3850 Stack and Stack Priority

Hi,
Question regarding a Cisco 3850 & Stack .
I´ve two 3850 switches stacked.
sh switch
Switch/Stack Mac Address : c025.5cb9.1b80 - Local Mac Address
Mac persistency wait time: Indefinite
                                             H/W   Current
Switch#   Role    Mac Address     Priority Version State
*1       Active   c025.5cb9.1b80     1      J0      Ready
2       Standby c025.5cb7.c480     1      J0      Ready
Now I will change the priority from switch 1 from 1 to 15 but I can´t do this:
(config)#switch 1 ?
provision Configure Switch provision / offline confi NMTSL3CORE1
I can´t use the command : switch 1 priority 15 as exmaple . Why ?
Thanks for help.
Cheers

See below :
sh ver
Cisco IOS Software, IOS-XE Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version 03.03.01SE RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Thu 05-Dec-13 10:15 by prod_rel_team
ROM: IOS-XE ROMMON
BOOTLDR: CAT3K_CAA Boot Loader (CAT3K_CAA-HBOOT-M) Version 1.2, RELEASE SOFTWARE (P)
NMTSL3CORE1 uptime is 2 hours, 57 minutes
Uptime for this control processor is 2 hours, 59 minutes
System returned to ROM by reload at 11:53:48 CET Mon Dec 16 2013
System image file is "flash:packages.conf"
Last reload reason: reload
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
[email protected].
License Level: Ipbase
License Type: Permanent
Next reload license Level: Ipbase
cisco WS-C3850-24P (MIPS) processor with 4194304K bytes of physical memory.
Processor board ID FOC1737X0T4
4 Virtual Ethernet interfaces
56 Gigabit Ethernet interfaces
8 Ten Gigabit Ethernet interfaces
2048K bytes of non-volatile configuration memory.
4194304K bytes of physical memory.
250456K bytes of Crash Files at crashinfo:.
250456K bytes of Crash Files at crashinfo-2:.
1609272K bytes of Flash at flash:.
1609272K bytes of Flash at flash-2:.
0K bytes of Dummy USB Flash at usbflash0:.
0K bytes of Dummy USB Flash at usbflash0-2:.
0K bytes of at webui:.
Base Ethernet MAC Address          : c0:25:5c:b9:1b:80
Model Revision Number              : J0
Motherboard Revision Number        : C0
Model Number                       : WS-C3850-24P
Switch Ports Model              SW Version        SW Image              Mode
*    1 32    WS-C3850-24P       03.03.01SE        cat3k_caa-universalk9 INSTALL
     2 32    WS-C3850-24P       03.03.01SE        cat3k_caa-universalk9 INSTALL
Switch 02
Switch uptime                      : 58 minutes
Base Ethernet MAC Address          : c0:25:5c:b7:c4:80
Model Revision Number              : J0
Motherboard Revision Number        : C0
Model Number                       : WS-C3850-24P
Configuration register is 0x102
Cheers

Similar Messages

3850 Stack not displayed correctly in CiscoView 6.1

HI,
our customer installed lms 4.2, updated it to 4.2.5 and applied the Maintenance_Release_4_2_5_01_LNX. Its a fresh installation, so there are no previous data. After a discovery via SNMPv3 the 3850 (stacks with 2 or 3 units) show up in CiscoView but only one unit, the others are missing. When I take a look in the fan status, it displays the fan status of the other stack members, so the stack is recognized, but not displayed...
Installed Packages:
CiscoView version is 6.1.156
Cat3850.cv50.v1-0.zip (installed with the 4.2.5 update)
Anybody got an idea how to fix this?
Thanks!

