Cisco 3850 Switch and Windows 7 IP Conflicts

Team,
Last evening (Christmas eve) we setup a pair of Cisco 3850 with IP Base version 3.3.35SE (recommended) and 3.7.0E (very latest).
We got these to replace a very old switch that had died. Attached to this network are windows 7 PC's with all the standard patches, service packs, etc.
with standard port configs - no PC would work - and in fact on each screen we got the windows 7 IP Conflict pop up box.
This seemed very odd to us, as we know these IP's are all static (no dhcp on this segment at all)
we went with a very vanilla config on each port
interface g1/0/1
switchport host
that is it - nothing special at all.
well, after hours of research we found the 3850 has a problem where its "ip device tracking" (even though disabled, by way of NOT being enabled on any interface) will effect the windows 7 PC's ip address in use detection port start up phase!
This is a very big problem. I am frankly SHOCKED Cisco would release a major switch that is going to not work when connected to the average network with windows 7 PC's.
we tried 3+ hours of prescribed work-arounds found when researching this issue -
ip device tracking probe delay 10 (global config)
ip device tracking max 0 (disabed, on interface)
finally,
nmsp attach suppress (interface, however this appears to be a default command in all IOS-XE versions we tried, as the command did NOT show in the show run) . this effected many different nic card vendors (laptops, desktops) and nic card drivers levels from old to very recent.
Finally,
we compared a 3850 in another location to this one - and we never got HIT by this problem before because that 3850 only as TRUNK ports and no windows 7 hosts directly attached.
Doing more research, I found out this also can effect vmware guests running windows SERVER.
this is now a huge issue as we have a scheduled deployment of 3850's throughout our network which is going to be put on hold.
the work-around I came up with which is not great is -
Make ALL the "access" ports connected to PC TRUNK ports and leave the NATIVE vlan (untagged) as the vlan you want the PC's to be in
interface g1/0/1
switchport mode trunk
switchport trunk native vlan 1
this is NOT an acceptable workaround as this presents security issues even with
switchport trunk allowed vlan 1, etc. as the only allowed vlan.
Note: this issue manifested itself and windows 7 PC's were UNABLE to use the network. if you do "ipconfig /all | more" you would see
192.168.0.140(duplicate) and the interface would actually use 169.254.0.239(duplicate) so the duplicate message appeared twice in the output.
1) With and without an SVI interface on each 3850 for the vlan where the windows 7 machines had a duplicate
2) when we had an SVI and the command ip device tracking probe use-svi (or whatever the hidden command is I forget now, but it took it)
3) when we had aaa new-model configured - and not configured - thinking this was some artifact of having aaa turn on something like 802.1x port state
4) when could confirm NO DHCP SNOOPING
5) when we DID not use static IP's - and had the switch assign DHCP addresses - the Windows 7 PC's STILL had duplicates and didnt work for their "Just leased" ip's.
6) when we could confirm ios-xe ip device tracking = disabled with show ip device tracking status, etc.
This is a major problem for this 3850 and unless we get a definitive answer on why this is happening and how we can rectify we are going to have to return our 3850's and get HP Procurve's something I would rather avoid doing. There is NO REASON I can imagine other than older switches who's ports default to ROUTED ports (i.e.. no ip switchport) where a switch should not at least function as a bare switch with essentially a default configuration out of the box.
Any ideas? I'm working well now with the ports ALL in trunking mode with vlan 1 native, but this is not a scalable workaround we can live with as we have security risks of a port not blocking certain vlans from going out ports to pc's, etc. that attackers could send tags on at that point, etc.
thanks,
Joe Brunner
#19366

