NetOps Field

During an IOS XE upgrade on a standalone Cisco Catalyst 9200L switch, the standard one-shot install command did not proceed as expected. Instead, the switch returned this message: Super package already added. Add operation not allowed. The message did not mean that the new image was corrupt. It meant that the Add stage had already completed and the extracted packages were present on the switch. Repeating the Add operation was therefore rejected. In this case, the upgrade continued with install activate . After the reload and initial verification, install commit was run. The switch was running the target release, booting in Install mode, and the final install state was C , meaning Activated and Committed. This article documents the actual sequence, the flash-space observations, and the verification steps that prevented an unnecessary restart of the entire upgrade process. Environment Platform: Cisco Catalyst C9200L-24P-4G Topology: Standalone switch Starting releas...

During an internal vulnerability assessment, one of the requested remediation actions was to remove accounts that appeared to be unnecessary on a Cisco Nexus switch. While reviewing the configuration, I found that a username used for SNMPv3 also appeared as a local CLI user. My first assumption was that the SNMP identity and the administrative login account should be treated separately. That assumption came from Cisco IOS environments I had handled previously. Before deleting the account, I verified the behavior more carefully. Cisco NX-OS synchronizes SNMPv3 users with its security user database by default. Deleting what looks like an unused CLI account can therefore also remove the SNMP user and interrupt monitoring. Environment Platform: Cisco Nexus C93180YC-FX3 Software: Cisco NX-OS 10.6(1) Context: Internal vulnerability assessment and account cleanup Change status: No account was deleted All usernames, passwords, customer information, and environment-specific details ha...

When troubleshooting remote syslog on a Cisco Nexus switch, one of the most useful commands is: show logging server The command provides a quick view of how each remote syslog server is configured and whether the switch has detected any transmission problem. This article explains the main fields you should check and how to interpret them during troubleshooting. Why show logging server Is Useful A remote syslog configuration can look correct in the running configuration while still using the wrong VRF, severity level, facility, or destination. The show logging server command makes these values easier to verify in one place. The most useful fields are: Server status Server severity Server facility Server VRF Server port Server Status Cisco NX-OS can display different states for a configured remote syslog server. Cisco documents the following states: Configured - The syslog server configuration was accepted. No errors found - Syslog...

During a routine configuration review in a newly assigned network environment, I noticed that syslog messages from a Cisco Nexus switch were not appearing on the NMS. The switch itself was reachable through the management network, so the basic management path initially appeared to be working. However, when I checked the remote syslog configuration, I found an inconsistency between the management routing path and the VRF used by the syslog servers. This became the starting point of the troubleshooting process. Environment The device was a Cisco Nexus 9000 Series switch using the dedicated management interface for out-of-band management. Management interface: mgmt0 Management routing: management VRF Remote syslog transport: UDP 514 Remote syslog severity: notifications Remote syslog facility: local7 NTP was also configured through the same management interface and management VRF, and NTP communication was working normally. ntp server <NTP-SERVER-IP...