Release Notes for the Catalyst 4500 Series Switch, Cisco IOS 15.1(1)SG
Available Languages
Table of Contents
Release Notes for the Catalyst 4500 Series Switch, Cisco IOS Releases 15.1(1)SG
Features Not Supported on the Cisco Catalyst 4500 Series Switch
Cisco Classic IOS Release Strategy
Supported Hardware on Catalyst 4500 Series Switch
Supported Hardware on Catalyst 4500 E-Series Switch
New Hardware Features in Release 15.1(1)SG1
New Software Features in Release 15.1(1)SG1
New Hardware Features in Release15.1(1)SG
New Software Features in Release15.1(1)SG
Identifying an +E Chassis and ROMMON
Guidelines for Upgrading the ROMMON
Upgrading the Supervisor Engine ROMMON from the Console
Upgrading the Supervisor Engine ROMMON Remotely Using Telnet
Upgrading the Cisco IOS Software
Open Caveats for Cisco IOS Release 15.1(1)SG2
Resolved Caveats in Cisco IOS Release 15.1(1)SG2
Open Caveats for Cisco IOS Release 15.1(1)SG1
Resolved Caveats in Cisco IOS Release 15.1(1)SG1
Open Caveats for Cisco IOS Release 15.1(1)SG
Resolved Caveats in Cisco IOS Release 15.1(1)SG
Troubleshooting at the System Level
Obtaining Documentation and Submitting a Service Request
Release Notes for the
Catalyst 4500 Series Switch,
Cisco IOS Releases 15.1(1)SG
Current Release
IOS 15.1(1)SG2—November 1, 2012
Previous Release
IOS 15.1(1)SG1 and IOS 15.1(1)SG
These release notes describe the features, modifications, and caveats for Cisco IOS Release 15.1(1)SG on the Catalyst 4500 series switch.
Support for Cisco IOS Software Release 15.1(1)SG, the default image, follows the standard Cisco Systems® support policy, available at
http://www.cisco.com/en/US/products/products_end-of-life_policy.html
Note
Although their Release Notes are unique, the 4 platforms (Catalyst 4500, Catalyst 4900,
Catalyst ME 4900, and Catalyst 4900M/4948E) use the same Software Configuration Guide, Command Reference Guide, and System Message Guide.
For more information on the Catalyst 4500 series switches, visit the following URL:
http://www.cisco.com/go/cat4500/docs
Cisco IOS Software Packaging
The Enterprise Services image supports all Cisco Catalyst 4500 Series software features based on Cisco IOS Software, including enhanced routing. Customers planning to enable BGP for Supervisor Engine IV, V, or V-10GE will no longer need to purchase a separate BGP license (FR-IRC4) because BGP is included in the Enterprise Services package. Beginning with 12.2(53)SG2, we support the Enterprise Services image on Supervisor Engine 6L-E.
The IP Base image supports Open Shortest Path First (OSPF) for Routed Access, Enhanced Interior Gateway Routing Protocol (EIGRP) "limited" Stub Routing, Nonstop Forwarding/Stateful Switchover (NSF/SSO), and RIPv1/v2. The IP Base image does not support enhanced routing features such as BGP, Intermediate System-to-Intermediate System (IS-IS), Internetwork Packet Exchange (IPX), AppleTalk, Virtual Routing Forwarding (VRF-lite), GLBP, and policy-based routing (PBR).
Cisco IOS Release 12.2(46)SG1 introduced a new LAN Base software and an IP upgrade image. These complement the existing IP Base and Enterprise Services images. The LAN base image is supported on Supervisor Engine 6L-E starting with Cisco IOS Release 12.2(52)XO. LAN Base image is primarily focused on customer access and Layer 2 requirements and therefore many of the IP Base features are not required. The IP upgrade image is available if at a later date you require some of those features.
Starting with Cisco IOS Release 15.0(2)SG, on the Catalyst 4500 Series Switch, support for NEAT feature has been extended from IP Base to LAN Base and support for HSRP v2 IPV6 has been extended from Enterprise Services to IP Base.
Starting with Cisco IOS Release (3.3.0SG or 15.1(1)SG), support for IP SLAs and NSF have been extended from Enterprise Services to IP Base.
- Feature Support by Image Type
- Features Not Supported on the Cisco Catalyst 4500 Series Switch
- Orderable Product Numbers
Feature Support by Image Type
Table 1 is a detailed list of features supported on Catalyst 4500 Series Switch running Cisco IOS Software Release 15.0(2)SG. For the full list of supported features, check the Feature Navigator application:
http://tools.cisco.com/ITDIT/CFN/
For information on MiBs support, please refer to this URL:
http://ftp.cisco.com/pub/mibs/supportlists/cat4000/cat4000-supportlist.html
Crashdump Enhancement1 |
|||
Ethernet Management Port (Fa1 interface)2 |
|||
IEEE 802.1ag D8.1 standard Compliant CFM, Y.1731 multicast LBM / AIS / RDI / LCK, IP SLA for Ethernet |
|||
IEEE 802.1s Multiple Spanning Tree (MST) Standard Compliance |
|||
IEEE 802.3ad Link Aggregation (LACP) Port-Channel Standalone Disable |
|||
IPv6 Multicast: Multicast Listener Discovery (MLD) Protocol, Versions 1 and 2 |
|||
Yes3 |
|||
Yes 3 |
|||
Yes 3 |
|||
IPv6 Switching: CEFv6 Switched Automatic IPv4-compatible Tunnels (in software) |
|||
IPv6 Switching: CEFv6 Switched Configured IPv6 over IPv4 Tunnels (in software) |
|||
IPv6 Tunneling: Automatic IPv4-compatible Tunnels (in software) |
|||
IPv6 Tunneling: Manually Configured IPv6 over IPv4 Tunnels (in software) |
|||
Medianet 2.0: Integrated Video Traffic Simulator (hardware-assisted IP SLA); IPSLA responder only |
|||
Medianet 2.0: Media Monitoring (Performance Monitoring and Mediatrace) |
|||
NEAT Enhancement: Re-Enabling BPDU Guard Based on User Configuration |
|||
Yes 3 |
|||
Yes 3 |
|||
Yes 3 |
|||
Yes 3 |
|||
Yes 3 |
|||
Yes 3 |
|||
Yes 3 |
|||
Yes 3 |
|||
Yes 3 |
|||
Yes 3 |
|||
Yes 3 |
|||
Yes 3 |
|||
Yes 3 |
|||
RADIUS Attribute 44 (Accounting Session ID) in Access Requests |
|||
Source Specific Multicast (SSM) - IGMPv3,IGMP v3lite, and URD |
|||
Time Domain Reflectometry (TDR)4 |
|||
TrustSec: IEEE 802.1ae MACSec encryption on user facing ports |
|||
TrustSec: IEEE 802.1ae MACSec encryption on user facing ports SSO |
|||
TrustSec: IEEE 802.1ae MACSec encryption between switch-to-switch links using Cisco SAP (Security Association Protocol) |
|||
Note You can purchase a special license to enable the 10 Gigabit uplinks in the LAN Base image without moving to IP Base.
Features Not Supported on the Cisco Catalyst 4500 Series Switch
The following features are not supported in Cisco IOS Release 15.1(1)SG on the Catalyst 4500 series switches:
– Standard Xerox Network System (XNS) access list
– Protocol type-code access list
- ADSL and Dial access for IPv6
- AppleTalk EIGRP (use native AppleTalk routing instead)
- Bridge groups
- CEF Accounting
- Cisco IOS software IPX ACLs:
– <1200-1299> IPX summary address access list
- Cisco IOS software-based transparent bridging (also called “fallback bridging”)
- Connectionless (CLNS) routing; including IS-IS routing for CLNS. IS-IS is supported for IP routing only.
- DLSw (data-link switching)
- IGRP (use EIGRP instead)
- isis network point-to-point command
- Kerberos support for access control
- LLDP HA
- Lock and key
- NAT-PT for IPv6
- NetFlow per-VRF
- PBR with Multiple Tracking Options
- QoS for IPv6 traffic (only supported on Supervisor 6)
- Reflexive ACLs
- Routing IPv6 over an MPLS network
- WCCP version 1
- CFM CoS
- PBR with EOT
Orderable Product Numbers
Cisco Classic IOS Release Strategy
Customers using Supervisor Engine 6-E or 6L-E with Catalyst 4500 Series Switches who need the latest hardware and software features should migrate to Cisco IOS Release 15.1(1)SG.
Note This release does not support older Supervisor Engines, including II+, III, IV, V, and V-10GE.
The Catalyst 4500 Series Switch has two maintenance trains. Cisco IOS Release 15.0(2)SG is the recommended release for customers who require a release with a maintenance train.
For more information on the Catalyst 4500 series switches, visit the following URL:
http://www.cisco.com/go/cat4500/docs
Figure 1 displays the two active trains, 12.2(53)SG and 15.0(2)SG.
Figure 1 Software Release Strategy for the Catalyst 4500 Series Switch
Support
Support for Cisco IOS Software Release 15.1(1)SG follows the standard Cisco Systems® support policy, available at
http://www.cisco.com/en/US/products/products_end-of-life_policy.html
System Requirements
This section describes the system requirements:
- Supported Hardware on Catalyst 4500 Series Switch
- Supported Hardware on Catalyst 4500 E-Series Switch
Supported Hardware on Catalyst 4500 Series Switch
Table 3 lists the hardware supported on the Catalyst 4500 Series Switch.
For Catalyst 4500 transciever module compatibility information, see the URL:
http://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html
Table 3 briefly describes the four chassis in the Catalyst 4500 Series Switch. For the chassis listed in the table, refer to Table 6 for software release information.
For information on the minimum supported release for each pluggable module please refer to:
http://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html
Supported Hardware on Catalyst 4500 E-Series Switch
In addition to the classic line cards and supervisor engines, Cisco IOS Software Release 15.0(2)SG supports the next-generation high-performance E-Series Supervisor Engine 6-E with CenterFlex technology and E-Series line cards and chassis. A brief list of primary E-Series hardware supported on Catalyst 4500 series switch ( Table 5 ).
Table 6 outlines the chassis and supervisor engine compatibility.
(M=Minimum release, R=Recommended release)
New and Changed Information
These sections describe the new and changed information for the Catalyst 4500 series switch running Cisco IOS software:
- New Hardware Features in Release 15.1(1)SG1
- New Software Features in Release 15.1(1)SG1
- New Hardware Features in Release 15.1(1)SG
- New Software Features in Release 15.1(1)SG
New Hardware Features in Release 15.1(1)SG1
Release 15.1(1)SG1 provides no new hardware on the Catalyst 4500 series switch.
New Software Features in Release 15.1(1)SG1
Release 15.1(1)SG1 provides no new new software on the Catalyst 4500 series switch:
New Hardware Features in Release 15.1(1)SG
Release 15.1(1)SG provides the following new hardware on the Catalyst 4500 series switch:
- GLC-FE-100EX and GLC-FE-100ZX for Fast Ethernet SFP ports on WS-X4248-FE-SFP
- GLC-GE-100FX for Gigabit Ethernet SFP ports on WS-X4640-CSFP-E, WS-X4612-SFP-E and WS-X4624-SFP-E
Note Although GLC-GE-100FX plugs in Gigabit Ethernet SFP port, it provides 100M bandwidth
New Software Features in Release 15.1(1)SG
Release 15.1(1)SG provides the following new software features on the Catalyst 4500 series switch.
