Table of Contents

Release Notes for the
Catalyst 3550 Multilayer Switch
Cisco IOS Release 12.1(19)EA1

October 2003

The Cisco IOS Release 12.1(19)EA1 runs on all Catalyst 3550 multilayer switches.

These release notes include important information about this Cisco IOS release and any limitations, restrictions, and caveats that apply to it. Verify that these are the correct release notes for your switch:

For the complete list of Catalyst 3550 switch documentation, see the "Related Documentation" section.

You can download the switch software from these sites:

(for registered Cisco.com users with a login password)

(for nonregistered Cisco.com users)

This Cisco IOS release is part of a special release of Cisco IOS software that is not released on the same 8-week maintenance cycle that is used for other platforms. As maintenance releases and future Cisco IOS releases become available, they will be posted to Cisco.com (previously Cisco Connection Online [CCO]) in the Cisco IOS software area.

Note   If you are upgrading a switch running Cisco IOS Release 12.1(13)EA1 or earlier that uses the 802.1X feature, or your switch has not run Cisco IOS Release 12.1(14)EA1, you must re-enable 802.1X after upgrading the software. For more information, see the "Cisco IOS Notes" section.

Contents

This information is in the release notes:

System Requirements

Table 1 lists the hardware supported by this Cisco IOS release.

Cluster Capability

When creating a switch cluster, we recommend configuring the highest-end switch in your cluster as the command switch.

A Catalyst 3550 switch can be a command switch or a member of a switch cluster.

If your cluster has Catalyst 3550, Catalyst 2950, Catalyst 2940, Catalyst 2900 XL, and Catalyst 3500 XL switches, the Catalyst 3550 switch should be the command switch. The Catalyst 3550 switch that has the latest software should be the command switch.

Table 2 lists the cluster capabilities and minimum software versions for the switches. The switches are listed in the order of highest to lowest end switch. A lower-end switch cannot be the command switch of a switch listed above it in the table (for example, a Catalyst 2940 switch cannot be the command switch of a cluster that has Catalyst 2950 or Catalyst 3550 switches.)

Software Compatibility

For information about the recommended platforms for web-based management, operating systems and browser support, CMS plug-in guidelines (Windows only), Java plug-in guidelines (Solaris only), and installation procedures, refer to the "Getting Started with CMS" chapter of the software configuration guide.

This release uses a CMS plug-in (Windows only) that replaces the Java plug-in.

Note   You must download the CMS plug-in to run CMS for this release. You can download the plug-in from this URL: http://www.cisco.com/pcgi-bin/tablebuild.pl/CMS-Plug-In-Win-1-0

For Solaris, Java plug-in 1.4.1_02 is required to run CMS. You can download the Java plug-in and installation instructions from this URL:

http://www.cisco.com/public/sw-center/lan/java/1.4.1-02.html

Some versions of the Catalyst 2900 XL software do not support clustering and if you have a cluster with switches that are running different versions of Cisco IOS software, software features added on the latest release might not be reflected on switches running the older versions. For example, if you start Visual Switch Manager (VSM) on a Catalyst 2900 XL switch running Cisco IOS Release 11.2(8)SA6, the windows and functionality can be different from a switch running Cisco IOS Release 12.0(5)WC(1) or later.

Note   The Cluster Management Suite (CMS) is not forward-compatible, which means that if a member switch is running a software version that is newer than the release running on the command switch, the new features are not available on the member switch. If the member switch is a new device supported by a software release that is later than the software release on the command switch, the command switch cannot recognize the member switch and it is displayed as an unknown device in the Front Panel view. You cannot configure any parameters or generate a report through CMS for that member; instead, you must launch the Device Manager application to perform configuration and obtain reports for that member.

Downloading Software

These are the procedures for downloading software:

Caution   The crypto image includes a bootloader upgrade. Do not power cycle the switch while you are copying this image to the switch. If a power failure occurs when you are copying this image to the switch, call Cisco Systems immediately.

When you upgrade a switch, the switch continues to operate while the new software is copied to Flash memory. If Flash memory has enough space, the new image is copied to the selected switch but does not replace the running image until you reboot the switch. If a failure occurs during the copy process, you can still reboot your switch by using the old image. If Flash memory does not have enough space for two images, the new image is copied over the existing one. Features provided by the new software are not available until you reload the switch.

If a failure occurs while copying a new image to the switch, and the old image has already been deleted, refer to the "Recovering from Corrupted Software" section in the "Troubleshooting" chapter of the Catalyst 3550 Multilayer Switch Software Configuration Guide.

Determining the Software Version and Feature Set

The Cisco IOS image is stored as a .bin file in a directory that is named with the Cisco IOS release. A subdirectory contains the files needed for web management. The image is stored on the system board Flash device (flash:).

You can use the show version privileged EXEC command to see the software version that is running on your switch. The second line displays C3550-I5Q3L2 for the enhanced multilayer software image (EMI) or C3550-I9Q3L2 for the standard multilayer software image (SMI).

Note   Although the show version output always shows the software image running on the switch (Layer 2 only or Layer 2 and Layer 3), the model name shown at the end of this display is the factory configuration (SMI or EMI) and does not change if you upgrade the software image.

You can also use the dir filesystem: privileged EXEC command to see the directory names of other software images that you might have stored in Flash memory.

Determining Which Files to Use

The upgrade procedures in these release notes describe how to perform the upgrade by using a combined .tar file. This file contains both the Cisco IOS image file and the CMS files. You must use the combined .tar file to upgrade the switch through the CMS.

The .tar file is an archive file from which you can extract files by using the tar command. You also use the .tar file to upgrade the system by using the archive download-sw privileged EXEC command.

Table 3 lists the software filenames for this Cisco IOS release.

