Table Of Contents
Release Notes for the
Catalyst 3550 Multilayer Switch
Cisco IOS Release 12.2(25)SE
Contents
System Requirements
Hardware Supported
Device Manager System Requirements
Hardware Requirements
Software Requirements
Cluster Compatibility
Upgrading the Switch Software
Finding the Software Version and Feature Set Running on the Switch
Deciding Which Files to Download from Cisco.com
Upgrading a Switch by Using Device Manager or Network Assistant
Upgrading a Switch by Using the CLI
Upgrading with a Nondefault System MTU Setting
Recovering from a Software Failure
Installation Notes
New Features
New Hardware Features
New Software Features
Limitations and Restrictions
Cisco IOS Limitations and Restrictions
802.1x
ACLs
Connected Devices
Configuration
DHCP
HSRP
IGMP
MAC Addressing
MIBs
Multicasting
Port Security
QoS
Routing
SNMP
SPAN and RSPAN
Spanning Tree
VLAN
Device Manager Limitations and Restrictions
Important Notes
Cisco IOS Notes
Device Manager Notes
Open Caveats
Open Cisco IOS Caveats
Open Device Manager Caveats
Resolved Caveats
Documentation Updates
Getting Started Guide
Regulatory Compliance and Safety Information Guide
Documentation Flyer
Hardware Installation Guide
Related Documentation
Obtaining Documentation
Cisco.com
Ordering Documentation
Documentation Feedback
Obtaining Technical Assistance
Cisco Technical Support Website
Submitting a Service Request
Definitions of Service Request Severity
Obtaining Additional Publications and Information
Release Notes for the
Catalyst 3550 Multilayer Switch
Cisco IOS Release 12.2(25)SE
Revised January 24 2007
Cisco IOS Release 12.2(25)SE runs on all Catalyst 3550 multilayer switches.
Note 
Beginning with this release, Cluster Management Suite (CMS) is no longer available with the switch software. You can use the embedded GUI referred to as the device manager or the Network Assistant standalone application (available on Cisco.com) to manage one more switches. For more information about the device manager and the Network Assistant, see the "New Software Features" section.
These release notes include important information about this Cisco IOS release and any limitations, restrictions, and caveats that apply to it. Verify that these are the correct release notes for your switch:
•If you are installing a new switch, refer to the Cisco IOS release label on the rear panel of your switch.
•If your switch is on, use the show version privileged EXEC command. See the "Finding the Software Version and Feature Set Running on the Switch" section.
•If you are upgrading to a new release, refer to the software upgrade filename for the Cisco IOS version. See the "Deciding Which Files to Download from Cisco.com" section.
For the complete list of Catalyst 3550 switch documentation, see the "Related Documentation" section.
You can download the switch software from these sites:
•http://www.cisco.com/public/sw-center/sw-lan.shtml
(for registered Cisco.com users with a login password)
•http://www.cisco.com/public/sw-center/sw-lan.shtml
(for nonregistered Cisco.com users)
This Cisco IOS release is part of a special release of Cisco IOS software that is not released on the same 8-week maintenance cycle that is used for other platforms. As maintenance releases and future Cisco IOS releases become available, they will be posted to Cisco.com (previously Cisco Connection Online [CCO]) in the Cisco IOS software area.
Contents
This information is in the release notes:
•"System Requirements" section
•"Upgrading the Switch Software" section
•"Installation Notes" section
•"New Features" section
•"Limitations and Restrictions" section
•"Important Notes" section
•"Open Caveats" section
•"Resolved Caveats" section
•"Documentation Updates" section
•"Related Documentation" section
•"Obtaining Documentation" section
•"Documentation Feedback" section
•"Obtaining Technical Assistance" section
•"Obtaining Additional Publications and Information" section
System Requirements
The system requirements for this release are described in these sections:
•"Hardware Supported" section
•"Device Manager System Requirements" section
•"Cluster Compatibility" section
Hardware Supported
Table 1lists the hardware supported by this release.
Table 1 Supported Hardware
Switch
|
Description
|
Catalyst 3550-12G
|
10 GBIC-based Gigabit Ethernet slots and 2 Gigabit Ethernet 10/100/1000BASE-T ports
|
Catalyst 3550-12T
|
10 Gigabit Ethernet 10/100/1000BASE-T ports and 2 GBIC1 -based Gigabit Ethernet slots
|
Catalyst 3550-24
|
24 autosensing 10/100 Ethernet ports and 2 GBIC-based Gigabit Ethernet slots
|
Catalyst 3550-24-DC
|
24 autosensing 10/100 Ethernet ports, 2 GBIC-based Gigabit Ethernet slots, and an on-board DC power converter
|
Catalyst 3550-24-FX
|
24 100BASE-FX ports and 2 GBIC-based Gigabit Ethernet slots
|
Catalyst 3550-24PWR
|
24 autosensing 10/100 Ethernet ports, 2 GBIC-based Gigabit Ethernet slots, ability to provide power for Cisco IP Phones and Cisco Aironet Access Points from all 10/100 Ethernet ports, auto-detection and control of inline power on a per-port basis on all 10/100 ports
|
Catalyst 3550-48
|
48 autosensing 10/100 Ethernet ports and 2 GBIC-based Gigabit Ethernet slots
|
GBIC modules
|
•1000BASE-SX GBIC
•1000BASE-LX/LH GBIC
•1000BASE-ZX GBIC
•1000BASE-T GBIC
•GigaStack GBIC
•CWDM2 fiber-optic GBIC
•DWDM3 fiber-optic GBIC
|
Redundant power system
|
Cisco RPS 300 Redundant Power System4
Cisco RPS 675 Redundant Power System5
|
Device Manager System Requirements
These sections describe the hardware and software requirements for using the device manager:
•"Hardware Requirements" section
•"Software Requirements" section
Hardware Requirements
Table 2 lists the minimum hardware requirements for running the device manager.
Table 2 Minimum Hardware Requirements
Processor Speed
|
DRAM
|
Number of Colors
|
Resolution
|
Font Size
|
Intel Pentium II1
|
64 MB2
|
256
|
1024 x 768
|
Small
|
Software Requirements
Table 3 lists the supported operating systems and browsers for using the device manager. The device manager verifies the browser version when starting a session to ensure that the browser is supported.
