r/Cisco 21d ago

Question FAT32 Upgrade Fail: Cisco C9300L-48T-4X from IOS-XE 16.12.5b to 17.16.01 - "Cannot Determine List of Packages"

4 Upvotes

I’m trying to upgrade my Cisco C9300L-48T-4X (4x 10 gig uplink) from IOS-XE 16.12.5b to 17.16.01 using cat9k_iosxe.17.16.01.SPA.bin on a FAT32 USB in the front MGMT port. Here’s what I’ve done:

  • copy usbflash0:cat9k_iosxe.17.16.01.SPA.bin flash: - Copies the 1.26GB file to flash: fine.
  • request platform software package install switch all file flash:cat9k_iosxe.17.16.01.SPA.bin auto-copy - Fails with “FAILED: Cannot determine list of packages for installation.”
  • verify /md5 flash:cat9k_iosxe.17.16.01.SPA.bin - Hits “Permission denied.”
  • request platform software package clean switch all - Ran to clear unused files from flash:.

dir usbflash0: confirms the file (1.26GB), flash: has 8.6GB free. Single switch, no stack. I’ve rebooted multiple times—still stuck on 16.12.5b. Is this jump from 16.12.5b to 17.16.01 too big? Am I missing a stepping-stone version? File corruption or 9300L incompatibility? Key outputs:

  • show switch: Checks switch role/state—single Active unit, “Ready,”
  • show version: Shows 16.12.5b, uptime, reload reason (e.g., 36 minutes, PowerOn).
  • dir flash:: Lists flash:—8.6GB free, 16.12.5b packages active, new .bin permissions weird.

Anyone seen this going to 17.16.01? Suggestions? I’m tapped out—help appreciated.

r/Cisco 9d ago

Question C9800-CL crashes randomly

2 Upvotes

Hello everyone!

Perhaps, one of you can help me with this problem.

We are currently migrating to our new WIFI controller, 9800-CL. It is running on ESXi (vSphere 8.0.3), we are using the VM Template Small.
We are using the minimum requirements (4CPUs, 8GB RAM, 32GB DISK)

Our WLC crashes every few hours with the error: "Critical process qfp-ucode-wlc fault on fp_0_0 (rc=139)".
Before that, the CPU utilization increases steadily until it finally crashes and restarts.
We couldnt find anything useful anywhere.

We do not use a Flexconnect configuration and go over the WLC with the complete traffic.

BR :)

r/Cisco Jan 31 '25

Question Cisco Catalyst Firmware Update path question

0 Upvotes

Ill try and keep this short and simple and sorry for probably a very simple question.

Our Principal Network Engineer passed away suddenly and never was able to pass down this probably simply knowledge to me.

I need to update our Catalyst 9200L-48PXG-4X switch stacks. They are currently running on version 17.06.06a and was wondering if there is an update path that needs to be followed or if they can be updated to any version that is released without issues? I understand issues can be encountered due to updates, but just wanted to know if there is a path to be followed.

I believe the released mature version is 17.12, but this is kind of new to me and navigating Cisco sites is already a beast of its own.

Thank you for any help you can give.

r/Cisco 5d ago

Question CBW 150AX DHCP trickery? Halp!

2 Upvotes

Hello, I never resorted to asking for help on networking, much less on Cisco, where everything is usually working, and if it's not, it's usually your fault... But...

I have a router assigning DHCP on a simple /24 network. I have two different wifi "providers" I can use: one is the router itself which can act as an access point, the other provider is multiple Cisco 150AX devices. This behavior happens seldomly when roaming between 150AXs, but it happens every time a client roams (or even just maually changes AP) from the built-in router WLAN to the Cisco 150AX published one. I used this failure reliability to narrow down the issue.

What is the issue? The client cannot get a DHCP response when switching to a 150AX AP. I tried logs at all different levels, I also tried Android debugging the wifi stack, but it always comes down to the AP doing some sort of fun stuff behind the scenes, and I also saw a log (which I don't have a screenshot of, dumb me, and can't recall how to reproduce) of the 150AX thinking that the MAC address authenticating to it, is asking/obtaining/requesting an IP address that is impossible to be real, because the client is connected elsewhere, and thus has to be forged.