The Catalyst 3550 switch is supported by either the SMI, which provides Layer 2+ features and basic Layer 3 routing, or the EMI, which provides Layer 2+ features, full Layer 3 routing, and advanced services. All Catalyst 3550 Gigabit Ethernet switches are shipped with the EMI installed. Catalyst 3550 Fast Ethernet switches are shipped with either the SMI or the EMI installed. After initial deployment, you can order the Enhanced Multilayer Software Image Upgrade kit to upgrade the Catalyst 3550 Fast Ethernet switches from the SMI to the EMI.

Upgrading a Switch by Using CMS

You can upgrade switch software by using CMS. From the menu bar, select Administration > Software Upgrade. For detailed instructions, click Help.

Caution   If you are copying the crypto image to the switch, the bootloader can take up to 30 seconds to upgrade. Do not power cycle the switch while you are copying the image to the switch. If a power failure occurs when you are copying the image, call Cisco Systems immediately.

Upgrading a Switch by Using the CLI

This procedure is for copying the combined .tar file to the Catalyst 3550 switch. You copy the file to the switch from a TFTP server and extract the files. You can download an image file and replace or keep the current image. This procedure requires a configured TFTP server.

Caution   If you are copying the crypto image to the switch, the bootloader can take up to 30 seconds to upgrade. Do not power cycle the switch while you are copying the image to the switch. If a power failure occurs when you are copying the image, call Cisco Systems immediately.

To download software, follow these steps:

Step 2   Download the software image file.

http://www.cisco.com/public/sw-center/sw-lan.shtml

http://www.cisco.com/public/sw-center/sw-lan.shtml

To download the SMI and EMI files, select Catalyst 3550 software.

To obtain authorization and to download the crypto software files, select Catalyst 3550 3DES Cryptographic Software.

Step 3   Copy the image to the appropriate TFTP directory on the workstation, and make sure the TFTP server is properly configured.

For more information, refer to Appendix B in the Catalyst 3550 Multilayer Switch Software Configuration Guide.

Step 4   Log in to the switch through the console port or a Telnet session.

Step 5   Check your VLAN 1 configuration by using the show interfaces vlan 1 privileged EXEC command, and verify that VLAN 1 is part of the same network as the TFTP server. (Check the Internet address is line near the top of the display.)

Step 6   Download the image file from the TFTP server to the switch. If you are installing the same version of software that is currently on the switch, overwrite the current image by using this privileged EXEC command:

The /overwrite option overwrites the software image in Flash memory with the downloaded one.

The /reload option reloads the system after downloading the image unless the configuration has been changed and not been saved.

For //location, specify the IP address of the TFTP server.

For /directory/image-name.tar, specify the directory (optional) and the image to download. Directory and image names are case sensitive.

This example shows how to download an image from a TFTP server at 198.30.20.19 and to overwrite the image on the switch:

You can also download the image file from the TFTP server to the switch and keep the current image by replacing the /overwrite option with the /leave-old-sw option.

Upgrading with a Nondefault System MTU Setting

If the switch was running Cisco IOS Release 12.1(8)EA1c or earlier and you had used the system mtu global configuration command to configure a nondefault system maximum transmission unit (MTU) size on your switch, follow these steps to upgrade your switch to Cisco IOS Release 12.1(11)EA1 or later:

Step 2   If a system MTU size of greater than 2000 is configured on the Catalyst 3550-12T or Catalyst 3550-12G, use the system mtu global configuration command to set it to the maximum supported MTU size.

---

Note    The maximum allowable system MTU for Catalyst 3550 Gigabit Ethernet switches is 2000 bytes; the maximum system MTU for Fast Ethernet switches is 1546 bytes.

---

Step 3   Save the running configuration by entering the copy running-config startup-config privileged EXEC command.

Step 4   Reload the switch by using the new Cisco IOS software.

Step 5   When the switch comes back up with Cisco IOS Release 12.1(11)EA1 or later, reload the switch a second time by using the reload privileged EXEC command so that the system mtu command takes effect.

Recovering from Software Failure

If the software fails, you can reload the software. For detailed recovery procedures, refer to the "Troubleshooting" chapter in the Catalyst 3550 Multilayer Switch Software Configuration Guide.

Installation Notes

You can assign IP information to your switch by using these methods:

Using Express Setup to Configure a Switch

Express Setup is a browser-based program that you can use to set up and configure the switch. You assign the IP information so that the switch can connect to local routers and the Internet. The IP address is also required if you plan to further configure the switch.

You do not create a username with Express Setup. Express Setup provides the minimum configuration to configure a switch. To create a username for the switch, use the Cluster Management Suite (CMS) or the command-line interface (CLI).

Note   To use Express Setup, you must have Cisco IOS Release 12.1(14)EA1 or later running on your switch.

This section provides a quick step-by-step setup procedure for a standalone switch and includes these steps:

Caution   Do not start Express Setup when there are any devices connected to the switch or connect a switch that is already in Express Setup mode to any device other than the PC or workstation that is being used to configure it. The switch acts as a DHCP server during the Express Setup procedure, and only the PC or workstation connected to the switch after Express Startup is started should receive a DHCP address from the switch.

Before using Express Setup to configure a switch, refer to the switch hardware installation guide for this information:

Starting Express Setup

Before starting Express Setup, verify that the switch has passed POST. The SYST and STAT LEDs should be on and green if the switch has successfully passed POST. For information about troubleshooting a POST failure, refer to the switch hardware installation guide. You cannot start Express Setup until POST has completed.

Caution   Do not start Express Setup when there are any devices connected to the switch. The switch acts as a DHCP server during the Express Setup procedure, and only the PC or workstation connected to the switch after Express Startup is started should receive a DHCP address from the switch.