Note The device manager does not require a plug-in.
Table 3 Supported Operating Systems and Browsers
Operating System
|
Minimum Service Pack or Patch
|
Microsoft Internet Explorer 1
|
Netscape Navigator
|
Windows 98
|
None
|
5.5 or 6.0
|
7.1
|
Windows NT 4.0
|
Service Pack 6 or later
|
5.5 or 6.0
|
7.1
|
Windows 2000
|
None
|
5.5 or 6.0
|
7.1
|
Windows XP
|
None
|
5.5 or 6.0
|
7.1
|
Cluster Compatibility
You cannot create and manage switch clusters through the device manager. To create and manage switch clusters, use the command-line interface (CLI) or the Network Assistant application.
When creating a switch cluster or adding a switch to a cluster, follow these guidelines:
•When you create a switch cluster, we recommend configuring the highest-end switch in your cluster as the command switch.
•If you are managing the cluster through Network Assistant, the switch with the latest software should be the command switch, unless your command switch is running Cisco IOS Release 12.1(19)EA1 or later.
•The standby command switch must be the same type as the command switch. For example, if the command switch is a Catalyst 3750 switch, all standby command switches must be Catalyst 3750 switches.
For additional information about clustering, see the Getting Started with Cisco Network Assistant and the Release Notes for Cisco Network Assistant (not orderable but available on Cisco.com), the software configuration guide, and the command reference.
Upgrading the Switch Software
Before downloading software from Cisco.com to upgrade the switch software, read this section for important information:
•"Finding the Software Version and Feature Set Running on the Switch" section
•"Deciding Which Files to Download from Cisco.com" section
•"Upgrading a Switch by Using Device Manager or Network Assistant" section
•"Upgrading a Switch by Using the CLI" section
•"Recovering from a Software Failure" section
Caution A bootloader upgrade occurs if you are upgrading the switch from a noncryptographic image to cryptographic image, regardless of the current noncryptographic Cisco IOS Release that is running on the switch. The bootloader can take up to 30 seconds to upgrade. Do not power cycle the switch while you are copying this image to the switch. If a power failure occurs when you are copying this image to the switch, call Cisco Systems immediately.
When you upgrade a switch, the switch continues to operate while the new software is copied to flash memory. If flash memory has enough space, the new image is copied to the selected switch but does not replace the running image until you reboot the switch. If a failure occurs during the copy process, you can still reboot your switch by using the old image. If flash memory does not have enough space for two images, the new image is copied over the existing one. Features provided by the new software are not available until you reload the switch.
If a failure occurs while copying a new image to the switch, and the old image has already been deleted, refer to the "Recovering from Corrupted Software" section in the "Troubleshooting" chapter of the software configuration guide.
Finding the Software Version and Feature Set Running on the Switch
The Cisco IOS image is stored as a bin file in a directory that is named with the Cisco IOS release. A subdirectory contains the files needed for web management. The image is stored on the system board flash device (flash:).
You can use the show version privileged EXEC command to see the software version that is running on your switch. The second line displays C3550-I5Q3L2 for the enhanced multilayer software image (EMI) or C3550-I9Q3L2 for the standard multilayer software image (SMI).
Note Although the show version output always shows the software image running on the switch (Layer 2 only or Layer 2 and Layer 3), the model name shown at the end of this display is the factory configuration (SMI or EMI) and does not change if you upgrade the software image.
You can also use the dir filesystem: privileged EXEC command to see the directory names of other software images that you might have stored in flash memory.
Deciding Which Files to Download from Cisco.com
The upgrade procedures in these release notes describe how to perform the upgrade by using a combined tar file. This file contains both the Cisco IOS image file and the files needed for the embedded device manager. To upgrade the switch through the command-line interface (CLI), use the tar file and the archive download-sw privileged EXEC command.
Table 4 lists the software filenames for this release. These files are posted on Cisco.com.
Table 4 Cisco IOS Software Files for Catalyst 3550 Switches
Filename
|
Description
|
c3550-i9q3l2-tar.122-25.SE.tar
|
Cisco IOS SMI image file and device manager files.
This image has Layer 2+ and basic Layer 3 routing features.
|
c3550-i5q3l2-tar.122-25.SE.tar
|
Cisco IOS EMI image file and device manager files.
This image has Layer 2+ and full Layer 3 features.
|
c3550-i9k91l2q3-tar.122-25.SE.tar
|
Cisco IOS SMI cryptographic image file and device manager files. This image has the Kerberos, Secure Shell (SSH), Layer 2+, and basic Layer 3 routing features.
|
c3550-i5k91l2q3-tar.122-25.SE.tar
|
Cisco IOS EMI cryptographic image file and device manager files. This image has the Kerberos, SSH, Layer 2+, and full Layer 3 features.
|
The Catalyst 3550 switch is supported by either the SMI, which provides Layer 2+ features and basic Layer 3 routing, or the EMI, which provides Layer 2+ features, full Layer 3 routing, and advanced services. All Catalyst 3550 Gigabit Ethernet switches are shipped with the EMI installed. Catalyst 3550 Fast Ethernet switches are shipped with either the SMI or the EMI installed. After initial deployment, you can order the Enhanced Multilayer Software Image Upgrade kit to upgrade the Catalyst 3550 Fast Ethernet switches from the SMI to the EMI.
Upgrading a Switch by Using Device Manager or Network Assistant
You can upgrade switch software by using the device manager or Network Assistant. From the feature bar, choose Administration > Software Upgrade. For detailed instructions, click Help.
Note When using the device manager to upgrade your switch, do not use or close your browser session after the upgrade process begins. Wait until after the upgrade process completes.
Upgrading a Switch by Using the CLI
This procedure is for copying the combined tar file to the Catalyst 3550 switch. You copy the file to the switch from a TFTP server and extract the files. You can download an image file and replace or keep the current image. This procedure requires a configured TFTP server.
Caution A bootloader upgrade occurs if you are upgrading the switch from a noncryptographic image to a cryptographic image, regardless of the current noncryptographic Cisco IOS release that is running on the switch. The bootloader can take up to 30 seconds to upgrade. Do not power cycle the switch while you are copying this image to the switch. If a power failure occurs when you are copying this image to the switch, call Cisco Systems immediately.
