| |
|
Alert Type: | Updated * |
Bug Id: | CSCur09076 | Title: | %SYS-4-CHUNKSIBLINGSEXCEED: No of siblings in chunk gone above threshold |
|
Status: | Other |
|
Severity: | 1 Catastrophic |
Description: * | Symptom:
3850 WLC intermittently will hang and no access allowed. Once the 3850 is reloaded, the issue goes away. The following is seen:
-Traceback= 1#048b6a8b926898a0a997138bbf4f379d :5501E000+258A31C :5501E000+3EF9114 :5501E000+EEC27C :5501E000+EEC898 :5501E000+1103900 :5501E000+1106B24 :5501E000+11070B0 :5501E000+1107688 :5501E000+3EAD28C
Sep 18 11:05:35 EDT: %DOT1X-5-FAIL: Authentication failed for client (f437.b720.88c2) on Interface Ca32 AuditSessionID 0a570a15541af4630003ee1f
Sep 18 11:05:59 EDT: %DOT1X-5-FAIL: Authentication failed for client (54ea.a882.8fc9) on Interface Ca35 AuditSessionID 0a570a15541af47a0003ee23
Sep 18 11:06:13 EDT: %SYS-4-CHUNKSIBLINGSEXCEED: Number of siblings in a chunk has gone above the threshold. Threshold:10000 Sibling-Count:22552 Chunk:0x38157CB0 Name:AIM_ATTACH -Process= "IP Host Track Process", ipl= 0, pid= 213
-Traceback= 1#048b6a8b926898a0a997138bbf4f379d :5501E000+258A31C :5501E000+3EF9114 :5501E000+EEC27C :5501E000+EEC898 :5501E000+1103900 :5501E000+1106870 :5501E000+11070B0 :5501E000+1107688 :5501E000+3EAD28C
Sep 18 11:06:18 EDT: %SYS-4-CHUNKSIBLINGSEXCEED: Number of siblings in a chunk has gone above the threshold. Threshold:10000 Sibling-Count:22902 Chunk:0x38EE9A74 Name:AIM_ATTACH -Process= "cpf_msg_rcvq_process", ipl= 0, pid= 129 (NC5A4-3)
-Traceback= 1#048b6a8b926898a0a997138bbf4f379d :54615000+258A31C :54615000+3EF9114 :54615000+EEC27C :54615000+EEC898 :54615000+10FE660 :54615000+1110F64 :54615000+1112198 :54615000+22A6FBC :54615000+22B3A20 :54615000+22AEA54 :54615000+3EAD28C (NC5A4-3)
Conditions:
3850 WLC running 03.06.00E
Workaround:
none
Further Problem Description:
|
|
Last Modified: | 31-AUG-2015 |
|
Known Affected Releases: | 15.2(2.0.0) |
|
Known Fixed Releases: | |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCul19814 | Title: | SCHED-3-tHRASHING at fnf-rpc_context_wait_for_completion |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom: After collecting "raw netflow" data, the active switch crashes. The show flow monitor v4 cache command causes the reboot of the switch with the following message:
%SCHED-3-TRASHING: Process thrashing on watched message event.
Conditions: This symptom occurs due to the show flow monitor command.
Workaround: There is no workaround.
|
|
Last Modified: | 03-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ |
|
Known Fixed Releases: * | 15.0(1)EZ2, 15.0(10.37)PKD, 15.0(10.37)PKP, 15.0(12.72)EZD, 15.0(14.1)TSR, 15.0(14.49)EZD, 15.0(2.29)ZSR, 15.2(1.1)PSR, 15.2(1.24)PSR, 15.2(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuu35972 | Title: | MCAST streams stop with more then one outgoing interfaces in the RIL |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
With more then one outgoing interfaces, multicast streams do not getting forwarded to any OIL interfaces. The switch forwards multicast stream just fine as long as there is only a single interface in the OIL list.
Conditions:
The issue is seen if there are 2 or more outgoing interfaces.
Workaround:
Not known
Further Problem Description:
|
|
Last Modified: | 03-AUG-2015 |
|
Known Affected Releases: | 3.6(2)E, n/a |
|
Known Fixed Releases: * | 15.2(3)E2 |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuq09690 | Title: | "no parameter-map" causes crash on 3.3.3 : auth_proxy_cache_redirect_url |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
After hitting CSCup76410 on 3.6, customer downgraded to 3.3.3se and experiencing continuous crashes
================ Where =================
#0 0xf7060f7e in strlen [__be_strlen] (str=0xd0d0d0d ) at ../VIEW_ROOT/cisco.comp/system-infra/libc/src/string/strlen.c:42
#1 0xf5afd772 in strdup [__be_strdup] (oldstr=0xd0d0d0d ) at ../VIEW_ROOT/cisco.comp/system-infra/util/misc/src/util.c:1129
#2 0xf57d3fd5 in auth_proxy_cache_redirect_url [__be_auth_proxy_cach...] (info=0x982ada6c, url=0xd0d0d0d ) at ../inspect/auth_proxy_support.c:675
#3 0xf57f8996 in webauth_http_parse_get_request [__be_webauth_http_pa...] (state=0x96f86e88, webauth=) at ../inspect/webauth_http_parse_get.c:944
#4 0xf57f79a4 in webauth_http_parse_request [__be_webauth_http_pa...] (state=0x96f86e88, webauth=0x982ada6c) at ../inspect/webauth_http_parse.c:218
#5 0xf57ea086 in webauth_io_read_complete [__be_webauth_io_read...] (ioid=2, state=0x96f86e88) at ../inspect/webauth_httpd_authproxy.c:63
#6 0xf57e567d in webauth_httpd_socket_read_ev [__be_webauth_httpd_s...] (info=0x982ada6c, ctx=0x9332c3dc) at ../inspect/webauth_httpd.c:2174
#7 0xf57e4a36 in webauth_httpd_socket_ev [__be_webauth_httpd_s...] (io_dict=, fd=2, event_mask=1) at ../inspect/webauth_httpd.c:2376
#8 0xf57e46bb in webauth_httpd [__be_webauth_httpd] () at ../inspect/webauth_httpd.c:2837
#9 0xf6ab9620 in process_create_preemptive [__be_process_create_...] (padd=Cannot access memory at address 0x8
) at ../VIEW_ROOT/cisco.comp/kernel/mki/src/process.c:2208
Conditions:
This is seen when the parameter-map is deleted on the fly while sessions associated with are active.
Workaround:
To shut the interface to which parameter-map is attached, before deleting/changing the pmap.
Further Problem Description:
|
|
Last Modified: | 05-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ, 15.2(2)E |
|
Known Fixed Releases: * | 15.0(1)EZ4, 15.0(14.1)TSR, 15.0(14.41)EZD, 15.0(14.57)EZD, 15.0(2.29)ZSR, 15.2(1)IC273.162, 15.2(2)E1, 15.2(2.54)PSR, 15.2(2b)E, 15.2(4.0)ST |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuj10443 | Title: | Standby sw crash@crypto_engine/sw/src/keylib/lib_key_storage.c:646 |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
Switch crashes when being added to stack after switchoer
Conditions:
This occurs in switchover scenarios
Workaround:
Reload the complete stack and boot again.
Further Problem Description:
|
|
Last Modified: | 05-AUG-2015 |
|
Known Affected Releases: | 15.0(11.98)EMP, 15.0(12.3)EMP, 15.2(2.2.94)E |
|
Known Fixed Releases: * | 12.2(60)EZ2, 12.2(60)EZ3, 15.0(1)EZ, 15.0(1)EZ1, 15.0(12.14)EZD, 15.0(14.1)TSR, 15.0(14.49)EZD, 15.0(2)EX5, 15.0(2)EX7, 15.0(2)SE7 |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuu70556 | Title: | stack manager crash @ dplr_pd_update_ring_status_chg |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
3850 switch running 3.7.1.E might experience a stack manager crash.