– Monitoring (includes Performance Monitoring and Mediatrace)
– Integrated video traffic simulator ( hardware assisted IP SLA)
For details refer to the URLs:
http://www.cisco.com/en/US/docs/net_mgmt/cisco_configuration_professional/v2_5/olh/ccp.pdf
http://www.cisco.com/en/US/docs/switches/lan/energywise/phase2_5/ios/release/notes/ol23554.html
- IPv6 OSPFv3 NSF/SSO
- IPv6 OSPFv3 Fast Convergence
- OSPFv3 Authentication
- IPsecv3/IKEv2 (for management traffic only)
- FIPS 140-2/3 Level 2 Certification
- No Service Password Recovery
- Easy Virtual Network (EVN)
- ND cache limit per interface
- HSRPv2 for IPv6 Global Address Support
- Identity 4.2: MAB with configurable user name/ password
- BGP Wildcard
- BGP 4Byte ASN (CnH)
- BGP graceful restart per neighbor
- BGP Nexthop tracking
- Dynamic PBR API
- Multicast Call Admission Control—Per interface route state limit
- Bandwidth-based Call Admission Control policy for Multicast
- Ability to disallow mcast group ranges
- IPv6 SSM mapping—MLD v1 receivers
- IPv6 BSR—Ability to configure RP mapping
- MSDP MD5 password authentication
- MLD group limits
- IPv6 multicast—Disable group ranges
- IGMP static group range support
- PIM-triggered joins
- Support directly conn. add in autoRP cand. RP
- Enhanced Multicast Multipath
- IGMP-STD-MIB implementation
- Knob to use SNMP MIBII ifindex as int-id in OSPF data fields
- Enhanced OSPF traffic stats
- OSPF Mechanism to exclude Connected prefixes
- OSPF TTL Security Check
- OSPF Graceful Shutdown
- OSPFv2 int. enabling—OSPF area command
- OSPFv3 IPSec enhancements
- IP-RIP: Delayed startup
- AAA accounting: Stop record CLI enhancement
- Radius Server Load Balancing porting
- AAA Double Authentication Secured by Absolute Timeout
- Local AAA Attribute Support via Subscriber Profile
- Method List, Server Group Scalability
- BGP: Dual AS Accept Implementation
- NSF in IP Base
- IGMPv3 Host Stac
- Per Intf IGMP State Limit
- Per Intf MrouteState Limit
- TACACS+ and Radius for IPv6
- NTP for IPv6( It is VRF aware as well)
Upgrading the System Software
In most cases, upgrading the switch to a newer release of Cisco IOS software does not require a ROMMON upgrade. However, if you are running an early release of Cisco IOS software and plan to upgrade, refer to the following tables for the minimum Cisco IOS image and the recommended ROMMON release, respectively.
Note You must upgrade to at leaset ROMMON Release 12.2(44r)SG5 to run Cisco IOS Release 15.0(2)SG on the Supervisor Engine 6-E and Supervisor Engine 6L-E. 12.2(44r)SG9 is recommended.
Most supervisor engines have the required ROMMON release. However, due to caveat CSCed25996, we recommend that you upgrade your ROMMON to the recommended release.
The following sections describe how to upgrade your switch software:
- Identifying an +E Chassis and ROMMON
- Guidelines for Upgrading the ROMMON
- Upgrading the Supervisor Engine ROMMON from the Console
- Upgrading the Supervisor Engine ROMMON Remotely Using Telnet
- Upgrading the Cisco IOS Software
Identifying an +E Chassis and ROMMON
An +E chassis is identified by a FRU minor value in the chassis' idprom.
When supervisor engine 1 (sup1) is in ROMMON and supervisor engine 2 (sup2) is in IOS, only sup2 can read the idprom contents of chassis’ idprom. Chassis type is displayed as “+E” in the output of the show version command. Conversely, sup1 can only display the chassis type as “E.”
When both sup1 and sup2 are in ROMMON, both engines can read the chassis’ idprom. Chassis type is displayed correctly as “+E” in the output of the show version command.
When both sup1 and sup2 are in IOS, both engines can read the chassis’ idprom. Chassis type is displayed correctly as “+E” in the output of the show version command.
Guidelines for Upgrading the ROMMON
If your supervisor engine is shipped with a newer version of ROMMON then do not downgrade! The new ROMMON will have board settings based on a hardware revision of components, and old settings will not work.
Upgrading ROMMON on Supervisor Engine 6-E and 6L-E may reset their uplink interfaces. Software prior to Cisco IOS Release 15.0(2)SG did not detect and recover from this situation when the standby supervisor engine ROMMON is upgraded. The redundant supervisor engine ROMMON upgrade process described next only works when the active supervisor engine is running Cisco IOS Release 15.0(2)SG. For redundant systems, you first upgrade the software to Cisco IOS Release 15.0(2)SG, then upgrade the ROMMON.
Upgrading the Supervisor Engine ROMMON from the Console
To avoid actions that might make your system unable to boot, read this entire section before starting the upgrade.
Note The examples in this section use the programmable read-only memory (PROM) upgrade version 12.2(44r)SG9 and Cisco IOS Release 12.2(50)SG. For other software releases, replace the ROMMON release and Cisco IOS software release with the appropriate release and filename. This document describes the procedure for a single supervisor engine system. In a dual supervisor engine system, you must perform the process on each supervisor engine.
Follow this procedure to upgrade your supervisor engine ROMMON:
Step 1 Directly connect a serial cable to the console port of the supervisor engine.
Note This section assumes that the console baud rate is set to 9600 (default). If you want to use a different baud rate, change the configuration register value for your switch.
Step 2 Download the cat4500-e-ios-promupgrade-122_44r_SG9 program from Cisco.com, and place it on a TFTP server in a directory that is accessible from the switch to be upgraded.
The cat4500-e-ios-promupgrade-122_44r_SG9 program is available on Cisco.com at the same location from which Catalyst 4500 system images are downloaded.
Step 3 Use the dir bootflash: command to ensure that sufficient space exists in Flash memory to store the PROM upgrade image. If you are using a CompactFlash card, replace bootflash: with slot0:
Note Because of CSCsu36751, you should use bootflash for this upgrade if your current ROMMON version is prior to 12.2(44r)SG3. Else, you might need to reseat the compact flash after rebooting.
Step 4 Download the cat4500-e-ios-promupgrade-122_44r_SG9 program into Flash memory using the copy tftp command.
The following example shows how to download the PROM upgrade image cat4500-e-ios-promupgrade-122_44r_SG9 from the remote host 172.20.58.78 to bootflash:
Address or name of remote host [172.20.58.78]?
Source filename [cat4500-e-ios-promupgrade-122_44r_SG9]?
Destination filename [cat4500-e-ios-promupgrade-122_44r_SG9]?
Accessing tftp://172.20.58.78/cat4500-e-ios-promupgrade-122_44r_SG9...
Loading cat4500-e-ios-promupgrade-122_44r_SG9 from 172.20.58.78 (via
Step 5 On a dual-supervisor system, copy the same ROMMON image to the standby supervisor engine with the copy bootflash:cat4500-e-ios-promupgrade-122_44r_SG9 slavebootflash command
Step 6 Enter the reload command to reset the switch, press Ctrl-C to stop the boot process, and re-enter ROMMON.
Note On a redundant system, this action causes a switchover.
The following example shows the output after a reset into ROMMON:
Step 7 Run the PROM upgrade program by entering this command:
boot bootflash:cat4500-e-ios-promupgrade-122_44r_SG9
No intervention is necessary to complete the upgrade. To ensure a successful upgrade, do not interrupt the process. Do not perform a reset, power cycle, or OIR of the supervisor engine until the upgrade completes.
The following example shows the output from a successful upgrade, followed by a system reset:
Step 8 Boot the Cisco IOS software image. This may happen automatically if the system is configured to auto-boot.
Step 9 On a redundant system, hook up a console to the now-active supervisor engine. After the system achieves an SSO state, repeat steps 6-8.
Step 10 Use the show module command to verify that you have upgraded the ROMMON:
Step 11 Use the delete command on the active supervisor to delete the PROM upgrade program from bootflash
The following example shows how to delete the cat4500-e-ios-promupgrade-122_44r_SG9 image from bootflash:
Step 12 On a redundant system, also delete the upgrade file from the standby supervisor engine:
The ROMMON has now been upgraded.
See the “Upgrading the Cisco IOS Software” section for instructions on how to upgrade the Cisco IOS software on your switch.
Upgrading the Supervisor Engine ROMMON Remotely Using Telnet
To avoid actions that might make your system unable to boot, read this entire section before starting the upgrade.
Follow this procedure to upgrade your supervisor engine ROMMON to Release 12.2(44r)SG9. This procedure can be used when console access is not available and when the ROMMON upgrade must be performed remotely.
Note In the following section, use the PROM upgrade version bootflash:cat4500-e-ios-promupgrade-122_44r_SG9.
Step 1 Establish a Telnet session to the supervisor engine.
Note In the following discussion, we assume that at least one IP address has been assigned to either an SVI or a routed port.
Step 2 Download the bootflash:cat4500-e-ios-promupgrade-122_44r_SG9 program from Cisco.com, and place it on a TFTP server in a directory that is accessible from the switch to be upgraded.
The bootflash:cat4500-e-ios-promupgrade-122_44r_SG9 programs are available on Cisco.com at the same location from which you download Catalyst 4500 system images.
Step 3 Use the dir bootflash: command to ensure that there is sufficient space in Flash memory to store the PROM upgrade image. If there is insufficient space, delete one or more images, and then enter the
squeeze bootflash: command to reclaim the space.
If you are using a CompactFlash card, replace bootflash: with slot0:.
Step 4 Download the bootflash:cat4500-e-ios-promupgrade-122_44r_SG9 program into Flash memory using the copy tftp command.
The following example shows how to download the PROM upgrade image bootflash:cat4500-e-ios-promupgrade-122_44r_SG9 from the remote host 172.20.58.78 to bootflash:
Step 5 Use the no boot system flash bootflash: file_name command to clear all BOOT variable commands in the configuration file. In this example, the BOOT variable was set to boot the image cat4000-i5s-mz.121-19.EW1.bin from bootflash:
Note The config-register must be set to autoboot.
Step 6 Use the show bootvar command to verify the boot string. The BOOT variable in this example will first run the PROM upgrade to upgrade ROMMON. Then, the upgrade software will reload and the supervisor engine will load the Cisco IOS software image.
Step 7 Run the PROM upgrade program by issuing the reload command. Issuing this command will terminate your Telnet session.
Verify the boot string in step 6. No intervention is necessary to complete the upgrade. To ensure a successful upgrade, do not interrupt the upgrade process. Do not perform a reset, power cycle, or OIR of the supervisor engine until the upgrade is complete.
The following example shows the console port output from a successful ROMMON upgrade followed by a system reset. Your Telnet session is disconnected during the ROMMON upgrade, so you will not see this output. This step could take 2-3 minutes to complete. You will need to reconnect your Telnet session after 2-3 minutes when the Cisco IOS software image and the interfaces are loaded.
Step 8 Use the no boot system flash bootflash: file_name command to clear the BOOT command used to upgrade the ROMMON.
Step 9 Use the show version command to verify that the ROMMON has been upgraded.
Step 10 Use the delete command to delete the PROM upgrade program from bootflash and the squeeze command to reclaim unused space.
