Table Of Contents
Release Notes for the
Catalyst 3550 Multilayer Switch
Cisco IOS Release 12.1(12c)EA1
Contents
System Requirements
Hardware Supported
Software Compatibility
Recommended Platform Configuration for Web-Based Management
Operating System and Browser Support
Guidelines for Installing and Enabling the Java Plug-In
Installing the Required Plug-In
Creating Clusters with Different Releases of IOS Software
Downloading Software
Determining the Software Version and Feature Set
Which Files to Use
Upgrading a Switch by Using CMS
Upgrading a Switch by Using the CLI
Upgrading with a Nondefault System MTU Setting
Recovering from Software Failure
Installation Notes
Setting Up the Catalyst 3550 Initial Configuration
Accessing CMS
Configuring the HTTP Server
Displaying CMS
New Features
New Hardware Features
New Software Features
Limitations and Restrictions
IOS Limitations and Restrictions
Cluster Limitations and Restrictions
CMS Limitations and Restrictions
Important Notes
IOS Notes
Cluster Notes
CMS Notes
Read-Only Mode in CMS
Open Caveats
Open IOS Caveats
Open CMS Caveats
Resolved Caveats
Resolved IOS Caveats
Resolved Cluster Caveats
Documentation Updates
Corrections to the Software Configuration Guide
Corrections to the Hardware Installation Guide
Lightning Activity Warning
Related Documentation
Obtaining Documentation
World Wide Web
Documentation CD-ROM
Ordering Documentation
Documentation Feedback
Obtaining Technical Assistance
Cisco.com
Technical Assistance Center
Cisco TAC Web Site
Cisco TAC Escalation Center
Release Notes for the
Catalyst 3550 Multilayer Switch
Cisco IOS Release 12.1(12c)EA1
December 2002
The Cisco IOS Release 12.1(12c)EA1 runs on all Catalyst 3550 multilayer switches.
These release notes include important information about this IOS release and any limitations, restrictions, and caveats that apply to it. Verify that these are the correct release notes for your switch:
•
If you are installing a new switch, refer to the IOS release label on the rear panel of your switch.
•If your switch is on, use the show version privileged EXEC command. See the "Determining the Software Version and Feature Set" section.
•If you are upgrading to a new release, refer to the software upgrade filename for the IOS version.
For the complete list of Catalyst 3550 switch documentation, see the "Related Documentation" section.
You can download the switch software from these sites:
•http://www.cisco.com/kobayashi/sw-center/sw-lan.shtml
(for registered Cisco.com users with a login password)
•http://www.cisco.com/public/sw-center/sw-lan.shtml
(for nonregistered Cisco.com users)
This IOS release is part of a special release of Cisco IOS software that is not released on the same 8-week maintenance cycle that is used for other platforms. As maintenance releases and future IOS releases become available, they will be posted to Cisco.com (previously Cisco Connection Online [CCO]) in the Cisco IOS software area.
Contents
This information is in the release notes:
•"System Requirements" section
•"Downloading Software" section
•"Installation Notes" section
•"New Features" section
•"Limitations and Restrictions" section
•"Important Notes" section
•"Open Caveats" section
•"Resolved Caveats" section
•"Documentation Updates" section
•"Related Documentation" section
•"Obtaining Documentation" section
•"Obtaining Technical Assistance" section
System Requirements
These are the system requirements for this IOS release:
•"Hardware Supported" section
•"Software Compatibility" section
Hardware Supported
Table 1 lists the hardware supported by this IOS release.
Table 1 Supported Hardware
Switch
|
Description
|
Catalyst 3550-12T
|
10 Gigabit Ethernet 10/100/1000BASE-T ports and 2 GBIC1 -based Gigabit Ethernet slots
|
Catalyst 3550-12G
|
10 GBIC-based Gigabit Ethernet slots and 2 Gigabit Ethernet 10/100/1000BASE-T ports
|
Catalyst 3550-24
|
24 autosensing 10/100 Ethernet ports and 2 GBIC-based Gigabit Ethernet slots
|
Catalyst 3550-48
|
48 autosensing 10/100 Ethernet ports and 2 GBIC-based Gigabit Ethernet slots
|
Catalyst 3550-24-FX
|
24 100BASE-FX ports and 2 GBIC-based Gigabit Ethernet slots
|
Catalyst 3550-24-DC
|
24 autosensing 10/100 Ethernet ports, 2 GBIC-based Gigabit Ethernet slots, and an on-board DC2 power converter
|
Catalyst 3550-24PWR
|
24 autosensing 10/100 Ethernet ports, 2 GBIC-based Gigabit Ethernet slots, ability to provide power for Cisco IP Phones and Cisco Aironet Access Points from all 10/100 Ethernet ports, auto-detection and control of inline power on a per-port basis on all 10/100 ports
|
GBIC modules
|
•1000BASE-SX GBIC
•1000BASE-LX/LH GBIC
•1000BASE-ZX GBIC
•1000BASE-T GBIC
•GigaStack GBIC
•Course Wave Division Multiplexer (CWDM) fiber-optic GBIC
|
Redundant power system
|
Cisco RPS 300 Redundant Power System
|
Software Compatibility
These are the software compatibility requirements for this IOS release:
•"Recommended Platform Configuration for Web-Based Management" section
•"Operating System and Browser Support" section
•"Installing the Required Plug-In" section
•"Creating Clusters with Different Releases of IOS Software" section
Recommended Platform Configuration for Web-Based Management
Table 2 lists the recommended platforms for Web-based management.
Table 2 Recommended Platform Configuration for Web-Based Management
OS
|
Processor Speed
|
DRAM
|
Number of Colors
|
Resolution
|
Font Size
|
Windows NT 4.01
|
Pentium 300 MHz
|
128 MB
|
65,536
|
1024 x 768
|
Small
|
Solaris 2.5.1 or higher
|
SPARC 333 MHz
|
128 MB
|
Most colors for applications
|
—
|
Small (3)
|
The minimum PC requirement is a Pentium processor running at 233 MHz with 64 MB of DRAM. The minimum UNIX workstation requirement is a Sun Ultra 1 running at 143 MHz with 64 MB of DRAM.
For information about supported operating systems, see the next section.
