text:
Table Of Contents
Release Notes for the
Catalyst 3550 Multilayer Switch
Cisco IOS Release 12.1(14)EA1
Recommended Platform Configuration for Web-Based Management
Operating System and Browser Support
Determining the Software Version and Feature Set
Determining Which Files to Use
Upgrading a Switch by Using CMS
Upgrading a Switch by Using the CLI
Upgrading with a Nondefault System MTU Setting
Recovering from Software Failure
Using Express Setup to Configure a Switch
Configuring the Switch Settings
Verifying Switch IP Address (Optional)
Clearing the Switch IP Address and Configuration
Setting Up the Catalyst 3550 Initial Configuration
Cisco IOS Limitations and Restrictions
Cluster Limitations and Restrictions
CMS Limitations and Restrictions
Cisco IOS Caveats Resolved in Cisco IOS Release 12.1(14)EA1
CMS Caveats Resolved in Cisco IOS Release 12.1(14)EA1
References to the Cisco Documentation CD-ROM
Corrections to the Software Configuration Guide and Command Reference
Additions to the Hardware Installation Guide
Installing the Optional Ground Kit
Corrections to the Hardware Installation Guide
Obtaining Technical Assistance
Obtaining Additional Publications and Information
Release Notes for the
Catalyst 3550 Multilayer Switch
Cisco IOS Release 12.1(14)EA1
July 2003
The Cisco IOS Release 12.1(14)EA1 runs on all Catalyst 3550 multilayer switches.
These release notes include important information about this Cisco IOS release and any limitations, restrictions, and caveats that apply to it. Verify that these are the correct release notes for your switch:
•If you are installing a new switch, refer to the Cisco IOS release label on the rear panel of your switch.
•If your switch is on, use the show version privileged EXEC command. See the "Determining the Software Version and Feature Set" section.
•If you are upgrading to a new release, refer to the software upgrade filename for the Cisco IOS version.
For the complete list of Catalyst 3550 switch documentation, see the "Related Documentation" section.
You can download the switch software from these sites:
(for registered Cisco.com users with a login password)
(for nonregistered Cisco.com users)
This Cisco IOS release is part of a special release of Cisco IOS software that is not released on the same 8-week maintenance cycle that is used for other platforms. As maintenance releases and future Cisco IOS releases become available, they will be posted to Cisco.com (previously Cisco Connection Online [CCO]) in the Cisco IOS software area.
Note If you are upgrading a switch that uses the 802.1X security feature, you must reenable 802.1X after upgrading the software. For more information, see the "Upgrading Software and 802.1X" section.
This information is in the release notes:
•"System Requirements" section
•"Downloading Software" section
•"New Software Features" section
•"Limitations and Restrictions" section
•"Documentation Updates" section
•"Related Documentation" section
•"Obtaining Documentation" section
•"Obtaining Technical Assistance" section
•"Obtaining Additional Publications and Information" section
System Requirements
These are the system requirements for this Cisco IOS release:
•"Software Compatibility" section
Hardware Supported
Table 1 lists the hardware supported by this Cisco IOS release.
Table 1 Supported Hardware
Switch Description
Catalyst 3550-12T
10 Gigabit Ethernet 10/100/1000BASE-T ports and 2 GBIC1 -based Gigabit Ethernet slots
Catalyst 3550-12G
10 GBIC-based Gigabit Ethernet slots and 2 Gigabit Ethernet 10/100/1000BASE-T ports
Catalyst 3550-24
24 autosensing 10/100 Ethernet ports and 2 GBIC-based Gigabit Ethernet slots
Catalyst 3550-48
48 autosensing 10/100 Ethernet ports and 2 GBIC-based Gigabit Ethernet slots
Catalyst 3550-24-FX
24 100BASE-FX ports and 2 GBIC-based Gigabit Ethernet slots
Catalyst 3550-24-DC
24 autosensing 10/100 Ethernet ports, 2 GBIC-based Gigabit Ethernet slots, and an on-board DC2 power converter
Catalyst 3550-24PWR
24 autosensing 10/100 Ethernet ports, 2 GBIC-based Gigabit Ethernet slots, ability to provide power for Cisco IP Phones and Cisco Aironet Access Points from all 10/100 Ethernet ports, auto-detection and control of inline power on a per-port basis on all 10/100 ports
GBIC modules
•GigaStack GBIC
•CWDM3 fiber-optic GBIC
Redundant power system
Cisco RPS 300 Redundant Power System
Cisco RPS 675 Redundant Power System4
1 GBIC = Gigabit Interface Converter
2 DC = direct current
3 CWDM = Course Wave Division Multiplexer
4 The Cisco RPS 675 does not support the Catalyst 3550-24-DC switches.
Software Compatibility
These are the software compatibility requirements for this Cisco IOS release:
•"Recommended Platform Configuration for Web-Based Management" section
•"Operating System and Browser Support" section
•"Supported Java Plug-Ins" section
Recommended Platform Configuration for Web-Based Management
Table 2 lists the recommended platforms for web-based management.
Table 2 Recommended Platform Configuration for Web-Based Management
OS Processor Speed DRAM Number of Colors Resolution Font Size
Windows NT 4.01
Pentium 300 MHz
1024 x 768
Solaris 2.5.1 or higher
SPARC 333 MHz
Most colors for applications
Small (3)
1 Service Pack 3 or higher is required.
The minimum PC requirement is a Pentium processor running at 233 MHz with 64 MB of DRAM. The minimum UNIX workstation requirement is a Sun Ultra 1 running at 143 MHz with 64 MB of DRAM.
Note These are only the recommended configurations for running Cluster Management Suite (CMS). For information about all supported operating systems, see the next section.
Operating System and Browser Support
You can access the web-based interfaces by using the operating systems and browsers listed in Table 3. CMS checks the browser version when starting a session to ensure that the browser is supported.
Table 3 Supported Operating Systems and Browsers
Operating System Minimum Service Pack or Patch Netscape Communicator 1 Microsoft Internet Explorer 2
Windows 95
Service Pack 1
4.75, 6.22, or 6.23
5.5 or 6.0
Windows 98
Second Edition
4.75, 6.22, or 6.23
5.5 or 6.0
Windows NT 4.0
Service Pack 3 or later
4.75, 6.22, or 6.23
5.5 or 6.0
Windows 2000
4.75, 6.22, or 6.23
5.5 or 6.0
Windows XP
4.75, 6.22, or 6.23
5.5 or 6.0
Solaris 2.5.1 or later
Sun-recommended patch cluster for the OS and Motif library patch 103461-24
4.75, 6.22, or 6.23
Not supported
1 Netscape Communicator version 6.0 is not supported.
2 Service Pack 1 or higher is required for Internet Explorer 5.5.
Note If your browser is Internet Explorer and you receive an error message stating that the page might not display correctly because your security settings prohibit running activeX controls, this might mean that your security settings are set too high. To lower security settings, go to Tools > Internet Options, and select the Security tab. Select the indicated Zone, and move the Security Level for this Zone slider from High to Medium (the default).
Note In Cluster Management displays, Internet Explorer versions 4.01 and 5.0 might not display edge devices that are not connected to the command switch. Other functionality is similar to that of Netscape Communicator.
Supported Java Plug-Ins
One of the these Java plug-ins is required for the browser to access and run the Java-based CMS:
•Java plug-in 1.4
•Java plug-in 1.3.1
These Java plug-ins are supported both in Windows environments and on Solaris platforms. You can download the plug-ins and installation instructions from this URL:
Note Only one of these Java plug-ins is required for CMS. Do not install more than one Java plug-in.
On Solaris platforms, follow the instructions in the README_FIRST.txt file to install the Java plug-in.
Java Plug-In Notes
These notes apply to Java plug-in configuration:
•To verify that a supported version of the Java plug-in is installed, select Start > Settings > Control Panel. The Java plug-in is listed with the version number in the Control Panel menu.
•If you have installed the Java plug-in but CMS still does not launch, make sure that the plug-in is enabled by selecting Start > Settings > Control Panel > Java Plug-in. Click the Basic tab, select Enable Java Plug-in, and click Apply.
•If the Java applet does not initialize after you have installed and enabled the plug-in, open the Java Plug-in Control Panel (Start > Programs > Java Plug-in Control Panel), and verify these settings:
In the Proxies tab, verify that Use browser settings is checked and that no proxies are enabled.
•If you are running an Internet virus checker on Windows 2000 and the plug-in takes a long time to load, you can speed up CMS operation by disabling the virus checker filter option or download option or both.
From the Start menu on McAfee VirusScan, disable the VirusScan Internet Filter option, the Download Scan option, or both by selecting Start > Programs > Network Associates > Virus Scan Console > Configure.
From the taskbar, right-click the Virus Shield icon and in the Quick Enable menu, disable the options by deselecting Internet Filter or Download Scan. Windows XP, Windows 2000, Windows 95, Windows 98, and Windows NT 4.0 Plug-Ins.
Cluster Capability
When creating a switch cluster, we recommend configuring the highest-end switch in your cluster as the command switch.
A Catalyst 3550 switch can be a command switch or a member of a switch cluster.
If your cluster has Catalyst 3550, Catalyst 2950, Catalyst 2940, Catalyst 2900 XL, and Catalyst 3500 XL switches, the Catalyst 3550 switch should be the command switch. The Catalyst 3550 switch that has the latest software should be the command switch.
Table 4 lists the cluster capabilities and minimum software versions for the switches. The switches are listed in the order of highest to lowest end switch. A lower-end switch cannot be the command switch of a switch listed above it in the table (for example, a Catalyst 2940 switch cannot be the command switch of a cluster that has Catalyst 2950 or Catalyst 3550 switches.)
Table 4 Switch Software and Cluster Capability
Switch Cisco IOS Release Cluster Capability
Catalyst 3750
Release 12.1(11)AX or later
Member or command switch
Catalyst 3550
Release 12.1(4)EA1 or later
Member or command switch
Catalyst 2970
Release 12.1(11)AX r later
Member or command switch
Catalyst 2950
Release 12.0(5.2)WC(1) or later
Member or command switch
Catalyst 2955
Release 12.1(12c)EA1 or later
Member or command switch
Catalyst 2940
Release 12.1(13)AY r later
Member or command switch
Catalyst 3500 XL
Release 12.0(5.1)XU or later
Member or command switch
Catalyst 2900 XL (8-MB switches)
Release 12.0(5.1)XU or later
Member or command switch
Catalyst 2900 XL (4-MB switches)
Release 11.2(8.5)SA6 (recommended)
Member switch only1
Catalyst 1900 and 2820
Release 9.00(-A or -EN)
Member switch only
1 Catalyst 2900 XL (4-MB) switches appear in the front-panel and topology views of CMS. However, CMS does not support configuration or monitoring of these switches.
Some versions of the Catalyst 2900 XL software do not support clustering and if you have a cluster with switches that are running different versions of Cisco IOS software, software features added on the latest release might not be reflected on switches running the older versions. For example, if you start Visual Switch Manager (VSM) on a Catalyst 2900 XL switch running Cisco IOS Release 11.2(8)SA6, the windows and functionality can be different from a switch running Cisco IOS Release 12.0(5)WC(1) or later.
Note The CMS is not forward-compatible, which means that if a member switch is running a software version that is newer than the release running on the command switch, the new features are not available on the member switch. If the member switch is a new device supported by a software release that is later than the software release on the command switch, the command switch cannot recognize the member switch and it is displayed as an unknown device in the Front Panel view. You cannot configure any parameters or generate a report through CMS for that member; instead, you must launch the Device Manager application to perform configuration and obtain reports for that member.
Downloading Software
These are the procedures for downloading software:
•"Determining the Software Version and Feature Set" section
•"Determining Which Files to Use" section
•"Upgrading a Switch by Using CMS" section
•"Upgrading a Switch by Using the CLI" section
•"Recovering from Software Failure" section
Note Before downloading software, read this section for important information.