The following example shows how to delete the cat4000-ios-promupgrade-121_20r_EW1 image from bootflash and reclaim unused space:
Step 11 Use the show bootvar command to verify that the ROMMON upgrade program has been removed from the BOOT variable.
The ROMMON has now been upgraded.
See the “Upgrading the Cisco IOS Software” section for instructions on how to upgrade the Cisco IOS software on your switch.
Upgrading the Cisco IOS Software
To avoid actions that might make your system unable to boot, please read this entire section before starting the upgrade.
Before you proceed, observe the following rules for hostname:
Uppercase and lowercase characters look the same to many internet software applications. It may seem appropriate to capitalize a name the same way you might do in English, but conventions dictate that computer names appear all lowercase. For more information, refer to RFC 1178, Choosing a Name for Your Computer.
- Must start with a letter and end with a letter or digit.
- Interior characters can only be letters, digits, and hyphens; periods and underscores not allowed.
- Names must be 63 characters or fewer; hostname of fewer than 10 characters is recommended.
- On most systems, a field of 30 characters is used for the host name and the prompt in the CLI. Longer configuration mode prompts may be truncated.
To upgrade the Cisco IOS software on your Catalyst 4500 series switch, use this procedure:
Step 1 Download Cisco IOS Release 15.01(2) from Cisco.com, and place the image on a TFTP server in a directory that is accessible from the supervisor engine that is upgraded.
Step 2 Use the dir bootflash: command to ensure that there is sufficient space in Flash memory to store the promupgrade image. If there is insufficient space, delete one or more images, and then enter the squeeze bootflash: command to reclaim the space.
If you are using a CompactFlash card, use slot0: instead of bootflash.
Step 3 Download the software image into Flash memory using the copy tftp command.
The following example shows how to download the Cisco IOS software image cat4000-is-mz.121-12c.EW from the remote host 172.20.58.78 to bootflash:
Step 4 Use the no boot system flash bootflash: file_name command to clear the cat4000-is-mz.121-8a.EW file and to save the BOOT variable.
The following example shows how to clear the BOOT variable:
Step 5 Use the boot system flash command to add the Cisco IOS software image to the BOOT variable.
The following example shows how to add the cat4000-is-mz.121-12c.EW image to the BOOT variable:
Step 6 Use the config-register command to set the configuration register to 0x2102.
The following example show how to set the second least significant bit in the configuration register:
Step 7 Enter the reload command to reset the switch and load the software.
Caution No intervention is necessary to complete the upgrade. To ensure a successful upgrade, do not interrupt the upgrade process by performing a reset, power cycle, or OIR of the supervisor, for at least five minutes.
The following example shows the output from a successful upgrade followed by a system reset:
Step 8 Use the show version command to verify that the new Cisco IOS release is operating on the switch.
Limitations and Restrictions
These sections list the limitations and restrictions for the current release of Cisco IOS software on the Catalyst 4500 series switch.
- Starting with Release IOS XE 3.3.0SG and IOS 15.1(1)SG, the seven RP restriction was removed.
- When you enter the permit any any ? command you will observe the octal option, which is unsupported in Cisco IOS Release 12.2(54)SG.
- A Span destination of fa1 is not supported.
- The "keepalive" CLI is not supported in interface mode on the switch, although it will appear in the running configuration. This behavious has no impact on functionality.
- TDR is only supported on interfaces Gi1/1 through Gi1/48, at 1000BaseT under open or shorted cable conditions. TDR length resolution is +/- 10 m. If the cable is less than 10 m or if the cable is properly terminated, the TDR result displays "0" m. If the interface speed is not 1000BaseT, an "unsupported" result status displays. TDR results will be unreliable for cables extended with the use of jack panels or patch panels.
- The following guidelines apply to Fast UDLD:
– Fast UDLD is disabled by default.
– Configure fast UDLD only on point-to-point links between network devices that support fast UDLD.
– You can configure fast UDLD in either normal or aggressive mode.
– Do not enter the link debounce command on fast UDLD ports.
– Configure fast UDLD on at least two links between each connected network device. This reduces the likelihood of fast UDLD incorrectly error disabling a link due to false positives.
– Fast UDLD does not report a unidirectional link if the same error occurs simultaneously on more than one link to the same neighbor device.
The outputs of certain commands, such as show ip route and show access-lists, contain non-deterministic text. While the output is easily understood, the output text does not contain strings that are consistently output. A general purpose specification file entry is unable to parse all possible output.
While a general purpose specification file entry may not be possible, a specification file entry might be created that returns the desired text by searching for text that is guaranteed to be in the output. If a string is guaranteed to be in the output, it can be used for parsing.
For example, the output of the show ip access-lists SecWiz_Gi3_17_out_ip command is this:
The first line is easily parsed because access list is guaranteed to be in the output:
The remaining lines all contain the term host. As a result, the specification file may report the desired values by specifying that string. For example, this line
will produce the following for the first and second rules
and the following for the third statement
Request the output of the show running-config command using NETCONF and parse that output for the desired strings. This is useful when the desired lines contain nothing in common. For example, the rules in this access list do not contain a common string and the order (three permits, then a deny, then another permit), prevent the spec file entry from using permit as a search string, as in the following example:
The XML output of show running-config command includes the following, which can then be parsed programmatically, as desired:
- Although the Catalyst 4500 series switch still supports legacy 802.1X commands used in Cisco IOS Release 12.2(46)SG and earlier releases (that is, they are accepted on the CLI), they do not display in the CLI help menu.
- Current IOS software cannot support filenames exceeding 64 characters.
- All software releases support a maximum of 32,768 IGMP snooping group entries.
- After upgrading to 12.2(31)SG and later releases, some CPU queues configured as SPAN sources and saved in the startup configuration file do not function as they did in the older software release. The following table reflects this change.
This only affects a switch that has any of the following queues configured as SPAN source in releases prior to 12.2(31)SG and saved to the startup configuration. The SPAN destination would not get the same traffic after upgrading to 12.2(31)SG.
Workaround: After upgrading to 12.2(31)SG and later releases, remove the old SPAN source configuration and reconfigure with the new queue names/IDs. For example:
- Although you can configure subsecond PIM query intervals on Catalyst 4500 platforms, such an action represents a compromise between convergence (reaction time) and a number of other factors (number of mroutes, base line of CPU utilization, CPU speed, processing overhead per 1 m-route, etc.). You must account for those factors when configuring subsecond PIM timers. We recommend that you set the PIM query interval to a minimum of 2 seconds. By adjusting the available parameters, you can achieve flawless operation; that is, a top number of multicast routes per given convergence time on a specific setup.
- With Cisco IOS Release XE 3.2.1SG, memory configuration is enabled:
This configuration had been removed erroneously in a prior release.
- The Catalyst 4510R switch does not support Supervisor Engines 6L-E. Installing an unsupported supervisor engine causes unpredictable hardware behavior that cannot be controlled by the software. Using an unsupported supervisor engine in a redundant slot might cause a supported supervisor engine in the other slot to malfunction.
- The MAC address table is cleared while you switch between supervisor engines if either the 802.1s or 802.1w Spanning Tree Protocol is configured. To minimize address clearing and subsequent packet flooding, configure the edge ports as spanning-tree portfast and the link type as spanning-tree link-type point-to-point.
- IP classful routing is not supported; do not use the no ip classless command; it will have no effect, because only classless routing is supported. The command ip classless is not supported because classless routing is enabled by default.
- A Layer 2 LACP channel cannot be configured with the spanning tree PortFast feature.
- Netbooting using a boot loader image is not supported. See the “Troubleshooting” section for alternatives.
- When you deploy redundant supervisors in a Catalyst 4507R, for hardware that does not exist while the startup configuration file is being parsed, the configuration file for the hardware is not applied.
For example, if the active supervisor engine is in slot 1, and you have configured interface Gi1/1, the supervisor engine in slot 2 becomes active if you remove the active supervisor engine from the chassis. In addition, while the startup configuration file is being parsed, you will receive an error message indicating that interface Gi1/1 is no longer present. This behavior is correct. When the formerly active supervisor engine is reinserted into slot 1, there is no configuration for interface Gi1/1.
This situation will not occur when both supervisor engines are physically in the chassis.
Workaround: Copy the startup configuration file into the running configuration:
- An unsupported default CLI for mobile IP is displayed in the HSRP configuration. Although this CLI will not harm your system, you might want to remove it to avoid confusion.
Workaround: Display the configuration with the show standby command, then remove the CLI. Here is an example of show standby GigabitEthernet1/1 command output:
- For HSRP preempt delay to function consistently, you must use the standby delay minimum command. Be sure to set the delay to more than 1 hello interval, thereby ensuring that a hello is received before HSRP leaves the initiate state.
Use the standby delay reload option if the router is rebooting after reloading the image.
- When you attempt to run OSPF between a Cisco router and a third party router, the two interfaces might get stuck in the Exstart/Exchange state. This problem occurs when the maximum transmission unit (MTU) settings for neighboring router interfaces do not match. If the router with the higher MTU sends a packet larger than the MTU set on the neighboring router, the neighboring router ignores the packet.
Workaround: Ensure that the MTUs match.
- You can run only.1q-in-.1q packet pass-through with Supervisor Engine 6-E.
- For PVST and Catalyst 4500 E-Series switch VLAN, Cisco IOS Release 12.1(13)EW support a maximum of 3000 spanning tree port instances. If you want to use more instances, use MST rather than PVST.
- Because the Supervisor Engine 6-E supports the FAT filesystem, the following restrictions apply:
– The verify and squeeze commands are not supported.
– The rename command is supported in FAT file system.
For Supervisor Engine 6-E, the rename command is available for bootflash and slot0. For all other supervisor engines, the rename command is supported for nvram devices only.
– The fsck command is supported for slot0 device. It is not supported in the file systems on supervisor engines other than 6-E.
– In the FAT file system, the IOS format bootflash: command erases user files only. It does not erase system configuration.
– The FAT file system supports a maximum of 63 characters for file/directory name. The maximum for path length is 127 characters.
– The FAT file system does not support the following characters in file/directory names:{}#%^ and space characters.
– The FAT file system honors the Microsoft Windows file attribute of read-only and read-write, but it does not support the Windows file hidden attribute.
– Supervisor Engine 6-E uses the FAT file system for compact flash (slot0). If a compact flash is not formatted in FAT file system (such as compact flash on a supervisor engine other than 6-E), the switch does not recognize it.
- If an original packet is dropped because of transmit queue shaping or sharing configurations, a SPAN packet copy can still be transmitted on the SPAN port.
- All software releases support a maximum of 16,000 IGMP snooping group entries.
- To maximize performance, use the no ip unreachables command on all interfaces that are configured for ACLs.
- The threshold for the Dynamic Arp Inspection err-disable function is set to 15 ARP packets per second per interface. You should adjust this threshold depending on the network configuration. The CPU should not receive DHCP packets at a sustained rate greater than 1000 pps.
- If you first configure an IP address or IPv6 address on a Layer 3 port, then change the Layer 3 port to a Layer 2 port with the switchport command, and finally change it back to a Layer 3 port, the original IP/IPv6 address is lost.
- In a redundant system, do not remove and reinsert the standby supervisor engine while the active supervisor engine is booting. Doing so may cause the online diagnostics test to fail.
