Table Of Contents
Release Notes for the Catalyst 3750 Metro Switch
Cisco IOS Release 12.2(37)SE and LaterFinding the Software Version and Feature Set
Upgrading a Switch by Using the CLI
Recovering from a Software Failure
Minimum Cisco IOS Release for Major Features
Caveats Resolved in Cisco IOS Release 12.2(37)SE1
Caveats Resolved in Cisco IOS Release 12.2(37)SE
Hierarchical Policy Maps on ES EtherChannels
Updates to the Command Reference
ip arp inspection vlan logging
Updates to the Hardware Installation Guide
Chapter 3 "Connecting the Power Supply"
Appendix A "Technical Specifications"
Obtaining Documentation, Obtaining Support, and Security Guidelines
Release Notes for the Catalyst 3750 Metro Switch
Cisco IOS Release 12.2(37)SE and Later
Revised August 8, 2007
Cisco IOS Release 12.2(37)SE and 12.2(37)SE1 run on the Catalyst 3750 Metro switch.
These release notes include important information about Cisco IOS Release 12.2(37)SE, Cisco IOS Release12.2(37)SE1, and any limitations, restrictions, and caveats that apply to the releases.
Verify that these release notes are correct for your switch:
•
If you are installing a new switch, see the Cisco IOS release label on the rear panel of your switch.
•
•
For the complete list of switch documentation, see the "Related Documentation" section.
You can download the switch software from this site:
http://www.cisco.com/public/sw-center/sw-lan.shtml
This software release is part of a special release of Cisco IOS software that is not released on the same 8-week maintenance cycle that is used for other platforms. As maintenance releases and future software releases become available, they will be posted to Cisco.com in the Cisco IOS software area.
Contents
This information is in the release notes:
•
•
•
•
•
•
Hardware Supported
Table 1 lists the supported hardware and the minimum Cisco IOS release required.
Table 1 Supported Hardware
Catalyst 3750 Metro 24-AC switch
24 10/100 Ethernet ports, 2 1000X standard SFP1 module slots, 2 1000X ES2 SFP slots, and field-replaceable AC power supply
Cisco IOS Release 12.1(14)AX
Catalyst 3750 Metro 24-DC switch
24 10/100 Ethernet ports, 2 1000X standard SFP module slots, 2 1000X ES SFP slots, and field-replaceable DC power supply
Cisco IOS Release 12.1(14)AX
SFP modules
1000BASE-T, 1000BASE-SX, and1000BASE-LX
1000BASE-ZX and CWDM3
100BASE-FX MMF4
1000BASE-BX
Cisco IOS Release 12.1(14)AX
Cisco IOS Release 12.1(14)AX1Cisco IOS Release 12.2(25)EY
Cisco IOS Release 12.2(25)EY2
1 SFP = small form-factor pluggable
2 ES = enhanced services
3 CWDM = coarse wavelength-division multiplexer
4 MMF = multimode fiber
Upgrading the Switch Software
These are the procedures for downloading software:
•
•
•
•
•
Note
Finding the Software Version and Feature Set
The Cisco IOS image is stored as a bin file in a directory that is named with the Cisco IOS release. The image is stored on the system board flash device (flash:).
You can use the show version privileged EXEC command to see the software version that is running on your switch.
You can also use the dir filesystem: privileged EXEC command to see the directory names of other software images that you might have stored in flash memory.
Deciding Which Files to Use
The upgrade procedures in these release notes describe how to perform the upgrade by using a combined tar file. This file contains the Cisco IOS image file. To upgrade the switch through the command-line interface (CLI), use the tar file and the archive download-sw privileged EXEC command.
Table 2 lists the software filename for this software release.
Table 2 Cisco IOS Software Image Files for Catalyst 3750 Metro Switches
Filename
c3750me-i5-tar.122-37.SE1.tar
Cisco IOS image tar file.
This image has Layer 2+ and Layer 3 features.c3750me-i5k91-tar.122-37.SE1.tar
Cisco IOS cryptographic image tar file.
This image has the Kerberos, SSH1 , SSL2 , Layer 2+, and Layer 3 features.
