NetOps Field

A Catalyst 9300 stack lost its Standby BFD session for about one second. The log reason was DETECT TIMER EXPIRED , the session came back on its own, and the Main path carried traffic the whole time. The cause is still unknown. This post records what was checked, what each check could and could not show, and what to capture if it happens again. A different incident on the same platform family, with the reason ECHO FAILURE , is covered in Cisco Catalyst 9300 BFD Echo Failure: Troubleshooting Session Flaps and Restoring Stability . The two are separate incidents, and nothing from that case is applied here. Network environment The environment is de-identified and simplified. Two sites are joined by a Main and a Standby carrier circuit. Static routes depend on BFD, so a BFD session that goes Down can pull its route out of the routing table. For configuration order and verification of this design, see Cisco Catalyst 9300 HQoS and Static BFD: Configuration Order and Verification . Illust...

A few users on one office floor reported that the network was down. Their PCs could not ping the default gateway. The switch port facing the unmanaged hub they were plugged into was in the err-disabled state. This post covers how the problem was isolated, what the switch can and cannot tell you about the cause, and which Catalyst features limit the damage when an unmanaged hub misbehaves. Quick Summary Observed: 3 to 5 users in one area lost network access. The gateway was unreachable from their PCs. The access switch port connected to their hub was err-disabled. Fix that worked: Unplug every device from the hub, keep only the uplink, clear the err-disabled state, then reconnect the devices one at a time and watch the port. Not recorded: The exact err-disable reason was not captured, and the switch software version was not noted. This post does not claim a root cause for that incident. Why it matters: A hub cannot be monitored or protected, so the switch port it hang...

A physical link can stay up and exchange BFD Control packets while the BFD session flaps because its Echo path fails. In this Catalyst 9300 case, Echo transmit counters increased while receive counters stayed at zero. Disabling Echo on the affected interface restored session stability. The cause of Echo packet loss remained unconfirmed. Conceptual symptom: BFD Control is received while the Echo return path fails. This diagram does not identify where packets are lost. Environment Item Environment Platform Cisco Catalyst 9300 Deployment Stack Headquarters IOS XE 17.12.5 Branch IOS XE 17.18.4 Affected function BFD Echo Operational workaround Disable BFD Echo on the affected interface For a separate guide covering configuration order and verification for Catalyst 9300 BFD deployments, see Cisco Catalyst 9300 HQoS and Static BFD: Configuration Order and Verification . Observed symptoms BFD Control packets were received. BFD Echo transmit counters increased. BFD Echo receive counters r...

For a bandwidth-limited Catalyst 9300 hub-and-branch link, review where traffic is classified and queued, and which static routes depend on BFD. A configured policy and an Up neighbor do not establish the complete forwarding result. These independent configuration examples use Cisco's IOS XE 17.18.x documentation; they are not completed lab results. Check the exact SKU, maintenance release, interface type, licenses, and existing policies. Another model's working configuration does not establish compatibility.

The marker 5 in Nexus username ... password ? help does not identify the IOS/IOS XE MD5 implementation. The Nexus 9000 NX-OS 10.2(x) command reference describes input format, while the security guide identifies SHA-256 for local-user passwords. Interpret the marker with its OS, release, command, and stored representation. [1] [2] 1. The reported password-type options During a local-account review on a device reported as NX-OS 10.2(5), CLI help offered 0 and 5 . The question was whether Type 5 meant the same thing as in IOS. This is a documentation investigation, not a lab reproduction or password migration. The hardware model and full release suffix were not supplied. The findings apply to Nexus 9000 documentation: Cisco names the maintenance release 10.2(5)M and maintains command guidance for 10.2(x). The release notes list no new software features in 10.2(5)M. Check other Nexus families separately. [3] 2. Input format, stored value, and algorithm Tables scroll horiz...

After choosing AAA during a security review, we needed a migration plan that kept the existing source of login authentication. The target was a Catalyst 9200L on IOS XE 17.18.4 using local accounts, with no RADIUS or TACACS+ server. AAA was disabled. The VTY configuration was recalled as login local , pending confirmation. The proposal moves login authentication into AAA while retaining local accounts. It has not been applied or tested on the target switch.

A security review required AAA on a Cisco device. The administrator asked why the existing management setup needed aaa new-model . We asked the security team which records they needed. Their concern was administrative access and activity, so we examined whether the existing logging features could meet the requirement. The documented coverage of login and configuration-change logs addressed parts of it. The unresolved requirement was evidence of prohibited command attempts and their authorization outcome. That requirement led us to choose AAA. Enabling aaa new-model alone does not establish that the required audit records are generated or retained.

On Catalyst 9200 switches, Install and Bundle modes have different boot dependencies. The mode determines which software files must stay in flash and how to approach upgrades and cleanup. Install mode boots from packages.conf and extracted .pkg files. Bundle mode boots a monolithic .bin image. Cisco recommends Install mode for Catalyst 9200 switches. Install and Bundle mode comparison Item Install Mode Bundle Mode Primary boot reference flash:packages.conf flash:<IOS-XE-IMAGE>.bin Required software files packages.conf and the referenced .pkg files The selected .bin image Mode shown by show version INSTALL BUNDLE Upgrade approach IOS XE install workflow Boot-variable change to another BIN image and reload Cisco recommendation for C9200 Recommended Supported, but not the recommended op...

On Catalyst 9200 switches in Install mode, install remove inactive frees flash by removing unused installation files. Plan its timing around the image transfer and the committed software state. The command scans the installation directory, identifies packages in use, and lists files for deletion. That list can include BIN images. A newly copied image that has not been added can therefore be deleted during cleanup. Before removing software files, confirm how the switch boots. See Cisco Catalyst 9200 Install Mode vs Bundle Mode Explained for the files required by each mode. What install remove inactive removes install remove inactive The switch checks the active packages.conf and its package set to identify software files the running installation does not require. Depending on the files and install state, candidates include: Inactive package files from an older or incomplete installation Unused provisioning or configuration files IOS XE .bin image files stored in fla...