Caution The crypto image includes a bootloader upgrade. Do not power cycle the switch while you are copying this image to the switch. If a power failure occurs when you are copying this image to the switch, call Cisco Systems immediately.
When you upgrade a switch, the switch continues to operate while the new software is copied to Flash memory. If Flash memory has enough space, the new image is copied to the selected switch but does not replace the running image until you reboot the switch. If a failure occurs during the copy process, you can still reboot your switch by using the old image. If Flash memory does not have enough space for two images, the new image is copied over the existing one. Features provided by the new software are not available until you reload the switch.
If a failure occurs while copying a new image to the switch, and the old image has already been deleted, refer to the "Recovering from Corrupted Software" section in the "Troubleshooting" chapter of the Catalyst 3550 Multilayer Switch Software Configuration Guide.
Determining the Software Version and Feature Set
The Cisco IOS image is stored as a .bin file in a directory that is named with the Cisco IOS release. A subdirectory contains the files needed for web management. The image is stored on the system board Flash device (flash:).
You can use the show version privileged EXEC command to see the software version that is running on your switch. The second line displays C3550-I5Q3L2 for the enhanced multilayer software image (EMI) or C3550-I9Q3L2 for the standard multilayer software image (SMI).
Note Although the show version output always shows the software image running on the switch (Layer 2 only or Layer 2 and Layer 3), the model name shown at the end of this display is the factory configuration (SMI or EMI) and does not change if you upgrade the software image.
You can also use the dir filesystem: privileged EXEC command to see the directory names of other software images that you might have stored in Flash memory.
Determining Which Files to Use
The upgrade procedures in these release notes describe how to perform the upgrade by using a combined .tar file. This file contains both the Cisco IOS image file and the CMS files. You must use the combined .tar file to upgrade the switch through the CMS.
The .tar file is an archive file from which you can extract files by using the tar command. You also use the .tar file to upgrade the system by using the archive download-sw privileged EXEC command.
Table 5 lists the software filenames for this Cisco IOS release.
Table 5 Cisco IOS Software Files for Catalyst 3550 Switches
Cisco IOS SMI image file and CMS files.
This image has Layer 2+ and basic Layer 3 routing features.
Cisco IOS EMI image file and CMS files.
This image has both Layer 2+ and full Layer 3 features.
Cisco IOS SMI crypto image file and CMS files.
This image has the Kerberos, Secure Shell (SSH), Layer 2+, and basic Layer 3 routing features.
Cisco IOS EMI crypto image file and CMS files.
This image has the Kerberos, SSH, Layer 2, and full Layer 3 features.
The Catalyst 3550 switch is supported by either the SMI, which provides Layer 2+ features and basic Layer 3 routing, or the EMI, which provides Layer 2+ features, full Layer 3 routing, and advanced services. All Catalyst 3550 Gigabit Ethernet switches are shipped with the EMI installed. Catalyst 3550 Fast Ethernet switches are shipped with either the SMI or the EMI installed. After initial deployment, you can order the Enhanced Multilayer Software Image Upgrade kit to upgrade the Catalyst 3550 Fast Ethernet switches from the SMI to the EMI.
Upgrading a Switch by Using CMS
You can upgrade switch software by using CMS. From the menu bar, select Administration > Software Upgrade. For detailed instructions, click Help.
Caution If you are copying the crypto image to the switch, the bootloader can take up to 30 seconds to upgrade. Do not power cycle the switch while you are copying the image to the switch. If a power failure occurs when you are copying the image, call Cisco Systems immediately.
Upgrading a Switch by Using the CLI
This procedure is for copying the combined .tar file to the Catalyst 3550 switch. You copy the file to the switch from a TFTP server and extract the files. You can download an image file and replace or keep the current image. This procedure requires a configured TFTP server.
Caution If you are copying the crypto image to the switch, the bootloader can take up to 30 seconds to upgrade. Do not power cycle the switch while you are copying the image to the switch. If a power failure occurs when you are copying the image, call Cisco Systems immediately.
To download software, follow these steps:
Step 1 Use Table 5 to identify the file that you want to download.
Step 2 Download the software image file.
•If you have a SmartNet support contract, go to this URL and log in to download the appropriate files:
•If you do not have a SmartNet contract, go to this URL and follow the instructions to register on Cisco.com and download the appropriate files:
To download the SMI and EMI files, select Catalyst 3550 software.
To obtain authorization and to download the crypto software files, select Catalyst 3550 3DES Cryptographic Software.
Step 3 Copy the image to the appropriate TFTP directory on the workstation, and make sure the TFTP server is properly configured.
For more information, refer to Appendix B in the Catalyst 3550 Multilayer Switch Software Configuration Guide.
Step 4 Log in to the switch through the console port or a Telnet session.
Step 5 Check your VLAN 1 configuration by using the show interfaces vlan 1 privileged EXEC command, and verify that VLAN 1 is part of the same network as the TFTP server. (Check the Internet address is line near the top of the display.)
Step 6 Download the image file from the TFTP server to the switch. If you are installing the same version of software that is currently on the switch, overwrite the current image by using this privileged EXEC command:archive download-sw /overwrite /reload tftp:[[//location]/directory]/image-name.tar
The /overwrite option overwrites the software image in Flash memory with the downloaded one.
The /reload option reloads the system after downloading the image unless the configuration has been changed and not been saved.
For //location, specify the IP address of the TFTP server.
For /directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive.
This example shows how to download an image from a TFTP server at 184.108.40.206 and to overwrite the image on the switch:Switch# archive download-sw /overwrite tftp://22.214.171.124/c3550-i5q3l2-tar.121-13.EA1.tar
You can also download the image file from the TFTP server to the switch and keep the current image by replacing the /overwrite option with the /leave-old-sw option.
Upgrading with a Nondefault System MTU Setting
If the switch was running Cisco IOS Release 12.1(8)EA1c or earlier and you had used the system mtu global configuration command to configure a nondefault system maximum transmission unit (MTU) size on your switch, follow these steps to upgrade your switch to Cisco IOS Release 12.1(11)EA1 or later:
Step 1 Upgrade the Cisco IOS software to Cisco IOS Release 12.1(11)EA1 or later.
Step 2 If a system MTU size of greater than 2000 is configured on the Catalyst 3550-12T or Catalyst 3550-12G, use the system mtu global configuration command to set it to the maximum supported MTU size.
Note The maximum allowable system MTU for Catalyst 3550 Gigabit Ethernet switches
is 2000 bytes; the maximum system MTU for Fast Ethernet switches is 1546 bytes.
Step 3 Save the running configuration by entering the copy running-config startup-config privileged EXEC command.
Step 4 Reload the switch by using the new Cisco IOS software.
Step 5 When the switch comes back up with Cisco IOS Release 12.1(11)EA1 or later, reload the switch a second time by using the reload privileged EXEC command so that the system mtu command takes effect.
Recovering from Software Failure
If the software fails, you can reload the software. For detailed recovery procedures, refer to the "Troubleshooting" chapter in the Catalyst 3550 Multilayer Switch Software Configuration Guide.
Installation Notes
You can assign IP information to your switch by using these methods:
•Running the express setup program as described in the "Using Express Setup to Configure a Switch" section.
•Running the setup program as described in the "Setting Up the Catalyst 3550 Initial Configuration" section.
•Dynamic Host Configuration Protocol (DHCP)-based autoconfiguration (refer to the Catalyst 3550 Multilayer Switch Software Configuration Guide)
•Manually assigning an IP address (refer to the Catalyst 3550 Multilayer Switch Software Configuration Guide).
Note If you are upgrading a switch that uses the 802.1X security feature, you must reenable 802.1X after upgrading the software. For more information, see the "Upgrading Software and 802.1X" section.
Using Express Setup to Configure a Switch
Express Setup is a browser-based program that you can use to set up and configure the switch. You assign the IP information so that the switch can connect to local routers and the Internet. The IP address is also required if you plan to further configure the switch.
You do not create a username with Express Setup. Express Setup provides the minimum configuration to configure a switch. To create a username for the switch, use the Cluster Management Suite (CMS) or the command-line interface (CLI).
Note To use Express Setup, you must have Cisco IOS Release 12.1(14)EA1 or later running on your switch.
This section provides a quick step-by-step setup procedure for a standalone switch and includes these steps:
•Configuring the Switch Settings
•Clearing the Switch IP Address and Configuration
Caution Do not start Express Setup when there are any devices connected to the switch or connect a switch that is already in Express Setup mode to any device other than the PC or workstation that is being used to configure it. The switch acts as a DHCP server during the Express Setup procedure, and only the PC or workstation connected to the switch after Express Startup is started should receive a DHCP address from the switch.
Before using Express Setup to configure a switch, refer to the switch hardware installation guide for this information:
•Removing the switch and AC power cord from the shipping container
•Getting an Ethernet (Category 5) straight-through cable to connect the switch to your PC or workstation
•Powering on the switch
Note The illustrations in this section show the Catalyst 2940 switch but the Mode button, LEDs, and switch ports are similar on the switch.
Starting Express Setup
Before starting Express Setup, verify that the switch has passed POST. The SYST and STAT LEDs should be on and green if the switch has successfully passed POST. For information about troubleshooting a POST failure, refer to the switch hardware installation guide. You cannot start Express Setup until POST has completed.
Caution Do not start Express Setup when there are any devices connected to the switch. The switch acts as a DHCP server during the Express Setup procedure, and only the PC or workstation connected to the switch after Express Startup is started should receive a DHCP address from the switch.
Follow these steps to start the Express Setup program:
Step 1 Verify that no devices are connected to the switch.
Step 2 Press and hold the Mode button, as shown in Figure 1, until the four LEDs next to the Mode button turn green. This takes approximately 2 seconds.
Figure 1 Starting Express Setup
Step 3 When the LEDs turn green, release the Mode button.
Note If all of the Mode LEDs begin to blink after you have held the Mode button for 2 seconds, a configuration already exists on the switch, and the switch cannot go into Express Setup mode. Release the button. For more information, see the "Clearing the Switch IP Address and Configuration" section.
Caution If you continue to hold the mode button for 8 more seconds, the switch configuration is deleted, and the switch reloads.
Step 4 Connect the Ethernet cable (not included) to a 10/100 Ethernet port on the front panel of the switch, as shown in Figure 2.
Caution Do not connect the switch to any device other than the PC or workstation being used to configure it.
Figure 2 Connecting the Switch and PC or Workstation Ethernet Ports
Step 5 Connect the other end of the cable to the Ethernet port on the PC or workstation.
Verify that the port status LEDs on both connected Ethernet ports are green.
Step 6 Wait approximately 30 seconds after the port LEDs turn green, and launch a web browser on your PC or workstation.
Step 7 Enter the IP address 10.0.0.1, as shown in Figure 3, in the browser, and press Enter.
Figure 3 Entering the IP Address
The Express Setup home page appears, as shown in Figure 4.
Figure 4 Express Setup Home Page
If the Express Setup does not run, or the Express Setup home page does not appear in your browser:
•Did you wait 30 seconds after connecting the switch and PC or workstation before entering the IP address in your browser?
If not, wait 30 seconds and re-enter 10.0.0.1 in the browser, and press Enter.
•Did you enter the wrong address in your web browser, or is there an error message displayed in the browser window?
Re-enter 10.0.0.1 in the browser, and press Enter.
•Did you connect a crossover instead of a straight-through Ethernet cable between an Ethernet port of the switch and the Ethernet port of the PC or workstation, as shown Figure 2?
If not, reconnect the cable to the Ethernet port on the switch and PC or workstation. Wait 30 seconds before entering 10.0.0.1 in the browser.
•Did you verify that POST successfully ran before starting Express Setup?
If not, make sure that only the SYST and STAT LEDs are green before pressing the Mode button to begin Express Setup.