To download software, follow these steps:
Step 1 Use Table 4 to identify the file that you want to download.
Step 2 Download the software image file.
•If you have a SmartNet support contract, go to this URL, and log in to download the appropriate files:
http://www.cisco.com/public/sw-center/sw-lan.shtml
•If you do not have a SmartNet contract, go to this URL, and follow the instructions to register on Cisco.com and download the appropriate files:
http://www.cisco.com/public/sw-center/sw-lan.shtml
To download the SMI and EMI files, select Catalyst 3550 software.
To obtain authorization and to download the cryptographic software files, select Catalyst 3550 3DES Cryptographic Software.
Step 3 Copy the image to the appropriate TFTP directory on the workstation, and make sure that the TFTP server is properly configured. (For more information, refer to Appendix B in the Catalyst 3550 Multilayer Switch Software Configuration Guide.)
Step 4 Log in to the switch through the console port or a Telnet session.
Step 5 Check your VLAN 1 configuration by using the show interfaces vlan 1 privileged EXEC command, and verify that VLAN 1 is part of the same network as the TFTP server. (Check the Internet address is line near the top of the display.)
Step 6 Download the image file from the TFTP server to the switch. If you are installing the same version of software that is currently on the switch, overwrite the current image by using this privileged EXEC command:
archive download-sw /overwrite /reload tftp:[[//location]/directory]/image-name.tar
The /overwrite option overwrites the software image in flash memory with the downloaded one.
The /reload option reloads the system after downloading the image unless the configuration has been changed and not been saved.
For //location, specify the IP address of the TFTP server.
For /directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive.
This example shows how to download an image from a TFTP server at 198.30.20.19 and to overwrite the image on the switch:
Switch# archive download-sw /overwrite tftp://198.30.20.19/c3550-i5q3l2-tar.122-25.SE.tar
You can also download the image file from the TFTP server to the switch and keep the current image by replacing the /overwrite option with the /leave-old-sw option.
Upgrading with a Nondefault System MTU Setting
If the switch was running Cisco IOS Release 12.1(8)EA1c or earlier and you had used the system mtu global configuration command to configure a nondefault system maximum transmission unit (MTU) size on your switch, follow these steps to upgrade your switch to Cisco IOS Release 12.1(11)EA1 or later:
Step 1 Upgrade the Cisco IOS software to Cisco IOS Release 12.1(11)EA1 or later.
Step 2 If a system MTU size of greater than 2000 is configured on the Catalyst 3550-12T or Catalyst 3550-12G, use the system mtu global configuration command to set it to the maximum supported MTU size.
Note The maximum allowable system MTU for Catalyst 3550 Gigabit Ethernet switches
is 2000 bytes; the maximum system MTU for Fast Ethernet switches is 1546 bytes.
Step 3 Save the running configuration by entering the copy running-config startup-config privileged EXEC command.
Step 4 Reload the switch by using the new Cisco IOS software.
Step 5 When the switch comes back up with Cisco IOS Release 12.1(11)EA1 or later, reload the switch a second time by using the reload privileged EXEC command so that the system mtu command takes effect.
Recovering from a Software Failure
If the software fails, you can reload the software. For detailed recovery procedures, refer to the "Troubleshooting" chapter in the software configuration guide.
Installation Notes
You can assign IP information to your switch by using one of these methods:
•Express Setup program, as described in the switch getting started guide. For information about this guide, see the "Getting Started Guide" section.
•CLI-based setup program, as described in the switch hardware installation guide.
•DHCP-based autoconfiguration, as described in the switch software configuration guide.
•Manually assigned IP address, as described in the switch software configuration guide.
New Features
These sections describe the new supported hardware and the new software features provided in this release:
•"New Hardware Features" section
•"New Software Features" section
New Hardware Features
For a list of supported hardware, see the "Hardware Supported" section.
New Software Features
This release contains these new Catalyst 3550 switch feature enhancements (available in all software images):
•Beginning with this release, CMS is no longer available with the switch software. You can use the embedded device manager to configure or manage a single switch or the Network Assistant standalone application to configure or manage one or more switches:
–The device manager is included in the switch image and provides simplified management for a single switch. Its features, such as Smartports and color-coded graphs, make it easier to configure and monitor the switch. No special installation is required. After the switch is configured through the Express Setup program or through the CLI-based setup program, the device manager is accessible through a Microsoft Internet Explorer or a Netscape Navigator browser session. For more information, refer to the device manager online help. For information on how to display the device manager, refer to the switch getting started guide.
–Network Assistant provides a comprehensive set of features for managing single and multiple devices, including switch clusters, through a GUI. This application must be downloaded from Cisco.com and be installed on your PC. You can learn more about Network Assistant at this URL:
http://www.cisco.com/go/NetworkAssistant
•Support in Cisco Network Assistant and the embedded device manager for upgrading your switch by using HTTP (no TFTP server is necessary)
•Secure Socket Layer (SSL) version 3.0 support for the HTTP1.1 server authentication, encryption, and message integrity, and HTTP client authentication to allow secure HTTP communications (only available in the cryptographic software image)
•Specify an action to take when a storm control occurs on a port
•Cisco intelligent power management (available on Catalyst 3550 PoE-capable switches)—The powered device and the switch negotiate through power negotiation CDP messages for an agreed power-consumption level. The negotiation allows a high-power Cisco powered device, which consumes more than 7 W, to operate at its highest power mode.
Limitations and Restrictions
You should review this section before you begin working with the switches. These are known Cisco IOS limitations that will not be fixed, and there is not always a workaround. Some features might not work as documented, and some features could be affected by recent changes to the switch hardware or software.