thanks for replying - i'm not onsite (its a standalone network) - but here is what it is -
Answers in line -
This all stems from a switch replacement correct?
yes a 10 year old Allied Telesyn switch was replaced that had no config - like a hub, just used for connectivity.
Are these 3850's in a stack?
>yes, tested all aspects of the stack many times.
Does it have a managment ip address -If so, is it using the old switch ip address
>old switch had no ip - i made a "management interface" on vlan 1 - BUT no ip on the built-in management interface on the switch.
What are they connecting to? (a router/L3 switch/anohter switch- cisco-HP etc..)
>various other devices - only 1 link back to a single 3750x stack. that switch is "hardened" so to speak to reveal or propagate very little by design.
How are they connected( L3 interface/L2 trunk/access port)
>all ports are left in trunk mode with vlan 1 as the active and untagged port. this was the workaround done to ever get the switch going. in "out of the box" or default mode as we initially wanted (no config) links to windows 7 PC's didnt work. links to linux or other devices non-windows did work!
Are thse switches performing inter-vlan routing or just acting as host switches?
>dumb flat network, no routing.
Is ip routing enabled?
>not unless enabled on 3850 by default. I didnt type "ip routing"
Do you have multiple vlans in your network and if so ar ethe being propergated to these new switches?
Your 7 pcs = are they just client pcs not servers?
client PC's - no servers OS per say.
can you confirm something like ICS isnt enabled (Internet connection sharing)  on any of them?
>yes not enabled.
Are the just using one NIC each?
> one machine is dual homed - but we know where its "second nic" goes - to another cisco network which is NOT connected back to this one. we traced all our ports a few times thinking even perhaps some small hub was "reflecting" traffic back to us - like a blackbox. Strangest thing -
default config out of the box - with ALL ports SHUTDOWN EXCEPT the single windows 7 facing port - the windows 7 machine STILL registered an IP CONFLICT when connected to the 3850 - even when it had NO SVI's!!! (i know mind numbing). if you disconnected the pc and connected it to an old cisco switch - it worked fine!!! wow.
sh switch
2 identical 3850's in working stack. power and network stacked. both at same version, etc - upgraded each time with "software install file flash:<long ios name>.bin
tested all power and general 3850 stacking. saw no issues.
sh int trunk
>all ports are now trunks (hence the workaround used to get it up).
has 20 trunks to PC's and some single connected switches (far away on fiber) - all allow only vlan 1 - no other vlans were created - very very simple network. vlan 1 is native
sh vlan brief
>just vlan 1 - no vlans created, checked this many times - had vlan 100 at one point - made sure it was gone over a period of hours.
sh vtp status
not setup - left complete default; no vtp domain set - connected to all switches in transparent model if a switch connection exists.
sh cdp neighbours
cant post (for god and country LOL) but there is one link back to our "core" so to speak - that switch is hardened not to allow any settings to slip over to new switches so hence no vtp, cdp is one to help troubleshooting.
sh ip route
just the L and C routes for the vlan 1 ip address 192.168.17.1/24
no static routes
no vlan interfaces other than int vlan 1
no ip address on g0/0/0 -> the default 3850 management interface hard assigned to the 3850 VRF you cant remove.
int g0/0/0
ip vrf forwarding Switch_Mgmt
i can get over there if you think of anything else key to show the group.
thanks,
Joe

Similar Messages

  • Emergency Responder and Cisco 3850 Switches

    I'm running Cisco ER V8.5, and recently installed new Cisco 3850 Switches. All the phones connected to the 3850 switches show a "unlocated" status. I've check the hardware compatibility Matrix for ER V8.5 and the 3850 is not on it.
    What are my options for locating these phones in ER and assigning them to an ERL. Manually defining the phones? Is there a patch or update to ER V8.5 that would make a 3850 compatible?

    I haven't used the 3850's with ER yet so can't speak to that specifically, but generally speaking you have more flexibility using location by subnets vs switches.  Scalability-wise, you can add way more subnets than switches.  There's more going on under the hood if you're locating by switches so the process overhead is greater.
    The only downside with using subnets is if you need to get more granular with your locations than your deployed subnets allow (ie a single voice subnet for an entire building but you need to define and assign locations at the floor level).  As long as you've been a little forward thinking on the route/switch side, you'll be fine.
    hope that helps,
    will

  • Has anyone deployed converged access with 3850 switches and 5760 WLCs?

    Has anyone deployed a converged access network architecture with 3850 switches and 5760 WLCs? I have done lots of projects with the 5508 WLCs In a centralized deployment. Basically with this design, I manage 2 logical networks as the wireless network is an overlay over the wired network. I can design firewall to segregate traffic between the wired and wireless hence I can carry both staff and guest traffic.
    Now Cisco is telling us that there is new design such that the dats plane traffic can be dropped locally through the 3850 switched. I am not sold on this and have not found any recommended best practices on when should we use a converged access architecture.
    Pros
    With converged access, data traffic is terminated at the MA which is on the switches, hence the WLC will not be a bottleneck? This is to prepare adoption for 802.11ac?
    Less hops for voice calls from user A to user B as data control traffic is dropped locally.
    Cons
    Now how do I segregate guest and staff traffic if my security folks say I need a firewall?
    Troubleshooting wireless client mobility will be a nightmare as the 3850 switches are MA.
    Pushing and upgrading code for the Code will mean upgrading the stack of switches in the LAN riser. This will be painful in a huge campus environment like an university.
    Can someone convince me why would a customer choose converged access?
    Sent from Cisco Technical Support iPad App