The reason why the C3850 switch stack is showing as standalone in LMS CiscoView is because
it's returning sysObjectID as standalone.
It should return as 1.3.6.1.4.1.9.1.1745 --cat38xxstack
While, if you poll it for sysObjectID, the Catalyst 3850 stack switches will be returning OID 1.3.6.1.4.1.9.1.1641.
This is an IOS bug "CSCul00003 - Incorrect Sys OID for Cat3850 Stack device".
Unless this bug is fixed, LMS will not be able to show it as stack device.
You can try to check if you can manually change the device identity to cat38xxstack from Inventory > add/edit device > edit identity.
Else we need to wait for the fix of this bug.
-Thanks
Vinod

Hosts no longer obtaining ip address on switch in 3850 stack

I have a six switch 3850 stack that has been in production for over a month now, and everything is running normal. Last week, hosts plugged into one of the switches stopped working, the hosts are not getting an IP address (this is access layer so PC's and phones). In addition, if I look at the MAC address table for a port, I am not seeing a MAC address.
All of them are running 03.03.03SE cat3k_caa-universalk9 .
I am thinking this is hardware related, only because on occasion I see the following messages in the logs:
Dec 17 12:21:18.052: %IOSXE-3-PLATFORM: MEMBER: 5 process fed: : -Traceback=1#88b11e4e26f5ac75f4f2f18f023e5220 :550E7000+3B9240 ngwcutils:2AF2C000+BE94 ngwcutils:2AF2C000+DA9C pthread:2E3C2000+5DC8
Also, I have a phone in a port on this switch for troubleshooting. When I removed the service-policy from the port to rebuild the port configuration, I received this message:
%FED_QOS_ERRMSG-3-QUEUE_BUFFER_HW_ERROR: MEMBER: 5 fed: Failed to allocate buffers for Gi5/0/1: code 18.

It could also be a software issue (bug). Open a ticket with TAC and send them the logs so they can help you resolve the issue.
HTH

3850 stack member has no mac address.

I have a strange issue where a member in my 3850 stack has no mac address. This occurred after at duplicate address was discovered on the management interface. We have reboot the switch but no luck. still the same. see below:
BTRBRGBB1535A_Stack1#sho sw de
Switch/Stack Mac Address : 5ca4.8a0c.2d80 - Local Mac Address
Mac persistency wait time: Indefinite
                                             H/W   Current
Switch#   Role    Mac Address     Priority Version State
*1       Active   5ca4.8a0c.2d80     1      V02     Ready
2       Member   0000.0000.0000     0      0       Provisioned
         Stack Port Status             Neighbors
Switch# Port 1     Port 2           Port 1   Port 2
1       DOWN       DOWN             None     None
Any help would be appriciated.

2 Member 0000.0000.0000 0 0 Provisioned
It's not "strange". It's a normal behaviour because the 2nd stack member hasn't joined the stack yet. It could be the that the 2nd stack member isn't powered up or it's not cabled properly.

4500 R+E with sup 8 vs. (3850 stack + 5508 WLC)

I got into discussion about upgrade our 3750 stack, 4404 WLC, less than 50 APs (APs spread out over MPLS WAN). I'm planning to get 4510 R+ E with 2 sup 8, but another opinion talked me down to 3850 stack with 5508 WLC. Basically, his argument is 3850 stack can do everything 4500 R+E can do, plus it's not hulky as 4500. My argument is I like unify access since sup 8 built in WLC and we don't have to get 5508. I know there're more 4500 R+E and respect his argument. Does anyone has input on these setup giving pricing is not much different between setup.
Thanks
Kevin

In my honest opinion, if you are posted this solution here, you are smelling something is off. I hate to be a bearer of bad news. It is.
We went through the same exercise 2 years ago. We wanted to upgrade our legacy 3750/3750G to 3750X and we found out that if we were to get a stack of four (or more ) 3750X, it is cheaper (much, much cheaper) to get a 4510R+E bundle (with Sup7E included) and associated line cards on top. Just to note, the 3750X and 3850 have the same price. The Sup7E and Sup8E have the same price.
Don't ask me why your consultant wanted you to get 3850. I am refraining myself putting two theories in here.