Note The rest of this section explains how to configure a switch by using the Express Setup web page. To configure the switch by using the CLI-based setup program, refer to the "Setting Up the Catalyst 3550 Initial Configuration" section.
Configuring the Switch Settings
The Management Interface field displays VLAN1-Default. This is the management interface through which you manage the switch and to which you assign IP information.
Follow these steps to configure your switch with Express Setup:
Step 1 Contact your system administrator and obtain the IP address, the IP subnet mask, and the default gateway for your switch.
Step 2 Enter the IP address of the switch in the IP Address field.
Step 3 Click the drop-down arrow in the IP Subnet Mask field, and select an IP Subnet Mask.
Step 4 Enter the IP address for the default gateway in the Default Gateway field.
A gateway (router or dedicated network device) is a system that connects a network on one subnet to one or more networks on a different subnet.
Note You must specify a default gateway if the management workstation and the switch are on different IP segments.
Step 5 Enter your password in the Switch Password field.
The password can be from 1 to 25 alphanumeric characters, can start with a number, is case sensitive, allows embedded spaces, but does not allow embedded spaces at the beginning or end.
Step 6 Enter your password again in the Confirm Switch Password field.
You do not enter a username for the switch. After the switch is configured with an IP address, you can use CMS to configure a username.
Step 7 (Optional) Enter a host name for the switch in the Host Name field. The host name is limited to 31 characters; embedded spaces are not allowed.
Step 8 (Optional) Enter the name of your system contact in the System Contact field. This identifies the system administrator for the switch or network.
Step 9 (Optional) Enter your system location in the System Location field. This identifies the physical location of the switch.
Step 10 (Optional) Click Enable in the Telnet Access field if you are going to use Telnet. If you enable Telnet access, you must enter a Telnet password:
a. Enter a password in the Telnet Password field. The Telnet password can be from 1 to 25 alphanumeric characters, is case sensitive, allows embedded spaces, but does not allow embedded spaces at the beginning or end.
b. Enter the Telnet password again in the Confirm Telnet Password field.
Step 11 (Optional) Click Enable to configure Simple Network Management Protocol (SNMP). Enable SNMP only if you plan to manage switches by using Cisco Works or another SNMP-based network-management system.
If you enable SNMP, you must enter a community string in either the SNMP Read Community field, the SNMP Write Community field, or both. SNMP community strings authenticate access to MIB objects. Embedded spaces are not allowed in SNMP community strings. If you set the SNMP read community, users can access MIB objects, but cannot modify them. If you set the SNMP write community, users can access and modify MIB objects.
Step 12 Click Save to save your settings to the switch, or click Cancel to clear your settings.
After you save your settings, the switch exits Express Setup mode.
Your switch is now configured with the new IP address. You can install the switch in your production network.
Verifying Switch IP Address (Optional)
After you have installed the switch in your network, follow these steps to verify the IP address configured on your switch:
Step 1 Launch a web browser on a PC or workstation that is connected the network.
Step 2 Enter the IP address of your switch (for example: 172.20.139.142.) The switch home page appears, as shown in Figure 5.
Figure 5 Switch Home Page
Re-Running Express Setup
If you did not click Save at the end of the "Configuring the Switch Settings" section section, you can re-run Express Setup by clicking Express Setup on the Switch home page.
If you have entered a wrong IP address or need to change the IP address of your switch, you can clear the IP address on your switch by following the steps in the "Clearing the Switch IP Address and Configuration" section.
Clearing the Switch IP Address and Configuration
If you have configured a new switch with a wrong IP address, or all the switch LEDs start blinking when you are trying to enter Express Setup mode, you can clear the IP address that is configured on the switch.
Note This procedure clears the IP address and all configuration information stored on the switch. Do not follow this procedure unless you want to completely reconfigure the switch.
To clear the IP address and the switch configuration information, follow these steps:
Step 1 Press and hold the Mode button, as shown in Figure 1.
The switch LEDs begin blinking after about 2 seconds.
Step 2 Continue holding down the Mode button. The LEDs stop blinking after 8 additional seconds, and then the switch reboots.
Note These steps only work on a previously configured switch.
Where to Go Next
After you have saved your configuration to the switch, you can install the switch (refer to the switch hardware installation guide) or further configure it (refer to the switch software configuration guide).
Setting Up the Catalyst 3550 Initial Configuration
The first time that you access the switch, it runs a setup program that prompts you for an IP address and other configuration information necessary for the switch to communicate with the local routers and the Internet. This information is also required if you plan to use the CMS to configure and manage the switch.
Note If the switch will be a cluster member managed through the IP address of the command switch, it is not necessary to assign IP information or a password. If you are configuring the switch as a standalone switch or as a command switch, you must assign IP information.
Follow these steps to create an initial configuration for the switch:
Step 1 Enter Yes at the first two prompts.Would you like to enter the initial configuration dialog? [yes/no]: yesAt any point you may enter a question mark '?' for help.Use ctrl-c to abort configuration dialog at any prompt.Default settings are in square brackets '[]'.Basic management setup configures only enough connectivityfor management of the system, extended setup will ask youto configure each interface on the system.Would you like to enter basic management setup? [yes/no]: yes
Step 2 Enter a host name for the switch, and press Return.
On a command switch, the host name is limited to 28 characters; on a member switch to 31 characters. Do not use -n, where n is a number, as the last character in a host name for any switch.Enter host name [Switch]: host_name
Step 3 Enter a secret password, and press Return.
The password can be from 1 to 25 alphanumeric characters, can start with a number, is case sensitive, allows spaces, but ignores leading spaces.Enter enable secret: secret_password
Step 4 Enter an enable password, and press Return.Enter enable password: enable_password
Step 5 Enter a virtual terminal (Telnet) password, and press Return.
The password can be from 1 to 25 alphanumeric characters, is case sensitive, allows spaces, but ignores leading spaces.Enter virtual terminal password: terminal-password
Step 6 (Optional) Configure Simple Network Management Protocol (SNMP) by responding to the prompts.
Step 7 Enter the interface name (physical interface or VLAN name) of the interface that connects to the management network, and press Return. For this release, always use VLAN 1 as that interface.Enter interface name used to connect to themanagement network from the above interface summary: vlan 1
Step 8 Configure the interface by entering the switch IP address and subnet mask and pressing Return:Configuring interface vlan 1:Configure IP on this interface? [yes]: yesIP address for this interface: 10.4.120.106Subnet mask for this interface [255.0.0.0]: 255.255.255.0
Step 9 Enter Y to configure the switch as the cluster command switch. Enter N to configure it as a member switch or as a standalone switch.
If you enter N, the switch appears as a candidate switch in the CMS. In this case, the message in Step 10 is not displayed.Would you like to enable as a cluster command switch? [yes/no]: yes
Step 10 Assign a name to the cluster, and press Return.Enter cluster name: cluster_name
The cluster name can be 1 to 31 alphanumeric characters, dashes, or underscores.
The initial configuration appears:The following configuration command script was created:hostname host-nameenable secret 5 $1$LiBw$0Xc1wyT.PXPkuhFwqyhVi0enable password enable-passwordline vty 0 15password terminal-passwordsnmp-server community public!no ip routing!interface vlan 1no shutdownip address 10.4.120.106 255.255.255.0interface GigabitEthernet0/1no ip address!interface GigabitEthernet0/2no ip address!...<output abbreviated>!interface GigabitEthernet0/12no ip addresscluster enable cluster-name!end
Step 11 These choices appear:[0] Go to the IOS command prompt without saving this config.[1] Return back to the setup without saving this config.[2] Save this configuration to nvram and exit.Enter your selection [2]:2
Make your selection, and press Return.
After you complete the setup program, the switch can run the created default configuration. If you want to change this configuration or want to perform other management tasks, use one of these tools:
•Command-line interface (CLI)
•CMS from your browser
New Software Features
Cisco IOS Release 12.1(14)EA1 contains these new features or enhancements:
•VLAN 1 minimization to reduce the risk of spanning-tree loops or storms by allowing VLAN 1 to be disabled on any individual VLAN trunk link. With this feature enabled, no user traffic is sent or received. The switch CPU continues to send and receive control protocol frames.
•Port security on trunk ports for limiting and identifying MAC addresses of the stations allowed to access the VLAN.
•Port Security on an increased number of secure MAC addresses, up to the maximum number of unicast MAC addresses supported in the active Switch Database Management (SDM) template.
•802.1X with guest VLAN to provide limited services to non-802.1X capable users.
•Support for the aging out of the IGMP forward-table entries that were learned by source-only learning.
•Full CISCO-PORT-SECURITY-MIB support
•CMS PreFlight, Port Picker Wizard enhancement, and Express Setup
Upgrading Software and 802.1X
In Cisco IOS Release 12.1(14)EA1, the implementation for 802.1X changed from the previous release. Some global configuration commands became interface configuration commands, and new commands were added.
If you have 802.1X configured on the switch and you upgrade to Cisco IOS Release 12.1(14)EA1 or later, the configuration file will not contain the new commands, and 802.1X will not operate. After the upgrade is complete, make sure to globally enable 802.1X by using the dot1x system-auth-control global configuration command. For more information, refer to the software configuration guide for this release.
Limitations and Restrictions
You should review this section before you begin working with the switches. These are known limitations that will not be fixed, and there is not always a workaround. Some features might not work as documented, and some features could be affected by recent changes to the switch hardware or software.
These are the limitations and restrictions:
•"Cisco IOS Limitations and Restrictions" section
•"Cluster Limitations and Restrictions" section
•"CMS Limitations and Restrictions" section
Cisco IOS Limitations and Restrictions
These limitations apply to Cisco IOS configuration:
•Modifying a multicast boundary access list does not prevent packets from being forwarded by any multicast routes that were in existence before the access list was modified if the packets arriving on the input interface do not violate the boundary. However, no new multicast routes that violate the updated version of the multicast boundary access list are learned, and any multicast routes that are in violation of the updated access list are not relearned if they age out.
After updating a multicast boundary, the workaround is to use the clear ip mroute privileged EXEC command to delete any existing multicast routes that violate the updated boundary. (CSCdr79083)
•When an IP packet with a cyclic redundancy check (CRC) error is received, the per-packet per-Differentiated Service Code Point (DSCP) counter (for DSCP 0) is incremented. Normal networks should not have packets with CRC errors. (CSCdr85898)
•If you configure the DHCP server to allocate addresses from a pool to the switch, two devices on the network might have the same IP address. Pooled addresses are temporarily allocated to a device and are returned to the pool when not in use. If you save the configuration file after the switch receives such an address, the pooled address is saved, and the switch does not attempt to access the DHCP server after a reboot to receive a new IP address. As a result, two devices might have the same IP address.
The workaround is to make sure that you configure the DHCP server with reserved leases that are bound to each switch by the switch hardware address. (CSCds55220)
•The show ip mroute count privileged EXEC command might display incorrect packet counts. In certain transient states (for example, when a multicast stream is forwarded only to the CPU during the route-learning process and the CPU is programming this route into the hardware), a multicast stream packet count might be counted twice. Do not trust the counter during this transient state. (CSCds61396)
•When changing the link speed of a Gigabit Ethernet port from 1000 Mbps to 100 Mbps, there is a slight chance that the port will stop transmitting packets. If this occurs, shut down the port, and re-enable it by using the shutdown and no shutdown interface configuration commands. (CSCds84279)
•In IP multicast routing and fallback bridging, certain hardware features are used to replicate packets for the different VLANs of an outgoing trunk port. If the incoming speed is line rate, the outgoing interface cannot duplicate that speed (because of the replication of the packets). As a result, certain replicated packets are dropped. (CSCdt06418)
•When you use the no interface port-channel global configuration command to remove an EtherChannel group, the ports in the port group change to the administratively down state.