Operating System and Browser Support
You can access the web-based interfaces by using the operating systems and browsers listed in Table 3. The switch checks the browser version when starting a session to ensure that the browser is supported. If the browser is not supported, the switch displays an error message, and the session does not start.
Table 3 Supported Operating Systems and Browsers
Operating System
|
Minimum Service Pack or Patch
|
|
Microsoft Internet Explorer 2
|
Windows 95
|
Service Pack 1
|
4.75 or 6.2
|
5.5 or 6.0
|
Windows 98
|
Second Edition
|
4.75 or 6.2
|
5.5 or 6.0
|
Windows NT 4.0
|
Service Pack 3 or later
|
4.75 or 6.2
|
5.5 or 6.0
|
Windows 2000
|
None
|
4.75 or 6.2
|
5.5 or 6.0
|
Windows XP
|
None
|
4.75 or 6.2
|
5.5 or 6.0
|
Solaris 2.5.1 or later
|
Sun-recommended patch cluster for the OS and Motif library patch 103461-24
|
4.75 or 6.2
|
Not supported
|
Note If your browser is Internet Explorer and you receive an error message stating that the page might not display correctly because your security settings prohibit running activeX controls, this might mean that your security settings are set too high. To lower security settings, go to Tools > Internet Options, and select the Security tab. Select the indicated Zone, and move the Security Level for this Zone slider from High to Medium (the default).
Note In Cluster Management displays, Internet Explorer versions 4.01 and 5.0 might not display edge devices that are not connected to the command switch. Other functionality is similar to that of Netscape Communicator.
Guidelines for Installing and Enabling the Java Plug-In
If CMS does not launch automatically, you might not have a supported Java Plug-In installed, or the Java Plug-In might not be enabled. CMS does not automatically detect if a supported Java plug-in is installed. If you start CMS without the required Java plug-in installed, you remain on the CMS splash screen, and CMS will not launch.
To make sure that a supported Java Plug-In is correctly installed and enabled, follow these guidelines:
•If you are using a supported browser and are connected to the Internet, click the Java Plug-In link to download and install a supported Java Plug-In.
•If you have installed the Java plug-in but CMS still does not launch, make sure that the plug-in is enabled by clicking Start > Settings > Control Panel > Java Plug-in. Click the Basic tab, select Enable Java Plug-in, and click Apply.
•To verify that a supported version of the Java Plug-In is installed, click Start > Settings > Control Panel. The Java Plug-In is listed with the version number in the Control Panel menu.
Installing the Required Plug-In
A Java plug-in is required for the browser to access and run the Java-based Cluster Management Suite (CMS). Download and install the plug-in before you start CMS. Each platform, Windows and Solaris, supports three plug-in versions. For information on the supported plug-ins, see the "Windows XP, Windows 2000, Windows 95, Windows 98, and Windows NT 4.0 Plug-Ins" section and the "Solaris Platforms" section.
You can download the recommended plug-ins from this URL: http://www.cisco.com/pcgi-bin/tablebuild.pl/java
Note Uninstall older versions of the Java plug-ins before installing the Java plug-in.
If the Java applet does not initialize after you have installed the plug-in, open the Java Plug-in Control Panel (Start > Programs > Java Plug-in Control Panel), and verify these settings:
In the Proxies tab, verify that Use browser settings is checked and that no proxies are enabled.
Note If you are running an Internet virus checker on Windows 2000 and the plug-in takes a long time to load, you can speed up CMS operation by disabling the virus checker filter option or download option or both.
On McAfee VirusScan, from the Start menu, to disable the VirusScan Internet Filter option, the Download Scan option, or both, select Start > Programs > Network Associates > Virus Scan Console > Configure.
or
From the taskbar, right-click the Virus Shield icon and in the Quick Enable menu, disable the options by deselecting Internet Filter or Download Scan.
Windows XP, Windows 2000, Windows 95, Windows 98, and Windows NT 4.0 Plug-Ins
These Java plug-ins are supported in Windows environments:
•Java plug-in 1.4
•Java plug-in 1.3.1
•Java plug-in 1.3.0
You can download these plug-ins from this URL:
http://www.cisco.com/pcgi-bin/tablebuild.pl/java
Solaris Platforms
These Java plug-ins are supported on the Solaris platform:
•Java plug-in 1.4
•Java plug-in 1.3.1
•Java plug-in 1.3.0
You can download these plug-ins and instructions from this URL:
http://www.cisco.com/pcgi-bin/tablebuild.pl/java
To install the Java plug-in, follow the instructions in the README_FIRST.txt file.
Creating Clusters with Different Releases of IOS Software
When a cluster consists of a mixture of other Catalyst switches, we strongly recommend using only the Catalyst 3550 switches as the command and standby command switches. When the command switch is a Catalyst 3550 switch, all standby command switches must also be Catalyst 3550 switches. The Catalyst 3550 switch that has the latest software should be the command switch. If the command switch is a Catalyst 3550 Gigabit Ethernet switch and the standby command switch is a Catalyst 3550 Fast Ethernet switch, command switch port speeds are reduced if the standby command switch takes over.
If your cluster has Catalyst 2950, Catalyst 2900 XL, and Catalyst 3500 XL switches, the Catalyst 2950 switch (with the latest software release) should be the command switch. The Catalyst 2950 switch that has the latest software should be the command switch.
If your switch cluster has Catalyst 1900, Catalyst 2820, Catalyst 2900 XL, and Catalyst 3500 XL switches, either the Catalyst 2900 XL or Catalyst 3500 XL (whichever has the latest software release) should be the command switch.
Table 4 lists the cluster capabilities and software versions for the switches.