3850 stack problem - duplicate IP

I have a 3850 stack running ip services on version 03.02.03.SE of IOS-XE. I have multiple SVI's on the stack and getting duplicate ip address messages in the logs.
I have checked that the stack has come up properly and they are both reporting ready and are active/standby. I have recreated the stack a couple of times and each time its the same.
Any ideas? Bug maybe?

I have added this command on all the physical ports on both stacks. Still getting the duplicate address messages in the log.
Anything else I can look at? As I say, the stack looks fine and the IP addresses it is complaining about only exist on the SVI on the ipservices stack.
There is a newer version of IOS-XE that is recommended on the Cisco site. Should I go for this?

3850 Stack EIGRP Problem

I am seeing strange behavior from a 3850 stack running EIGRP to a couple of 4507's. Let me start out by saying that over the past couple of weeks, we have replaced 5 stacks using the same configuration template, code version, etc. with no issues. Before we execute the change to install these switches, we always run failover testing to prove routing. Last night, on the 6th switch stack, failover testing did not succeed. Maybe you can help me figure out why.
Here is what happened. I have a loopback configured on the stack. We connect the stack to each of the 4507's at the distribution layer and bring up an eigrp adjacency. I start a continuous ping from another site to the loopback. Then we pull the first link and the ping continues successfully. Plug it back in, bring up the adjacency. Then we pull the second uplink and the ping begins failing (TTL Lost in transit). The route at the source of the ping was lost so it was using the default route which led to nowhere. When I check the route against the table on the 4507's the subnet is not in the table but the adjacency is up.
I have attached a topology drawing of the relevant devices (as I see it). Again, we never experienced this issue with the 5 previous stacks which are all connected to the 4507's the same way.

Joshua
So you have equal cost paths on the 4507 to the loopback. You pull the first link and the ping continues because it still has one route. You reconnect the link and an adjacency is formed but no routes are passed from the 3850 to the 4500 and then when you pull the second link the only remaining routes is lost on the 4507 ?
When you plug the first link back in -
1) what do you see in the EIGRP topology tables on the 4507
2) You may need to run debugging on EIGRP to see what is happening from the 4500 and 3850 end
Jon

Up-link 2 x 3750 Stack to 4 x 3850 stack

All -
Sorry is this is a rather simple question but I’ve never worked with Stack switches before? I have a remote office that has 3 floors. On one floor we have a 2 3750s in a stack. On another we have a single 3560 and I’m going to be installing a new 3850 stack – the new stack will have 4 x 3850’s...
My question is how should I uplink the other switches to the new stack? In the new stack I have a master a slave and two member switches. Should I create a port channel from the 3750’s and use all available links and spread them across all switches in the new stack, and then do the same with the single switch on the other floor? Or should I create two port-channels from the 3750 and the 3560 to the new 3850 stack?
My thought is that if I create a single port channel form each switch to the new stack I would be basically be removing spanning tree from the environment and basically daisy chaining the switches? Is this a valid solution? Also does the stack act like a chassis where the control plan would be on the master – if so can I spread a interfaces in a port channel across all members in the stack?
Thanks in advance
Mike

Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
To take advantage of fewest (logical) devices and redundancy, run a dual Etherchannel from your new 3850 to the 3750 stack and the 3650. On both the 3850 and 3750 stacks, insure the same Etherchannel links are on different stack members.
Logically, you would no longer need STP, but keep in running in case anyone accidentally creates a L2 loop.
As to what stack members to terminate uplinks/downlinks on, on 3750s, Cisco recommends avoiding the stack master (not possible on your dual 3750 stack). I don't know what Cisco's recommendations, if any, is for 3850 stacks.
Yes, stacks "appear" much like chassis devices, i.e. stack member ports "appear" like chassis line cards ports.