When you remove an EtherChannel group, enter the no shutdown interface configuration command on the interfaces that belonged to the port group to bring them back on line. (CSCdt10825)
•In the output displayed after a show interface interface-id privileged EXEC command, the output buffer failures field shows the number of packets lost before replication, whereas the packets output field shows the successful transmitted packets after replication. To determine actual discarded frames, multiply the output buffer failures by the number of VLANs on which the multicast data is replicated. (CSCdt26928)
•Internet Group Management Protocol (IGMP) packets classified by QoS to map the DSCP value and the class of service (CoS) value in a QoS policy map might only modify the DSCP property and leave the CoS value at zero. (CSCdt27705)
•If you assign both tail-drop threshold percentages to 100 percent by using the wrr-queue threshold interface configuration command and display QoS information for this interface by using the show mls qos interface statistics privileged command, the drop-count statistics are always zero even if the thresholds were exceeded. To display the total number of discarded packets, use the show controllers ethernet-controllers interface-id privileged EXEC command. In the display, the number of discarded frames includes the frames that were dropped when the tail-drop thresholds were exceeded. (CSCdt29703)
•Open Shortest Path First (OSPF) path costs and Interior Gateway Routing Protocol (IGRP) metrics are incorrect for switch virtual interface (SVI) ports. You can manually configure the bandwidth of the SVI by using the bandwidth interface configuration command. Changing the bandwidth of the interface changes the routing metric for the routes when the SVI is used as an outgoing interface. (CSCdt29806)
•Remote Monitoring (RMON) collection functions on physical interfaces, but it is not supported on EtherChannels and SVIs. (CSCdt36101)
•Multicast router information is displayed in the show ip igmp snooping mrouter privileged EXEC command when IGMP snooping is disabled. Multicast VLAN Registration (MVR) and IGMP snooping use the same commands to display multicast router information. In this case, MVR is enabled, and IGMP snooping is disabled. (CSCdt48002)
•When a VLAN interface has been disabled and restarted multiple times by using the shutdown and no shutdown interface configuration commands, the interface might not restart following a no shutdown command. To restart the interface, re-enter a shutdown and no shutdown command sequence. (CSCdt54435)
•When you configure the ip pim spt-threshold infinity interface configuration command, you want all sources for the specified group to use the shared tree and not use the source tree. However, the switch does not automatically start to use the shared tree. No connectivity problem occurs, but the switch continues to use the shortest path tree for multicast group entries already installed in the multicast routing table. You can enter the clear ip mroute * privileged EXEC command to force the change to the shared tree. (CSCdt60412)
•Configuring too many multicast groups might result in an extremely low memory condition and cause the software control data structure to go out of sync, causing unpredictable forwarding behavior. The memory resources can only be recovered by entering the clear ip mroute privileged EXEC command. To prevent this situation, do not configure more than the recommended multicast routes on the switch. (CSCdt63480)
•The dec keyword is not supported in the bridge bridge-group protocol global configuration command. If two Catalyst 3550 switches are connected to each other through an interface that is configured for IP routing and fallback bridging, and the bridge group is configured with the bridge bridge-group protocol dec command, both switches act as if they were the spanning tree root. Therefore, spanning-tree loops might be undetected. (CSCdt63589)
•When you configure an EtherChannel between a Catalyst 3550 and a Catalyst 1900 switch, some of Catalyst 3550 links in the EtherChannel might go down, but one link in the channel remains up, and connectivity is maintained.
•If the number of multicast routes configured on the switch is greater than the switch can support, it might run out of available memory, which can cause it to reboot. This is a limitation in the platform-independent code.
The workaround is to not configure the switch to operate with more than the maximum number of supported multicast routes. You can use the show sdm prefer and show sdm prefer routing privileged EXEC commands to view approximate maximum configuration guidelines for the current SDM template and the routing template. (CSCdt63354)
The workaround is to disable the Port Aggregation Protocol (PAgP) on both devices by using the channel-group channel-group-number mode on interface configuration command. PAgP negotiation between these two devices is not reliable. (CSCdt78727)
•When the switch is operating with equal-cost routes and it is required to learn more unicast routes than it can support, the CPU might run out of memory, and the switch might fail.
The workaround is to remain within the documented recommended and supported limits. (CSCdt79172)
•The behavior of a software access control list (ACL) with QoS is different from a hardware ACL with QoS. On the Catalyst 3550 switch, when the QoS hardware rewrites the DSCP of a packet, the rewriting of this field happens before software running on the CPU examines the packet, and the CPU sees only the new value and not the original DSCP value.
When the security hardware ACL matches a packet on input, the match uses the original DSCP value. For output security ACLs, the security ACL hardware should match against the final, possibly changed, DSCP value as set by the QoS hardware. Under some circumstances, a match to a security ACL in hardware prevents the QoS hardware from rewriting the DSCP and causes the CPU to use the original DSCP.
If a security ACL is applied in software (because the ACL did not fit into hardware, and packets were sent to the CPU for examination), the match probably uses the new DSCP value as determined by the QoS hardware, regardless of whether the ACL is applied at the input or at the output. When packets are logged by the ACL, this problem can also affect whether or not a match is logged by the CPU even if the ACL fits into hardware and the permit or deny filtering was completed in hardware.
To avoid these issues, whenever the switch rewrites the DSCP of any packet to a value different from the original DSCP, security ACLs should not test against DSCP values in any of their access control elements (ACEs), regardless of whether the ACL is being applied to an IP access group or to a VLAN map. This restriction does not apply to ACLs used in QoS class maps.
If the switch is not configured to rewrite the DSCP value of any packet, it is safe to match against DSCP in ACLs used for IP access groups or for VLAN maps because the DSCP does not change as the packet is processed by the switch.
The DSCP field of an IP packet encompasses the two fields that were originally designated precedence and type of service (TOS). Statements relating to DSCP apply equally to either IP precedence or IP TOS. (CSCdt94355)
•On earlier versions of Catalyst 3550-24 switches, if a 10/100BASE-TX port on the switch is connected to a Catalyst 2820 or Catalyst 1900 switch through an ISL trunk at 100 Mbps, bidirectional communication cannot be established. The Catalyst 2820 or Catalyst 1900 switch identifies the Catalyst 3550-24 switch as a CDP neighbor, but the Catalyst 3550-24 switch does not recognize the Catalyst 2820 or Catalyst 1900 switch. On these switches, you should not use ISL trunks between the Catalyst 3550-24 and a Catalyst 2820 or Catalyst 1900 switch. Configure the link as an access link instead of a trunk link.
This problem has been fixed in hardware on Catalyst 3550-24 switches with motherboard assembly number 73-5700-08 or later. To determine the board level on your switch, enter the show version privileged EXEC. Motherboard information appears toward the end of the output display. (CSCdv68158)
•When IGMP filtering is enabled and you use the ip igmp profile global configuration command to create an IGMP filter, reserved multicast addresses cannot be filtered. Because IGMP filtering uses only Layer 3 addresses to filter IGMP reports and due to mapping between Layer 3 multicast addresses and Ethernet multicast addresses, reserved groups (224.0.0.x) are always allowed through the switch. In addition, aliased groups can leak through the switch. For example, if a user is allowed to receive reports from group 22.214.171.124, but not from group 126.96.36.199, aliasing will cause the user to receive reports from 184.108.40.206. Aliasing of reserved addresses means that all groups of the form y.0.0.x are allowed through. (CSCdv73626)
•If a switch stack contains both Catalyst 3550 switches and Catalyst 2900 XL or Catalyst 3500 XL switches, Cross-Stack UplinkFast (CSUF) is not enabled if the management VLAN on the Catalyst 2900 XL or 3500 XL switches is changed to a VLAN other than VLAN 1 (the default).
The workaround is to make sure that the management VLAN of all Catalyst 2900 XL or 3500 XL switches in the stack is set to VLAN 1. (CSCdv79737)
•If you use the ip igmp max-groups interface configuration command to set the maximum number of IGMP groups for an interface to 0, the port still receives group reports from reserved multicast groups (224.0.0.x) and their Layer 2 aliases (y.0.0.x). (CSCdv79832)
•The switch might reload when it is executing the no snmp-server host global configuration command. This is a rare condition that can happen if SNMP traps or informs are enabled and the SNMP agent attempts to send a trap to the host just as it is being removed from the configuration and if the IP address of the host (or the gateway to reach the host) has not been resolved by Address Resolution Protocol (ARP).
The workaround is to ensure that the target host or the next-hop gateway to that host is in the ARP cache (for example, by using a ping command) before removing it from the SNMP configuration. Alternatively, disable all SNMP traps and informs before removing any hosts from the SNMP configuration. (CSCdw44266)
•When you access CISCO-STACK-MIB portTable, the mapping might be off by one from the mapping given by the switch. The objects in this table are indexed by two numbers: portModuleIndex and portIndex. The allowable values for portModuleIndex are 1 through 16. Because 0 is not an allowable value, the value 1 represents module 0.
The workaround is to use the value 1 to represent module 0. (CSCdw71848)
•Multicast traffic can be temporarily lost when a link comes up in a redundant network and causes the reverse path forwarding (RPF) to change. This only occurs when there are multiple paths between the rendezvous point (RP) and the multicast source.
There is no workaround. (CSCdw27519)
•If a port on the Catalyst 3550 switch that is running the Multiple Spanning Tree Protocol (MSTP) is connected to another switch that belongs to a different multiple spanning tree (MST) region, the Catalyst 3550 port is not recognized as a boundary port when you start the protocol migration process by using the clear spanning-tree detected-protocols interface interface-id privileged EXEC command. This problem occurs only on the root bridge, and when the root bridge is cleared, the boundary ports are not shown because the designated ports do not receive any bridge protocol data units (BPDUs) unless a topology change occurs. This is the intended behavior.
The workaround is to configure the Catalyst 3550 switch for PVST by using the spanning-tree mode pvst global configuration command bridge, and then change it to MSTP by using the spanning-tree mode mst global configuration command. (CSCdx10808)
•When a large number of VLANs and a large number of trunk ports with allowed VLAN lists are configured on the switch, if you enter the no switchport trunk allowed vlan interface-range command to remove the allowed list for all the trunk ports, the SYS-3-CPUHOG system message might appear.
The workaround is to use the no switchport trunk allowed vlan interface configuration command on each trunk port to remove the allowed list for all the trunk ports. (CSCdx17189)
•When 1000 VLANs and more than 40 trunk ports are configured, and the spanning-tree mode changes from MSTP to PVST or vice versa, this message appears on the console:%ETHCNTR-3-RA_ALLOC_ERROR: RAM Access write pool I/O memory allocation failure
There is no workaround. However, we recommend that you reload the switch by using the reload privileged EXEC command. To avoid this problem, configure the system with fewer VLANs and fewer trunk ports, or use the switchport trunk allowed vlan interface configuration command to reduce the number of active VLANs on each trunk port. (CSCdx20106)
•Ternary content addressable memory (TCAM) generation might fail when there are multiple ACLs in a policy-map. If you add an entry that checks Transmission Control Protocol (TCP) flags to an access list that is used for QoS classification, the system might report that a hardware limitation has been reached for the policy map. This can occur when the policy map already contains several other access list entries that check different TCP flags, or that check TCP or User Datagram Protocol (UDP) port numbers using an operation different from equal (eq), such as not equal (ne), less than (lt), greater than (gt), or range. When the hardware limitation is reached, the service-policy input policy-map-name interface configuration command is removed from the running configuration of the interface.
Checking for TCP flags and TCP/UDP port numbers using operators other than eq share some of the same hardware resources. The switch supports no more than six checks within a single policy map. An identical check repeated in multiple entries in the same policy map counts as a single instance. If this limit is reached during a TCP or UDP port number check, the software can often work around the problem by allocating extra entries in the TCAM. There is no workaround if the limit is reached during a check against the TCP flags in the packet. Similar checks in a port ACL applied to the same physical interface as the policy map also count toward the limit.
Because these resources are allocated on a first-come, first-serve basis, rearranging the order of ACLs within a policy map or the order of entries within a single ACL, placing the TCP flags checks as early as possible, might enable the policy map to be loaded into the hardware.