Table 4 Switch Software and Cluster Capability
Switch
|
IOS Release
|
Cluster Capability
|
Catalyst 3550
|
Release 12.1(4)EA1 or later
|
Member or command switch
|
Catalyst 3500 XL
|
Release 12.0(5.1)XU or later
|
Member or command switch
|
Catalyst 2950
|
Release 12.0(5.2)WC(1) or later
|
Member or command switch
|
Catalyst 2900 XL (8-MB switches)
|
Release 12.0(5.1)XU or later
|
Member or command switch
|
Catalyst 2900 XL (4-MB switches)
|
Release 11.2(8.5)SA6 (recommended)
|
Member switch only1
|
Catalyst 1900 and 2820
|
Release 9.00(-A or -EN) or later
|
Member switch only
|
Some versions of the Catalyst 2900 XL software do not support clustering and if you have a cluster with switches that are running different versions of IOS software, software features added on the latest release might not be reflected on switches running the older versions. For example, if you start Visual Switch Manager (VSM) on a Catalyst 2900 XL switch running Release 11.2(8)SA6, the windows and functionality can be different from a switch running Release 12.0(5)WC(1) or later.
Note The CMS is not forward-compatible, which means that if a member switch is running a software version that is newer than the release running on the command switch, the new features are not available on the member switch. If the member switch is a new device supported by a software release that is later than the software release on the command switch, the command switch cannot recognize the member switch and it is displayed as an unknown device in the Front Panel view. You cannot configure any parameters or generate a report through CMS for that member; instead, you must launch the Device Manager application to perform configuration and obtain reports for that member.
Downloading Software
These are the procedures for downloading software:
•"Determining the Software Version and Feature Set" section
•"Which Files to Use" section
•"Upgrading a Switch by Using CMS" section
•"Upgrading a Switch by Using the CLI" section
Note Before downloading software, read this section for important information.
Caution The crypto image includes a bootloader upgrade. Do not power cycle the switch while you are copying this image to the switch. If a power failure occurs when you are copying this image to the switch, call Cisco Systems immediately.
Determining the Software Version and Feature Set
The IOS image is stored as a .bin file in a directory that is named with the IOS release. A subdirectory contains the HTML files needed for web management. The image is stored on the system board Flash device (flash:).
You can use the show version privileged EXEC command to see the software version that is running on your switch. The second line displays C3550-I5Q3L2 for the enhanced multilayer software image (EMI) or C3550-I9Q3L2 for the standard multilayer software image (SMI).
Note Although the show version output always shows the software image running on the switch (Layer 2 or Layer 2/3), the model name shown at the end of this display is the factory configuration (SMI or EMI) and does not change if you upgrade the software image.
You can also use the dir filesystem: privileged EXEC command to see the directory names of other software images that you might have stored in Flash memory.
Which Files to Use
The upgrade procedures in these release notes describe how to perform the upgrade by using a combined .tar file. This file contains both the IOS image file and the HTML files (needed for the CMS). You must use the combined .tar file to upgrade the switch through the CMS.
The .tar file is an archive file from which you can extract files by using the tar command. You also use the .tar file to upgrade the system by using the archive download-sw privileged EXEC command.
Table 5 lists the software filenames for this IOS release.
Table 5 Cisco IOS Software Files for Catalyst 3550 Switches
Filename
|
Description
|
c3550-i9q3l2-mz.121-12c.EA1.bin
|
IOS SMI image file.
This image has Layer 2+ and basic Layer 3 routing features.
|
c3550-i9q312-tar.121-12c.EA1.tar
|
IOS SMI image file and CMS files.
This image has Layer 2+ and basic Layer 3 routing features.
|
c3550-i5q3l2-mz.121-12c.EA1.bin
|
IOS EMI image file.
This image has both Layer 2+ and full Layer 3 features.
|
c3550-i5q3l2-tar.121-12c.EA1.tar
|
IOS EMI image file and CMS files.
This image has both Layer 2+ and full Layer 3 features.
|
c3550-i9k2l2q3-mz.121-12c.EA1.bin
|
IOS SMI crypto image file.
This image has the Secure Shell (SSH) and Layer 2+ features.
|
c3550-i9k2l2q3-tar.121-12c.EA1.tar
|
IOS SMI crypto image file and CMS files.
This image has the SSH and Layer 2+ features.
|
c3550-i5k2l2q3-mz.121-12c.EA1.bin
|
IOS EMI crypto image file.
This image has the SSH, Layer 2, and Layer 3 features.
|
c3550-i5k2l2q3-tar.121-12c.EA1.tar
|
IOS EMI crypto image file and CMS files.
This image has the SSH, Layer 2, and Layer 3 features.
|
The Catalyst 3550 switch is supported by either the SMI, which provides Layer 2+ features and basic Layer 3 routing, or the EMI, which provides Layer 2+ features, full Layer 3 routing, and advanced services. All Catalyst 3550 Gigabit Ethernet switches are shipped with the EMI installed. Catalyst 3550 Fast Ethernet switches are shipped with either the SMI or the EMI installed. After initial deployment, you can order the Enhanced Multilayer Software Image Upgrade kit to upgrade the Catalyst 3550 Fast Ethernet switches from the SMI to the EMI.
Upgrading a Switch by Using CMS
You can upgrade switch software by using CMS. From the menu bar, select Administration > Software Upgrade. For detailed instructions, click Help.
Caution If you are copying the crypto image to the switch, the bootloader can take up to 30 seconds to upgrade. Do not power cycle the switch while you are copying the image to the switch. If a power failure occurs when you are copying the image, call Cisco Systems immediately.
Upgrading a Switch by Using the CLI
This procedure is for copying the combined .tar file to the Catalyst 3550 switch. You copy the file to the switch from a TFTP server and extract the files. You can download an image file and replace or keep the current image.
Caution If you are copying the crypto image to the switch, the bootloader can take up to 30 seconds to upgrade. Do not power cycle the switch while you are copying the image to the switch. If a power failure occurs when you are copying the image, call Cisco Systems immediately.
To download software, and if necessary, the TFTP server application, follow these steps:
Step 1 Use Table 5 to identify the file that you want to download.
Step 2 Download the software image file.
•If you have a SmartNet support contract, go to this URL and log in to download the appropriate files:
http://www.cisco.com/kobayashi/sw-center/sw-lan.shtml
•If you do not have a SmartNet contract, go to this URL and follow the instructions to register on Cisco.com and download the appropriate files:
http://www.cisco.com/public/sw-center/sw-lan.shtml
To download the SMI and EMI files, select Catalyst 3550 software.
To obtain authorization and to download the crypto software files, select Catalyst 3550 3DES Cryptographic Software.
