Cisco Switching/Routing :: Upgrading IOS Images For SSH Support On 4506 With Single Sup IV
Jan 18, 2012
I have been asked to upgrade the IOS images on three 4506 switches with a single Supervisor IV engine in each to allow for SSH2 access.The current image is cat4000-i5s-mz.122-25.EWA.bin..I have uploaded cat4000-i5k91s-mz.122-25.EWA14.bin to bootflash on each Supervisor engine.The ROM on each SUP IV is 12.1(20r). I don't want to have to upgrade the ROM version.Will the cat4000-i5k91s-mz.122-25.EWA14.bin image retain all the current features of the current image and provide SSH2 support, without requiring a ROM upgrade?Each switch has 512 Mb of RAM.If this image will accomplish what I want, what are the commands used to select the new image from bootflash. I'm familiar with image updates on fixed chassis switches using the boot system flash command.
I was upgrading the newest software images on a c2950G switch. So i followed the step by step procedures from url...I removed the current flash that was on the switch and then for some reason typed reload. This started the switch up without the IOS. Make a long story short I am now stuck in switch: prompt mode and I am unable to use x-modem to transfer the newest IOS onto the switch. I am currently getting "no response remote system".
I am currently running a 4506 with a sup V engine. I have purchased a sup 7 engine. Is there a guide on how to perform this task. I am sure I need to do an IOS update as well.
I have a new building to add to our campus and I have been encouraged to run single mode fiber. All of my other buildings are connected with multi-mode fiber. I just want to make sure i will not have an issue if I run single mode to the new building with SM SFP's.
I'm looking for switches that support single mode fiber connections and would like to know if "WS-C3750-FS-S Catalyst 3750 24 100BaseFX + 2 SFP" and "WS-C3750G-12S-S Catalyst 3750 12 SFP" can serve the purpose?
I want to sizing a CAT 4506 with WS-X45-SUP7L-E supervisor. To support full routing (EIGRP and BGP) I have to choice CAT4500E IOS ENTERPRISE SERVICES W/O CRYPTO.
Does Nexus 7K support Multiple VDCs sharing ports on a single line card. One of our cisco parnter engineers stated that cisco doenst recommend using same line card for multiple VDCs.The second VDC (Non-Default VDC) will be used four our Outside, and DMZ Segment, and to phyiscally segregate our Firewall from our Internal/Inside Core Switch without using a physical DMZ Switch.I know Cisco used the Nexus in this way in their PCI DSS 2.0 Compliance Document. Module is N7K-M148GT-11L
Mod Ports Module-Type Model Status --- ----- -------------------------------- ------------------ ------------ 1 48 10/100/1000 Mbps Ethernet XL Mod N7K-M148GT-11L Mod Ports Module-Type Model Status --- ----- -------------------------------- ------------------ ------------ 1 48 10/100/1000 Mbps Ethernet XL Mod N7K-M148GT-11L
I have 1841, 2800 and 3800 routers and need to do IOS upgrade to all of them. Existing routers do not have enough flash to hold 2 IOS images.if the router has 12.4.13r ROM IOS, will I be able to boot the ISR router via Cisco brand USB? That means in case something goes wrong while I am uploading new IOS to the router via WAN and something wrong, now router in ROMMON mode. If a local site person has a Cisco USB with an IOS in it, can he just stick it to the router and reboot the router and router will go out of rommon and go into normal mode? After it is working, then I can put the running IOS onto the exisitng CF card so now I can remove the USB and the CF card has a good IOS and reboot the router again.I am just trying to find a safe way to upgrade the site when they don't have big enough flash to hold 2 IOS at the same time. The local person is not technical so asking him to setup tftp server and put the IOS in the computer and so I can do tftpdnld while in rommon mode to grab the IOS from his tftp will be difficult to have the local person to set it up.
If ISR can boot off of the IOS in USB only, then I assume the requiremetn is the ROM IOS needs to be 12.4.13r. Then what is a safe way to upgrade the ROM IOS to this then? I never upgrade ROM IOS before so don't know what kind of problem I may run into and whether it's higher risk to upgrade this than upgrading the regular ios? If it is, then all my routers won't have this ROM IOS version, so that means I can't use USB to boot then? Will that means I am down to tftp server option? ( I heard xmodem won't work as it will time out before the ios can load via the slow dialup link into the router to rescue it from rommon mode).
My management has tasked me to give them a high level overview of the different switching we can choose for our new building.
This is what I know so far.4 Closets, each closet has 450 ports,One MDF room that is will contain one UCS Chassis and a Nimble iSCSI SAN.