These sections describe the limitations and restrictions:
•"Cisco IOS Limitations and Restrictions" section
•"Device Manager Limitations and Restrictions" section
Cisco IOS Limitations and Restrictions
These sections describe the Cisco IOS limitations for features on the switch:
•"802.1x" section
•"ACLs" section
•"Connected Devices" section
•"Configuration" section
•"DHCP" section
•"HSRP" section
•"IGMP" section
•"MAC Addressing" section
•"MIBs" section
•"Multicasting" section
•"Port Security" section
•"QoS" section
•"Routing" section
•"SNMP" section
•"SPAN and RSPAN" section
•"Spanning Tree" section
•"VLAN" section
802.1x
These are 802.1x limitations:
•When an 802.1x-authenticated client is disconnected from an IP phone, hub, or switch and does not send an EAPOL-Logoff message, the switch interface does not transition to the unauthorized state. If this happens, it can take up to 60 minutes for the interface to transition to the unauthorized state when the re-authentication time is the default value (3600 seconds).
The workaround is to change the number of seconds between re-authentication attempts by using the dot1x timeout re-authperiod seconds global configuration command. (CSCdz38483)
•On a switch running Cisco IOS Release 12.1(12c)EA1 or later, if the switch MTU value is set to a value greater than 1500 and the authentication server and the intermediate devices are not configured with a compatible MTU value, 802.1x authentication with EAP-Transparent LAN Services (TLS) might fail.
The workaround is to reset the switch MTU value to the default value or to configure the same MTU value on the switch, the authentication server, and the intermediate devices. (CSCea05682)
ACLs
These are ACL limitations. For ACL limitations with QoS, see the "QoS" section.
•If you apply a large ACL and it fills the entire TCAM, the MVR IP multicast data packets are sent to the switch CPU and are not forwarded to the MVR receiver ports. (CSCdx80751)
•If the output from the show tcam inacl 1 statistics privileged EXEC command shows that the TCAM is not full and you are applying an ACL, this system message might appear:
%FM-3-UNLOADING: Unloading input vlan label 1 feature from all TCAMs
There is no workaround. (CSCea25658)
Connected Devices
These are limitations related to connection with specific devices:
•When you configure an EtherChannel between a Catalyst 3550 and a Catalyst 1900 switch, some of Catalyst 3550 links in the EtherChannel might go down, but one link in the channel remains up, and connectivity is maintained.
The workaround is to disable the Port Aggregation Protocol (PAgP) on both devices by using the channel-group channel-group-number mode on interface configuration command. PAgP negotiation between these two devices is not reliable. (CSCdt78727)
•When a Cisco RPS 300 Redundant Power System provides power to a switch, after the switch power supply is restored, the RPS 300 continues to provide power until the RPS mode button is pressed. At this point, some switches restart, depending on how quickly the switch internal power supply resumes operation. (CSCdx81023)
•When you insert a GigaStack GBIC in a GBIC module slot, the CPU utilization increases by six percent. This increase occurs for each GigaStack GBIC added to the switch. Other types of GBICs do not cause additional CPU utilization. (CSCdx90515)
•When the link between a device with an AC power supply and a Catalyst 3550-24PWR switch is 10 Mbps and half duplex, and the AC power supply is turned off, the switch is in the error-disabled state.
The workaround is remove the AC power supply, disconnect the Ethernet cable, and then reconnect the Ethernet cable. This ensures that the switch uses inline power. (CSCdz16265)
•The Catalyst 3550 switch does not adjust the power allocation based on IEEE class of the power device. When an IEEE powered-compliant device is connected to a switch, it allocates 15 W (the default) to the port. (CSCdz37516)
•When a Catalyst 3550 switch is connected to a 3-port Gigabit Ethernet module in a Cisco 12000 Gigabit Switch Router (GSR) that is configured for Ethernet over Multiprotocol Label Switching (EoMPLS), the switch does not reliably send frames to the GSR.
The workaround is to configure the Catalyst 3550 Gigabit Ethernet interface with the spanning-tree portfast interface configuration command. (CSCea04746)
•If a cable on an ingress interface is disconnected, an Alteon A184 cannot detect when a 1000BASE-X link between two Catalyst 3550 switches is down.
There is no workaround. (CSCea09786)
•When three or more Catalyst 3550-24PWR switches are connected through GigaStack GBICs, you can access all the VLANs on the uplink switch, but you can only access VLAN 1 on the other switches.
The workaround is to enter the switchport mode trunk interface configuration command on all of the GigaStack interfaces and do one of these:
–Use the shutdown and then the no shutdown interface configuration commands on the ports.
–Save the switch configuration by using the copy running-config startup-config privileged EXEC command, and reload all the switches. (CSCec86258)
•The undersize error counter is incrementing when no undersize packets are present. This condition occurs on 802.1Q tunnel ports connected to a Nortel or Alteon Load Balancer.
There is no known workaround. (CSCed73388)
•The Cisco RPS 300 Redundant Power System supports the Catalyst 3550 multilayer switch and provides redundancy for up to six connected devices until one of these devices requires backup power. If a connected device has a power failure, the RPS immediately begins supplying power to that device and sends status information to other connected devices that it is no longer available as a backup power source. As described in the device documentation, when the RPS LED is amber, the RPS is connected but down. However, this might merely mean that the RPS is in standby mode. Press the Standby/Active button on the RPS to put it into active mode. You can view RPS status through the CLI by using the show rps privileged EXEC command. For more information, refer to the RPS documentation.
Configuration
These are configuration limitations:
•When changing the link speed of a Gigabit Ethernet port from 1000 Mbps to 100 Mbps, there is a slight chance that the port will stop forwarding packets. If this occurs, shut down the port, and re-enable it by using the shutdown and no shutdown interface configuration commands. (CSCds84279)
•When you use the no interface port-channel global configuration command to remove an EtherChannel group, the ports in the port group change to the administratively down state.
When you remove an EtherChannel group, enter the no shutdown interface configuration command on the interfaces that belonged to the port group to bring them back on line. (CSCdt10825)
•In the show interface interface-id privileged EXEC command output, the output buffer failures field shows the number of packets lost before replication, whereas the packets output field shows the successful transmitted packets after replication. To determine actual discarded frames, multiply the output buffer failures by the number of VLANs on which the multicast data is replicated. (CSCdt26928)
•Remote Monitoring (RMON) collection functions on physical interfaces, but it is not supported on EtherChannels and SVIs. (CSCdt36101)
•If a switch stack contains both Catalyst 3550 switches and Catalyst 2900 XL or Catalyst 3500 XL switches, Cross-Stack UplinkFast (CSUF) is not enabled if the management VLAN on the Catalyst 2900 XL or 3500 XL switches is changed to a VLAN other than VLAN 1 (the default).
