Downloads |
 Feedback
|
Table Of Contents
Recovering from a Lost or Forgotten Password
Procedure with Password Recovery Enabled
Procedure with Password Recovery Disabled
Preventing Autonegotiation Mismatches
SFP Module Security and Identification
Understanding Layer 2 Traceroute
Layer 2 Traceroute Usage Guidelines
Running TDR and Displaying the Results
Enabling Debugging on a Specific Feature
Enabling All-System Diagnostics
Redirecting Debug and Error Message Output
Using On-Board Failure Logging
Troubleshooting
This chapter describes how to identify and resolve software problems related to the Cisco IOS software on the Cisco ME 3800X and ME 3600X switch.
You can use the command-line interface (CLI) to identify and solve problems.
Additional troubleshooting information related to hardware is provided in the hardware installation guide.
Note
For complete syntax and usage information for the commands used in this chapter, see the command reference for this release and the Cisco IOS Master Command List, All Releases.
•
Note
•
•
•
Recovering from a Lost or Forgotten Password
The default configuration for the switch allows an end user to recover from a lost password by interrupting the boot process during power-on and by entering a new password.
Note
Disabling password recovery provides configuration file security by preventing unauthorized users from accessing the configuration file.
The Cisco ME switch boot loader uses break-key detection to stop the automatic boot sequence for the password recovery purpose.
Note
On a SUN work station running UNIX, Ctrl-C is the break key.
On a PC running Windows XP or 2000, Ctrl-Break is the break key.
Cisco TAC has tabulated break keys for most common operating systems and an alternative break key sequence for those terminal emulators that do not support the break keys. To see that list go to:
http://www.cisco.com/en/US/products/hw/routers/ps133/products_tech_note09186a0080174a34.shtml
These sections describes how to recover a forgotten or lost switch password:
•
•
You enable or disable password recovery by using the service password-recovery global configuration command.
Follow the steps in this procedure if you have forgotten or lost the switch password.
Step 1
Step 2
Step 3
Reconnect the power cord to the switch.
Step 4
***** The system will autoboot in 5 seconds *****Send a break key to prevent autobooting.You must enter the break key on the console terminal within 5 seconds of receiving the message that the system will autoboot. The System LED flashes green until the break key is accepted. After the break key is accepted, the System LED turns off until after the switch boots.
Several lines of information about the software appear with instructions, informing you if the password recovery procedure has been disabled or not.
•
The system has been interrupted, or encountered an error during initializion of the flash filesystem. The following commands will initialize the flash filesystem, and finish loading the operating system software:flash_initload_helperbootproceed to the "Procedure with Password Recovery Enabled" section, and follow the steps.
•
The password-recovery mechanism has been triggered, but is currently disabled.proceed to the "Procedure with Password Recovery Disabled" section, and follow the steps.
Step 5
Switch>reloadProceed with reload? [confirm] y
Procedure with Password Recovery Enabled
If the password-recovery mechanism is enabled, this message appears:
The system has been interrupted, or encountered an error during initializion of the flash filesystem. The following commands will initialize the flash filesystem, and finish loading the operating system software:flash_initload_helperboot
Step 1
switch: flash_initStep 2
Step 3
switch:load_helperStep 4
switch:dir flash:The switch file system appears:
Directory of flash:13 drwx 192 Mar 01 1993 22:30:48 image-name-mz.122-50-EX11 -rwx 5825 Mar 01 1993 22:31:59 config.text18 -rwx 720 Mar 01 1993 02:21:30 vlan.dat16128000 bytes total (10003456 bytes free)Step 5
This file contains the password definition.
switch:rename flash:config.text flash:config.text.oldStep 6
switch:bootYou are prompted to start the setup program. Enter N at the prompt:
Continue with the configuration dialog? [yes/no]:NStep 7
Switch>enableStep 8
Switch#rename flash:config.text.old flash:config.textStep 9
Switch#copy flash:config.text system:running-config Source filename [config.text]? Destination filename [running-config]?Press Return in response to the confirmation prompts.
The configuration file is now reloaded, and you can change the password.
Step 10
Switch#configure terminalStep 11
Switch (config)#enable secret passwordThe secret password can be from 1 to 25 alphanumeric characters, can start with a number, is case sensitive, and allows spaces but ignores leading spaces.