Step 3 Download the Cisco TFTP server from the URL link from Step 2, if necessary. The information on this page describes how to download and configure the TFTP server.
Step 4 Copy the image to the appropriate TFTP directory on the workstation, and make sure the TFTP server is properly configured.
For more information, refer to Appendix B in the Catalyst 3550 Multilayer Switch Software Configuration Guide.
Step 5 Log in to the switch through the console port or a Telnet session.
Step 6 Check your VLAN 1 configuration by using the show interfaces vlan 1 privileged EXEC command, and verify that VLAN 1 is part of the same network as the TFTP server. (Check the Internet address is line near the top of the display.)
Step 7 Download the image file from the TFTP server to the switch. If you are installing the same version of software that is currently on the switch, overwrite the current image by using this privileged EXEC command:
archive download-sw /overwrite /reload tftp:[[//location]/directory]/image-name.tar
The /overwrite option overwrites the software image in Flash memory with the downloaded one.
The /reload option reloads the system after downloading the image unless the configuration has been changed and not been saved.
For //location, specify the IP address of the TFTP server.
For /directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive.
This example shows how to download an image from a TFTP server at 198.30.20.19 and to overwrite the image on the switch:
Switch# archive download-sw /overwrite
tftp://198.30.20.19/c3550-i5q3l2-tar.121-12c.EA1.tar
You can also download the image file from the TFTP server to the switch and keep the current image by replacing the /overwrite option with the /leave-old-sw option.
Upgrading with a Nondefault System MTU Setting
If the switch was running Release 12.1(8)EA1c or earlier and you had used the system mtu global configuration command to configure a nondefault system maximum transmission unit (MTU) size on your switch, follow these steps to upgrade your switch to Release 12.1(11)EA1 or later:
Step 1 Upgrade the IOS software to Release 12.1(11)EA1 or later.
Step 2 If a system MTU size of greater than 2000 is configured on the Catalyst 3550-12T or Catalyst 3550-12G, use the system mtu global configuration command to set it to the maximum supported MTU size.
Note The maximum allowable system MTU for Catalyst 3550 Gigabit Ethernet switches
is 2000 bytes; the maximum system MTU for Fast Ethernet switches is 1546 bytes.
Step 3 Save the running configuration by entering the copy running-config startup-config privileged EXEC command.
Step 4 Reload the switch by using the new IOS software.
Step 5 When the switch comes back up with Release 12.1(11)EA1 or later, reload the switch a second time by using the reload privileged EXEC command so that the system mtu command takes effect.
Recovering from Software Failure
If the software fails, you can reload the software. For detailed recovery procedures, refer to the "Troubleshooting" chapter in the Catalyst 3550 Multilayer Switch Software Configuration Guide.
Installation Notes
You can assign IP information to your switch by using the setup program, the Dynamic Host Configuration Protocol (DHCP)-based autoconfiguration (refer to the Catalyst 3550 Multilayer Switch Software Configuration Guide), or by manually assigning an IP address (refer to the Catalyst 3550 Multilayer Switch Software Configuration Guide).
These are the installation procedures:
•"Setting Up the Catalyst 3550 Initial Configuration" section
•"Accessing CMS" section
Setting Up the Catalyst 3550 Initial Configuration
The first time that you access the switch, it runs a setup program that prompts you for an IP address and other configuration information necessary for the switch to communicate with the local routers and the Internet. This information is also required if you plan to use the CMS to configure and manage the switch.
Note If the switch will be a cluster member managed through the IP address of the command switch, it is not necessary to assign IP information or a password. If you are configuring the switch as a standalone switch or as a command switch, you must assign IP information.
Follow these steps to create an initial configuration for the switch:
Step 1 Enter Yes at the first two prompts.
Would you like to enter the initial configuration dialog? [yes/no]: yes
At any point you may enter a question mark '?' for help.
Use ctrl-c to abort configuration dialog at any prompt.
Default settings are in square brackets '[]'.
Basic management setup configures only enough connectivity
for management of the system, extended setup will ask you
to configure each interface on the system.
Would you like to enter basic management setup? [yes/no]: yes
Step 2 Enter a host name for the switch, and press Return.
On a command switch, the host name is limited to 28 characters; on a member switch to 31 characters. Do not use -n, where n is a number, as the last character in a host name for any switch.
Enter host name [Switch]: host_name
Step 3 Enter a secret password, and press Return.
The password can be from 1 to 25 alphanumeric characters, can start with a number, is case sensitive, allows spaces, but ignores leading spaces.
Enter enable secret: secret_password
Step 4 Enter an enable password, and press Return.
Enter enable password: enable_password
Step 5 Enter a virtual terminal (Telnet) password, and press Return.
The password can be from 1 to 25 alphanumeric characters, is case sensitive, allows spaces, but ignores leading spaces.
Enter virtual terminal password: terminal-password
Step 6 (Optional) Configure Simple Network Management Protocol (SNMP) by responding to the prompts.
Step 7 Enter the interface name (physical interface or VLAN name) of the interface that connects to the management network, and press Return. For this release, always use vlan 1 as that interface.
Enter interface name used to connect to the
management network from the above interface summary: vlan 1
Step 8 Configure the interface by entering the switch IP address and subnet mask and pressing Return:
Configuring interface vlan 1:
Configure IP on this interface? [yes]: yes
IP address for this interface: 10.4.120.106
Subnet mask for this interface [255.0.0.0]: 255.255.255.0
Step 9 Enter Y to configure the switch as the cluster command switch. Enter N to configure it as a member switch or as a standalone switch.
If you enter N, the switch appears as a candidate switch in the CMS. In this case, the message in Step 10 is not displayed.
Would you like to enable as a cluster command switch? [yes/no]: yes
Step 10 Assign a name to the cluster, and press Return.
Enter cluster name: cluster_name
The cluster name can be 1 to 31 alphanumeric characters, dashes, or underscores.
The initial configuration appears:
The following configuration command script was created:
enable secret 5 $1$LiBw$0Xc1wyT.PXPkuhFwqyhVi0
enable password enable-password
password terminal-password
snmp-server community public
ip address 10.4.120.106 255.255.255.0
interface GigabitEthernet0/1
interface GigabitEthernet0/2
interface GigabitEthernet0/12
cluster enable cluster-name
Step 11 These choices are displayed:
[0] Go to the IOS command prompt without saving this config.
