPOWERSHUTDOWN: Holding module inslot 7 in reset, due to insufficient power00:33:54: %C4K_CHASSIS-2-INSUFFICIENTPOWERSHUTDOWN: Holding module inslot 6 in reset, due to insufficient powerWorkaround: Enter power redundancy combined max inputs 2.
This command selects any available inputs to provide the power equivalent of 2 inputs (1 power supply unit). Even if one or two inputs fail, the same amount of power will be supplied.
CSCsr26624
Open Caveats in Cisco IOS Release 12.2(31)SGA10
This section lists the open caveats in Cisco IOS Release 12.2(31)SGA10:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater# sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, enter shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
This only affects a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: None. (CSCsc11726)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
This problem only occurs if the interface configured with port security is in violation restrict mode (through the switchport port-security violation restrict command). Moreover, the interface must be in security violation state when you apply the default interface command.
Workarounds: Bring the interface into shutdown mode before you apply the default interface command. (CSCsf30157)
•
This happens to redundant Catalyst 4500 system, regardless the number of supervisor engines on the chassis. This problem applies to Cisco IOS Releases 12.2(31)SG and the 12.2(31)SGA maintenance train.
Workaround: Shut off the EtherChannel interface and bring it up again. (CSCsf08912)
•
Workaround: Remove the IEEE 802.1X configuration from the switch port. (CSCsg10135)
•
Workaround: None. (CSCsg76868)
•
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
•
Workaround: Monitor the switch and note the number of occurrences as well as any changes on the network prior to the reload. (CSCsh13318)
•
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
•
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
•
Workaround: Remove all configurations that require the loopback interface before removing the loopback interface. (CSCsf06946)
Resolved Caveats in Cisco IOS Release 12.2(31)SGA10
This section lists the resolved caveats in Release 12.2(31)SGA10:
•
This issue is observed on platforms including WS-C4948 and WS-X4548-GB, and linecards including:
–
–
–
–
–
–
–
Workaround: Enable packet filtering so that the SPAN session passes only good packets using the command:
monitor session 1 filter packet-type good rxCSCsv07168
•
Workaround: Enable and disable global QoS, as follows:
switch# conf tswitch(conf)# qosswitch(conf)# no qosCSCsv29945
•
This impacts Cisco IOS Releases 12.2(31)SGA08, 12.2(37)SG, 12.2(40)SG, 12.2(44)SG, 12.2(46)SG, 12.2(50)SG, and 12.2(50)SG1.
Workarounds:
For a Classic Series Supervisor Engine, disable and configure QoS on the port.
For example, to configure Gig 2/1 as an isolated private VLAN trunk port, do the following:
Switch# conf tEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitEthernet 2/1Switch(config-if)# no qosSwitch(config-if)# qosSwitch(config-if)# endSwitch#You can configure the following EEM script to automate this workaround. QoS will be disabled and re-enabled whenever a port flaps.
logging event link-status globalevent manager applet linkup-reqosevent syslog pattern "changed state to up"action 1 cli command "enable"action 2 cli command "conf t"action 3 cli command "interface gigabitEthernet 2/1"action 4 cli command "no qos"action 5 cli command "qos"On Supervisor Engine 6-E or a Catalyst 4900M switch, remove and reapply the QoS service policy on the impacted VLAN:
Switch# conf tEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# interface gigabitEthernet 2/1Switch(config-if)# vlan-range 10Switch(config-if-vlan-range)# no service policy output primVlanOutPolicySwitch(config-if-vlan-range)# no service policy input secVlanInPolicySwitch(config-if-vlan-range)# service policy output primVlanOutPolicySwitch(config-if-vlan-range)# service policy input secVlanInPolicySwitch(config-if-vlan-range)# endSwitch#CSCsw19087
•
While the problem is happening, the following messages display:
%C4K_REDUNDANCY-4-KEEPALIVE_WARNING: STANDBY:Keepalive messages from peer Supervisor are missing for 162 seconds%C4K_REDUNDANCY-3-PEER_RELOAD: STANDBY:The peer Supervisor is being reset because keepalive message(s) not received.Workaround: None. (CSCsw64001)
•
The following linecards are affected:
–
–
–
–
–
E-series linecards with SFP, TenGigabit ports using HAMM modules, and WS-C4948 SFP uplinks do not exhibit this problem.
Workarounds: Do one of the following:
–
–
CSCsx74970
•
Cisco has released free software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are available and are documented in the workarounds section of the posted advisory.
CSCsq24002
Open Caveats in Cisco IOS Release 12.2(31)SGA9
This section lists the open caveats in Cisco IOS Release 12.2(31)SGA9:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater# sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, enter shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
This only affects a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: None. (CSCsc11726)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
This problem only occurs if the interface configured with port security is in violation restrict mode (through the switchport port-security violation restrict command). Moreover, the interface must be in security violation state when you apply the default interface command.
Workarounds: Bring the interface into shutdown mode before you apply the default interface command. (CSCsf30157)
•
This happens to redundant Catalyst 4500 system, regardless the number of supervisor engines on the chassis. This problem applies to Cisco IOS Releases 12.2(31)SG and the 12.2(31)SGA maintenance train.
Workaround: Shut off the EtherChannel interface and bring it up again. (CSCsf08912)
•
Workaround: Remove the IEEE 802.1X configuration from the switch port. (CSCsg10135)
•
Workaround: None. (CSCsg76868)
•
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
•
Workaround: Monitor the switch and note the number of occurrences as well as any changes on the network prior to the reload. (CSCsh13318)
•
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
•
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
•
Workaround: Remove all configurations that require the loopback interface before removing the loopback interface. (CSCsf06946)
Resolved Caveats in Cisco IOS Release 12.2(31)SGA9
This section lists the resolved caveats in Release 12.2(31)SGA9:
•
Workaround: Terminate traffic before you shut down a remote interface. (CSCsj73451)
•
%C4K_REDUNDANCY-4-KEEPALIVE_WARNING: STANDBY:Keepalive messages from peer Supervisor are missing for 27 seconds
%C4K_ETH-4-MACFATALRXERR: STANDBY:Supervisor EOBC port MAC was reset due to a fatal Rx error
This issue does not impact your network.
Workaround: None. (CSCsu10462)
The KEEPALIVE_WARNING message is documented in the system message guide as informational.
The MACFATALRXERR message will not appear Cisco IOS Release 12.2(31)SGA9 and 12.2(50)SG onwards.
•
LACP PDUs should always be transmitted untagged.
Workaround:None. (CSCsv63758)
•
–
–
–
–
Workarounds that mitigate this vulnerability are available in the "workarounds" section of the advisory.
CSCsm27071
•
Cisco has released free software updates that address this vulnerability.
Several mitigation strategies are outlined in the workarounds section of this advisory.
CSCsr29468
•
Cisco has released free software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are available in the workarounds section of the advisory.
CSCsk64158
•
In addition to these vulnerabilities, Cisco Nexus 5000 devices contain a TCP DoS vulnerability that may result in a system crash. This additional vulnerability was found as a result of testing the TCP state manipulation vulnerabilities.
Cisco has released free software updates for download from the Cisco website that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available.
CSCsv04836
Open Caveats in Cisco IOS Release 12.2(31)SGA8
This section lists the open caveats in Cisco IOS Release 12.2(31)SGA8:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater# sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, enter shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
This only affects a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: None. (CSCsc11726)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
This problem only occurs if the interface configured with port security is in violation restrict mode (through the switchport port-security violation restrict command). Moreover, the interface must be in security violation state when you apply the default interface command.
Workarounds: Bring the interface into shutdown mode before you apply the default interface command. (CSCsf30157)
•
This happens to redundant Catalyst 4500 system, regardless the number of supervisor engines on the chassis. This problem applies to Cisco IOS Releases 12.2(31)SG and the 12.2(31)SGA maintenance train.
Workaround: Shut off the EtherChannel interface and bring it up again. (CSCsf08912)
•
Workaround: Remove the IEEE 802.1X configuration from the switch port. (CSCsg10135)
•
Workaround: None. (CSCsg76868)
•
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
•
Workaround: Monitor the switch and note the number of occurrences as well as any changes on the network prior to the reload. (CSCsh13318)
•
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
•
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
•
Workaround: Remove all configurations that require the loopback interface before removing the loopback interface. (CSCsf06946)
Resolved Caveats in Cisco IOS Release 12.2(31)SGA8
This section lists the resolved caveats in Release 12.2(31)SGA8:
•
Workaround: Shut down supervisor uplink ports prior to reload. (CSCsl34390)
•
RFC2578 indicates that the next to last sub-identifier must be zero, however, cpscEvent OID is wrongly defined as: 1.3.6.1.4.1.9.9.362.0.1.1 Because the next to last sub-identifier is 1 and not 0, cpscEventRev1 is defined as: 1.3.6.1.4.1.9.9.362.0.2 and replaces the wrong cpscEvent OID.
Workaround: None (CSCsm23134)
•
Releases 12.2(37)SG, 12.2(40)SG, and 12.2(31)SGA3 (and earlier) are not affected.
Workarounds:
–
–
(CSCsm38960)
•
This issue may occur between a WS-X4506-GB-T and a Catalyst 4500 configured with
Supervisor Engine II-Plus-10GE.Workarounds: Upgrade to Cisco IOS Release 12.2(46)SG or 12.2(31)SGA8. (CSCsm09735)
•
Cpu Subsystem Tests ... seeprom: . temperature_sensor: . eobc: FIf EOBC fails, the bootup will remain in this step for roughly two minutes.
You can also see the EOBC test result by entering the show diagnostic result module all detail command after your system boots.
Workaround: None. (CSCso23121)
•
Workaround: None. (CSCek25021)
•
Workaround: None. (CSCsm19901)
•
Workarounds:
–
platform eobc reset command from the enable prompt–
(CSCsl88908)
•
Workarounds:
–
–
(CSCsm71323)
•
Workarounds are available to help mitigate this vulnerability.