1 SSH = Secure Shell
2 SSL = Secure Socket Layer
Archiving Software Images
Before upgrading your switch software, make sure that you have archived copies of the current Cisco IOS release and the Cisco IOS release to which you are upgrading. You should keep these archived images until you have upgraded all devices in the network to the new Cisco IOS image and until you have verified that the new Cisco IOS image works properly in your network.
Cisco routinely removes old Cisco IOS versions from Cisco.com. See Product Bulletin 2863 for more information:
http://www.cisco.com/en/US/partner/products/sw/iosswrel/ps5187/prod_bulletin0900aecd80281c0e.
HtmlYou can copy the bin software image file on the flash memory to the appropriate TFTP directory on a host by using the copy flash: tftp: privileged EXEC command.
Note
You can also configure the switch as a TFTP server to copy files from one switch to another without using an external TFTP server by using the tftp-server global configuration command. For more information about the tftp-server command, see the "Basic File Transfer Services Commands" section of the Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 at this URL:
Upgrading a Switch by Using the CLI
This procedure is for copying the tar file to the switch. You copy the file to the switch from a TFTP server and extract the files. You can download an image file and replace or keep the current image.
Download the software from Cisco.com to your management station by following these steps:
Step 1
Step 2
Go to this URL and log in to download the appropriate files:
http://www.cisco.com/public/sw-center/sw -lan.shtml
To download the files, click the link for your switch platform, and then follow the links on the page to select the correct tar image file.
Step 3
For more information, see Appendix B in the software configuration guide for this release.
Step 4
Step 5
Step 6
archive download-sw /overwrite /reload tftp:[[//location]/directory]/image-name.tarThe /overwrite option overwrites the software image in flash memory with the downloaded one.
The /reload option reloads the system after downloading the image unless the configuration has been changed and not been saved.
For //location, specify the IP address of the TFTP server.
For /directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive.
This example shows how to download an image from a TFTP server at 198.30.20.19 and to overwrite the image on the switch:
Switch# archive download-sw /overwrite tftp://198.30.20.19/c3750me-i5-tar.122-37.SE1.tarYou can also download the image file from the TFTP server to the switch and keep the current image by replacing the /overwrite option with the /leave-old-sw option.
Recovering from a Software Failure
Switch software can be corrupted during an upgrade, by downloading the wrong file to the switch, and by deleting the image file. In all of these cases, the switch does not pass the power-on self-test (POST), and there is no connectivity. You can use the Xmodem protocol to recover from these failures.
For detailed recovery procedures, see the "Troubleshooting" chapter in the software configuration guide for this release.
Installation Notes
You can assign IP information to your switch by using these methods:
•
•
•
•
New Features
These are the new supported hardware and the new software features provided this release:
•
•
New Hardware Features
For a list of all supported hardware, see the "Hardware Supported" section.
New Software Features
These are the new software features for Cisco IOS Release 12.2(37)SE:
•
•
•
•
•
•
•
•
•
•
Minimum Cisco IOS Release for Major Features
Table 3 lists the minimum software release required to support the major features on the Catalyst 3750 Metro switch.
Note
http://www.cisco.com/en/US/products/hw/switches/ps5532/products_configuration_guide_chapter09186a00801ee872.html
Limitations and Restrictions
You should review this section before you begin working with the switch. These are known limitations that will not be fixed, and there is not always a workaround. Some features might not work as documented, and some features could be affected by recent changes to the switch hardware or software.
Configuration
These are the configuration limitations:
•
This problem occurs under these conditions:
–
–
–
The workaround is to reconfigure the static IP address. (CSCea71176)
•
The workaround is to upgrade to Cisco IOS Release 12.2(25)EY or later. (CSCec35100)
•
These are the workarounds:
1.
2.
3.
•
–
–
–
No workaround is necessary; these are the designed behaviors. (CSCed50819)
•
However, when dynamic ARP inspection is not enabled and jumbo MTU is configured, ARP and RARP packets are correctly bridged in hardware. (CSCed79734)
•
The workaround is to configure the port for 10 Mbps and half duplex or to connect a hub or a nonaffected device to the switch. (CSCed39091)
•
When you enter the show ip arp inspection log privileged EXEC command, the log entries from all switches in the stack are moved to the switch on which the command was entered.