Step 12
Switch (config)#exit Switch#Step 13
Switch#copy running-config startup-configThe new password is now in the startup configuration.
Note
Step 14
Switch#reload
Procedure with Password Recovery Disabled
If the password-recovery mechanism is disabled, this message appears:
The password-recovery mechanism has been triggered, butis currently disabled. Access to the boot loader promptthrough the password-recovery mechanism is disallowed atthis point. However, if you agree to let the system bereset back to the default system configuration, accessto the boot loader prompt can still be allowed.Would you like to reset the system back to the default configuration (y/n)?
Caution
Note
•
Press Enter to continue........•
Step 1
Would you like to reset the system back to the default configuration (y/n)? YStep 2
Switch:load_helperStep 3
switch:dir flash:The switch file system appears:
Directory of flash:13 drwx 192 Mar 01 1993 22:30:48 image-name-mz.122-50-SE16128000 bytes total (10003456 bytes free)Step 4
Switch:bootYou are prompted to start the setup program. To continue with password recovery, enter N at the prompt:
Continue with the configuration dialog? [yes/no]:NStep 5
Switch>enableStep 6
Switch#configure terminalStep 7
Switch (config)#enable secret passwordThe secret password can be from 1 to 25 alphanumeric characters, can start with a number, is case sensitive, and allows spaces but ignores leading spaces.
Step 8
Switch (config)#exit Switch#Step 9
Switch#copy running-config startup-configThe new password is now in the startup configuration.
Note
Step 10
Preventing Autonegotiation Mismatches
The IEEE 802.3ab autonegotiation protocol manages the switch settings for speed (10, 100, and 1000 Mbps, excluding SFP module ports) and duplex (half or full). There are situations when this protocol can incorrectly align these settings, reducing performance. A mismatch occurs under these circumstances:
•
•
To maximize switch performance and ensure a link, follow one of these guidelines when changing the settings for duplex and speed:
•
•
Note
SFP Module Security and Identification
Cisco small form-factor pluggable (SFP) modules have a serial EEPROM that contains the module serial number, the vendor name and ID, a unique security code, and cyclic redundancy check (CRC). When an SFP module is inserted in the switch, the switch software reads the EEPROM to verify the serial number, vendor name and vendor ID, and recompute the security code and CRC. If the serial number, the vendor name or vendor ID, the security code, or CRC is invalid, the software generates a security error message and places the interface in an error-disabled state.
Note
If you are using a non-Cisco SFP module, remove the SFP module from the switch, and replace it with a Cisco module. After inserting a Cisco SFP module, use the errdisable recovery cause gbic-invalid global configuration command to verify the port status, and enter a time interval for recovering from the error-disabled state. After the elapsed interval, the switch brings the interface out of the error-disabled state and retries the operation. For more information about the errdisable recovery command, see the command reference for this release.
If the module is identified as a Cisco SFP module, but the system is unable to read vendor-data information to verify its accuracy, an SFP module error message is generated. In this case, you should remove and re-insert the SFP module. If it continues to fail, the SFP module might be defective.
Monitoring SFP Module Status
You can check the physical or operational status of an SFP module by using the show interfaces transceiver privileged EXEC command. This command shows the operational status, such as the temperature and the current for an SFP module on a specific interface and the alarm status. You can also use the command to check the speed and the duplex settings on an SFP module. For more information, see the show interfaces transceiver command in the command reference for this release.
Monitoring Temperature
The switch monitors the temperature conditions. The switch also uses the temperature information to control the fans. The temperature value is the temperature in the switch (not the external temperature). Enter the show env temperature privileged EXEC command to see if the temperature is okay or faulty.
You can use the show env temperature status privileged EXEC command to display the temperature value, state, and thresholds. You can configure a high and low threshold level (in Celsius) to generate an alert by using the system env temperature alert {high | low} value global configuration command.
The show env temperature status command displays the temperature value, state, and thresholds.
