text:
Table Of Contents
Release Notes for the Cisco ME 3400E and
ME 3400 Ethernet Access Switches, Cisco IOS Release 12.2(50)SE and Later
Finding the Software Version and Feature Set
Recovering from a Software Failure
Minimum Cisco IOS Release for Major Features
Bidirectional Forwarding Detection
Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE5
Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE4
Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE3
Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE1
Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE
Update to the Software Configuration Guide
Update to the ME 3400 Hardware Installation Guide
Updates to the System Message Guide
Updates to the ME 3400E Regulatory Compliance and Safety Information Guide and the Getting Started Guide
Cisco ME 3400E-24TS-M and Cisco ME 3400EG-12CS-M
Obtaining Documentation and Submitting a Service Request
Release Notes for the Cisco ME 3400E and
ME 3400 Ethernet Access Switches, Cisco IOS Release 12.2(50)SE and Later
Revised October 5, 2010
Cisco IOS Release 12.2(50)SE and later runs on the Cisco ME 3400E and ME 3400Series Ethernet Access switches.
These release notes include important information about Cisco IOS Release 12.2(50)SE3 and any limitations, restrictions, and caveats that apply to the release. Verify that these release notes are correct for your switch:
•If you are installing a new switch, see the Cisco IOS release label on the rear panel of your switch.
•If your switch is on, use the show version privileged EXEC command. See the "Finding the Software Version and Feature Set" section.
•If you are upgrading to a new release or different image, see the software upgrade filename for the software version. See the "Deciding Which Files to Use" section.
For the complete list of Cisco ME 3400E and ME 3400 switch documentation, see the "Related Documentation" section.
You can download the switch software from this site (registered Cisco.com users with a login password):
This software release is part of a special release of Cisco IOS software that is not released on the same 8-week maintenance cycle that is used for other platforms. As maintenance releases and future software releases become available, they will be posted to Cisco.com in the Cisco IOS software area.
This information is in the release notes:
•Upgrading the Switch Software
•Minimum Cisco IOS Release for Major Features
•Obtaining Documentation and Submitting a Service Request
Hardware Supported
Table 1 lists the hardware supported on Cisco IOS Release 12.2(50)SE.
Table 1 Supported Hardware
Device Description Supported by Minimum Cisco IOS Release
24 10/100 ports and 2 dual-purpose ports; supports removable AC- and DC-power supplies.
Cisco IOS Release 12.2(44)EY
12 dual-purpose ports and 4 SFP module slots; supports removable AC- and DC-power supplies.
Cisco IOS Release 12.2(44)EY
2 dual-purpose ports and 2 SFP module slots, AC-power input.
Cisco IOS Release 12.2(44)EY
24 100BASE-FX SFP module ports and 2 Gigabit Ethernet SFP module ports, AC power
Cisco IOS Release 12.2(40)SE
2 dual-purpose ports and 2 SFP-only module ports, AC power
Cisco IOS Release 12.2(35)SE1
12 dual-purpose ports and 4 SFP-only module ports
Cisco IOS Release 12.2(25)SEG1
12 dual-purpose ports and 4 SFP-only module ports
Cisco IOS Release 12.2(25)SEG1
24 10/100 ports and 2 SFP module slots, AC power
Cisco IOS Release 12.2(25)EX
24 10/100 ports and 2 SFP module slots, DC power
Cisco IOS Release 12.2(25)EX
SFP modules
Coarse wavelength-division multiplexing (CWDM)
Cisco IOS Release 12.2(25)EX
Digital optical monitoring (DOM) support for GLC-BX, CWDM and DWDM SFPs
Cisco IOS Release 12.2(44)SE
1000BASE-LX/LH MMF and SMF
DOM support for GLC-ZX-SM SFP, 1000BASE-LX/LH, and 1000BASE-SX
Cisco IOS Release 12.2(46)SE
DOM support for 1000BASE-BX
Additional DWDM SFPs qualification
Cisco IOS Release 12.2(50)SE
For a complete list of ME 3400 supported SFPs and part numbers, see the ME 3400 data sheet at:
SFP modules
100BASE -BX10, -EX, -FX (GLC-FE-100FX only), -LX10, -ZX
1000BASE-T and 10/100/100BASE-T—Category 5,6
(SFP-only ports; not supported on dual-purpose ports)
Coarse wavelength-division multiplexing (CWDM)
Dense wavelength-division multiplexing (DWDM)
Digital optical monitoring (DOM) support for SFP-GE-S, SFP-GE-L, 1000BASE-BX10, 1000BASE-ZX, CWDM and DWDM SFPs
Note See the hardware installation guide for SFP model numbers.
Cisco IOS Release 12.2(44)EY
Additional DWDM SFPs qualification
Cisco IOS Release 12.2(50)SE
For a complete list of ME 3400E supported SFPs and part numbers, see the ME 3400E data sheet at:
Catalyst 3560 SFP interconnect cable
Cisco IOS Release 12.2(25)EX
Upgrading the Switch Software
These are the procedures for downloading software. Before downloading software, read this section for important information:
•Finding the Software Version and Feature Set
•Recovering from a Software Failure
Finding the Software Version and Feature Set
The Cisco IOS image is stored as a bin file in a directory that is named with the Cisco IOS release. The image is stored on the system board flash device (flash:).
You can use the show version privileged EXEC command to see the software version that is running on your switch. The second line of the display shows the version.
You can also use the dir filesystem: privileged EXEC command to see the directory names of other software images that you might have stored in flash memory.
Deciding Which Files to Use
The upgrade procedures in these release notes describe how to perform the upgrade by using a combined tar file. This file contains the Cisco IOS image file. To upgrade the switch through the command-line interface (CLI), use the tar file and the archive download-sw privileged EXEC command.
Table 2 lists the filenames for this software release.
Note The ME 3400 metro base image is not supported on the Cisco ME 3400E switch.
Table 2 Cisco IOS Software Image Files
Cisco ME 3400 metro base image.
This image has basic Metro Ethernet features.
Cisco ME 3400 metro base cryptographic image.
This image has the Kerberos, Secure Shell (SSH), and basic Metro Ethernet features.
Cisco ME 3400E and ME 3400 metro access image.
This image has Layer 2 + Metro Ethernet features.
Cisco ME 3400E and ME 3400 metro access cryptographic image.
This image has the Kerberos, SSH, and Layer 2 + Metro Ethernet features.
Cisco ME 3400E and ME 3400 metro IP access image.
This image has Layer 2+ and full Layer 3 routing Metro Ethernet features.
Cisco ME 3400E and ME 3400 metro IP access cryptographic image.
This image has the Kerberos, SSH, Layer 2+, and full Layer 3 routing Metro Ethernet features.
Archiving Software Images
Before upgrading your switch software, make sure that you have archived copies of the current Cisco IOS release and the Cisco IOS release to which you are upgrading. You should keep these archived images until you have upgraded all devices in the network to the new Cisco IOS image and until you have verified that the new Cisco IOS image works properly in your network.
Cisco routinely removes old Cisco IOS versions from Cisco.com. See Product Bulletin 2863 for more information:
You can copy the bin software image file on the flash memory to the appropriate TFTP directory on a host by using the copy flash: tftp: privileged EXEC command.
You can also configure the switch as a TFTP server to copy files from one switch to another without using an external TFTP server by using the tftp-server global configuration command. For more information about the tftp-server command, see the "Basic File Transfer Services Commands" section of the Cisco IOS Configuration Fundamentals Command Reference, Release 12.2 at this URL:
Upgrading a Switch
This procedure is for copying the combined tar file to the switch. You copy the file to the switch from a TFTP server and extract the files. You can download an image file and replace or keep the current image.
Note For downloading software, we recommend that you connect to the TFTP server through a network node interface (NNI). If you want to connect to the server through a user network interface (UNI), see the "Troubleshooting" chapter of the software configuration guide for methods for enabling ping capability on UNIs. See the "New Software Features" section for a definition of NNIs and UNIs.
To download software, follow these steps:
Step 1 Use Table 2 to identify the file that you want to download.
Step 2 Download the software image file. If you have a SmartNet support contract, log in to cisco.com and go to this URL, and log in to download the appropriate files:
Click on "Launch the IOS Upgrade Planner" and search for the ME3400 platform to select the appropriate files:
•Select the software release and image you want to download.
•You might need to obtain authorization and to download the cryptographic software files
Step 3 Copy the image to the appropriate TFTP directory on the workstation, and make sure that the TFTP server is properly configured.
For more information, refer to Appendix B in the software configuration guide for this release.
Step 4 Log into the switch through the console port or a Telnet session.
Step 5 (Optional) Ensure that you have IP connectivity to the TFTP server by entering this privileged EXEC command:
Switch# ping tftp-server-address
Note By default, ping is supported on network node interfaces (NNIs), but you cannot ping from a user network interface (UNI) because the control-plane security feature drops ICMP response packets received on UNIs. See the "Troubleshooting" chapter of the software configuration guide for methods for pinging from the switch to a host connected to a UNI.
For more information about assigning an IP address and default gateway to the switch, refer to the software configuration guide for this release.
Step 6 Download the image file from the TFTP server to the switch. If you are installing the same version of software that is currently on the switch, overwrite the current image by entering this privileged EXEC command:Switch# archive download-sw /overwrite /reload tftp:[[//location]/directory]/image-name.tar
The /overwrite option overwrites the software image in flash memory with the downloaded one.
The /reload option reloads the system after downloading the image unless the configuration has been changed and not saved.
For //location, specify the IP address of the TFTP server.
For /directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive.
This example shows how to download an image from a TFTP server at 18.104.22.168 and to overwrite the image on the switch:Switch# archive download-sw /overwritetftp://22.214.171.124/me340x-metroipaccess-tar.122.50.SE.tar
You can also download the image file from the TFTP server to the switch and keep the current image by replacing the /overwrite option with the /leave-old-sw option.
Recovering from a Software Failure
For recovery procedures, see the "Troubleshooting" chapter in the software configuration guide for this release.
Installation Notes
You can assign IP information to your switch by using these methods:
•The CLI-based setup program, as described in the switch hardware installation guide.
•The DHCP-based autoconfiguration, as described in the switch software configuration guide.
•Manually assigning an IP address, as described in the switch software configuration guide.
New Features
These sections describe the new supported hardware and the new software features provided in this release:
New Hardware Features
For a list of all supported hardware, see the "Hardware Supported" section.
New Software Features
•IPv6 routing support (requires metro IP access image):
–DHCP for IPv6 relay, client, server address assignment and prefix delegation
–IPv6 unicast routing capability for forwarding IPv6 traffic through configured interfaces using static routing, RIP, OSPF, or EIGRP
–IPv6 default router preference (DRP) for improving the ability of a host to select an appropriate router
Note Although documented in the software configuration guide, HTTP(S) over IPv6 is not supported in this release.
•IPv6 ACLs to be applied to interfaces to filter IPv6 traffic (requires metro IP access image).
•Bidirectional Forwarding Detection (BFD) Protocol to quickly detect forwarding-path failures for OSPF, IS-IS, BGP, EIGRP, or HSRP routing protocols.
•REP configuration on edge ports connected to ports that do not support REP.
•Support for Embedded Event Manager Version 2.4.
•Network Edge Access Topology (NEAT) with 802.1X switch supplicant, host authorization with CISP, and auto enablement to authenticate a switch outside a wiring closet as a supplicant to another switch.
•CPU utilization threshold trap monitors CPU utilization.
•RADIUS server load balancing to allow access and authentication requests to be distributed evenly across a server group.
•Support for the CISCO-ENTITY-SENSOR MIB and the CISCO-PORT-QOS-MIB
•IP source guard in the metro base image (ME 3400) to restrict traffic on nonrouted interfaces by filtering traffic based on the DHCP snooping database and IP source bindings
•Dynamic ARP inspection in the metro base image (ME 3400) to prevent malicious attacks on the switch by not relaying invalid ARP requests and responses to other ports in the same VLAN
Minimum Cisco IOS Release for Major Features
Table 3 lists the minimum software release (after the first release) required to support the major features of the Cisco ME 3400E and ME 3400 switch. Features not listed are supported in all releases.
Note The first release for the Cisco ME3400E switch was 12.2(44)EY and it included all features through release 12.2(44)SE.
Table 3 Features Introduced After the First Release and the Minimum Cisco IOS Release Required
Feature Minimum Cisco IOS Release Required
IPv6 routing support (metro IP access image only)
IPv6 ACLs (metro IP access image only)
BFD (metro IP access image only)
REP support on ports connected to nonREP ports
NEAT with 802.1X switch supplicant, host authorization with CISP, and auto enablement
CPU utilization threshold trap
EEM 2.4 (metro access image only on ME 3400)
RADIUS server load balancing
IP source guard in metro base image (ME 3400)
Dynamic ARP inspection in metro base image (ME 3400)
EOT and IP SLAs EOT static route support
REP counter and timer enhancements
HSRPv2 (metro IP access image only)
DHCP server port-based address allocation
DHCP-based autoconfiguration and image update
Configurable small-frame arrival threshold
Source Specific Multicast (SSM) mapping for multicast applications
Support for the *, ip-address, interface interface-id, and vlan vlan-id keywords with the clear ip dhcp snooping command
Flex Link Multicast Fast Convergence
IEEE 802.1x readiness check
Configurable control-plane queue assignment
Configurable control plane security (support for ENIs)
/31 bit mask support for multicast traffic
Configuration rollback and replacement
EEM (metro IP access image only)
Note EEM support was added to the metro access image in 12.2(44)SE
IGMP Helper (metro IP access image only)
IP SLAs support (metro IP access and metro access images only)
IP SLAs enhanced object tracking (metro IP access and metro access images only)
IP SLAs for Ethernet OAM (metro IP access image only)
Multicast VRF Lite (metro IP access image only)
SSM PIM (metro IP access image only)
REP (metro IP access and metro access images only)
LLDP-MED location TLV (metro IP access and metro access images only)
LLDP and LLDP-MED
Port security on a PVLAN host
VLAN Flex Links load balancing
Support for Multicast VLAN Registration (MVR) over trunk ports
Enhanced object tracking for HSRP (metro IP access image only)
Ethernet OAM IEEE 802.3ah protocol (metro IP access and metro access images only)
Ethernet OAM CFM (IEEE 802.1ag) and E-LMI (metro IP access and metro access images only)
Per port per VLAN QoS (metro IP access and metro access images only)
Support for all OSPF network types (metro IP access only)
Layer 2 protocol tunneling on trunks (metro IP access and metro access images only)
IS-IS protocol (metro IP access only)
NNIs on all ports (metro IP access image only)
DHCP server
DHCP Option-82 configurable remote ID and circuit ID
Multiple spanning-tree (MST) based on the IEEE 802.1s standard