Similar limits apply for any combination of input VLAN maps, input router ACLs, output VLAN maps, and output router ACLs that share the same VLAN label. The switch supports eight checks for all features on the same VLAN label. When the limit is reached, the system might forward packets by using the CPU rather than through hardware, greatly reducing system performance. To determine the VLAN label assigned to a VLAN or interface on input or output, use the show fm vlan or show fm interface privileged EXEC commands. Then use the show fm vlan-label privileged EXEC command to determine which set of features (input VLAN map, input router ACL, output VLAN map, or output router ACL) share this label.
These are the workarounds:
–Re-arrange the order of classes within the policy map and the order of entries within the individual access lists in the policy map or within any IP port ACL applied to the interface so that checks for TCP flags are made as early as possible within the policy map. You can also re-arrange the order of the individual ACLs within a VLAN map and the order of the individual entries in a security ACL.
–Add an extra entry to the front of an ACL that checks for the same TCP flags that are checked later on in the ACL. If the first entry of the ACL already matches only the TCP protocol, you can duplicate the entry and add a check for the appropriate TCP flags.
–Reduce the number of different combinations of TCP flags being tested.
If the other workarounds fail, avoid combining any check against the TCP flags with gt, lt, ne, or range checks within the policy map and port ACL configured on the interface or within the VLAN maps and router ACLs that share the same VLAN label. (CSCdx24363)
•If you apply an ACL to an interface that has a QoS policy map attached and the ACL is configured so that the packet should be forwarded by the CPU or if the configured ACL cannot fit into the ternary content addressable memory (TCAM), all packets received from this interface are forwarded to the CPU. Because traffic forwarded to the CPU cannot be policed by the policer configured on the interface, this traffic is not accurately rate-limited to the configured police rate.
The workaround, when QoS rate limiting is configured on an interface, is to configure applied ACLs so that packets are not forwarded by the CPU or reduce the number of ACEs in the ACL so that it can fit into the TCAM. (CSCdx30485)
•When you reboot a Catalyst 3550-24-FX switch, it might loop back packets received on a 100BASE-FX port to its link partner. This can occur before the Cisco IOS software takes control of the system and lasts for about 200 milliseconds.
As a result, the link partner might shut down the port when it detects loopback packets, or MAC addresses might be learned on the wrong ports on upstream switches. The network might be unable to deliver packets to a few devices for up to 5 minutes after rebooting the Catalyst 3550-24-FX switch when:
–The Catalyst 3550-24-FX switch is connected to one or more switches in the network.
–Spanning tree is disabled in the network or the Port Fast feature is enabled on the ports connected to the Catalyst 3550-24-FX switch.
–The Catalyst 3550-24-FX switch is powered cycled or reloaded from CLI.
–One or more devices in the network transmit a broadcast or multicast packet during the 200-millisecond timing window while the Catalyst 3550-24-FX switch is booting.
This problem corrects itself after five minutes or when these devices transmit a broadcast or multicast packet, whichever comes first.
The workaround is to enable spanning tree in the network and to make sure that the Port Fast feature is disabled on all ports connected to the Catalyst 3550-24-FX switch. (CSCdx45558)
•Catalyst 3550 switches do not take into account the Preamble and Inter Frame Gap (IFG) when rate limiting traffic, which could result in a slightly inaccurate policing rate on a long burst of small-sized frames, where the ratio of the Preamble and IFG to frame size is more significant. This should not be an issue in an environment where the frames are a mix of different sizes.
•If the switch fails for any reason while you are exiting VLAN configuration mode (accessed by entering the vlan database privileged EXEC command), there is a slight chance that the VLAN database might get corrupted. After resetting from the switch, you might see these messages on the console:%SW_VLAN-4-VTP_INVALID_DATABASE_DATA: VLAN manager received bad data of type device type: value 0 from vtp database$SW_VLAN-3-VTP_PROTOCOL_ERROR: VTP protocol code internal error
The workaround is to use the delete flash:vlan.dat privileged EXEC command to delete the corrupted VLAN database. Then reload the switch by using the reload privileged EXC command. (CSCdx19540)
•If you apply a large ACL and it fills the entire ternary content addressable memory (TCAM), the multicast VLAN registration (MVR) IP multicast data packets are sent to the switch CPU and are not forwarded to the MVR receiver ports.
There is no workaround. (CSCdx80751)
•When a Cisco RPS 300 Redundant Power System provides power to a switch, after the switch power supply is restored the RPS 300 continues to provide power until the RPS mode button is pressed. At this point, some switches restart, depending on how quickly the switch internal power supply resumes operation. (CSCdx81023)
•When you insert a GigaStack GBIC in a GBIC module slot, the CPU utilization increases by six percent. This increase occurs for each GigaStack GBIC added to the switch. Other types of GBICs do not cause additional CPU utilization.
There is no workaround. (CSCdx90515)
•An RSPAN source session does not forward monitored traffic to the RSPAN destination session if there is an egress SPAN source port in the session with port security or 802.1X enabled. (CSCdy21035)
•Not all traffic is properly mirrored by RSPAN when a port is monitored for egress traffic and the RSPAN VLAN is carried through a Layer 2 Protocol Tunnel to the RSPAN destination switch.
This happens because the MAC addresses for the original packets as well as the mirrored RSPAN packets are all learned on the tunnel VLAN, so the RSPAN traffic is no longer properly segregated on the tunneling switches.
The workaround is to not include any RSPAN VLANs in any Layer 2 Protocol tunnels unless the tunnel is dedicated to a single RSPAN VLAN. (CSCdy37188)
•Ingress forwarding on a SPAN destination port does not work if there is an egress SPAN source port in the session with port security or 802.1X enabled. (CSCdy44646)
•When the switch receives multicast traffic and IGMP join for requests a multicast group at the same time and it begins to forward the multicast packets, some of the packets might be dropped. (CSCdy80326)
•If a Catalyst 3550 switch is connected to two routers (Router 1 and Router 2) in this topology:
–The link between Router 1 and the switch is a BVI (bridge virtual interface) that belongs to two VLANs (VLAN 100 and VLAN 110) and uses one IP address. The IP subnet for the BVI is the same for both VLANs. The ports in both VLANs operate as Layer 2 interfaces. An SVI with an IP address is configured only on VLAN 100.
–The link between Router 2 and the switch is an IP interface that only belongs to VLAN 110.
IP connectivity then exists between Router 1 and the switch. There is no IP connectivity between Router 2 and the switch.
The workaround is to configure another SVI with an IP address on the Catalyst 3550 switch that would be reachable from Router 2. (CSCdy82042)
•The 5 minute input rate and 5 minutes output rate fields in the output of the show interfaces privileged EXEC command show both rates as 0 bits/sec. If you enter the show interfaces command more than once, these fields might show values greater than 0 bits/sec.
There is no workaround. (CSCdz06305)
•When the link between a device with an AC power supply and a Catalyst 3550-24PWR switch is 10 Mbps and half duplex, and the AC power supply is turned off, the switch is in the error-disable state.
The workaround is remove the AC power supply, disconnect the Ethernet cable, and then reconnect the Ethernet cable. This ensures that the switch uses inline power. (CSCdz16265)
•When you perform a ping from a VLAN to another VLAN on the same switch, the VLAN counter does not change. (CSCdz17863)
•The Catalyst 3550 switch does not adjust the power allocation based on IEEE class of the power device (PD) When an IEEE PD-compliant device is connected to a switch, it allocates 15 W (the default) to the port. (CSCdz37516)
•When an 802.1X-authenticated client is disconnected from an IP phone, hub, or switch and does not send an EAPOL-Logoff message, the switch interface does not transition to the unauthorized state. If this happens, it can take up to 60 minutes for the interface to transition to the unauthorized state when the re-authentication time is the default value (3600 seconds).
The workaround is to change the number of seconds between re-authentication attempts by using the dot1x timeout re-authperiod seconds global configuration command. (CSCdz38483)
•When the link between two switches is a Ethernet cable to an E3 converter, if Multiple Spanning Tree (MST) is enabled on an 802.1Q trunk, traffic is not forwarded or sent for 60 seconds after the shutdown and no shutdown interface configuration commands are entered. (CSCdz45037)
•When a switch receives a bridge Spanning Tree Protocol (STP) bridge protocol data unit (BPDU) from an access port and the egress port is a trunk port, the switch assigns the BPDU a class of service (CoS) value of 0 instead of 7.
There is no workaround. (CSCdz54043)
•If a switch configuration contains a large ACL and a per-port per-VLAN policy map that both are attached to two interfaces, when you are copying it to the running configuration, this process might fail because the switch runs out of memory. (CSCdz54115)
These are the workarounds:
–Copy the new configuration file to the config.txt file, and reboot the switch.
–Save the configuration file as two files: one containing only the ACL configuration and one containing the rest of the configuration (including the QoS and interface configuration). Add the first configuration file to the running-configuration file, and then add the second file to the running-configuration file.
•After the no interface tunnel0 global configuration command is entered to remove the tunnel interface, the output from the show running-config privileged EXEC command still shows the tunnel interface that was removed. (CSCdz66450)
This can occur if HSRP interface tracking is configured on another interface to track a tunnel interface, if the no interface command was entered before the HSRP tracking configuration was removed, or if the no standby tunnel0 global configuration command was entered on the other interface to disable tracking.
These are the workarounds:
–Before removing the tunnel interface from the configuration, remove the HSRP interface tracking commands in the configuration that specify the tunnel interface.
–Use the no standby track global configuration command without specifying an interface to disable HSRP tracking.
•After a MAC address is relearned on a new interface, traffic might not be immediately forwarded to the MAC addresses.
There is no workaround. (CSCdz75459)
•The Catalyst 3550 switch only supports the read operation in the sysClearPortTime MIB object (.220.127.116.11.22.214.171.124.1.1.13) in the CISCO-STACK-MIB. Use the clear counters privileged EXEC command to clear the counters.
There is no workaround. (CSCdz87897)
•When a Catalyst 3550 switch is connected to a 3-port Gigabit Ethernet module in a Cisco 12000 Gigabit Switch Router (GSR) that is configured for Ethernet over Multiprotocol Label Switching (EoMPLS), the switch does not reliably send frames to the GSR.
The workaround is to configure the Catalyst 3550 Gigabit Ethernet interface with the spanning-tree portfast interface configuration command. (CSCea04746)
•On a switch running Cisco IOS Release 12.1(12c)EA1 or later, if the switch maximum-transmission-unit (MTU) value is set to a value greater than 1500 and the authentication server and the intermediate devices are not configured with a compatible MTU value, 802.1X authentication with EAP-TLS might fail.
The workaround is to reset the switch MTU value to the default value or to configure the same MTU value on the switch, the authentication server, and the intermediate devices. (CSCea05682)
•If a cable on ingress interface is disconnected, an Alteon A184 cannot detect when a 1000BASE-X link between two Catalyst 3550 switches is down.
There is no workaround. (CSCea09786)
•Performing an extended ping from one interface to another interface on the same switch, this can cause high CPU utilization. This can occur when a large number of ping packets are sent and received and is the expected behavior.
The workaround is to not perform a ping from one interface to another on the same switch. (CSCea19301)
•The switch does not create an adjacency table entry when the ARP timeout value is 15 seconds and the ARP request times out.
The workaround is to not set an ARP timeout value lower than 120 seconds. (CSCea21674)
•If the output from the show tcam inacl 1 statistics privileged EXEC command shows that the ternary content addressable memory (TCAM) is not full and you are applying an access control list (ACL), this system message might appear:%FM-3-UNLOADING: Unloading input vlan label 1 feature from all TCAMs
There is no workaround. (CSCea25658)
•A Catalyst 3550-12G might log the following syslog message on a semiregular basis when connected to a Catalyst 8500, a WS-X5550, a WS-U5534, or other Gigabit Ethernet interface:
%LINK-3-UPDOWN: Interface GigabitEthernet0/9, changed state to up
The workaround is to upgrade the Catalyst 3550 to Cisco IOS release 12.1(14(EA1) or later and configure the Catalyst 3550 and its link partner for autonegotiation. (CSCea87747)
•A Catalyst 3550 switch might not be able to pass Vine (Advanced Research Projects Agency) ARPA frames over bridge groups.