Conditions:
unknown yet
Workaround:
unknown yet
Further Problem Description:
|
|
Last Modified: | 06-AUG-2015 |
|
Known Affected Releases: | 15.2(3.7.1E) |
|
Known Fixed Releases: * | 15.2(3)E2, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCut05943 | Title: | 3850 incorrect vlan tag once using private vlans |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
SW1 Gi1/0/1----TRUNK----Gi1/0/1 SW2 Gi1/0/2----TRUNK----Gi1/0/1 SW3
Gi1/0/48
|
|
Host (ISOLATED VLAN Y)
Each switch has SVI X (PRIMARY vlan). ISOLATED VLAN Y is mapped to PRIMARY VLAN X. We can ping from Host to SVI X of SW1 and SW2 but not SW3.
Conditions:
- 3850/3650 switches running cat3k_caa-universalk9ldpe.SPA.03.07.00.E.152-3.E.bin
- all switches configured with private vlans
- host configured in ISOLATED vlan and trying to communicate with host in PRIMARY vlan, while traffic has to pass between trunks on a device in the middle
Workaround:
- no workaround to have the setup working as expected and not loosing functionality
- we can use COMMUNITY instead of ISOLATED, however then we do not achieve the goal of having isolated hosts
- we can change interfaces from TRUNKs to PRIVATE-VLAN PROMISCOUS but then we can have only one PRIMARY vlan
- we can remove private vlan configuration from SW2, but then we are not able to use private vlan feature on SW2...
Further Problem Description:
|
|
Last Modified: | 06-AUG-2015 |
|
Known Affected Releases: | 3.7(0)E |
|
Known Fixed Releases: * | 15.2(3)E1, 15.2(3)E2, 3.7(1)E, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCus93034 | Title: | 5760 segmentation fault(11) on Auth-proxy HTTP daemon |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
IOS Thread backtrace:
IOSD-EXT-SIGNAL: Segmentation fault(11), Process = Auth-proxy HTTP daemon 0
5760 crashes
Conditions:
Usage of web authentication
Workaround:
none
Further Problem Description:
|
|
Last Modified: | 06-AUG-2015 |
|
Known Affected Releases: | 10.2(100.0) |
|
Known Fixed Releases: * | 15.2(3)E2, 15.2(4.0)ST, 15.2(5.0)ST, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCut26365 | Title: | Packet drop on 3850 by an unrelated ACL entry |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
TCP ack packet is discarded by unrelated ACE on 3850.
Conditions:
"establish" option is used.
Workaround:
The problem happened with tcp flags which have multiple bit set. If customer cofig as separate bit, then there is no issue.
The ace: deny tcp any any eq ftp established
Configured as two aces (because the tcp flag establish means "ack or rst"
deny tcp any any eq ftp ack
deny tcp any any eq ftp rst
Further Problem Description:
|
|
Last Modified: | 06-AUG-2015 |
|
Known Affected Releases: | 3.7(0)E |
|
Known Fixed Releases: * | 15.2(3)E2, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCut44425 | Title: | SFP remove and crash when "show platform port-asic 0 read counters" |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
SFP remove and crash occur when run "show platform port-asic 0 read counters" command
Conditions:
when "show platform port-asic 0 read counters" command is run
Workaround:
We can use the following command as workaround now.
Switch#show platform fwd-asic counters tla ?
AQM Active Queue Management
ASE Acl Search Engine
EGR Egress Global Resolution
EPF Egress Scheduler Module
EQC Egress Scheduler Module
ESM Egress Queue Controller
FPE Flexible Parser
FPS Flexible Pipe Stage
FSE Fib Search Engine
IGR Ingress Global Resolution
IPF Ingress Port FIFO
IQS Ingress Queues and Scheduler
NFL Netflow
NIF Network Interface
PBC Packet Buffer Complex
PIM Protocol Independent Multicast
PLC Policer
RMU Recirculation Multiplexer Unit
RRE Reassembly Engine
RWE Rewrite Engine
SEC Security Engine
SIF Stack Interface
SQS Stack Queues And Scheduler
SUP Supervisor Interface
Switch#show platform fwd-asic counters tla NIF detail asic 0 sw 4
Starting with asic 0
NifRxByteDestinationGroupStats on Asic 0
[0]
rxUnicastBytes1 0x00000000
rxUnicastBytes0 0x00000184
rxMulticastBytes1 0x00000000
rxMulticastBytes0 0x00000000
rxBroadcastBytes1 0x00000000
rxBroadcastBytes0 0x00000000
Further Problem Description:
|
|
Last Modified: | 06-AUG-2015 |
|
Known Affected Releases: | 15.5(2)T |
|
Known Fixed Releases: * | 15.2(3)E2, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCut22611 | Title: | 3850 - 1 GiG 1000BaseLX negotiates to "HALF DUPLEX" after reload |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
1 Gig port (1000BaseLX) sometime starts operating at HALF DUPLEX mode after a reload.
Shut/no shut or plugging/unplugging the SFP does not fix the issue. Only way to fix it, is remove the SFP, hardcode the duplex to full and insert SFP back.
Conditions:
WS-C3850-24U running 3.3.5
Both ports need to be connected to C3850-NM-4-1G.
GBIC used- GLC-LH-SMD for 1000BaseLX
Workaround:
Not Available yet.
UDLD should be kicked in to stop any possible layer 2 loop due to this unidirectional situation but this is anyway not a valid workaround to stop the SFP port operating at HALF DUPLEX.
Further Problem Description:
|
|
Last Modified: | 06-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ5 |
|
Known Fixed Releases: * | 15.2(3)E1, 15.2(3)E2, 3.7(1)E, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCua55911 | Title: | active reloaded with IOSD-EXT-SIGNAL: Segmentation fault(11) |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
active reloaded with IOSD-EXT-SIGNAL: Segmentation fault(11)
Conditions:
* did "no issu set rollback-timer 7200" and did wr mem and the active crashed with the error segmentation fault
Workaround:
none
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.1(2)SG1.7, 15.4(1.1) |
|
Known Fixed Releases: * | 15.0(1.5)UCT, 15.0(10.16)EMW, 15.0(8.24)EMD, 15.0(9.0)PKD, 15.1(1.40)SID, 15.1(2)SG, 15.1(2)SG1, 15.1(2)SG2, 15.1(2)SG3, 15.1(2)SG4 |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCum70737 | Title: | 3850 :: ACL definitions not consistent between stack master and members |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
- Policy-map not programmed as indicated by output of "sh plat qos policy hw_state target tenGigabitEthernet X/Y/Z"
- As soon as the policy is re-writted using "match dscp" statements in the class-map instead of "match access-gorup" - the policy is programed correctly,
- Switch on which the policy is to be applied is not aware of nearly any ACL configured
- Output of "sh plat acl info switch X" shows different results for both switch members - at least one of the switches
Conditions:
- Stack of 2x 3850 running 03.03.01SE
- The switch has ACL applied on the management interface !!!
Workaround:
Remove the ACL from the Management interface.
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.0(1.1)EX |
|
Known Fixed Releases: * | 15.0(1)EZ3, 15.0(13.23)EZD, 15.0(14.1)TSR, 15.0(14.49)EZD, 15.0(2.29)ZSR, 15.2(1.30)PSR, 15.2(2)E, 15.2(2b)E, 15.2(4.0)ST, 15.2(4.0.64a)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCun81556 | Title: | IPDT: Standby failed to boot up after SSO due to Bulk-sync failure |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
- cannot configure "channel-group" on the channel member port
- If stack condition,
after SSO, Standby switch will fail to boot up as a result of bulk sync failure.
Conditions:
- "ip device tracking maximum" is present on an etherchannel member port
- seen with Cat3750, Cat3850 and stack ondition
Workaround:
Remove the config "ip device tracking maximum" from the chanel member ports
before configure channel-group, also before bringing up the switch in order to complete SSO.