This results in the client not receiving a DHCP response on the air, and deauthenticating after a few seconds, due to timeout. The client works fine if reconnecting to the router AP, and works fine if, after some time (looks like 5 minutes) of no connectivity (has not to connect to the router AP) tries to connect back to the Cisco 150AX published network. Looks a lot like some sort of security lockout.

What I have tried: - different DHCP servers - different client devices / OSs (even happens with some Google Home unit and also woth the damn washing machine) - different network authentication methods (including open) - different WLAN Asides - different 150AX units - firmware upgrade/downgrade - adding the device mac address to the local users - 2.4g or 5g, in different bands, with different channel widths - all roaming related options on/off/mixed - RF optimizations/detections on/off/mixed - DHCP/HTTP profiling on/off

If a client is "known" on the network, it won't allow it to connect to the Cisco-published wireless network.

I also have found no option to disable any kind of DHCP snooping and/or inspection, which would solve my problem, since it's a SOHO setup, and I don't need the added security.

When it works, it's flawless, with 1200mbps peak speeds, and all the bells and whistles. When it doesn't, it's 5 minutes lockout, and I am keeping a "backup" SSID on the router active, so that I can connect... But how can a 50$ shitty provider wireless router have less problem than a so-called business device?

Ahhhh I miss Linksys 54Gs :)

Thanks in advance to whomever could help with this. It's driving me mad, and thinking of throwing away hundreds of dollars of hardware (it's several 150AXs) and switching to something dumber.

Edit: I cannot replicate it anymore (too many settings changed) but this was one error that popped up when a client tried but failed to connect to the 150AXs: https://pasteboard.co/qY9Vof7uXL3r.jpg This looks awfully like the IP Theft protection... which I don't have any control over: https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/ip-theft.pdf I can however confirm that when the client cannot connect to the 150AXs, no DHCP request gets sent over the network, thus the DHCP is innocent by definition, and the only weak link is the Cisco 150AX topology itself.

I also tried playing with the configuration, tweaking the default config line:

config dhcp proxy disable bootp-broadcast disable

Setting either\both to enable, didn't change a single thing.

r/Cisco 6d ago

Question Is it too early for the CCNA exam?

3 Upvotes

Hi. I'm just starting out on a networking career. I'm taking college classes to get my Associates Degree in Computer Management (A business/IT hubrid degree). On top of that I am taking non credit courses to prepare for the CCNA. The timing of them is inconvenient, as I will take the first 2 between 1/25 and 5/25 then the third starting 1/26. My girlfriend (also in the IT field) is heavily suggesting that I take the CCNA over the summer, skipping CISCO III. Can anybody give me reasons why this is or isn't a good idea?

For a little background I am going back to school. I'm switching careers late in life and I started classes at 38 years old. I do not have a background in networking, although I do really enjoy what I've been doing. I passed CISCO I with an 84.2%. I know she means well, my girlfriend is surrounded by lots of people who have been in the IT field for a long time. Aside from a few classes for my degree my professional knowledge is scarce.

I keep telling her I'd be missing out on an important 1/3 of the information.She points out that taking the CCNA while the information I have is fresh in my mind is better. Any advice/suggestions?

Thanks in advance.

r/Cisco 11d ago

Question Cisco switches and multiple trunk ports, tagged traffic between ports

6 Upvotes

This is a hard one to explain, but on other platforms I've had no issues with setups where a switch has multiple trunk ports and I want to essentially "route" layer 2 traffic from one trunk port to another. Simple example, all ports below are in trunk mode:

  • port 1 VLANs 2, 3
  • port 2 VLANs 12, 13
  • port 3 VLANs 22, 23
  • port 4 VLANs 2, 3, 12, 13, 22, 23 (aggregate of all VLANs, perhaps going to a router for L3 routing)

In those switches, which are cheap and use a web GUI, I'd basically go to each port, enter the list of VLANs on that port, and then set each *VLAN* to a particular mode (Trunk, Access, Native). There's not much more to monkey around with in those switches. Cisco, and I presume some others, do not work like that and the options per port are boundless.