Follow these steps to start the Express Setup program:

Step 2   Press and hold the Mode button, as shown in Figure 1, until the four LEDs next to the Mode button turn green. This takes approximately 2 seconds.

Step 3   When the LEDs turn green, release the Mode button.

Note   If all of the Mode LEDs begin to blink after you have held the Mode button for 2 seconds, a configuration already exists on the switch, and the switch cannot go into Express Setup mode. Release the button. For more information, see the "Clearing the Switch IP Address and Configuration" section .

Caution   If you continue to hold the mode button for 8 more seconds, the switch configuration is deleted, and the switch reloads.

Step 4   Connect the Ethernet cable (not included) to a 10/100 Ethernet port on the front panel of the switch, as shown in Figure 2.

Caution   Do not connect the switch to any device other than the PC or workstation being used to configure it.

Step 5   Connect the other end of the cable to the Ethernet port on the PC or workstation.

Verify that the port status LEDs on both connected Ethernet ports are green.

Step 6   Wait approximately 30 seconds after the port LEDs turn green, and launch a web browser on your PC or workstation.

Step 7   Enter the IP address 10.0.0.1, as shown in Figure 3, in the browser, and press Enter.

The Express Setup home page appears, as shown in Figure 4.

If the Express Setup does not run, or the Express Setup home page does not appear in your browser:

If not, wait 30 seconds and re-enter 10.0.0.1 in the browser, and press Enter.

Re-enter 10.0.0.1 in the browser, and press Enter.

If not, reconnect the cable to the Ethernet port on the switch and PC or workstation. Wait 30 seconds before entering 10.0.0.1 in the browser.

If not, make sure that only the SYST and STAT LEDs are green before pressing the Mode button to begin Express Setup.

Note   The rest of this section explains how to configure a switch by using the Express Setup web page. To configure the switch by using the CLI-based setup program, refer to the "Setting Up the Catalyst 3550 Initial Configuration" section.

Configuring the Switch Settings

The Management Interface field displays VLAN1-Default. This is the management interface through which you manage the switch and to which you assign IP information.

Follow these steps to configure your switch with Express Setup:

Step 2   Enter the IP address of the switch in the IP Address field.

Step 3   Click the drop-down arrow in the IP Subnet Mask field, and select an IP Subnet Mask.

Step 4   Enter the IP address for the default gateway in the Default Gateway field.

A gateway (router or dedicated network device) is a system that connects a network on one subnet to one or more networks on a different subnet.

Note   You must specify a default gateway if the management workstation and the switch are on different IP segments.

Step 5   Enter your password in the Switch Password field.

The password can be from 1 to 25 alphanumeric characters, can start with a number, is case sensitive, allows embedded spaces, but does not allow embedded spaces at the beginning or end.

Step 6   Enter your password again in the Confirm Switch Password field.

You do not enter a username for the switch. After the switch is configured with an IP address, you can use CMS to configure a username.

Step 7   (Optional) Enter a host name for the switch in the Host Name field. The host name is limited to 31 characters; embedded spaces are not allowed.

Step 8   (Optional) Enter the name of your system contact in the System Contact field. This identifies the system administrator for the switch or network.

Step 9   (Optional) Enter your system location in the System Location field. This identifies the physical location of the switch.

Step 10   (Optional) Click Enable in the Telnet Access field if you are going to use Telnet. If you enable Telnet access, you must enter a Telnet password:

Step 11   (Optional) Click Enable to configure Simple Network Management Protocol (SNMP). Enable SNMP only if you plan to manage switches by using Cisco Works or another SNMP-based network-management system.

If you enable SNMP, you must enter a community string in either the SNMP Read Community field, the SNMP Write Community field, or both. SNMP community strings authenticate access to MIB objects. Embedded spaces are not allowed in SNMP community strings. If you set the SNMP read community, users can access MIB objects, but cannot modify them. If you set the SNMP write community, users can access and modify MIB objects.

Step 12   Click Save to save your settings to the switch, or click Cancel to clear your settings.

After you save your settings, the switch exits Express Setup mode.

Your switch is now configured with the new IP address. You can install the switch in your production network.

Verifying Switch IP Address (Optional)

After you have installed the switch in your network, follow these steps to verify the IP address configured on your switch:

Step 2   Enter the IP address of your switch (for example: 172.20.139.142.) The switch home page appears, as shown in Figure 5.

ReRunning Express Setup

If you did not click Save at the end of the "Configuring the Switch Settings" section section, you can rerun Express Setup by clicking Express Setup on the Switch home page.

If you have entered a wrong IP address or need to change the IP address of your switch, you can clear the IP address on your switch by following the steps in the "Clearing the Switch IP Address and Configuration" section .

Clearing the Switch IP Address and Configuration

If you have configured a new switch with a wrong IP address, or all the switch LEDs start blinking when you are trying to enter Express Setup mode, you can clear the IP address that is configured on the switch.

Note   This procedure clears the IP address and all configuration information stored on the switch. Do not follow this procedure unless you want to completely reconfigure the switch.

To clear the IP address and the switch configuration information, follow these steps:

The switch LEDs begin blinking after about 2 seconds.

Step 2   Continue holding down the Mode button. The LEDs stop blinking after 8 additional seconds, and then the switch reboots.

Note   These steps only work on a previously configured switch.

Where to Go Next

After you have saved your configuration to the switch, you can install the switch (refer to the switch hardware installation guide) or further configure it (refer to the switch software configuration guide).

Setting Up the Catalyst 3550 Initial Configuration

The first time that you access the switch, it runs a setup program that prompts you for an IP address and other configuration information necessary for the switch to communicate with the local routers and the Internet. This information is also required if you plan to use the CMS to configure and manage the switch.