There is no workaround. (CSCed95822)
•
The workaround is to enter the no switchport block unicast interface configuration command for that specific interface. (CSCee93822)
•
The workaround is to statically configure the MAC address of port 1/0/3 in the CAM table of the switch bound to port 1/0/2 by using the mac address-table static mac-addr vlan vlan-id interface fastethernet1/0/2 global configuration command. (CSCee87864)
•
There is no workaround. This is a cosmetic error and does not affect the functionality of the switch. (CSCef59331)
•
2d20h: %PLATFORM_UCAST-3-LB: PI<->PD handles out of sync for Adj 222.1.1.1 LB -Traceback= 252620 A919CC A847E0 A85BE0 A927FC AA2D28 A965E0 A89C08 A78744 B08F48 ADF504 ADDC4C AE3460 AD25CC B94AA0 B94F20
There is no workaround. (CSCeh13477)
Ethernet
This is the Ethernet limitation:
SNAP-encapsulated IP packets are dropped without an error message being reported at the interface. The switch does not support SNAP-encapsulated IP packets. There is no workaround. (CSCdz89142)
Fallback Bridging
These are the fallback bridging limitations:
•
The workaround is to remove the VLAN from the bridge group or to remove the static MAC address from the VLAN. (CSCdw81955)
•
The workaround is to disable fallback bridging. To remove an interface from a bridge group and to remove the bridge group, use the no bridge-group bridge-group interface configuration command. Another workaround is to disable port security on all ports in all VLANs participating in fallback bridging by using the no switchport port-security interface configuration command. (CSCdz80499)
HSRP
These are the Hot Standby Routing Protocol (HSRP) limitations:
•
The workaround is to ensure that the ports on the standby cluster members are not in the spanning-tree blocking state. To verify that these ports are not in the blocking state, see the "Configuring STP" chapter in the software configuration guide. (CSCec76893)
•
There is no workaround. Do not configure HSRP on MPLS interfaces. (CSCeg76540)
IP
These are the IP limitations:
•
The workaround is to set an ARP timeout value higher than 120 seconds. (CSCea21674)
•
The workaround is to use rate limiting on DHCP traffic to prevent a denial of service attack from occurring. (CSCeb59166)
IP Telephony
These are the IP telephony limitations:
•
The workaround is to power the AP by using an AC wall adaptor. (CSCin69533)
•
There is no workaround. (CSCea85312)
MAC Addressing
This is the MAC addressing limitation:
When a MAC address is configured for filtering on the internal VLAN of a routed port, incoming packets from the MAC address to the routed port are not dropped. (CSCeb67937)
MPLS and EoMPLS
These are the multiprotocol label switching (MPLS) and Ethernet over MPLS (EoMPLS) limitations:
•
The workaround is to configure the incoming ports as an IEEE 802.1Q trunk or as an access port. (CSCeb44014)
•
The workaround is to use the show mpls ldp parameter user EXEC command to see the configured value. (CSCeb76775)
•
There is no workaround. (CSCec13655)
•
The workaround is to allow the EoMPLS VLAN on the trunk on the ES ports. (CSCsc42814)
Multicasting
These are the multicasting limitations:
•
•
There is no workaround because non-RPF traffic is continuous in certain topologies. As long as the trunk port is a member on a trunk port in at least one VLAN, this problem for the non-RPF traffic occurs. (CSCdu25219)
•
The workaround is to reduce the number of multicast routes and IGMP snooping groups to less than the maximum supported value. (CSCdy09008)
•
There is no workaround. (CSCdy82818)
•
The workaround is to not apply a router ACL configured to deny access to a VLAN interface. Apply the security through other means; for example, apply VLAN maps to the VLAN instead of using a router ACL for the group. (CSCdz86110)
•
There is no workaround. (CSCeb75366)
•
–
–
There is no workaround. (CSCec20128)
•
The switchport block multicast interface configuration command is only applicable to non-IP multicast traffic.