    They choose CA because of the capwap termination at the switch. You can still use a 5508 and tunnel guest to a DMZ segment if you wish. You will need a 5508 though is you want to tunnel traffic to an anchor WLC.
    Sent from Cisco Technical Support iPhone App

  • 3850 switches and NAC

    Hi all,
    We had 802.1x/MAB running fine at a site with Cisco 3750 switches. We then upgraded to Cisco 3850 switches. Now we find that a number of Avaya IP phones get stuck saying "Discover xxx.xxx.xxx.xxx" and when you do a "sh auth session int gi x/y" it shows the "D" flag and it says "Blocked On: Pending Deletion".
    Has anyone come across this before?
    Thank you in advance!

    Ugh, I think you might have hit the same issue that I did with a deployment that I have done in the past, except in my case I was dealing with Cisco 4500-X that also runs the XE code. The "IP Device Tracking" is disabled by default on Catalyst IOS but enabled by default on IOS XE. The command is needed (even for layer 2 switches) if you plan on deploying dot1x with DACLs. 
    I have worked with both Arista and HP (Actually 3com) in the past. Arista had some very nice and fast switches while HP had nothing that really impressed me. To be fair, I have ran into issues/bugs with both manufacturers :) So just keep in mind that nobody will be perfect out there :)
    Btw, I still believe that Cisco's TAC and communities, such as this is what sets Cisco apart from the rest of the competition. 
    Best regards, 
    Neno

  • Cisco 3850 Switch getting message %SPI_FC-3-HIGH_WMARK_REACHED

    Hi Team,
    We have one Cisco 3850 Switch installed at the Customer site and getting the message as below,
    Mar 28 10:57:11.578: %SPI_FC-3-HIGH_WMARK_REACHED: Number of messages in the queue for channel 9 has reached maximum.
    -Traceback= 1#830db5fd318976b0280defe233875463  :10000000+153F71C :10000000+B5E9B0 :10000000+B5EBA4 :10000000+3CC5CC :10000000+3CD0B4 :10000000+39AB00 :10000000+27CDD2C :10000000+7C7814 :10000000+27AC29C
    .Mar 28 10:58:31.585: %SPI_FC-3-HIGH_WMARK_REACHED: Number of messages in the queue for channel 9 has reached maximum.
    -Traceback= 1#830db5fd318976b0280defe233875463  :10000000+153F71C :10000000+B5E9B0 :10000000+B5EBA4 :10000000+3CC5CC :10000000+3CD0B4 :10000000+39AB00 :10000000+27CDD2C :10000000+7C7814 :10000000+27AC29C
     --More--         .Mar 28 10:59:51.586: %SPI_FC-3-HIGH_WMARK_REACHED: Number of messages in the queue for channel 9 has reached maximum.
    -Traceback= 1#830db5fd318976b0280defe233875463  :10000000+153F71C :10000000+B5E9B0 :10000000+B5EBA4 :10000000+3CC5CC :10000000+3CD0B4 :10000000+39AB00 :10000000+27CDD2C :10000000+7C7814 :10000000+27AC29C
    Please suggest the meaning of these messages and suggestion for resolution on the same.
    Attaching show version, show logging for this Switch.
    Regards
    Ashutosh

    Hi Akilhasan,
    The switch is hitting a bug which is currently under investigation. The latter implies there is no official workaround, but my suggestion would be that you consider reloading the switch outside of business hours (considering preventive measures i. e. back the configuration up, save changes, etc.). 
    The most stable version and recommended per Cisco is 03.03.03. There is newer 03.06.00 available, just released past June, so you may consider as well upgrading the IOS, of course under a properly carried out risk assessment, and you can roll back if something unexpected occurs. I would suggest doing so only if you have a solid knowledge of the customer's network and business needs.
    Hope this helps. 
    Kind regards,
    - Ed

  • Cisco prime 2.1 not showing wired clients connected to Cisco 3850 switches

    Hello All,
    I have around 80 Cisco 3850 switches at a customer network and they are using prime infrastructure 2.1.2 to manage these devices. Most of the features are working fine except that the prime does not show the wired clients connected to the switches. The wireless clients are shown properly but not the wired clients. Their core switches are nexus 7k. The SNMP configuration on the switches is as follows.
    snmp-server group xxxx  v3 priv write xxxx-VIEW-WR
    snmp-server view xxx-VIEW-WR mib-2 included
    snmp-server trap-source Vlan100
    snmp-server host x.x.x.x version 3 priv testuser
    Please help me to resolve this issue.
    Shabeeb

    I managed to get the end hosts connected in 3850 switches with the use of snmp context command. But now the issue is that prime is showing only the mac address of the device , not the IP address. 
    Is there anyway to resolve this issue?