Nonstop forwarding (NSF) awareness (metro IP access image only)
Secure Copy Protocol
Flex Links sub 100 ms convergence; preemptive switchover (metro IP access and metro access images)
Link-state tracking (trunk failover) (metro IP access and metro access images only)
Limitations and Restrictions
You should review this section before you begin working with the switch. These are known limitations that will not be fixed, and there is not always a workaround. Some features might not work as documented, and some features could be affected by recent changes to the switch hardware or software.
•Bidirectional Forwarding Detection
Bidirectional Forwarding Detection
•The BFD session with the neighbor flaps when there is close to 100% bidirectional line rate traffic transmitted through the physical links that connect the neighbors. This happens only on the sessions where the Layer 3 BFD neighboring switches are connected through a Layer 2 intermediate switch.
The workaround is to make sure that there is no 100% bidirectional unknown traffic flowing through the intermediate Layer 2 switch in the same links where the Layer 3 switches are connected. An alternate workaround is to always directly the Layer 3 switches when BFD is running. (CSCsu94835)
•The far-end fault optional facility is not supported on the GLC-GE-100FX SFP module.
The workaround is to configure aggressive UDLD. (CSCsh70244).
•A static IP address might be removed when the previously acquired DHCP IP address lease expires.
This problem occurs under these conditions:
–When the switch is booted without a configuration (no config.text file in flash memory).
–When the switch is connected to a DHCP server that is configured to give an address to it (the dynamic IP address is assigned to VLAN 1).
–When an IP address is configured on VLAN 1 before the dynamic address lease assigned to VLAN 1 expires.
The workaround is to reconfigure the static IP address. (CSCea71176 and CSCdz11708)
•The DHCP snooping binding database is not written to flash memory or a remote file in any of these situations:
–When the Network Time Protocol (NTP) is configured, but the NTP clock is not synchronized. You can check the clock status by entering the show NTP status privileged EXEC command and verifying that the network connection to the NTP server and the peer work correctly.
–The DHCP snooping database file is manually removed from the file system. After enabling the DHCP snooping database by configuring a database URL, a database file is created. If the file is manually removed from the file system, the DHCP snooping database does not create another database file. You need to disable the DHCP snooping database and enable it again to create the database file.
–The URL for the configured DHCP snooping database was replaced because the original URL was not accessible. The new URL might not take effect after the timeout of the old URL.
No workaround is necessary; these are the designed behaviors. (CSCed50819)
•When dynamic ARP inspection is enabled on a switch, ARP and RARP packets greater than 2016 bytes are dropped by the switch or switch stack. This is a hardware limitation.
However, when dynamic ARP inspection is not enabled and a jumbo MTU is configured, ARP and RARP packets are correctly bridged in hardware. (CSCed79734)
•Dynamic ARP inspection log entries might be lost after a switch failure. Any log entries that are still in the log buffer (have not been output as a system message) on a switch that fails are lost.
When you enter the show ip arp inspection log privileged EXEC command, the log entries from all switches in the stack are moved to the switch on which you entered the command.
There is no workaround. (CSCed95822)
•When port security is enabled on an interface in restricted mode and the switchport block unicast interface command has been entered on that interface, MAC addresses are incorrectly forwarded when they should be blocked
The workaround is to enter the no switchport block unicast interface configuration command on that specific interface. (CSCee93822)
•A traceback error occurs if a crypto key is generated after an SSL client session.
There is no workaround. This is a cosmetic error and does not affect the functionality of the switch. (CSCef59331)
•When you enter the boot host retry timeout global configuration command to specify the amount of time that the client should keep trying to download the configuration and you do not enter a timeout value, the default value is zero, which should mean that the client keeps trying indefinitely. However, the client does not keep trying to download the configuration.
The workaround is to always enter a non zero value for the timeout value when you enter the boot host retry timeout timeout-value command. (CSCsk65142)
•The switch might display tracebacks similar to this example when an EtherChannel interface port-channel type changes from Layer 2 to Layer 3 or the reverse:
15:50:11: %COMMON_FIB-4-FIBNULLHWIDB: Missing hwidb for fibhwidb Port-channel1 (ifindex 1632) -Traceback= A585C B881B8 B891CC 2F4F70 5550E8 564EAC 851338 84AF0C 4CEB50 859DF4 A7BF28 A98260 882658 879A58
There is no workaround. (CSCsh12472)
•The switch does not create an adjacent table entry when the ARP timeout value is 15 seconds and the ARP request times out. The workaround is to not set an ARP timeout value lower than 120 seconds. (CSCea21674)
MAC Addressing
When a MAC address is configured for filtering on the internal VLAN of a routed port, incoming packets from the MAC address to the routed port are not dropped. (CSCeb67937)
•The switch does not support tunnel interfaces, including DVMRP and PIM tunneling.
•Nonreverse-path forwarded (RPF) IP multicast traffic to a group that is bridged in a VLAN is leaked onto a trunk port in the VLAN even if the port is not a member of the group in the VLAN, but it is a member of the group in another VLAN. Because unnecessary traffic is sent on the trunk port, it reduces the bandwidth of the port. There is no workaround for this problem because non-RPF traffic is continuous in certain topologies. As long as the trunk port is a member of the group in at least one VLAN, this problem occurs for the non-RPF traffic. (CSCdu25219)
•If the number of multicast routes and Internet Group Management Protocol (IGMP) groups are more than the maximum number specified by the show sdm prefer global configuration command, the traffic received on unknown groups is flooded in the received VLAN even though the show ip igmp snooping multicast-table privileged EXEC command output shows otherwise. The workaround is to reduce the number of multicast routes and IGMP snooping groups to less than the maximum supported value. (CSCdy09008)
•IGMP filtering is applied to packets that are forwarded through hardware. It is not applied to packets that are forwarded through software. Hence, with multicast routing enabled, the first few packets are sent from a port even when IGMP filtering is set to deny those groups on that port. There is no workaround. (CSCdy82818)
•When you use the ip access-group interface configuration command with a router access control list (ACL) to deny access to a group in a VLAN, multicast data to the group that is received in the VLAN is always flooded in the VLAN, regardless of IGMP group membership in the VLAN. This provides reachability to directly connected clients, if any, in the VLAN. The workaround is to not apply a router ACL set to deny access to a VLAN interface. Apply the security through other means; for example, apply VLAN maps to the VLAN instead of using a router ACL for the group. (CSCdz86110)
•If an IGMP report packet has two multicast group records, the switch removes or adds interfaces depending on the order of the records in the packet:
–If the ALLOW_NEW_SOURCE record is before the BLOCK_OLD_SOURCE record, the switch removes the port from the group.
–If the BLOCK_OLD_SOURCE record is before the ALLOW_NEW_SOURCE record, the switch adds the port to the group.
There is no workaround. (CSCec20128)
•When IGMP snooping is disabled and you enter the switchport block multicast interface configuration command, IP multicast traffic is not blocked.
The switchport block multicast interface configuration command is only applicable to non-IP multicast traffic.
There is no workaround. (CSCee16865)
•Incomplete multicast traffic can be seen under either of these conditions:
–You disable IP multicast routing or re-enable it globally on an interface.
–A switch mroute table temporarily runs out of resources and recovers later.
The workaround is to enter the clear ip mroute privileged EXEC command on the interface. (CSCef42436)
•Although you can configure a REP segment without configuring REP edge ports, we recommend that you configure REP edge ports whenever possible because edge ports enable these functions:
–selecting the preferred alternate port
–configuring VLAN load balancing
–configuring topology change notifications (TCNs) toward STP, other REP segments, or an interface
–initiating the topology collection process
–preemption mechanisms
You cannot enable these functions on REP segments without edge ports.
•The switch does not support tunnel interfaces for routed traffic.
•A route map that has an ACL with a Differentiated Services Code Point (DSCP) clause cannot be applied to a Layer 3 interface. The switch rejects this configuration and displays a message that the route map is unsupported. There is no workaround. (CSCea52915)
•A spanning-tree loop might occur if all of these conditions are true:
–Port security is enabled with the violation mode set to protected.
–The maximum number of secure addresses is less than the number of switches connected to the port.
–There is a physical loop in the network through a switch whose MAC address has not been secured, and its BPDUs cause a secure violation.
The workaround is to change any one of the listed conditions. (CSCed53633)
•When you use the bandwidth policy-map class command to configure more than one class in a policy map for Class-based Weighted Fair Queuing (CBWFQ), and the committed information rate (CIR) bandwidth for any of the classes is less than 2 percent of the interface rate, the CBWFQ classes in the policy may not receive the configured CIR bandwidths.
There is no workaround, but it is unlikely that a CBWFQ class would be configured with such a low CIR bandwidth. (CSCsb98219)
•Although visible in the command-line help, the conform-action color class-map police configuration command is not supported. Entering the command has no affect.
There is no workaround. (CSCsk00594)
•When CPU protection is disabled, you can configure 64 policers per port on most switches. However, on Cisco ME 3400EG-12CS and Cisco ME 3400G-12CS switches, due to hardware limitations, you can attach 64 per-port, per-VLAN policers to a maximum of 6 ports. If you attempt to attach more than 6 per-port, per-VLAN 64-policer policy maps, the attachment fails.
There is no workaround. (CSCsv21416)
SPAN and RSPAN
•The egress SPAN data rate might degrade when multicast routing is enabled. The amount of degradation depends on the processor loading. Typically, the switch can egress SPAN at up to 40,000 packets per second (64-byte packets). As long as the total traffic being monitored is below this limit, there is no degradation. However, if the traffic being monitored exceeds the limit, only a portion of the source stream is spanned. When this occurs, the following console message appears:
Decreased egress SPAN rate. In all cases, normal traffic is not affected; the degradation limits only how much of the original source stream can be egress spanned. If multicast routing is disabled, egress SPAN is not degraded.
There is no workaround. If possible, disable multicast routing. If possible, use ingress SPAN to observe the same traffic. (CSCeb01216)
•Some IGMP report and query packets with IP options might not be ingress-spanned. Packets that are susceptible to this problem are IGMP packets containing 4 bytes of IP options (IP header length of 24). An example of such packets would be IGMP reports and queries having the router alert IP option. Ingress-spanning of such packets is not accurate and can vary with the traffic rate. Typically, very few or none of these packets are spanned. There is no workaround. (CSCeb23352)
•When system jumbo MTU size is configured on a switch and the egress ports can support jumbo frames, the egress SPAN jumbo frames are not forwarded to the SPAN destination ports.
There is no workaround. (CSCsj21718)
•Cisco Discovery Protocol (CDP) and Port Aggregation Protocol (PAgP) packets received by network node interfaces (NNIs) from a SPAN source are not sent to the destination interfaces of a local SPAN session.
The workaround is to use the monitor session session_number destination {interface interface-id encapsulation replicate} global configuration command for local SPAN. (CSCed24036)
•IP traffic with IP options set is sometimes leaked on a trunk port. For example, a trunk port is a member of an IP multicast group in VLAN X but is not a member in VLAN Y. If VLAN Y is the output interface for the multicast route entry assigned to the multicast group and an interface in VLAN Y belongs to the same multicast group, the IP-option traffic received on an input VLAN interface other than one in VLAN Y is sent on the trunk port in VLAN Y because the trunk port is forwarding in VLAN Y, even though the port has no group membership in VLAN Y. There is no workaround. (CSCdz42909).
•For trunk ports or access ports configured with IEEE 802.1Q tagging, inconsistent statistics might appear in the show interfaces counters privileged EXEC command output. Valid IEEE 802.1Q frames of 64 to 66 bytes are correctly forwarded even though the port LED blinks amber, and the frames are not counted on the interface statistics. There is no workaround. (CSCec35100).
•If the number of VLANs times the number of trunk ports exceeds the recommended limit of 13,000, the switch can fail.
The workaround is to not configure more than the recommended number of VLANs and trunks. (CSCeb31087)
•A CPUHOG message sometimes appears when you configure a private VLAN. Enable port security on one or more of the ports affected by the private VLAN configuration.
There is no workaround. (CSCed71422)
Open Caveats
When several per-port, per-VLAN parent policies are attached to the input of one or more interfaces and a child policy of these parent policies is modified, the parent policies are detached from the interfaces and reattached during the process. Because the modified policy is large, the TCAM entries are being used up, and the attached policies should be removed. However, some of the parent policies are not removed from the interface, and the TCAM entries are cleared. If you save the configuration and reload the switch, the policies are detached, but the TCAM is full, and you cannot attach other policies.
This error message appears:
QOSMGR-4-QOS_TCAM_RESOURCE_EXCEED_MAX: Exceeded a maximum of QoS TCAM resources
The workaround is to manually detach the policy maps from all the interfaces by entering the no service-policy input policy-map-name interface configuration command on each interface.
•CSCsv24288 (ME 3400E)
If you create a QoS configuration that uses more than the platform limit of 256 unique policer profiles (unique combinations of rates and actions), the policy map that caused the hardware resource exhaustion is rejected. Further attempts to attach new policies are also rejected. This occurs even if you modify the policy that caused the resource exhaustion to use less resources.
The workaround is to modify the existing policy maps to use less than 256 unique policer profiles and to reload the switch to free up the hardware resources.
•CSCsw77908 (ME 3400E)
When you configure an aggregate policer in a per-port per-VLAN service policy, the output of the show policy-map interface privileged EXEC command displays zeroes for the policer rate counters. This occurs only when the policer is an aggregate policer and the service policy is hierarchical.
There is no workaround.
•CSCsw91409 (ME 3400E)