There is no workaround. (CSCee16865)
•
–
–
The workaround is to enter clear ip mroute privileged EXEC command on the interface. (CSCef42436)
•
There is no workaround. (CSCef67261)
QoS
These are the Quality of Service (QoS) limitations:
•
The workaround is to choose compatible buffer sizes and threshold levels. (CSCea76893)
•
There is no workaround. (CSCeb75230)
•
There is no workaround. (CSCeb80223)
•
There is no workaround. (CSCeb80300)
•
There is no workaround. (CSCec08205)
•
The workaround is to configure explicit matches for traffic that requires priority treatment. (CSCec38901)
•
The workaround is to detach the service policy from the port while making the modifications and then to re-attach the service policy. (CSCec75945)
•
If this becomes a problem, you can change switch behavior by using the queue-limit policy-map class configuration command at the class level to set shorter queue depths. Each shaper has an associated buffer queue with a default depth of 128 packets.
For example:
Switch(config)# policy-map cos2-policySwitch(config-pmap)# class cos2Switch(config-pmap-c)# bandwidth 50000Switch(config-pmap-c)# queue-limit 32The point at which buffer memory is exhausted depends on the number of queues, the sizes of the queued packets, and whether or not the traffic pattern being sent to the switch allows the queues to drain at all.
Upgrading your switch to Cisco IOS Release 12.2(25)EY or later greatly reduces the possibility of this situation happening, although it can still occur with some configurations and traffic patterns. (CSCed83886)
•
There is no workaround. (CSCee22591)
Routing
These are the routing limitations:
•
•
There is no workaround. (CSCea52915)
•
–
–
–
The workaround is to change any one of the listed conditions. (CSCed53633)
SPAN and RSPAN
These are the SPAN and Remote SPAN (RSPAN) limitations:
•
There is no workaround for a remote SPAN session. This is a hardware limitation. (CSCdy72835)
•
The workaround is to use the encapsulate replicate keywords in the monitor session global configuration command. This is a hardware limitation. (CSCdy81521)
•
The workaround is to configure only one RSPAN source session. (CSCea72326)
•
In all cases, normal traffic is not affected; the degradation limits only how much of the original source stream can be monitored. If fallback bridging and multicast routing are disabled, egress-SPAN monitoring is not degraded.
There is no workaround. If possible, disable fallback bridging and multicast routing. If possible, use ingress-SPAN to observe the same traffic. (CSCeb01216)
•
There is no workaround. (CSCeb23352)
•
The workaround is to use the monitor session session_number destination {interface interface-id encapsulation replicate} global configuration command for a local SPAN session. (CSCed24036)
Trunking
These are the trunking limitations:
•
There is no workaround. (CSCdz33708)
•
There is no workaround. (CSCdz42909)
•
There is no workaround. (CSCec35100).
•
3d20h: %PLATFORM_UCAST-3-LB: PI<->PD handles out of sync for Adj 222.1.1.1 LB -Traceback= 252620 A9204C A84E60 A86260 A92E7C AA36A0 AA3520 A96C60 A8A288 A78DC4 B095C8
There is no workaround. This does not affect switch functionality. (CSCeh20081)
Tunneling
This is the tunneling limitation:
•
The workaround is to configure identical VLAN mappings on both ES ports if they are going to be bundled into an EtherChannel. (CSCec49520)
VLAN
These are the VLAN limitations:
•
The workaround is to reduce the number of VLANs or trunks. (CSCeb31087)
•
There is no workaround. (CSCed71422)
•
The workaround is to define another policy-map name for the second-level policy-map with the same configuration to be used for another policy-map. (CSCef47377)
Important Notes
These are the important notes related to this software release:
•
–
–
In Cisco IOS Release 12.2(18)SE and later, you can only use the logging on and then the no logging console global configuration commands to disable logging to the console. (CSCec71490)
•
•
Note
•
Note
Open Caveats
These are the Cisco IOS severity-3 open configuration caveats in this software release:
•
The trust ip-precedence class configuration command is not supported in a hierarchical service policy on an enhanced-services (ES) port. However, this command is not rejected by the switch.