The workaround is to make sure that the management VLAN of all Catalyst 2900 XL or 3500 XL switches in the stack is set to VLAN 1. (CSCdv79737)
•The 5 minute input rate and 5 minutes output rate fields in the output of the show interfaces privileged EXEC command show both rates as 0 bits/sec. If you enter the show interfaces command more than once, these fields might show values greater than 0 bits/sec. (CSCdz06305)
•When the link between two switches is a Ethernet cable to an E3 converter, if MST is enabled on an 802.1Q trunk, traffic is not forwarded or sent for 60 seconds after the shutdown and no shutdown interface configuration commands are entered. (CSCdz45037)
•Performing an extended ping from one interface to another interface on the same switch can cause high CPU utilization. This can occur when a large number of ping packets are sent and received and is the expected behavior.
The workaround is to not perform a ping from one interface to another on the same switch. (CSCea19301)
•When connected to some third-party devices that send early preambles, a switchport operating at 100 Mbps full duplex or 100 Mbps half duplex might bounce the line protocol up and down. The problem is observed only when the switch is receiving frames.
The workaround is to configure the port for 10 Mbps and half duplex or to connect a hub or a nonaffected device to the switch. (CSCed39091)
•Storm control or traffic suppression (configured by using the storm-control {broadcast | multicast | unicast} interface configuration command) is supported only on physical interfaces; it is not supported on EtherChannel port channels even though you can enter these commands through the CLI.
DHCP
These are DHCP limitations:
•If you configure the DHCP server to allocate addresses from a pool to the switch, two devices on the network might have the same IP address. Pooled addresses are temporarily allocated to a device and are returned to the pool when not in use. If you save the configuration file after the switch receives such an address, the pooled address is saved, and the switch does not attempt to access the DHCP server after a reboot to receive a new IP address. As a result, two devices might have the same IP address.
The workaround is to make sure that you configure the DHCP server with reserved leases that are bound to each switch by the switch hardware address. (CSCds55220)
•The DHCP option-82 format on the Catalyst 3550 switch is inconsistent with other Cisco switches. When the Catalyst 3550 switch is used as the relay agent with DHCP snooping and the option-82 feature using the VLAN-module-port (vlan-mod-port) format, the switch does not assign the correct value to the port identifier (circuit ID suboption). The value is offset by 1 from the actual interface module- and port-number values. Also, the circuitID/port-identifier for Fast Ethernet and Gigabit Ethernet interfaces have the same module-number but different port-number values. For example, on a Catalyst 3550-24 switch, fastethernet0/1 is reported as module 0/port 0 and gigabitethernet0/1 is reported as module 0/port 24.
There is no workaround. (CSCed29525)
HSRP
These is the HSRP limitation:
•After the no interface tunnel0 global configuration command is entered to remove the tunnel interface, the output from the show running-config privileged EXEC command still shows the tunnel interface that was removed. (CSCdz66450)
This can occur if HSRP interface tracking is configured on another interface to track a tunnel interface, if the no interface command was entered before the HSRP tracking configuration was removed, or if the no standby tunnel0 global configuration command was entered on the other interface to disable tracking.
These are the workarounds:
–Before removing the tunnel interface from the configuration, remove the HSRP interface tracking commands in the configuration that specify the tunnel interface.
–Use the no standby track global configuration command without specifying an interface to disable HSRP tracking.
IGMP
These are IGMP limitations:
•Internet Group Management Protocol (IGMP) packets classified by QoS to map the DSCP value and the class of service (CoS) value in a QoS policy map might only modify the DSCP property and leave the CoS value at zero. (CSCdt27705)
•When IGMP filtering is enabled and you use the ip igmp profile global configuration command to create an IGMP filter, reserved multicast addresses cannot be filtered. Because IGMP filtering uses only Layer 3 addresses to filter IGMP reports and due to mapping between Layer 3 multicast addresses and Ethernet multicast addresses, reserved groups (224.0.0.x) are always allowed through the switch. In addition, aliased groups can leak through the switch. For example, if a user is allowed to receive reports from group 225.1.2.3, but not from group 230.1.2.3, aliasing will cause the user to receive reports from 230.1.2.3. Aliasing of reserved addresses means that all groups of the form y.0.0.x are allowed through. (CSCdv73626)
•If you use the ip igmp max-groups interface configuration command to set the maximum number of IGMP groups for an interface to 0, the port still receives group reports from reserved multicast groups (224.0.0.x) and their Layer 2 aliases (y.0.0.x). (CSCdv79832)
•When IGMP snooping is disabled and you enter the switchport block multicast interface configuration command, IP multicast traffic is not blocked. The switchport block multicast command is only applicable to non-IP multicast traffic.
There is no workaround. (CSCee16865)
MAC Addressing
These are MAC address limitations:
•After a MAC address is relearned on a new interface, traffic might not be immediately forwarded to the MAC addresses. (CSCdz75459)
•The switch uses the same MAC address for all VLAN interfaces. If the destination MAC address in a packet is the same as the MAC address of the VLAN interface, and the VLAN interface for that VLAN is shut down or does not exist, the switch drops the packet.
There is no workaround. (CSCed12004)
MIBs
These are MIB limitations:
•When you access CISCO-STACK-MIB portTable, the mapping might be off by one from the mapping given by the switch. The objects in this table are indexed by two numbers: portModuleIndex and portIndex. The allowable values for portModuleIndex are 1 through 16. Because 0 is not an allowable value, the value 1 represents module 0.
The workaround is to use the value 1 to represent module 0. (CSCdw71848)
•The Catalyst 3550 switch only supports the read operation in the sysClearPortTime MIB object (.1.3.6.1.4.1.9.5.1.1.13) in the CISCO-STACK-MIB. Use the clear counters privileged EXEC command to clear the counters. (CSCdz87897)
Multicasting
These are the multicasting limitations:
•Modifying a multicast boundary access list does not prevent packets from being forwarded by any multicast routes that were in existence before the access list was modified if the packets arriving on the input interface do not violate the boundary. However, no new multicast routes that violate the updated version of the multicast boundary access list are learned, and any multicast routes that are in violation of the updated access list are not relearned if they age out.