Note   If the switch will be a cluster member managed through the IP address of the command switch, it is not necessary to assign IP information or a password. If you are configuring the switch as a standalone switch or as a command switch, you must assign IP information.

Follow these steps to create an initial configuration for the switch:

Step 2   Enter a host name for the switch, and press Return.

On a command switch, the host name is limited to 28 characters; on a member switch to 31 characters. Do not use -n, where n is a number, as the last character in a host name for any switch.

Step 3   Enter a secret password, and press Return.

The password can be from 1 to 25 alphanumeric characters, can start with a number, is case sensitive, allows spaces, but ignores leading spaces.

Step 4   Enter an enable password, and press Return.

Step 5   Enter a virtual terminal (Telnet) password, and press Return.

The password can be from 1 to 25 alphanumeric characters, is case sensitive, allows spaces, but ignores leading spaces.

Step 6   (Optional) Configure Simple Network Management Protocol (SNMP) by responding to the prompts.

Step 7   Enter the interface name (physical interface or VLAN name) of the interface that connects to the management network, and press Return. For this release, always use VLAN 1 as that interface.

Step 8   Configure the interface by entering the switch IP address and subnet mask and pressing Return:

Step 9   Enter Y to configure the switch as the cluster command switch. Enter N to configure it as a member switch or as a standalone switch.

If you enter N, the switch appears as a candidate switch in the CMS. In this case, the message in Step 10 is not displayed.

Step 10   Assign a name to the cluster, and press Return.

The cluster name can be 1 to 31 alphanumeric characters, dashes, or underscores.

The initial configuration appears:

Step 11   These choices appear:

Make your selection, and press Return.

After you complete the setup program, the switch can run the created default configuration. If you want to change this configuration or want to perform other management tasks, use one of these tools:

New Software Features

Cisco IOS Release 12.1(19)EA1 has these new features or enhancements:

Note   IP refers to IP version 4 (IPv4). Layer 3 IP version 6 (IPv6) packets are treated as non-IP packets.

---

Note    CMS is downloaded to your browser each time you launch CMS. You can increase the speed at which CMS loads by permanently installing CMS on your PC or workstation. Select CMS > Installation and Distributions, and click Install. CMS will be installed locally and load faster the next time that you launch it.

---

---

Note    This release uses a CMS plug-in (Windows only) that replaces the Java plug-in. You must download the CMS plug-in to run CMS for this release. You can download the plug-in from this URL: http://www.cisco.com/pcgi-bin/tablebuild.pl/CMS-Plug-In-Win-1-0

---

For more information about new CMS features, click Help > What's New from the online help.

For a detailed list of key features for this software release, refer to the Catalyst 3550 Multilayer Switch Software Configuration Guide.

Upgrading Software and 802.1X

In Cisco IOS Release 12.1(14)EA1, the implementation for 802.1X changed from the previous release. Some global configuration commands became interface configuration commands, and new commands were added.

If you have 802.1X configured on the switch and you upgrade to Cisco IOS Release 12.1(14)EA1 or later, the configuration file will not contain the new commands, and 802.1X will not operate. After the upgrade is complete, make sure to globally enable 802.1X by using the dot1x system-auth-control global configuration command. For more information, refer to the software configuration guide for this release.

Upgrading Software and DHCP Option-82

In Cisco IOS Release 12.1(19)EA1, the implementation for the Option-82 Subscriber Identification changed from the previous release. The new option-82 format uses a different circuit ID and remote ID suboption, vlan-mod-port. The previous version uses the snmp-ifindex circuit ID and remote ID suboption.

If you have option-82 configured on the switch and you upgrade to Cisco IOS Release 12.1(19)EA1 or later, the option-82 configuration is not affected. However, when you globally enable DHCP snooping on the switch by using the ip dhcp snooping global configuration command, the previous option 82 configuration is suspended, and the new option 82 format is applied. When you globally disable DHCP snooping on the switch, the previous option-82 configuration is re-enabled.

To provide for backward compatibility, you can select the previous option 82 format by using the ip dhcp snooping information option format snmp-ifindex global configuration command when you enable DHCP snooping. When DHCP snooping is globally enabled, option-82 information (in the selected format) is only inserted on snooped VLANs.

For more information about using the previous version of option-82 without enabling DHCP snooping, see the software configuration guide for this release.

Limitations and Restrictions

You should review this section before you begin working with the switches. These are known limitations that will not be fixed, and there is not always a workaround. Some features might not work as documented, and some features could be affected by recent changes to the switch hardware or software.

These are the limitations and restrictions:

Cisco IOS Limitations and Restrictions

These limitations apply to Cisco IOS configuration:

After updating a multicast boundary, the workaround is to use the clear ip mroute privileged EXEC command to delete any existing multicast routes that violate the updated boundary. (CSCdr79083)

The workaround is to make sure that you configure the DHCP server with reserved leases that are bound to each switch by the switch hardware address. (CSCds55220)

When you remove an EtherChannel group, enter the no shutdown interface configuration command on the interfaces that belonged to the port group to bring them back on line. (CSCdt10825)

The workaround is to not configure the switch to operate with more than the maximum number of supported multicast routes. You can use the show sdm prefer and show sdm prefer routing privileged EXEC commands to view approximate maximum configuration guidelines for the current SDM template and the routing template. (CSCdt63354)

The workaround is to disable the Port Aggregation Protocol (PAgP) on both devices by using the channel-group channel-group-number mode on interface configuration command. PAgP negotiation between these two devices is not reliable. (CSCdt78727)

The workaround is to remain within the documented recommended and supported limits. (CSCdt79172)

When the security hardware ACL matches a packet on input, the match uses the original DSCP value. For output security ACLs, the security ACL hardware should match against the final, possibly changed, DSCP value as set by the QoS hardware. Under some circumstances, a match to a security ACL in hardware prevents the QoS hardware from rewriting the DSCP and causes the CPU to use the original DSCP.