On an ME 3400E-2CS or ME 3400E-12CS switch, a port-shaper configured for 500 K bits per second (Kb/s) on a 100 Mb/s link shapes at approximately 90 Kb/s. Port shapers at 1 Mb/s and higher function correctly. This occurs only on the 2CS and 12CS platforms when the link speed is 100 Mb/s and the configured shape rate is 500Kb/s.
The workaround is to configure the shaper for 1Mb/s or higher or to change the link speed to 10Mb/s.
When you enter the show mvr interface interface-id members privileged EXEC command to see status of an MVR port, an MVR member port that is not connected always shows as ACTIVE.
The workaround is to use the show mvr interface interface-id or the show mvr members privileged EXEC command. These command outputs show the correct status of an MVR port.
When you enter the mvr vlan vlan-id global configuration command to create an MVR VLAN and enable MVR on the switch by entering the mvr global configuration command, if you enter the show mvr interface interface-id members privileged EXEC command, the output shows the MVR groups on the interface. However, if you enable MVR first and then create the MVR VLAN, the MVR groups are not displayed correctly.
The workaround, if the groups are not displaying correctly, is to create the MVR VLAN before enabling MVR. The configuration then displays correctly.
•CSCsx18055 (ME 3400)
A Hardware resources are not available message appears under these conditions:
–VLANs are created in a group and assigned to the UNI-VLAN community.
–Those VLANs are deleted.
–You recreate those VLANs again and reassign them to the UNI-VLAN community again.
There is no workaround.
If an RSPAN interface is configured as an MVR source port (configured by entering the mvr type source interface configuration command), RSPAN receives captured data through the RSPAN VLAN, but does not send the packets to the RSPAN destination interface. The same limitation also applies to monitoring IGMP snooping groups or multicast routing groups.
The workaround is to disable MVR on all RSPAN uplink interfaces by entering the no mvr type interface configuration command and to not monitor traffic in an MVR group, an IGMP snooping group, or a multicast routing group.
Entering the udld enable global configuration command is supposed to enable UniDirectional Link Detection (UDLD) only on fiber ports. You enter the udld port interface configuration command to enable UDLD on other port types. However, when you enter the udld enable global configuration command, UDLD is enabled by default on dual-media ports, even if a copper link is connected to an RJ-45 socket.
The workaround is to manually disable UDLD on the port by entering the no udld port interface configuration command.
The switch unexpectedly reloads when copying a configuration file from a remote server or from flash memory containing logging file flash:
The workaround is to enter the logging file flash:filename global configuration command to configure logging to flash instead of copying to flash.
When a redirect URL is configured for a client on the authentication server and a large number of clients are authenticated, high CPU usage could occur on the switch.
There is no workaround.
Resolved Caveats
•Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE5
•Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE4
•Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE3
•Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE1
•Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE
Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE5
A vulnerability in the Internet Group Management Protocol (IGMP) version 3 implementation of Cisco IOS Software and Cisco IOS XE Software allows a remote unauthenticated attacker to cause a reload of an affected device. Repeated attempts to exploit this vulnerability could result in a sustained denial of service (DoS) condition. Cisco has released free software updates that address this vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20100922-igmp.shtml.
Note: The September 22, 2010, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. Five of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses vulnerabilities in Cisco Unified Communications Manager. Each advisory lists the releases that correct the vulnerability or vulnerabilities detailed in the advisory. The table at the following URL lists releases that correct all Cisco IOS Software vulnerabilities that have been published on September 22, 2010, or earlier:
Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link:
Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE4
Authentication, authorization, and accounting (AAA) fails, preventing authentication and requiring you to recover your password. For example, when you enter the aaa authentication login default group tacacs line global configuration command, AAA fails.
There is no workaround.
When you use an access control server (ACS) to enable command authorization, the ACS does not process a copy command ending with a colon (for example, scp:, ftp:, tftp:, flash:).
This problem affects authentication, authorization, and accounting (AAA) authorization:
–If the ACS denies a copy command ending with a colon, you can use that command on a switch.
–If the ACS permits a copy command ending with a colon, you cannot use that command on a switch.
To workaround is to either deny or permit the copy command without entering any arguments on the ACS.
After you enter the snmp mib rep trap-rate global configuration command on a switch that is configured for Resilient Ethernet Protocol (REP) and link-state tracking (LST) and you shut down or disconnect all LST upstream links, a memory allocation failure occurs.
There is no workaround.
The CISCO-RTTMON-MIB is not correctly implemented in this release.
There is no workaround.
If a switch is directly connected to another switch and both are running Cisco IOS IP Service Level Agreements (SLAs) to monitor jitter, a message about high jitter appears and then the problem is resolved automatically when the event does not occur:
036814: Feb 11 23:30:04: IP SLAs (10) jitter operation: seq=12, jitterIn=44
036820: Feb 11 23:30:05: IP SLAs (10) jitter operation: seq=13, jitterIn=-44
There is no workaround.
On a switch that is configured for quality of service (QoS), a memory leak occurs when a small portion (about 90 bytes) of the processor memory is not released by the HRPC QoS request handler process.
There is no workaround.
If you repeatedly enter the show tech-support privileged EXEC command, the switch might leak memory and, in some cases, shut down.
The workaround is to reload the switch to clear the memory after repeated use of the show tech-support command.
When flow control is enabled on a port-channel interface and you enter the flowcontrol receive on interface configuration command, the bundle is not enabled after the switch restarts. The command appears in the port-channel interface running configuration but does not appear in the switch running configuration. A message such as this appears:
%EC-5-CANNOT_BUNDLE2: Gi0/27 is not compatible with Po1 and will be suspended (flow control receive of Gi0/27 is on, Po1 is off)
%EC-5-CANNOT_BUNDLE2: Gi0/28 is not compatible with Po1 and will be suspended (flow control receive of Gi0/28 is on, Po1 is off)
Use one of these workarounds:
–To manually configure the port-channel interface, enter the flowcontrol receive on interface configuration command.
–To add the flow-control configuration to the interface after the switch restarts, use an EEM script similar to this:
event manager applet Add_flowcontrol_on_restart
event syslog pattern SYS-5-RESTART
action 1 cli command "en"
action 2 cli command "conf t"
action 3 cli command "inter port 1"
action 4 cli command "flowcontrol receive on"
For action 3, specify the port-channel interface.
In a VPN routing/forwarding (VRF) instance, a port channel is configured, and the default route is in the global routing table. If a link shuts down while the other links remain up, the port channel might not forward traffic.
Use one of these workarounds:
–Enter the shutdown interface configuration command, and then enter the no shutdown interface command.
–In the VRF instance, configure the links in the port channel as Layer 2 access links, and configure a switch virtual interface (SVI).
Packet loss and output drops occur on the egress interface for routed multicast traffic.
This problem occurs when multiple S,G entries time out at the same time and then are re-established at the same time, when multiple Protocol Independent Multicast (PIM) neighbors time out at the same time and then are re-established at the same time, or when multiple high-volume multicast streams are routed through multiple Layer-3 interfaces.
Use one of these workarounds:
–Enter the clear ip mroute * EXEC command.
–Enter the shutdown interface configuration command followed by the no shutdown interface configuration command on the egress interface.
The switch unexpectedly reloads when copying a configuration file from a remote server or from flash memory containing logging file flash:
The workaround is to enter the logging file flash:filename global configuration command to configure logging to flash instead of copying to flash.
When you have configured a login banner by entering the banner login c message c global configuration command and the switch reloads, the output of banner is missing a carriage return, making the format incorrect.
There is no workaround.
A switch can fail when an SNMP process attempts to configure dot1x authentication when it is already configured.
There is no workaround.
When you use IEEE 802.1x authentication with web authentication and an HTTP page opens, the switch redirects the user to an HTTP login page, not a HTTPS login page.
The workaround is to remove the custom banner.
Memory allocation failures occur on a Metro Ethernet switch that is configured for Resilient Ethernet Protocol (REP) and that has poor point-to-point physical link integrity with a neighboring REP node. These failures are caused by I/O memory fragmentation and can result in REP-4-LINKSTATUS error messages, REP control Protocol Data Unit (PDU) packet loss, or both.
The workaround is to ensure that the physical link with the neighboring REP node is good.
A switch enters a loop in which it continues to fail after it first has failed while starting, and then has failed again while attempting to recover. This failure loop occurs only after you have entered the archive upload-sw privileged EXEC command to write the configuration to a remote server using Secure Copy Protocol (SCP) and when the connection to the remote server is configured for spanning-tree PortFast.
The workaround is to not use SCP to write to the remote server. Use File Transfer Protocol (FTP) or Trivial File Transfer Protocol (TFTP).
A memory leak occurs when there is a stuck in active (SIA) state condition for an Enhanced Interior Gateway Routing Protocol (EIGRP) route.
There is no workaround.
A switch does not receive SNMP trap and inform messages from the correct interface after you have entered the snmp-server trap-source loopback0 and snmp-server source-interface informs loopback0 global configuration commands.
There is no workaround.
When the no mac address-table static mac-addr vlan vlan-id interface interface-id global configuration command is used to remove a dynamically learned MAC address, the switch fails under these conditions:
–The physical interface is in a no shut state.
–The MAC address is first dynamically learned and then changed to static.
There is no workaround.
When you have configured an output service policy, performing an SNMPWALK on cportQosStatistics causes loops.
A memory leak occurs on a device that uses Enhanced Interior Gateway Routing Protocol (EIGRP) when the external routes are being exchanged.
The workaround is to stabilize the network to minimize the impact of external route advertisement.
When you enter the dot1x pae interface configuration command on a switch access port and then enable an access list in the inbound direction on an ingress switched virtual interface (SVI), the access list does not work, allowing all packets to pass.
The workaround is to enable the access list in the outbound direction on the egress SVI.
When you enter the no spanning-tree etherchannel guard misconfig global configuration command, enter the write memory privileged EXEC command, and then restart the switch, the spanning-tree etherchannel guard misconfig global configuration command is saved instead of the no form of this command.
There is no workaround.
An IP phone loses network connectivity under these conditions:
–The IP phone is authenticated by MAB (in Open1x mode) on a supplicant switch.
–The supplicant switch is connected to an authenticator switch through the NEAT protocol.
A call is placed using the IP phone. After approximately 5 minutes, network connectivity to the phone is lost.
The workaround is to statically configure the MAC address of the IP phone on the authenticator switch.
After receiving an invalid Edge/End Port Advertisement (EPA), a switch that is configured for Resilient Ethernet Protocol (REP) fails because of a watchdog time-out.
Before the switch fails, it generates messages such as this:
SYS-3-CPUHOG: Task is running for (528552)msecs, more than (2000)msecs (66/0),process = REP BPA/EPA Proc.
There is no workaround.
After Resilient Ethernet Protocol (REP) has converged among several switches, multicast traffic is no longer flooded to one switch.
The workaround is to enter the set igmp querier privileged EXEC command.
After you have entered the snmp-server host informs global configuration command to enable SNMP informs on a switch, the switch might fail if you enter the show snmp pending user EXEC command.
There is no workaround. Do not enter the show command when SNMP informs are enabled.
A Remote Switched Port Analyzer (RSPAN) does not detect IPv6 multicast packets on an RSPAN destination port.
There is no workaround.
A switch fails when you enter the show ip ospf interface user EXEC command and then stop the command output at the this line:
Backup Designated router (ID) xx.x.x.x, Interface address xx.x.x.x
The failure occurs when the Backup Designated Router (BDR) neighbor of the switch is shut down while you press Enter or the spacebar to advance the command output.
When the switch fails, it sends this error message:
Unexpected exception to CPUvector 2000, PC = 261FC60
There is no workaround.
On a switch that is configured for IP routing and that is running Cisco IOS Release 12.2(50)SE or later, Cisco Express Forwarding (CEF) can use a large amount of memory. The IP RIB Update process uses about 2000 bytes for each prefix that CEF uses.
There is no workaround. You can reduce the memory use by reducing the number of routes the switch processes.
After you have entered the logging filter global configuration command on a switch to specify a syslog filter module to be used by the Embedded Syslog Manager (ESM), processes logging many system messages retain increasing amounts of processor memory.
The workaround is to enter the no logging filter global configuration command.
Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE3
Memory allocation errors no longer occur when the Cisco Express Forwarding (CEF) consistency checkers have been enabled. The CEF consistency checkers have been enabled by default. They can also be enabled by using these global configuration commands:
cef table consistency-check ipv4
cef table consistency-check ipv6
A switch no longer fails when you enter the configure replace privileged EXEC command, and a banner is already present in the switch configuration.
•CSCso90107 (ME 3400)
You can now query the bgpPeerTable MIB for VPN/VRF interfaces.
Cisco IOS Software contains a vulnerability that could allow an attacker to cause a Cisco IOS device to reload by remotely sending a crafted encryption packet. Cisco has released free software updates that address this vulnerability. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090923-tls.shtml.
•CSCsq51052 (ME 3400)
The output of the show ip ssh privileged EXEC command no longer displays SSH Enabled - version 2.99. Instead, a correct SSH version (1.5, 1.99 or 2.0) now appears.
Third-party IP phones now automatically power up when reconnected to enabled PoE ports on the switch.