This issue is triggered by a logic error when processing extended communities on the PE device.
This issue cannot be deterministically exploited by an attacker.
Cisco has released free software updates that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available.
(CSCec12299)
Open Caveats in Cisco IOS Release 12.2(31)SGA7
This section lists the open caveats in Cisco IOS Release 12.2(31)SGA7:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater# sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, enter shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
This only affects a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: None. (CSCsc11726)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
This problem only occurs if the interface configured with port security is in violation restrict mode (through the switchport port-security violation restrict command). Moreover, the interface must be in security violation state when you apply the default interface command.
Workarounds: Bring the interface into shutdown mode before you apply the default interface command. (CSCsf30157)
•
This happens to redundant Catalyst 4500 system, regardless the number of supervisor engines on the chassis. This problem applies to Cisco IOS Releases 12.2(31)SG and the 12.2(31)SGA maintenance train.
Workaround: Shut off the EtherChannel interface and bring it up again. (CSCsf08912)
•
Workaround: Remove the IEEE 802.1X configuration from the switch port. (CSCsg10135)
•
Workaround: None. (CSCsg76868)
•
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
•
Workaround: Monitor the switch and note the number of occurrences as well as any changes on the network prior to the reload. (CSCsh13318)
•
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
•
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
•
Workaround: Remove all configurations that require the loopback interface before removing the loopback interface. (CSCsf06946)
Resolved Caveats in Cisco IOS Release 12.2(31)SGA7
This section lists the resolved caveats in Release 12.2(31)SGA7:
•
You will see one or both of the following error messages:
*Mar 5 11:16:33.663 UTC: %C4K_CHASSIS-3-MIXINVOLTAGEDETECTED: Power supplies in the chassis are receiving different voltage inputs*Mar 5 11:16:33.663 UTC: %C4K_CHASSIS-3-MIXINPOWERDETECTED: Power supplies in the chassis are of different types (AC/DC) or wattageYou may also see the following message:
%ILPOWER-5-ILPOWER_POWER_DENY: Interface Gi2/33: inline power deniedOn ports with POE devices connected.This glitch temporarily shuts down the affected power supply and causes a loss of power supply redundancy. Power for the data and chassis is decremented and might cause the linecard(s) to shut down. Power for PoE also will decrement, and it could cause PDs to shut down and reset.
Note the following:
–
–
The output current is lower with both 110V input connections, see
Power Supply Calculator on cisco.com at the URL:http://tools.cisco.com/cpc/launch.jsp.Workaround: None. (CSCso67729)
•
The group(s) of ports on which the PoE devices do not power up may differ for each instance on different systems.
The problem has been observed with the following hardware combinations:
–
–
Note
Workaround: None. (CSCso29149)
•
"write memory's via CLI" on the switch.This occurs with Cisco IOS Releases 12.2(25)EWA13 and earlier releases, 12.2(31)SGA6 and earlier releases, and 12.2(4x)SG releases.
Workaround: Restrict vty access to one session and upgrade to Cisco IOS Release 12.2(25)EWA14 or 12.2(31)SGA7. (CSCso86459)
•
"NVRAM Verification Failed" and the running config might not be saved to the NVRAM.Workaround: Upgrade to Cisco IOS Release 12.2(25)EWA14 or 12.2(31)SGA7. (CSCsq27434)
Open Caveats in Cisco IOS Release 12.2(31)SGA6
This section lists the open caveats in Cisco IOS Release 12.2(31)SGA6:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater# sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, enter shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
This only affects a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: None. (CSCsc11726)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
This problem only occurs if the interface configured with port security is in violation restrict mode (through the switchport port-security violation restrict command). Moreover, the interface must be in security violation state when you apply the default interface command.
Workarounds: Bring the interface into shutdown mode before you apply the default interface command. (CSCsf30157)
•
This happens to redundant Catalyst 4500 system, regardless the number of supervisor engines on the chassis. This problem applies to Cisco IOS Releases 12.2(31)SG and the 12.2(31)SGA maintenance train.
Workaround: Shut off the EtherChannel interface and bring it up again. (CSCsf08912)
•
Workaround: Remove the IEEE 802.1X configuration from the switch port. (CSCsg10135)
•
Workaround: None. (CSCsg76868)
•
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
•
Workaround: Monitor the switch and note the number of occurrences as well as any changes on the network prior to the reload. (CSCsh13318)
•
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
•
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
•
Workaround: Remove all configurations that require the loopback interface before removing the loopback interface. (CSCsf06946)
Resolved Caveats in Cisco IOS Release 12.2(31)SGA6
This section lists the resolved caveats in Release 12.2(31)SGA6:
•
This problem is seen either when DBL is enabled via Auto-Qos or by attaching Qos policy with DBL action. For example,
!
policy-map p1class c1dbl!interface Gig 3/2service-policy output p1!
While the problem is occurring, dropped traffic is displayed under the Dbl-Drop-Queue counter of the show interface counter detail command.
Workaround: Disable DBL globally with the no qos dbl command.
•
While the problem occurs, drops appear under the Dbl-Drop-Queue counter output of the show interface counter detail command.
Workaround: Disable DBL globally with the no qos dbl command. (CSCsk07525)
Catalyst 4500 Supervisor Engine V-10GE (WS-X4516-10GE) running a Cisco IOS release earlier than 12.2(25)EWA13 may encounter a system reset due to NFL fatal error. When it fails, you may see the following log message:
%C4K_SWITCHINGENGINEMAN-4-FATALERRORINTERRUPTSEEN: Fatal NFL Error !additional characters related to failure will be reported!And in the crashdump, you will see vector=600.
Workaround: None. (CSCsl99781)
•
"ERROR! Unsupported chassis type 52, system cannot boot. Rebooting in 10 seconds."This caveat is seen on bootup under either of the following conditions:
–
–
Workaround: Upgrade to Cisco IOS Release 12.2(31)SGA6, 12.2(37)SG or later versions of software. (CSCsm82435)
•
Cisco has released free software updates that address this vulnerability.
Aside from disabling affected services, there are no available workarounds to mitigate an exploit of this vulnerability.
(CSCsj85065)
Open Caveats in Cisco IOS Release 12.2(31)SGA5
This section lists the open caveats in Cisco IOS Release 12.2(31)SGA5:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater# sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, enter shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
This only affects a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: None. (CSCsc11726)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
This problem only occurs if the interface configured with port security is in violation restrict mode (through the switchport port-security violation restrict command). Moreover, the interface must be in security violation state when you apply the default interface command.
Workarounds: Bring the interface into shutdown mode before you apply the default interface command. (CSCsf30157)
•
This happens to redundant Catalyst 4500 system, regardless the number of supervisor engines on the chassis. This problem applies to Cisco IOS Releases 12.2(31)SG and the 12.2(31)SGA maintenance train.
Workaround: Shut off the EtherChannel interface and bring it up again. (CSCsf08912)
•
Workaround: Remove the IEEE 802.1X configuration from the switch port. (CSCsg10135)
•
Workaround: None. (CSCsg76868)
•
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
•
Workaround: Monitor the switch and note the number of occurrences as well as any changes on the network prior to the reload. (CSCsh13318)
•
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
•
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
•
Workaround: Remove all configurations that require the loopback interface before removing the loopback interface. (CSCsf06946)
Resolved Caveats in Cisco IOS Release 12.2(31)SGA5
This section lists the resolved caveats in Release 12.2(31)SGA5:
•
Workaround: None. (CSCse43697)
•
00:10:34: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum (20000). Dampening is OFF00:10:06: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum 000). Dampening is OFFAt this point, if you revert back to the bgp dampening command on the active supervisor engine, the new command is not synchronized with the standby supervisor engine.
Workarounds: Enter the no bgp dampening command, then the bgp dampening command. (CSCse12485)
•
While this problem occurs, traffic drops appear under the Dbl-Drop-Queue counter on the output of the show interface <mod/port> counter detail command.
Workaround: Disable DBL globally by configuring the no qos dbl command. (CSCsk07525)
•
To observe the problem, the MSDP timer must be set to 1.
Workaround: Because this s problem does not occur if the MSDP timer is bigger, increase the timer to 5. (CSCsj61328)
•
%SYS-3-CPUHOG: Task is running for (112000)msecs, more than (2000)msecs(1/0),process = RADIUSIf "radius-server retry method reorder" is not configured, the router may neglect to transmit RADIUS packets to servers after the "server-private" server if the "server-private" server does not respond. In addition, the reference count of a server, as shown by the output of the <CmdBold>debug aaa server-ref-count<noCmdBold> EXEC command, may improperly drop to zero. This results in no packets being transmitted to the server unless it is unconfigured and reconfigured.
Workaround: None. (CSCin45879)
•
Multicast Source---4500------Private VLAN Trunk----Switch-----STB
When you change channels on the set top box, the IGMP leaves are not acknowledged and the traffic accumulates across the link (the link utilization increases by 4mb).
Workaround: Remove the trunk configuration and configure the link as an access port. (CSCsl09521)
•
•
ip summary-address rip 0.0.0.0 0.0.0.0 configured on an interface will send out the default with a metric of 16.Workaround: Instead of using ip summary-address rip 0.0.0.0 0.0.0.0 to only send out the default, configure a distribute-list under the rip process. (CSCsd68016)
•
This caveats affects the following supervisor engines:
–
–
–
This problem exists in the Cisco IOS Releases 12.2(25)EWAx, 12.2(25)SG, 12.2(31)SG and 12.2(31)SGAx. It does not exist in Cisco IOS Release 12.2(37)SG.