  • How can i configure hsrp in cisco 3850 switch please guide me

    how can i configure hsrp in cisco 3850 switch please guide me

    Hi Mauleshg,
    Please the below mention link to configure Hsrp hope this will help you.
    http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/ip/configuration_guide/b_fhrp_3se_3850_cg/b_fhrp_3se_3850_cg_chapter_010.html
    Br.
    Mohseen Patel

  • Error in GUI of Cisco 3850 Switch with Wireless Controller.

    Hi,
    I have Configured 3850 switch wireless controller. But while accessing the controller through GUI, I faced following errors while configuring it through GUI.
    Because its complecated to configure it through CLI.
    Attached are the snaps of error faced.
    and if I didnt get this error, and able to configure, I can save it because of this error.
    Please help me on this issue, so that I can easily configure the controller.
    Brgds,
    Ninad Thakare

    Hi Sandeep,
    Here is the configuration which I have did.
    ip http server
    ip http secure-server
    wsma agent exec
    profile httplistener
    profile httpslistener
    wsma agent config
    profile httplistener
    profile httpslistener
    wsma agent filesys
    profile httplistener
    profile httpslistener
    wsma agent notify
    profile httplistener
    profile httpslistener
    wsma profile listener httplistener
    transport http
    wsma profile listener httpslistener
    transport https
    wireless mobility controller
    wireless management interface Vlan4 ( Voice VLAN )
    wlan FG-WiFi 1 FG-WiFi
    client vlan 4
    ip dhcp server 10.106.72.1
    no security wpa akm dot1x
    security wpa akm psk set-key ascii 0 testing1234
    no security wpa wpa2
    no security wpa wpa2 ciphers aes
    no wmm
    no shutdown
    wlan GLOBALACCESSII 2 GLOBALACCESSII
    client vlan 4
    ip dhcp server 10.106.72.1
    no security wpa akm dot1x
    security wpa akm psk set-key ascii 0 testing1234
    no security wpa wpa2
    no security wpa wpa2 ciphers aes
    no wmm
    no shutdown
    ap group default-group
    ap group 3850WLC
    wlan FG-WiFi
      vlan 4
    wlan GLOBALACCESSII
      vlan 4
    end
    Brgds,
    Ninad Thakare

  • Cisco 3850 SSO and NSF failover time

    Dear Member,
    I m trying to setup a network with few second fail-over with Cisco 3850 stack, C3850 support SSO and NSF on OSPF.
    However, when the Master fails, Slave take up the role and re-learn routing information and around 10 sec to fail-over.
    May any brothers have this experience and 10 sec fail-over should be the normal behavior or can be enhance?
    Attach diagram for reference.
    Regards
    Russ

    Great, adding the following command and only have 1 ping loss with end to end.
    =========================
    Stack-mac persistent timer 0
    router ospf 1
    nsf cisco enforce global
    ========================

  • Cisco CE500 Switch and SPAN Port Monitoring

    Does the Cisco CE500 switch support SPAN/Port Monitoring? If so, how is this configured via the browser?
    Thanks

    Please check this document on Cisco.
    http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#Cat500

  • Cisco VPN Client and Windows XP Home

    Hello,
    I cannot find any information to tell me whether Windows XP Home (Not XP Professional) is supported under ant Cisco VPN client 4.xx or 5.xx.
    We have several "home" users and when trying to install it just causes the pc to do a looping reboot.
    Can anyone advise please ?
    Scott

    Scott,
    Not sure if you read the release notes, but here they are are for V4.06 and V5.0:
    http://www.cisco.com/en/US/docs/security/vpn_client/cisco_vpn_client/vpn_client46/release/notes/46clnt.html#wp1207576
    http://www.cisco.com/en/US/products/sw/secursw/ps2308/prod_release_note09186a0080884df5.html#wp1207576
    I'm not seeing anything that prohibits XP Home, but there are several caveats that may have direct bearing on why your user's can't get it installed (administrative access to internal firewalls).
    HTH
    Steve

  • Cisco aironet 1130g and windows 2003 with cisco ACS

      hi
    i  have configured windows 2003 server with  DNS ,Active directory users and dhcp server.  and configured my cisco 1130g AP .
    i have installed cisco access control server 4.0 because i use LEAP authentication protocol and for the ACS for network configuration i give aaa client ip addresss as AP interface ip and  same shared secret for the AP and ACS,.
    so  when i log to wifi it ask username and password
    problem is lap top cannot have a ip address my dhcp server not issue any ip address .
    my hiper terminal massage is like this when i connect to wifi 
    help ...thank you...

