FWSM maintenance mode - vlan 1

Hi,
A client has had their FWSM fail, when you try to start the module the switch eventually disables the power to that slot (%C6KPWR-SP-4-DISABLED: power to module in slot 4 set off (Module  Failed SCP dnld)). I have turned off diagnostics with 'no diagnostic boot level' and then use 'boot device module 4 cf:1' to bring the FWSM up into maintenance mode. I can then session up from the switch and log in to the FWSM as root.
After inputting all the necessary IP info I can't ping anything on vlan 1 as I would expect, I have set the FWSM as 192.168.1.2 and a FTP/TFTP server as 192.168.1.1
I have removed the firewall vlan groups and tried to put them back with just vlan 1 but this isn't accepted (the reasons are covered in other posts on the forum). What am I doing wrong as the instruction say that vlan 1 is the only vlan that is accessable whilst the FWSM is in maintenance mode.
I can create an int vlan 1 in the switch and ping my ftp server so know that the switchport is set up correctly, I can also see that Po308 is formed and when the module boots I can see the Gi4/xx interfaces come up (FWSM is in slot 4).
Any ideas of what to try next?
............and they aren't covered by maintenance agreements
FWSM
Maintenance image version: 2.1(4)
[email protected]#show images
Device name             Partition#              Image name
Compact flash(cf)       4                       c6svc-fwm-k9.3-1-4-0.bin
Switch
SWITCH# sh ver
Cisco IOS Software, s72033_rp Software (s72033_rp-ADVIPSERVICESK9_WAN-M), Version 12.2(33)SXI7, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2011 by Cisco Systems, Inc.
Compiled Mon 18-Jul-11 05:49 by prod_rel_team
ROM: System Bootstrap, Version 12.2(17r)SX7, RELEASE SOFTWARE (fc1)
Regards
Mel

Recently i met the same problem.
When installing FWSM board on the Catalyst 6509 there is not communication access via vlan1 in the maintenance partition.
Moreover, the FWSM works properly in the aplication partition(cf:4).
Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISEK9_WAN-M), Version 12.2(33)SXH8, RELEASE SOFTWARE (fc1)
System Bootstrap, Version 12.2(17r)SX5, RELEASE SOFTWARE (fc1)
Mod Ports Card Type                              Model             
  1   48  48-port 10/100/1000 RJ45 EtherModule   WS-X6148A-GE-TX   
  4    6  Firewall Module                        WS-SVC-FWM-1      
  5    2  Supervisor Engine 720 (Active)         WS-SUP720-3BXL    
  8    5  Communication Media Module             WS-SVC-CMM        
Mod MAC addresses                       Hw    Fw           Sw           Status
  1  001b.d41a.8360 to 001b.d41a.838f   1.5   8.4(1)       8.7(0.22)BUB Ok
  4  0003.fead.962e to 0003.fead.9635   3.0   7.2(1)       4.1(14)      Ok
  5  0017.9444.c3ec to 0017.9444.c3ef   5.4   8.5(2)       12.2(33)SXH8 Ok
  8  0017.0ee2.13cc to 0017.0ee2.13d5   2.8   12.4(25c),   12.4(25c),   Ok
FWSM versions
FWSM Firewall Version 3.2(20)
Device Manager Version 5.0(3)F
Not possible to verify the switch is in the service.
I guess the reason is likely next.
FWSM supports only untagged packets on the vlan1. By default catalyst 6500 not tagged native vlan1.
In my case globally enabled tagging  in the native vlan.
#sh vlan dot1q tag native
dot1q native vlan tagging is enabled globally
sh vlan dot1q tag native
dot1q native vlan tagging is enabled globally
Per Port Native Vlan Tagging State:
Port    Operational          Native VLAN
           Mode               Tagging State
Gi1/2   trunk                 enabled
Gi1/8   trunk                 enabled
Gi1/13  trunk                 enabled
Gi1/14  trunk                 enabled
Gi1/17  trunk                 enabled
Gi1/18  trunk                 enabled
Gi1/21  trunk                 enabled
Gi1/27  trunk                 enabled
Gi1/30  trunk                 enabled
Gi1/32  trunk                 enabled
Gi1/38  trunk                 enabled
Gi1/42  trunk                 enabled
Gi1/43  trunk                 enabled
Gi1/44  trunk                 enabled
Gi1/46  trunk                 enabled
Gi5/2   trunk                 enabled
Po2     trunk                 enabled
Po308   trunk                 enabled