Workaround: Do not configure the ip flow-aggregation cache command until either
Cisco IOS Release 12.2(25)EWA11 or 12.2(31)SGA5 IOS is available. Until then, upgrade your switch to Cisco IOS Release 12.2(37)SGx. (CSCsk21849)Open Caveats in Cisco IOS Release 12.2(31)SGA4
This section lists the open caveats in Cisco IOS Release 12.2(31)SGA4:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, enter shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
This only affects a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: None. (CSCsc11726)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
00:10:34: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum (20000). Dampening is OFF00:10:06: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum 000). Dampening is OFFAt this point, if you revert back to the bgp dampening command on the active supervisor engine, the new command is not synchronized with the standby supervisor engine.
Workarounds: Enter the no bgp dampening command, then the bgp dampening command. (CSCse12485)
•
This problem only occurs if the interface configured with port security is in violation restrict mode (through the switchport port-security violation restrict command). Moreover, the interface must be in security violation state when you apply the default interface command.
Workarounds: Bring the interface into shutdown mode before you apply the default interface command. (CSCsf30157)
•
Workaround: None. (CSCse43697)
•
This happens to redundant Catalyst 4500 system, regardless the number of supervisor engines on the chassis. This problem applies to Cisco IOS Releases 12.2(31)SG and the 12.2(31)SGA maintenance train.
Workaround: Shut off the EtherChannel interface and bring it up again. (CSCsf08912)
•
Workaround: Remove the IEEE 802.1X configuration from the switch port. (CSCsg10135)
•
Workaround: None. (CSCsg76868)
•
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
•
Workaround: Monitor the switch and note the number of occurrences as well as any changes on the network prior to the reload. (CSCsh13318)
•
This does not affect performance.
Workaround: Enter the no shutdown command. (CSCsg27395)
•
Workaround: Remove the transceiver from the new port and place it in the old port. Once the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
•
Workaround: Remove all configurations that require the loopback interface before removing the loopback interface. (CSCsf06946)
Resolved Caveats in Cisco IOS Release 12.2(31)SGA4
This section lists the resolved caveats in Release 12.2(31)SGA4:
•
WS-X4548-GB-RJ45V with hardware revision 4.0 is NOT impacted by the problem reported in CSCsf26804 hence PoE health Monitor checks are not applicable to the module.
Workaround: None.
This caveat is fixed in 12.2(25)EWA11 and 12.2(31)SGA4 software releases.
Release 12.2(37)SG is other recommended software release. 12.2(37)SG does not have the fix for CSCsf26804 and hence does not run into CSCsk85158.
A linecard replacement is not needed. Do not RMA the module. (CSCsk85158)
•
Nov 19 05:11:02 MET: %IPC-5-WATERMARK: 1801 messages pending in rcv forthe port CF : Standby(2020000.11) seat 2020000Such messages indicate that there are pending messages for active and standby supervisor engine inter-process communication. This condition does not impact switching traffic.
Workaround: None. (CSCsg83090)
•
Workaround: Downgrade to Cisco IOS Release 12.2(25)EWA10. (CSCsi22041)
•
Switch# show qos map cos dscpCoS-DSCP Mapping TableCoS: 0 1 2 3 4 5 6 7--------------------------------DSCP: 0 8 16 26 32 46 48 56Workaround: None. (CSCsi52529)
•
Net Link States (Area 100)Link ID ADV Router Age Seq# Checksum192.168.22.2 192.168.22.6 3391732 0x80000CCE 0x0053CDAdditionally, CPU load for OSPF process might increase.
Workaround: Avoid conflicting IP addresses. Remove duplicate IP address or shutdown the interface. (CSCsi11438)
•
Workaround: After entering the access-enable host command, remove, then reapply the ACL to the interface. (CSCsi20981)
•
Ingress service policies applied to secondary VLANs on that port work properly and are not affected.
Workaround: None. (CSCsi48332)
•
Workaround:When this happens, the mismatched command list can be displayed on the active supervisor engine by issuing the show issu config-sync failures mcl command. The WS-X4418-GB module only supports the default dot1q encapsulation. The command mismatch can be fixed by removing the switchport trunk encapsulation dot1q subinterface command from each of the interfaces associated with the WS-X4418-GB module on the active supervisor engine and then rebooting the standby supervisor engine. Please verify that the above encapsulation command is removed in the running configuration on the active supervisor engine for the above interfaces. The standby supervisor engine will now boot up into SSO mode. Save the configuration on the active supervisor engine after making the above changes. (CSCse86228)
Open Caveats in Cisco IOS Release 12.2(31)SGA3
This section lists the open caveats in Cisco IOS Release 12.2(31)SGA3:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: None. (CSCsc11726)
•
Workaround:When this happens, the mismatched command list can be displayed on the active supervisor engine by issuing the show issu config-sync failures mcl command. The WS-X4418-GB module only supports the default dot1q encapsulation. The command mismatch can be fixed by removing the switchport trunk encapsulation dot1q subinterface command from each of the interfaces associated with the WS-X4418-GB module on the active supervisor engine and then rebooting the standby supervisor engine. Please verify that the above encapsulation command is removed in the running configuration on the active supervisor engine for the above interfaces. The standby supervisor engine will now boot up into SSO mode. Save the configuration on the active supervisor engine after making the above changes. (CSCse86228)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
00:10:34: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum (20000). Dampening is OFF00:10:06: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum 000). Dampening is OFFAt this point, if you revert back to the bgp dampening command on the active supervisor engine, the new command is not synchronized with the standby supervisor engine.
Workarounds: Issue the no bgp dampening command, then the bgp dampening command. (CSCse12485)
•
This problem only occurs if the interface configured with port security is in violation restrict mode (through the switchport port-security violation restrict command). Moreover, the interface must be in security violation state when you apply the default interface command.
Workarounds: Bring the interface into shutdown mode before you apply the default interface command. (CSCsf30157)
•
Workaround: None. (CSCse43697)
•
Workaround:When this happens, the mismatched command list can be displayed on the active supervisor engine by issuing the show issu config-sync failures mcl command. The WS-X4418-GB module only supports the default dot1q encapsulation. The command mismatch can be fixed by removing the switchport trunk encapsulation dot1q subinterface command from each of the interfaces associated with the WS-X4418-GB module on the active supervisor engine and then rebooting the standby supervisor engine. Please verify that the above encapsulation command is removed in the running configuration on the active supervisor engine for the above interfaces. The standby supervisor engine will now boot up into SSO mode. Save the configuration on the active supervisor engine after making the above changes. (CSCse86228)
•
This happens to redundant Catalyst 4500 system, regardless the number of supervisor engines on the chassis. This problem applies to Cisco IOS Releases 12.2(31)SG and the 12.2(31)SGA maintenance train.
Workaround: Shut off the EtherChannel interface and bring it up again. (CSCsf08912)
•
Workaround: Remove the IEEE 802.1X configuration from the switch port. (CSCsg10135)
•
Workaround: None. (CSCsg76868)
•
Nov 19 05:11:02 MET: %IPC-5-WATERMARK: 1801 messages pending in rcv forthe port CF : Standby(2020000.11) seat 2020000Such messages indicate that there are pending messages for active and standby supervisor engine inter-process communication. This condition does not impact switching traffic.
Workaround: None. (CSCsg83090)
•
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
•
Workaround: Monitor the switch and note the number of occurrences as well as any changes on the network prior to the reload. (CSCsh13318)
•
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
•
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
•
Workaround: Remove all configurations that require the loopback interface before removing the loopback interface. (CSCsf06946)
•
Workaround: Downgrade to Cisco IOS Release 12.2(25)EWA10, if feasible. (CSCsi22041)
Resolved Caveats in Cisco IOS Release 12.2(31)SGA3
This section lists the resolved caveats in Release 12.2(31)SGA3:
•
This feature has been introduced in select Cisco IOS Software releases published after April 5, 2007.
The %DATACORRUPTION-1-DATAINCONSISTENCY error message is preceded by a timestamp:
May 17 10:01:27.815 UTC: %DATACORRUPTION-1-DATAINCONSISTENCY: copy errorThe error message is then followed by a traceback.
Workaround: Gather the output from the show tech-support command and open a service request with the Technical Assistance Center (TAC) or designated support organization. (CSCsj44081)
•
NHRP is a primary component of the Dynamic Multipoint Virtual Private Network (DMVPN) feature.
NHRP can operate in three ways: at the link layer (Layer 2), over Generic Routing Encapsulation (GRE) and multipoint GRE (mGRE) tunnels and directly on IP (IP protocol number 54). This vulnerability affects all three methods of operation.
NHRP is not enabled by default for Cisco IOS.
This vulnerability is addressed by Cisco bug IDs CSCin95836 for non-12.2 mainline releases and CSCsi23231 for 12.2 mainline releases.
(CSCin95836)
Open Caveats in Cisco IOS Release 12.2(31)SGA2
This section lists the open caveats in Cisco IOS Release 12.2(31)SGA2:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: None. (CSCsc11726)
•
Workaround:When this happens, the mismatched command list can be displayed on the active supervisor engine by issuing the show issu config-sync failures mcl command. The WS-X4418-GB module only supports the default dot1q encapsulation. The command mismatch can be fixed by removing the switchport trunk encapsulation dot1q subinterface command from each of the interfaces associated with the WS-X4418-GB module on the active supervisor engine and then rebooting the standby supervisor engine. Please verify that the above encapsulation command is removed in the running configuration on the active supervisor engine for the above interfaces. The standby supervisor engine will now boot up into SSO mode. Save the configuration on the active supervisor engine after making the above changes. (CSCse86228)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
00:10:34: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum (20000). Dampening is OFF00:10:06: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum 000). Dampening is OFFAt this point, if you revert back to the bgp dampening command on the active supervisor engine, the new command is not synchronized with the standby supervisor engine.
Workarounds: Issue the no bgp dampening command, then the bgp dampening command. (CSCse12485)
•
This problem only occurs if the interface configured with port security is in violation restrict mode (through the switchport port-security violation restrict command). Moreover, the interface must be in security violation state when you apply the default interface command.