I am working on the spreadsheet and it looks like this (Not totally filled):
2960s3560x3750x45064510Approx cost (Each, 48PORT, POE+, 10G uplink, Dual PS, IP BASE) 6K7K8K45K75KMax Capacity192432432192384Backplane speed206464520520ProLeast ExpensiveStackable to 9Stackable to 9ProDual PSDual PSDual PSDual PSDual PSProLayer 3 opt Layer 3 optDual SupsDual SupsConExpensiveExpensiveConNo Dual PSConLayer 2 OnlyCannot stack more than 4 For the MDF I would like to use 2 Nexus 5548's with FEX's, and the layer 3 daughter board. For the IDF's I was thinking of two 4010's.
I am implementing a guest wireless network to work alongside my internal network. The guest network will use the existing switching network and will be separated by VLANs. I have the ASA set so that traffic can get to it and out to the Internet. I can set up a workstation on the same VLAN as my guest network and can route inside my network (strictly doing this for testing purposes). Where I am having problems is with the Catalyst 4506 switches and the ip routing. I had two separate "ip route" statements defined on my switches.
ip route 10.200.2.0 255.255.255.0 10.200.2.254 ip route 0.0.0.0 0.0.0.0 10.100.100.254
I have discovered that the traffic is always following the default route despite the fact that my IP address on my test workstation falls in the 10.200.2.x network. I was looking at documentation and found that it is possible to set up policy-based routing on the core switches. Can you have two "ip route" statements defined like this to segreate traffic or do I have to use PBR for routing (or a combination) in this case? If I define PBR then how does that impact my existing routing? I need to make sure that I can still route the existing traffic while I'm configuring this change.
We have 2 sites, each with 2 x 4506 switches which will be connected togther using an etherchannel. The switches will provide access ports for client devices and will be configured with HSRP to provide gateway redundancy. SW1 will be HSRP active.2 metro ethernet links will be installed in each site which will connect back to our HQ sites. OSPF will be used over the backbone to provide resiliency and to allow shortest path routing to each HQ and to prevent traffic over the HQ to HQ link.
The 4506 will be trunked togther with an SVI for providing OSFP adjacency.For the traffic flow from SW2 to HQ2, traffic will hit SW1 and then route back to SW2 and then to HQ2. Is this the best way to do this? Should a second link be connected between switches just for routing or should something like GLBP be used?
CiscoSwitch1(4506) has 3 VLANs(12,13,14) and Switch2(4948) has 3 different VLANs(22,23,24) and IP routing has been enabled in both switches with SVI interfaces for each vlan. intervlan routing is works fine.Now there is a requirement to connect these switches together. Vlan 12 on the Cisco switch 4506 has to be made available from vlan 22 from Switch2(4948). basically Vlan 12 is having a multicast source (225.0.0.0 & 226.0.0.0) which should be accessabile from vlan 22 of cisco switch 4948.I got 2 ideas
1) Create a trunk between these switches and configure L2 vlan(12) in cisco 4948...i know theoritically it should work but what my concern is Ip routing enabled in both switches will it create any issues? is it a gud solution to this requirement?
2) Create a separate IP network on the ports connecting to both switches and set up routes to the networks.ex- console(config)#ip route 192.168.10.10 255.255.255.0 192.168.20.1.
I am configuring multicast in a environment where I have a 4506 at each site (4 total) and a 6506 as the core. Each 4506 is connected via layer 3 to the 6506. I have a mix of 3560s, 3548s, and 2960s connected to the 4506s and the 6506 via layer 2 trunk
I have multiple multicast sources and hosts communicating at a time (multiple cameras sending video / multiple computers receiving video). So this is not a scenario where there is 1 sender and many receivers. This would be many senders (~50) and some receivers (~10)
I configured ip multicast-routing on each of the 4506s and on the 6506. IGMP snooping is on by default on the 3560 and 2960 switches. CGMP is on by default on the 3548 switches.
I set up PIM sparse-dense mode and IGMP version 3 on each of the layer 3 interfaces for the 4506s and 6506 where they connect and on each VLAN that is sending or receiving multicast. Multicast is working throughout the network, however I am looking to verify the configuration as I scale this out to more clients on the network.
#1 - Is it correct to us sparse-dense mode in this configuration?
#2 - Do I need to configure a rendezvous points using AUTO-RP? (ip pim send-rp-announce INTERFACE scope TTL). Not sure here if I need to designate this and what to choose. Right now I do not have this and it is working, but documentation seems to infer that I need to designate this.