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.2(2)E |
|
Known Fixed Releases: * | 15.2(1.41)PSR, 15.2(2)E, 15.2(2.2.32)EA, 15.2(2b)E, 15.2(4.0)ST, 15.2(4.0.64a)E, 15.2(5.0)ST, 3.6(0)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuo14829 | Title: | 3850/03.03.02SE/Stuck Routing Control Q due to IPV6 MLD |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:BGL.D.09-3800-1#sh platform punt client
tag buffer jumbo fallback packets received failures
-----SNIP-------------
65544 0/ 96/1600 0/4 0/0 0 0 0 0 0
65545 0/ 96/1600 0/8 0/32 0 0 0 0 0
s65546 511/ 512/1600 0/32 0/512 27369 35180 2507410 0 1
65547 0/ 96/1600 0/8 0/32 0 0 0 0 0
65548 0/ 512/1600 0/32 0/256 1182 1182 70920 0 0
BGL.D.09-3800-1#show platform punt statistics port-asic 0 cpuq -1 direction rm punt statistics port-asic 0 cpuq -1 direction rx
----SNIP-----
RX (ASIC2CPU) Stats (asic 0 qn 4 lqn 4):
RXQ 4: CPU_Q_ROUTING_CONTROL
----------------------------------------
Packets received from ASIC : 27883
Send to IOSd total attempts : 27883
Send to IOSd failed count : 1
RX suspend count : 1
RX unsuspend count : 0
RX unsuspend send count : 0
------SNIP------------
Conditions:IOS-XE 3.2.xSE, 3.3.0SE, 3.3.1SE, 3.3.2SE
Caused by IPV6 MLD group specific query packets
Workaround:+ Reload of the switch brings it out of the condition
More Info:Fixed in 3.3.3SE or higher. Upgrade IOS-XE.
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ2 |
|
Known Fixed Releases: * | 15.0(1)EZ3, 15.0(13.44)EZD, 15.0(14.1)TSR, 15.0(14.49)EZD, 15.0(2.29)ZSR, 15.2(1.41)PSR, 15.2(2)E, 15.2(2.2.32)EA, 15.2(2b)E, 15.2(4.0)ST |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCup86496 | Title: | unicast ARP replies not destined to 3850 are forwarded to ARP module |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: |
Cu migrated 3750 switches to 3850 switches. and they use NAC for security.
The problem occurred with 3850 due to abnormal ARP table update.
Symptom:In 3850, we see that even the unicast ARP replies which are not destined to this box being forwarded to ARP module which will then learn and update the Src MAC for Src IP address which is creating an issue
Conditions:when the 3850 gets ARP replies which are not destined to this box
Workaround:None.
More Info:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.4(2.12)CG26 |
|
Known Fixed Releases: * | 15.0(1)EZ5, 15.0(14.57)EZD, 15.0(2.29)ZSR, 15.2(2)E1, 15.2(3)E, 15.2(4.0)ST, 15.2(4.0.64a)E, 15.2(5.0)ST, 3.3(5)SE, 3.6(1)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuu41817 | Title: | 3850 cts assigning multicast traffic to sgt default (65535) |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
Enforcement being applied to multicast traffic
Conditions:
Multicast traffic with igmp join
Workaround:
none
Further Problem Description:
NA
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 3.7(0) |
|
Known Fixed Releases: * | 15.2(1.8)SY, 15.2(3)E2, 15.2(4.0)ST, 15.2(4.0.15)E, 15.2(4.0.64a)E, 15.2(5.0)ST, 15.6(0.7)S, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCur33133 | Title: | Reboot of Standby Stack Member after configuration change. |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
The issue is that after a configuration is changed, the Standby member reloads and displays error messages.
Conditions:
The standby can randomly reload on different occasions, for example when applying policy on interface or modifying VLAN configuration.
Workaround:
There is no workaround.
Further Problem Description:
Software version 3.6.0 or 3.3.1 (in lab I tested 3.3.1SE)
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ1 |
|
Known Fixed Releases: * | 15.2(1)SY1, 15.2(2)E2, 15.2(3)E1, 15.2(4.0.64a)E, 15.2(5.0)ST, 3.6(2)E, 3.7(1)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuu31131 | Title: | Memory leak under *MallocLite* / tdl code for ipv4 and l3m |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
Memory leak is seen in *MallocLite* process. if MallocLite is disabled, we see the increase in memory under the TDL code for l3m and ipv4. Further investigation is going on to identify the source code involved in triggering the leak.
Conditions:
Not known
Workaround:
Not known
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 3.6(2)E |
|
Known Fixed Releases: * | 15.2(3)E2, 15.2(4.0.64a)E, 15.2(4.0.8)E, 15.2(5.0)ST, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCum41076 | Title: | Wireless IPSG is broken for NG3K |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
IP Source Gurad for wireless IPv4 traffic does not take effect. The feature is enabled on a wlan. It is supposed to drop traffic from a wireless client in the wlan if the source IP is not the one allocated to the client.
But, this does not happen and such traffic is forwarded normally.
Conditions:
This is issue is seen whenever IPSG is enabled for a wlan (under all conditions).
Workaround:
There is no reasonable workaround for this issue.
|
|
Last Modified: | 12-AUG-2015 |
|
Known Affected Releases: | 15.0(11.30)EMP |
|
Known Fixed Releases: * | 15.0(1)EZ2, 15.0(10.37)PKD, 15.0(10.37)PKP, 15.0(12.91)EZD, 15.0(14.1)TSR, 15.0(14.49)EZD, 15.0(2.29)ZSR, 15.2(2)E, 15.2(2.2.70)ST, 15.2(2b)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuo14901 | Title: | Crash/High CPU when enabling nbar for Flexible Netflow |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
3850 switch crashes and/or experiences high cpu when adding nbar feature to FNF.
Conditions:
Device must have flexible netflow and nbar application configured.
Workaround:
This is not a supported case. We should never have this configuration.
Further Problem Description:
Need to reject the configuration on wired interface.
|
|
Last Modified: | 15-AUG-2015 |
|
Known Affected Releases: | n/a |
|
Known Fixed Releases: * | 15.0(1)EZ4, 15.0(1.77)ZSR, 15.0(13.70)EZD, 15.0(14.1)TSR, 15.0(14.57)EZD, 15.0(2.29)ZSR, 15.2(2)E1, 15.2(3)E, 15.2(4.0)ST, 15.2(4.0.64a)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuq89605 | Title: | Switch does not show the configured duplex value |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
When a down interface is configured on Catalyst switch 3850 for a fixed speed and duplex value, the "show int status" command shows the correct speed, but it shows duplex as auto.
This behavior is seen only on an unconnected port.
Example:
#######
CAT3850#show run interface gigabitEthernet 1/0/2
Building configuration...
Current configuration : 62 bytes
!
interface GigabitEthernet1/0/2
speed 100
duplex full
end
CAT3850#show interfaces status | include Gi1/0/2
Gi1/0/2 notconnect 1 auto 100 10/100/1000BaseTX
Conditions:
The problem is seen on down interface, but when the link is ?up?, it shows the correct settings.
Workaround:
There is no workaround.
Further Problem Description:
NA
|
|
Last Modified: | 15-AUG-2015 |
|
Known Affected Releases: | 15.2(2)E |
|
Known Fixed Releases: * | 15.2(1)SY1, 15.2(2)E2, 15.2(3)E1, 15.2(4.0)ST, 15.2(4.0.64a)E, 3.6(2)E, 3.7(1)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCup53338 | Title: | 3850 IOSD crash | Signal=SIGSEGV(11) @ pm_port_data_from_swidb |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
The standby switch on a 3850 stack may reboot due to an IOSd crash following a stack-merge event.
Conditions:
Not Known
Workaround:
None
Further Problem Description:
|
|
Last Modified: | 15-AUG-2015 |
|
Known Affected Releases: | 12.3PI4, n/a |
|
Known Fixed Releases: * | 15.0(1)EZ4, 15.0(1.77)ZSR, 15.0(14.1)TSR, 15.0(14.57)EZD, 15.0(14.9)EZD, 15.0(2.29)ZSR, 15.2(2)E1, 15.2(2.23)PSR, 15.2(2.39)PSR, 15.2(2b)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCup48618 | Title: | 3850: Crash @ dot1x_switch_handle_vlan_removal |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
3850 member stack crashes on replacing a supplicant behind phone.