Workarounds: Bring the interface into shutdown mode before you apply the default interface command. (CSCsf30157)
•
Workaround: None. (CSCse43697)
•
Workaround:When this happens, the mismatched command list can be displayed on the active supervisor engine by issuing the show issu config-sync failures mcl command. The WS-X4418-GB module only supports the default dot1q encapsulation. The command mismatch can be fixed by removing the switchport trunk encapsulation dot1q subinterface command from each of the interfaces associated with the WS-X4418-GB module on the active supervisor engine and then rebooting the standby supervisor engine. Please verify that the above encapsulation command is removed in the running configuration on the active supervisor engine for the above interfaces. The standby supervisor engine will now boot up into SSO mode. Save the configuration on the active supervisor engine after making the above changes. (CSCse86228)
•
This happens to redundant Catalyst 4500 system, regardless the number of supervisor engines on the chassis. This problem applies to Cisco IOS Releases 12.2(31)SG and the 12.2(31)SGA maintenance train.
Workaround: Shut off the EtherChannel interface and bring it up again. (CSCsf08912)
•
Workaround: Remove the IEEE 802.1X configuration from the switch port. (CSCsg10135)
•
Workaround: None. (CSCsg76868)
•
Nov 19 05:11:02 MET: %IPC-5-WATERMARK: 1801 messages pending in rcv forthe port CF : Standby(2020000.11) seat 2020000Such messages indicate that there are pending messages for active and standby supervisor engine inter-process communication. This condition does not impact switching traffic.
Workaround: None. (CSCsg83090)
•
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
•
Workaround: Monitor the switch and note the number of occurrences as well as any changes on the network prior to the reload. (CSCsh13318)
•
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
•
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
•
Workaround: Remove all configurations that require the loopback interface before removing the loopback interface. (CSCsf06946)
•
Workaround: Downgrade to Cisco IOS Release 12.2(25)EWA10, if feasible. (CSCsi22041)
Resolved Caveats in Cisco IOS Release 12.2(31)SGA2
This section lists the resolved caveats in Release 12.2(31)SGA2:
•
%C4K_LINECARDMGMTPROTOCOL-4-ONGOINGTIMEOUTWARNING: Astro 2-2(Fa2/9-16) -consecutive management requests timed out.Workaround: Remove the switchport voice VLAN untagged configuration from the switch port. (CSCsg76374)
•
Workaround: Upgrade to Cisco IOS Release 12.2(31)SG or later and resize the TCAM with the
access-list hardware region balance command to support the ACL Verify TCAM utilization with the show platform hardware acl statistics utilization brief command. (CSCsh50565)•
route-map PBR permit 10match ip address <ACL>set ip next-hop <NEXT-HOP 1> <NEXT-HOP 2>Workaround: Ensure that the next-hops do not fall under a route pointing to Null0. Such routes may have been entered either statically or by a routing protocol configured for summarization. (CSCsd88586)
•
Workarounds:
1) Disable the 802.1X guest-vlan supplicant. The port will not remain in the guest VLAN state. It will transition out of the unauthorized state.
2) Use dynamic VLAN assignment through the ACS to assign the correct VLAN to the port.
(CSCsh47641)
•
Workaround: Upgrade to Cisco IOS Release 12.2(31)SGA2. (CSCsi74467)
•
This might happen for the following reasons:
–
–
This situation occurs on Cisco IOS Release 12.2(31)SGA1 or lower (except for Cisco IOS Release 12.2(25)EWA10).
Note
Workaround: Download an image that supports PoE Health Monitoring such as Cisco IOS Release 12.2(37)SG, 12.2(31)SGA2, or 12.2(25)EWA10. These software images have code that will monitor, detect, and attempt to correct random S2W errors. Although this code does not prevent the problem, it will positively identify the issue and and reduce recovery time.
If you experience three HealthCheck warning messages within a week, RMA the line card immediately, and request an Engineer Failure Analysis (EFA) report. Perform the following debugging steps if your IP phone or PoE device fails:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
(CSCsf26804)
•
Workaround: Upgrade to Cisco IOS Release 12.2(25)EWA10 or 12.2(31)SGA2. (CSCsi34572)
•
The Cisco IOS Secure Copy Server is an optional service that is disabled by default. Devices that are not specifically configured to enable the Cisco IOS Secure Copy Server service are not affected by this vulnerability.
This vulnerability does not apply to the Cisco IOS Secure Copy Client feature.
(CSCsc19259)
•
(CSCsd95616)
Open Caveats in Cisco IOS Release 12.2(31)SGA1
This section lists the open caveats in Cisco IOS Release 12.2(31)SGA1:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
Workaround: None. (CSCsc11726)
•
Workaround:When this happens, the mismatched command list can be displayed on the active supervisor engine by issuing the show issu config-sync failures mcl command. The WS-X4418-GB module only supports the default dot1q encapsulation. The command mismatch can be fixed by removing the switchport trunk encapsulation dot1q subinterface command from each of the interfaces associated with the WS-X4418-GB module on the active supervisor engine and then rebooting the standby supervisor engine. Please verify that the above encapsulation command is removed in the running configuration on the active supervisor engine for the above interfaces. The standby supervisor engine will now boot up into SSO mode. Save the configuration on the active supervisor engine after making the above changes. (CSCse86228)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
00:10:34: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum (20000). Dampening is OFF00:10:06: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum 000). Dampening is OFFAt this point, if you revert back to the bgp dampening command on the active supervisor engine, the new command is not synchronized with the standby supervisor engine.
Workarounds: Issue the no bgp dampening command, then the bgp dampening command. (CSCse12485)
•
This problem only occurs if the interface configured with port security is in violation restrict mode (through the switchport port-security violation restrict command). Moreover, the interface must be in security violation state when you apply the default interface command.
Workarounds: Bring the interface into shutdown mode before you apply the default interface command. (CSCsf30157)
•
Workaround: None. (CSCse43697)
•
Workaround:When this happens, the mismatched command list can be displayed on the active supervisor engine by issuing the show issu config-sync failures mcl command. The WS-X4418-GB module only supports the default dot1q encapsulation. The command mismatch can be fixed by removing the switchport trunk encapsulation dot1q subinterface command from each of the interfaces associated with the WS-X4418-GB module on the active supervisor engine and then rebooting the standby supervisor engine. Please verify that the above encapsulation command is removed in the running configuration on the active supervisor engine for the above interfaces. The standby supervisor engine will now boot up into SSO mode. Save the configuration on the active supervisor engine after making the above changes. (CSCse86228)
•
This happens to redundant Catalyst 4500 system, regardless the number of supervisor engines on the chassis. This problem applies to Cisco IOS Releases 12.2(31)SG and the 12.2(31)SGA maintenance train.
Workaround: Shut off the EtherChannel interface and bring it up again. (CSCsf08912)
•
Workaround: Remove the IEEE 802.1X configuration from the switch port. (CSCsg10135)
•
%C4K_LINECARDMGMTPROTOCOL-4-ONGOINGTIMEOUTWARNING: Astro 2-2(Fa2/9-16) -consecutive management requests timed out.Workaround: Remove the switchport voice VLAN untagged configuration from the switch port. (CSCsg76374)
•
Workaround: None. (CSCsg76868)
•
Nov 19 05:11:02 MET: %IPC-5-WATERMARK: 1801 messages pending in rcv forthe port CF : Standby(2020000.11) seat 2020000Such messages indicate that there are pending messages for active and standby supervisor engine inter-process communication. This condition does not impact switching traffic.
Workaround: None. (CSCsg83090)
•
qos account layer2 encapsulation.Workaround: None. (CSCsg58526)
•
Workaround: Monitor the switch and note the number of occurrences as well as any changes on the network prior to the reload. (CSCsh13318)
•
This does not impact performance.
Workaround: Issue the no shutdown command. (CSCsg27395)
•
Workaround: Upgrade to Cisco IOS Release 12.2(31)SG or later and resize the TCAM with the
access-list hardware region balance command to support the ACL Verify TCAM utilization with the show platform hardware acl statistics utilization brief command. (CSCsh50565)•
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693).
•
Workaround: Downgrade to Cisco IOS Release 12.2(25)EWA10, if feasible. (CSCsi22041)
Resolved Caveats in Cisco IOS Release 12.2(31)SGA1
This section lists the resolved caveats in Release 12.2(31)SGA1:
•
Workaround: None. (CSCsg11229)
•
Jul 27 08:14:36: %SYS-2-FREEFREE: Attempted to free unassigned memory at 1A35ACA8, alloc 10355D60, dealloc 103594B4-Traceback= 10FAC5A8 1035A150 1035A30C 105A7A7C 1059F3A8Jul 27 08:14:36: %SYS-6-MTRACE: mallocfree: addr, pc1A35ACA8,1035A14C 195FECAC,103592E8 1A1A97D4,60000010 1A1A9780,103591341A084698,10249D60 1A16F008,10355724 1A0FBE24,10359098 127B42B8,600000F8Jul 27 08:14:36: %SYS-6-MTRACE: mallocfree: addr, pc127B3E80,103594C4 1A35AF4C,600000F2 1A35ACA8,103594B4 1A1F9F6C,1083D310127B16CC,6000005E 127B11A8,50000208 127B15E0,1083D300 1A17258C,1083D2E4Jul 27 08:14:36: %SYS-6-BLKINFO: Attempt to free a block that is in use blk 1A35AC80,words 580, alloc 10355D60, Free, dealloc 103594B4, rfcnt 0-Traceback= 10F96808 10FAC5B8 1035A150 1035A30C 105A7A7C 1059F3A8Jul 27 08:14:36: %SYS-6-MEMDUMP: 0x1A35AC80: 0xAB1234CD 0x390000 0x1983C854 0x11F30330Jul 27 08:14:36: %SYS-6-MEMDUMP: 0x1A35AC90: 0x10355D60 0x1A35B130 0x1A35AC38 0x244Workaround: Upgrade to Cisco IOS Release 12.2(31)SGA1 or later. (CSCsf09339)
•
Workarounds: None. (CSCsg62994)
•
no passive-interface <interface> commands, ISIS IIH advertisements is sent from such interfaces without the local IPv6 address, preventing the formation of adjacencies.Workaround: Remove passive-interface commands from the router isis configuration. (CSCei21664)
•
Workaround: Use Hardware Control Plane Policing (CoPP) to police GARP packets. (CSCsg08775)
•
This issue impacts Catalyst 4500 series switches running IOS releases including and earlier than 12.2(31)SGA and 12.2(25)EWA6.