Workaround: Remove and reinsert the standby supervisor engine after the active supervisor engine boots. (CSCsa66509)
- The switchport private-vlan mapping trunk command supports a maximum of 500 unique private VLAN pairs. For example, 500 secondary VLANs could map to one primary VLAN, or 500 secondary VLANs could map to 500 primary VLANs.
- Support for PoE depends on the use of the following line cards and power supplies.
- If a Catalyst 4500 series switch requests information from the Cisco Secure Access Control Server (ACS) and the message exchange times out because the server does not respond, a message similar to this appears:
If this message appears, ensure network connectivity exists between the switch and the ACS. Also check that the switch has been properly configured as an AAA client on the ACS.
– As IPSG learns the static hosts on each interface, the switch CPU may achieve 100 percent if there are a large number of hosts to learn. The CPU usage will drop after the hosts are learned.
– IPSG violations for static hosts are printed as they occur. If multiple violations occur simultaneously on different interfaces, the CLI displays the last violation. For example, if IPSG is configured for 10 ports and violations exist on ports 3,6, and 9, the violation messages are printed only for port 9.
– Inactive host bindings will appear in the device tracking table when either a VLAN is associated with another port or a port is removed from a VLAN. So, as hosts are moved across subnets, the hosts appear in the device tracking table as inactive.
– Autostate SVI does not work on EtherChannel.
In such a scenario, the IPv6 MTU value programmed in hardware differs from the IPv6 interface MTU value. This occurs if no room exists in the hardware MTU table to store additional values.
To create room, unconfigure some unused MTU values. Then, either disable or re-enable IPv6 on the interface, or reapply the MTU configuration.
- To stop IPSG with static hosts on an interface, use the following commands in interface configuration submode:
To enable IPSG with static hosts on a port, enter the following commands:
If you configure the ip verify source tracking [port-security] interface configuration command on a port without enabling IP device tracking globally or setting an IP device tracking maximum on that interface, IPSG with static hosts reject all the IP traffic from that interface.
Note The preceding condition also applies to IPSG with static hosts on a PVLAN host port.
- uRPF supports up to four paths. If a packet arrives at one of the valid VLANs that is not programmed as one of the RPF VLAN in hardware, it is dropped. If traffic may arrive from any other interfaces without RPF configured, it can be switched.
- Input and output ACLs cannot override or filter traffic received on an uRPF interface.
- No CLI command exists to reflect uRPF drop packets during hardware switching. The sh ip traffic and show cef int commands do not reflect uRPF drops.
- IPv6 ACL is not supported on a switchport. IPv6 packets cannot be filtered on switchports using any of the known methods: PACL, VACL, or MACLs.
- Class-map match statements using match ip prec | dscp match only IPv4 packets, whereas matches performed with match prec | dscp match both IPv4 and IPv6 packets.
- IPv6 QoS hardware switching is disabled if the policy-map contains IPv6 ACL and match CoS in the same class-map with the IPv6 access-list has any mask within the range /81 and /127. This situation causes forwarding packets to software, which efficiently disables the QoS.
- When the following data-only Catalyst 4500 linecards are used in a Catalyst 4507R-E or 4510R-E chassis with Supervisor Engine 6-Es, the capacity of the power supply may be exceeded:
– WS-X4148-FX-MT Cisco Catalyst 4500 Fast Ethernet Switching Module, 48-port 100BASE-FX (MT-RJ)
– WS-X4448-GB-RJ45 Cisco Catalyst 4500 48-port 10/100/1000 Module (RJ-45)
The Catalyst 4503-E and Catalyst 4506-E have no caveats. The Catalyst 4507R-E configurations that use power supplies rated at 1400 W or above also have no caveats.
The following replacement switching modules will not exceed the power supply capacity for any Catalyst 4500-E chassis:
Refer to the Catalyst 4500 Series Module Installation Guide to determine the power requirements for all of the Catalyst 4500 linecards and the power capacities of the Catalyst 4500 power supplies.
- Supervisor Engine 6-E only supports Catalyst 4500 Series linecards in slots 8-10.
- If you remove a line card from a redundant switch and initiate an SSO switch-over, then reinsert the line card, all interfaces are shutdown. The remaining configuration on the original line card is preserved.
This situation only occurs if a switch reached SSO before you removed the line card.
- On Supervisor Engine 6-E, upstream ports support flow control auto negotiation in 1G mode only, and flow control is forced in 10G mode. If the interface is configured to auto-negotiate the flow control, and the interface is operating in 10G mode, the system forces flow control to ON and does not auto-negotiate.
- Supervisor Engine 6-E supports fast UDLD on a maximum of 32 ports.
- With Cisco IOS Release 12.2(53)SG3 (and 12.2(54)SG), we changed the default behavior such that your single supervisor, RPR, or fixed configuration switch does not reload automatically. To configure automatic reload, you must enter the diagnostic fpga soft-error recover aggressive command. (CSCth16953)
- Energywise WOL is not “waking up” a PC in hibernate or standby mode.
Workaround: Use the show version command. CSCtr30294
Workaround: Select an alternate destination or source port. CSCty05405
– 48 10/100/1000BaseT Premium POE E Series WS-X4648-RJ45V+E (JAE14310RHU)
– 6 Sup 6-E 10GE (X2), 1000BaseX (SFP) WS-X45-SUP6-E (JAE13104VVY)
the following restrictions apply:
– Sub-interrfaces are not supported on 1 Gigabit and Ten-Gigabit interfaces.
– Port-channel members do not support multiple classification criteria for a QoS policy.
– CEF is disabled automatically when uRFP is enabled and TCAM is fully utilized.
- While configuring an IPv6 access-list, if you specify "hardware statistics" as the first statement in v6 access-list mode (i.e. before issuing any other v6 ACE statement), it will not take effect. Similarly, your "hardware statistics" configuration will be missing from the output of the show running command.
Workaround: During IPv6 access-list configuration, configure at least one IPv6 ACE before the "hardware statistics" statement. CSCuc53234
- For any configuration where the source-interface keyword is used, if you provide an SVI that is associated with a secondary private VLAN, configuration involving the secondary VLAN may be lost when the switch is reloaded. In such scenarios, always use the primary private VLAN.
- When performing an ISSU between any releases prior to Cisco IOS 15.1(1)SG or 3.3.0SG to release Cisco IOS 15.1(1)SG (or 3.3.0SG) or higher, a switch performing multicast routing may persistently drop traffic after the upgrade completes. You can recover multicast traffic by reloading the chassis. Alternately, you can remove all multicast configuration prior to ISSU, and add it back when ISSU completes. CSCuj42672
Caveats
Caveats describe unexpected behavior in Cisco IOS releases. Caveats listed as open in a prior release are carried forward to the next release as either open or resolved.
Note All caveats in Release 12.4 also apply to the corresponding 12.1 E releases. Refer to the Caveats for Cisco IOS Release 12.4 publication at the following URL:
http://www.cisco.com/en/US/docs/ios/12_4/release/notes/124MCAVS.html
Note For the latest information on PSIRTS, refer to the Security Advisories on CCO at the following URL:
http://tools.cisco.com/security/center/publicationListing
Open Caveats for Cisco IOS Release 15.1(1)SG2
This section lists the open caveats for Cisco IOS Release 15.1(1)SG2:
- When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing key pair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. CSCsb11964
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
qos account layer2 encapsulation command.
- When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.
This does not affect performance.
Workaround: Enter the no shutdown command. CSCsg27395
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693)
- When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
Workaround: None. This is an informational message. CSCsi60898
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
- In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. CSCsr00333
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, you will not see the VLAN updates on the other switches in the VTP domain.
Workaround: Configure an ISL/dot1q trunk port. CSCsu43445
- When you remove a line card containing ports configured with IGMP snooping while booting a standby supervisor engine, the active supervisor engine does not synchronize this configuration to the standby supervisor engine as a part of a bulk synchronization. When you reinstall the line card, the configuration in the active and standby supervisor engines will differ.
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change. CSCsv44866
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.
The queue transmit counters as well as the policing statistics (if any) are correct. CSCsz20149
- On a wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
- When you run Cisco IOS Release 12.2(53)SG1, 12.2(50)SG6, or later releases and configure switchport block multicast on a switch, Layer 2 multicast is not blocked. IPv4 and IPV6 unknown multicast traffic is blocked.
Prior to Cisco IOS Release 12.2(53)SG1 and 12.2(50)SG6, the switchport block multicast command blocks IP Multicast, Layer 2 multicast, and broadcast traffic. CSCta61825
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for a Catalyst 4900M switch, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
- On a peer interface on a Catalyst 4948E Ethernet Switch, if errdisabled mode flap detection is set to a very small number (such as 2 flaps in 10 sec), a 10GE link flap may cause the peer interface to enter the errdisabled state.
Workarounds: The Cisco switch default link-flap detection value is 5 flaps in 10 seconds. Use the default value or larger numbers. CSCtg07677
- After you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command. CSCsx42157
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with hardware control plane policing.
- When either the RADIUS-server test feature is enabled or RADIUS-server dead-criteria is configured, and either RADIUS-server deadtime is set to 0 or not configured, the RADIUS-server status is not properly relayed to AAA.
Workaround: Configure both dead-criteria and deadtime.
- When you configure open authentication and perform SSO, the spanning tree state and MAC address are not synchronized to the new standby supervisor engine. This behavior interrupts traffic only after the second switchover because the new standby supervisor engine possesses the wrong state after the initial switchover and the second switchover starts the port in the blocking state.
Workaround: Enter shut and no shut on the port to synchronize the STP state. CSCtf52437
- A device in a Guest VLAN that is connected behind a phone capable of 2nd-port-TLV, experiences packet loss following a SSO failover. The device experiences an authentication restart after the first CDP frame arrives from the phone.
- If you reboot a switch, the configured value of the interface MTU size for the elements of the port channel interface does not work for IPv6 traffic.
Workaround: After the switch reloads, enter shut and no shut on the port-channel interface.
- When you have two Layer 3 CE-facing interfaces, each connected to a CE to split WCCP between the CEs, and you move a WCCP service (such as 60 (ftp-native)) from one interface to the other, the target interface fails to completely transfer the service from the old to the new CE.
Workaround: Shut down the CE-facing interface. After all of the mask-value entries point to the target CE, unshut the CE-facing interface. CSCtl09941
- Dynamic ACLs do not function correctly if they include advanced operators, including dscp/ipp/tos, log/log-input, fragments and/or tcp flag operators.
Workaround: Remove these operators from any dynamic ACLs. CSCts05302
- Occasionally, if you use an X2 SR transceiver on a WS-X4706-10GE running
Cisco IOS Release 12.2(40)SG, you observe CRC errors after a reload or power cycle upon inserting the card or X2.
Workaround: Reinsert the X2. CSCsk43618
- If burst is not explicitly configured for a single rate policer, the show policy-map command displays an incorrect burst value.
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. CSCsi71036
- When you enter the show policy-map vlan vlan command, unconditional marking actions that are configured on the VLAN are not shown.
If you enter the show policy-map name, however, the unconditional marking actions appear. CSCsi94144
- Uplinks go down when you upgrade the ROMMON of an WS-X45-SUP6-E supervisor from version 0.34 to a later version.
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. CSCsm81875
This problem can happen when pause frames are sent to a switch port and the flow control receive configuration is toggled on a 10-Gigabit Ethernet port.