SW-3850 stacking with different License Levels?

we will be decommissioning the 3750 that is uplinked to a 3850-48port and will be connecting a 3850-24port in full stack-wise and stack-power High availability mode………now it will have the same IOS but the License Level will be different….so my question is will the two switches become stackable with different License Levels?

Hi,
it so not possible stack two switches with different licence. You will have to order new license to be same on both switches.
Please read Q&A for 3850 switch. See link below question "What are the license requirements for a Cisco Catalyst 3850 switch stack?"
http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3850-series-switches/qa_c67-722110.html
HTH
Jan
Please rate answer if useful

3850 stack IOS upgrade

Hi,
Is it possible to upgrade the IOS on a cisco 3850 stack in a non disruptive way?
Reloading 1 switch at a time?
Or do you need to reload the entire stack at once, like a 3750 stack?

"And repeat the same command for the second switch"
You actually dont have to do this. First verify that you are in "INSTALL" mode by issuing a "show version." Once you have this file in your local flash, just run the following:
Switch#software install file flash:cat3k_caa-universalk9.SPA.03.02.02.SE.150-1.EX2.bin switch 1-2
**This will expand the .bin file onto your switch and ask you to reload. After reload, you will be on new version
+++++++++++++++++++++++++++
Here is a snippet from my lab – I ran through a quick upgrade from 3.2.0 to 3.2.2
+++++++++++++++++++++++++++
F340.04.23-3850-8#show ver
OS-XE Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version 03.02.00SE <-------- Version currently running
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Wed 09-Jan-13 21:50 by prod_rel_team
ROM: IOS-XE ROMMON
BOOTLDR: C3850 Boot Loader (C3850-HBOOT-M) Version 1.1, RELEASE SOFTWARE (P)
F340.04.23-3850-8 uptime is 1 minute
Uptime for this control processor is 4 minutes
System returned to ROM by reload
System image file is "flash:packages.conf"
Last reload reason: Reload command
License Level: Ipservices
License Type: Permanent
Next reload license Level: Ipservices
cisco WS-C3850-48P (MIPS) processor with 4194304K bytes of physical memory.
Processor board ID FOC1705V0T8
1 Virtual Ethernet interface
52 Gigabit Ethernet interfaces
4 Ten Gigabit Ethernet interfaces
2048K bytes of non-volatile configuration memory.
4194304K bytes of physical memory.
250456K bytes of Crash Files at crashinfo:.
1609272K bytes of Flash at flash:.
0K bytes of Dummy USB Flash at usbflash0:.
0K bytes of at webui:.
Base Ethernet MAC Address          : 24:01:c7:23:20:00
Motherboard Assembly Number        : 73-12241-08
Motherboard Serial Number          : XXXXXXXX
Model Revision Number              : A0
Motherboard Revision Number        : C0
Model Number                       : WS-C3850-48P
System Serial Number               : XXXXXXXX
Switch Ports Model              SW Version        SW Image              Mode
     1 56    WS-C3850-48P       03.02.00SE        cat3k_caa-universalk9 INSTALL <--- Mode
F340.04.23-3850-8#show flash
-#- --length-- ---------date/time--------- path
2   74410468 Feb 23 2013 21:42:02 +00:00 cat3k_caa-base.SPA.03.02.00SE.pkg
3    2773680 Feb 23 2013 21:42:02 +00:00 cat3k_caa-drivers.SPA.03.02.00.SE.pkg
4   32478044 Feb 23 2013 21:42:02 +00:00 cat3k_caa-infra.SPA.03.02.00SE.pkg
5   30393116 Feb 23 2013 21:42:02 +00:00 cat3k_caa-iosd-universalk9.SPA.150-1.EX.pkg
6   18313952 Feb 23 2013 21:42:02 +00:00 cat3k_caa-platform.SPA.03.02.00.SE.pkg
7   63402700 Feb 23 2013 21:42:02 +00:00 cat3k_caa-wcm.SPA.10.0.100.0.pkg
8       1218 Feb 23 2013 21:42:12 +00:00 packages.conf
9    2097152 Aug 28 2013 17:39:17 +00:00 nvram_config
10        616 Jul 30 2013 05:32:53 +00:00 vlan.dat