Workaround: None. (CSCsg03745)
•
Workaround: Issue the no standby redirects command. (CSCsd80754)
•
issu runversion command causes the active supervisor engine to report a bulk sync failure as the standby supervisor engine boots up due to the mismatch command (MCL). The MCL errors are reported for PoE interfaces configured with the power inline static max command. The standby automatically resets and comes back in RPR mode.The is error occurs only with PoE interfaces when you configure static max allowed inline power on WS-X4506-GB-T line cards.
Workaround: Remove the configuration lines reported in the MCL list from the running config on the active supervisor engine, and then rebooting the standby engine. After the standby supervisor engine is up and the switch reaches the STANDBY HOT state, reconfigure the original
power inline static max command. (CSCse57813)•
Reloading the switch will solve the problem. Upon boot-up, radius-server source-ports 1645-1646 is in the running-config and communication with the RADIUS server will resume
Workaround: Ensure the radius-server source-ports 1645-1646 command is configured. (CSCsh22161)
•
Workaround: None. (CSCsd11631)
•
Workaround: None. (CSCsg02099)
•
This problem has been seen with connections between WS-X4418-GB module and the Catalyst 3550, Catalyst 3560, and Catalyst 3500xl series switches.
Workaround: Issue the shut/no shut command on the WS-X4418-GB interface. (CSCsg21514)
•
Workaround: Perform a shut/no shut on the interface. (CSCsd90837)
•
Workaround: Disable and enable QoS. (CSCsg75348)
•
Workaround: Disable the PVLAN trunk port. (CSCsg46891)
•
Workaround: Bounce any interface on the 4500 switch causing a spanning tree topology change. (CSCsc95631)
•
Workaround: Apply one of the following:
1. Interface ACL - Configure and attach an access list to every active router interface configured for IP packet processing. After enabled, the tftp server in IOS listens by default on all interfaces enabled for IP processing. So, the access list needs to deny traffic to every IP address assigned to an active router interface.
2. Control Plane Policing - Configure and apply a CoPP policy.
Note
3. Infrastructure ACLs (iACL) - Although it is often difficult to block traffic transiting your network, it is possible to identify traffic that should never be allowed to target your infrastructure devices and to block that traffic at the border of your network. Infrastructure ACLs are considered a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for this specific vulnerability. The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for iACLs
4. Receive Access Lists (rACLs) - The rACLs protect a device from harmful traffic before the traffic can impact the route processor. rACLs are considered a network security best practice, and should be considered as a long-term addition to good network security, as well as a workaround for this specific vulnerability. The CPU load is distributed to the line card processors and helps mitigate load on the main route processor. The white paper entitled "GSR: Receive Access Control Lists" will help identify and allow legitimate traffic to your device and deny all unwanted packets . (CSCse04560)
Note
•
Workaround: None. (CSCse61081)
•
This problem is not seen with Cisco IOS Releases 12.2(25)EWA4 and 12.2(25)EWA5.
Workaround: None. (CSCsf16422)
•
%IP_SOURCE_GUARD-4-IP_SOURCE_GUARD_DENY_PACKET: IP Source Guard detects and drops illegal trafficWorkaround: Disable and enable the affected switch ports. (CSCsd65833)
•
Workaround: Either do not use tunneled EAP methods or disable the authentication failed VLAN. (CSCse71105)
•
Workaround: Reset the VTP domain name for all switches in the domain. (CSCse40078)
•
Workarounds: Remove the configuration lines reported in the MCL list from the running config on the active supervisor engine. Then, reboot the standby supervisor engine. After the standby supervisor engine has booted and Catalyst 4500 series switch is in a STANDBY HOT state, reconfigure the original power inline static max command. (CSCse57813)
•
Cisco has made free software available to address this vulnerability for affected customers.
(CSCsd75273)
•
Cisco has made free software available to address this vulnerability for affected customers.
(CSCse52951)
•
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
The vulnerable cryptographic library is used in the following Cisco products:
–
–
–
–
–
This vulnerability is also being tracked by CERT/CC as VU#754281.
Cisco has made free software available to address this vulnerability for affected customers. There are no workarounds available to mitigate the effects of the vulnerability.
Note
(CSCsd85587)
Open Caveats in Cisco IOS Release 12.2(31)SGA
This section lists the open caveats in Cisco IOS Release 12.2(31)SGA:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
%HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: Reset the standby supervisor by entering the redundancy reload peer command. This command synchronizes the standby supervisor configuration with the active supervisor.
•
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
Workaround: None. (CSCsc11726)
•
00:00:26: %PM-4-PORT_INCONSISTENT: Port Gi3/1 is inconsistent: IDB state down (set 00:00:02 ago), link: up (00:00:02 ago)Traffic loss is observed for about 500 ms.
Workaround: Save your changes to the running configuration to avoid the error log and the loss of traffic during a Stateful Switchover.
•
Workaround:When this happens, the mismatched command list can be displayed on the active supervisor engine by issuing the show issu config-sync failures mcl command. The WS-X4418-GB module only supports the default dot1q encapsulation. The command mismatch can be fixed by removing the switchport trunk encapsulation dot1q subinterface command from each of the interfaces associated with the WS-X4418-GB module on the active supervisor engine and then rebooting the standby supervisor engine. Please verify that the above encapsulation command is removed in the running configuration on the active supervisor engine for the above interfaces. The standby supervisor engine will now boot up into SSO mode. Save the configuration on the active supervisor engine after making the above changes. (CSCse86228)
•
This could occur for these reasons:
–
–
Workarounds:
–
–
•
00:10:34: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum (20000). Dampening is OFF00:10:06: %BGP-5-DAMPENING_HIGH_MAX_PENALTY: Maximum penalty (32473) is more than allowed maximum 000). Dampening is OFFAt this point, if you revert back to the bgp dampening command on the active supervisor engine, the new command is not synchronized with the standby supervisor engine.
Workarounds: Issue the no bgd dampening command, then the bgp dampening command. (CSCse12485)
•
Workarounds: Remove the configuration lines reported in the MCL list from the running config on the active supervisor engine. Then, reboot the standby supervisor engine. After the standby supervisor engine has booted and Catalyst 4500 series switch is in a STANDBY HOT state, reconfigure the original power inline static max command. (CSCse57813)
•
This problem only occurs if the interface configured with port security is in violation restrict mode (through the switchport port-security violation restrict command). Moreover, the interface must be in security violation state when you apply the default interface command.
Workarounds: Bring the interface into shutdown mode before you apply the default interface command. (CSCsf30157)
•
Workarounds: None. (CSCse43697)
•
Workaround: Downgrade to Cisco IOS Release 12.2(25)EWA10, if feasible. (CSCsi22041)
Resolved Caveats in Cisco IOS Release 12.2(31)SGA
This section lists the resolved caveats in Release 12.2(31)SGA:
•
–
–
Aug 1 04:46:01 CDT: %C4K_HWPORTMAN-4-BLOCKEDTXQUEUE: Blocked transmit queue HwTxQId1 on Switch Phyport Gi1/35, count=1784Aug 1 04:46:12 CDT: Current Freelist count 5629. Fell below threshold 601 times consecutivelyAug 1 04:46:42 CDT: Current Freelist count 5629. Fell below threshold 1202 times consecutivelyWorkaround: Upgrade to Cisco IOS Release 12.2(25)EWA8, 12.2(31)SGA, or 12.2(37)SG. (CSCse29295)
•
%IDBINDEX_SYNC-3-IPC_ERR:ifindex_sync_standby_port : no such port.-Process= "rf task", ipl= 0, pid= 54-Traceback=Workaround: None. (CSCse31818)
•
Workaround: Re-connect. (CSCsc31540)
•
Conditions: This DDTS resolves a symptom of CSCec71950. Cisco IOS with this specific DDTS are not at risk of crash if CSCec71950 has been resolved in the software.
Workaround: Cisco IOS versions with the fix for CSCec71950 are not at risk for this issue and no workaround is required. If CSCec71950 is not resolved.
(CSCek26492)
•
This vulnerability only applies to traffic destined to the Cisco IOS device. Traffic transiting the Cisco IOS device will not trigger this vulnerability.
Cisco has made free software available to address this vulnerability for affected customers.
This issue is documented as Cisco bug ID CSCek37177.
There are workarounds available to mitigate the effects of the vulnerability.
(CSCek37177)
•
Cisco has made free software available to address this vulnerability for affected customers.
There are workarounds available to mitigate the effects of the vulnerability. The workaround depends on if Mobile IPv6 is used and what version on Cisco IOS is being currently used.
(CSCsd58381)
•
When an active TCP connection is established and when data is sent by the Cisco router to the remote router at a much faster rate than the remote router can handle, the router might advertise a zero window. So, when the router reads the data, the window is re-opened and the new window is advertised. When this situation occurs, and when the Cisco router has saved data to TCP in order to be send to the remote router, the Cisco router may drop the TCP connection.
Workaround: Increase the window size on both ends. On the Cisco router, enter the
ip tcp window-size command. When you use a Telnet connection, reduce the screen-length argument in the terminal length command to 20 or 30 lines. (CSCsc39357)Open Caveats in Cisco IOS Release 12.2(31)SG3
This section lists the open caveats in Cisco IOS Release 12.2(31)SG3:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
%HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: Reset the standby supervisor by entering the redundancy reload peer command. This command synchronizes the standby supervisor configuration with the active supervisor.