These are examples of output from the show env temperature and show env temperature status commands:
Switch> show env temperatureSYSTEM TEMPERATURE is GREENSwitch> show env temperature statusSYSTEM Temperature Value: 35.5 Degree CelsiusSYSTEM Temperature State: GREENSYSTEM Low Temperature Alert Threshold: 0.0 Degree CelsiusSYSTEM Low Temperature Shutdown Threshold: -20.0 Degree CelsiusSYSTEM High Temperature Alert Threshold: 58.0 Degree CelsiusSYSTEM High Temperature Shutdown Threshold: 80.0 Degree CelsiusPOWER SUPPLY 1 Temperature Value: 32.7500 Degree CelsiusPOWER SUPPLY 1 Temperature Alert Threshold: 85.0000 Degree CelsiusPOWER SUPPLY 1 Temperature Shutdown Threshold: 110.0000 Degree CelsiusFAN TRAY 2: No Temperature Information ProvidedFor more information, see the command reference for this release.
Using Ping
The switch supports IP ping, which you can use to test connectivity to remote hosts. Ping sends an echo request packet to an address and waits for a reply. To ping a host in a different IP subnetwork from the switch, you must have IP routing configured to route between the subnets, and a static route to the destination might also be appropriate. If you need to enable or configure IP routing, see Chapter 37 "Configuring IP Unicast Routing."
Beginning in privileged EXEC mode, use the ping command to ping another device on the network from the switch:
To end a ping session, simultaneously press and release the Ctrl, Shift, and 6 keys, and then press the X key.
Using Layer 2 Traceroute
•
•
Understanding Layer 2 Traceroute
The Layer 2 traceroute feature allows the switch to identify the physical path that a packet takes from a source device to a destination device. Layer 2 traceroute supports only unicast source and destination MAC addresses. It finds the path by using the MAC address tables of the switches in the path. When the switch detects a device in the path that does not support Layer 2 traceroute, the switch continues to send Layer 2 trace queries and lets them time out.
Note
The switch can only identify the path from the source device to the destination device. It cannot identify the path that a packet takes from source host to the source device or from the destination device to the destination host.
Layer 2 Traceroute Usage Guidelines
•
•
•
•
•
•
•
•
•
–
–
•
•
Displaying the Physical Path
You can display the physical path that a packet takes from a source device to a destination device by using one of these privileged EXEC commands:
•
•
For more information, see the command reference for this release.
Using IP Traceroute
Understanding IP Traceroute
You can use IP traceroute to identify the path that packets take through the network on a hop-by-hop basis. The command output displays all network layer (Layer 3) devices, such as routers, that the traffic passes through on the way to the destination.
Your switches can participate as the source or destination of the traceroute privileged EXEC command and might or might not appear as a hop in the traceroute command output. If the switch is the destination of the traceroute, it is displayed as the final destination in the output. Intermediate switches do not show up in the output if they are only bridging the packet from one port to another within the same VLAN. However, if the intermediate switch is a multilayer switch that is routing a particular packet, this switch shows up as a hop in the output.
The traceroute privileged EXEC command uses the Time To Live (TTL) field in the IP header to cause routers and servers to generate specific return messages. Traceroute starts by sending a User Datagram Protocol (UDP) datagram to the destination host with the TTL field set to 1. If a router finds a TTL value of 1 or 0, it drops the datagram and sends an Internet Control Message Protocol (ICMP) time-to-live-exceeded message to the sender. Traceroute finds the address of the first hop by examining the source address field of this message.
To identify the next hop, traceroute sends a UDP packet with a TTL value of 2. The first router decrements the TTL field by 1 and sends the datagram to the next router. The second router sees a TTL value of 1, discards the datagram, and returns the time-to-live-exceeded message to the source. This process continues until the TTL is incremented to a value large enough for the datagram to reach the destination host (or until the maximum TTL is reached).
To learn when a datagram reaches its destination, traceroute sets the UDP destination port number in the datagram to a very large value that the destination host is unlikely to be using. When a host receives a datagram destined to itself containing a destination port number that is unused locally, it sends an ICMP port-unreachable error to the source. Because all errors except port-unreachable errors come from intermediate hops, the receipt of a port-unreachable error means that this message was sent by the destination port.