Conditions:
Cat3850 running 3.6.0E
Workaround:
None
Further Problem Description:
|
|
Last Modified: | 15-AUG-2015 |
|
Known Affected Releases: | 15.2(3.1.22)PI4 |
|
Known Fixed Releases: * | 15.2(2)E1, 15.2(3)E, 15.2(4.0)ST, 15.2(4.0.64a)E, 3.6(1)E, 3.7(0)E |
|
|
| |
| |
|
Alert Type: | New |
Bug Id: | CSCuv62794 | Title: | MAC address doesn't update when flex-link switchover. |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
when Flex-link switchover, ping loss happend.
Conditions:
Flex-link switchover
Workaround:
None
Further Problem Description:
|
|
Last Modified: | 19-AUG-2015 |
|
Known Affected Releases: | 15.0(31.4.79) |
|
Known Fixed Releases: | |
|
|
| |
| |
|
Alert Type: | New |
Bug Id: | CSCuv69263 | Title: | 3850 crashes while running 'no ip pim rp-address' |
|
Status: | Open |
|
Severity: | 2 Severe |
Description: | Symptom:
A 3850 may crash while running the command 'no ip pim rp-address'
Conditions:
Running the command 'no ip pim rp-address'
Workaround:
None at this time.
Further Problem Description:
|
|
Last Modified: | 19-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EX2 |
|
Known Fixed Releases: | |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCus99367 | Title: | 3850 re-writes mobility capwap data packets with TTL 9 |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: * | Symptom:
3850 re-writes mobility capwap data packets with TTL 9
Conditions:
3850 re-writes mobility capwap data packets with TTL 9. As a result any capwap data packets(DHCP/ARP etc) sent via mobility tunnel will have a TTL set to 9 which means these packets will not be able to make more than 9 hops.
In an environment where 3850 wlan is anchored to another WLC/Switch >9 hops away, clients will not be able to get DHCP IP.
Hardware affected: 3850/3650
Software versions impacted: 3.3.x, 3.6.0, 3.6.1, 3.6.2, 3.7.0, 3.7.1
5760 is not impacted by this issue
Workaround:
Shorten the path between the foreign and anchor or upgrade to fixed image(IOS-xe 3.7.2 or 3.6.3).
Further Problem Description:
None.
|
|
Last Modified: | 22-AUG-2015 |
|
Known Affected Releases: | 15.2(3)E |
|
Known Fixed Releases: | 15.2(3)E2, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | New |
Bug Id: | CSCuv78424 | Title: | Unicast ARP packets are duplicated |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
3650/3850 duplicates unicast ARP request packets destined for its IP and sends back 2 replies for one ARP request packet sent by the host.
Conditions:
NA
Workaround:
NA
Further Problem Description:
|
|
Last Modified: | 28-AUG-2015 |
|
Known Affected Releases: | 15.2(3)E |
|
Known Fixed Releases: | |
|
|
| |
| |
|
Alert Type: | New |
Bug Id: | CSCuu86656 | Title: | 2 different policies with same order of class-maps on same asic |
|
Status: | Fixed |
|
Severity: | 2 Severe |
Description: | Symptom:
traffic hits in correct class-map if we configure 2 different policies with same order of class-maps(these class-maps are port-range based acls) on same asic.
Conditions:when the policy contains L4 range match (e.g, tcp port > 100), and only reboot.
Workaround:manually reconfig after reboot.
More Info:
|
|
Last Modified: | 30-AUG-2015 |
|
Known Affected Releases: | Rev |
|
Known Fixed Releases: | 15.2(3)E2, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCut98110 | Title: | 3850: ARP ACL ace log restriction should be removed |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
3850 doesn't support ARP ACL log option
arp access-list DAI
deny ip host 172.28.78.1 mac any log
permit ip any mac any
Switch(config)#ip arp inspection filter DAI vlan 20-21 static
%Command rejected:arp acl with 'log' keyword is not supported.
Conditions:
cat3850
Workaround:
None
Further Problem Description:
|
|
Last Modified: | 03-AUG-2015 |
|
Known Affected Releases: | 16.2(0), n/a |
|
Known Fixed Releases: * | 15.2(3)E2, 15.2(4.10.60)PI5, 15.2(5.0)ST |
|
|
| |
| |
|
Alert Type: | New |
Bug Id: | CSCui61021 | Title: | one policymap should be able to be associated with multiple access-group |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
one policymap not able to be associated with multiple access-group
Conditions:
multiple access-group with one policy map
Workaround:
Further Problem Description:
|
|
Last Modified: | 27-AUG-2015 |
|
Known Affected Releases: | 15.0(11.65)EMP1 |
|
Known Fixed Releases: | 15.2(2)E, 3.6(0)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuv89877 | Title: | fed crashed on removing service-policy |
|
Status: * | Other |
|
Severity: * | 3 Moderate |
Description: | Symptom:
remove service policy might trigger switches to crash
Conditions:
remove service-policy from input/output of an GE interface.
Workaround:
unknown at this point
refrain from remove service-policy during business hours
Further Problem Description:
|
|
Last Modified: | 26-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ5 |
|
Known Fixed Releases: | |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuv19773 | Title: | "nmsp attach suppress" not being added into run-config on WS-C3850-24P |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
"nmsp attach suppress" disables IPDT related feature on the interface, however command is not added into run-config, hence upon a reload IPDT is still enabled and Customer has to disable it once again:
B.06-3800-8(config)#do sh ip devic tra int gi1/0/1
--------------------------------------------
Interface GigabitEthernet1/0/1 is: STAND ALONE
IP Device Tracking = Disabled
IP Device Tracking Probe Count = 3
IP Device Tracking Probe Interval = 30
IPv6 Device Tracking Client Registered Handle: 98
IP Device Tracking Enabled Features:
HOST_TRACK_CLIENT_ATTACHMENT
--------------------------------------------
B.06-3800-8(config)#int gi1/0/1
B.06-3800-8(config-if)#nmsp attachment suppress
B.06-3800-8(config)#do sh run int gi1/0/1
Building configuration...
Current configuration : 38 bytes
!
interface GigabitEthernet1/0/1
end
B.06-3800-8(config)#do sh ip device track int gi1/0/1
--------------------------------------------
Interface GigabitEthernet1/0/1 is: STAND ALONE
IP Device Tracking = Disabled
IP Device Tracking Probe Count = 3
IP Device Tracking Probe Interval = 30
IP Device Tracking Enabled Features:
--------------------------------------------
Conditions:
- WS-C3850-24P running 3.7.0E or 3.7.1E
Workaround:
- add manually "nmsp attach suppress" under each interface upon every single reload of the switch
Further Problem Description:
|
|
Last Modified: | 25-AUG-2015 |
|
Known Affected Releases: | 3.7(0)E |
|
Known Fixed Releases: * | 15.2(4.0.75a)E, 15.2(4.0.80)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuj17317 | Title: | XE: Certain snagless cables may press on the mode button causing reload |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Request to adjust the current behavior. This bug is being considered as an enhancement to avoid future unexpected resets on existing hardware. There is a field notice to inform customers of possible hard (non-software) workarounds to the issue:
http://www.cisco.com/en/US/customer/ts/fn/636/fn63697.html
Symptom:
Express Setup is a feature that allows for quick configuration of basic features on the WS-C3850 and other IOS-XE based switches. Express Setup is invoked through holding the Mode button for 2 seconds on an unconfigured switch or for 10 seconds on a previously configured switch. When this happens the switch configuration is deleted and the switch reboots and can be configured using Express Setup or via the CLI.
Large anti-snag cable boots have the potential of coming into contact with the mode button resulting in the unexpected invocation of Express Setup. This request is for a change in the default behavior of Express Setup to avoid invocation when a switch is in production and invocation is undesirable.