11 223734376 Aug 24 2013 08:30:12 +00:00 cat3k_caa-universalk9.SPA.03.02.02.SE.150-1.EX2.bin <--- IOS downloaded from cisco.com
1089032192 bytes available (450543616 bytes used)
F340.04.23-3850-8#software install file flash:cat3k_caa-universalk9.SPA.03.02.02.SE.150-1.EX2.bin switch 1-2 <---add as many switches as you have in the stack here
Preparing install operation ...
[1]: Starting install operation
[1]: Expanding bundle flash:cat3k_caa-universalk9.SPA.03.02.02.SE.150-1.EX2.bin
[1]: Copying package files
[1]: Package files copied
[1]: Finished expanding bundle flash:cat3k_caa-universalk9.SPA.03.02.02.SE.150-1.EX2.bin
[1]: Verifying and copying expanded package files to flash:
[1]: Verified and copied expanded package files to flash:
[1]: Starting compatibility checks
[1]: Finished compatibility checks
[1]: Starting application pre-installation processing
[1]: Finished application pre-installation processing
[1]: Old files list:
    Removed cat3k_caa-base.SPA.03.02.00SE.pkg
    Removed cat3k_caa-drivers.SPA.03.02.00.SE.pkg
    Removed cat3k_caa-infra.SPA.03.02.00SE.pkg
    Removed cat3k_caa-iosd-universalk9.SPA.150-1.EX.pkg
    Removed cat3k_caa-platform.SPA.03.02.00.SE.pkg
    Removed cat3k_caa-wcm.SPA.10.0.100.0.pkg
[1]: New files list:
    Added cat3k_caa-base.SPA.03.02.02.SE.pkg
    Added cat3k_caa-drivers.SPA.03.02.02.SE.pkg
    Added cat3k_caa-infra.SPA.03.02.02.SE.pkg
    Added cat3k_caa-iosd-universalk9.SPA.150-1.EX2.pkg
    Added cat3k_caa-platform.SPA.03.02.02.SE.pkg
    Added cat3k_caa-wcm.SPA.10.0.111.0.pkg
[1]: Creating pending provisioning file
[1]: Finished installing software. New software will load on reboot.
[1]: Committing provisioning file
[1]: Do you want to proceed with reload? [yes/no]: yes
[1]: Reloading
///////////// Reload
F340.04.23-3850-8#show ver
Cisco IOS Software, IOS-XE Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version 03.02.02.SE RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Fri 14-Jun-13 19:24 by prod_rel_team
ROM: IOS-XE ROMMON
BOOTLDR: C3850 Boot Loader (C3850-HBOOT-M) Version 1.1, RELEASE SOFTWARE (P)
         F340.04.23-3850-8 uptime is 1 minute
Uptime for this control processor is 7 minutes
System returned to ROM by reload
System image file is "flash:packages.conf"
Last reload reason: Reload command
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
[email protected].
License Level: Ipservices
License Type: Permanent
Next reload license Level: Ipservices
cisco WS-C3850-48P (MIPS) processor with 4194304K bytes of physical memory.
Processor board ID FOC1705V0T8
1 Virtual Ethernet interface
52 Gigabit Ethernet interfaces
4 Ten Gigabit Ethernet interfaces
2048K bytes of non-volatile configuration memory.
4194304K bytes of physical memory.
250456K bytes of Crash Files at crashinfo:.
1609272K bytes of Flash at flash:.
0K bytes of Dummy USB Flash at usbflash0:.
0K bytes of at webui:.
Base Ethernet MAC Address          : 24:01:c7:23:20:00
Motherboard Assembly Number        : 73-12241-08
Motherboard Serial Number          : XXXXXXXXXX
Model Revision Number              : A0
Motherboard Revision Number        : C0
Model Number                       : WS-C3850-48P
System Serial Number               : XXXXXXXXX
--More--                           Switch Ports Model              SW Version        SW Image              Mode
     1 56    WS-C3850-48P       03.02.02.SE       cat3k_caa-universalk9 INSTALL
+++++++++++++++++++++++++
Updating Cisco IOS XE Software
When the switch is in install mode, you can install any new Cisco IOS XE Software bundle by using the software Installcommand.
Note: This command works only when the Cisco Catalyst 3850 Switch is booted in install mode.
Reference:
http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps12686/deployment_guide_c07-727067.html#wp9000183