After updating a multicast boundary, the workaround is to use the clear ip mroute privileged EXEC command to delete any existing multicast routes that violate the updated boundary. (CSCdr79083)
•The show ip mroute count privileged EXEC command might display incorrect packet counts. In certain transient states (for example, when a multicast stream is forwarded only to the CPU during the route-learning process and the CPU is programming this route into the hardware), a multicast stream packet count might be counted twice. Do not trust the counter during this transient state. (CSCds61396)
•In IP multicast routing and fallback bridging, certain hardware features are used to replicate packets for the different VLANs of an outgoing trunk port. If the incoming speed is line rate, the outgoing interface cannot duplicate that speed (because of the replication of the packets). As a result, certain replicated packets are dropped. (CSCdt06418)
•Multicast router information is displayed in the show ip igmp snooping mrouter privileged EXEC command output when IGMP snooping is disabled. Multicast VLAN Registration (MVR) and IGMP snooping use the same commands to display multicast router information. In this case, MVR is enabled, and IGMP snooping is disabled. (CSCdt48002)
•When you use the ip pim spt-threshold infinity interface configuration command, you want all sources for the specified group to use the shared tree and not use the source tree. However, the switch does not automatically start to use the shared tree. No connectivity problem occurs, but the switch continues to use the shortest path tree for multicast group entries already installed in the multicast routing table. You can enter the clear ip mroute * privileged EXEC command to force the change to the shared tree. (CSCdt60412)
•Configuring too many multicast groups might result in an extremely low memory condition and cause the software control data structure to go out of sync, causing unpredictable forwarding behavior. The memory resources can only be recovered by entering the clear ip mroute privileged EXEC command. To prevent this situation, do not configure more than the recommended multicast routes on the switch. (CSCdt63480)
•If the number of multicast routes configured on the switch is greater than the switch can support, it might run out of available memory, which can cause it to reboot. This is a limitation in the platform-independent code.
•The workaround is to not configure the switch to operate with more than the maximum number of supported multicast routes. You can use the show sdm prefer and show sdm prefer routing privileged EXEC commands to view approximate maximum configuration guidelines for the current SDM template and the routing template. (CSCdt63354)
•Multicast traffic can be temporarily lost when a link comes up in a redundant network and causes the reverse path forwarding (RPF) to change. This only occurs when there are multiple paths between the rendezvous point (RP) and the multicast source. (CSCdw27519)
•When the switch receives multicast traffic and IGMP join for requests a multicast group at the same time and it begins to forward the multicast packets, some of the packets might be dropped. (CSCdy80326)
•When one Fast Ethernet port on a switch (Switch A) is connected to a packet generator, and another Fast Ethernet port on the switch is connected to a Gigabit Ethernet interface on another switch (Switch B), multicast traffic sent from Switch A to Switch B is incorrectly counted. The output from the show mls qos interface interface-id statistics command for the Gigabit Ethernet interface is incorrect.
There is no workaround. (CSCee19574)
Port Security
These are port security limitations:
•If a port is configured as a secure port with the violation mode as restrict, the secure ports might process packets even after maximum limit of MAC addresses is reached, but those packets are not forwarded to other ports. (CSCdw02638)
•Certain combinations of features create conflicts with the port security feature. In Table 5, No means that port security cannot be enabled on a port if the referenced feature is also running on the same port. Yes means that both port security and the referenced feature can be enabled on the same port at the same time. A dash means not applicable.
Table 5 Port Security Compatibility with Other Features
Type of Port
|
Compatible with Port Security
|
DTP1 port2
|
No
|
Trunk port
|
Yes
|
Dynamic-access port3
|
No
|
Routed port
|
No
|
SPAN source port
|
Yes
|
SPAN destination port
|
No
|
EtherChannel
|
No
|
Tunneling port
|
Yes
|
Protected port
|
Yes
|
802.1x port
|
Yes
|
Voice VLAN port4
|
Yes
|
QoS
These are QoS limitations:
•If you assign both tail-drop threshold percentages to 100 percent by using the wrr-queue threshold interface configuration command and display QoS information for this interface by using the show mls qos interface statistics privileged command, the drop-count statistics are always zero even if the thresholds were exceeded. To display the total number of discarded packets, use the show controllers ethernet-controllers interface-id privileged EXEC command. In the display, the number of discarded frames includes the frames that were dropped when the tail-drop thresholds were exceeded. (CSCdt29703)
•The behavior of a software access control list (ACL) with QoS is different from a hardware ACL with QoS. On the Catalyst 3550 switch, when the QoS hardware rewrites the DSCP of a packet, the rewriting of this field happens before software running on the CPU examines the packet, and the CPU sees only the new value and not the original DSCP value.
When the security hardware ACL matches a packet on input, the match uses the original DSCP value. For output security ACLs, the security ACL hardware should match against the final, possibly changed, DSCP value as set by the QoS hardware. Under some circumstances, a match to a security ACL in hardware prevents the QoS hardware from rewriting the DSCP and causes the CPU to use the original DSCP.
If a security ACL is applied in software (because the ACL did not fit into hardware, and packets were sent to the CPU for examination), the match probably uses the new DSCP value as determined by the QoS hardware, regardless of whether the ACL is applied at the input or at the output. When packets are logged by the ACL, this problem can also affect whether or not a match is logged by the CPU even if the ACL fits into hardware and the permit or deny filtering was completed in hardware.
To avoid these issues, whenever the switch rewrites the DSCP of any packet to a value different from the original DSCP, security ACLs should not test against DSCP values in any of their access control elements (ACEs), regardless of whether the ACL is being applied to an IP access group or to a VLAN map. This restriction does not apply to ACLs used in QoS class maps.
If the switch is not configured to rewrite the DSCP value of any packet, it is safe to match against DSCP in ACLs used for IP access groups or for VLAN maps because the DSCP does not change as the packet is processed by the switch.