There is no workaround.
•
The switch might display tracebacks similar to this example when an EtherChannel interface port-channel type changes from Layer 2 to Layer 3 or the reverse:
15:50:11: %COMMON_FIB-4-FIBNULLHWIDB: Missing hwidb for fibhwidb Port-channel1 (ifindex 1632) -Traceback= A585C B881B8 B891CC 2F4F70 5550E8 564EAC 851338 84AF0C 4CEB50 859DF4 A7BF28 A98260 882658 879A58
There is no workaround.
•
When using Enhanced IGRP (EIGRP), a route might not appear in the routing table after booting up or during link flap.
The workaround is to enter the shutdown interface configuration command followed by the no shutdown command on the affected interface.
•
Traceback messages appear if you enter the no switchport interface configuration command to change a Layer 2 interface that belongs to a port channel to a routed port.
There is no workaround.
•
When a RIP network and IP address are configured on an interface, a traceback error occurs after you enter the shutdown, no shutdown, switchport and no switchport interface configuration commands.
The workaround is to configure the RIP network and the IP address after you configure the interface.
•
On a Catalyst 3750 Metro switch running Cisco IOS release 12.2(35)SE2 or later, if you attach or modify a policy with a policer action that has a user-configured conform burst (bc) or peak burst (be) specified in milliseconds by using the police cir percent percent [bc conform-burst ms] | pir percent percent [be peak-burst ms] policy map configuration command, you might receive a false error message related to adjusting bc/be value to fit the interface supported range.
The workaround is to use the police cir cir policy-map class configuration command and to specify the committed information rate (CIR) as an absolute number in bits per second (b/s) instead of a percentage.
•
When an internal VLAN is configured as a preferred VLAN for Flex Link VLAN load-balancing ports, traffic loss might occur on the internal VLAN.
The workaround is to remove the interval VLAN from the Flex Link VLAN load-balancing preferred VLAN lists for both the active and backup interfaces.
•
Changing the spanning tree mode from rapid STP to MSTP can cause tracebacks when the virtual port error-disable feature is enabled when the STP mode is changed.
There is no workaround.
•
When Ethernet Local Management Interface (E-LMI) is enabled on an ES port and VLAN translation is also configured for some VLANs on the port, VLAN translation is not processed correctly, and the VLANs are error-disabled by E-LMI.
The workaround is to not configure VLAN translation and ELMI-CE on the same ports.
•
An address learned as a supplicant that is aged out by port security aging is never relearned by port security under any of these conditions:
–
–
–
The workaround is to use the dot1x timeout interface configuration command instead of the port security aging timer as the reauthentication timer for IEEE 802.
Resolved Caveats
These sections describe the caveats that have been resolved in these releases:
•
•
Caveats Resolved in Cisco IOS Release 12.2(37)SE1
These caveats are resolved in Cisco IOS Release 12.2(37)SE1:
•
The server side of the Secure Copy (SCP) implementation in Cisco IOS contains a vulnerability that allows any valid user, regardless of privilege level, to transfer files to and from an IOS device that is configured to be a Secure Copy server. This vulnerability could allow valid users to retrieve or write to any file on the device's filesystem, including the device's saved configuration. This configuration file may include passwords or other sensitive information.
The Cisco IOS Secure Copy Server is an optional service that is disabled by default. Devices that are not specifically configured to enable the Cisco IOS Secure Copy Server service are not affected by this vulnerability.
This vulnerability does not apply to the Cisco IOS Secure Copy Client feature.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20070808-scp.shtml.
•
The SCP (Secure Copy Protocol) support is now correctly included in the image. The show file systems and copy privileged EXEC commands now correctly show scp as an option.
•
The switch no longer drops ARP packets destined to MAC addresses that are close to the MAC address block of the switch.
Caveats Resolved in Cisco IOS Release 12.2(37)SE
These caveats are resolved in Cisco IOS Release 12.2(37)SE:
•
Cisco IOS device may crash while processing malformed Secure Sockets Layer (SSL) packets. In order to trigger these vulnerabilities, a malicious client must send malformed packets during the SSL protocol exchange with the vulnerable device.