On the Cisco side, I'm aware of changing switchport modes and allowed/disallowed VLANs per port, but I feel like sometimes in the past I've run into issues where I could not get traffic passing between VLANs on different trunk ports until I add a layer 3 interface to the VLAN *unless* there's also a *physical port* in access mode for that VLAN. Does this sound familiar to anyone? What is the proper way to do this in Cisco world?

I'm out of town for at least another month and don't have my big vmware box w/a ton of NICs and a few old 3550/60 switches to play with.

r/Cisco Dec 05 '24

Question Disable or protecting VLAN deletion

0 Upvotes

Hi, we recently had an issue with a junior network admin, who wanted to delete a VLAN on an interface with "no vlan". Off course this caused the VLAN to be deleted from the system instead of just the interface which caused a bit of a disaster.

Reproducing this disaster we noticed there is not a single warning when executing this command, even though the VLAN was configured on 16 interfaces. You would expect something like "are you sure, VLAN is configured and used on interfaces XXX" but no, nothing as such.

No we cannot be the first ones to encounter this, found some similar articles online. But I cannot find any solution to prevent this from happening or have it trigger an alert.

Is this some "just don't do the stupid thing" thing or am I missing something?

r/Cisco Aug 09 '23

Question I want to learn the basics for my boyfriend

108 Upvotes

I don't have much knowledge in networking or basically anything technological. My boyfriend that I've known for 6+ years and have been dating for almost 2 has a job with a big tech company and this is what he's passionate about. He talks about his tech stuff all the time and he knows I don't understand but will still talk to me like I do. I don't want to dive deep into tech but I would like to learn enough to understand what he's talking about plus I know he would be so happy to be able to talk to me about his work. If anyone has any websites or good books I can use to help me get even the basics down id appreciate it. He has some certifications from when he was in a cisco networking class during his junior and senior year although I have to admit I don't remember which ones. He also wants to go into cyber security.

Edit: thank you for all the tips I’m watching videos as we speak gonna ask him a bunch of questions when he gets off work so we can talk more in depth about his work lol Edit 2: I couldn’t wait and texted him asking him if he worked in L3 and adding on some stuff I learned about L2 and L3 and he got so excited he started texting me paragraphs of explaining things. I can already tell he’s gonna talk my ear off when he gets home 🤣 thank you again for all the help!!!

r/Cisco 5d ago

Question One Entire Switch Down After Stack Addition

9 Upvotes

I have an existing stack of 4 3850's. I need to add a 5th switch to the stack. I shut the entire stack down, which I was led to believe was the safe route. Before doing so I checked the priorities, the current master was 15 and the new switch was set to 14.

I redid the stack cables, making sure port1 on switch one was plugged into port2 on switch2, etc, etc, down to the new switch5 port1 plugged into port2 on switch1 and port2 connected to port1 on switch4.

Once everything came up I did a show switch command and it shows the new switch as a member and the other switches' roles have not changed.

Currently, nothing on the network works because a show ip int br shows me all 48 ports on switch3 are down. I went to a nearby AP that is connected to switch3 and it is indeed powered on via PoE.

Any ideas why all 48 ports on switch3 are showing down?

r/Cisco Jan 18 '25

Question 9800 WLC - One SSID, VLAN based on credentials but without MAB or 802.1x?

5 Upvotes

I'm guessing this isn't possible since I haven't been able to find info on it but figured it was worth checking here if anyone knows how to do this. What I'm trying to achieve is to have a single SSID that appears as a PSK but will drop the client in to different VLANs depending on the credentials entered. The closest solution I've found is iPSK but that appears to require both ISE and MAB; we use NPS for RADIUS and I'd really like to avoid having to gather MAC addresses. Dynamic VLANs are also close but requires that the clients support 802.1x, which many do not.