•
Workaround: Re-connect. (CSCsc31540)
•
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
Workaround: None. (CSCsc11726)
•
00:00:26: %PM-4-PORT_INCONSISTENT: Port Gi3/1 is inconsistent: IDB state down (set 00:00:02 ago), link: up (00:00:02 ago)Traffic loss is observed for about 500 ms.
Workaround: Save your changes to the running configuration to avoid the error log and the loss of traffic during a Stateful Switchover.
•
Workaround: Downgrade to Cisco IOS Release 12.2(25)EWA10, if feasible. (CSCsi22041)
Resolved Caveats in Cisco IOS Release 12.2(31)SG3
This section lists the resolved caveats in Release 12.2(31)SG3:
•
This feature has been introduced in select Cisco IOS Software releases published after April 5, 2007.
The %DATACORRUPTION-1-DATAINCONSISTENCY error message is preceded by a timestamp:
May 17 10:01:27.815 UTC: %DATACORRUPTION-1-DATAINCONSISTENCY: copy errorThe error message is then followed by a traceback.
Workaround: Gather the output from the show tech-support command and open a service request with the Technical Assistance Center (TAC) or designated support organization. (CSCsj44081)
•
Cisco is providing fixed software to address this issue. There are workarounds available to mitigate the effects of the vulnerability.
(CSCse56501)
•
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available.
(CSCsi01470)
•
(CSCsd95616)
Open Caveats in Cisco IOS Release 12.2(31)SG2
This section lists the open caveats in Cisco IOS Release 12.2(31)SG2:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
%HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: Reset the standby supervisor by entering the redundancy reload peer command. This command synchronizes the standby supervisor configuration with the active supervisor.
•
Workaround: Re-connect. (CSCsc31540)
•
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
Workaround: None. (CSCsc11726)
•
00:00:26: %PM-4-PORT_INCONSISTENT: Port Gi3/1 is inconsistent: IDB state down (set 00:00:02 ago), link: up (00:00:02 ago)Traffic loss is observed for about 500 ms.
Workaround: Save your changes to the running configuration to avoid the error log and the loss of traffic during a Stateful Switchover.
•
Workaround: Downgrade to Cisco IOS Release 12.2(25)EWA10, if feasible. (CSCsi22041)
Resolved Caveats in Cisco IOS Release 12.2(31)SG2
This section lists the resolved caveats in Release 12.2(31)SG2:
•
NHRP is a primary component of the Dynamic Multipoint Virtual Private Network (DMVPN) feature.
NHRP can operate in three ways: at the link layer (Layer 2), over Generic Routing Encapsulation (GRE) and multipoint GRE (mGRE) tunnels and directly on IP (IP protocol number 54). This vulnerability affects all three methods of operation.
NHRP is not enabled by default for Cisco IOS.
This vulnerability is addressed by Cisco bug IDs CSCin95836 for non-12.2 mainline releases and CSCsi23231 for 12.2 mainline releases.
(CSCin95836)
•
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available.
(CSCsi01470)
Open Caveats in Cisco IOS Release 12.2(31)SG1
This section lists the open caveats in Cisco IOS Release 12.2(31)SG1:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
%HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: Reset the standby supervisor by entering the redundancy reload peer command. This command synchronizes the standby supervisor configuration with the active supervisor.
•
Workaround: Re-connect. (CSCsc31540)
•
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
Workaround: None. (CSCsc11726)
•
00:00:26: %PM-4-PORT_INCONSISTENT: Port Gi3/1 is inconsistent: IDB state down (set 00:00:02 ago), link: up (00:00:02 ago)Traffic loss is observed for about 500 ms.
Workaround: Save your changes to the running configuration to avoid the error log and the loss of traffic during a Stateful Switchover.
•
Workaround: Downgrade to Cisco IOS Release 12.2(25)EWA10, if feasible. (CSCsi22041)
Resolved Caveats in Cisco IOS Release 12.2(31)SG1
This section lists the resolved caveats in Release 12.2(31)SG1:
•
Because CDP is a layer-2 protocol, this issue can only be triggered by systems that are residing on the same network segment.
Workaround: Disable on interfaces where CDP is not necessary. (CSCse85200)
•
It only happens on releases that include the fix for CSCse85200.
When turning on "debug cdp even," the following message appears:
CDP-EV: Received item (type : 9) with invalid length 4Workaround: None. (CSCsf07847)
Open Caveats in Cisco IOS Release 12.2(31)SG
This section lists the open caveats in Cisco IOS Release 12.2(31)SG:
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
%HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: Reset the standby supervisor by entering the redundancy reload peer command. This command synchronizes the standby supervisor configuration with the active supervisor.
•
Workaround: Re-connect. (CSCsc31540)
•
This only impacts a switch that has any of the following queues are configured as SPAN source in releases prior to 12.2(31)SG and saved to startup-config. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
Switch(config)# no monitor session n source cpu queue all rxSwitch(config)# monitor session n source cpu queue <new_Queue_Name>(CSCsc94802)
•
Workarounds:
–
–
(CSCsc94317)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
Workaround: None. (CSCsc11726)
•
00:00:26: %PM-4-PORT_INCONSISTENT: Port Gi3/1 is inconsistent: IDB state down (set 00:00:02 ago), link: up (00:00:02 ago)Traffic loss is observed for about 500 ms.
Workaround: Save your changes to the running configuration to avoid the error log and the loss of traffic during a Stateful Switchover.
•
Workaround: Downgrade to Cisco IOS Release 12.2(25)EWA10, if feasible. (CSCsi22041)
•
WS-X4548-GB-RJ45V with hardware revision 4.0 is NOT impacted by the problem reported in CSCsf26804 hence PoE health Monitor checks are not applicable to the module.
Workaround: None.
This caveat is fixed in 12.2(25)EWA11 and 12.2(31)SGA4 software releases.
Release 12.2(37)SG is other recommended software release. 12.2(37)SG does not have the fix for CSCsf26804 and hence does not run into CSCsk85158.
A linecard replacement is not needed. Do not RMA the module. (CSCsk85158)
Resolved Caveats in Cisco IOS Release 12.2(31)SG
This section lists the resolved caveats in Release 12.2(31)SG:
•
Workaround: Avoid enabling IPSG on sticky ports that are configured with VVID. (CSCeg31712)
•
Workaround: Use less than 1000 policers.(CSCsa57218)
•
ip ospf dead-interval minimal hello-multiplier, the dead-interval can be changed to exceed 1 second with the ip ospf dead-interval keyword. However, the running configuration still displays the ip ospf dead-interval minimal hello-multiplier command instead of the
ip ospf dead-interval command.Workaround: To change the dead-interval when Fast Hellos is enabled, first disable Fast Hellos and then configure the new dead-interval. (CSCsa86676)
•
Workaround: Re-issue the shut and no shut commands on the ports. (CSCsb16809)
•
%HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby.Workaround: Reset the standby supervisor with the redundancy reload peer command, which synchronizes the standby supervisor engine configuration with that of the active supervisor engine
•
Workaround: Upgrade the ROMMON of both WS-4516-10GE supervisor engines with ROMMON version 12.2(31r)SG .
•
Conditions: The packets must be received on a trunk enabled port.
Further Information: On the 13th September 2006, Phenoelit Group posted an advisory containing three vulnerabilities:
–
–
–
These vulnerabilities are addressed by Cisco IDs:
–
–
–
(CCSCsd34759)
•
Cisco has made free software available to address this vulnerability for affected customers.
There are workarounds available to mitigate the effects of the vulnerability. The workaround depends on if Mobile IPv6 is used and what version on Cisco IOS is being currently used.
(CSCsd40334)
Open Caveats in Cisco IOS Release 12.2(25)SG4
This section lists the open caveats in Cisco IOS Release 12.2(25)SG4:
•
Workaround: None. (CSCee65294)
•
Workaround: Disable QoS with the no qos command, and then re-enable QoS with the qos global command. (CSCee52449)
•
Workaround: Reset the module with the hw-module module reset command. (CSCee05078)
•
Workaround: Configure the convertor box (CPE device) to operate in either LT (Link Test) or ML (Missing Link) mode. (CSCed28409)
•
Workaround: None. (CSCdz10171)
•
Workaround: Format the CompactFlash module on any Catalyst 4500 series switch supervisor engine that uses Release 12.1(19)EW (or later). (CSCeb36355)
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
Workaround: None. (CSCef88634)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: Avoid enabling IPSG on sticky ports that are configured with VVID. (CSCeg31712)
•
Workaround: Use less than 1000 policers.(CSCsa57218)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
ip ospf dead-interval minimal hello-multiplier, the dead-interval can be changed to exceed 1 second with the ip ospf dead-interval keyword. However, the running configuration still displays the ip ospf dead-interval minimal hello-multiplier command instead of the
ip ospf dead-interval command.Workaround: To change the dead-interval when Fast Hellos is enabled, first disable Fast Hellos and then configure the new dead-interval. (CSCsa86676)
•
Workaround: Re-issue the shut and no shut commands on the ports. (CSCsb16809)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
%HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: Reset the standby supervisor by entering the redundancy reload peer command. This command synchronizes the standby supervisor configuration with the active supervisor.
•
WS-X4548-GB-RJ45V with hardware revision 4.0 is NOT impacted by the problem reported in CSCsf26804 hence PoE health Monitor checks are not applicable to the module.
Workaround: None.
This caveat is fixed in 12.2(25)EWA11 and 12.2(31)SGA4 software releases.
Release 12.2(37)SG is other recommended software release. 12.2(37)SG does not have the fix for CSCsf26804 and hence does not run into CSCsk85158.