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
Cisco IOS is affected by the following vulnerabilities:
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. There are workarounds available to mitigate the effects of these vulnerabilities.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-SSL.shtml.
Note
A combined software table for Cisco IOS is available to aid customers in choosing a software releases that fixes all security vulnerabilities published as of May 22, 2007. This software table is available at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20070522-cry-bundle.shtml.
•
Cisco IOS device may crash while processing malformed Secure Sockets Layer (SSL) packets. In order to trigger these vulnerabilities, a malicious client must send malformed packets during the SSL protocol exchange with the vulnerable device.
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
Cisco IOS is affected by the following vulnerabilities:
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. There are workarounds available to mitigate the effects of these vulnerabilities.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-SSL.shtml.
Note
A combined software table for Cisco IOS is available to aid customers in choosing a software releases that fixes all security vulnerabilities published as of May 22, 2007. This software table is available at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20070522-cry-bundle.shtml.
•
This error message no longer appears during authentication when a method list is used and one of the methods in the method list is removed:
AAA-3-BADMETHODERROR:Cannot process authentication method 218959117•
A vulnerability has been discovered in a third party cryptographic library which is used by a number of Cisco products. This vulnerability may be triggered when a malformed Abstract Syntax Notation One (ASN.1) object is parsed. Due to the nature of the vulnerability it may be possible, in some cases, to trigger this vulnerability without a valid certificate or valid application-layer credentials (such as a valid username or password).
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
The vulnerable cryptographic library is used in the following Cisco products:
–
–
–
–
–
This vulnerability is also being tracked by CERT/CC as VU#754281.
Cisco has made free software available to address this vulnerability for affected customers. There are no workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-crypto.shtml.
Note
•
Cisco IOS device may crash while processing malformed Secure Sockets Layer (SSL) packets. In order to trigger these vulnerabilities, a malicious client must send malformed packets during the SSL protocol exchange with the vulnerable device.
Successful repeated exploitation of any of these vulnerabilities may lead to a sustained Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow an attacker will not be able to decrypt any previously encrypted information.
Cisco IOS is affected by the following vulnerabilities:
–
–
–
Cisco has made free software available to address these vulnerabilities for affected customers. There are workarounds available to mitigate the effects of these vulnerabilities.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20070522-SSL.shtml.
Note
A combined software table for Cisco IOS is available to aid customers in choosing a software releases that fixes all security vulnerabilities published as of May 22, 2007. This software table is available at the following link: http://www.cisco.com/warp/public/707/cisco-sa-20070522-cry-bundle.shtml.
•
When you configure an interface for InterSwitch Link (ISL) encapsulation and enable Ethernet OAM remote-loopback, the interface now goes into remote-loopback mode.
•
When you configure an IP address on a switch virtual interface (SVI) with DCHP and enable DHCP snooping on the SVI VLAN, the switch SVI now obtains an IP address.
•
The output of the show policy-map and show running-config commands now show the queue-limit configuration for qos-group values above 64. In addition, the switch now properly configures qos-group values above 16.
•
When multicast routing and IGMP snooping are enabled, a member switch that receives join messages at a high rate can now correctly forward multicast traffic to all the multicast groups after a reload.
•
When a Catalyst 3750 Metro switch is running Cisco IOS Release 12.2(25)SEG1, and a VLAN interface is associated with a VPN routing/forwarding (VRF) table, an internal VLAN is configured. This internal VLAN now appears correctly when you enter the show ip interface brief privileged EXEC command.
•
When a an SNMP query is done for an object ID (OID) equal to or greater than that of the mplsLsr MIB (1.3.6.1.3.96), the switch no longer unexpectedly reloads.
•
When you enter a shutdown or no shutdown interface configuration command on a remote link, the Catalyst 3750 Metro switch no longer displays a traceback.
•
When trunk ports are participating in a Flex Link configuration, entering a shutdown or no shutdown interface configuration command on the port no longer causes the switch to reload.