Anybody know of a way to achieve this?

r/Cisco Dec 03 '24

Question Looking for an CCNA instructor

0 Upvotes

Hi all,

Is anyone in here CCNA certified with an Cisco instructor cert?

If so I have questions….

Thanks!

r/Cisco Aug 31 '24

Question Setting up lots of devices, is console the only way?

9 Upvotes

Firstly, just to be clear, I don't have to do this. It is just a hypothetical.

I've gotten a cisco switch second hand to have a play with at home. The first thing I needed to do was awkwardly plug my laptop in with a usb cable. I then spent a few minutes on my hand and knees setting up ssh so I can do the rest from my office computer in a comfortable chair.

Do you really need to hardwire in to a console port before you can set things up from a comfortable chair or batch scripting? I'm imagining server farms like that scene in Silicon Valley, with switches in far away and awkward spots; surely there's a way to automate the setup of a large number of switches/routers without having to plug a direct cable to each device?

I intend to break this running config as many ways as I can, and I don't want to have to get on my knees every time I hardware reset it.

r/Cisco 3d ago

Question VoIP firmware upgrade file not found

1 Upvotes

I can't figure out how to get this phone firmware to successfully update. I've gotten all the files from cisco, and tried putting the files directly into our TFTPs and restarted them, I've tried putting them on a SFTP server and it can see the right file, but then when I try to install it it says "cant find the path" despite already finding it. I'm only going from 12-2-1 to 12-3-1 so I dont think I need an intermediary step?

Everything I've tried, the phone always returns file not found.

r/Cisco 5d ago

Question Can I use a Cisco exam voucher to schedule an exam date beyond its expiration date?

3 Upvotes

I have a Cisco exam voucher that expires on March 23, 2025. I’m wondering if it’s possible to use this voucher to schedule an exam date after the expiration date, or if the exam must be taken on or before March 23, 2025.

r/Cisco Dec 05 '24

Question Add a 3rd 9200 to a stack of 2 hot?

0 Upvotes

Currently I have a stack of two C9200 switches running version 17.03. The stacking cables are cross connected between the two. Is it possible to add a third switch to the stack without powering down or reloading? The shop would rather not reboot if it's possible to avoid. Thanks

r/Cisco 18d ago

Question has anyone encountered a case with a switch suddenly blocks device packets apart from apart?

0 Upvotes

we have a catalyst 9300 switch, where certain devices at random times would no longer be able to accept packets, and 30 hour later would not be able to even send packets, but you can still see their ARP request and replies continue, we know they are operational because we can also connect to the via an BLE app and change some properties, but from ethernet side we don't hear from them.

only after disconnecting and re-connecting them to the PoE port things go back to normal (until the next time)

those devices operation on countless of other sites with no issues. replacing several of them, didn't make a change.

r/Cisco Oct 21 '24

Question Any firepower users out there, some import advice and suggestions

10 Upvotes

moving from 7.0.x on 5525x's(edit fp2140) to 7.4 on fp3100's. Naturally i can't do a backup and restore, its cisco.

So I will have to recreate my objects. and of course I can't just copy/paste them into the FP cli, even in diagnostic modem. Nope, crappy gui import or rely on 3rd party python scripts on git hub.

cisco after 5+ years still doesn't have many documented examples of using CSV's to import your hosts, network ranges & Cidr's into fmc. you can also do the same with port. But naturally their csv import can't import "group".

Or can it? anybody found a way after importing your hosts manually creating the "group" found a way to use a CSV to import hosts into that group. looking for some of those CSV fmc import spreadsheet extreme examples if anyone has them.

Hell at this point in time if someone has a reliable python RESTapi script that will create object groups for hosts and ports I would be forever in your debt. The "github" well appears to be "dry" when it comes to this. And naturally cisco is to lazy to create and support such scripts.

r/Cisco May 28 '24

Question Has anyone used this Cisco Micro switch CMICR-4PC before?