[1] Return back to the setup without saving this config.
[2] Save this configuration to nvram and exit.
Enter your selection [2]:2
Make your selection, and press Return.
After you complete the setup program, the switch can run the created default configuration. If you want to change this configuration or want to perform other management tasks, use one of these tools:
•Command-line interface (CLI)
•Cluster Management Suite (CMS) from your browser
Accessing CMS
Before using the web-based CMS tools, see the "Software Compatibility" section and the "Installing the Required Plug-In" section to set up the appropriate browser options. After you have assigned an IP address to the switch and installed the plug-in, you can access the switch from your browser and use the CMS to configure other switches.
Note If you have downloaded a new version of the CMS, you must clear your browser cache before launching the new CMS version.
The browser prompts for a username and password when you access CMS:
•If no username is configured on your switch (the default), you only need to enter the enable password in the appropriate field. For more information, see the "Displaying CMS" section.
•If you are not using the default method of authentication (the enable password), you need to configure the HTTP server interface with the method of authentication used on the switch. For more information, see the "Configuring the HTTP Server" section.
Configuring the HTTP Server
Beginning in privileged EXEC mode, follow these steps to configure the HTTP server interface:
| |
Command
|
Purpose
|
Step 1
|
configure terminal
|
Enter global configuration mode.
|
Step 2
|
ip http authentication {aaa | enable | local | tacacs}
|
Configure the HTTP server interface for the type of authentication you want to use.
•aaa—Indicates that the AAA facility is used for authentication.
•enable—Indicates that the enable password, which is the default method of HTTP server user authentication, is being used.
•local—Indicates that the local user database as defined on the Cisco router or access server is used for authentication.
•tacacs—Indicates that the TACACS server is used for authentication.
|
Step 3
|
end
|
Return to privileged EXEC mode.
|
Step 4
|
show running-config
|
Verify your entries.
|
After you have configured the HTTP server interface, display the CMS access page as described in the "Displaying CMS" section.
Displaying CMS
To display the CMS access page, follow these steps:
Step 1 Enter the switch IP address in the browser Location field (Netscape Communicator) or Address field (Internet Explorer), and press Return.
Step 2 Enter your username and password when prompted.
The Cisco Systems Access page appears. For more information on setting passwords and privilege levels, refer to the Catalyst 3550 Multilayer Switch Software Configuration Guide.
Step 3 Click Web Console to launch the CMS applet.
When you access CMS from a standalone or a cluster-member switch, Device Manager appears.
New Features
These are the new supported hardware and the new software features provided in IOS Release 12.1(12c)EA1:
•"New Hardware Features" section
•"New Software Features" section
New Hardware Features
Cisco IOS Release 12.1(12c)EA1 supports the Catalyst 3550-24PWR switch.
For a list of all supported hardware, see the "Hardware Supported" section.
New Software Features
Cisco IOS Release 12.1(12c)EA1 contains these new features or enhancements:
•Kerberos security system to authenticate requests for network resources by using a trusted third party
•Automatic QoS (auto-QoS) to simplify the deployment of existing QoS features by classifying traffic and configuring egress queues (Voice over IP only)
•Layer 2 traceroute to identify the physical path that a packet takes from a source device to a destination device
•Support for Link Aggregation Control Protocol (LACP) to facilitate the automatic creation of EtherChannels by exchanging packets between Ethernet interfaces. LACP is defined in IEEE 802.3AD
•Switched Port Analyzer (SPAN) and remote SPAN (RSPAN) support of Intrusion Detection Systems (IDSs) to monitor, repel, and report network security violations
•Support for the capabilities keyword with the show interfaces privileged EXEC command
•Support for these new security features:
–802.1X with per-user access control lists for providing different levels of network access and service to an 802.1X-authenticated user
–802.1X with VLAN assignment for restricting 802.1X-authenticated users to a specified VLAN
–802.1X with port security for controlling access to 802.1X multiple-host ports
–802.1X with voice VLAN to permit an IP phone access to the voice VLAN irrespective of the authorized or unauthorized state of the port
•CMS support for these features:
–Ping and Trace—Perform a ping, Layer 2 traceroute, or Layer 3 traceroute operation on or to a specific address.
–Front Panel View Enhancements—Choose the switches in a cluster that are displayed in the Front Panel view window.
Limitations and Restrictions
You should review this section before you begin working with the switches. These are known limitations that will not be fixed, and there is not always a workaround. Some features might not work as documented, and some features could be affected by recent changes to the switch hardware or software.
These are the limitations and restrictions:
•"IOS Limitations and Restrictions" section
•"Cluster Limitations and Restrictions" section
•"CMS Limitations and Restrictions" section
IOS Limitations and Restrictions
These limitations apply to IOS configuration:
•When you insert a GigaStack GBIC in a GBIC module slot, the CPU utilization increases by six percent. This increase occurs for each GigaStack GBIC added to the switch. Other types of GBICs do not cause additional CPU utilization.
There is no workaround. (CSCdx90515)
•Not all traffic is properly mirrored by RSPAN when a port is monitored for egress traffic and the RSPAN VLAN is carried through a Layer 2 Protocol Tunnel to the RSPAN destination switch.
This happens because the MAC addresses for the original packets as well as the mirrored RSPAN packets are all learned on the tunnel VLAN, so the RSPAN traffic is no longer properly segregated on the tunneling switches.
The workaround is to not include any RSPAN VLANs in any Layer 2 Protocol tunnels unless the tunnel is dedicated to a single RSPAN VLAN. (CSCdy37188)
•Multicast traffic can be temporarily lost when a link comes up in a redundant network and causes the reverse path forwarding (RPF) to change. This only occurs when there are multiple paths between the rendezvous point (RP) and the multicast source.
There is no workaround. (CSCdw27519)
•When you reboot a Catalyst 3550-24-FX switch, it might loop back packets received on a 1000BASE-FX port to its link partner. This can occur before the IOS software takes control of the system and lasts for about 200 milliseconds.