Re-authentication now occurs on a port under these conditions:
–The port is in single-host mode.
–The port is configured with the authentication event no-response action authorize vlan vlan-number command.
–An EAPOL start packet is sent to the port.
Cisco devices running affected versions of Cisco IOS Software are vulnerable to a denial of service (DoS) attack if configured for IP tunnels and Cisco Express Forwarding.
Cisco has released free software updates that address this vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090923-tunnels.shtml.
A switch no longer fails and reloads when a specific queue is removed from a class:class-map match-any CMAP-BC-ALL-COSmatch cos 2match cos 1policy-map PMAP-ingress-g0/1class CMAP-BC-ALL-COSno queue-limit cos 1 200
Cisco IOS devices that are configured for Internet Key Exchange (IKE) protocol and certificate based authentication are vulnerable to a resource exhaustion attack. Successful exploitation of this vulnerability may result in the allocation of all available Phase 1 security associations (SA) and prevent the establishment of new IPsec sessions.
Cisco has released free software updates that address this vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090923-ipsec.shtml
Cisco IOS Software configured with Authentication Proxy for HTTP(S), Web Authentication or the consent feature, contains a vulnerability that may allow an unauthenticated session to bypass the authentication proxy server or bypass the consent webpage.
There are no workarounds that mitigate this vulnerability.
This advisory is posted at the following link:
The switch no longer fails when you use the vacant-message line configuration command.
Ping packets are no longer accepted on user network interfaces (UNIs) or enhanced network interfaces.
If a link failure occurs on a secondary edge port, preemption now occurs after the link comes up.
A switch no longer randomly resets due to memory corruption.
QoS scheduling policies assigned to ports that are members of a port-channel now work correctly. In previous releases, only the default "equal and fair" scheduling policy was applied to port-channel members, even though a configured QoS scheduling policy was assigned.
When open1x authentication and MAC authentication bypass are enabled on a port, an IP phone is connected to the port, and DHCP snooping is enabled on the switch, DHCP traffic is now forwarded on the voice VLAN before open 1x authentication times out and the switch uses MAC authentication bypass to authorize the port.
The switch no longer reloads when you enter several key strokes while in interface-range configuration mode.
If MAC authentication bypass is enabled and the RADIUS server is not available, the switch now tries to re-authenticate a port after a server becomes available.
•CSCsz43495 (ME3400E)
When a IEEE 802.1Q tunnel is set in a Resilient Ethernet Protocol (REP) ring, Address Resolution Protocol (ARP) broadcast loops no longer occur in the REP topology, and SW_MATM-4-MACFLAP_NOTIF messages no longer appear.
A memory leak no longer occurs when Cisco Network Assistant is polling the switch and the ip http server or ip http-secure-server global configuration command is enabled.
If you enable automatic server testing through the radius-server host ip-address [test username name] global configuration command, the switch no longer sends requests to the RADIUS server if the server is not available.
A switch configured with 802.1x and port security on the same ports no longer might inappropriately put the ports into an error-disabled state.
Moving a PC between two IP Phones without disconnecting either phone from the switch no longer triggers a port-security violation.
A port security violation error no longer occurs when MAC address sticky learning is enabled on a port and a CDP is enabled on a connected IP Phone.
Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE1
The switch now accepts an encrypted secret password.
When a TCP packet with all flags set to zero (at the TCP level) is sent to a remote router, the remote (destination) router no longer returns an ACK/RST packet back to the source of the TCP segment.
If the connection to a primary AAA server fails, the backup server is now queried for login access.
Cisco IOS Caveats Resolved in Cisco IOS Release 12.2(50)SE
Traceback messages no longer appear if you enter the no switchport interface configuration command to change a Layer 2 interface that belongs to a port channel to a routed port.
If you enter the no ip vrf vrf-name global configuration command to delete a VPN routing/forwarding instance on the switch when routing is not enabled on the switch, the VRF instance is no longer held in the delete queue and using one of the system's maximum allowable VRFs.
The server no longer attempts re-authentication every ten minutes when a switch is configured with the dot1x timeout reauth-period server interface configuration command.
Traffic is now forwarded to the interfaces that are configured with static multicast MAC addresses after the switch is reloaded.
Note You cannot configure the static MAC address (unicast or multicast) entries on EtherChannel member interfaces, or add an interface into the EtherChannel if that interface is associated with a static MAC address entry.
If the switch uses 802.1x authentication with VLAN assignment, it no longer uses the VLAN assignment with different authorization attempts, such as user authentication or re-authentication.
A switch no longer intermittently fails and displays an error message when the uni-vlan community configuration is in the switch running configuration.
When keepalive is disabled on an interface, the interface is no longer put in an error-disabled state when it receives keepalive packets.
The Switched Port Analyzer (SPAN) destination port no longer detects IPv6 multicast packets from a VLAN that is not being monitored by SPAN.
This message no longer appears in the log during the system bootup on a switch that is running
Cisco IOS 12.2(50)SE:%COMMON_FIB-3-FIBIDBINCONS2
The switch no longer reloads when the Forwarding Information Base (FIB) adjacency table is added.
Multiple Cisco products are affected by denial of service (DoS) vulnerabilities that manipulate the state of Transmission Control Protocol (TCP) connections. By manipulating the state of a TCP connection, an attacker could force the TCP connection to remain in a long-lived state, possibly indefinitely. If enough TCP connections are forced into a long-lived or indefinite state, resources on a system under attack may be consumed, preventing new TCP connections from being accepted. In some cases, a system reboot may be necessary to recover normal system operation. To exploit these vulnerabilities, an attacker must be able to complete a TCP three-way handshake with a vulnerable system.
In addition to these vulnerabilities, Cisco Nexus 5000 devices contain a TCP DoS vulnerability that may result in a system crash. This additional vulnerability was found as a result of testing the TCP state manipulation vulnerabilities.
Cisco has released free software updates for download from the Cisco website that address these vulnerabilities. Workarounds that mitigate these vulnerabilities are available.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090908-tcp24.shtml.
A switch port configured for IGMP snooping no longer lose its group membership when the port receives a query comes from an upstream device that is not configured for IGMP snooping.
The switch no longer fails after you configure a multicast VLAN registration (MVR) group.
A switch configured with class-based policies that are applied and active on at least one interface no longer might reload or display CPU hog messages during SNMP polling for the ciscoCBQosMIB.
When a switch virtual interface (SVI) is configured as unnumbered and is pointing to a loopback interface, the switch no longer fails when the SVI receives a packet.
Switch ports no longer attempt authentication at the interval configured for the port security timer instead of the configured IEEE 802.1x timer.
•CSCsx12513 (ME-3400G-12C only)
Traffic subject to quality of service (QOS) configuration is now handled as expected.
Documentation Updates
•Update to the Software Configuration Guide
•Update to the ME 3400 Hardware Installation Guide
•Updates to the System Message Guide
•Updates to the ME 3400E Regulatory Compliance and Safety Information Guide and the Getting Started Guide
Update to the Software Configuration Guide
Although documented in the software configuration guide, HTTP(S) over IPv6 is not supported in this release.
Although documented in the software configuration guide, VRF-Aware services for Unicast Reverse Path Forwarding (uRPF) is not supported.
Update to the ME 3400 Hardware Installation Guide
This is an installation update to the Cisco ME3400 Hardware Installation Guide.
Cisco Ethernet Switches are equipped with cooling mechanisms, such as fans and blowers. However, these fans and blowers can draw dust and other particles, causing contaminant buildup inside the chassis, which can result in a system malfunction.
You must install this equipment in an environment as free as possible from dust and foreign conductive material (such as metal flakes from construction activities).
These standard provide guidelines for acceptable working environments and acceptable levels of suspended particulate matter:
•Network Equipment Building Systems (NEBS) GR-63-CORE
•National Electrical Manufacturers Association (NEMA) Type 1
•International Electrotechnical Commission (IEC) IP-20
Updates to the System Message Guide
These messages were added but are not yet in the system message guide:Error Message ACLMGR-2-NOVMR: Cannot generate hardware representation of access list [chars]
Explanation There are insufficient resources available to create a hardware representation of the ACL. A lack of available logical operation units or specialized hardware resources can cause this problem. Logical operation units are needed for a TCP flag match or a test other than eq (ne, gt, lt, or range) on TCP, UDP, or SCTP port numbers.
Recommended Action Modify the ACL configuration to use fewer resources, or rename the ACL with a name or number that alphanumerically precedes the other ACL names or numbers.Error Message %SPANTREE_VLAN_SHIM-3-ADD_REGISTRY_FAILED: Subsystem [chars] fails to add callback function [chars]
Explanation A subsystem has added its callback functions. Use this message only for debugging. The first [chars] is the subsystem name, and the second [chars] is the function name.
Recommended Action No action is required.Error Message %SPANTREE_VLAN_SHIM-2-MAX_INSTANCE: Platform limit of [dec] STP instances exceeded. No instance created for [chars] (port [chars]).
Explanation The number of VLAN spanning-tree instances has reached the allowable maximum. No more VLAN instances are created until instances are less than the maximum. [dec] is the maximum, the first [chars] is the VLAN for which an STP instance is not created, and the second [chars] is the port number.
For example, when you are configuring spanning tree and the allowable maximum is 128 instances
–If the switch has already created 128 instances and you enter the vlan 200-1000 global interface configuration command, the first [chars] is 200, and an STP instance for VLAN 200 is not created.
–If the switch has already created 100 instances and you enter the vlan 200-1000 global interface configuration command, the first [chars] is 228. The switch creates STP instances for VLAN 200 to VLAN 227, but not for VLAN 228. 200 is not created.
STP instances are also not created for the remainder of the VLANs in the range
Recommended Action Reduce the number of active spanning-tree instances by either disabling some or deleting the VLANs associated with them. To create STP instances, manually create them. If you do not, the switch automatically creates an STP instances when a VLAN is created.
For example, if the switch has already created 128 instances and you want to create an STP instance for VLAN 200, remove a spanning-tree instance with one of these commands:
–To delete one of the VLANs with an STP instance, enter the no vlan vlan-id global configuration command.
–To disable spanning tree on a per-VLAN basis. enter the no spanning-tree vlan-id global configuration command.
Then enter the spanning-tree 200 global configuration command to create an instance for VLAN 200.
These messages were deleted:Error Message ACLMGR-2-NOVMR: Cannot create VMR data structures for access list [chars].Error Message DOT1X-5-INVALID_INPUT: Dot1x Interface parameter is Invalid on interface [chars].Error Message DOT1X-5-SECURITY_VIOLATION: Security violation on interface [chars], New MAC address [enet] is seen.Error Message DOT1X_SWITCH-5-ERR_VLAN_NOT_FOUND: Attempt to assign non-existent or shutdown VLAN [dec] to 802.1x port [chars]Error Message DOT1X_SWITCH-5-ERR_VLAN_ROUTED_PORT: Attempt to assign VLAN [dec] to routed 802.1x port [chars]Error Message UDLD-3-UDLD_IDB_ERROR: UDLD error handling [chars] interface [chars].Error Message UDLD-3-UDLD_INTERNAL_ERROR: UDLD internal error [chars].Error Message UDLD-3-UDLD_INTERNAL_IF_ERROR: UDLD internal error, interface [chars] [chars].Error Message UDLD-4-UDLD_PORT_DISABLED: UDLD disabled interface [chars], [chars] detected.Error Message UDLD-6-UDLD_PORT_RESET: UDLD reset interface [chars].Error Message UFAST_MCAST_SW-3-PROC_START_ERROR: No process available for transmitting UplinkFast packets.Error Message UFAST_MCAST_SW-4-MEM_NOT_AVAILABLE: No memory is available for transmitting UplinkFast packets on Vlan [dec].Error Message VQPCLIENT-2-CHUNKFAIL: Could not allocate memory for VQP.Error Message VQPCLIENT-2-DENY: Host [enet] denied on interface [chars].Error Message VQPCLIENT-3-IFNAME: Invalid interface ([chars]) in response.
Updates to the ME 3400E Regulatory Compliance and Safety Information Guide and the Getting Started Guide
These warnings were incorrectly documented in the guides. These are the correct warnings:
All Switches
Warning This product relies on the building's installation for short-circuit (overcurrent) protection. Ensure that the protective device is rated not greater than:
10 A Statement 1005
Cisco ME 3400EG-2CS-A
Warning To prevent the system from overheating, do not operate it in an area that exceeds the maximum recommended ambient temperature of:
140°F (60°C) Statement 1047
Cisco ME 3400E-24TS-M and Cisco ME 3400EG-12CS-M
Warning To prevent the system from overheating, do not operate it in an area that exceeds the maximum recommended ambient temperature of:
149°F (65°C) Statement 1047
Related Documentation
These documents provide complete information about the switch and are available from this Cisco.com site:
These are combined documents for the switches:
•Cisco ME 3400E, ME 3400, and ME 2400 Ethernet Access Switches System Message Guide
These documents are available for the Cisco ME 3400E switch:
•Release Notes for the Cisco ME 3400E Ethernet Access Switch
•Cisco ME 3400E Ethernet Access Switch Software Configuration Guide
•Cisco ME 3400E Ethernet Access Switch Command Reference
•Cisco ME 3400E Ethernet Access Switch Hardware Installation Guide
•Cisco ME 3400E Ethernet Access Switch Getting Started Guide
•Regulatory Compliance and Safety Information for the Cisco ME 3400E Ethernet Access Switch
These documents are available for the Cisco ME 3400 switch:
•Cisco ME 3400 Ethernet Access Switch Software Configuration Guide
•Cisco ME 3400 Ethernet Access Switch Command Reference
•Cisco ME 3400 and ME 2400 Ethernet Access Switch System Message Guide
•Cisco ME 3400 Ethernet Access Switch Hardware Installation Guide
•Cisco ME 3400 and ME 2400 Ethernet Access Switches Getting Started Guide
•Regulatory Compliance and Safety Information for the Cisco ME 3400 and ME 2400 Ethernet Access Switches
•Configuration Notes for the Cisco ME 3400G-12CS Ethernet Access Switch
•Information about Cisco SFP, SFP+, and GBIC modules is available from this Cisco.com site:
SFP compatibility matrix documents are available from this Cisco.com site:
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
© 2009 Cisco Systems, Inc. All rights reserved.