•
Online insertion and removal (OIR) of an SFP module no longer causes error-disabled ports to change to Up or Standby states, resulting in lost data.
•
The switch no longer reloads when you remove a class from a policy map that is attached to an interface.
•
When IGMP snooping is enabled, multicast traffic no longer is dropped after a port channel interface link flaps.
•
The switch no longer reloads when you use the bc keyword to modify a child policy map by entering the police cir percent percent [bc conform-burst ms] policy map configuration command.
•
The switch no longer halts when configuring link-state tracking with EtherChannel downstream ports or when booting up a switch already configured with link-state tracking with EtherChannel downstream ports.
Documentation Updates
This section contains these documentation updates:
•
•
•
Hierarchical Policy Maps on ES EtherChannels
As stated in the software configuration guide in Chapter 32, "Configuring QoS," the maximum shaping limit is not limited to 1 Gigabit if an absolute parameter policy is used, but instead it depends on the link status. The implicit shaper is now 1 Gigabit if one ES link is up and 2 Gigabits if both links are up.
Note that if there are child policies under a parent shaper that contain absolute bandwidth configurations and these policies become invalid because of ES link status changes, the entire policy is removed. Absolute values are not changed internally as percentage values are. If you want to configure an EtherChannel policy for a redundant application so that all policies would hold true no matter what the link state, there are two options:
•
•
IP SLAs Support
The Catalyst 3750 Metro switch includes partial support for Cisco IOS IP Service Level Agreements (IP SLAs) to provide advanced network service monitoring information and collect data pertaining to SLAs verification. The switch can initiate and reply jitter probes. However, the traffic does not follow the queuing configuration that is applied to customer traffic. All locally originated traffic always goes to the same egress queue on the switch port, regardless of the ToS setting for the IP SLAs probe. We recommend the use of an external shadow router to measure latency and packet drop rate (PDR) across the switch.
For performance testing purposes, this configuration was validated:
1.
2.
3.
a.
b.
For information about IP SLAs on Cisco routers, see this URL:
http://www.cisco.com/application/pdf/en/us/guest/products/ps6602/c1244/cdccont_0900aecd804fb392.pdf
Updates to the Command Reference
Commands for dynamic Address Resolution Protocol (ARP) inspection were revised in Cisco IOS Release 12.2(37)SE. These changes have not yet been incorporated into the command reference for this release.
•
ip arp inspection validate
Use the ip arp inspection validate global configuration command to perform specific checks for dynamic Address Resolution Protocol (ARP) inspection. Use the no form of this command to return to the default settings.
ip arp inspection validate {[src-mac] [dst-mac] [ip [allow zeros] ]}
no ip arp inspection validate [src-mac] [dst-mac] [ip [allow zeros] ]
Syntax Description
Defaults
No checks are performed.
Command Modes
Global configuration
Command History
12.2(20)SE
This command was introduced.
12.2(37)SE
The allow-zero keyword was added.
Usage Guidelines
You must specify at least one of the keywords. Each command overrides the configuration of the previous command; that is, if a command enables src-mac and dst-mac validations, and a second command enables IP validation only, the src-mac and dst-mac validations are disabled as a result of the second command.
The allow-zeros keyword interacts with ARP access control lists (ACLs) in this way:
•
•
The no form of the command disables only the specified checks. If none of the options are enabled, all checks are disabled.
Examples
This example show how to enable source MAC validation:
Switch(config)# ip arp inspection validate src-macYou can verify your setting by entering the show ip arp inspection vlan vlan-range privileged EXEC command.
Related Commands
show inventory vlan vlan-range
Displays the configuration and the operating state of dynamic ARP inspection for the specified VLAN.
ip arp inspection vlan logging
Use the ip arp inspection vlan logging global configuration command to control the type of packets that are logged per VLAN. Use the no form of this command to disable this logging control.
ip arp inspection vlan vlan-range logging {acl-match {matchlog | none} | dhcp-bindings {all | none | permit} | arp-probe}
no ip arp inspection vlan vlan-range logging {acl-match | dhcp-bindings | arp-probe}
Syntax Description
Defaults
All denied or all dropped packets are logged. ARP probe packets are not logged.