If a security ACL is applied in software (because the ACL did not fit into hardware, and packets were sent to the CPU for examination), the match probably uses the new DSCP value as determined by the QoS hardware, regardless of whether the ACL is applied at the input or at the output. When packets are logged by the ACL, this problem can also affect whether or not a match is logged by the CPU even if the ACL fits into hardware and the permit or deny filtering was completed in hardware.

To avoid these issues, whenever the switch rewrites the DSCP of any packet to a value different from the original DSCP, security ACLs should not test against DSCP values in any of their access control elements (ACEs), regardless of whether the ACL is being applied to an IP access group or to a VLAN map. This restriction does not apply to ACLs used in QoS class maps.

If the switch is not configured to rewrite the DSCP value of any packet, it is safe to match against DSCP in ACLs used for IP access groups or for VLAN maps because the DSCP does not change as the packet is processed by the switch.

The DSCP field of an IP packet encompasses the two fields that were originally designated precedence and type of service (TOS). Statements relating to DSCP apply equally to either IP precedence or IP TOS. (CSCdt94355)

This problem has been fixed in hardware on Catalyst 3550-24 switches with motherboard assembly number 73-5700-08 or later. To determine the board level on your switch, enter the show version privileged EXEC. Motherboard information appears toward the end of the output display. (CSCdv68158)

The workaround is to make sure that the management VLAN of all Catalyst 2900 XL or 3500 XL switches in the stack is set to VLAN 1. (CSCdv79737)

There is no workaround. (CSCdw27519)

The workaround is to ensure that the target host or the next-hop gateway to that host is in the ARP cache (for example, by using a ping command) before removing it from the SNMP configuration. Alternatively, disable all SNMP traps and informs before removing any hosts from the SNMP configuration. (CSCdw44266)

The workaround is to use the value 1 to represent module 0. (CSCdw71848)

The workaround is to configure the Catalyst 3550 switch for PVST by using the spanning-tree mode pvst global configuration command bridge, and then change it to MSTP by using the spanning-tree mode mst global configuration command. (CSCdx10808)

The workaround is to use the no switchport trunk allowed vlan interface configuration command on each trunk port to remove the allowed list for all the trunk ports. (CSCdx17189)

There is no workaround. However, we recommend that you reload the switch by using the reload privileged EXEC command. To avoid this problem, configure the system with fewer VLANs and fewer trunk ports, or use the switchport trunk allowed vlan interface configuration command to reduce the number of active VLANs on each trunk port. (CSCdx20106)

Checking for TCP flags and TCP/UDP port numbers using operators other than eq share some of the same hardware resources. The switch supports no more than six checks within a single policy map. An identical check repeated in multiple entries in the same policy map counts as a single instance. If this limit is reached during a TCP or UDP port number check, the software can often work around the problem by allocating extra entries in the TCAM. There is no workaround if the limit is reached during a check against the TCP flags in the packet. Similar checks in a port ACL applied to the same physical interface as the policy map also count toward the limit.

Because these resources are allocated on a first-come, first-serve basis, rearranging the order of ACLs within a policy map or the order of entries within a single ACL, placing the TCP flags checks as early as possible, might enable the policy map to be loaded into the hardware.

Similar limits apply for any combination of input VLAN maps, input router ACLs, output VLAN maps, and output router ACLs that share the same VLAN label. The switch supports eight checks for all features on the same VLAN label. When the limit is reached, the system might forward packets by using the CPU rather than through hardware, greatly reducing system performance. To determine the VLAN label assigned to a VLAN or interface on input or output, use the show fm vlan or show fm interface privileged EXEC commands. Then use the show fm vlan-label privileged EXEC command to determine which set of features (input VLAN map, input router ACL, output VLAN map, or output router ACL) share this label.

These are the workarounds:

If the other workarounds fail, avoid combining any check against the TCP flags with gt, lt, ne, or range checks within the policy map and port ACL configured on the interface or within the VLAN maps and router ACLs that share the same VLAN label. (CSCdx24363)

The workaround, when QoS rate limiting is configured on an interface, is to configure applied ACLs so that packets are not forwarded by the CPU or reduce the number of ACEs in the ACL so that it can fit into the TCAM. (CSCdx30485)

As a result, the link partner might shut down the port when it detects loopback packets, or MAC addresses might be learned on the wrong ports on upstream switches. The network might be unable to deliver packets to a few devices for up to 5 minutes after rebooting the Catalyst 3550-24-FX switch when:

This problem corrects itself after five minutes or when these devices transmit a broadcast or multicast packet, whichever comes first.

The workaround is to enable spanning tree in the network and to make sure that the Port Fast feature is disabled on all ports connected to the Catalyst 3550-24-FX switch. (CSCdx45558)

The workaround is to use the delete flash:vlan.dat privileged EXEC command to delete the corrupted VLAN database. Then reload the switch by using the reload privileged EXC command. (CSCdx19540)

There is no workaround. (CSCdx74914)

There is no workaround. (CSCdx80751)

There is no workaround. (CSCdx90515)

This happens because the MAC addresses for the original packets as well as the mirrored RSPAN packets are all learned on the tunnel VLAN, so the RSPAN traffic is no longer properly segregated on the tunneling switches.

The workaround is to not include any RSPAN VLANs in any Layer 2 Protocol tunnels unless the tunnel is dedicated to a single RSPAN VLAN. (CSCdy37188)

IP connectivity then exists between Router 1 and the switch. There is no IP connectivity between Router 2 and the switch.