text:
Here is a list of data that I have compiled which I providing freely. I ask that any updates are sent back to me for the benefit of everyone else. Please remember that you are downloading this data freely in respect of the time I have taken to put it together – its not your time, so please don't represent that this data is yours or that you compiled it.
You clearly haven't it found it anywhere else on the web, so do the right thing and send me updates – this way everyone benefits. Please pay attention to the license – your use of this data is at its peril. No other data exists like this on the web, so its pretty easy to find out if data pops up identical too it. Otherwise – enjoy ;)
Oslon-to-Windows Data
Publised under an ISC Licence. More details on this post.
Olson-to-Windows.xlsx – Here (73KB)
Olson-to-Windows.xls – Here (192KB)
World Countries and States List
I have had emails regarding questions of Commerical Use – please read the Creative Commons Attribution-Non-Commercial-Share Alike 2.5 Australia License. Note this provision – "Any of the above conditions can be waived if you get permission from the copyright holder." If you feel you need my data for commerical purposes, Contact Me with the reasons why you need it and I can expressly waive this permission if I deem it appropriate. Includes 202 Countries and total Unique States of 3697.
- ISO Alpha-2
- ISO Alpha-3
- ISO 3166 Country Name
- Individual Country States
ISO-Country-List.xlsx – Here (125KB)
ISO-Country-List.xls – Here (423KB)
Data by Tim Davis is licensed under a Creative Commons Attribution-Non-Commercial-Share Alike 2.5 Australia License. Based on a work at www.timdavis.com.au. Permissions beyond the scope of this license may be available at http://www.timdavis.com.au.