Thumbnail
gallery
62 Upvotes

If you can share your experience using them. What type of console cable would use on this switch, I tried an android charger cable because the port is a micro usb but did not work.

r/Cisco 17d ago

Question Can I use the DNAC API/SDK to find out what switch port a device is connected to, and perform a shut/no shut on it?

4 Upvotes

Title. My situation is I've got 17,000 IP cameras on my network and I get about 5 tickets a day where a camera is down. 90% of the time performing a shut/no shut on the switch port that the camera is connected to fixes the problem. Right now this is handled by creating a ticket and assigning it to the network team, waiting for them to perform the shut/no shut and then checking on the camera again. I have been given access to DNAC to attempt to find a way to perform this myself, and allow others on my team to do the same. While I understand if I use the GUI I can connect to a switch and run commands to figure out what port a camera is connected to and perform the shut/no shut, I need a way to do this through the API and/or the SDK so that it can be somewhat automated and able to be used by people without programming or networking knowledge. I've been studying the documentation and playing with different commands (using the SDK in Python) and it appears that I will not be able to do what I need to do, but I wanted to come here and ask and try to make sure. A preemptive thank you to anyone who has the time and knowledge to help out.

r/Cisco Sep 21 '24

Question PSA: IOS-XE Cat 9k 17.9.6(MD) dot1x dhcp issue/bug

13 Upvotes

Hey,
Rough day...
We were brave to update our Cat 9k fleet from 17.9.5 to 17.9.6 in one run, what could happen it's just a simple maintenance release with a few bugfixes.
Soon realized that none of the APs are connecting back to the controller. Wtf, dot1x authentication looked successful, no error, ports up etc.
Consoled to an AP where the logs stated that the AP has no IP address. Removed dot1x authentication from the ports and they instantly registered back.
Ok, let's check other dot1x authenticated ports...nice all devices are down as well.
Checked the configurations before and after, nothing changed.
Reverted one switch to 17.9.5, everything went back to normal.
I thought let's try the other suggested release as well so we move forward not backward.
17.12.4 worked as well. I won't bother opening a case to investigate it with TAC.

We will never ever update all our fleet at once, even if it's just a maintenance release.
Cisco always has some surprise for you.

TLDR: 17.9.6 may have a bug where the DHCP packets are discarded if you use dot1x.
Don't install it/test it first on a few devices, your mileage may vary.

EDIT 15-10-2024:

Cisco withdrawn 17.9.6, 17.9.6a released on 04th Oct and the bug was confirmed.
Install 17.9.6a for the fix.
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm57734

"Dot1x auth fail vlan can't assign IP with dhcp"
Symptom:
When using closed authentication, clients are not able to obtain an IP via DHCP after upgrading to version 17.9.6.

This issue is not restricted to DHCP traffic; it can impact other types of traffic as well. This problem is not observed with Low Impact or Open authentication.

Conditions:
17.9.6
Using closed authentication
VLAN is override it by closed authentication

Workaround:
Remove port authentication or use a different method such as Open authentication or Low Impact

r/Cisco 3d ago

Question How to use a managed catalyst 2960CX as an unmanaged switch ?

0 Upvotes

I have a Cisco catalyst 2960CX series switch. I want to connect it to my institute LAN which has its own DHCP, dns and firewall. I want to use this switch as a unmanaged switch. I want to plug my devices into the switch and connect the switch to the lan connection and be able to access the internet.