Catalyst 3850 Stack VLANs, layer 2 vs. layer 3 design question

Hello there:
Just a generic, design question, after doing much reading, I am just not clear as when to use one or the other, and what the benefits/tradeoffs are:
Should we configure the switch stack w/ layer 3, or layer 2 VLANs?
We have a Catalyst 3850 Stack, connected to an ASA-X 5545 firewall via 8GB etherchannel.
We have about 100 servers (some connected w/ bonding or mini-etherchannels), and 30 VLANs.
We have several 10GB connections to servers.
We push large, (up to) TB sized files from VLAN to VLAN, mostly using scp.
No ip phones, no POE.
Inter-VLAN connectivity/throughput and security are priorities.
Originally, we planned to use the ASA to filter connections between VLANs, and VACLs or PACLs on the switch stack to filter connections between hosts w/in the same VLAN.
Thank you.

If all of your servers are going to the 3850 then I'd say you've got the wrong switch model to do DC job. If you don't configure QoS properly, then your servers will start dropping packets because Catalyst switches have very, very shallow memory buffers. These memory buffers get swamped when servers do non-stop traffic.
Ideally, Cisco recommends the Nexus solution to connect servers to. One of the guys here, Joseph, regularly recommends the Catalyst 4500-X as a suitable (and financial) alternative to the more expensive Nexus range.
In a DC environment, if you have a lot of VM stuff, then stick with Layer 2. V-Motion and Layer 3 don't go hand-in-hand.

Has anyone deployed converged access with 3850 switches and 5760 WLCs?

Has anyone deployed a converged access network architecture with 3850 switches and 5760 WLCs? I have done lots of projects with the 5508 WLCs In a centralized deployment. Basically with this design, I manage 2 logical networks as the wireless network is an overlay over the wired network. I can design firewall to segregate traffic between the wired and wireless hence I can carry both staff and guest traffic.
Now Cisco is telling us that there is new design such that the dats plane traffic can be dropped locally through the 3850 switched. I am not sold on this and have not found any recommended best practices on when should we use a converged access architecture.
Pros
With converged access, data traffic is terminated at the MA which is on the switches, hence the WLC will not be a bottleneck? This is to prepare adoption for 802.11ac?
Less hops for voice calls from user A to user B as data control traffic is dropped locally.
Cons
Now how do I segregate guest and staff traffic if my security folks say I need a firewall?
Troubleshooting wireless client mobility will be a nightmare as the 3850 switches are MA.
Pushing and upgrading code for the Code will mean upgrading the stack of switches in the LAN riser. This will be painful in a huge campus environment like an university.
Can someone convince me why would a customer choose converged access?
Sent from Cisco Technical Support iPad App

They choose CA because of the capwap termination at the switch. You can still use a 5508 and tunnel guest to a DMZ segment if you wish. You will need a 5508 though is you want to tunnel traffic to an anchor WLC.
Sent from Cisco Technical Support iPhone App