Workaround: Change the flow control receive configuration when no traffic exists. CSCso71647
- If an EtherChannel is a member of a FlexLink pair, then static MAC addresses configured on the EtherChannel are not moved to the alternate port when the EtherChannel fails (FlexLink failure).
- When a CFM Inward Facing MEP (IFM) is configured on a VLAN that is not allocated on a switch port that is DOWN, the show ethernet cfm maintenance-points local command displays the
IFM CC Status as inactive. When you allocate the VLAN, the CC-status remains inactive.
You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then later allocate the same VLAN.
Workaround: Unconfigure, and then reconfigure the IFM on the port.
- When you configure vlan dot1q tag native globally on Supervisor Engine 6-E, MST control packets are tagged on egress on the native VLAN. This conflicts with 802.1s. The Cisco 7600 Series router drops its MST proposal agreements (because it expects the native VLAN MST control packets to be untagged), causing 30 seconds of traffic loss while spanning tree converges.
Workaround: Disable native VLAN tagging on the trunk port of the switch by entering the
no switchport trunk native vlan tag command. CSCsz12611
- Before large PACLs are fully loaded in hardware, you might observe a false completion messages like the following:
Workaround: No functional impact.
You must wait for the ACLs to be programmed before performing other TCAM related changes. CSCtd57063
- If a large number of VLAN mappings are configured, a member port might fail to join a port channel and no warming is issued.
Workaround: Reduce the number of VLAN mappings. CSCtn56208
- WCCP service is not reacquired when a service group with a multicast group address is unconfigured, and then reconfigured.
Workaround: Configure IP multicast routing globally and establish IP PIM sparse dense mode on the CE-facing interface. CSCtl97692
- If an interface whose IP address is being used as the router ID is deleted or shuts down, and you configure a service group with a multicast group address, packet redirection to CE stops and packets are forwarded directly to the destination.
Workaround: Unconfigure and reconfigure the service group. CSCtn88087
- Global WCCP service configuration fails to enable (WCCP global configuration is accepted but nvgen fails) on a newly deployed switch if the switch is not enabled for SVI or a Layer 3 interface.
Workaround: Enable a Layer 3 interface in the running configuration. CSCsc88636.
– Links flap for various Layer 3 protocols.
– A traffic loss of several seconds is observed during the upgrade process.
Workaround: Do not use the quick option with the issu changeversion command. CSCto51562
- A peer policy is not updated after reauthentication if the policy is changed on the AS beforehand. After reauthentication, the original peer policy is retained.
Workaround: Enter shut and no shut on the port. CSCts29515
- When you enable both Cisco TrustSec and RADIUS accounting, a disparity occurs between the RADIUS client (Cisco switch) and the RADIUS/CTS server in how the authenticator field in the header is computed for DOT1X/RADIUS accounting messages.
A Cisco IOS AAA client uses the PAC secret to compute the authenticator; Cisco Secure ACS 5.2 uses the shared secret. This behavior causes a mismatch that results in a rejection of the accounting message, and the client marks the server as unresponsive.
Workaround: None. You must disable 802.1X accounting. CSCts26844
- When more than one Equal Cost Multipath (ECMP) is available on the downstream switch, and Mediatrace is invoked to provide flow statistics, the dynamic policy does not show statistics for a flow.
Mediatrace cannot find the correct inbound interface and applies the dynamic policy on a different interface from the one used for media flow.
- When a switchover is created on the Mediatrace responder, the dynamic access list created for a monitored flow tuple is not deleted. Although the Mediatrace initiator creates another set of dynamic access lists after the switchover, the old ones remain in the configuration.
The impact of stale dynamic access lists is to monitor unwanted traffic.
– If the switchover is scheduled, remove the scheduled session on the initiator. Reschedule the session after the new active supervisor engine boots on the responder.
– If the Mediatrace responder SSO is not planned, after the new active supervisor engine boots, manually delete the stale dynamic access lists. CSCty75070
- Configuring an interface as unidirectional with the unidirectional send-only | receive-only command still allows the interface to send (configured as Send-only Unidirection Ethernet mode) or receive (configured as Receive-only Unidirection Ethernet mode) packets in a bidirectional mode.
- When you add a "bfd" suffix to the snmp server host x.x.x.x configuration command, the BFD traps, ciscoBfdSessUp and ciscoBfdSessDown, are not generated.
Workaround: Do not specify a "bfd" suffix with the snmp-server host x.x.x.x configuration command. CSCtx51561
- When you transfer a startup-config to the switch directly without entering write mem, and the startup-config contains the hw-module uplink shared-backplane command, the four ports on a Supervisor Engine 6-E are not activated in subsequent reloads. The second port of each supervisor engine remains inactive.
Workaround: Configure hw-module uplink shared-backplane from the console or vty, and enter write mem. CSCtx43568
- During either a system- or user-initiated reload operation, the following message is observed when the system shuts down:
This message is not observed during a system bootup.
Workaround: None required. This message is information only. CSCtz15738
- With IGMP snooping enabled, multicast traffic received through a tunnel interface is not forwarded out the Outgoing Interface List.
Workaround: Disable IGMP snooping. CSCuc65538
- When a port connected to a CDP speaker goes down, a small memory leak occurs (typically less than 300 bytes).
Workaround: Disable CDP on interfaces that may flap frequently. CSCub85948
Resolved Caveats in Cisco IOS Release 15.1(1)SG2
This section lists the resolved caveats in Cisco Release 15.1(1)SG2:
- After booting a switch with Cisco IOS XE 3.3.0SG or 3.3.1SG with a crypto (k9) image, a linecard may display a status of Auth Fail, and will not be brought online. Non-crypto images are unaffected.
Workaround: Reset the linecard either with the hw-module module m reset command or through a manual OIR. CSCuc64146
- Following an upgrade to Cisco IOS XE 3.3.1SG, a switch with a power supply of type PWR-C45-4200ACV may display one of the following messages:
The power supply or power supply inputs are incorrectly listed as 110V when they should be list as 220V. The power supply may go into an err-disable state if only one power supply has the issue. If both power supplies have the issue and are both recognized as 110V, they will not go into an err-disable state. Additionally, other modules in the switch might be denied power and will not power on.
Workaround: Remove the power supply inputs, remove or reinsert the power supply, then restore the power supply inputs. CSCuc07562
Open Caveats for Cisco IOS Release 15.1(1)SG1
This section lists the open caveats for Cisco IOS Release 15.1(1)SG1:
- When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing key pair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. CSCsb11964
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
qos account layer2 encapsulation command.
- When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.
This does not affect performance.
Workaround: Enter the no shutdown command. CSCsg27395
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693)
- When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
Workaround: None. This is an informational message. CSCsi60898
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
- In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. CSCsr00333
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, you will not see the VLAN updates on the other switches in the VTP domain.
Workaround: Configure an ISL/dot1q trunk port. CSCsu43445
- When you remove a line card containing ports configured with IGMP snooping while booting a standby supervisor engine, the active supervisor engine does not synchronize this configuration to the standby supervisor engine as a part of a bulk synchronization. When you reinstall the line card, the configuration in the active and standby supervisor engines will differ.
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change. CSCsv44866
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.
The queue transmit counters as well as the policing statistics (if any) are correct. CSCsz20149
- On a wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
- When you run Cisco IOS Release 12.2(53)SG1, 12.2(50)SG6, or later releases and configure switchport block multicast on a switch, Layer 2 multicast is not blocked. IPv4 and IPV6 unknown multicast traffic is blocked.
Prior to Cisco IOS Release 12.2(53)SG1 and 12.2(50)SG6, the switchport block multicast command blocks IP Multicast, Layer 2 multicast, and broadcast traffic. CSCta61825
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for a Catalyst 4900M switch, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
- On a peer interface on a Catalyst 4948E Ethernet Switch, if errdisabled mode flap detection is set to a very small number (such as 2 flaps in 10 sec), a 10GE link flap may cause the peer interface to enter the errdisabled state.
Workarounds: The Cisco switch default link-flap detection value is 5 flaps in 10 seconds. Use the default value or larger numbers. CSCtg07677
- After you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command. CSCsx42157
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with hardware control plane policing.
- When either the RADIUS-server test feature is enabled or RADIUS-server dead-criteria is configured, and either RADIUS-server deadtime is set to 0 or not configured, the RADIUS-server status is not properly relayed to AAA.
Workaround: Configure both dead-criteria and deadtime.
- When you configure open authentication and perform SSO, the spanning tree state and MAC address are not synchronized to the new standby supervisor engine. This behavior interrupts traffic only after the second switchover because the new standby supervisor engine possesses the wrong state after the initial switchover and the second switchover starts the port in the blocking state.
Workaround: Enter shut and no shut on the port to synchronize the STP state. CSCtf52437
- A device in a Guest VLAN that is connected behind a phone capable of 2nd-port-TLV, experiences packet loss following a SSO failover. The device experiences an authentication restart after the first CDP frame arrives from the phone.
- If you reboot a switch, the configured value of the interface MTU size for the elements of the port channel interface does not work for IPv6 traffic.
Workaround: After the switch reloads, enter shut and no shut on the port-channel interface.
- When you have two Layer 3 CE-facing interfaces, each connected to a CE to split WCCP between the CEs, and you move a WCCP service (such as 60 (ftp-native)) from one interface to the other, the target interface fails to completely transfer the service from the old to the new CE.
Workaround: Shut down the CE-facing interface. After all of the mask-value entries point to the target CE, unshut the CE-facing interface. CSCtl09941
- Dynamic ACLs do not function correctly if they include advanced operators, including dscp/ipp/tos, log/log-input, fragments and/or tcp flag operators.
Workaround: Remove these operators from any dynamic ACLs. CSCts05302
- Occasionally, if you use an X2 SR transceiver on a WS-X4706-10GE running
Cisco IOS Release 12.2(40)SG, you observe CRC errors after a reload or power cycle upon inserting the card or X2.
Workaround: Reinsert the X2. CSCsk43618
- If burst is not explicitly configured for a single rate policer, the show policy-map command displays an incorrect burst value.
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. CSCsi71036
- When you enter the show policy-map vlan vlan command, unconditional marking actions that are configured on the VLAN are not shown.
If you enter the show policy-map name, however, the unconditional marking actions appear. CSCsi94144
- Uplinks go down when you upgrade the ROMMON of an WS-X45-SUP6-E supervisor from version 0.34 to a later version.
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. CSCsm81875
This problem can happen when pause frames are sent to a switch port and the flow control receive configuration is toggled on a 10-Gigabit Ethernet port.
Workaround: Change the flow control receive configuration when no traffic exists. CSCso71647
- If an EtherChannel is a member of a FlexLink pair, then static MAC addresses configured on the EtherChannel are not moved to the alternate port when the EtherChannel fails (FlexLink failure).
- When a CFM Inward Facing MEP (IFM) is configured on a VLAN that is not allocated on a switch port that is DOWN, the show ethernet cfm maintenance-points local command displays the
IFM CC Status as inactive. When you allocate the VLAN, the CC-status remains inactive.
You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then later allocate the same VLAN.
Workaround: Unconfigure, and then reconfigure the IFM on the port.
- When you configure vlan dot1q tag native globally on Supervisor Engine 6-E, MST control packets are tagged on egress on the native VLAN. This conflicts with 802.1s. The Cisco 7600 Series router drops its MST proposal agreements (because it expects the native VLAN MST control packets to be untagged), causing 30 seconds of traffic loss while spanning tree converges.