subset: commoncrawl


text:
A Lakeville man died just days before his birthday, after an Aug. 10 motorcycle accident on Highway 50 and Holt Avenue.
Dustin Rahier, 38, was in eastbound traffic popping wheelies on a Kawasaki motorcycle when vehicles in front of him slowed down, causing him to brake hard and roll, according to the Minnesota State Patrol.
The State Patrol reported Rahier suffered a serious injury in the crash, and a White Funeral Home obituary reported he died that day.
Rahier was taking part in the Northfield Historical Society's sixth annual Outlaw Run fundraiser at the time of the accident.
The event starts with a reenactment of attempted bank robbery in Northfield committed by gangs led by Jesse and Frank James and the Younger brothers on Sept. 7, 1876.
Townspeople fired back, and the robbery ended with two gang members and two townspeople dead; the Younger brothers were eventually captured, but the James brothers escaped.
Outlaw Run motorcyclists explore southern Minnesota as the gangs did before the attempted robbery.
Northfield Historical Society Executive Director Hayes Scriven said the accident happened just as the group of about 230 motorcyclists were leaving a New Trier restaurant, the group's first stop on the trip.
Scriven said he was in the chase vehicle, which follows the riders and contains a first aid kit and cell phone for emergencies; the group also included nurses and emergency medical technicians.
He said an emergency medical technician witnessed the crash and was at Rahier's side within a minute of the accident.
Rahier was awake but lost consciousness at the scene, Scriven said.
Historical Society members are devastated by the loss, and Scriven said they will be meeting to determine whether to continue holding the fundraiser or if to make changes to it.
Two minor accidents have happened to riders participating in the event in the past: one rider lost the sole of his shoe when his motorcycle slipped on loose gravel and another rider broke an ankle in a spill.
"I'm still trying to comprehend this," Scriven said, fighting tears. "This is something that's going to live with me for the rest of my life. "It's the saddest thing I've ever been around."
A celebration of Rahier's life starts at 5 p.m. Wednesday, Aug. 14 at White Funeral Home, 20134 Kenwood Trail in Lakeville.


text:
Hey there, time traveller!
This article was published 25/6/2014 (1153 days ago), so information in it may no longer be current.
Winnipeg no longer has a Redwood Bridge.
On Wednesday afternoon, city council voted unanimously to change the name of the 106-year-old bridge connecting Elmwood to the North End after former Mynarski Coun. Harry Lazarenko.
Lazarenko served council for two stints spanning 30 years. He served from 1974 to 1977 and then 1983 to 2010. He suffered a brain aneurysm in May 2010 and did not return to council.
His successor in Mynarksi, Coun. Ross Eadie, tried to rename Machray Park after Lazarenko, but was rebuffed by a coalition of community groups.
Mayor Sam Katz seconded Eadie's motion.
Redwood Bridge, built in 1908, appears to be named after Alfred Boyd, who owned a red-roofed store near the bridge, or another store owner.
It is Winnipeg's oldest bridge.


text:
Pale Fire
Hardcover, 315 pages, Random House Inc, List Price: $23 |purchase
Buy Featured Book
Your purchase helps support NPR programming. How?
Book Summary
Nabokov's parody, half poem and half commentary on the poem, deals with the escapades of the deposed king of Zemala in a New England college town.


text:
PHOTO: Hugh Jackman Visits HEDWIG's Neil Patrick Harris & Lena Hall
Tony hosts unite! Star of stage and screen Hugh Jackman took in the hit musical Hedwig and the Angry Inch yesterday and dropped by backstage following the performance to visit the show's stars (and Tony nominees!), Neil Patrick Harris and Lena Hall.
Jackman shared a photo of the visit on Instagram along with the caption: "The amazing @ActuallyNPH and Lena Hall. Do NOT miss this show!! Awesome.. electric atmosphere."
Can these two entertainment giants be cooking up a number for this year's live Tony telecast on CBS? Tune in on June 8th to find out!
Neil Patrick Harris' returns to Broadway in the new production of Hedwig and the Angry Inch, the musical with book by John Cameron Mitchell and music and lyrics by Stephen Trask, directed by Michael Mayer. The limited engagement, featuring Lena Hall(Kinky Boots, lead singer of The Deafening), opened Tuesday, April 22 at the Belasco Theatre (111 West 44th Street).
HEDWIG AND THE ANGRY INCH was originally produced by David Binder off off Broadway at Westbeth and then, under the direction of Peter Askin, ran over two years at the Jane Street Theatre beginning in February 1998. The musical won the Outer Critics Circle Award for Best Off-Broadway Musical and both John Cameron MitchellandStephen Trask won Obies in 2001. It won a 1998 New York Magazine Award and Entertainment Weekly's "Soundtrack of the Year" Award. Time Magazine named HEDWIG the Top Musical of 1998.
The film of Hedwig and the Angry Inch, directed by John Cameron Mitchell, won the Audience Award and Best Director Awards at Sundance. Mitchell won the Best New Director from the National Board of Review, the Gotham Awards, and the LA Critics Society. Stage productions have played for many years in Japan and in 2008, Korea hosted a popular televised Reality Show about the search for a new star to play Hedwig.
Photo source: Instagram