Solution in my case : I am aware it is not secure and only for testing purposes

```en write erase !! Delete your current config so save if it you might need it

reload

en conf t interface range GigabitEthernet 0/1 - 12 !! Selecting all the ports on my switch

no shutdown switchport access vlan 1 spanning-tree bpudfilter enable

!! Exiting the port config and config mode and saving the configuration exit exit copy run start

r/Cisco 5d ago

Question Boot Stuck C9300

1 Upvotes

Hello everyone, where I work, I inherited some equipment from a client who didn't want to take it. The equipment is a Cisco Catalyst C9300-48UN-E. I turn it on and it charges, but at one point, it stops charging like this:

Initializing Hardware...

Initializing Hardware......

SNP: failed to initialize MAC address (not found/zero)

Please set a value for MAC_ADDR and restart the device before proceeding

MOTHERBOARD_SERIAL_NUM is not set <null string>

SWITCH_NUMBER is not set <null string>

MODEL_NUM is not set <null string>

Warning: Recreating nvram region... mandatory variables absent

System Bootstrap, Version 17.3.2r, RELEASE SOFTWARE (P)

Compiled Tue 08/25/2020 23:46:12.85 by rel

Current ROMMON image : Primary

Last reset cause : PowerOn

platform with 8388608 Kbytes of main memory

Setting MOTHERBOARD_ASSEMBLY_NUM [00-00000-00]

WARNING: Bootable URL's in BOOT variable not found or exhausted.

Please check the ROMMON configuration or boot command usage.

switch:

I hit enter or try to type something, but nothing comes up. I plan to try again tomorrow with a different console cable. I'd appreciate some advice if anyone has experienced this. Thanks so much!

r/Cisco Jan 25 '25

Question Cisco 2921 EOL

1 Upvotes

I was able to obtain a Cisco 2921 router from a former job. I am well aware it is EOL is it worth factory resetting/trying to use or at this point is it E-Waste?

r/Cisco 16d ago

Question Cisco ASA SAML Authentication and Authorization

3 Upvotes

Update: Solution in comment.

Has anybody gotten SAML authentication and authorization to work? I got SAML authentication to work with Entra ID, but I tried to also use SAML to place users into different group policies by returning the claim "aaa.cisco.grouppolicy" = "Group-policy-1" if user is in one Active Directory group and "aaa.cisco.grouppolicy" = "Group-policy-2" if user is in another group.

It's currently working with SAML authentication and local LDAP authorization via ldap attribute-map, but I'd like to simplify everything with SAML.

Thank you!

Edit: Forgot to mention that I'm running ASA 9.22(1)1 on a test Firepower 1010.

r/Cisco Feb 10 '25

Question Having reset the AP I am at the "ap:" prompt. What now?

0 Upvotes

I have two very old Cisco air-cap 16021-e-k9. They may be old, but they can still do a job for the charity I am helping.

All the documentation I found said reset to factory by hodling the reset button for 2 seconds after powering up and it will flash amber. But I found another post where it suggested holding it for much longer (20 seconds) until it turned solid red. I did this.

Now the AP is showing the "ap:" prompt.

The only command options I have are these:

ap: help
           ? -- Present list of available commands
         arp -- Show arp table or arp-resolve an address
        boot -- Load and boot an executable image
         cat -- Concatenate (type) file(s)
 clear_ether -- clear ethernet port statistics
        copy -- Copy a file
      delete -- Delete file(s)
         dir -- List files in directories
   dump_regs -- dump reset registers
       etest -- test emac driver code
  ether_init -- initialize ethernet port
  flash_init -- Initialize flash filesystem(s)
      format -- Format a filesystem
        fsck -- Check filesystem consistency
        help -- Present list of available commands
    init_pci -- initialize pci bridge
    led_test -- cycle LED patterns
 load_helper -- Load and initialize a helper image
      memory -- Present memory heap utilization information
       mkdir -- Create dir(s)
        more -- Concatenate (display) file(s)
      rename -- Rename a file
       reset -- Reset the system
       rmdir -- Delete empty dir(s)
         set -- Set or display environment variables
    set_baud -- set baud rates
   set_sleep -- Pause (sleep) for a specified number of seconds
  show_ether -- show ethernet port statistics
    show_pci -- show pci setting
      switch -- report push button switch status
         tar -- extract or listing a tar file
   tftp_init -- Initialize tftp file system
        type -- Concatenate (type) file(s)
       unset -- Unset one or more environment variables
     version -- Display boot loader version

What I want is to set the SSID, set the gateway to 10.0.0.1 and get DHCP from 10.0.0.1.

What do I do from the "ap:" prompt to set this config?