The workaround is to use Subnetwork Access Protocol (SNAP) frames instead. (CSCeb10032)
•Storm control or traffic suppression (configured by using the storm-control {broadcast | multicast | unicast} level level [.level] interface configuration command) is supported only on physical interfaces; it is not supported on EtherChannel port channels even though you can enter these commands through the CLI.
•The Cisco RPS 300 Redundant Power System supports the Catalyst 3550 multilayer switch and provides redundancy for up to six connected devices until one of these devices requires backup power. If a connected device has a power failure, the RPS immediately begins supplying power to that device and sends status information to other connected devices that it is no longer available as a backup power source. As described in the device documentation, when the RPS LED is amber, the RPS is connected but down. However, this might merely mean that the RPS is in standby mode. Press the Standby/Active button on the RPS to put it into active mode. You can view RPS status through the CLI by using the show rps privileged EXEC command. For more information, refer to the RPS 300 Hardware Installation Guide.
Note The Cisco RPS 300 does not support the Catalyst 3550-24PWR switch.
•You can connect the switch to a PC by using the switch console port and the supplied rollover cable and the DB-9 adapter. You need to provide a RJ-45-to-DB-25 female DTE adapter if you want to connect the switch console port to a terminal. You can order a kit (part number ACS-DSBUASYN=) with this RJ-45-to-DB-25 female DTE adapter from Cisco.
Cluster Limitations and Restrictions
These limitations apply to cluster configuration:
•When there is a transition from the cluster active command switch to the standby command switch, Catalyst 1900, Catalyst 2820, and Catalyst 2900 4-MB switches that are cluster members might lose their cluster configuration. You must manually add these switches back to the cluster.
(CSCds32517, CSCds55711)
•When a Catalyst 2900 XL or Catalyst 3500 XL cluster command switch is connected to a Catalyst 3550 switch, the command switch does not find any cluster candidates beyond the Catalyst 3550 switch if it is not a member of the cluster. You must add the Catalyst 3550 switch to the cluster. You can then see any cluster candidates connected to it. (CSCdt09918)
•If both the active command-switch and the standby command switch fail at the same time, the cluster is not automatically recreated. Even if there is a third passive command switch, it might not recreate all cluster members because it might not have all the latest cluster configuration information. You must manually recreate the cluster if both the active and standby command switches simultaneously fail. (CSCdt43501)
CMS Limitations and Restrictions
These limitations apply to CMS configuration:
•Host names and Domain Name System (DNS) server names that contain commas on a cluster command switch, member switch, or candidate switch can cause CMS to behave unexpectedly. You can avoid this instability in the interface by not using commas in host names or DNS names. Do not enter commas when also entering multiple DNS names in the IP Configuration tab of the IP Management window in CMS.
•ACEs that contain the host keyword precede all other access control entries (ACEs) in standard ACLs. You can reposition the ACEs in a standard ACL with one restriction: No ACE with the any keyword or a wildcard mask can precede an ACE with the host keyword.
•A red border appears around the text-entering area of some CMS dialogs. The color of the border changes to green when text is entered. This is only a cosmetic error. The colored border does not prevent you from entering text.
There is no workaround. (CSCdy36769)
Note This error only occurs with Java plug-in 1.4.0.
•If you open a window in which you can enter text, open another window, and return to the first window, right-clicking in the text field might make the cursor in this field disappear. You can still enter text in the field.
There is no workaround. (CSCdy44189)
•When first determining network information, CMS temporarily halts under these conditions in Windows 98:
–Netscape version 4.75 is running with Java Runtime Environment (JRE) 1.3.1 or 1.4.0
–Netscape version 6.2 is running with JRE 1.3.1.
The workaround is to click once outside of the CMS window when CMS halts. (CSCdz72175)
•When you enable log scaling for Link Graphs, the Y-axis scale becomes illegible. There is no workaround. (CSCdz81086)
•After you click Apply or Refresh in the SNMP window, the window size changes.
There is no workaround. (CSCdz84255)
•The CMS window does not return to full size after resizing the NE or IE when using Netscape version 6.xx on Solaris and Linux. This is a Netscape browser problem. There is no workaround. (CSCea01179)
•The CMS files that are downloaded from the switch to your PC, terminal, or workstation are not cached on the PC, terminal, or workstation. The files are then downloaded again when CMS is relaunched.
There is no workaround. (CSCea26211)
•On Windows 98, if you launch CMS by using the Netscape 4.7 browser, CMS might stop running after you click the Apply button.
The workaround is to use Netscape 6.0 or later or use Internet Explorer to launch CMS on Windows 98. (CSCea27408)
•Changing the password or current authentication while CMS is running causes HTTP requests to fail.
The workaround is to close all browser sessions and then relaunch CMS. (CSCeb33995)
Important Notes
These are the important notes related to this Cisco IOS release:
•"Read-Only Mode in CMS" section
Cisco IOS Notes
These notes apply to Cisco IOS configuration:
•When you enable port security on an interface that is also configured with a voice VLAN, you must set the maximum allowed secure addresses on the port to 2 plus the maximum number of secure addresses allowed on the access VLAN. When the port is connected to a Cisco IP phone, the IP phone requires up to two MAC addresses. The address of the IP phone is learned on the voice VLAN, and it might or might not be learned on the access VLAN. Connecting a PC to the IP phone requires additional MAC addresses.
•If you configure a port ACL on a physical interface on a switch that has VLAN maps or input router ACLs configured, or if you configure a VLAN map or input router ACL on a switch that has port ACLs configured, a CONFLICT message is generated but the configuration is accepted. The port ACL action has priority on that port over actions in a router ACL or VLAN map applied to the VLAN to which the port belongs.
The result is that packets received on that physical port will be permitted or denied based on the port ACL action without regard to any permit or deny statements in any router ACL or VLAN map, while packets received on other physical ports in the VLAN will still be permitted or denied based on any router ACLs or VLAN maps applied to the VLAN. If the port ACL is applied to a trunk port, it overrides any other input ACLs applied to all VLANs on the trunk port.
•The default system MTU for traffic on the Catalyst 3550 switch is 1500 bytes. The 802.1Q tunneling feature increases the frame size by 4 bytes. Therefore, when you configure 802.1Q tunneling, you must configure all switches in the 802.1Q network to be able to process maximum frames by increasing the switch system MTU size to at least 1504 bytes. You configure the system MTU size by using the system mtu global configuration command.
•Beginning with Cisco IOS Release 12.1(8)EA1, to configure traffic suppression (previously configured by using the switchport broadcast, switchport multicast, and switchport unicast interface configuration commands), you use the storm-control {broadcast | multicast | unicast} level level [.level] interface configuration commands. For more information about these commands, refer to the Catalyst 3550 Multilayer Switch Command Reference.
•When you are configuring a cascaded stack of Catalyst 3550 switches by using the GigaStack GBIC module and want to include more than one VLAN in the stack, be sure to configure all the GigaStack GBIC interfaces as trunk ports by using the switchport mode trunk interface configuration command and to use the same encapsulation method by using the switchport encapsulation {isl | dot1q} interface configuration command. For more information about these commands, refer to the Catalyst 3550 Multilayer Switch Command Reference.
•If the 1000BASE-T GBIC (WS-G5482) module is not securely inserted, the switch might fail to recognize it or might display an incorrect media type following a show interface privileged EXEC command entry. If this happens, remove and reinsert the GBIC module.
•Beginning with Cisco IOS Release 12.1(11)EA1, the mac address-table aging-time command replaces the mac-address-table aging-time command (with the hyphen). The mac-address-table aging-time command (with the hyphen) will become obsolete in a future release.
•Beginning with Cisco IOS Release 12.1(11)EA1, the vtp privileged EXEC command keywords are available in the vtp global configuration command. The vtp privileged EXEC command will become obsolete in a future release.
•Beginning with Cisco IOS Release 12.1(12c)EA1, the ip igmp query-interval seconds interface configuration command range is 1 to 18000 seconds. If your existing configuration includes a value larger than 18000, the command has no effect, and the switch returns a warning message the first time you restart the switch with the upgraded software. Enter a new value by using the ip igmp query-interval seconds interface configuration command, and then save your configuration.
•If the switch has insufficient Layer 4 resources, the following message might be displayed when configuring port ACLs:%Error: cannot create VMR data structures.%FM-2-NOVMR: Cannot create VMR data structures for access list 131
If this message is displayed, the switch did not apply the ACL to the port. (CSCdx42414)
•Beginning with Cisco IOS Release 12.1(12c)EA1, you can set the class of service (CoS) value of incoming traffic in a policy map that includes the trust dscp policy-map class configuration command. To do this, follow the steps described in the "Classifying, Policing, and Marking Traffic by Using Policy Maps" section in the "Configuring QoS" chapter of the software configuration guide for this release. (CSCdy45670)
•When you configure a dynamic switchport by using the switchport access vlan dynamic interface configuration command, the port might allow unauthorized users to access network resources if the interface changes from access mode to trunk mode through Dynamic Trunking Protocol (DTP) negotiation.
The workaround is to configure the port as a static access port. (CSCdz32330)
•If a spanning-tree loop occurs, this message might appear:MALLOCFAIL, alignment 0. -Process=Syslog Traps -Traceback= 1A3740
This message appears because the switch has run out of I/O memory and is unable to allocate a packet buffer to report the error. You can also verify if the switch runs out of I/O memory by using the show memory privileged EXEC command.
The workaround is to reconfigure the spanning tree to remove the loop. (CSCdz51522)
•Beginning in Cisco IOS Release 12.1(13)EA1, these are the default settings for a IP Phone connected to a switch (CSCdz76948):
–The port trust state is to not trust the priority of frames arriving on the IP Phone port from connected devices.
–The CoS value of incoming traffic is overwritten and set to zero.
•Catalyst 3550-24-FX switches now support both full- and half-duplex mode, and the default duplex mode is now half duplex. Autonegotiation of the duplex mode is not supported.
On a Catalyst 3550-24-FX switch, when you upgrade to Cisco IOS Release 12.1(13)EA1 or later, all ports are reset to half-duplex mode. This will cause a duplex setting mismatch if the switch is connected to another device operating in full-duplex mode. After upgrading to Cisco IOS Release 12.1(13)EA1 or later, you should configure the Catalyst 3550-24-FX switch to operate in full-duplex mode, if necessary. (CSCdz29482)
Cluster Notes
This note applies to cluster configuration:
The cluster setup privileged EXEC command and the standby mac-address interface configuration command have been removed from the CLI and the documentation because they did not function correctly.
CMS Notes
These notes apply to CMS configuration:
•If you use CMS on Windows 2000, it might not apply configuration changes if the enable password is changed from the CLI during your CMS session. You have to restart CMS and enter the new password when prompted. Platforms other than Windows 2000 prompt you for the new enable password when it is changed.
•CMS does not display QoS classes that are created through the CLI if these classes have multiple match statements. When using CMS, you cannot create classes that match more than one match statement. CMS does not display policies that have such classes.
•If you use Internet Explorer Version 5.5 and select a URL with a nonstandard port at the end of the address (for example, www.add.com:84), you must enter http:// as the URL prefix. Otherwise, you cannot launch CMS.
•Within an ACL, you can change the sequence of ACEs that have the host keyword. However, because such ACEs are independent of each other, the change has no effect on the way the ACL filters traffic.
•If you have a proxy server configured on your web browser, CMS can run slowly and take 2 to 3 minutes to process each command that is entered.