As a result, the link partner might shut down the port when it detects loopback packets, or MAC addresses might be learned on the wrong ports on upstream switches. The network might be unable to deliver packets to a few devices for up to 5 minutes after rebooting the Catalyst 3550-24-FX switch when:
–The Catalyst 3550-24-FX switch is connected to one or more switches in the network.
–Spanning tree is disabled in the network or the Port Fast feature is enabled on the ports connected to the Catalyst 3550-24-FX switch.
–The Catalyst 3550-24-FX switch is powered cycled or reloaded from CLI.
–One or more devices in the network transmit a broadcast or multicast packet during the 200-millisecond timing window while the Catalyst 3550-24-FX switch is booting.
This problem corrects itself after five minutes or when these devices transmit a broadcast or multicast packet, whichever comes first.
The workaround is to enable spanning tree in the network and to make sure that the Port Fast feature is disabled on all ports connected to the Catalyst 3550-24-FX switch. (CSCdx45558)
•Ingress forwarding on a SPAN destination port does not work if there is an egress SPAN source port in the session with port security or 802.1X enabled. (CSCdy44646)
•An RSPAN source session does not forward monitored traffic to the RSPAN destination session if there is an egress SPAN source port in the session with port security or 802.1X enabled. (CSCdy21035)
•Storm control or traffic suppression (configured by using the storm-control {broadcast | multicast | unicast} level level [.level] interface configuration command) is supported only on physical interfaces; it is not supported on EtherChannel port channels even though you can enter these commands through the CLI.
•The Cisco RPS 300 Redundant Power System supports the Catalyst 3550 multilayer switch and provides redundancy for up to six connected devices until one of these devices requires backup power. If a connected device has a power failure, the RPS immediately begins supplying power to that device and sends status information to other connected devices that it is no longer available as a backup power source. As described in the device documentation, when the RPS LED is amber, the RPS is connected but down. However, this might merely mean that the RPS is in standby mode. Press the Standby/Active button on the RPS to put it into active mode. You can view RPS status through the CLI by using the show rps privileged EXEC command. For more information, refer to the RPS 300 Hardware Installation Guide.
Note The Cisco RPS 300 does not support the Catalyst 3550-24PWR switch.
•You can connect the switch to a PC by using the switch console port and the supplied rollover cable and the DB-9 adapter. You need to provide a RJ-45-to-DB-25 female DTE adapter if you want to connect the switch console port to a terminal. You can order a kit (part number ACS-DSBUASYN=) with this RJ-45-to-DB-25 female DTE adapter from Cisco.
•Modifying a multicast boundary access list does not prevent packets from being forwarded by any multicast routes that were in existence before the access list was modified if the packets arriving on the input interface do not violate the boundary. However, no new multicast routes that violate the updated version of the multicast boundary access list are learned, and any multicast routes that are in violation of the updated access list are not relearned if they age out.
After updating a multicast boundary, the workaround is to use the clear ip mroute privileged EXEC command to delete any existing multicast routes that violate the updated boundary. (CSCdr79083)
•When an IP packet with a cyclic redundancy check (CRC) error is received, the per-packet per-Differentiated Service Code Point (DSCP) counter (for DSCP 0) is incremented. Normal networks should not have packets with CRC errors. (CSCdr85898)
•The mac-address interface configuration command does not properly assign a MAC address to an interface. This command is not supported on Catalyst 3550 switches. (CSCds11328)
•If you configure the DHCP server to allocate addresses from a pool to the switch, two devices on the network might have the same IP address. Pooled addresses are temporarily allocated to a device and are returned to the pool when not in use. If you save the configuration file after the switch receives such an address, the pooled address is saved, and the switch does not attempt to access the DHCP server after a reboot to receive a new IP address. As a result, two devices might have the same IP address.
The workaround is to make sure that you configure the DHCP server with reserved leases that are bound to each switch by the switch hardware address. (CSCds55220)
•The show ip mroute count privileged EXEC command might display incorrect packet counts. In certain transient states (for example, when a multicast stream is forwarded only to the CPU during the route-learning process and the CPU is programming this route into the hardware), a multicast stream packet count might be counted twice. Do not trust the counter during this transient state. (CSCds61396)
•When changing the link speed of a Gigabit Ethernet port from 1000 Mbps to 100 Mbps, there is a slight chance that the port will stop transmitting packets. If this occurs, shut down the port, and re-enable it by using the shutdown and no shutdown interface configuration commands. (CSCds84279)
•In IP multicast routing and fallback bridging, certain hardware features are used to replicate packets for the different VLANs of an outgoing trunk port. If the incoming speed is line rate, the outgoing interface cannot duplicate that speed (because of the replication of the packets). As a result, certain replicated packets are dropped. (CSCdt06418)
•When you use the no interface port-channel global configuration command to remove an EtherChannel group, the ports in the port group change to the administratively down state.
When you remove an EtherChannel group, enter the no shutdown interface configuration command on the interfaces that belonged to the port group to bring them back on line. (CSCdt10825)
•In the output displayed after a show interface interface-id privileged EXEC command, the output buffer failures field shows the number of packets lost before replication, whereas the packets output field shows the successful transmitted packets after replication. To determine actual discarded frames, multiply the output buffer failures by the number of VLANs on which the multicast data is replicated. (CSCdt26928)
•Internet Group Management Protocol (IGMP) packets classified by QoS to map the DSCP value and the class of service (CoS) value in a QoS policy map might only modify the DSCP property and leave the CoS value at zero. (CSCdt27705)
•If you assign both tail-drop threshold percentages to 100 percent by using the wrr-queue threshold interface configuration command and display QoS information for this interface by using the show mls qos interface statistics privileged command, the drop-count statistics are always zero even if the thresholds were exceeded. To display the total number of discarded packets, use the show controllers ethernet-controllers interface-id privileged EXEC command. In the display, the number of discarded frames includes the frames that were dropped when the tail-drop thresholds were exceeded. (CSCdt29703)
•Open Shortest Path First (OSPF) path costs and Interior Gateway Routing Protocol (IGRP) metrics are incorrect for switch virtual interface (SVI) ports. You can manually configure the bandwidth of the SVI by using the bandwidth interface configuration command. Changing the bandwidth of the interface changes the routing metric for the routes when the SVI is used as an outgoing interface. (CSCdt29806)
•On the Catalyst 3550 switch, coldStart and warmStart traps are not consistently sent. (CSCdt33779)
•Remote Monitoring (RMON) collection functions on physical interfaces, but it is not supported on EtherChannels and SVIs. (CSCdt36101)
•Multicast router information is displayed in the show ip igmp snooping mrouter privileged EXEC command when IGMP snooping is disabled. Multicast VLAN Registration (MVR) and IGMP snooping use the same commands to display multicast router information. In this case, MVR is enabled, and IGMP snooping is disabled. (CSCdt48002)
•When a VLAN interface has been disabled and restarted multiple times by using the shutdown and no shutdown interface configuration commands, the interface might not restart following a no shutdown command. To restart the interface, re-enter a shutdown and no shutdown command sequence. (CSCdt54435)
•When you configure the ip pim spt-threshold infinity interface configuration command, you want all sources for the specified group to use the shared tree and not use the source tree. However, the switch does not automatically start to use the shared tree. No connectivity problem occurs, but the switch continues to use the shortest path tree for multicast group entries already installed in the multicast routing table. You can enter the clear ip mroute * privileged EXEC command to force the change to the shared tree. (CSCdt60412)
•If the number of multicast routes configured on the switch is greater than the switch can support, it might run out of available memory, which can cause it to reboot. This is a limitation in the platform-independent code.