The workaround is to configure another SVI with an IP address on the Catalyst 3550 switch that would be reachable from Router 2. (CSCdy82042)

There is no workaround. (CSCdz06305)

The workaround is remove the AC power supply, disconnect the Ethernet cable, and then reconnect the Ethernet cable. This ensures that the switch uses PoE. (CSCdz16265)

The workaround is to change the number of seconds between re-authentication attempts by using the dot1x timeout re-authperiod seconds global configuration command. (CSCdz38483)

There is no workaround. (CSCdz54043)

These are the workarounds:

This can occur if HSRP interface tracking is configured on another interface to track a tunnel interface, if the no interface command was entered before the HSRP tracking configuration was removed, or if the no standby tunnel0 global configuration command was entered on the other interface to disable tracking.

These are the workarounds:

There is no workaround. (CSCdz75459)

There is no workaround. (CSCdz87897)

The workaround is to configure the Catalyst 3550 Gigabit Ethernet interface with the spanning-tree portfast interface configuration command. (CSCea04746)

The workaround is to reset the switch MTU value to the default value or to configure the same MTU value on the switch, the authentication server, and the intermediate devices. (CSCea05682)

There is no workaround. (CSCea09786)

The workaround is to not perform a ping from one interface to another on the same switch. (CSCea19301)

The workaround is to not set an ARP timeout value lower than 120 seconds. (CSCea21674)

There is no workaround. (CSCea25658)

---

Note    The Cisco RPS 300 does not support the Catalyst 3550-24PWR switch.

---

Cluster Limitations and Restrictions

These limitations apply to cluster configuration:

CMS Limitations and Restrictions

These limitations apply to CMS configuration:

There is no workaround. (CSCdy36769)

---

Note    This error only occurs with Java plug-in 1.4.0.

---

There is no workaround. (CSCdy44189)

The workaround is to allow SSH and Telnet access through the vty lines by using the transport input ssh telnet and line vty 0 15 global configuration command. (CSCdz01037)

The workaround is to click once outside of the CMS window when CMS halts. (CSCdz72175)

There is no workaround. (CSCdz84255)

There is no workaround. (CSCea26211)

The workaround is to use Netscape 6.0 or later or use Internet Explorer to launch CMS on Windows 98. (CSCea27408)

The workaround is to close all browser sessions and then relaunch CMS. (CSCeb33995)

Important Notes

These are the important notes related to this Cisco IOS release:

Cisco IOS Notes

These notes apply to Cisco IOS configuration:

The result is that packets received on that physical port will be permitted or denied based on the port ACL action without regard to any permit or deny statements in any router ACL or VLAN map, while packets received on other physical ports in the VLAN will still be permitted or denied based on any router ACLs or VLAN maps applied to the VLAN. If the port ACL is applied to a trunk port, it overrides any other input ACLs applied to all VLANs on the trunk port.

If this message is displayed, the switch did not apply the ACL to the port. (CSCdx42414)

The workaround is to configure the port as a static access port. (CSCdz32330)

This message appears because the switch has run out of I/O memory and is unable to allocate a packet buffer to report the error. You can also verify if the switch runs out of I/O memory by using the show memory privileged EXEC command.

The workaround is to reconfigure the spanning tree to remove the loop. (CSCdz51522)

On a Catalyst 3550-24-FX switch, when you upgrade to Cisco IOS Release 12.1(13)EA1 or later, all ports are reset to half-duplex mode. This will cause a duplex setting mismatch if the switch is connected to another device operating in full-duplex mode. After upgrading to Cisco IOS Release 12.1(13)EA1 or later, you should configure the Catalyst 3550-24-FX switch to operate in full-duplex mode, if necessary. (CSCdz29482)

Cluster Notes

This note applies to cluster configuration:

The cluster setup privileged EXEC command and the standby mac-address interface configuration command have been removed from the CLI and the documentation because they did not function correctly.

CMS Notes

These notes apply to CMS configuration:

Read-Only Mode in CMS

CMS provides two levels of access to the configuration options. If your privilege level is 15, you have read-write access to CMS. If your privilege level is from 1 to 14, you have read-only access to CMS. In the read-only mode, some data is not displayed, and an error message appears when these switches are running these software releases:

In the Front Panel view or Topology view, CMS does not display error messages. In the Front Panel view, if the switch is running one of the software releases listed previously, the device LEDs do not appear. In Topology view, if the member is a Long-Reach Ethernet (LRE) switch, the customer premises equipment (CPEs) connected to the switch do not appear. The Bandwidth and Link graphs also do not appear in these views.

To view switch information, you need to upgrade the member switch software. For information about upgrading switch software, see the "Downloading Software" section.

Open Caveats

These are the open caveats with possible unexpected activity in this Cisco IOS release:

Open Cisco IOS Caveats

These are the severity 3 Cisco IOS configuration caveats:

If you create a policy map by using the policy-map policy-map-name global configuration command, enter the class class-map-name policy-map configuration command and then you immediately exit from the policy-map class configuration mode, the policy map does not show its class-map association.

The workaround is to configure another command (such as the police, trust, or set policy-map class configuration command) after entering the class class-map-name policy-map configuration command.

If the switch is configured to use the MSTP or Rapid-PVST+ protocol, the cross-stack UplinkFast (CSUF) transition reverts to slow convergence on switch stacks that are connected through Gigastack cables. CSUF works only in PVST mode.

There is no workaround.

When a community string is assigned by the cluster command switch, you cannot get any dot1dBridge MIB objects using a community string with a VLAN entity from a cluster member switch.

The workaround is to manually add the cluster community string with the VLAN entity on the member switches for all active VLANs shown in the show spanning-tree summary display. This is an example of such a change, where cluster member 3 has spanning-tree on vlan 1-3 and the cluster commander community string is public@es3.