text:
Humility and Irony in Worship
So, as many of you may know, I lead worship at a young church in Chandler, AZ.
And yesterday was a great morning of worship, of telling the story of God and proclaiming who he is and what he's done and what he will do.
However, there was one of those moments yesterday that I shall call a "keepin' it real" moment."
It came right after we sang a great song called "Open Skies" by David Crowder. The song ended, and I began to briefly talk about "humility" in worship. I mentioned that passage from James 4 where James quotes Proverbs 3:34, "God opposes the proud but gives grace to the humble." And I encouraged our people to remember to come to God, in worship, with humble hearts and grateful souls. Thankful and aware that our Great King's love flows lavishly on us messed up and wicked people. With humility we understand that God's grace is given to us not because we deserve it, but because He is good.
And so, with these wonderful thoughts about humility and worship, I then proceed to begin the opening lyrics of the next song, "Your Love is Deep" by Jami Smith. However, it should be noted, I made the decision to lower the key of the song from 'D' to 'C' back in rehearsal on Thursday. I tell you this, because once I learn a song in a certain key, that key gets locked in to my brain, and sometimes it's difficult for me to convince my brain and mouth to sing in a different key. So, although my guitar is plucking away nicely in 'C', my starting notes on Sunday, in this moment, were far from where they needed to be. And then, quickly I tried to adjust and drop to the right note, but I dropped too far and missed it again. It took me a good 3 or 4 starts and stutters on the lyric, "your love is deep…" before finally I locked in to the right key. A rather embarrassing moment, if I do say so.
But here's what I love:
a) the irony of having just talked about humility in worship, and then completely butchering the opening of the song.
b) the fact that this wasn't the first time, and probably nor will it be the last time, but the people of our church love and appreciate me anyways.
c) in reality, this is a defining characteristic of the culture of our church.
Let me expound on the last point a little.
One value of mine in leading worship is that, while I take "WHAT I DO" very seriously, I don't take "MYSELF" too seriously. The minute I take myself too seriously, I begin to think more highly of myself than I ought. I begin to inflate my sense of importance. I begin to put expectations on myself and others that are unfair or unrealistic. I begin to lose sight of what it means to lead people into hearts of worship. And so, I cherish these moments where not only I, but our whole church, is reminded that I'm human and real. And these moments are welcomed here at our church. Moments where we all sorta realize, "yeah, this isn't a show… this isn't a performance or a concert… this is a bunch of real people just coming together for the sake of bringing glory to the name of our Great King, and mess-ups are just gonna happen." Things like mics not coming on right away, or transitions being botched, or cues being missed, etc… all help, in small ways, to create a culture of authenticity. Now, granted, if these things happen ALL the TIME, that'd be a different story… then we're into the realm of distractions and barriers. But I don't think we're there… No, I LIKE where we're at as a culture of worshipers.
And so, if you come to our church, I say "thank you" for your grace towards your leaders, and for allowing us to be real and authentic and human. And thank you for helping us create a culture of not taking ourselves too seriously, but understanding that we're all in this thing together.
Oh,and thank you Lord for the irony of speaking about humility and following it up with a moment of humility. Gotta love it.
3 Responses to "Humility and Irony in Worship"
Brian Morgan
Cool, this is why I like The Grove..
We wouldn't go to The Grove if it were ran by "perfect" people. We love every aspect of the church and most especially the worship team. Sounds pretty perfect to us though, but I am not sure I know the difference between a c note and a z note… :)
Would not understand one part of the musical note thing but am so sad I missed Open Skies, my favorite worship song. Now I know it won't be on the list for awhile. :( Oh by the way did you know I read all your blogs? I have heaven now, sweeter heaven when I die and even better than that heaven when God makes everything right. Happy, simple girl!


text:
SEFFNER — A 16-year-old Armwood High School student said three men in a minivan tried to abduct her at a school bus stop early Wednesday, Hillsborough deputies said.
Deputies said the girl said one of the men tried to pull her by the arm into a silver minivan at Highway 92 and Anna Drive about 7 a.m.
The student broke free and ran, deputies said. There were no witnesses, deputies said.
The girl described the driver of the minivan as Hispanic, in his mid 30s, with short, uneven brown hair, brown eyes and a goatee. He had two silver square earrings in his right ear and wore baby-blue loose-fitting pants and a white T-shirt.
She described the second suspect as Hispanic, in his mid 30s, with long, brown curly shoulder-length hair. He wore red, tight designer pants.
She said the third man was Hispanic, tall, with no hair.
The minivan, possibly a Dodge Caravan, had damage on the passenger side rear near the wheel well, scratches on the passenger sliding door and beads hanging from the rearview mirror.
The suspects fled west on Highway 92.
Deputies ask anyone with information about the case to call the them at (813) 247-8200 or Crime Stoppers at 1-800-873-8477.
Follow This Just In on Twitter.


text:
You read the title correctly.
"Put your money where your mouth is" the new music video featuring the Donald saying "wise" words and clips of the Apprentice contestants.
(at the bottom of the page)
There are also musical clips from the songs "You're f,f,f, Fired" and "Put Your Money Where Your Mouth Is" and you can rate them, afterward.


text:
Three-Time Grammy Winner
Kelly Clarkson has released 6 studio albums (Thankful, Breakaway, My December, All I Ever Wanted, Stronger), 1 Greatest Hits album, sold over 20 million albums worldwide. In the UK, Clarkson has sold over 2 million albums and has had 4 top 5 albums and 8 singles in the top 10. She is the recipient of 3 Grammy Awards, 4 American Music Awards, 3 MTV Video Music Awards, 2 Academy of Country Music Awards, 1 CMA Award and 12 Billboard Music Awards. Clarkson's last studio effort Stronger was certified platinum, won the Grammy for Best Pop Vocal Album and produced the smash singles, "Mr. Know It All" and "Stronger (What Doesn't Kill You)". Kelly spent the summer touring with Maroon 5 and recording her very first Christmas album Wrapped In Red, which was released on October 29th and features 5 original tracks as well as some Christmas favourites.


text:
Sep 18, 2012 - From staff reportsOfficials cited Gentry Blackburn, 19, of Riverton, for driving under the influence and driving without a license at about 9:20 a.m. Saturday after he reportedly drove a 1990 Chevrolet Blazer off the street near the intersection of Smith Road and East Park Avenue.
According to reports, the vehicle traveled 200 yards off Smith Road and struck a nearby tree head-on.
Blackburn then reportedly fled the scene, but he was apprehended walking along Smith Road about three-quarters of a mile away.
Deputies said Blackburn had just purchased a can of air duster. He reportedly told deputies that he had "huffed" the duster while driving down Smith Road, which caused him to pass out behind the wheel, drive off the roadway, and crash into the tree.
Damages from the collision were estimated at more than $1,000.
Blackburn was taken to the Riverton Memorial Hospital for unknown injuries.
Get your copy of The Ranger online, every day! If you are a current print subscriber and want to also access dailyranger.com online (there is nothing more to purchase) including being able to download The Mining and Energy Edition, click here. Looking to start a new online subscription to dailyranger.com (even if it is for just one day)? Access our secure SSL encrypted server and start your subscription now by clicking here.


text:
SHN Adds BUYER & CELLAR, CHICAGO and I LOVE LUCY LIVE ON STAGE to 2014 Season
SHN has announced the addition of three special engagements coming to the SHN Orpheum and Curran Theatres: BUYER & CELLAR starring Michael Urie from TV's "Ugly Betty"; CHICAGO starring John O'Hurley from TV's "Dancing With the Stars"; and the brand new hit stage show I LOVE LUCY LIVE ON STAGE adapted from the most beloved program in television history.
Starring Michael Urie, of TV's "Ugly Betty"
SHN Curran Theatre
August 19, 2014 - August 31, 2014
MICHAEL URIE, star of TV's "Ugly Betty" and Broadway's HOW TO SUCCEED IN BUSINESS WITHOUT REALLY TRYING, brings his Drama Desk and Clarence Derwent Award winning performance as Alex More to San Francisco in the critically acclaimed smash hit comedy BUYER & CELLAR.
Alex is a struggling actor in L.A. who takes a job working in the mall in Barbra Streisand's Malibu basement. One day, the Lady Herself comes downstairs to play. It feels like real bonding in the basement, but will their relationship ever make it upstairs?
Written by Jonathan Tolins and directed by Stephen Brackett, BUYER & CELLAR is an outrageous comedy about the price of fame, the cost of things, and the oddest of odd jobs. BUYER & CELLAR swept the Best of 2013 Theater lists including The New York Times, Associated Press, The Hollywood Reporter, New York Post, NPR, The Huffington Post, The Advocate, The Daily Beast, Entertainment Weekly, NBC New York, and Time Out New York. The New York Times' Charles Isherwood raves Urie gives "a tour-de-force performance," with Ben Brantley adding "I tell you to GO."
For more information please visit: www.shnsf.com/online/buyer
Starring John O'Hurley, of TV's "Dancing With the Stars"
SHN Orpheum Theatre
November 7, 2014 - November 16, 2014
A true New York City institution, CHICAGO has everything that makes Broadway great: a universal tale of fame, fortune and all that jazz; one show-stopping-song after another; and the most astonishing dancing you've ever seen.
No wonder CHICAGO has been honored with 6 Tony Awards, 2 Olivier Awards, a Grammy and thousands of standing ovations.
It's also no surprise that CHICAGO has wowed audiences all around the world, from Mexico City to Moscow, from Sao Paulo to South Africa.
Whether you're looking for your first Broadway musical, whether you've seen the Academy Award-winning film and want to experience the show live on stage or whether you've seen it before and want to recapture the magic, CHICAGO always delivers.
"'CHICAGO' still GLITTERS HYPNOTICALLY."- Ben Brantley, The New York Times
For more information please visit: www.shnsf.com/online/chicago
SHN Curran Theatre
November 11, 2014 - November 23, 2014
I LOVE LUCY LIVE ON STAGE is the brand-new hit stage show adapted from the most beloved program in television history! America's favorite foursome - Lucy, Ricky, Fred and Ethel - is live on stage and in color for the very first time!
It's 1952 and you are a member of the studio audience awaiting the filming of two hilarious and oh-so-familiar I LOVE LUCY episodes. Imagine stepping back in time onto the Desilu Playhouse soundstage where a charming host entertains and enlightens you to the behind-the-scenes filming process, the 1950s hi-fidelity technology and this brand-new thing called "television." The episodes begin and you witness, firsthand, the side-splitting antics of that crazy redhead in the Ricardo's New York apartment and thrill to the Cuban sounds of "The Ricky Ricardo Orchestra" at the famed Tropicana Nightclub. In between scenes? The Crystaltone Singers perform live advertising jingles of the show's newest sponsors in perfect 50s style harmony. Can you say "Brylcreem?!"
L.A. Examiner's Ron Irwin says I LOVE LUCY LIVE ON STAGE is "an absolutely brilliant and utterly engaging tribute to that iconic television show!" TV Guide's William Keck calls it, "the most entertaining stage production I've seen in years - including Broadway!"
The truth is in the title - whether young or old, everybody really does LOVE LUCY!
For more information please visit: www.shnsf.com/online/lucy
Tickets are available now for current SHN members by calling SHN Audience Services at 888-746-1799 (Press 2), or through their SHN ACCOUNT at shnsf.com. Group tickets are available beginning Monday, May 12. Tickets go on sale to the general public on Friday, May 16 at 10am, through shnsf.com and 888-746-1799.
Photo Credit: Sandra Coudert


text: 32. Subs. by the Constitution (Forty-second Amendment) Act, 1976, s. 4, for "the principles specified in clause (b) or clause (c) of article 39" (w.e.f. 3-1-1977). Section 4 has been declared invalid by the Supreme Court in Minerva Mills Ltd. and Others Vs. Union of India and Others (1980) 2. S.C.C. 591.