Cisco 3850 Switch and Windows 7 IP Conflicts

Team,
Last evening (Christmas eve) we setup a pair of Cisco 3850 with IP Base version 3.3.35SE (recommended) and 3.7.0E (very latest).
We got these to replace a very old switch that had died. Attached to this network are windows 7 PC's with all the standard patches, service packs, etc.
with standard port configs - no PC would work - and in fact on each screen we got the windows 7 IP Conflict pop up box.
This seemed very odd to us, as we know these IP's are all static (no dhcp on this segment at all)
we went with a very vanilla config on each port
interface g1/0/1
switchport host
that is it - nothing special at all.
well, after hours of research we found the 3850 has a problem where its "ip device tracking" (even though disabled, by way of NOT being enabled on any interface) will effect the windows 7 PC's ip address in use detection port start up phase!
This is a very big problem. I am frankly SHOCKED Cisco would release a major switch that is going to not work when connected to the average network with windows 7 PC's.
we tried 3+ hours of prescribed work-arounds found when researching this issue -
ip device tracking probe delay 10 (global config)
ip device tracking max 0 (disabed, on interface)
finally,
nmsp attach suppress (interface, however this appears to be a default command in all IOS-XE versions we tried, as the command did NOT show in the show run) . this effected many different nic card vendors (laptops, desktops) and nic card drivers levels from old to very recent.
Finally,
we compared a 3850 in another location to this one - and we never got HIT by this problem before because that 3850 only as TRUNK ports and no windows 7 hosts directly attached.
Doing more research, I found out this also can effect vmware guests running windows SERVER.
this is now a huge issue as we have a scheduled deployment of 3850's throughout our network which is going to be put on hold.
the work-around I came up with which is not great is -
Make ALL the "access" ports connected to PC TRUNK ports and leave the NATIVE vlan (untagged) as the vlan you want the PC's to be in
interface g1/0/1
switchport mode trunk
switchport trunk native vlan 1
this is NOT an acceptable workaround as this presents security issues even with
switchport trunk allowed vlan 1, etc. as the only allowed vlan.
Note: this issue manifested itself and windows 7 PC's were UNABLE to use the network. if you do "ipconfig /all | more" you would see
192.168.0.140(duplicate) and the interface would actually use 169.254.0.239(duplicate) so the duplicate message appeared twice in the output.
1) With and without an SVI interface on each 3850 for the vlan where the windows 7 machines had a duplicate
2) when we had an SVI and the command ip device tracking probe use-svi (or whatever the hidden command is I forget now, but it took it)
3) when we had aaa new-model configured - and not configured - thinking this was some artifact of having aaa turn on something like 802.1x port state
4) when could confirm NO DHCP SNOOPING
5) when we DID not use static IP's - and had the switch assign DHCP addresses - the Windows 7 PC's STILL had duplicates and didnt work for their "Just leased" ip's.
6) when we could confirm ios-xe ip device tracking = disabled with show ip device tracking status, etc.
This is a major problem for this 3850 and unless we get a definitive answer on why this is happening and how we can rectify we are going to have to return our 3850's and get HP Procurve's something I would rather avoid doing. There is NO REASON I can imagine other than older switches who's ports default to ROUTED ports (i.e.. no ip switchport) where a switch should not at least function as a bare switch with essentially a default configuration out of the box.
Any ideas? I'm working well now with the ports ALL in trunking mode with vlan 1 native, but this is not a scalable workaround we can live with as we have security risks of a port not blocking certain vlans from going out ports to pc's, etc. that attackers could send tags on at that point, etc.
thanks,
Joe Brunner
#19366