The DSCP field of an IP packet encompasses the two fields that were originally designated precedence and type of service (TOS). Statements relating to DSCP apply equally to either IP precedence or IP TOS. (CSCdt94355)
•Ternary content addressable memory (TCAM) generation might fail when there are multiple ACLs in a policy-map. If you add an entry that checks TCP flags to an access list that is used for QoS classification, the system might report that a hardware limitation has been reached for the policy map. This can occur when the policy map already contains several other access list entries that check different TCP flags, or that check TCP or User Datagram Protocol (UDP) port numbers using an operation different from equal (eq), such as not equal (ne), less than (lt), greater than (gt), or range. When the hardware limitation is reached, the service-policy input policy-map-name interface configuration command is removed from the running configuration of the interface.
Checking for TCP flags and TCP/UDP port numbers using operators other than eq share some of the same hardware resources. The switch supports no more than six checks within a single policy map. An identical check repeated in multiple entries in the same policy map counts as a single instance. If this limit is reached during a TCP or UDP port number check, the software can often work around the problem by allocating extra entries in the TCAM. There is no workaround if the limit is reached during a check against the TCP flags in the packet. Similar checks in a port ACL applied to the same physical interface as the policy map also count toward the limit.
Because these resources are allocated on a first-come, first-serve basis, rearranging the order of ACLs within a policy map or the order of entries within a single ACL, placing the TCP flags checks as early as possible, might enable the policy map to be loaded into the hardware.
Similar limits apply for any combination of input VLAN maps, input router ACLs, output VLAN maps, and output router ACLs that share the same VLAN label. The switch supports eight checks for all features on the same VLAN label. When the limit is reached, the system might forward packets by using the CPU rather than through hardware, greatly reducing system performance. To determine the VLAN label assigned to a VLAN or interface on input or output, use the show fm vlan or show fm interface privileged EXEC commands. Then use the show fm vlan-label privileged EXEC command to determine which set of features (input VLAN map, input router ACL, output VLAN map, or output router ACL) share this label.
These are the workarounds:
–Re-arrange the order of classes within the policy map and the order of entries within the individual access lists in the policy map or within any IP port ACL applied to the interface so that checks for TCP flags are made as early as possible within the policy map. You can also re-arrange the order of the individual ACLs within a VLAN map and the order of the individual entries in a security ACL.
–Add an extra entry to the front of an ACL that checks for the same TCP flags that are checked later on in the ACL. If the first entry of the ACL already matches only the TCP protocol, you can duplicate the entry and add a check for the appropriate TCP flags.
–Reduce the number of different combinations of TCP flags being tested.
If the other workarounds fail, avoid combining any check against the TCP flags with gt, lt, ne, or range checks within the policy map and port ACL configured on the interface or within the VLAN maps and router ACLs that share the same VLAN label. (CSCdx24363)
•If you apply an ACL to an interface that has a QoS policy map attached and the ACL is configured so that the packet should be forwarded by the CPU or if the configured ACL cannot fit into the ternary content addressable memory (TCAM), all packets received from this interface are forwarded to the CPU. Because traffic forwarded to the CPU cannot be policed by the policer configured on the interface, this traffic is not accurately rate-limited to the configured police rate.
The workaround, when QoS rate limiting is configured on an interface, is to configure applied ACLs so that packets are not forwarded by the CPU or reduce the number of ACEs in the ACL so that it can fit into the TCAM. (CSCdx30485)
•If you create a policy map by using the policy-map policy-map-name global configuration command, enter the class class-map-name policy-map configuration command, and then immediately exit from the policy-map class configuration mode, the policy map does not show its class-map association.
The workaround is to enter another command (such as the police, trust, or set policy-map class configuration command) after entering the class class-map-name policy-map configuration command. (CSCdx81650)
•If a switch configuration contains a large ACL and a per-port per-VLAN policy map that both are attached to two interfaces, when you are copying it to the running configuration, this process might fail because the switch runs out of memory. (CSCdz54115)
These are the workarounds:
–Copy the new configuration file to the config.txt file, and reboot the switch.
–Save the configuration file as two files: one containing only the ACL configuration and one containing the rest of the configuration (including the QoS and interface configuration). Add the first configuration file to the running-configuration file, and then add the second file to the running-configuration file.
•If you are configuring a policy map on an interface by using named ACLs and the policy map has 13 named ACLs that include deny statements, these messages might appear when you add an ACL:
QoS: Programming TCAM failed: Unsuccessful ACL merge
Service Policy attachment failed
Service Policy xxxx not attached
QM-4-HARDWARE_NOT_SUPPORTED: Hardware limitation has reached for policymap xxxx
Use one of these workarounds:
–Use numbered ACLs.
–Do not use deny statements because the end of an ACL has an implicit deny statement. (CSCec46594)
•Catalyst 3550 switches do not take into account the Preamble and Inter Frame Gap (IFG) when rate limiting traffic, which could result in a slightly inaccurate policing rate on a long burst of small-sized frames, where the ratio of the Preamble and IFG to frame size is more significant. This should not be an issue in an environment where the frames are a mix of different sizes.
•Certain combinations of features create conflicts with the port security feature. In Table 5, No means that port security cannot be enabled on a port if the referenced feature is also running on the same port. Yes means that both port security and the referenced feature can be enabled on the same port at the same time. A dash means not applicable.
Routing
These are routing limitations:
•Open Shortest Path First (OSPF) path costs and Interior Gateway Routing Protocol (IGRP) metrics are incorrect for switch virtual interface (SVI) ports. You can manually configure the bandwidth of the SVI by using the bandwidth interface configuration command. Changing the bandwidth of the interface changes the routing metric for the routes when the SVI is used as an outgoing interface. (CSCdt29806)
•The dec keyword is not supported in the bridge bridge-group protocol global configuration command. If two Catalyst 3550 switches are connected to each other through an interface that is configured for IP routing and fallback bridging, and the bridge group is configured with the bridge bridge-group protocol dec command, both switches act as if they were the spanning-tree root. Therefore, spanning-tree loops might be undetected. (CSCdt63589)
•When the switch is operating with equal-cost routes and it is required to learn more unicast routes than it can support, the CPU might run out of memory, and the switch might fail.
The workaround is to remain within the documented recommended and supported limits. (CSCdt79172)
•If a Catalyst 3550 switch is connected to two routers (Router 1 and Router 2) in this topology:
–The link between Router 1 and the switch is a BVI (bridge virtual interface) that belongs to two VLANs (VLAN 100 and VLAN 110) and uses one IP address. The IP subnet for the BVI is the same for both VLANs. The ports in both VLANs operate as Layer 2 interfaces. An SVI with an IP address is configured only on VLAN 100.