#3 - Is there any other configuration settings I should be considering? I hard to find real world configurations of multicast as examples or people that know multicast routing well.
We have sup engine 6L(WS-X45-SUP6L-E) on two 4506 switch. both switches connected in LAN (HSRP primary and Secondary).
We are going to replace it with Sup7LE. What is the best procedure to get this done with minimal outage?Any other important thing to be noted ? Note : We have Lincence for SUP 7LE
We are attempting to PXE boot from clients obtaining their DHCP lease information from DHCP pools configured on our 4506. The PXE server, and the client are configured in separate VLANs. We have configured option 66 to point to the PXE server IP address, and the bootfile option to point to the PXE boot configuration filename. On the client side SVI, we also have configured the ip helper-address command to point to the PXE server (which also acts as another DHCP server for redundancy).
The PXE boot continuously fails stating it is unable to find the configuration file. If we remove the DHCP pool from the 4506, and allow the client to receive their DHCP lease info from the secondary server (Windows 2k8 - same server as PXE server), they PXE boot with no issues.
We have no problem obtaining DHCP info, just completion of the PXE process.
Yesterday I've faced a Problem that is not letting me boot with the new IOS.
Actually I'm planning upgrade IOS which supports SSH. As part of plan I've downloaded the new IOS image and uploaded via TFTP server to the switch.
After uploading to the switch. I've verified image and MD5 hash also. Everthing is fine. Then after I set the boot variable for the newly uploaded Image.
When I'm rebooting the Device it is not taking the new IOS. It's booting with the OLD image. Even It's not showing any error message while rebooting (ACTIVITY FILE ATTACHED FOR YOUR REFERENCE) I can't take risk by deleting the old IOS.
I have 4506 with below sup, my requirement is to enable netfolw , but as i came to know that it is not supported in this sup, is there any additional option which can be explored to get the netflow working without replacing sup.
Card Type Model -------------------------------------------------------------+----------------------- Sup 6-E 10GE (X2), 1000BaseX (SFP) WS-X45-SUP6-E
We have just purchased and installed a 4506-E chassis. It contains a supervisor, two POE blades and 3 non-poe blades. Version is 12.2(53)SG1. Anyhoo, one of the ports isn't providing power to an IP phone. We can plug the phone into any of the other POE ports and it works fine. Is there a way to test an idividual port for POE problems? What could the problem be? The port works for normal data but will not provide power.
We ordered the wrong part number for a Cisco 4506 non-E chassis, the part number is: WS-X4624-SFP-E and the device is showing "Unsupported module"; What would the part number be for the non-E? WS-X4448-GB-SFP,Catalyst 4500 48-Port 1000Base-X (SFPs Optional) ?
i'm desperately trying to get LACP working over a dot1q Tunnel. The "Service Provider" Switches are two 4506-E Switches with SUP7-E connected via a 10G Link, running on cat4500e-universalk9.SPA.03.03.00.SG.151-1.SG
sample config:
dot1q tag vlan native interface GigabitEthernet3/1 switchport access vlan 2001
a 6509 and a 4506 with 2, 1gb interfaces in a portchannel. Bring it up and everything is fine. Save the config and reload either switch and the interfaces stay in Not Connected state. Either doing a No Shut or a physical unplug the SFP and plug it back in will bring it up with no issues. Interfaces do not go into Err Disabled state they stay in Not Connected like there is no fiber plugged into it. No error mesages in the log. The Just the Interface is now up.Both are running very new code,
6509 - s2t54-ipservicesk9-mz.SPA.150-1.SY1.bin ( 15.0.(1)SY1 ) 4506 - Version 03.02.00.XO
I have "inherited" a Catalyst 4506 with IOS version 12.2(20)EWA1 and Supervisor IV already installed. We recently purchased a second Supervisor IV and I am looking to install this second supervisor for redundancy. Is there anything special with installing a second supervisor or so I just physically install the new supervisor and the IOS will automatically set everything up?
I have a setup with two Cat 4506E working as a HA,I used a bundle 4Gb interfaces working as ether-channel,I'm facing a problem with DHCP pools on the both SW's,There is no problem if I use the pools on one sw,But when I but the pool on both sw's then I faced a lot of conflict IP in the DHCP pools,How can setup a real DHCP redundancy on both SW's,
My inherited network has a Cisco Catalyst 4506 with a WS-X4124FX–MT fiber card that connects to twelve Cisco 2950 switches over 62.5 micron multimode fiber at 100 Mbps. I do not know my run lengths (or even where the conduits run), but the furthest switches are well over a thousand feet from the server room. Any appropriate test equipment to provide this information soon.