Conditions:
The cable boot is making extended contact with the mode button resulting in Express Setup being invoked. The following messages are seen when this issue is encountered on the WS-3850-48 or other IOS-XE based switch:
##########################
%SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram
%EXPRESS_SETUP-6-CONFIG_IS_RESET: The configuration is reset and the system will now reboot
%SYS-5-RELOAD: Reload requested by NGWC led process. Reload Reason: Reload command.
%STACKMGR-1-RELOAD_REQUEST: 1 stack-mgr: Received reload request for all switches, reason Reload command
%STACKMGR-1-RELOAD: 1 stack-mgr: Reloading due to reason Reload command
##########################
The device will then reset and the configuration will not be present when it comes back up.
Workaround:
Disable Express Setup with the following command:
no setup express
Or remove the the cable boot from the cable installed in port 1.
Further Problem Description:
|
|
Last Modified: | 21-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EX1 |
|
Known Fixed Releases: * | 15.0(1)EZ4, 15.0(1.77)ZSR, 15.0(13.85)EZD, 15.0(14.1)TSR, 15.0(14.5)TTT, 15.0(14.57)EZD, 15.0(2.29)ZSR, 15.2(2)E, 15.2(2b)E, 15.2(4.0)ST |
|
|
| |
| |
|
Alert Type: | New |
Bug Id: | CSCuv70040 | Title: | Smartinstall failing when configuring custom connectivity on a 3850 |
|
Status: | Open |
|
Severity: | 3 Moderate |
Description: | Symptom:
2960x failing smartinstall when the director is 3850 running 03.06.00
Conditions:
3850 is Director and 2960X as the client
Workaround:
use custom product id and match model number of the client
Further Problem Description:
|
|
Last Modified: | 20-AUG-2015 |
|
Known Affected Releases: | 3.6(0) |
|
Known Fixed Releases: | |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCup24700 | Title: | Switch reloaded on "mac address-table static mac vlan int" cmd |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
Switch may reload after configuring mac address-table static vlan <#> int
Conditions:
Checking for any specific conditions related to network where this is crashing
Workaround:
None at this time
Further Problem Description:
|
|
Last Modified: | 15-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ3 |
|
Known Fixed Releases: * | 15.0(1)EZ4, 15.0(1.77)ZSR, 15.0(14.1)TSR, 15.0(14.57)EZD, 15.0(14.9)EZD, 15.0(2.29)ZSR, 15.2(2)E1, 15.2(2.23)PSR, 15.2(2.39)PSR, 15.2(2b)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuo77295 | Title: | Secondary WLC5760 crashed during reverting back from Primary |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
Secondary WLC5760 crashed during reverting back from Primary
Conditions:
step1. set up HA ( WLC1 is primary and WLC2 is secondary)
step2. WLC1 goes down and WLC2 become a primary WLC
step3. when WLC1 revert back to a primary, WLC2 crashed
Workaround:
na
Further Problem Description:
na
|
|
Last Modified: | 15-AUG-2015 |
|
Known Affected Releases: | 15.0DPB |
|
Known Fixed Releases: * | 15.0(1)EZ4, 15.0(1.77)ZSR, 15.0(13.92)EZD, 15.0(14.1)TSR, 15.0(14.15)TTT, 15.0(14.57)EZD, 15.0(2.29)ZSR, 15.2(2)E1, 15.2(2.23)PSR, 15.2(2.39)PSR |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuq39180 | Title: | NGWC Webauth form cannot be submitted with enter key |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
in 3.3.x: Pressing enter key submit web auth form for computer, but not for mobile devices such as iPhone or Windows Phone.
Conditions:
WebAuth
Workaround:
Use custom HTML template.
Further Problem Description:
|
|
Last Modified: | 05-AUG-2015 |
|
Known Affected Releases: | n/a |
|
Known Fixed Releases: * | 15.2(1)IC273.173, 15.2(2)E1, 15.2(3)E, 15.2(4.0)ST, 15.2(5.0)ST, 15.5(0.18)S0.6, 15.5(1)S, 15.5(1)SN, 15.5(1.8)S, 16.1(0.49) |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCut21614 | Title: | SR632757933:Unable to ping beyond 3850 due to same vlan id & l3ifindex |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
L2/L3 connectivity can go down when another port in a different vlan is shut/no shut.
Conditions:
The internal l3ifindex and the vlan id share the same index value.
Workaround:
Assign a different vlan id to the port so that the l3ifindex no longer shares the same index with the vlan.
Further Problem Description:
|
|
Last Modified: | 06-AUG-2015 |
|
Known Affected Releases: | 15.2(2.0.0) |
|
Known Fixed Releases: * | 15.2(3)E2, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCut68387 | Title: | FED Memory corruption Crash due to CGM |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
FED process crash with errors mentioning memory corruption
Conditions:
Unknown
Workaround:
Unknown
Further Problem Description:
|
|
Last Modified: | 06-AUG-2015 |
|
Known Affected Releases: | 15.2(3.16)M0.7 |
|
Known Fixed Releases: * | 15.2(3)E2, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCut49440 | Title: | 3850 class-map "match" doesn't work correctly |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
If class-map match-any has "match dscp" and "match ip precedence" as follows, traffic with dscp value doesn't hit the policy-map.
!
class-map match-any DSCP-CS5
match dscp cs5
match ip precedence 5
!
policy-map PM-PQ
class DSCP-CS5
police cir 8000 conform-action transmit exceed-action drop
Conditions:
"match ip precedence " is configured in same the class-map.
Workaround:
Either removing " match ip precedence x" or configuring "match dscp xx" after "match ip precedence x" would resolve the issue.
!
class-map match-any DSCP-CS5
match ip precedence 5
match dscp cs5
Further Problem Description:
|
|
Last Modified: | 06-AUG-2015 |
|
Known Affected Releases: | 3.7(0)E |
|
Known Fixed Releases: * | 15.2(3)E2, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCut81374 | Title: | After reload, C3850-NM-4-10G/GLC-SX-MM not linkup with speed nonegotiate |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
The ports using with C3850-NM-4-10G / GLC-SX-MM is not link-up after switch reload.
This issue is only seen "speed nonegotiate" setting.
Conditions:
3850 running with 3.6.0E /3.6.1E /3.7.0E.
Workaround:
Delete "speed nonegotiate" and input same configuration again.
Further Problem Description:
none
|
|
Last Modified: | 06-AUG-2015 |
|
Known Affected Releases: | 15.2(2)E, 15.2(2)E1, 15.2(3)E |
|
Known Fixed Releases: * | 15.2(3)E2, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCui92373 | Title: | gui : click on wired express setup redirects to blank page |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
gui : click on wired express setup redirects to blank page
Conditions:
gui : click on wired express setup redirects to blank page
Workaround:
directly type the http:// and click the wired webui/wired express setup page directly instead of navigating to the other pages and coming back
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.0SID |
|
Known Fixed Releases: * | 15.2(1.30)PSR, 15.2(2)E, 15.2(2b)E, 15.2(4.0)ST, 15.2(4.0.64a)E, 15.2(5.0)ST, 3.6(0)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuo55427 | Title: | IP theft msg should add old/new IP for which IP-theft is being notified |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
Currently when we detect IP theft we get the below syslog
*Jan 15 12:58:45 HKT: WCDB-3-WCDB_IP_CONFLICT IP theft found!! The wired client-1499.e21d.e9ae source-ARP tries to steal the IP 10.25.0.21 of the wireless host-0026.abd4.a2a7 source-ARP
If we include the interfaces of the old and new IP entry for which IP-theft is being notified then this helps us to troubleshoot the issue better
Conditions:
When IP theft is detected
Workaround:
NA
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ3, 15.2(22.22) |
|
Known Fixed Releases: * | 15.0(1)EZ4, 15.0(1.3)TTT, 15.0(1.77)ZSR, 15.0(13.77)EZD, 15.0(14.1)TSR, 15.0(14.57)EZD, 15.0(2.29)ZSR, 15.2(2)E, 15.2(2.2.32)EA, 15.2(2b)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCun82902 | Title: | ARP packet forwarded although the ports have "switchport protected' |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
ARP packet is forwarded although the ports have "switchport protected' configuration
Conditions:
When IPDT is enabled and "switchport protected" configured on both incoming and outgoing port. This issue also triggers with Dyanmic Arp inspection and switchport protect configuration on incoming and outgoing port. Please note that IPDT is on by default on 3850 switch.