When you are stacking Catalyst 3550 switches by using GigaStack GBICs, the links between the switches might not be up.

There is no workaround.

A port channel that is configured as untrusted for DHCP snooping has a set rate limit. If snooping occurs to one of its VLANs, the rate limit is not applied to the DHCP traffic that arrives on the port channel.

There is no workaround.

A port-based ACL (PACL) that is applied to an access port whose access VLAN has DHCP snooping enabled might deny traffic on another port. The SVI for the VLAN is configured with an IP helper-address, and the service DHCP is enabled. DHCP traffic on another access port with an access VLAN that is enabled for snooping might be denied, which causes both ports to lose DHCP bindings.

There is no workaround.

The MIB value for a GBIC port might not reflect its actual parameters. For example, the CISCO-STACK-MIB port-duplex MIB object has a value of auto, but the port has an SX GBIC, is link up, and is in full-duplex mode.

There is no workaround.

Open CMS Caveats

These are the severity 3 CMS configuration caveats:

CMS does not validate configuration values for STP port priority before applying them to the switch. When invalid values are applied, the attempt fails silently without a warning message. This applies to all switches running Cisco IOS 12.1 or later.

There is no workaround. Make sure the input configuration values are valid.

CMS does not validate configuration values for STP port path cost before applying them to the switch. When invalid values are applied, the attempt fails silently without a warning message. This applies to all switches running Cisco IOS 12.1 or later.

There is no workaround. Make sure input configuration values are valid for the switch type.

CMS does not validate configuration values for STP bridge parameters before applying them to the switch. When invalid values are applied, the attempt fails silently without a warning message. This applies to all switches running Cisco IOS 12.1 or later.

There is no workaround. Make sure input configuration values are valid.

Sometimes a stack icon disappears from the topology view. This can occur if one of the stack members goes down or a stack member is disconnected from the stack.

The workaround is to close the CMS browser and launch CMS again.

When using CMS in read-only mode, an error is reported if help is launched from the QoS Graph dialog box.

There is no workaround.

CMS does not apply shaped bandwidth weights that are invalid. Shaped weights are invalid if the sum of their reciprocals is greater than 1 and the weight of a queue is zero.

There is no workaround.

When you change the Spanning Tree Protocol (STP) port priority on a switch that is running Cisco IOS Release 12.1(19)EA1 or later, the values must be in the range of 0 to 240 and in increments of 16. If you enter a value that is not an increment of 16, the configuration fails, and no error message appears.

The workaround is to enter values from 0 to 240 that are in increments of 16.

If UplinkFast is enabled and you enter a value in the Path Cost field in the STP Modify Port Parameters window, 3000 is automatically added to the configured-STP cost value. For example, if the path cost is 10, the actual value becomes 3010. If you disable UplinkFast, the path-cost value changes to its originally configured value of 10.

You cannot attach or remove an access control list (ACL) to or from an interface when you are in Guide Mode.

The workaround is to use Expert Mode to attach or remove an ACL to or from an interface.

CMS does not recognize the CWDM SFP on the Catalyst 2940 switches, even though the CWDM SFP is supported by the switches.

There is no workaround

When you launch the IP Multicast wizard, multicast-enabled devices do not appear in the list of multicast-enabled devices.

There is no workaround. The wizard does not display multicast-enabled devices.

When you right-click on a Catalyst 3750 switch in the Front Panel view, these pop-up menu options do not appear:

The workarounds are to select these menu options from the feature bar:

Running pop-up blocking software with a browser prevents CMS from loading.

The workaround is to disable the pop-up blocking software before launching CMS.

When you click the Highlight VLAN Port Membership Modes button in the VLAN window of a switch whose front panel is not displayed in Front Panel view, CMS brings the Front Panel view to the foreground, but the Front Panel view of the switch is not displayed, and you cannot see the highlighted ports.

Use one of these workarounds:

When you click Previous instead of Finish in the Save Configuration window, the configuration for the interfaces is not applied to the member devices.

The workaround is to click the Finish button to apply the configuration to member devices. If you need to modify the configuration, you need to launch the configuration wizard again.

The IGMP Report Window does not list all the entries in the table.

There is no workaround.

Resolved Caveats

These are the caveats that have been resolved in this release.

Cisco IOS Caveats Resolved in Cisco IOS Release 12.1(19)EA1

These Cisco IOS caveats were resolved in Cisco IOS Release 12.1(19)EA1:

CMS now works when a switch runs the crypto software image and the vty lines are configured to use only SSH by using the transport input ssh line vty 0 15 interface configuration command.

When a QoS policy map is attached to an interface and you modify the class map that the policy is using, the previous class map information is now completely removed from the interface.

A switch with an EtherChannel now correctly load balances multicast traffic across the links in a channel.

When you enable an interface that is already up by using the no shutdown command, the switch no longer sends a linkdown trap with the locIfReason as up.

A Catalyst 3550-12G no longer logs the following syslog message on a semiregular basis when connected to a Catalyst 8500, a WS-X5550, a WS-U5534, or other Gigabit Ethernet interface:

%LINK-3-UPDOWN: Interface GigabitEthernet0/9, changed state to up

A Catalyst 3550 switch can now successfully pass Vine (Advanced Research Projects Agency) ARPA frames over bridge groups.

In the CISCO-STACK-MIB, the portDuplex object now shows the negotiated port duplex information.

When you specify the interface to attach to a policy map, the switch no longer logs this error message if a CoS is set in a QoS policy map without entering the trust dscp global configuration command:

00:15:41: Add/Modify 'set' action associated with class-map CLASS_UDP failed: Insufficient memory 00:15:41: %QM-4-UNEXPECTED_INTERNAL_QOS_CONDITION: Unexpected internal QoS condition. -Traceback= 47FD48 47A6CC 1E8EA0 1EE43C 1EE5A8 133078 1417F0 1C6440

Load sharing across multiple paths for a recursive route entry no longer fails.