The workaround is to not configure the switch to operate with more than the maximum number of supported multicast routes. You can use the show sdm prefer and show sdm prefer routing privileged EXEC commands to view approximate maximum configuration guidelines for the current SDM template and the routing template. (CSCdt63354)
•Configuring too many multicast groups might result in an extremely low memory condition and cause the software control data structure to go out of sync, causing unpredictable forwarding behavior. The memory resources can only be recovered by entering the clear ip mroute privileged EXEC command. To prevent this situation, do not configure more than the recommended multicast routes on the switch. (CSCdt63480)
•The dec keyword is not supported in the bridge bridge-group protocol global configuration command. If two Catalyst 3550 switches are connected to each other through an interface that is configured for IP routing and fallback bridging, and the bridge group is configured with the bridge bridge-group protocol dec command, both switches act as if they were the spanning tree root. Therefore, spanning-tree loops might be undetected. (CSCdt63589)
•When you configure an EtherChannel between a Catalyst 3550 and a Catalyst 1900 switch, some of Catalyst 3550 links in the EtherChannel might go down, but one link in the channel remains up, and connectivity is maintained.
The workaround is to disable the Port Aggregation Protocol (PAgP) on both devices by using the channel-group channel-group-number mode on interface configuration command. PAgP negotiation between these two devices is not reliable. (CSCdt78727)
•When the switch is operating with equal-cost routes and it is required to learn more unicast routes than it can support, the CPU might run out of memory, and the switch might fail.
The workaround is to remain within the documented recommended and supported limits. (CSCdt79172)
•The behavior of a software access control list (ACL) with QoS is different from a hardware ACL with QoS. On the Catalyst 3550 switch, when the QoS hardware rewrites the DSCP of a packet, the rewriting of this field happens before software running on the CPU examines the packet, and the CPU sees only the new value and not the original DSCP value.
When the security hardware ACL matches a packet on input, the match uses the original DSCP value. For output security ACLs, the security ACL hardware should match against the final, possibly changed, DSCP value as set by the QoS hardware. Under some circumstances, a match to a security ACL in hardware prevents the QoS hardware from rewriting the DSCP and causes the CPU to use the original DSCP.
If a security ACL is applied in software (because the ACL did not fit into hardware, and packets were sent to the CPU for examination), the match probably uses the new DSCP value as determined by the QoS hardware, regardless of whether the ACL is applied at the input or at the output. When packets are logged by the ACL, this problem can also affect whether or not a match is logged by the CPU even if the ACL fits into hardware and the permit or deny filtering was completed in hardware.
To avoid these issues, whenever the switch rewrites the DSCP of any packet to a value different from the original DSCP, security ACLs should not test against DSCP values in any of their access control elements (ACEs), regardless of whether the ACL is being applied to an IP access group or to a VLAN map. This restriction does not apply to ACLs used in QoS class maps.
If the switch is not configured to rewrite the DSCP value of any packet, it is safe to match against DSCP in ACLs used for IP access groups or for VLAN maps because the DSCP does not change as the packet is processed by the switch.
The DSCP field of an IP packet encompasses the two fields that were originally designated precedence and TOS (type of service). Statements relating to DSCP apply equally to either IP precedence or IP TOS. (CSCdt94355)
•If you configure a trunk port for Dynamic Trunking Protocol (DTP) nonegotiate mode and change the encapsulation type from ISL to 802.1Q by using the switchport trunk encapsulation interface configuration command, the port becomes an access port and is no longer trunking. (CSCdv46715)
•On earlier versions of Catalyst 3550-24 switches, if a 10/100BASE-TX port on the switch is connected to a Catalyst 2820 or Catalyst 1900 switch through an ISL trunk at 100 Mbps, bidirectional communication cannot be established. The Catalyst 2820 or Catalyst 1900 switch identifies the Catalyst 3550-24 switch as a CDP neighbor, but the Catalyst 3550-24 switch does not recognize the Catalyst 2820 or Catalyst 1900 switch. On these switches, you should not use ISL trunks between the Catalyst 3550-24 and a Catalyst 2820 or Catalyst 1900 switch. Configure the link as an access link instead of a trunk link.