Executing IP Traceroute
Beginning in privileged EXEC mode, follow this step to trace that the path packets take through the network:
Note
This example shows how to perform a traceroute to an IP host:
Switch# traceroute ip 171.9.15.10Type escape sequence to abort.Tracing the route to 171.69.115.101 172.2.52.1 0 msec 0 msec 4 msec2 172.2.1.203 12 msec 8 msec 0 msec3 171.9.16.6 4 msec 0 msec 0 msec4 171.9.4.5 0 msec 4 msec 0 msec5 171.9.121.34 0 msec 4 msec 4 msec6 171.9.15.9 120 msec 132 msec 128 msec7 171.9.15.10 132 msec 128 msec 128 msecSwitch#The display shows the hop count, IP address of the router, and the round-trip time in milliseconds for each of the three probes that are sent.
To end a trace in progress, enter the escape sequence (Ctrl-^ X by default). Simultaneously press and release the Ctrl, Shift, and 6 keys, and then press the X key.
Using TDR
•
Understanding TDR
You can use the Time Domain Reflector (TDR) feature to diagnose and resolve cabling problems. When running TDR, a local device sends a signal through a cable and compares the reflected signal to the initial signal.
TDR can detect these cabling problems:
•
•
If one of the twisted-pair wires is open, TDR can find the length at which the wire is open.
Use TDR to diagnose and resolve cabling problems in these situations:
•
•
•
Running TDR and Displaying the Results
To run TDR, enter the test cable-diagnostics tdr interface interface-id privileged EXEC command:
To display the results, enter the show cable-diagnostics tdr interface interface-id privileged EXEC command. For a description of the fields in the display, see the command reference for this release.
Note
Using Debug Commands
•
•
•
Caution
Note
Enabling Debugging on a Specific Feature
All debug commands are entered in privileged EXEC mode, and most debug commands take no arguments. For example, beginning in privileged EXEC mode, enter this command to enable the debugging for all Flex Links backup interface:
Switch# debug backup allThe switch continues to generate output until you enter the no form of the command.
If you enable a debug command and no output appears, consider these possibilities:
•
•
To disable debugging of Flex Links, enter this command in privileged EXEC mode:
Switch# no debug backup allAlternately, in privileged EXEC mode, you can enter the undebug form of the command:
Switch# undebug backup allTo display the state of each debugging option, enter this command in privileged EXEC mode:
Switch# show debuggingEnabling All-System Diagnostics
Beginning in privileged EXEC mode, enter this command to enable all-system diagnostics:
Switch# debug all
Caution
The no debug all privileged EXEC command disables all diagnostic output. Using the no debug all command is a convenient way to ensure that you have not accidentally left any debug commands enabled.
Redirecting Debug and Error Message Output
By default, the network server sends the output from debug commands and system error messages to the console. If you use this default, you can use a virtual terminal connection to monitor debug output instead of connecting to the console port.
Possible destinations include the console, virtual terminals, internal buffer, and UNIX hosts running a syslog server. The syslog format is compatible with 4.3 Berkeley Standard Distribution (BSD) UNIX and its derivatives.
Note
For more information about system message logging, see Chapter 28 "Configuring System Message Logging."
Using the crashinfo File
The crashinfo file saves information that helps Cisco technical support representatives to debug problems that caused the Cisco IOS image to fail (crash). The switch writes the crash information to the console at the time of the failure, and the file is created the next time you boot the Cisco IOS image after the failure (instead of while the system is failing).
The information in the file includes the Cisco IOS image name and version that failed, a list of the processor registers, and a stack trace. You can provide this information to the Cisco technical support representative by using the show tech-support privileged EXEC command.
All crashinfo files are kept in this directory on the flash file system:
flash:/crashinfo/crashinfo_n where n is a sequence number.
Each new crashinfo file that is created uses a sequence number that is larger than any previously existing sequence number, so the file with the largest sequence number describes the most recent failure. Version numbers are used instead of a timestamp because the switches do not include a real-time clock. You cannot change the name of the file that the system will use when it creates the file. However, after the file is created, you can use the rename privileged EXEC command to rename it, but the contents of the renamed file will not be displayed by the show tech-support privileged EXEC command. You can delete crashinfo files by using the delete privileged EXEC command.