CMS Caveats Resolved in Cisco IOS Release 12.1(19)EA1

These CMS caveats were resolved in Cisco IOS Release 12.1(19)EA1:

The Port Settings table no longer displays meaningless information in the columns for interface description and duplex cells. This problem occurred for some of the Catalyst 2820 and Catalyst 1900 switches.

When launching CMS in read-only mode, Java exceptions might have occurred. This behavior did not affect CMS functionality.

Documentation Updates

You can access all Catalyst 3550 documentation at this URL:

http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/index.htm

This section provides these updates to the product documentation:

These changes will be included in the next version of the documentation.

References to the Cisco Documentation CD-ROM

The documentation for the Catalyst 3550 switches incorrectly refers to the Cisco Documentation CD-ROM. The Catalyst 3550 switches no longer ship with this CD-ROM.

Additions to the Catalyst 3550 Multilayer Switch Software Configuration Guide

These are additions to the Catalyst 3550 Multilayer Switch Software Configuration Guide, "Getting Started with CMS" chapter:

http://www.cisco.com/public/sw-center/lan/java/1.4.1-02.html

Correction to the Software Configuration Guide and Command Reference

This is a correction for the Catalyst 3550 Multilayer Switch Software Configuration Guide and Catalyst 3550 Multilayer Switch Command Reference:

In this document, IP refers to IP version 4 (IPv4). Layer 3 IP version 6 (IPv6) packets are treated as non-IP packets.

Corrections to the Hardware Installation Guide

These are corrections for the Catalyst 3550 Multilayer Switch Hardware Installation Guide:

The CMS requirements as described in the "Managing the Switch by Using the Cluster Management Suite" chapter are no longer correct. Refer to the "Getting Started with CMS" chapter of the software configuration guide for the latest CMS requirements.

Related Documentation

These documents provide complete information about the switch and are available from this Cisco.com site:

http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/index.htm

You can order printed copies of documents with a DOC-xxxxxx= number from the Cisco.com sites and from the telephone numbers listed in the "Ordering Documentation" section.

Obtaining Documentation

Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems.

Cisco.com

You can access the most current Cisco documentation on the World Wide Web at this URL:

http://www.cisco.com/univercd/home/home.htm

You can access the Cisco website at this URL:

http://www.cisco.com

International Cisco websites can be accessed from this URL:

http://www.cisco.com/public/countries_languages.shtml

Documentation CD-ROM

Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which may have shipped with your product. The Documentation CD-ROM is updated regularly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual or quarterly subscription.

Registered Cisco.com users can order a single Documentation CD-ROM (product number DOC-CONDOCCD=) through the Cisco Ordering tool:

http://www.cisco.com/en/US/partner/ordering/ordering_place_order_ordering_tool_launch.html

All users can order annual or quarterly subscriptions through the online Subscription Store:

http://www.cisco.com/go/subscription

Ordering Documentation

You can find instructions for ordering documentation at this URL:

http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm

You can order Cisco documentation in these ways:

http://www.cisco.com/en/US/partner/ordering/index.shtml

Documentation Feedback

You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click Feedback at the top of the page.

You can send your comments in e-mail to bug-doc@cisco.com.

You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:

Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883

We appreciate your comments.

Obtaining Technical Assistance

For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, the Cisco Technical Assistance Center (TAC) provides 24-hour, award-winning technical support services, online and over the phone. Cisco.com features the Cisco TAC website as an online starting point for technical assistance.

Cisco TAC Website

The Cisco TAC website (http://www.cisco.com/tac ) provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The Cisco TAC website is available 24 hours a day, 365 days a year.

Accessing all the tools on the Cisco TAC website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a login ID or password, register at this URL:

http://tools.cisco.com/RPF/register/register.do

Opening a TAC Case

The online TAC Case Open Tool (http://www.cisco.com/tac/caseopen ) is the fastest way to open P3 and P4 cases. (Your network is minimally impaired or you require product information). After you describe your situation, the TAC Case Open Tool automatically recommends resources for an immediate solution. If your issue is not resolved using these recommendations, your case will be assigned to a Cisco TAC engineer.

For P1 or P2 cases (your production network is down or severely degraded) or if you do not have Internet access, contact Cisco TAC by telephone. Cisco TAC engineers are assigned immediately to P1 and P2 cases to help keep your business operations running smoothly.

To open a case by telephone, use one of the following numbers:

Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447

For a complete listing of Cisco TAC contacts, go to this URL:

http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml

TAC Case Priority Definitions

To ensure that all cases are reported in a standard format, Cisco has established case priority definitions.

Priority 1 (P1)—Your network is "down" or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.

Priority 2 (P2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.

Priority 3 (P3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.

Priority 4 (P4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.

Obtaining Additional Publications and Information

Information about Cisco products, technologies, and network solutions is available from various online and printed sources.

http://www.cisco.com/en/US/products/products_catalog_links_launch.html

http://www.ciscopress.com

http://www.cisco.com/go/packet

http://www.cisco.com/go/iqmagazine

http://www.cisco.com/en/US/about/ac123/ac147/about_cisco_the_internet_protocol_journal.html

http://www.cisco.com/en/US/learning/index.html

This document is to be used in conjunction with the documents listed in the "Related Documentation" section section.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO ORCCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, MGX, MICA, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, Stratm, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.

All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0304R)

This product includes code licensed from RSA Security, Inc. Some portions licensed from IBM are available at
http://oss.software.ibm.com/icu4j/

Copyright © 2001-2003 Cisco Systems, Inc. All rights reserved.