Read-Only Mode in CMS
CMS provides two levels of access to the configuration options. If your privilege level is 15, you have read-write access to CMS. If your privilege level is from 1 to 14, you have read-only access to CMS. In the read-only mode, some data is not displayed, and an error message appears when these switches are running these software releases:
•Catalyst 2900 XL or Catalyst 3500 XL member switches running Cisco IOS Release 12.0(5)WC2 or earlier
•Catalyst 2950 member switches running Cisco IOS Release 12.0(5)WC2 or earlier
•Catalyst 3550 member switches running Cisco IOS Release 12.1(6)EA1 or earlier
In the Front Panel view or Topology view, CMS does not display error messages. In the Front Panel view, if the switch is running one of the software releases listed previously, the device LEDs do not appear. In Topology view, if the member is a Long-Reach Ethernet (LRE) switch, the customer premises equipment (CPEs) connected to the switch do not appear. The Bandwidth and Link graphs also do not appear in these views.
To view switch information, you need to upgrade the member switch software. For information about upgrading switch software, see the "Downloading Software" section.
Open Caveats
These are the open caveats with possible unexpected activity in this Cisco IOS release:
•"Open Cisco IOS Caveats" section
Open Cisco IOS Caveats
These are the severity 3 Cisco IOS configuration caveats:
When a Catalyst 6000 SSH client connects to a Catalyst 3550 SSH server, the Catalyst 6000 switch halts at the enable-password prompt from which to enter privileged EXEC mode. This problem occurs when the Catalyst 6000 switch is running the c6sup1_rp-JK2SV-M crypto-image as a client and the Catalyst 3550 switch is running the crypto-image as the SSH server.
There is no workaround.
On a Catalyst 3550-24 switch, the switch drops frames received on the 10/100 ports with a destination MAC address of 5xxx.xxxx.xxxx because of frame-check-sequence (FCS) errors.
There is no workaround.
If you create a policy map by using the policy-map policy-map-name global configuration command, enter the class class-map-name policy-map configuration command and then you immediately exit from the policy-map class configuration mode, the policy map does not show its class-map association.
The workaround is to configure another command (such as the police, trust, or set policy-map class configuration command) after entering the class class-map-name policy-map configuration command.
When a community string is assigned by the cluster command switch, you cannot get any dot1dBridge MIB objects using a community string with a VLAN entity from a cluster member switch.
The workaround is to manually add the cluster community string with the VLAN entity on the member switches for all active VLANs shown in the show spanning-tree summary display. This is an example of such a change, where cluster member 3 has spanning-tree on vlan 1-3 and the cluster commander community string is email@example.com(config)#snmp community public@es3@1 ROMbr3(config)#snmp community public@es3@2 ROMbr3(config)#snmp community public@es3@3 RO
CMS does not work when a switch is running the crypto software image and the vty lines are configured to use only SSH by using the transport input ssh line vty 0 15 interface configuration command.
The workaround is to allow SSH and Telnet access through the vty lines by using the transport input ssh telnet interface configuration command.
When you are stacking Catalyst 3550 switches by using GigaStack GBICs, the links between the switches might not be up.
There is no workaround.
If you remove a large number of class maps by using a script or remove a policy map that contains a large number of class maps from an interface, the switch might reboot.
There is no workaround.
When a QoS policy map is attached to an interface and the class map used by the policy map is modified, the previous class map information is not completely removed from the interface. This causes the interface to incorrectly classify packets.
There is no workaround.
A switch with an EtherChannel will not load balance multicast traffic across the links in a channel. This affects only multicast traffic, unicast traffic is correctly load balanced.
There is no workaround.
When you enable an interface which is already up by using the no shutdown command, the switch sends a linkdown trap with the locIfReason as up.
There is no workaround.
In the CISCO-STACK-MIB, the portDuplex object should show the negotiated port duplex information. Instead, the portDuplex object shows the configured value.
There is no workaround.
When you specify the interface to attach to a policy map, the switch might log this error message if a CoS is set in a QoS policy map without the entering the trust dscp global configuration command:
00:15:41: Add/Modify 'set' action associated with class-map CLASS_UDP failed: Insufficient memory 00:15:41: %QM-4-UNEXPECTED_INTERNAL_QOS_CONDITION: Unexpected internal QoS condition. -Traceback= 47FD48 47A6CC 1E8EA0 1EE43C 1EE5A8 133078 1417F0 1C6440
The workaround is to use the trust dscp set cos and the mls qos cos policy-map global configuration commands when you create the policy map.
Load sharing across multiple paths for a recursive route entry might fail.
There is no workaround.
The Catalyst 3550 continues to learn the MAC-address of an IP phone from CDP packets it receives from the IP phone over the data VLAN. Normally, the switch learns the MAC address of the phone on the voice VLAN only.
There is no workaround.
Open CMS Caveats
These are the severity 3 CMS configuration caveats:
CMS fails when a switch is running the crypto software image and the vty lines have been configured to use only secure shell (SSH) using the transport input ssh and line vty 0 15 global configuration commands.
The workaround is to allow SSH and Telnet access through the vty lines by using the transport input ssh telnet and line vty 0 15 global configuration command.
The Port Settings table displays meaningless information in the columns for interface description and duplex cells. This problem occurs for some of the Catalyst 2820 and Catalyst 1900 switches.
CMS does not validate configuration values for STP port priority before applying them to the switch. When invalid values are applied, the attempt fails silently without a warning message. This applies to all switches running Cisco IOS 12.1 or later.
There is no workaround. Make sure input configuration values are valid.
CMS does not validate configuration values for STP port path cost before applying them to the switch. When invalid values are applied, the attempt fails silently without a warning message. This applies to all switches running Cisco IOS 12.1 or later.
There is no workaround. Make sure input configuration values are valid for the switch type.
CMS does not validate configuration values for STP bridge parameters before applying them to the switch. When invalid values are applied, the attempt fails silently without a warning message. This applies to all switches running Cisco IOS 12.1 or later.
There is no workaround. Make sure input configuration values are valid.
The Link Graphs bar chart for Packet Drops & Errors might display erroneous errors for Ethernet interfaces.
The workaround is to use the show interfaces or show interfaces counter privileged EXEC commands command instead.
Sometimes a stack icon disappears from the topology view. This can occur if one of the stack members goes down or a stack member is disconnected from the stack.
The workaround is to close the CMS browser and launch CMS again.
When launching CMS in read-only mode, Java exceptions might occur. This behavior does not affect CMS functionality.
There is no workaround.
When using CMS in read-only mode, an error is reported if help is launched from the QoS Graph dialog box.
There is no workaround.
CMS does not apply shaped bandwidth weights that are invalid. Shaped weights are invalid if the sum of their reciprocals is greater than 1 and the weight of a queue is zero.
There is no workaround.
Resolved Caveats
These are the caveats that have been resolved in this release.
•"Cisco IOS Caveats Resolved in Cisco IOS Release 12.1(14)EA1" section
•"CMS Caveats Resolved in Cisco IOS Release 12.1(14)EA1" section
Cisco IOS Caveats Resolved in Cisco IOS Release 12.1(14)EA1
These Cisco IOS caveats were resolved in Cisco IOS Release 12.1(14)EA1:
When the switch runs out of Layer 4 operation (L4op) resources, the ACL that you are configuring or modified is now applied.
When Cross-Stack UplinkFast (CSUF) is configured on a stack of switches, if a link between two uplink ports is down, and if at least two switches have uplink ports that are connected to the secondary root switch, the correct port is now elected as the root port, and no loops are formed.
When a Catalyst switch is used as a Layer 2 switch with IGMP snooping enabled, the switch no longer sends IGMP leave packets with a source IP address of 0.0.0.0.
When a host leaves a multicast group by sending an Internet Group Management Protocol (IGMP) leave message or it does not send an IGMP report in response to a General Query within the maximum IGMP response-time window (the default is 10 seconds), the switch no longer removes the port. If this is the last receiver port in the group, the switch no longer sends a leave message to the router to prune the multicast router.
On an interface, if you are configuring 802.1Q or Layer 2 protocol tunneling and BPDU filtering is disabled, BPDU filtering is no longer automatically enabled when the interface is reset.
On a Gigabit Ethernet port that was manually configured to operate at 100 Mbps and full duplex, if flow control for send is set to desired mode and the link partner flow control for receive is set to off, the port no longer sends pause frames.
When port security is not enabled, you can no longer enter the same static secure MAC address on multiple switch interfaces.
When a host leaves an IP multicast group, it might send an IGMP leave message to the group. In response, the switch now sends a group-specific query.
The output from the show controllers privileged EXEC command now correctly shows routed-interface information when you enter the no switchport interface configuration command on an interface.
A Catalyst 3550 switch now generates warmstart and coldstart traps.
After the voice VLAN feature is enabled, the output from the show interfaces interface-id switchport privileged EXEC command now shows that the voice VLAN is active.
After you add a static MAC address on an interface, you can now remove it.
Classification of IP traffic based on the IP precedence value no longer fails if the last five bits of the type of service (TOS) field are not zero.
If you enter the shutdown and no shutdown interface configuration commands on a Remote Switched Port Analyzer (RSPAN) reflector port, the reflector port configuration is now correctly restored.
When a Catalyst 3550 switch is a DHCP client and renews its IP address from a DHCP server, the switch no longer puts its IP address in the giaddr field of the request.
If a cluster command switch or a statically-configured member switch connected to the command switch restarts, the member switch is no longer down.
On a voice VLAN, if you configure the IP Phone to use priority tagging and VLAN 0 (the native VLAN) by using the switchport voice clan dot1p interface configuration command and if 802.1X is enabled on the interface, a switch running Cisco IOS Release 12.1(12c)EA1 or later now forwards voice traffic correctly.
When STP Layer 2 protocol tunneling is enabled on an interface, the switch no longer forwards Link Aggregation Control Protocol (LACP) packets with STP packets.
On switches running Cisco IOS Release 12.1(12c)EA1 or later, if you change the access VLAN ID of a port channel by using the switchport access vlan interface configuration command, the changes are propagated to the port-channel members and are now added to the running configuration of the members.
If a Layer 2 interface is shut down, the aging time for the MAC address table is no longer removed from the switch configuration.
If the port duplex setting of a 10/100 port on a Catalyst 3550-24PWR switch is not set to auto, when the port is connected to some Gigabit Ethernet NICs and you change the port speed from 100 Mbps to 10 Mbps or the reverse, the link between the port and the NIC now works correctly.
When you configure VLANs by using the vlan global configuration command and more than 1005 VLANs are configured, the switch no longer reloads.
When HSRP is configured on 16 VLAN interfaces with single standby group and then is configured on the 17th VLAN interface with the same standby group, an error message no longer appears and the HSRP configuration is successful on the interface.
A switch configured for fallback bridging no longer stops bridging traffic to unknown destination addresses if the bridge-group bridge-group spanning-disabled interface configuration command is configured on both SVIs.
A switch configured for Rapid Spanning-tree (802.1w) no longer sends a Topology Change Notification (TCN) if an interface is reconfigured by using the spanning-tree portfast interface configuration command.
CMS Caveats Resolved in Cisco IOS Release 12.1(14)EA1
These CMS caveats were resolved in Cisco IOS Release 12.1(14)EA1:
In the Community Strings tab of the SNMP Manager window, CMS now shows all the community strings except those that are created when you configure trap managers on the switch.
If CMS is in read-only mode and a Catalyst 3550 switch is connected to a Catalyst 3500 XL switch, when you try to access the link report for the link between the switches, a Java Exception error no longer occurs.
In the Trap Manager tab of the SNMP window, CMS now shows the VLAN Create/Delete trap options as enabled when they are configured to be sent to the trap manager.
You can now create or modify an EtherChannel port group.
Documentation Updates
You can access all Catalyst 3550 documentation at this URL:
This section provides these updates to the product documentation:
•"References to the Cisco Documentation CD-ROM" section
•"Additions to the Hardware Installation Guide" section
•"Corrections to the Hardware Installation Guide" section
These changes will be included in the next version of the documentation.