Workaround: Disable native VLAN tagging on the trunk port of the switch by entering the
no switchport trunk native vlan tag command. CSCsz12611
- Before large PACLs are fully loaded in hardware, you might observe a false completion messages like the following:
Workaround: No functional impact.
You must wait for the ACLs to be programmed before performing other TCAM related changes. CSCtd57063
- If a large number of VLAN mappings are configured, a member port might fail to join a port channel and no warming is issued.
Workaround: Reduce the number of VLAN mappings. CSCtn56208
- WCCP service is not reacquired when a service group with a multicast group address is unconfigured, and then reconfigured.
Workaround: Configure IP multicast routing globally and establish IP PIM sparse dense mode on the CE-facing interface. CSCtl97692
- If an interface whose IP address is being used as the router ID is deleted or shuts down, and you configure a service group with a multicast group address, packet redirection to CE stops and packets are forwarded directly to the destination.
Workaround: Unconfigure and reconfigure the service group. CSCtn88087
- Global WCCP service configuration fails to enable (WCCP global configuration is accepted but nvgen fails) on a newly deployed switch if the switch is not enabled for SVI or a Layer 3 interface.
Workaround: Enable a Layer 3 interface in the running configuration. CSCsc88636.
– Links flap for various Layer 3 protocols.
– A traffic loss of several seconds is observed during the upgrade process.
Workaround: Do not use the quick option with the issu changeversion command. CSCto51562
- A peer policy is not updated after reauthentication if the policy is changed on the AS beforehand. After reauthentication, the original peer policy is retained.
Workaround: Enter shut and no shut on the port. CSCts29515
- When you enable both Cisco TrustSec and RADIUS accounting, a disparity occurs between the RADIUS client (Cisco switch) and the RADIUS/CTS server in how the authenticator field in the header is computed for DOT1X/RADIUS accounting messages.
A Cisco IOS AAA client uses the PAC secret to compute the authenticator; Cisco Secure ACS 5.2 uses the shared secret. This behavior causes a mismatch that results in a rejection of the accounting message, and the client marks the server as unresponsive.
Workaround: None. You must disable 802.1X accounting. CSCts26844
- When more than one Equal Cost Multipath (ECMP) is available on the downstream switch, and Mediatrace is invoked to provide flow statistics, the dynamic policy does not show statistics for a flow.
Mediatrace cannot find the correct inbound interface and applies the dynamic policy on a different interface from the one used for media flow.
- When a switchover is created on the Mediatrace responder, the dynamic access list created for a monitored flow tuple is not deleted. Although the Mediatrace initiator creates another set of dynamic access lists after the switchover, the old ones remain in the configuration.
The impact of stale dynamic access lists is to monitor unwanted traffic.
– If the switchover is scheduled, remove the scheduled session on the initiator. Reschedule the session after the new active supervisor engine boots on the responder.
– If the Mediatrace responder SSO is not planned, after the new active supervisor engine boots, manually delete the stale dynamic access lists. CSCty75070
- Configuring an interface as unidirectional with the unidirectional send-only | receive-only command still allows the interface to send (configured as Send-only Unidirection Ethernet mode) or receive (configured as Receive-only Unidirection Ethernet mode) packets in a bidirectional mode.
- When you add a "bfd" suffix to the snmp server host x.x.x.x configuration command, the BFD traps, ciscoBfdSessUp and ciscoBfdSessDown, are not generated.
Workaround: Do not specify a "bfd" suffix with the snmp-server host x.x.x.x configuration command. CSCtx51561
- When you transfer a startup-config to the switch directly without entering write mem, and the startup-config contains the hw-module uplink shared-backplane command, the four ports on a Supervisor Engine 6-E are not activated in subsequent reloads. The second port of each supervisor engine remains inactive.
Workaround: Configure hw-module uplink shared-backplane from the console or vty, and enter write mem. CSCtx43568
- During either a system- or user-initiated reload operation, the following message is observed when the system shuts down:
This message is not observed during a system bootup.
Workaround: None required. This message is information only. CSCtz15738
- After booting a switch with Cisco IOS XE 3.3.0SG or 3.3.1SG with a crypto (k9) image, a linecard may display a status of Auth Fail, and will not be brought online. Non-crypto images are unaffected.
Workaround: Reset the linecard either with the hw-module module m reset command or through a manual OIR. CSCuc64146
- Following an upgrade to Cisco IOS XE 3.3.1SG, a switch with a power supply of type PWR-C45-4200ACV may display one of the following messages:
The power supply or power supply inputs are incorrectly listed as 110V when they should be list as 220V. The power supply may go into an err-disable state if only one power supply has the issue. If both power supplies have the issue and are both recognized as 110V, they will not go into an err-disable state. Additionally, other modules in the switch might be denied power and will not power on.
Workaround: Remove the power supply inputs, remove or reinsert the power supply, then restore the power supply inputs. CSCuc07562
However, you can perform an upgrade from Cisco IOS 15.0(2)SG5 to 15.1(1)SG2 or from Cisco IOS 15.0(2)SG5 to 15.1(2)SG.
– Use RPR for Cisco IOS 15.0(2)SG5 or 15.1(1)SG1 combinations (upgrade or downgrade).
– Downgrade from Cisco IOS 15.1(1)SG1; using 15.0(2)SG4 or an earlier release.
– Upgrade from Cisco IOS 15.0(2)SG5; use 15.1(1)SG2 instead.
- With IGMP snooping enabled, multicast traffic received through a tunnel interface is not forwarded out the Outgoing Interface List.
Workaround: Disable IGMP snooping. CSCuc65538
- When a port connected to a CDP speaker goes down, a small memory leak occurs (typically less than 300 bytes).
Workaround: Disable CDP on interfaces that may flap frequently. CSCub85948
Resolved Caveats in Cisco IOS Release 15.1(1)SG1
This section lists the resolved caveats in Cisco Release 15.1(1)SG1:
- If a switch enabled with Bidir PIM has a software tunnel interface pointing towards the RP upstream, packet drops are observed.
Workaround: None. Consider using a physical interface pointing towards RP upstream.
- If a configuration contains an "ip vrf" or "vrf definition" section, and you type “wr mem” while using an IP Base or LAN Base boot level of IOS-XE, the following message appears.
Workaround: None. The message is information only. CSCtw93140
- After logging “Authorization succeeded for client (Unknown MAC)”, a switch crashes if the following conditions apply:
– A switchport is configured with both of the following:
authentication event server dead action authorize...
authentication event server alive action reinitalize
– The RADIUS server was down previously, and a port without traffic (for example: a hub with no devices attached) was authorized into the inaccessible authentication bypass (IAB) VLAN without an associated MAC address.
– The RADIUS server becomes available again, and a dot1x client attempts to authenticate.
- Traffic is dropped on a particular tx-queue of an EtherChannel member interfacere configured with a queuing policy. However, it will still appear in an egress span session of the EtherChannel.
The show platform software interface tx-queue command will display an incorrect number of configured queues (compare to EtherChannel members that are not dropping traffic).
Workaround: Enter shut then no shut on the port. CSCua66962
- If either the active or standby supervisor engine is running Cisco IOS 15.1(1)SG, the standby supervisor engine does achieve a standby-cold or standby-hot state; it continues to reload.
Workaround: Downgrade or upgrade the supervisor engine by either temporarily removing the other supervisor engine or relocating the supervisor engine to another chassis. CSCtz44577
- On a switch running Cisco 15.0(2)SG4 or 15.1(1)SG with 4648* or 4748* linecards with PoE, a single port on a linecard fails to link up, usually after flapping its link frequently.
Workaround: Enter shut then no shut on the port. CSCtz94862
- On a switch running Cisco 15.0(2)SG4 or 15.1(1)SG on 4648* or 4748* linecards with PoE, the PoE device will not power up on a single port, but will work on other ports on the same linecard.
– Connect a non-PoE device to the port
– Enter shut then no shut on the port. CSCua63562
- The Catalyst 4500E series switch with Supervisor Engine 7L-E contains a denial of service (DoS) vulnerability when processing specially crafted packets that can cause a reload of the device.
Cisco has released free software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are not available.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-ecc
- Cisco IOS Software contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. An attacker could exploit this vulnerability by sending a single DHCP packet to or through an affected device, causing the device to reload.
Cisco has released free software updates that address this vulnerability. A workaround that mitigates this vulnerability is available. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-dhcp
Open Caveats for Cisco IOS Release 15.1(1)SG
This section lists the open caveats for Cisco IOS Release 15.1(1)SG:
- When you enter the ip http secure-server command (or if the system reads it from the startup configuration), the device searches for a persistent self-signed certificate during boot up.
– If such a certificate does not exist and the device's hostname and default_domain are set, then a persistent self-signed certificate is generated.
– If such a certificate exists, the FQDN in the certificate is compared with the current device's hostname and default_domain. If either differs from the FQDN in the certificate, the existing persistent self-signed certificate is replaced with a new one with the updated FQDN. Be aware that the existing key pair is used in the new certificate.
On a switch that supports redundancy, the generation of the self-signed certificate occurs independently on the active and the standby supervisor engines, and the certificates differ. After switchover, the HTTP client that holds the old certificate cannot connect to the HTTPS server.
Workaround: Reconnect. CSCsb11964
- When policing IEEE 802.1Q tagged non-IP traffic and calculating traffic conformance, the policer excludes the four bytes that constitute the 802.1Q tag even when you enter the
qos account layer2 encapsulation command.
- When hard-coded duplex and speed settings are deleted after an interface shuts down, an a- is added to the duplex and speed in the output from the show interface status command.
This does not affect performance.
Workaround: Enter the no shutdown command. CSCsg27395
- When a transceiver is removed rapidly from one port and placed in another on the same chassis, occasionally a duplicate seeprom message appears and the port is not able to handle traffic.
Workaround: Remove the transceiver from the new port and place it in the old port. After the SFP is recognized in the old port, remove it slowly and insert it in the new port. (CSCse34693)
- When performing an ISSU upgrade and the versions of the active and standby supervisor engines differ, you see the following message in the standby supervisor engine console:
Workaround: None. This is an informational message. CSCsi60898
Workarounds: Do one of the following:
– After a reload, copy the startup-config to the running-config.
– Use a loopback interface as the target of the ip unnumbered command.
– Change the CLI configuration so that during bootup the router port is created first.
- In SSO mode, when a port channel is created, deleted, and recreated on an active supervisor engine with the same channel number, the standby port channel state goes out of sync. After a switch over, the following message displays:
Workaround: When the port channel starts to flap, enter shut and no shut on the port channel. After the first switchover and after deleting the port channel, create a new channel. CSCsr00333
- VTP databases do not propagate through promiscuous trunk ports. If only promiscuous trunks are configured, you will not see the VLAN updates on the other switches in the VTP domain.
Workaround: Configure an ISL/dot1q trunk port. CSCsu43445
- When you remove a line card containing ports configured with IGMP snooping while booting a standby supervisor engine, the active supervisor engine does not synchronize this configuration to the standby supervisor engine as a part of a bulk synchronization. When you reinstall the line card, the configuration in the active and standby supervisor engines will differ.
Workaround: Do one of the following:
– Reload the standby switch again with the line card in place.