A linecard replacement is not needed. Do not RMA the module. (CSCsk85158)
Resolved Caveats in Cisco IOS Release 12.2(25)SG4
This section lists the resolved caveats in Release 12.2(25)SG4:
•
Workaround: None. If you want to determine a partner's correct information, use the
show cdp neighbor command.(CSCsj81502)
Open Caveats in Cisco IOS Release 12.2(25)SG3
This section lists the open caveats in Cisco IOS Release 12.2(25)SG3:
•
Workaround: None. (CSCee65294)
•
Workaround: Disable QoS with the no qos command, and then re-enable QoS with the qos global command. (CSCee52449)
•
Workaround: Reset the module with the hw-module module reset command. (CSCee05078)
•
Workaround: Configure the convertor box (CPE device) to operate in either LT (Link Test) or ML (Missing Link) mode. (CSCed28409)
•
Workaround: None. (CSCdz10171)
•
Workaround: Format the CompactFlash module on any Catalyst 4500 series switch supervisor engine that uses Release 12.1(19)EW (or later). (CSCeb36355)
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
Workaround: None. (CSCef88634)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: Avoid enabling IPSG on sticky ports that are configured with VVID. (CSCeg31712)
•
Workaround: Use less than 1000 policers.(CSCsa57218)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
ip ospf dead-interval minimal hello-multiplier, the dead-interval can be changed to exceed 1 second with the ip ospf dead-interval keyword. However, the running configuration still displays the ip ospf dead-interval minimal hello-multiplier command instead of the
ip ospf dead-interval command.Workaround: To change the dead-interval when Fast Hellos is enabled, first disable Fast Hellos and then configure the new dead-interval. (CSCsa86676)
•
Workaround: Re-issue the shut and no shut commands on the ports. (CSCsb16809)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
%HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: Reset the standby supervisor by entering the redundancy reload peer command. This command synchronizes the standby supervisor configuration with the active supervisor.
•
WS-X4548-GB-RJ45V with hardware revision 4.0 is NOT impacted by the problem reported in CSCsf26804 hence PoE health Monitor checks are not applicable to the module.
Workaround: None.
This caveat is fixed in 12.2(25)EWA11 and 12.2(31)SGA4 software releases.
Release 12.2(37)SG is other recommended software release. 12.2(37)SG does not have the fix for CSCsf26804 and hence does not run into CSCsk85158.
A linecard replacement is not needed. Do not RMA the module. (CSCsk85158)
Resolved Caveats in Cisco IOS Release 12.2(25)SG3
This section lists the resolved caveats in Release 12.2(25)SG3:
•
This feature has been introduced in select Cisco IOS Software releases published after April 5, 2007.
The %DATACORRUPTION-1-DATAINCONSISTENCY error message is preceded by a timestamp:
May 17 10:01:27.815 UTC: %DATACORRUPTION-1-DATAINCONSISTENCY: copy errorThe error message is then followed by a traceback.
Workaround: Gather the output from the show tech-support command and open a service request with the Technical Assistance Center (TAC) or designated support organization. (CSCsj44081)
•
Cisco is providing fixed software to address this issue. There are workarounds available to mitigate the effects of the vulnerability.
(CSCse56501)
Open Caveats in Cisco IOS Release 12.2(25)SG2
This section lists the open caveats in Cisco IOS Release 12.2(25)SG2:
•
Workaround: None. (CSCee65294)
•
Workaround: Disable QoS with the no qos command, and then re-enable QoS with the qos global command. (CSCee52449)
•
Workaround: Reset the module with the hw-module module reset command. (CSCee05078)
•
Workaround: Configure the convertor box (CPE device) to operate in either LT (Link Test) or ML (Missing Link) mode. (CSCed28409)
•
Workaround: None. (CSCdz10171)
•
Workaround: Format the CompactFlash module on any Catalyst 4500 series switch supervisor engine that uses Release 12.1(19)EW (or later). (CSCeb36355)
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
Workaround: None. (CSCef88634)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: Avoid enabling IPSG on sticky ports that are configured with VVID. (CSCeg31712)
•
Workaround: Use less than 1000 policers.(CSCsa57218)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
ip ospf dead-interval minimal hello-multiplier, the dead-interval can be changed to exceed 1 second with the ip ospf dead-interval keyword. However, the running configuration still displays the ip ospf dead-interval minimal hello-multiplier command instead of the
ip ospf dead-interval command.Workaround: To change the dead-interval when Fast Hellos is enabled, first disable Fast Hellos and then configure the new dead-interval. (CSCsa86676)
•
Workaround: Re-issue the shut and no shut commands on the ports. (CSCsb16809)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
%HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: Reset the standby supervisor by entering the redundancy reload peer command. This command synchronizes the standby supervisor configuration with the active supervisor.
•
WS-X4548-GB-RJ45V with hardware revision 4.0 is NOT impacted by the problem reported in CSCsf26804 hence PoE health Monitor checks are not applicable to the module.
Workaround: None.
This caveat is fixed in 12.2(25)EWA11 and 12.2(31)SGA4 software releases.
Release 12.2(37)SG is other recommended software release. 12.2(37)SG does not have the fix for CSCsf26804 and hence does not run into CSCsk85158.
A linecard replacement is not needed. Do not RMA the module. (CSCsk85158)
Resolved Caveats in Cisco IOS Release 12.2(25)SG2
This section lists the resolved caveats in Release 12.2(25)SG2:
•
This feature has been introduced in select Cisco IOS Software releases published after April 5, 2007.
The %DATACORRUPTION-1-DATAINCONSISTENCY error message is preceded by a timestamp:
May 17 10:01:27.815 UTC: %DATACORRUPTION-1-DATAINCONSISTENCY: copy errorThe error message is then followed by a traceback.
Workaround: Gather the output from the show tech-support command and open a service request with the Technical Assistance Center (TAC) or designated support organization. (CSCsj44081)
•
Cisco has made free software available to address this vulnerability for affected customers. There are workarounds available to mitigate the effects of the vulnerability.
(CSCef77013)
•
NHRP is a primary component of the Dynamic Multipoint Virtual Private Network (DMVPN) feature.
NHRP can operate in three ways: at the link layer (Layer 2), over Generic Routing Encapsulation (GRE) and multipoint GRE (mGRE) tunnels and directly on IP (IP protocol number 54). This vulnerability affects all three methods of operation.
NHRP is not enabled by default for Cisco IOS.
This vulnerability is addressed by Cisco bug IDs CSCin95836 for non-12.2 mainline releases and CSCsi23231 for 12.2 mainline releases.
(CSCin95836)
•
A vulnerability in the Cisco implementation of Multicast Virtual Private Network (MVPN) is subject to exploitation that can allow a malicious user to create extra multicast states on the core routers or receive multicast traffic from other Multiprotocol Label Switching (MPLS) based Virtual Private Networks (VPN) by sending specially crafted messages.
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available.
Open Caveats in Cisco IOS Release 12.2(25)SG1
This section lists the open caveats in Cisco IOS Release 12.2(25)SG1:
•
Workaround: None. (CSCee65294)
•
Workaround: Disable QoS with the no qos command, and then re-enable QoS with the qos global command. (CSCee52449)
•
Workaround: Reset the module with the hw-module module reset command. (CSCee05078)
•
Workaround: Configure the convertor box (CPE device) to operate in either LT (Link Test) or ML (Missing Link) mode. (CSCed28409)
•
Workaround: None. (CSCdz10171)
•
Workaround: Format the CompactFlash module on any Catalyst 4500 series switch supervisor engine that uses Release 12.1(19)EW (or later). (CSCeb36355)
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
Workaround: None. (CSCef88634)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: Avoid enabling IPSG on sticky ports that are configured with VVID. (CSCeg31712)
•
Workaround: Use less than 1000 policers.(CSCsa57218)
•
Workaround: If the SVIs associated with the physical interface are down after the switchover, issue shutdown and no shutdown commands on the physical interface to bring up the SVIs. (CSCsb02308)
•
ip ospf dead-interval minimal hello-multiplier, the dead-interval can be changed to exceed 1 second with the ip ospf dead-interval keyword. However, the running configuration still displays the ip ospf dead-interval minimal hello-multiplier command instead of the
ip ospf dead-interval command.Workaround: To change the dead-interval when Fast Hellos is enabled, first disable Fast Hellos and then configure the new dead-interval. (CSCsa86676)
•
Workaround: Re-issue the shut and no shut commands on the ports. (CSCsb16809)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
%HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: Reset the standby supervisor by entering the redundancy reload peer command. This command synchronizes the standby supervisor configuration with the active supervisor.
Resolved Caveats in Cisco IOS Release 12.2(25)SG1
This section lists the resolved caveats in Release 12.2(25)SG1:
•
Because CDP is a layer-2 protocol, this issue can only be triggered by systems that are residing on the same network segment.
Workaround: Disable on interfaces where CDP is not necessary. (CSCse85200)
•
It only happens on releases that include the fix for CSCse85200.
When turning on "debug cdp even," the following message appears:
CDP-EV: Received item (type : 9) with invalid length 4Workaround: None. (CSCsf07847)
•
Cisco has made free software available to address this vulnerability for affected customers.
There are workarounds available to mitigate the effects of the vulnerability. The workaround depends on if Mobile IPv6 is used and what version on Cisco IOS is being currently used.
(CSCsd40334)
•
Cisco has made free software available to address this vulnerability for affected customers.
(CSCsd75273)
•
Cisco has made free software available to address this vulnerability for affected customers.