References to the Cisco Documentation CD-ROM
The documentation for the Catalyst 3550 switches incorrectly refers to the Cisco Documentation CD-ROM. The Catalyst 3550 switches no longer ship with this CD-ROM.
Corrections to the Software Configuration Guide and Command Reference
These are corrections for the Catalyst 3550 Multilayer Switch Software Configuration Guide and Catalyst 3550 Multilayer Switch Command Reference:
•The command syntax for the udld interface configuration command is incorrect in the command reference and the software configuration guide. The correct syntax is udld port [aggressive | disable]; the syntax and usage guidelines incorrectly include the enable option. Also, the usage guidelines should use udld port, not just udld, when referring to this command.
Additions to the Hardware Installation Guide
This is an addition to the Catalyst 3550 Multilayer Switch Hardware Installation Guide:
Installing the Optional Ground Kit
For switches that require a two-hole lug for grounding, you can order a kit containing the ground lug and hardware from Cisco. For the Catalyst 3550-12G, 3550-24, and 3550-24-FX switches, order part number NEBS-LUG-3550=.
Note When you install the ground-lug kit, you cannot connect a redundant power system (RPS) to the switch.
To install the ground lug, you will need these tools and equipment:
•Ratcheting torque screwdriver with a Phillips head that exerts up to 15 pound-force inches (lbf-in.) or 240 ounce-force inches (ozf-in.) of pressure
•Panduit crimping tool with optional controlled-cycle mechanism (model CT-700, CT-720, CT-920, CT-920CH, CT-930, or CT-940CH)
•6-gauge copper ground wire (insulated or noninsulated)
•Wire-stripping tool for stripping 6-gauge wires
To ground the switch to earth ground, follow these steps. Make sure to follow any grounding requirements at your site.
Step 1 Use the two Phillips pan-head screws to attach the RPS connector cover to the back of the switch as shown in Figure 6 and Figure 7.
Figure 6 Attaching the RPS Connector Cover on the Catalyst 3550-12G Switch
Figure 7 Attaching the RPS Connector Cover on the Catalyst 3550-24 and 3550-FX Switches
Step 2 If your ground wire is insulated, use a wire stripping tool to strip the 6-gauge ground wire to 0.5 inch (12.7 mm) ± 0.02 inch (0.5 mm), as shown in Figure 8.
Figure 8 Stripping the Ground Wire
Step 3 Slide the open end of the ground lug over the exposed area of the 6-gauge wire.
Step 4 Using a Panduit crimping tool, crimp the ground lug to the 6-gauge wire, as shown in Figure 9.
Figure 9 Crimping the Ground Lug
Step 5 Use the two number-10-32 screws to attach the ground lug and wire assembly to the switch rear panel RPS connector cover, as shown in Figure 10 and Figure 11.
Step 6 Using a ratcheting torque screwdriver, torque each ground-lug screw to 15 lbf-in. (240 ozf-in.)
Figure 10 Torquing Ground-Lug Screws on the Catalyst 3550-12G Switch
Figure 11 Torquing Ground-Lug Screws on the Catalyst 3550-24 and 3550-FX Switches
Corrections to the Hardware Installation Guide
These are corrections for the Catalyst 3550 Multilayer Switch Hardware Installation Guide:
•In the "100BASE-FX Ports" section on page 1-10, the "Site Requirements" section on page 2-6, and the "Connecting to 100BASE-FX Ports" section on page 2-30, the information about duplex mode is incorrect. This is the correct information:
The 100BASE-FX ports operate only at 100 Mbps and support both full- and half-duplex mode. The half-duplex mode is the default setting. Autonegotiation is not supported.
•In the "GBIC Module Slots" section on page 1-12, the information about Cisco-approved GBICs is incorrect. This is the correct information:
Cisco-approved CWDM GBIC modules have a serial EEPROM that contains the module serial number, the vendor name and ID, a unique security code, and cyclic redundancy check (CRC). When a CWDM GBIC module is inserted in the switch, the switch software reads the EEPROM to check the serial number, vendor name and vendor ID, and recompute the security code and CRC. If the serial number, the vendor name or vendor ID, the security code, or CRC is invalid, the switch places the interface in an error-disabled state.
Note If you are using a non-Cisco approved CWDM GBIC module, remove the GBIC from the switch, and replace it with a Cisco-approved module.
•In the "Powering On the Switch and Running POST" section on page 2-11 and in the "Understanding POST Results" section on page 3-1, the information about POST is incorrect. This is the correct information:
POST tests run automatically each time the switch is powered on. When the switch begins POST, the port LEDs from number 1 to number 2 turn off. The System LED flashes green, and the RPS LED turns off.
On a Catalyst 3550-24PWR switch, the LEDs do not function correctly during the power-on self-test (POST). The workaround is to view the POST results from the console.
•In the "Technical Specifications" appendix, these values in Table A-5, "Fiber-Port Specifications for Catalyst 3550-24-FX Switches" are incorrect:
–Optical transmitter power for 50/125-micron cabling
–Optical transmitter power for 62.5/125-micron cabling
The correct transmitter power for both the 50/125-micron and 62.5/125-micron cabling is -23.5
to -14 decibel milliwatt (dBm).
•In the "Translated Safety Warnings" chapter, these are the correct translations for the Lightning Activity Warning:
Lightning Activity Warning
Do not work on the system or connect or disconnect cables during periods of lightning activity.
Tijdens onweer dat gepaard gaat met bliksem, dient u niet aan het systeem te werken of kabels aan te sluiten of te ontkoppelen.
Älä työskentele järjestelmän parissa äläkä yhdistä tai irrota kaapeleita ukkosilmalla.
Ne pas travailler sur le système ni brancher ou débrancher les câbles pendant un orage.
Arbeiten Sie nicht am System und schließen Sie keine Kabel an bzw. trennen Sie keine ab, wenn es gewittert.
Villámlás közben ne dolgozzon a rendszeren, valamint ne csatlakoztasson és ne húzzon ki kábeleket!
Non lavorare sul sistema o collegare oppure scollegare i cavi durante un temporale con fulmini.
Utfør aldri arbeid på systemet, eller koble kabler til eller fra systemet når det tordner eller lyner.
Não trabalhe no sistema ou ligue e desligue cabos durante períodos de mau tempo (trovoada).
No operar el sistema ni conectar o desconectar cables durante el transcurso de descargas eléctricas en la atmósfera.
Vid åska skall du aldrig utföra arbete på systemet eller ansluta eller koppla loss kablar.
Related Documentation
These documents provide complete information about the switch and are available from this Cisco.com site:
You can order printed copies of documents with a DOC-xxxxxx= number from the Cisco.com sites and from the telephone numbers listed in the "Ordering Documentation" section.
•Catalyst 3550 Multilayer Switch Software Configuration Guide (order number DOC-7811194=)
•Catalyst 3550 Multilayer Switch Command Reference (order number DOC-7811195=)
•Catalyst 3550 Multilayer Switch System Message Guide (order number DOC-7811196=)
•Cluster Management Suite (CMS) online help (available only from the switch CMS software)
•Catalyst 3550 Multilayer Switch Hardware Installation Guide (order number DOC-7811358=)
•1000BASE-T Gigabit Interface Converter Installation Note (not orderable but is available on Cisco.com)
•Catalyst GigaStack Gigabit Interface Converter Hardware Installation Guide (order number DOC-786460=)
Obtaining Documentation
Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems.
You can access the most current Cisco documentation on the World Wide Web at this URL:
You can access the Cisco website at this URL:
You can access international Cisco websites from this URL:
Documentation CD-ROM
Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which may have shipped with your product. The Documentation CD-ROM is updated monthly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual subscription.
Registered Cisco.com users can order the Documentation CD-ROM (product number DOC-CONDOCCD=) through the online Subscription Store:
Ordering Documentation
You can find instructions for ordering documentation at this URL:
You can order Cisco documentation in these ways:
•Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Networking Products MarketPlace:
•Registered Cisco.com users can order the Documentation CD-ROM (Customer Order Number DOC-CONDOCCD=) through the online Subscription Store:
•Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, U.S.A.) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387).
Documentation Feedback
You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click Feedback at the top of the page.
You can e-mail your comments to firstname.lastname@example.com.
You can submit your comments by mail by using the response card behind the front cover of your document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883
We appreciate your comments.
Obtaining Technical Assistance
Cisco provides Cisco.com, which includes the Cisco Technical Assistance Center (TAC) Website, as a starting point for all technical assistance. Customers and partners can obtain online documentation, troubleshooting tips, and sample configurations from the Cisco TAC website. Cisco.com registered users have complete access to the technical support resources on the Cisco TAC website, including TAC tools and utilities.
Cisco.com offers a suite of interactive, networked services that let you access Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world.
Cisco.com provides a broad range of features and services to help you with these tasks:
•Streamline business processes and improve productivity
•Resolve technical issues with online support
•Download and test software packages
•Order Cisco learning materials and merchandise
•Register for online skill assessment, training, and certification programs
To obtain customized information and service, you can self-register on Cisco.com at this URL:
Technical Assistance Center
The Cisco TAC is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two levels of support are available: the Cisco TAC website and the Cisco TAC Escalation Center. The avenue of support that you choose depends on the priority of the problem and the conditions stated in service contracts, when applicable.
We categorize Cisco TAC inquiries according to urgency:
•Priority level 4 (P4)—You need information or assistance concerning Cisco product capabilities, product installation, or basic product configuration.
•Priority level 3 (P3)—Your network performance is degraded. Network functionality is noticeably impaired, but most business operations continue.
•Priority level 2 (P2)—Your production network is severely degraded, affecting significant aspects of business operations. No workaround is available.
•Priority level 1 (P1)—Your production network is down, and a critical impact to business operations will occur if service is not restored quickly. No workaround is available.
Cisco TAC Website
You can use the Cisco TAC website to resolve P3 and P4 issues yourself, saving both cost and time. The site provides around-the-clock access to online tools, knowledge bases, and software. To access the Cisco TAC website, go to this URL:
All customers, partners, and resellers who have a valid Cisco service contract have complete access to the technical support resources on the Cisco TAC website. Some services on the Cisco TAC website require a Cisco.com login ID and password. If you have a valid service contract but do not have a login ID or password, go to this URL to register:
If you are a Cisco.com registered user, and you cannot resolve your technical issues by using the Cisco TAC website, you can open a case online at this URL:
If you have Internet access, we recommend that you open P3 and P4 cases through the Cisco TAC website so that you can describe the situation in your own words and attach any necessary files.
Cisco TAC Escalation Center
The Cisco TAC Escalation Center addresses priority level 1 or priority level 2 issues. These classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer automatically opens a case.
To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to this URL:
Before calling, please check with your network operations center to determine the level of Cisco support services to which your company is entitled: for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). When you call the center, please have available your service agreement number and your product serial number.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
•The Cisco Product Catalog describes the networking products offered by Cisco Systems as well as ordering and customer support services. Access the Cisco Product Catalog at this URL:
•Cisco Press publishes a wide range of networking publications. Cisco suggests these titles for new and experienced users: Internetworking Terms and Acronyms Dictionary, Internetworking Technology Handbook, Internetworking Troubleshooting Guide, and the Internetworking Design Guide. For current Cisco Press titles and other information, go to Cisco Press online at this URL:
•Packet magazine is the Cisco monthly periodical that provides industry professionals with the latest information about the field of networking. You can access Packet magazine at this URL:
•Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in the design, development, and operation of public and private internets and intranets. You can access the Internet Protocol Journal at this URL:
•Training—Cisco offers world-class networking training, with current offerings in network training listed at this URL:
This document is to be used in conjunction with the documents listed in the "Related Documentation" section section.
Copyright © 2001-2003, Cisco Systems, Inc. All rights reserved.