text:
We've been having some seriously hot days on campus lately, which does not help with the stress everyone is carrying around during exam week. This Fashionista wore a look that was simple and open. This might explain why she had such a positive attitude during one of the most stressful weeks of the semester.
Name: Sarah Garza
Major: Physics
Year: Sophomore
CollegeFashionista: So how would you describe your style?
Sarah Garza: In one word; eclectic.
CF: Do you check out any blogs or magazines for trend updates?
SG: My mom will occasionally bring home magazines like Vogue or L Magazine. I like to check those out, but I mainly go to Pinterest to look for what's new.
CF: How are you transitioning your style from winter to spring?
SG: Well, I'm really digging the crop top look because it's already getting particularly hot. Sandals have been a big go-to for me, too. I don't normally wear a lot of sandals but this summer, leather sandals have caught my interest. I like the leather sandals that are similar to gladiator sandals but with more of a medieval look.
How to: This look should be easy to throw together for you Fashionistas. Start by picking out your favorite crop top. The crop top shouldn't be too hard to match since this look is so simple. Cuff a pair of boyfriend jeans to mimic your crop top for the bottom half of the outfit. I've been seeing a lot of Fashionistas cuffing their loose-fit jeans and it looks stunning. This Fashionista chose flats to wear with her look, which emphasized the strong hemlines at the bottom of her crop top and jeans. Both flats and booties are the better option for this style. It's a very contemporary look that really complements slim Fashionistas and adds character to your silhouette.


text:
Hot Crab Cream Cheese Dip Recipe
This dip is perfectly elegant for special occasions. Eight ounces imitation crab can be substituted for the canned crab.—Karen Buchholz, Sitka, Alaska
- 2 cans (6 ounces each) lump crabmeat, drained
- 2 packages (8 ounces each) cream cheese, softened
- 1/2 small onion, finely chopped
- 1 tablespoon prepared horseradish
- 2 dashes Worcestershire sauce
- 1/2 teaspoon salt
- 1/4 teaspoon pepper
- 1/3 cup slivered almonds
- Assorted crackers
- 1. In a large bowl, combine the first seven ingredients. Spread in a 1-qt. baking dish. Sprinkle with almonds. Bake at 350° for 10-15 minutes or until mixture bubbles. Serve with crackers. Yield: 6-8 servings.
Nutritional Facts
2 tablespoons: 149 calories, 12g fat (6g saturated fat), 50mg cholesterol, 309mg sodium, 2g carbohydrate (1g sugars, 1g fiber), 8g protein.
Reviews for Hot Crab Cream Cheese Dip
Average Rating
Reviewed Dec. 27, 2010
"I took it to a party and everyone raved about it. I did haven't almonds so I used pecan pieces."
© 2017 RDA Enthusiast Brands, LLC


text:
SatanÂ's Whore, Victoria Woodhull Closes at Theater for the New City 4/8
Theater for the New City (Crystal Field, Executive Director) presents Satan's Whore, Victoria Woodhull, written by Richard Geha, through April 8, 2012. Lissa Moira directs this post-Civil War, period drama about the sexual liberationist Victoria Woodhull. Don Garverick choreographs, with set design by David "Zen" Mansley & lighting design by William Giraldo.
Satan's Whore follows the life of Victoria Woodhull as she journeys from sexually abused child, to the most infamous, celebrated, intellectual beauty of 19th Century New York City. Feminist suffragette & renowned spiritualist, Woodhull was the first female presidential candidate, with Frederick Douglass as her running mate. She was also the first female newspaper publisher & Wall Street broker, but was best known as a fearless free-love advocate & practitioner. Woodhull was a woman so far ahead of her time, that time has yet to catch up.
Richard Geha (Playwright) is a clinical psychologist & a psychoanalyst in private practice. He holds an MA in literature & an MA & a PhD in psychology. As a university professor, he has taught undergraduate, graduate & post-graduate courses, as well as instructing at psychoanalytic institutes & several of his papers on psychoanalysis & literature have appeared in professional journals. He has published two collections of short stories: Primal Scenes: Stories of Radical Witness & As Marilyn Lay Dying: Stories of the Primal Scene. One of the main themes of his professional papers, short stories & plays addresses the extent to which we live in fictional worlds, worlds invented by the mind. Along with his wife, Lisa, he also breeds & raises Egyptian Arabian horses.
Lissa Moira (Director/Dramaturg) is also a well-known playwright (Before God Was Invented, Time It Is) & the co-writer of Dead Canaries, a feature film starring Charles Durning, Dan Luria, Dee Wallace-Stone & Joel Higgins. Her latest directorial success, Siren's Heart: Marilyn in Purgatory, by Walt Stepp, will open Off-Broadway in April. Look for Lissa & Richard West's DaDa noir musical comedy, Who Murdered Love? this summer.
Closes Saturday, April 8 at 8pm at Theater for the New City ~ 155 First Ave.
PRICE: $12/$10 Students & Seniors
RESERVATIONS: smarttix.com (212)868-4444


text:
A DANGEROUS 20-year-old Kates Hill man fascinated by extreme violence and serial killings has been given an indeterminate prison sentence after he savagely stabbed two men with a kitchen knife – leaving one, a popular Dudley musician (pictured), fighting for his life.
Cannabis dealer Sean Davies was found to have designs for "grotesque" weapons, information on bomb making and material on cannibalism in his flat after he inflicted horrific injuries on his two victims – Faid Saleh and Jack Turley, a member of Black Country punk rock band The Fight.
At Wolverhampton Crown Court, Judge John Warner ruled Davies was dangerous and would have to spend a minimum of seven years behind bars but stressed he would only be released when the authorities felt he was safe.
He would also remain on licence for a further ten years after his release.
The court was told Faid Saleh went to Davies's Cromwell Street flat with Jack and two other men, after Davies refused to sell him any more cannabis because he had not cleared his drug debts.
Hugh O'Brien-Quinn, prosecuting, said Davies came out armed with a seven-inch knife and after being grabbed and punched by Mr Saleh, he went on to stab him three times in the chest and shoulder, before then plunging the weapon into Mr Turley's stomach.
Jack, a former pupil at Castle High School suffered life-threatening injuries and would have died if he had not arrived at hospital so quickly, Mr O'Brien-Quinn told the court.
Mr Saleh had to undergo two emergency operations and was in hospital for two months. He now has no sensation in his left arm, his vision is blurred and he has difficulties with his co-ordination.
Mr Turley, who toured extensively in the US, Japan, Canada and Europe with the band, is also facing the prospect of another operation in the future.
The court was also told police found information for the manufacturing of acid, nail, aerosol, microwave, petrol and bleach bombs in the flat, as well as material about making gunpowder.
Mr O'Brien-Quinn also informed the court: "There were also designs for a number of g rotesque weapons, information of how to dispose of bodies after removing the limbs and how to avoid arrest as well as a a collection of cuttings dealing with serial killers and cannibalism."
Davies denied two charges of attempted murder and his pleas were accepted by the prosecution after he admitted two charges of wounding with intent to cause grievous bodily harm.
Christopher Hotten QC defending said Davies told police: "I do drugs. It's a dangerous business. I took the knife with me", adding that Mr Saleh had launched an unprovoked attack on him when he answered his door.
He said it was the victims who had provoked the violence that followed and Davies had "grossly over-reacted. It does not justify what he did but it explains it" Mr Hotten added.
Sentencing Davies, Judge Warner said: "I am completely satisfied you are a dangerous young man and there is a significant risks of harm to members of the public from you.
"The material found in your home shows you have a very disturbing and extreme preoccupation that is more than immature ramblings."
He also said how Davies had made it clear in interviews that if "someone wronged him" in the future he would not think twice about using a knife again.


text:
Ask Health Experts and Get Answers to Your Health Question ASAP
Welcome to Just Answer and thank you for the question.
I am Dr. Sohaib, a Medical Internist (who deals with diseases of all the organ
systems of body) and i will do my best to find an answer for you.
Sorry to hear about your problem.
Well, the best way to lose weight is by means of dietary control and exercise.
And both the diet and exercise plan need to be closely supervised and monitored by a certified dietician and a physical therapist, as together they can appropriately guide you regarding kind of diet and its types which will suit best to your needs, and various forms of exercises and the appropriate duration.
If these measures alone are not helpful, then pharmacological intervention can be done in the form of drugs that assist you to lose weight.
The only drug approved by FDA for weight loss is Orlistat (Xenical) which you can take to assist you in weight loss. You can ask your doctor for a prescription and discuss with him about this in detail.
Here is an article that i have searched for you; please click.
Furthermore, various bariatric surgeries are also an option but reserved only for resistant cases having morbid obesity. Click on this link for further details regarding these;
Most importantly an underlying cause need to ruled out that might be responsible for your weight such as hypothyroidism (already ruled out), cushings disease, and other diseases/drugs etc [surely your treating physician must have looked for these already].
I would have been worried too if i were at your place but let me reassure you that this is a treatable condition and carry a good prognosis, you just need to continue working over it continuously (in terms of diet and exercise) and discuss with your doctor the options i have suggested.
For excessive fatigue, Vitamin E 400mg daily along with Co-enzyme Q-10 supplements will be of great help.
Stay relaxed.
Wish you good luck.
Kindest Regards.
It was a pleasure assisting you and i hope my answer was helpful. I will
appreciate 4/5 Star Rating (Good/Excellent Service) & a Bonus as this is the
only way i get credit for my time & expertise. Do not hesitate to ask any follow up
questions or clarifications any time.


text:
Department News
Doug Clifford wins Mayoral Race
Doug Clifford won the mayoral election in Pleasant View, Utah on November 6, 2007 with 54% of the votes. After retiring from an executive position at Hewlett Packard (he was at Iomega before that), Doug joined the Department of Electrical & Computer Engineering as an Adjunct Professor teaching business management and teamwork to senior project teams. Doug, who is also the chair of the College of Engineering's ACET (Advancement Council for Engineering and Technology), was the 2007 Honored Alumnus for the College of Engineering.


text:
For Online Computer Support, Ask a Computer Technician
hi sir
what is the model of your video card?
did you try to install the driver from the CD that came with your video card?
hi again,
is your VISTA 32 or 64 bit ?
can you please try this link
just click on the link and install. this is the most recent version.
let's see what happens.
sorry, there was a problem
can you try this link to download your driver
select option 1
hello again sir,It will be better for me to opt out, because I am out of ideas. Let me redirect you to another expert. If nobody opts in back, we can continue together again. Regards