This problem has been fixed in hardware on Catalyst 3550-24 switches with motherboard assembly number 73-5700-08 or later. To determine the board level on your switch, enter the show version privileged EXEC. Motherboard information appears toward the end of the output display. (CSCdv68158)
•When IGMP filtering is enabled and you use the ip igmp profile global configuration command to create an IGMP filter, reserved multicast addresses cannot be filtered. Because IGMP filtering uses only Layer 3 addresses to filter IGMP reports and due to mapping between Layer 3 multicast addresses and Ethernet multicast addresses, reserved groups (224.0.0.x) are always allowed through the switch. In addition, aliased groups can leak through the switch. For example, if a user is allowed to receive reports from group 225.1.2.3, but not from group 230.1.2.3, aliasing will cause the user to receive reports from 230.1.2.3. Aliasing of reserved addresses means that all groups of the form y.0.0.x are allowed through. (CSCdv73626)
If you use the ip igmp max-groups interface configuration command to set the maximum number of IGMP groups for an interface to 0, the port still receives group reports from reserved multicast groups (224.0.0.x) and their Layer 2 aliases (y.0.0.x). (CSCdv79832)
•The switch might reload when it is executing the no snmp-server host global configuration command. This is a rare condition that can happen if SNMP traps or informs are enabled and the SNMP agent attempts to send a trap to the host just as it is being removed from the configuration and if the IP address of the host (or the gateway to reach the host) has not been resolved by Address Resolution Protocol (ARP).
The workaround is to ensure that the target host or the next-hop gateway to that host is in the ARP cache (for example, by using a ping command) before removing it from the SNMP configuration. Alternatively, disable all SNMP traps and informs before removing any hosts from the SNMP configuration. (CSCdw44266)
•When you access CISCO-STACK-MIB portTable, the mapping might be off by one from the mapping given by the switch. The objects in this table are indexed by two numbers: portModuleIndex and portIndex. The allowable values for portModuleIndex are 1 through 16. Because 0 is not an allowable value, the value 1 represents module 0.
The workaround is to use the value 1 to represent module 0. (CSCdw71848)
•If a port on the Catalyst 3550 switch that is running the Multiple Spanning Tree Protocol (MSTP) is connected to another switch that belongs to a different multiple spanning tree (MST) region, the Catalyst 3550 port is not recognized as a boundary port when you start the protocol migration process by using the clear spanning-tree detected-protocols interface interface-id privileged EXEC command. This problem occurs only on the root bridge, and when the root bridge is cleared, the boundary ports are not shown because the designated ports do not receive any bridge protocol data units (BPDUs) unless a topology change occurs. This is the intended behavior.
The workaround is to configure the Catalyst 3550 switch for PVST by using the spanning-tree mode pvst global configuration command bridge, and then change it to MSTP by using the spanning-tree mode mst global configuration command. (CSCdx10808)
•If you apply an ACL to an interface that has a QoS policy map attached and the ACL is configured so that the packet should be forwarded by the CPU or if the configured ACL cannot fit into the ternary content addressable memory (TCAM), all packets received from this interface are forwarded to the CPU. Because traffic forwarded to the CPU cannot be policed by the policer configured on the interface, this traffic is not accurately rate-limited to the configured police rate.
The workaround, when QoS rate limiting is configured on an interface, is to configure applied ACLs so that packets are not forwarded by the CPU or reduce the number of ACEs in the ACL so that it can fit into the TCAM. (CSCdx30485)
•Catalyst 3550 switches do not take into account the Preamble and Inter Frame Gap (IFG) when rate limiting traffic, which could result in a slightly inaccurate policing rate on a long burst of small-sized frames, where the ratio of the Preamble and IFG to frame size is more significant. This should not be an issue in an environment where the frames are a mix of different sizes.
•If the switch fails for any reason while you are exiting VLAN configuration mode (accessed by entering the vlan database privileged EXEC command), there is a slight chance that the VLAN database might get corrupted. After resetting from the switch, you might see these messages on the console:
%SW_VLAN-4-VTP_INVALID_DATABASE_DATA: VLAN manager received bad data of type device
type: value 0 from vtp database
$SW_VLAN-3-VTP_PROTOCOL_ERROR: VTP protocol code internal error
The workaround is to use the delete flash:vlan.dat privileged EXEC command to delete the corrupted VLAN database. Then reload the switch by using the reload privileged EXC command. (CSCdx19540)
•When a Cisco RPS 300 Redundant Power System provides power to a switch, after the switch power supply is restored the RPS 300 continues to provide power until the RPS mode button is pressed. At this point, some switches restart, depending on how quickly the switch internal power supply resumes operation. (CSCdx81023)
•Inserting GigaStack Gigabit Interface Converter (GBIC) modules in the switch cause an increase in the CPU usage. (CSCdx90515)
•Hot Standby Routing Protocol (HSRP) does not support configuration of overlapping addresses in different VPN routing and forwarding (VRF) tables. (CSCdy14520)
•When 1000 VLANs and more than 40 trunk ports are configured, and the spanning-tree mode changes from MSTP to PVST or vice versa, this message appears on the console:
%ETHCNTR-3-RA_ALLOC_ERROR: RAM Access write pool I/O memory allocation failure
There is no workaround. However, we recommend that you reload the switch by using the reload privileged EXEC command. To avoid this problem, configure the system with fewer VLANs and fewer trunk ports, or use the switchport trunk allowed vlan interface configuration command to reduce the number of active VLANs on each trunk port. (CSCdx20106)
Cluster Limitations and Restrictions
These limitations apply to cluster configuration:
•When there is a transition from the cluster active command switch to the standby command switch, Catalyst 1900, Catalyst 2820, and Catalyst 2900 4-MB switches that are cluster members might lose their cluster configuration. You must manually add these switches back to the cluster.
(CSCds32517, CSCds44529, CSCds55711, CSCds55787, CSCdt70872)
•When a Catalyst 2900 XL or Catalyst 3500 XL cluster command switch is connected to a Catalyst 3550 switch, the command switch does not find any cluster candidates beyond the Catalyst 3550 switch if it is not a member of the cluster. You must add the Catalyst 3550 switch to the cluster. You can then see any cluster candidates connected to it. (CSCdt09918)
•If both the active command-switch and the standby command switch fail at the same time, the cluster is not automatically recreated. Even if there is a third passive command switch, it might not recreate all cluster members because it might not have all the latest cluster configuration information. You must manually recreate the cluster if both the active and standby command switches simultaneously fail. (CSCdt43501)
CMS Limitations and Restrictions
These limitations apply to CMS configuration:
•Host names and Domain Name System (DNS) server names that contain commas on a cluster command switch, member switch, or candidate switch can cause CMS to behave unexpectedly. You can avoid this instability in the interface by not using commas in host names or DNS names. Do not enter commas when also entering multiple D