Workaround:
One option is to "disable IPDT"/DAI if configured provided customer does not have wireless setup and he is fine with that..
to disable IPDT, pls configure "nmsp attachment suppress" on C3850 protected port.
But igmpv2 packet will not be addressed with this work around
Further Problem Description:
This issue comes when IPDT/DAI enabled. in this case ARP packet is not going through the security port check.
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | n/a |
|
Known Fixed Releases: * | 15.0(1)EZ4, 15.0(1.77)ZSR, 15.0(14.1)TSR, 15.0(14.13)EZD, 15.0(14.57)EZD, 15.0(2.29)ZSR, 15.2(1.41)PSR, 15.2(2)E, 15.2(2.2.32)EA, 15.2(4.0)ST |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCun05898 | Title: | mac aging time reset to default 300 on switch reload |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
MAC aging timer resets to default 300 on switch reload when configured equal to Global Aging Time
Conditions:
Configured equal to Global Aging Time
Workaround:
none
Further Problem Description:
btv-vua-7#show mac address-table aging-time
Global Aging Time: 480
btv-vua-7(config)#mac address-table aging-time 480 vlan 2007
btv-vua-7#wr mem
Building configuration...
Compressed configuration from 25023 bytes to 9777 bytes[OK]
btv-vua-7#relode
Reload command is being issued on Active unit, this will reload the whole stack
Proceed with reload? [confirm]
Connection timed out
After Reload:
btv-vua-7#show mac address-table aging-time
Global Aging Time: 480
Vlan Aging Time
---- ----------
2007 300
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ, n/a |
|
Known Fixed Releases: * | 15.0(1)EZ4, 15.0(1.77)ZSR, 15.0(14.1)TSR, 15.0(14.12)EZD, 15.0(14.57)EZD, 15.0(2.29)ZSR, 15.2(1.30)PSR, 15.2(2)E, 15.2(2b)E, 15.2(4.0)ST |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCun91945 | Title: | 3850 returns incorrect SNMP value for cpeExtPsePortEntPhyIndex |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
3850 returns incorrect SNMP value for cpeExtPsePortEntPhyIndex.
Conditions:
3850 returns incorrect SNMP value for cpeExtPsePortEntPhyIndex.
Workaround:
none
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.0(1)S3.3, 15.2(2)E |
|
Known Fixed Releases: * | 15.2(1.41)PSR, 15.2(2)E, 15.2(2.2.32)EA, 15.2(2b)E, 15.2(4.0)ST, 15.2(4.0.64a)E, 15.2(5.0)ST, 3.6(0)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCui75064 | Title: | 3850 Power command not functional under global config |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
3850 Power command not functional under global config.
witch(config)#p?
parameter-map parser passwd password
policy-map port-channel power <<< priority-list
privilege process process-max-time
However, when you try this command it says incomplete
Switch(config)#power
% Incomplete command.
Conditions:
Power option should not be there in global config mode for Edison but should be there for incredibles.
Workaround:
Cat3850 returns FALSE to reg_invoke_ilpower_consumption_supported().
Add the "inline" keyword if reg_invoke_ilpower_consumption_supported() returns TRUE.
Further Problem Description:
Under config mode power command removed.So that for 3850 it will not show any power command under config mode but for classic switches it should work.
For Edison:
=================================================================
Switch(config)#p?
parameter-map parser passthru-domain-list passwd
password pnp policy-map port-channel
priority-list privilege process process-max-time
profile
Switch(config)#po
Switch(config)#po?
policy-map port-channel
Switch(config)#power?
% Unrecognized command
Switch(config)#power ?
% Unrecognized command
Switch(config)#power
^
% Invalid input detected at '^' marker.
Switch(config)#inter g6/0/1
Switch(config-if)#p?
pagp power
For Classic (3750)
==============================================
WS-C3750X(config)#power ?
inline Inline power configuration
rps RPS port configuration
xps XPS configuration
WS-C3750X(config)#power inline ?
consumption Inline device power consumption
logging Inline power logging messages
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 3.2(2)SE |
|
Known Fixed Releases: * | 15.0(1)EZ4, 15.0(1.3)TTT, 15.0(1.77)ZSR, 15.0(13.77)EZD, 15.0(14.1)TSR, 15.0(14.57)EZD, 15.0(2.29)ZSR, 15.2(1.24)PSR, 15.2(1.30)PSR, 15.2(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCum81233 | Title: | Config long vlan name cause tracback wcm_cs_debug_api + 780 |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
%DATACORRUPTION-1-DATAINCONSISTENCY: copy error, -PC= 52705290
-Traceback= 1#6a6c87117f2275246f32e67dc3e37e6a :54DF8000+1F98E0C :54DF8000+1FCB944 :54DF8000+3BB3508 :54DF8000+A9C374 :54DF8000+AA2CE4 :54DF8000+A9BEB4 :54DF8000+AA088C :54DF8000+34212EC
Conditions:
-error occurs when a vlan is configured with a long name (longer that 30 signs) and just after that we go to another vlan configuration mode with "vlan x" command
- 3850 running cat3k_caa-universalk9.SPA.03.03.01.SE.150-1.EZ1.bin
- error occurs just once on the device and to trigger the error again need to reload 3850 and once again proceed with step 1
Workaround:
none
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | n/a |
|
Known Fixed Releases: * | 15.0(1)EZ3, 15.0(13.46)EZD, 15.0(14.1)TSR, 15.0(14.49)EZD, 15.0(2.29)ZSR, 15.2(1.30)PSR, 15.2(2)E, 15.2(2b)E, 15.2(4.0)ST, 15.2(4.0.64a)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCum96372 | Title: | 3850 returns false for cswRingRedundant with provisioned switch |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
When trying to pull the object cswRingRedundant from a 3850 stack, we will return false if there are any switches that are provisioned.
Conditions:
Any 3850 stack that has a provisioned switch will return false when pulling cswRingRedundant
Workaround:
Unprovison the switch when pulling cswRingRedundant
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 3.2(0.1.1) |
|
Known Fixed Releases: * | 15.0(1)EZ4, 15.0(1.6)TTT, 15.0(1.77)ZSR, 15.0(13.80)EZD, 15.0(14.1)TSR, 15.0(14.57)EZD, 15.0(2.29)ZSR, 15.2(1.30)PSR, 15.2(2)E, 15.2(2b)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCun22639 | Title: | ip source guard with mac-check prevents DHCP |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
The DHCP table is not getting populated when a new host is plugged into the port if the command "ip verify source mac-check" is enabled , the DHCP request from that host are being blocked and therefore the host does never receive an ip address.
Conditions:
3850
ip verify source mac-check is configured on the ports connecting to hosts
Workaround:
use the source-guard feature without the mac-check keyword
Further Problem Description:
As per configuration guide, "ip verify source mac-check" is supposed to create a new DHCP snooping binding entry for every new host connected to the ports on 3850, but is not.
http://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3.2_0_se/multibook/configuration_guide/b_consolidated_config_guide_3850_chapter_0110110.pdf
Symptom:
Clients fails to get DHCP when ipsg and portsecurity and enabled on the port.
Conditions;
When port security gives calls ipsg to lookinto the new mac arrived.
Workaround:
Added check to verify if maccheck is supported on the platform, which makes sure
that in case of NG3k it doesn't verify mac binding.