You can display the most recent crashinfo file (that is, the file with the highest sequence number at the end of its filename) by entering the show tech-support privileged EXEC command. You also can access the file by using any command that can copy or display files, such as the more or the copy privileged EXEC command.
Using On-Board Failure Logging
You can use the on-board-failure logging (OBFL) feature to collect information about the switch. The information includes uptime, temperature, and voltage information and helps Cisco technical support representatives to troubleshoot switch problems.
This section has this information:
Understanding OBFL
By default, OBFL is enabled and is automatically activated five minutes after the switch boots up. It collects information about the switch and small form-factor pluggable (SFP) modules. The switch stores this information in the flash memory:
•
•
•
•
•
•
You should manually set the system clock, or configure it by using Network Time Protocol (NTP).
When the switch is running, you can retrieve the OBFL data by using the show logging onboard privileged EXEC commands. If the switch fails, contact your Cisco technical support representative to find out how to retrieve the data.
When an OBFL-enabled switch is restarted, there is a 10-minute delay before logging of new data begins.
Configuring OBFL
To enable OBFL, use the hw-module module logging onboard [message level level] global configuration command. Use the message level level parameter to specify the severity of the hardware-related messages that the switch generates and stores in the flash memory.
To copy the OBFL data to the local network or a specific file system, use the copy logging onboard module 1 destination privileged EXEC command.
Caution
Beginning in privileged EXEC mode, follow these steps to enable and configure OBFL. Note that OBLF is enabled by default; you need to enable it only if it has been disabled.
To disable OBFL, use the no hw-module module 1 logging onboard [message level] global configuration command.
To clear all the OBFL data in the flash memory except for the uptime and CLI command information, use the clear logging onboard privileged EXEC command.
For more information about the commands in this section, see the command reference for this release.
Displaying OBFL Information
To display the OBFL information, use one or more of the privileged EXEC commands in Table 50-2.
Note
These are examples of output from the show logging onboard commands:
Switch# show logging onboard clilog--------------------------------------------------------------------------------CLI LOGGING SUMMARY INFORMATION--------------------------------------------------------------------------------COUNT COMMAND--------------------------------------------------------------------------------1 hw-module module logging onboard1 hw-module module logging onboard message level 74 show logging onboard1 show logging onboard message1 show logging onboard summary--------------------------------------------------------------------------------Switch# show logging onboard temp--------------------------------------------------------------------------------TEMPERATURE SUMMARY INFORMATION--------------------------------------------------------------------------------Number of sensors : 1Sampling frequency : 5 minutesMaximum time of storage : 720 minutes--------------------------------------------------------------------------------Sensor | ID | Maximum Temperature 0C--------------------------------------------------------------------------------System 1 41--------------------------------------Temp Sensor ID0C 1--------------------------------------No historical data to display--------------------------------------Switch# show logging onboard uptime--------------------------------------------------------------------------------UPTIME SUMMARY INFORMATION--------------------------------------------------------------------------------First customer power on : 03/01/1993 00:06:06Total uptime : 0 years 20 weeks 4 days 6 hours 20 minutesTotal downtime : 0 years 0 weeks 0 days 0 hours 0 minutesNumber of resets : 90Number of slot changes : 0Current reset reason : 0x0Current reset timestamp : 03/01/1993 00:05:43Current slot : 1Current uptime : 0 years 0 weeks 2 days 6 hours 0 minutes--------------------------------------------------------------------------------Reset | |Reason | Count |--------------------------------------------------------------------------------No historical data to display--------------------------------------------------------------------------------Switch# show logging onboard voltage------------------------------------------------------------------------------------------VOLTAGE SUMMARY INFORMATION------------------------------------------------------------------------------------------Number of sensors : 6Sampling frequency : 1 minutesMaximum time of storage : 720 minutes------------------------------------------------------------------------------------------Sensor | ID | Maximum Voltage------------------------------------------------------------------------------------------12.00V 0 12.5671.25V 2 1.2583.30V 3 3.3052.50V 4 2.5171.80V 5 1.8251.50V 6 1.508------------------------------------------------------------------------------------------Nominal Range Sensor ID------------------------------------------------------------------------------------------No historical data to display------------------------------------------------------------------------------------------For more information about using the commands in Table 50-2 and for examples of OBFL data, see the command reference for this release.