We are looking at upgrading the main switch to a Catalyst WS-C4507+E with two WS-X4712-SFP+E cards and the closets to Cisco 2960S-48TD-L switches. Assuming this is a reasonable move, my question is about choosing the appropriate SFP’s for our current and future needs.
I am aware that 62.5 micron multimode fiber is the least favorable for extended lengths, but I will not be in a position to replace it for at least a year. If I purchase 10 Gbps modules, like the SFP-10G-SR or SFP-10G-LRM, can they “throttle down”, either automatically or by setting a parameter, to communicate at slower speeds over distances that exceed their 10 Gbps maximum link lengths on multimode fiber?
We want to permit certain mac addresses on the cat 4506 switch wherein only those mac addresses will get access to network.
Configuration Planned: For testing purpose we have created mac access list on cat 4506 and deny laptop mac address in this access list. The mac access group is applied to the port where the laptop is connected to cat 4506.Even after applying the mac access group on the port, the laptop is able to ping the vlan ip of cat 4506 [code]
laptop with ip address 192.168.10.2/24 connected to port 2/1 is able to ping 192.168.10.1 even after applying the mac access-group
Note-we have tested same configuration on cat 3560 and its working fine. We apply the mac access-group command on interface and clear the arp-cache and we are not able to ping vlan interface ip. The moment we remove the mac access-group,ping starts again.
I have three 4506 switches with vlan 4 set as the management vlan. Switch 1 is connected to switch 2 and switch 3.
I can access switch 1 and 2 using telnet from the management vlan and both switches reply to pings. But from switch 1 or 2 I cannot ping or telnet switch 3. If I plug into switch 3 and I can ping and telnet switch 3 but not switches 1 or 2.
It is as if the management vlan 4 is not being passed to/from switch 1 and 3. The configs for the uplinks from switch 1 to 2 and 3 are the same. And the configs for switches 2 and 3 look the same apart from the port settings.
I have over 40 vlans running all that work fine between all the switches.
I have one computer connected to the 4506 that management does not want this PC to have access to anything on our network except our DHCP server and the one printer that resides on our network. I created an extended access list as follows. Our network is the 10.10.x.x and the external addresses the PC needs to access is 11.1.x.x. Once this PC is rebooted, it is unable to access DHCP to get the needed IP address it bounces back to a 169.x.x.x address and stops working.
Extended IP access list 2000 permit tcp host 10.10.200.242 host 11.1.200.1 (gateway) permit tcp host 10.10.200.242 host 11.1.2.151 eq smtp (access from the pc to external server for smtp) permit tcp host 10.10.200.242 host 11.1.2.149 eq 5721 (access from the pc to external server for remote access) [ code]...
Then I applied the access-group 2000 on the interface the PC is connected to. What am I missing for DHCP to work and for this PC to always get the ip address that is reserved?
I am running HSRP on three 4506 switches..S1(active) S2( standby) and S3(listen)..S1 is active for all the vlansRight now, I wanted to make S3 active for two vlans: vlan 10 and 19What would be the impact to the end hosts?Also, can you tell me why the arp is not syncing for all the three devices? [code]
I have two 4506 switches in my organization. Recently the office was relocated and when both the switches were booted they ignored the startup config.The config-reg was set to 0x2101. No boot system command was configured.So I changed the config-reg of SW1 to 0x2102 and gave boot system command as stated below.When reloaded the switch booted to ROMMON and I had to manually boot the IOS.I want them to boot normally with IOS.Config of SW2 is not changed since relocation. I am specifying both configs bor your consideration. [code]
I'm dealing with a 4506 switch that whn I try to apply "sh auth sess int xx" I get "Invalid Input Detected" ... Is there any way that I can get the authenticated session over a port even if I can't apply "sh auth sess int"?
Need to limit the amount of bandwidth a specific VLAN can use on a 802.1q trunk port. Situation is that we have a pair of Catalyst 4506 switches which have 802.1q trunk ports into a Checkpoint Firewall, this in turn is connected to a managed WAN router (to which I can't apply a QoS policy).If the 4506 was routing the traffic it would be easy to setup a class-map to match the IP traffic and then QoS the traffic, but the VLAN in question is trunked directly into the firewall (no L3/IP presence on the 4506 next hop for all clients on this VLAN is the firewall).What I need to do is restrict any traffic from this specific VLAN to 10Mbps on the uplink to the Checkpoint Firewall so it cannot impact the onward WAN.
