NetOps Field

After choosing AAA during a security review, we needed a migration plan that kept the existing source of login authentication. The target was a Catalyst 9200L on IOS XE 17.18.4 using local accounts, with no RADIUS or TACACS+ server. AAA was disabled. The VTY configuration was recalled as login local , pending confirmation. The proposal moves login authentication into AAA while retaining local accounts. It has not been applied or tested on the target switch.

On Catalyst 9200 switches, Install and Bundle modes have different boot dependencies. The mode determines which software files must stay in flash and how to approach upgrades and cleanup. Install mode boots from packages.conf and extracted .pkg files. Bundle mode boots a monolithic .bin image. Cisco recommends Install mode for Catalyst 9200 switches. Install and Bundle mode comparison Item Install Mode Bundle Mode Primary boot reference flash:packages.conf flash:<IOS-XE-IMAGE>.bin Required software files packages.conf and the referenced .pkg files The selected .bin image Mode shown by show version INSTALL BUNDLE Upgrade approach IOS XE install workflow Boot-variable change to another BIN image and reload Cisco recommendation for C9200 Recommended Supported, but not the recommended op...

On Catalyst 9200 switches in Install mode, install remove inactive frees flash by removing unused installation files. Plan its timing around the image transfer and the committed software state. The command scans the installation directory, identifies packages in use, and lists files for deletion. That list can include BIN images. A newly copied image that has not been added can therefore be deleted during cleanup. Before removing software files, confirm how the switch boots. See Cisco Catalyst 9200 Install Mode vs Bundle Mode Explained for the files required by each mode. What install remove inactive removes install remove inactive The switch checks the active packages.conf and its package set to identify software files the running installation does not require. Depending on the files and install state, candidates include: Inactive package files from an older or incomplete installation Unused provisioning or configuration files IOS XE .bin image files stored in fla...

After Catalyst C9200L and C9300L switches were upgraded from IOS XE 17.9.4a to 17.18.4, an existing access-control system could no longer connect over SSH. The switches were operating normally and console access still worked. The failure was in SSH negotiation between the access-control tool and the switch. Environment Cisco Catalyst C9200L Cisco Catalyst C9300L Previous IOS XE version: 17.9.4a Upgraded IOS XE version: 17.18.4 SSH connection initiated through an existing access-control system The same access-control system had connected successfully before the upgrade. SSH failure before authentication After the upgrade, its SSH sessions failed before authentication completed. The switch logged: %SSH-3-NO_MATCH: No matching kex algorithm found The detailed log identified a Key Exchange (KEX) mismatch. The client offered: diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie-hellman-group-exchange-sha1 diffie-hellman-group...

During an IOS XE upgrade on a standalone Catalyst 9200L, the combined install command stopped with: Super package already added. Add operation not allowed. An earlier Add operation had already extracted the packages onto the switch, so another Add attempt was rejected. The message alone did not establish that the image was corrupt. The upgrade continued with install activate , checks after reload, and install commit . The target release was running in Install mode, with final state C (Activated and Committed). If you need to confirm why this workflow uses packages.conf and install commands, see Cisco Catalyst 9200 Install Mode vs Bundle Mode Explained . Environment Platform: Cisco Catalyst C9200L-24P-4G Topology: Standalone switch Starting release: Cisco IOS XE 17.9.4a Target release: Cisco IOS XE 17.18.4 Boot mode: Install mode Image transfer method: TFTP to local flash Hostnames, IP addresses, MAC addresses, serial numbers, and site-specific timestamps ...