    As I mentioned now several times already, it is the client and ACS which do the PEAP. The Access point doesn't have to be configured for an eap type. What you did on the AP was setting the AP as a radius server which is duplicate work with what you did on ACS.
    So you need on your client to configure either PEAP or LEAP.
    Nicolas

  • Cisco NAC Agent and Windows 8 still not working

    Hello. I recently upgraded the Cisco NAC Agent to the latest version (4.9.1.13) on a Windows 8 VM. The release notes state that Windows 8 support has been added, and that a patch must be downloaded. However, the information about the patch is vague. I'm not sure if it's a client or server-side patch, or perhaps if I already have it as a result of upgrading to the latest version.
    I ask this because I plan to upgrade some computers to Windows 8, and have noticed that Cisco NAC Agent can't handshake with the NAC server on Windows 8 (both native and VM), and despite upgrading to the latest version, the handshake is still unsuccessful.
    Thanks,
    -Collin

    Hi Collin,
    The 4.9.1 Patch for Windows 8 Support can be downloaded from the following link :
    http://www.cisco.com/cisco/software/release.html?mdfid=282910502&flowid=34713&softwareid=282573326&release=4.9.1&relind=AVAILABLE&rellifecycle=&reltype=latest
    The patch should be applied to both 4.9.1 CAM and CAS.
    Please go through the README file for patch provided in the download link provided above. It has detailed information.
    Regards,
    Karthik Chandran

  • Xserve RAID with fibre switch and windows

    I have a customer who potentially is looking at an Xserve and RAID using a fibre switch with a couple of G5s with fibre cards for speed. They also have a Windows machine that they need to access files, but speed is not an issue. Will the Windows machine be able to see the RAID if it is shared by OS X Server via ethernet or does it need a fibre card? Thanks in advance for assistance!
      Mac OS X (10.4.3)  

    You can turn on Windows (SMB) sharing, or you can connect it directly via fibre channel. Note, if you connect it to the fibre, you can't have it access the SAME volume at the SAME time as the Macs are accessing (heck, you can't have the Macs access the SAME volume at the SAME time without software either), without Xsan and the StorNext file system.

  • Cisco 3850 Switch Management Port - ACL on VTY

    Hi,
    I got these switches.
    Switch Ports Model              SW Version        SW Image              Mode   
    *    1 32    WS-C3850-24T       03.03.02SE        cat3k_caa-universalk9 INSTALL
         2 32    WS-C3850-24T       03.03.02SE        cat3k_caa-universalk9 INSTALL
    SSH access to Management port G0/0 with an ACL applied on line vty 0 4 is failing, even through the ACL is permiting traffic.
    interface GigabitEthernet0/0
     vrf forwarding Mgmt-vrf
     ip address 172.16.12.3 255.255.255.0
     negotiation auto
    ip access-list standard ACLVTY
     permit any log
    line vty 0 4
     access-class ACLVTY in
     exec-timeout 15 0
     length 0
     history size 64
     transport preferred ssh
     transport input ssh
     transport output telnet ssh
    037599: *Mar 28 2014 04:59:49.919 AEDT: %SEC-6-IPACCESSLOGS: list permit-any permitted 172.16.12.100 1 packet
    # show ip access-list permit-any
    Standard IP access list permit-any
        10 permit any log (3 matches)
    If I remove the ACL under VTY "no access-class ACLVTY in", then SSH to the management port works. If I don't use the management port and use a normal port say G1/0/1 configured on management VLAN and assigned the same IP address, then SSH works with the VTY ACL still existing. 
    Any ideas ?
    Thanks, 
    Rick.

    Hi,
    IOS will accept all VTY connections by default. However, if an access-class is used, the assumption is that connections should only arrive from the global VRF. If you need control the IP source while allowing VTY connections from VRF instances, you have a try configuration option "vrf-also"
    So, you should get something like this:
    line vty 0 4
    access-class ACLVTY in vrf-also  

Maybe you are looking for