–The link between Router 2 and the switch is an IP interface that only belongs to VLAN 110.
IP connectivity then exists between Router 1 and the switch. There is no IP connectivity between Router 2 and the switch.
The workaround is to configure another SVI with an IP address on the Catalyst 3550 switch that would be reachable from Router 2. (CSCdy82042)
•The switch does not create an adjacency table entry when the ARP timeout value is 15 seconds and the ARP request times out.
The workaround is to not set an ARP timeout value lower than 120 seconds. (CSCea21674)
•When the switch has many routes that use loadsharing among multiple next hops, some of the routes might not loadshare but instead pick only one of the next hops for forwarding all packets on that route. This happens when the portion of the adjacency RAM that has been allotted for multipath routes has been used up.
There is no workaround. (CSCed22152)
•Packets received from media types that require SNAP encapsulation of IPv4 packets require the switch to forward SNAP-encapsulated packets. Layer 2 forwarding of IPv4 in SNAP encapsulation ordinarily takes place in hardware (unless a VLAN map or port ACL contains an IP ACL). However, on the Catalyst 3550 switch, Layer 3 forwarding of IPv4 in SNAP can only be done in software. SNAP-encapsulated IPv4 packets that are directed to the router MAC address or the HSRP group MAC address (if this device is the active router in the HSRP group) are forwarded to the switch CPU, potentially causing high CPU utilization levels.
This is a hardware limitation, and there is no workaround. (CSCed59864)
•When multi-VRF-CE is enabled on the switch, the switch does not support the ip directed-broadcast interface configuration command used to enable forwarding of IP-directed broadcasts on an interface.
There is no workaround. (CSCee05670)
•When an IP packet with a cyclic redundancy check (CRC) error is received, the per-packet per-Differentiated Service Code Point (DSCP) counter (for DSCP 0) is incremented. Normal networks should not have packets with CRC errors. (CSCdr85898)
SNMP
These are SNMP limitations:
•The switch might reload when it is executing the no snmp-server host global configuration command. This is a rare condition that can happen if SNMP traps or informs are enabled and the SNMP agent attempts to send a trap to the host just as it is being removed from the configuration and if the IP address of the host (or the gateway to reach the host) has not been resolved by Address Resolution Protocol (ARP).
The workaround is to ensure that the target host or the next-hop gateway to that host is in the ARP cache (for example, by using a ping command) before removing it from the SNMP configuration. Alternatively, disable all SNMP traps and informs before removing any hosts from the SNMP configuration. (CSCdw44266)
SPAN and RSPAN
These are SPAN and RSPAN limitations:
•An RSPAN source session does not forward monitored traffic to the RSPAN destination session if there is an egress SPAN source port in the session with port security or 802.1x enabled. (CSCdy21035)
•Not all traffic is properly mirrored by RSPAN when a port is monitored for egress traffic and the RSPAN VLAN is carried through a Layer 2 Protocol Tunnel to the RSPAN destination switch.
This happens because the MAC addresses for the original packets as well as the mirrored RSPAN packets are all learned on the tunnel VLAN, so the RSPAN traffic is no longer properly segregated on the tunneling switches.
The workaround is to not include any RSPAN VLANs in any Layer 2 Protocol tunnels unless the tunnel is dedicated to a single RSPAN VLAN. (CSCdy37188)
•Ingress forwarding on a SPAN destination port does not work if there is an egress SPAN source port in the session with port security or 802.1x enabled. (CSCdy44646)
•Whenever a single frame is subject to both ingress and egress SPAN, and both the ingress and the egress SPAN are sent to the same SPAN destination port, the egress copy of the spanned frame is sent out of the SPAN destination port before the ingress copy of the spanned frame is sent out of the SPAN destination port.
There is no workaround. (CSCef97043)
Spanning Tree
These are spanning tree limitations:
•If a port on the Catalyst 3550 switch that is running the Multiple Spanning Tree Protocol (MSTP) is connected to another switch that belongs to a different multiple spanning tree (MST) region, the Catalyst 3550 port is not recognized as a boundary port when you start the protocol migration process by using the clear spanning-tree detected-protocols interface interface-id privileged EXEC command. This problem occurs only on the root bridge, and when the root bridge is cleared, the boundary ports are not shown because the designated ports do not receive any bridge protocol data units (BPDUs) unless a topology change occurs. This is the intended behavior.
The workaround is to configure the Catalyst 3550 switch for Per-VLAN spanning-tree plus (PVST+) by using the spanning-tree mode pvst global configuration command bridge, and then change it to MSTP by using the spanning-tree mode mst global configuration command. (CSCdx10808)
•When you reboot a Catalyst 3550-24-FX switch, it might loop back packets received on a 100BASE-FX port to its link partner. This can occur before the Cisco IOS software takes control of the system and lasts for about 200 milliseconds.
As a result, the link partner might shut down the port when it detects loopback packets, or MAC addresses might be learned on the wrong ports on upstream switches. The network might be unable to deliver packets to a few devices for up to 5 minutes after rebooting the Catalyst 3550-24-FX switch when:
–The Catalyst 3550-24-FX switch is connected to one or more switches in the network.
–Spanning tree is disabled in the network or the Port Fast feature is enabled on the ports connected to the Catalyst 3550-24-FX switch.
–The Catalyst 3550-24-FX switch is powered cycled or reloaded from CLI.
–One or more devices in the network transmit a broadcast or multicast packet during the 200-millisecond timing window while the Catalyst 3550-24-FX switch is booting.
This problem corrects itself after five minutes or when these devices transmit a broadcast or multicast packet, whichever comes first.
The workaround is to enable spanning tree in the network and to make sure that the Port Fast feature is disabled on all ports connected to the Catalyst 3550-24-FX switch. (CSCdx45558)
•When a switch receives a bridge STP bridge protocol data unit (BPDU) from an access port and the egress port is a trunk port, the switch assigns the BPDU a CoS value of 0 instead of 7.
There is no workaround. (CSCdz54043)
VLAN
Thes