– Remove and reenter the commands on the active supervisor engine. The standby supervisor engine will acquire this change. CSCsv44866
- After posture validation succeeds, the following benign traceback messages may appear after you unconfigure the global RADIUS and IP device tracking commands:
This applies to classic or E-series Catalyst 4500 supervisor engines running
Cisco IOS Release 12.2(50)SG
- The host's MAC address is not synchronized to the standby supervisor engine after you unconfigure 802.1X on the port and reconnect the host to a IP phone (with CDP port status TLV support) that is connected to the switch.
If the switch were to run a supervisor switchover while in this state, the host's MAC address would not be present in the new active supervisor engine’s MAC address table, causing possible connectivity interruption on the host.
Workaround: Enter the shutdown command, followed by the no shutdown command on the interface. This triggers relearning and synchronizing of the host's MAC to the standby supervisor engine. CSCsw91661
- If you simultaneously apply a service-policy to a port in the output direction and a service-policy to a vlan-range under that port in the output direction, the class-map hit counters in the output of the
show policy-map interface command are wrong.
The queue transmit counters as well as the policing statistics (if any) are correct. CSCsz20149
- On a wireless control system (WCS), some device information is incorrectly displayed for PCs sitting behind an lldp-med capable phone. Specifically, WCS displays the phone's serial number, model number, and software version in the PC's device information. All other information about the PC is correctly displayed on WCS.
This only happens when the switch is running network mobility service protocol (nmsp). It does not happen if the phone is CDP enabled.
Workaround: Use the VLAN ID or name to differentiate the IP phone and the PC sitting behind the phone on the WCS.
The IP phone is detected on the voice VLAN, and the displayed information of serial number, model number, and software version is correct. However, a PC sitting behind the phone is detected on a data VLAN, and the displayed device information is wrong and should be ignored.
- When you run Cisco IOS Release 12.2(53)SG1, 12.2(50)SG6, or later releases and configure switchport block multicast on a switch, Layer 2 multicast is not blocked. IPv4 and IPV6 unknown multicast traffic is blocked.
Prior to Cisco IOS Release 12.2(53)SG1 and 12.2(50)SG6, the switchport block multicast command blocks IP Multicast, Layer 2 multicast, and broadcast traffic. CSCta61825
- If time is not specified in the link debounce command, the default value depends on the supervisor engine. The default is 10 mS for a Catalyst 4900M switch, Supervisor Engine 6-E, and Supervisor Engine 6L-E. The default is 100 mS for all other supervisor engines.
Despite the different default value, you can configure any value in the time range.
- On a peer interface on a Catalyst 4948E Ethernet Switch, if errdisabled mode flap detection is set to a very small number (such as 2 flaps in 10 sec), a 10GE link flap may cause the peer interface to enter the errdisabled state.
Workarounds: The Cisco switch default link-flap detection value is 5 flaps in 10 seconds. Use the default value or larger numbers. CSCtg07677
- After you have enabled EPM logging and the client is authenticated via MAB or Webauth, the value of AUTHTYPE is DOT1X in EPM syslog messages irrespective of the authentication method.
Similarly, the show epm sessions command always displays the authentication method as DOT1X.
Workaround: To view the authentication method used for a client, enter the
show authentication sessions command. CSCsx42157
- With CFM enabled globally as well as on an ingress interface, CFM packets received on the interface are not policed with hardware control plane policing.
- When either the RADIUS-server test feature is enabled or RADIUS-server dead-criteria is configured, and either RADIUS-server deadtime is set to 0 or not configured, the RADIUS-server status is not properly relayed to AAA.
Workaround: Configure both dead-criteria and deadtime.
- When you configure open authentication and perform SSO, the spanning tree state and MAC address are not synchronized to the new standby supervisor engine. This behavior interrupts traffic only after the second switchover because the new standby supervisor engine possesses the wrong state after the initial switchover and the second switchover starts the port in the blocking state.
Workaround: Enter shut and no shut on the port to synchronize the STP state. CSCtf52437
- A device in a Guest VLAN that is connected behind a phone capable of 2nd-port-TLV, experiences packet loss following a SSO failover. The device experiences an authentication restart after the first CDP frame arrives from the phone.
- If you reboot a switch, the configured value of the interface MTU size for the elements of the port channel interface does not work for IPv6 traffic.
Workaround: After the switch reloads, enter shut and no shut on the port-channel interface.
- When you have two Layer 3 CE-facing interfaces, each connected to a CE to split WCCP between the CEs, and you move a WCCP service (such as 60 (ftp-native)) from one interface to the other, the target interface fails to completely transfer the service from the old to the new CE.
Workaround: Shut down the CE-facing interface. After all of the mask-value entries point to the target CE, unshut the CE-facing interface. CSCtl09941
- Dynamic ACLs do not function correctly if they include advanced operators, including dscp/ipp/tos, log/log-input, fragments and/or tcp flag operators.
Workaround: Remove these operators from any dynamic ACLs. CSCts05302
- Occasionally, if you use an X2 SR transceiver on a WS-X4706-10GE running
Cisco IOS Release 12.2(40)SG, you observe CRC errors after a reload or power cycle upon inserting the card or X2.
Workaround: Reinsert the X2. CSCsk43618
- If burst is not explicitly configured for a single rate policer, the show policy-map command displays an incorrect burst value.
Workaround: Enter the show policy-map interface command to find the actual burst value programmed. CSCsi71036
- When you enter the show policy-map vlan vlan command, unconditional marking actions that are configured on the VLAN are not shown.
If you enter the show policy-map name, however, the unconditional marking actions appear. CSCsi94144
- Uplinks go down when you upgrade the ROMMON of an WS-X45-SUP6-E supervisor from version 0.34 to a later version.
This behavior occurs in a redundant switch when the active supervisor engine is running Cisco IOS, the standby supervisor engine is in ROMMON, and the standby supervisor engine’s ROMMON is upgraded from version 0.34 or to a later version. The upgrade process causes the uplinks on the standby supervisor engine to go down but the active supervisor engine is unaware of this.
Workarounds: To resume normal operation, do one of the following:
– Reload both supervisor engines with the redundancy reload shelf command.
– Power-cycle the standby supervisor engine by briefly pulling it from the chassis.
There is no workaround for the link flap issue. CSCsm81875
This problem can happen when pause frames are sent to a switch port and the flow control receive configuration is toggled on a 10-Gigabit Ethernet port.
Workaround: Change the flow control receive configuration when no traffic exists. CSCso71647
- If an EtherChannel is a member of a FlexLink pair, then static MAC addresses configured on the EtherChannel are not moved to the alternate port when the EtherChannel fails (FlexLink failure).
- When a CFM Inward Facing MEP (IFM) is configured on a VLAN that is not allocated on a switch port that is DOWN, the show ethernet cfm maintenance-points local command displays the
IFM CC Status as inactive. When you allocate the VLAN, the CC-status remains inactive.
You only see this behavior if you initially did not allocate a VLAN before you configure the IFM, and then later allocate the same VLAN.
Workaround: Unconfigure, and then reconfigure the IFM on the port.
- When you configure vlan dot1q tag native globally on Supervisor Engine 6-E, MST control packets are tagged on egress on the native VLAN. This conflicts with 802.1s. The Cisco 7600 Series router drops its MST proposal agreements (because it expects the native VLAN MST control packets to be untagged), causing 30 seconds of traffic loss while spanning tree converges.
Workaround: Disable native VLAN tagging on the trunk port of the switch by entering the
no switchport trunk native vlan tag command. CSCsz12611
- Before large PACLs are fully loaded in hardware, you might observe a false completion messages like the following:
Workaround: No functional impact.
You must wait for the ACLs to be programmed before performing other TCAM related changes. CSCtd57063
- If a large number of VLAN mappings are configured, a member port might fail to join a port channel and no warming is issued.
Workaround: Reduce the number of VLAN mappings. CSCtn56208
- WCCP service is not reacquired when a service group with a multicast group address is unconfigured, and then reconfigured.
Workaround: Configure IP multicast routing globally and establish IP PIM sparse dense mode on the CE-facing interface. CSCtl97692
- If an interface whose IP address is being used as the router ID is deleted or shuts down, and you configure a service group with a multicast group address, packet redirection to CE stops and packets are forwarded directly to the destination.
Workaround: Unconfigure and reconfigure the service group. CSCtn88087
- Global WCCP service configuration fails to enable (WCCP global configuration is accepted but nvgen fails) on a newly deployed switch if the switch is not enabled for SVI or a Layer 3 interface.
Workaround: Enable a Layer 3 interface in the running configuration. CSCsc88636.
– Links flap for various Layer 3 protocols.
– A traffic loss of several seconds is observed during the upgrade process.
Workaround: Do not use the quick option with the issu changeversion command. CSCto51562
- A peer policy is not updated after reauthentication if the policy is changed on the AS beforehand. After reauthentication, the original peer policy is retained.
Workaround: Enter shut and no shut on the port. CSCts29515
- When you enable both Cisco TrustSec and RADIUS accounting, a disparity occurs between the RADIUS client (Cisco switch) and the RADIUS/CTS server in how the authenticator field in the header is computed for DOT1X/RADIUS accounting messages.
A Cisco IOS AAA client uses the PAC secret to compute the authenticator; Cisco Secure ACS 5.2 uses the shared secret. This behavior causes a mismatch that results in a rejection of the accounting message, and the client marks the server as unresponsive.
Workaround: None. You must disable 802.1X accounting. CSCts26844
- When more than one Equal Cost Multipath (ECMP) is available on the downstream switch, and Mediatrace is invoked to provide flow statistics, the dynamic policy does not show statistics for a flow.
Mediatrace cannot find the correct inbound interface and applies the dynamic policy on a different interface from the one used for media flow.
- When a switchover is created on the Mediatrace responder, the dynamic access list created for a monitored flow tuple is not deleted. Although the Mediatrace initiator creates another set of dynamic access lists after the switchover, the old ones remain in the configuration.
The impact of stale dynamic access lists is to monitor unwanted traffic.
– If the switchover is scheduled, remove the scheduled session on the initiator. Reschedule the session after the new active supervisor engine boots on the responder.
– If the Mediatrace responder SSO is not planned, after the new active supervisor engine boots, manually delete the stale dynamic access lists. CSCty75070
- Configuring an interface as unidirectional with the unidirectional send-only | receive-only command still allows the interface to send (configured as Send-only Unidirection Ethernet mode) or receive (configured as Receive-only Unidirection Ethernet mode) packets in a bidirectional mode.
- When you add a "bfd" suffix to the snmp server host x.x.x.x configuration command, the BFD traps, ciscoBfdSessUp and ciscoBfdSessDown, are not generated.
Workaround: Do not specify a "bfd" suffix with the snmp-server host x.x.x.x configuration command. CSCtx51561
- When you transfer a startup-config to the switch directly without entering write mem, and the startup-config contains the hw-module uplink shared-backplane command, the four ports on a Supervisor Engine 6-E are not activated in subsequent reloads. The second port of each supervisor engine remains inactive.
Workaround: Configure hw-module uplink shared-backplane from the console or vty, and enter write mem. CSCtx43568
- If a switch enabled with Bidir PIM has a software tunnel interface pointing towards the RP upstream, packet drops are observed.
Workaround: None. Consider using a physical interface pointing towards RP upstream.
- During either a system- or user-initiated reload operation, the following message is observed when the system shuts down:
This message is not observed during a system bootup.
Workaround: None required. This message is information only. CSCtz15738
- If a configuration contains an "ip vrf" or "vrf definition" section, and you type “wr mem” while using an IP Base or LAN Base boot level of IOS-XE, the following message appears.