Command Modes
Global configuration
Command History
12.2(20)SE
This command was introduced.
12.2(37)SE
The arp-probe keyword was added.
Usage Guidelines
The term logged means that the entry is placed into the log buffer and that a system message is generated.
The acl-match and dhcp-bindings keywords merge with each other; that is, when you configure an ACL match, the DHCP bindings configuration is not disabled. Use the no form of the command to reset the logging criteria to their defaults. If neither option is specified, all types of logging are reset to log when ARP packets are denied. These are the options:
•
•
If neither the acl-match or the dhcp-bindings keywords are specified, all denied packets are logged.
The implicit deny at the end of an ACL does not include the log keyword. This means that when you use the static keyword in the ip arp inspection filter vlan global configuration command, the ACL overrides the DHCP bindings. Some denied packets might not be logged unless you explicitly specify the deny ip any mac any log ACE at the end of the ARP ACL.
Examples
This example shows how to configure ARP inspection on VLAN 1 to log packets that match the permit commands in the ACL:
Switch(config)# arp access-list test1Switch(config-arp-nacl)# permit request ip any mac any logSwitch(config-arp-nacl)# permit response ip any any mac any any logSwitch(config-arp-nacl)# exitSwitch(config)# ip arp inspection vlan 1 logging acl-match matchlogYou can verify your settings by entering the show ip arp inspection vlan vlan-range privileged EXEC command.
Related Commands
show ip arp inspection
The output of this command has changed to include the ARP probe information.
This is an example of output from the show ip arp inspection command
Switch# show ip arp inspectionSource Mac Validation : DisabledDestination Mac Validation : DisabledIP Address Validation : EnabledVlan Configuration Operation ACL Match Static ACL---- ------------- --------- --------- ----------1 Enabled Active deny-all NoVlan ACL Logging DHCP Logging Probe Logging---- ----------- ------------ -------------1 Acl-Match All PermitVlan Forwarded Dropped DHCP Drops ACL Drops---- --------- ------- ---------- ---------1 0 0 0 0Vlan DHCP Permits ACL Permits Probe Permits Source MAC Failures---- ------------ ----------- ------------- -------------------1 0 0 0 0Vlan Dest MAC Failures IP Validation Failures Invalid Protocol Data---- ----------------- ---------------------- ---------------------1 0 0 0Updates to the Hardware Installation Guide
These sections list updates to the hardware installation guide:
•
•
Installation Update
Cisco Ethernet Switches are equipped with cooling mechanisms, such as fans and blowers. However, these fans and blowers can draw dust and other particles, causing contaminant buildup inside the chassis, which can result in a system malfunction.
You must install this equipment in an environment as free as possible from dust and foreign conductive material (such as metal flakes from construction activities).
These standard provide guidelines for acceptable working environments and acceptable levels of suspended particulate matter:
•
•
•
Chapter 3 "Connecting the Power Supply"
Preparing for Installation
Locate the terminal block plug that ships with the DC power supply.
Obtain these necessary tools and equipment:
•
•
•
•
Note
•
Appendix A "Technical Specifications"
These are the correct weights for the Catalyst 3750 Metro switches:
•
•
•
•
Related Documentation
These documents provide information about the switch and are available from this Cisco.com site:
http://www.cisco.com/en/US/products/hw/switches/ps5532/tsd_products_support_series_home.html
You can order printed copies of documents with a DOC-xxxxxx= number from the Cisco.com sites listed in the "Obtaining Documentation, Obtaining Support, and Security Guidelines" section.
•
•
(order number DOC-7817432=)•
•
•
•
•
•
http://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html
–
–
–
–
Obtaining Documentation, Obtaining Support, and Security Guidelines
For information on obtaining documentation, obtaining support, providing documentation feedback, security guidelines, and also recommended aliases and general Cisco documents, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCVP, the Cisco logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networking Academy, Network Registrar, Packet, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0705R)
© 2007 Cisco Systems, Inc. All rights reserved.
Guest