Now this will not cause any issue for 3k and 4k since 3k and 4k do not support
maccheck, hence will work as it is today
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ |
|
Known Fixed Releases: * | 15.0(1)EZ3, 15.0(13.22)EZD, 15.0(14.1)TSR, 15.0(14.49)EZD, 15.0(2.29)ZSR, 15.2(1.30)PSR, 15.2(2)E, 15.2(2b)E, 15.2(4.0)ST, 15.2(4.0.64a)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuq08184 | Title: | ip cef accounting non-recursive - on 3850 causes CPU to spike |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
ip cef accounting non-recursive - on 3850 causes CPU to spike for recursive and non-recursive prefixes
Conditions:
This command accounts for traffic hitting a recursive prefix against the non-recursive prefix that its next hop resolves through.
Hence, we are seeing the packets being punted to the cpu when we have accounting for non-recursive prefixes too
This issue is seen only on 3850. Tested on 6500 and none seen.
So let's take the following example
10.0.0.0/24 via 11.11.11.11
20.0.0.0/24 via 11.11.11.11
11.11.11.0/24 via 2.2.2.2, eth0
When non-recursive accounting is turned on traffic hitting 10.0.0.0/24 and 20.0.0.0/24 is accounted using a counter associated with 11.11.11.0/24
Workaround:
Remove the command
Further Problem Description:
This command is not supported on 3850, as per discussion with BU.
When we configure this command on 6500 (with the same route conditions), the CPU utilization before and after configuring this command, is the same
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | n/a |
|
Known Fixed Releases: * | 15.2(2)E2, 15.2(3)E, 15.2(4.0)ST, 15.2(4.0.64a)E, 15.2(5.0)ST, 3.6(2)E, 3.7(0)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCun89248 | Title: | C3850 stack does not filter broadcast traffic on the flexlink |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
if Cat3850 stack switchover,
it does not filter broadcast packet on flexlink standby port.
Conditions:
- configure a lot of flexlink
- with 3.3.0SE to 3.3.2SE, but not on 3.2.3SE.
Workaround:
reload the stack
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 3.3(2)SE |
|
Known Fixed Releases: * | 15.0(1)EZ4, 15.0(1.77)ZSR, 15.0(14.1)TSR, 15.0(14.12)EZD, 15.0(14.57)EZD, 15.0(2.29)ZSR, 15.2(1.41)PSR, 15.2(2)E, 15.2(2.2.32)EA, 15.2(2b)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCus37493 | Title: | Dynamic ARP inspection filtering affects DAI trusted ports |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
ARP for an IP address shows as incomplete.
Conditions:
DAI filtering is configured and interfaces where ARP packets are ingressing are DAI trusted.
Workaround:
Disable DAI filtering, or remove applicable deny statement in DAI filtering ARP ACL.
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ5, 15.2(2)E1 |
|
Known Fixed Releases: * | 15.2(2)E2, 15.2(3)E1, 15.2(4.0.64a)E, 15.2(5.0)ST, 3.6(2)E, 3.7(1)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCut06428 | Title: | backup flexlink with multicast fast-convergence is leaking igmp leave |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
Backup flexlink port with "multicast fast-convergence" is leaking igmp leave packets causing loop
Conditions:
NG3k switch with flexlink configuration and "multicast fast-convergence" option
Workaround:
disable "multicast fast-convergence" option
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 3.6(0) |
|
Known Fixed Releases: * | 15.2(3)E2, 15.2(4.0.64a)E, 15.2(5.0)ST, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCut29532 | Title: | FlexLink and QinQ breaks communication on 3850 |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
- on dot1q-tunnel interface in egress direction the outer tag (Service Provider's VLAN ID) is not stripped when forwarding traffic to Customer's equipment
Conditions:
- 3850 with 03.06.00 or 03.06.01 or 03.07.00
- QinQ is configured
- FlexLink is configured on dot1q-tunnel interface
!
interface GigabitEthernet1/0/1
switchport access vlan 1082
switchport mode dot1q-tunnel
switchport backup interface Gi1/0/3 <================= FlexLink configured
l2protocol-tunnel cdp
l2protocol-tunnel stp
no cdp enable
!
Workaround:
- remove FlexLink configuration from dot1q-tunnel interface
!
interface GigabitEthernet1/0/1
switchport access vlan 1082
switchport mode dot1q-tunnel
! switchport backup interface Gi1/0/3 <================= FlexLink configuration is commented out (removed)
l2protocol-tunnel cdp
l2protocol-tunnel stp
no cdp enable
!
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.2(3)E |
|
Known Fixed Releases: * | 15.2(3)E2, 15.2(4.0.64a)E, 15.2(5.0)ST, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCur95710 | Title: | interface DLY value changes after stack switchover |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
C3850 interface DLY value changes after stack switchover.
Conditions:
After reloading the active switch of stacked C3850, the interface
delay value changes on the port of new active switch.
This issue is seen when the link speed is 100Mbps or 10Mbps.
e.g.
interface GigabitEthernet2/0/24
speed 100
duplex full
(before switchover)
GigabitEthernet2/0/24 is up, line protocol is up (connected)
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
(after switchover)
GigabitEthernet2/0/24 is up, line protocol is up (connected)
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 10 usec,
This condition is recovered by shut/no shut on this port.
Workaround:
Configure delay manually on the interface.
e.g.
interface GigabitEthernet2/0/24
delay 10
speed 100
duplex full
Switch#sh int g2/0/24 | i DLY
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.2(2)E1 |
|
Known Fixed Releases: * | 15.2(1)SY1, 15.2(3)E1, 15.2(3)E2, 15.2(4.0.64a)E, 15.2(5.0)ST, 3.7(1)E, 3.7(2)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCun37216 | Title: | Phones not tracked correctly/at all on chassis/stack switches |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
Phones not being tracked or not showing on the correct switchport. Descriptions showing up on the wrong switch port or not at all in CER.
Conditions:
Chassis/Stack switch which switchports where new blade is added after install and switch has not been rebooted.
Chassis/Stack switch with IfIndex persistence configured.
Workaround:
If ifIndex persistence is configured on the switch, remove that configuration then reboot the stack/chassis.
If ifIndex persistence is not configured, a reboot of the stack/chassis should resolve the issue.
This should result in switchports being arranged sequentially in the SNMP response the switch sends so CER can read it in correctly.
Further Problem Description:
|
|
Last Modified: | 08-AUG-2015 |
|
Known Affected Releases: | 15.1(100.1) |
|
Known Fixed Releases: * | 15.2(2)E1, 15.2(2.54)PSR, 15.2(2b)E, 15.2(3)E, 15.2(4.0)ST, 15.2(4.0.64a)E, 15.2(5.0)ST, 3.6(1)E, 3.7(0)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuo07760 | Title: | 03.06.00E - H/W version is not correct or showing 0 |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
H/W version value is incorrect on the stack if they are all not booted at the same time.
Conditions:
If the switches are booted up one by one
Workaround:
Boot all switches simultaneously
Further Problem Description:
|
|
Last Modified: | 15-AUG-2015 |
|
Known Affected Releases: | 15.2(2.2.53)E |
|
Known Fixed Releases: * | 15.2(2)E2, 15.2(3)E, 15.2(4.0)ST, 15.2(4.0.64a)E, 3.6(2)E, 3.7(0)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuo46878 | Title: | Incomplete arp issue seen as incorrect bridging for arp packet w IPDT |
|
Status: | Fixed |
|
Severity: | 3 Moderate |
Description: | Symptom:
ARP reply packets that are sent with switchport MAC address as destination address are flooded back to network by the switch. Ideally, such packets should be consumed by the switch.
Conditions:
The switchport MAC address is used as source MAC and sender MAC when ARP probes are sent by IPDT feature. The replies to these packets will cause this issue.
Workaround:
There is no workaround to this problem. However, the impact of this issue can reduced if IPDT feature is disabled on switch-to-switch links. This avoids such packets from being flooded to other switches.