(CSCse52951)
Open Caveats in Cisco IOS Release 12.2(25)SG
This section lists the open caveats in Cisco IOS Release 12.2(25)SG:
•
Workaround: None. (CSCee65294)
•
Workaround: Disable QoS with the no qos command, and then re-enable QoS with the qos global command. (CSCee52449)
•
Workaround: Reset the module with the hw-module module reset command. (CSCee05078)
•
Workaround: Configure the convertor box (CPE device) to operate in either LT (Link Test) or ML (Missing Link) mode. (CSCed28409)
•
Workaround: None. (CSCdz10171)
•
Workaround: Format the CompactFlash module on any Catalyst 4500 series switch supervisor engine that uses Release 12.1(19)EW (or later). (CSCeb36355)
•
000099: Jul 9 01:22:36.478 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000100: Jul 9 01:22:46.534 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000101: Jul 9 01:22:56.566 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000102: Jul 9 01:23:06.598 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000103: Jul 9 01:23:16.642 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000104: Jul 9 01:23:26.682 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000105: Jul 9 01:23:36.721 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000106: Jul 9 01:23:46.777 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standby000107: Jul 9 01:23:56.793 PDT: %HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: When using the access-list N permit host hostname command, specify the IP address of the host rather than the hostname (CSCef67489)
•
Workaround: None. (CSCef88634)
•
show policy-map interface fa6/1 do not show the packets being matched:clearwater#sh policy-map intFastEthernet3/2Service-policy output: p1Class-map: c1 (match-all)0 packets <--------It stays at '0' despite of traffic being receivedMatch: access-group name fnacl21police: Per-interfaceConform: 9426560 bytes Exceed: 16573440 bytesWorkaround: Verify that the MAC addresses being transmitted through the system are learned.
(CSCef01798)
•
Workaround: None. (CSCeg48586)
•
Workaround: Avoid enabling IPSG on sticky ports that are configured with VVID. (CSCeg31712)
•
Workaround: Use less than 1000 policers.(CSCsa57218)
•
Workaround: If the data or video SVIs associated to the physical interface (connected to the IP phone) are down after the switchover, issue the shutdown and no shutdown commands on the physical interface to restore the correct (up) state for all the SVIs. (CSCsb02308)
•
ip ospf dead-interval minimal hello-multiplier, the dead-interval can be changed to exceed 1 second with the ip ospf dead-interval keyword. However, the running configuration still displays the ip ospf dead-interval minimal hello-multiplier command instead of the
ip ospf dead-interval command.Workaround: To change the dead-interval when Fast Hellos is enabled, first disable Fast Hellos and then configure the new dead-interval. (CSCsa86676)
•
Workaround: Re-issue the shut and no shut commands on the ports. (CSCsb16809)
•
–
–
On a switch that support redundancy, the generation of the self-signed certificate is performed independently on the active and the standby supervisor engines. So, the certificates differ. After switchover, the HTTP client that holds the old certificate can not connect to the HTTPS server.
Workaround: Re-connect. (CSCsb11964)
•
%HA_CONFIG_SYNC-3-LBL_CFGSYNC: Unable to sync config-changed command to standbyWorkaround: Reset the standby supervisor by entering the redundancy reload peer command. This command synchronizes the standby supervisor configuration with the active supervisor.
Resolved Caveats in Cisco IOS Release 12.2(25)SG
This section lists the resolved caveats in Release 12.2(25)SG:
•
Workarounds:
1. Before moving the supervisor engine to a non-redundancy-capable chassis, change the mode to RPR.
2. Enter the write memory command and reload the switch from the non-redundancy chassis. (CSCef67677)
•
Workaround: Exit, then re-enter interface configuration mode. All commands will be accepted, even after you enter the macro apply command. (CSCsa44632)
•
Workaround: Use the no ip flow ingress command in conjunction with the
no ip flow ingress layer2-switched command. (CSCsa67042)•
Workaround: Remove, reconfigure and reinstall policers, or, use less than 800 policers. (CSCsa66422)
•
Workaround: No workarounds are available. Enter the default interface command and apply smartport macros such as "cisco-switch" and "cisco-desktop". (CSCsb59783)
•
Workaround: No workarounds are available. Enter the default interface command and apply smartport macros such as "cisco-switch" and "cisco-desktop". (CSCei76082)
•
Cisco has made free software available that includes the additional integrity checks for affected customers.
(CSCei61732)
•
Conditions: The packets must be received on a trunk enabled port, with a matching domain name and a matching VTP domain password (if configured).
Further Information: On the 13th September 2006, Phenoelit Group posted an advisory containing three vulnerabilities:
–
–
–
These vulnerabilities are addressed by Cisco IDs:
–
–
–
(CSCei54611)
Troubleshooting
These sections provide troubleshooting guidelines for the Catalyst 4000 family running IOS supervisor engines:
•
Netbooting from the ROMMON
Netbooting using a boot loader image is not supported. Instead, use one of the following options to boot an image:
1.
rommon 1> boot slot0:<bootable_image>2.
The ROMMON TFTP boot is very similar to the BOOTLDR TFTP boot, except that:
–
–
To boot from ROMMON, perform the following tasks while in ROMMON mode:
a.
b.
c.
For example, to set the supervisor engine Ethernet port with an IP address 172.16.1.5 and IP mask 255.255.255.0, enter the following command:
rommon 2> set interface fa1 172.16.1.5 255.255.255.0d.
e.
f.
For example, to boot the image name cat4000-is-mz.160 located on the TFTP server 172.16.1.8, enter the following command:
rommon 3> boot tftp://172.16.1.8/tftpboot/cat4000-is-mzTroubleshooting at the System Level
This section contains troubleshooting guidelines for system-level problems:
•
•
Troubleshooting Modules
This section contains troubleshooting guidelines for modules:
•
•
Troubleshooting MIBs
For general information on MIBs, RMON groups, and traps, refer to the Cisco public MIB directory (http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml). For information on the specific MIBs supported by the Catalyst 4500 series switches, refer to the Catalyst 4000 MIB Support List located at ftp://ftp.cisco.com/pub/mibs/supportlists/cat4000/cat4000-supportlist.html.
Related Documentation
Although their Release Notes are unique, the 4 platforms (Catalyst 4500, Catalyst 4900, Catalyst ME 4900, and Catalyst 4900M) use the same Software Configuration Guide, Command Reference Guide, and System Message Guide. Refer to the following home pages for additional information:
•
http://www.cisco.com/go/cat4500/docs
•
http://www.cisco.com/go/cat4900/docs
•
http://www.cisco.com/en/US/products/ps7009/tsd_products_support_series_home.html
Hardware Documents
Installation guides and notes including specifications and relevant safety information are available at the following URLs:
•
•
•
http://www.cisco.com/en/US/products/hw/switches/ps4324/prod_installation_guides_list.html
•
•
http://www.cisco.com/en/US/products/hw/switches/ps4324/prod_installation_guides_list.html
•
http://www.cisco.com/en/US/products/ps6021/prod_installation_guides_list.html
•
http://www.cisco.com/en/US/products/ps7009/prod_installation_guides_list.html
Software Documentation
Software release notes, configuration guides, command references, and system message guides are available at the following URLs:
•
http://www.cisco.com/en/US/products/hw/switches/ps4324/prod_release_notes_list.html
•
http://www.cisco.com/en/US/products/ps6021/prod_release_notes_list.html
•
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/release/note/OL_11511.html
Software documents for the Catalyst 4500 Classic, Catalyst 4500 E-Series, Catalyst 4900, and
Cisco ME 4900 Series Ethernet Switches are available at the following URLs:•
•
http://www.cisco.com/en/US/products/hw/switches/ps4324/prod_command_reference_list.html
•
http://www.cisco.com/en/US/products/hw/switches/ps4324/products_system_message_guides_list.html
Cisco IOS Documentation
Platform-independent Cisco IOS documentation may also apply to the Catalyst 4500 and 4900 switches. These documents are available at the following URLs:
•
http://www.cisco.com/en/US/products/ps6350/products_installation_and_configuration_guides_list.html
•
http://www.cisco.com/en/US/products/ps6350/prod_command_reference_list.html
You can also use the Command Lookup Tool at:
http://tools.cisco.com/Support/CLILookup/cltSearchAction.do
•
http://www.cisco.com/en/US/products/ps6350/products_system_message_guides_list.html
You can also use the Error Message Decoder tool at:
http://www.cisco.com/pcgi-bin/Support/Errordecoder/index.cgi
•
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
Notices
The following notices pertain to this software license.
OpenSSL/Open SSL Project
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/).
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com).
This product includes software written by Tim Hudson (tjh@cryptsoft.com).
License Issues
The OpenSSL toolkit stays under a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. Actually both licenses are BSD-style Open Source licenses. In case of any license issues related to OpenSSL please contact openssl-core@openssl.org.
OpenSSL License:
Copyright © 1998-2007 The OpenSSL Project. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1.
2.
3.
4.
5.
6.
"This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/)".
THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT "AS IS"' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes software written by Tim Hudson (tjh@cryptsoft.com).
Original SSLeay License:
Copyright © 1995-1998 Eric Young (eay@cryptsoft.com). All rights reserved.
This package is an SSL implementation written by Eric Young (eay@cryptsoft.com).
The implementation was written so as to conform with Netscapes SSL.
This library is free for commercial and non-commercial use as long as the following conditions are adhered to. The following conditions apply to all code found in this distribution, be it the RC4, RSA, lhash, DES, etc., code; not just the SSL code. The SSL documentation included with this distribution is covered by the same copyright terms except that the holder is Tim Hudson (tjh@cryptsoft.com).
Copyright remains Eric Young's, and as such any Copyright notices in the code are not to be removed. If this package is used in a product, Eric Young should be given attribution as the author of the parts of the library used. This can be in the form of a textual message at program startup or in documentation (online or textual) provided with the package.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1.
2.
3.
"This product includes cryptographic software written by Eric Young (eay@cryptsoft.com)".
The word `cryptographic' can be left out if the routines from the library being used are not cryptography-related.
4.
THIS SOFTWARE IS PROVIDED BY ERIC YOUNG "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
The license and distribution terms for any publicly available version or derivative of this code cannot be changed. i.e. this code cannot simply be copied and put under another distribution license [including the GNU Public License].
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information, see What's New in Cisco Product Documentation at: http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html.
Subscribe to What's New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Release Notes for the Catalyst 4500 Series Switch, Cisco IOS Release 12.2(54)SG
Copyright © 1999-2011, Cisco Systems, Inc. All rights reserved.
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)