Workaround: None. The message is information only. CSCtw93140
- After logging “Authorization succeeded for client (Unknown MAC)”, a switch crashes if the following conditions apply:
– A switchport is configured with both of the following:
authentication event server dead action authorize...
authentication event server alive action reinitalize
– The RADIUS server was down previously, and a port without traffic (for example: a hub with no devices attached) was authorized into the inaccessible authentication bypass (IAB) VLAN without an associated MAC address.
– The RADIUS server becomes available again, and a dot1x client attempts to authenticate.
- Traffic is dropped on a particular tx-queue of an EtherChannel member interfacere configured with a queuing policy. However, it will still appear in an egress span session of the EtherChannel.
The show platform software interface tx-queue command will display an incorrect number of configured queues (compare to EtherChannel members that are not dropping traffic).
Workaround: Enter shut then no shut on the port. CSCua66962
- If either the active or standby supervisor engine is running Cisco IOS 15.1(1)SG, the standby supervisor engine does achieve a standby-cold or standby-hot state; it continues to reload.
Workaround: Downgrade or upgrade the supervisor engine by either temporarily removing the other supervisor engine or relocating the supervisor engine to another chassis. CSCtz44577
- On a switch running Cisco 15.0(2)SG4 or 15.1(1)SG with 4648* or 4748* linecards with PoE, a single port on a linecard fails to link up, usually after flapping its link frequently.
Workaround: Enter shut then no shut on the port. CSCtz94862
- On a switch running Cisco 15.0(2)SG4 or 15.1(1)SG on 4648* or 4748* linecards with PoE, the PoE device will not power up on a single port, but will work on other ports on the same linecard.
– Connect a non-PoE device to the port
– Enter shut then no shut on the port. CSCua63562
- After booting a switch with Cisco IOS XE 3.3.0SG or 3.3.1SG with a crypto (k9) image, a linecard may display a status of Auth Fail, and will not be brought online. Non-crypto images are unaffected.
Workaround: Reset the linecard either with the hw-module module m reset command or through a manual OIR. CSCuc64146
- With IGMP snooping enabled, multicast traffic received through a tunnel interface is not forwarded out the Outgoing Interface List.
Workaround: Disable IGMP snooping. CSCuc65538
- When a port connected to a CDP speaker goes down, a small memory leak occurs (typically less than 300 bytes).
Workaround: Disable CDP on interfaces that may flap frequently. CSCub85948
Resolved Caveats in Cisco IOS Release 15.1(1)SG
This section lists the resolved caveats in Release 15.1(1)SG:
- If you enter the show spanning-tree vlan command when spanning tree is changed from PVST to Rapid PVST, the ports configured as promiscuous trunks are not listed as part of the spanning tree.
Troubleshooting
These sections provide troubleshooting guidelines for the Catalyst 4000 family running IOS supervisor engines:
- Netbooting from the ROMMON
- Troubleshooting at the System Level
- Troubleshooting Modules
- Troubleshooting MIBs
Netbooting from the ROMMON
Netbooting using a boot loader image is not supported. Instead, use one of the following options to boot an image:
1. Boot from a CompactFlash card by entering the following command:
The ROMMON TFTP boot is very similar to the BOOTLDR TFTP boot, except that:
– the BOOTLDR variable should not be set
– the TFTP server must be accessible from the Ethernet management port on the supervisor engine.
To boot from ROMMON, perform the following tasks while in ROMMON mode:
a. Ensure that the Ethernet management port on the supervisor engine is physically connected to the network.
b. Verify that bootloader environment is not set by entering the unset bootldr command.
c. Set IP address of the Ethernet management port on the supervisor engine by entering the following command: set interface fa1 ip_address > < ip_mask
For example, to set the supervisor engine Ethernet port with an IP address 172.16.1.5 and IP mask 255.255.255.0, enter the following command:
d. Set default gateway for the Ethernet management port on the supervisor engine by entering the following command: set ip route default gateway_ip_address. The default gateway should be directly connected to the supervisor engine Ethernet management port subnet.
e. Ping the TFTP server to ensure that there is connectivity to the server from the Ethernet management port on the supervisor engine by entering the following command: ping < tftp_server_ip_address >.
f. Once the ping is successful, boot the image from the TFTP server by entering the following command: boot tftp:// tftp_server_ip_address > / < image_path_and_file_name
For example, to boot the image name cat4000-is-mz.160 located on the TFTP server 172.16.1.8, enter the following command:
Troubleshooting at the System Level
This section contains troubleshooting guidelines for system-level problems:
- When the system is booting and running power-on diagnostics, do not reset the switch.
- Ensure that you do not mix the serial and Ethernet cables plugged into the supervisor engine. The Fast Ethernet port (10/100 MGT) on the supervisor engine is inoperative in all Catalyst 4500 Cisco IOS releases. An Ethernet cable plugged into the Fast Ethernet port is active only in ROMMON mode.
Troubleshooting Modules
This section contains troubleshooting guidelines for modules:
- When you hot insert a module into a chassis, always use the ejector levers on the front of the module to seat the backplane pins properly. Inserting a module without using the ejector levers might cause the supervisor engine to display incorrect messages about the module. For module installation instructions, refer to the Catalyst 4500 Series Module Installation Guide.
- Whenever you connect an interface that has duplex set to autonegotiate to an end station or another networking device, ensure that the other device is configured for autonegotiation as well. If the other device is not set to autonegotiate, the port set to autonegotiate will remain in half-duplex mode, which can cause a duplex mismatch resulting in packet loss, late collisions, and line errors on the link.
Troubleshooting MIBs
For general information on MIBs, RMON groups, and traps, refer to the Cisco public MIB directory ( http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml). For information on the specific MIBs supported by the Catalyst 4500 series switches, refer to the Catalyst 4000 MIB Support List located at ftp://ftp.cisco.com/pub/mibs/supportlists/cat4000/cat4000-supportlist.html.
Related Documentation
Although their Release Notes are unique, the 4 platforms (Catalyst 4500, Catalyst 4900, Catalyst ME 4900, and Catalyst 4900M) use the same Software Configuration Guide, Command Reference Guide, and System Message Guide. Refer to the following home pages for additional information:
http://www.cisco.com/go/cat4500/docs
http://www.cisco.com/go/cat4900/docs
http://www.cisco.com/en/US/products/ps7009/tsd_products_support_series_home.html
Hardware Documents
Installation guides and notes including specifications and relevant safety information are available at the following URLs:
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/hardware/installation/guide/78-14409-08/4500inst.html
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/hardware/catalyst4500e/installation/guide/Eseries.html
- For information about individual switching modules and supervisors, refer to the Catalyst 4500 Series Module Installation Guide at:
http://www.cisco.com/en/US/products/hw/switches/ps4324/prod_installation_guides_list.html
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/hardware/regulatory/compliance/78_13233.html
http://www.cisco.com/en/US/products/hw/switches/ps4324/prod_installation_guides_list.html
http://www.cisco.com/en/US/products/ps6021/prod_installation_guides_list.html
http://www.cisco.com/en/US/products/ps7009/prod_installation_guides_list.html
Software Documentation
Software release notes, configuration guides, command references, and system message guides are available at the following URLs:
http://www.cisco.com/en/US/products/hw/switches/ps4324/prod_release_notes_list.html
http://www.cisco.com/en/US/products/ps6021/prod_release_notes_list.html
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/release/note/OL_11511.html
Software documents for the Catalyst 4500 Classic, Catalyst 4500 E-Series, Catalyst 4900, and
Cisco ME 4900 Series Ethernet Switches are available at the following URLs:
http://www.cisco.com/en/US/products/hw/switches/ps4324/products_installation_and_configuration_guides_list.html
http://www.cisco.com/en/US/products/hw/switches/ps4324/prod_command_reference_list.html
http://www.cisco.com/en/US/products/hw/switches/ps4324/products_system_message_guides_list.html
Cisco IOS Documentation
Platform-independent Cisco IOS documentation may also apply to the Catalyst 4500 and 4900 switches. These documents are available at the following URLs:
http://www.cisco.com/en/US/products/ps6350/products_installation_and_configuration_guides_list.html
http://www.cisco.com/en/US/products/ps6350/prod_command_reference_list.html
You can also use the Command Lookup Tool at:
http://tools.cisco.com/Support/CLILookup/cltSearchAction.do
http://www.cisco.com/en/US/products/ps6350/products_system_message_guides_list.html
You can also use the Error Message Decoder tool at:
http://www.cisco.com/pcgi-bin/Support/Errordecoder/index.cgi
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
Notices
The following notices pertain to this software license.
OpenSSL/Open SSL Project
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit ( http://www.openssl.org/).
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com).
This product includes software written by Tim Hudson (tjh@cryptsoft.com).
License Issues
The OpenSSL toolkit stays under a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. Actually both licenses are BSD-style Open Source licenses. In case of any license issues related to OpenSSL please contact openssl-core@openssl.org.
Copyright © 1998-2007 The OpenSSL Project. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions, and the following disclaimer in the documentation or other materials provided with the distribution.
3. All advertising materials mentioning features or use of this software must display the following acknowledgment: “This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit ( http://www.openssl.org/)”.
4. The names “OpenSSL Toolkit” and “OpenSSL Project” must not be used to endorse or promote products derived from this software without prior written permission. For written permission, please contact openssl-core@openssl.org.
5. Products derived from this software may not be called “OpenSSL” nor may “OpenSSL” appear in their names without prior written permission of the OpenSSL Project.
6. Redistributions of any form whatsoever must retain the following acknowledgment:
“This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit ( http://www.openssl.org/)”.
THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT “AS IS”' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes software written by Tim Hudson (tjh@cryptsoft.com).
Copyright © 1995-1998 Eric Young (eay@cryptsoft.com). All rights reserved.
This package is an SSL implementation written by Eric Young (eay@cryptsoft.com).
The implementation was written so as to conform with Netscapes SSL.
This library is free for commercial and non-commercial use as long as the following conditions are adhered to. The following conditions apply to all code found in this distribution, be it the RC4, RSA, lhash, DES, etc., code; not just the SSL code. The SSL documentation included with this distribution is covered by the same copyright terms except that the holder is Tim Hudson (tjh@cryptsoft.com).
Copyright remains Eric Young’s, and as such any Copyright notices in the code are not to be removed. If this package is used in a product, Eric Young should be given attribution as the author of the parts of the library used. This can be in the form of a textual message at program startup or in documentation (online or textual) provided with the package.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation or other materials provided with the distribution.
3. All advertising materials mentioning features or use of this software must display the following acknowledgement:
“This product includes cryptographic software written by Eric Young (eay@cryptsoft.com)”.
The word ‘cryptographic’ can be left out if the routines from the library being used are not cryptography-related.
4. If you include any Windows specific code (or a derivative thereof) from the apps directory (application code) you must include an acknowledgement: “This product includes software written by Tim Hudson (tjh@cryptsoft.com)”.
THIS SOFTWARE IS PROVIDED BY ERIC YOUNG “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
The license and distribution terms for any publicly available version or derivative of this code cannot be changed. i.e. this code cannot simply be copied and put under another distribution license [including the GNU Public License].
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What’s New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What’s New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
This document is to be used in conjunction with the documents listed in the “Related Documentation” section.
CCVP, the Cisco logo, and Welcome to the Human Network are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networkers, Networking Academy, Network Registrar, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)