thanks for replying - i'm not onsite (its a standalone network) - but here is what it is -
Answers in line -
This all stems from a switch replacement correct?
yes a 10 year old Allied Telesyn switch was replaced that had no config - like a hub, just used for connectivity.
Are these 3850's in a stack?
>yes, tested all aspects of the stack many times.
Does it have a managment ip address -If so, is it using the old switch ip address
>old switch had no ip - i made a "management interface" on vlan 1 - BUT no ip on the built-in management interface on the switch.
What are they connecting to? (a router/L3 switch/anohter switch- cisco-HP etc..)
>various other devices - only 1 link back to a single 3750x stack. that switch is "hardened" so to speak to reveal or propagate very little by design.
How are they connected( L3 interface/L2 trunk/access port)
>all ports are left in trunk mode with vlan 1 as the active and untagged port. this was the workaround done to ever get the switch going. in "out of the box" or default mode as we initially wanted (no config) links to windows 7 PC's didnt work. links to linux or other devices non-windows did work!
Are thse switches performing inter-vlan routing or just acting as host switches?
>dumb flat network, no routing.
Is ip routing enabled?
>not unless enabled on 3850 by default. I didnt type "ip routing"
Do you have multiple vlans in your network and if so ar ethe being propergated to these new switches?
Your 7 pcs = are they just client pcs not servers?
client PC's - no servers OS per say.
can you confirm something like ICS isnt enabled (Internet connection sharing) on any of them?
>yes not enabled.
Are the just using one NIC each?
> one machine is dual homed - but we know where its "second nic" goes - to another cisco network which is NOT connected back to this one. we traced all our ports a few times thinking even perhaps some small hub was "reflecting" traffic back to us - like a blackbox. Strangest thing -
default config out of the box - with ALL ports SHUTDOWN EXCEPT the single windows 7 facing port - the windows 7 machine STILL registered an IP CONFLICT when connected to the 3850 - even when it had NO SVI's!!! (i know mind numbing). if you disconnected the pc and connected it to an old cisco switch - it worked fine!!! wow.
sh switch
2 identical 3850's in working stack. power and network stacked. both at same version, etc - upgraded each time with "software install file flash:<long ios name>.bin
tested all power and general 3850 stacking. saw no issues.
sh int trunk
>all ports are now trunks (hence the workaround used to get it up).
has 20 trunks to PC's and some single connected switches (far away on fiber) - all allow only vlan 1 - no other vlans were created - very very simple network. vlan 1 is native
sh vlan brief
>just vlan 1 - no vlans created, checked this many times - had vlan 100 at one point - made sure it was gone over a period of hours.
sh vtp status
not setup - left complete default; no vtp domain set - connected to all switches in transparent model if a switch connection exists.
sh cdp neighbours
cant post (for god and country LOL) but there is one link back to our "core" so to speak - that switch is hardened not to allow any settings to slip over to new switches so hence no vtp, cdp is one to help troubleshooting.
sh ip route
just the L and C routes for the vlan 1 ip address 192.168.17.1/24
no static routes
no vlan interfaces other than int vlan 1
no ip address on g0/0/0 -> the default 3850 management interface hard assigned to the 3850 VRF you cant remove.
int g0/0/0
ip vrf forwarding Switch_Mgmt
i can get over there if you think of anything else key to show the group.
thanks,
Joe

Cisco 3850 SSO and NSF failover time

Dear Member,
I m trying to setup a network with few second fail-over with Cisco 3850 stack, C3850 support SSO and NSF on OSPF.
However, when the Master fails, Slave take up the role and re-learn routing information and around 10 sec to fail-over.
May any brothers have this experience and 10 sec fail-over should be the normal behavior or can be enhance?
Attach diagram for reference.
Regards
Russ

Great, adding the following command and only have 1 ping loss with end to end.
=========================
Stack-mac persistent timer 0
router ospf 1
nsf cisco enforce global
========================

Role , Menu and Display Priority

I have a Role A with a menu sequence, Sort Priority 100
and a Role B with another menu sequence Priority 50
User is having role A and B
But B is displayed in the navigation before A.
How can I influence the display sequence?

Hello Holger,
I had done this job successful.
In my opinion, workset was used for first level menu
usually, not role ,role is only a concept.
We need to sort the workset which will be display in first level menu in fact.
And "Sort Priority" of workset can take effect,
I had validated that.
And the similar situation occured in second level menu.
Regards,
Jianguo Chen

3850 Stack and Stack Priority

Similar Messages

Maybe you are looking for