Further Problem Description:
|
|
Last Modified: | 15-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ2, n/a |
|
Known Fixed Releases: * | 15.0(1)EZ4, 15.0(1.77)ZSR, 15.0(13.82)EZD, 15.0(14.1)TSR, 15.0(14.2)TTT, 15.0(14.57)EZD, 15.0(2.29)ZSR, 15.2(2)E1, 15.2(2.23)PSR, 15.2(2.39)PSR |
|
|
| |
| |
|
Alert Type: | New |
Bug Id: | CSCuv76831 | Title: | DIAG errors on 3850 switch |
|
Status: | Other |
|
Severity: | 4 Minor |
Description: | Symptom:
Following errors seen continuously on 3850 switch :
Jul 28 15:49:19.467 JKT: **DIAG** card_detect(2,-1) (KSI-LAND-1-2)
Jul 28 15:49:19.467 JKT: **DIAG** Duplicate card in diag_insert_diag_info(switch 2) (KSI-LAND-1-2)
Jul 28 15:50:46.764 JKT: update test result card(1)/sub_card(-1)/info_type(0)/testing_type(4) (KSI-LAND-1-2)
Jul 28 15:50:46.764 JKT: update non per-port test result[4] = 2 (KSI-LAND-1-2)
Jul 28 15:50:46.764 JKT: Overall test result card(1)/sub_card(-1): 0 0 0 0 (KSI-LAND-1-2)
Conditions:
Problem persists even after configuring "no debug diagnostic all"
Workaround:
Logging discriminator can be used to stop seeing the messages
Further Problem Description:
No impact to switch performance
|
|
Last Modified: | 20-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ5 |
|
Known Fixed Releases: | |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCun63989 | Title: | Express setup logs (express_setup.debug) should include more details |
|
Status: | Fixed |
|
Severity: | 4 Minor |
Description: | Symptom:
There is no way to tell which switch triggered the reset when the Mode button is pressed.
Conditions:
3850 switch with a Mode button.
Workaround:
None
Further Problem Description:
This enhancement will include for information in the express setup file regarding the switch number and timestamp.
|
|
Last Modified: | 15-AUG-2015 |
|
Known Affected Releases: | 15.0(1)EZ2 |
|
Known Fixed Releases: * | 15.2(1)SY1, 15.2(3)E1, 15.2(4.0)ST, 15.2(4.0.64a)E, 3.7(1)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuu51994 | Title: | vlan information not reflect when only config vlan under channel |
|
Status: * | Open |
|
Severity: * | 4 Minor |
Description: | Symptom:
when set 'switchport mode access' and 'switchport access vlan x' under port-channel and add physical interface into port-channel by 'channel-group x mode active' (not setting 'switchport access vlan x' again under physical interface again), from show run there is no 'switchport access vlan x' command under both port-channel and physical interfaces. but from show interface status, those ports are accessport for vlan x.
Conditions:
set 'switchport mode access' and 'switchport access vlan x' under port-channel and add physical interface into port-channel by 'channel-group x mode active' (not setting 'switchport access vlan x' again under physical interface again)
Workaround:
set 'switchport mode access' and 'switchport access vlan x' under both port-channel and physical interface
Further Problem Description:
|
|
Last Modified: | 25-AUG-2015 |
|
Known Affected Releases: | 15.2(2)E2 |
|
Known Fixed Releases: | |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuq14913 | Title: | 3850 allows two level policing in hierarchical policy-map |
|
Status: | Fixed |
|
Severity: | 4 Minor |
Description: | Symptom:
The switch erroneously allows two level policing in the hierarchical policy-map.
Conditions:
Workaround:
There is no workaround.
Further Problem Description:
|
|
Last Modified: | 15-AUG-2015 |
|
Known Affected Releases: | 3.6(0)E |
|
Known Fixed Releases: * | 15.2(1)SY1, 15.2(2)E2, 15.2(3)E1, 15.2(4.0)ST, 15.2(4.0.64a)E, 3.6(2)E, 3.7(1)E |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuu34717 | Title: | 3850 cts enforcement for multicast traffic |
|
Status: | Fixed |
|
Severity: | 4 Minor |
Description: | Symptom:
3850 platform configured for trustsec will check policies for multicast traffic (we do have enforcement for multicast traffic). Multicast traffic is classified to (sgt,0) if one is defined, otherwise hits the default sgacl (0,0).
The same behavior is also for 3650 and 5760.
Most of the other platform is not using trustsec enforcement for multicast traffic.
This is platform specific behavior and bug has been created to document it.
Conditions:
cts on 3850/3650/5760 and muticast traffic
Workaround:
If the catchall is defined as a permit instead of deny, then multicast traffic is forwarded.
Further Problem Description:
The fix involves ensuring the deny acl is not applied to multicast traffic.
|
|
Last Modified: | 03-AUG-2015 |
|
Known Affected Releases: | 3.7(0) |
|
Known Fixed Releases: * | 15.2(3)E2 |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuu83648 | Title: | Port assignment to a Vlan using SNMP not reflected on show run interfac |
|
Status: * | Other |
|
Severity: | 5 Cosmetic |
Description: | Symptom:
customer has configured a VLAN using SNMP MIBs, but when ?show interface? is run on the 3850 switch the change is not displayed. However, the change is observed on the ?show vlan? output.
port 2/0/31
interface GigabitEthernet2/0/31
switchport mode access
no snmp trap link-status
spanning-tree portfast
end
sho vlan
10 IDF-H active Gi2/0/31
Also, when using the command #sho run all | b interface GigabitEthernet2/0/31 the change is displayed:
interface GigabitEthernet2/0/31
switchport
switchport access vlan 10
The SNMP command is:
$Dsetting="1.3.6.1.4.1.9.9.68.1.2.2.1.2.$interface";
snmp2_set("$switch", "$Wcommunity", "$Dsetting" , "$type", "$_POST[DVLAN]");
$interface is the interface
And "$_POST[DVLAN] is the VLAN
Conditions:
A customer has configured a vlan and assigned a port to it using SNMP on a 3850 running 03.06.02A.
Workaround:
To verify the port has been assigned to the intended VLAN used the following commands:
show vlan
sho run all | b interface GigabitEthernet
Further Problem Description:
|
|
Last Modified: | 21-AUG-2015 |
|
Known Affected Releases: | 15.2(2)E |
|
Known Fixed Releases: | |
|
|
| |
| |
|
Alert Type: | Updated * |
Bug Id: | CSCuv84751 | Title: | when disable IPDT of interface at 3850, ping failed |
|
Status: * | Other |
|
Severity: * | 6 Enhancement |
Description: | Symptom:
when disable IPDT of interface at 3850, ping failed.
Conditions:
1.disable IPDT of interface at 3850
2.there is QOS related config at interface of 3850
Workaround:
1.no QOS config at interface of 3850
OR
2.ip device tracking probe delay 10 at 3850
Further Problem Description:
|
|
Last Modified: | 26-AUG-2015 |
|
Known Affected Releases: | 15.2(3)E |
|
Known Fixed Releases: | |
|
|
| |
| |
|
Alert Type: | New |
Bug Id: | CSCui42745 | Title: | GUI/CLI access to Cat3850 in spite of "no wireless mgmt-via-wireless" |
|
Status: | Open |
|
Severity: | 6 Enhancement |
Description: | Symptom:
Wireless client can telnet/ssh/http/https to Cat3850 even though "no wireless mgmt-via-wireless" is configured.
Conditions:
100% reproducible
Workaround:
Apply ACL policies on wlan to block ssh/telnet/http access to each of the IP interfaces defined on the switch or controller.
ip access-list extended no_mgmt
deny tcp any host X.X.X.X eq www
deny tcp any host X.X.X.X eq 22
deny tcp any host X.X.X.X eq telnet
permit ip any any
wlan JJwireless 1 JJwireless
client vlan 100
ip access-group no_mgmt
no security wpa
no security wpa akm dot1x
no security wpa wpa2
no security wpa wpa2 ciphers aes
no shutdown
* X.X.X.X is 3850/5760's wireless management interface address.
Further Problem Description:
|
|
Last Modified: | 29-AUG-2015 |
|
Known Affected Releases: | 15.0SID |
|
Known Fixed Releases: | |
|
|
| |
2013 Cisco and/or its affiliates. All rights reserved. 
没有评论:
发表评论