Similar Messages

  • Wlc ha maintenance mode

    We have 2 wlc 5508 with software  7.5.102.0, both wlc have 25 AP license.
    We try to setup HA SSO but 1 wlc in  maintenance mode: Maintenance cause= Incompatible Software license
    Could you help me ?
    thanks.
    ============== Primary controller===========================
    (Cisco Controller) >show redundancy summary
                Redundancy Mode = SSO ENABLED
                    Local State = ACTIVE
                     Peer State = UNKNOWN - Communication Down
                           Unit = Primary
                        Unit ID = BC:16:65:F9:19:60
               Redundancy State = Non Redundant
                   Mobility MAC = BC:16:65:F9:19:60
    Redundancy Management IP Address................. 192.168.11.11
    Peer Redundancy Management IP Address............ 192.168.11.12
    Redundancy Port IP Address....................... 169.254.11.11
    Peer Redundancy Port IP Address.................. 169.254.11.12
    (Cisco Controller) >
    (Cisco Controller) >show interface summary
    Number of Interfaces.......................... 5
    Interface Name                   Port Vlan Id  IP Address      Type    Ap Mgr Guest
    management                       LAG  30       192.168.11.9    Static  Yes    No  
    redundancy-management            LAG  30       192.168.11.11   Static  No     No  
    redundancy-port                  -    untagged 169.254.11.11   Static  No     No  
    service-port                     N/A  N/A      0.0.0.0         DHCP    No     No  
    virtual                          N/A  N/A      1.1.1.1         Static  No     No  
    ============== Secondary controller===========================
    (Cisco Controller) >show redundancy  summary
                Redundancy Mode = SSO ENABLED
                    Local State = MAINTENANCE
                     Peer State = UNKNOWN - Communication Down
                           Unit = Primary
                        Unit ID = F8:72:EA:EE:86:60
               Redundancy State = Non Redundant
                   Mobility MAC = F8:72:EA:EE:86:60
    Maintenance Mode = Enabled
    Maintenance cause= Incompatible Software license
    Redundancy Management IP Address................. 192.168.11.12
    Peer Redundancy Management IP Address............ 192.168.11.11
    Redundancy Port IP Address....................... 169.254.11.12
    Peer Redundancy Port IP Address.................. 169.254.11.11
    (Cisco Controller) >
    (Cisco Controller) >
    (Cisco Controller) >show interface sum
    Number of Interfaces.......................... 5
    Interface Name                   Port Vlan Id  IP Address      Type    Ap Mgr Guest
    management                       LAG  30       192.168.11.10   Static  Yes    No  
    redundancy-management            LAG  30       192.168.11.12   Static  No     No  
    redundancy-port                  -    untagged 169.254.11.12   Static  No     No  
    service-port                     N/A  N/A      0.0.0.0         DHCP    No     No  
    virtual                          N/A  N/A      1.1.1.1         Static  No     No  

    In order to use a WLC that has a license as an HA WLC, you need a minimum of a 50 AP license.
    http://www.cisco.com/en/US/products/ps10315/products_tech_note09186a0080bd3504.shtml
    If you want to convert any existing WLC as a Standby WLC, do so using the config redundancy unit secondary command in the CLI. This CLI command will only work if the WLC which is intended to work as Standby has some number of permanent license count. This condition is only valid for the 5500 WLC, where a minimum of 50 AP Permanent licenses are needed to be converted to Standby. There is no restriction for other WLCs such as the WiSM2, 7500, and 8500.
    Sent from Cisco Technical Support iPhone App

  • HELP: WLC AP-SSO not working (standby unity in maintenance mode)

    I have two WLC version 7.3.101.0 with the standby unit having HA-SKU. I have tested the AP-SSO functionality without any problem in lab with direct connection on RP port between two WLC. Once I brought them into data centre in separate location (latency is less than 10ms between the two DC), the standby unity always went into maintenance mode. The booting process on standby unit went to maintenance mode as shown below:
    Management Gateway and Peer Redundancy Management interface are not reachable.
    Entering maintenance mode...
    I have checked on the core switches at 2 data centre that the two WLC RP ports are connected to same VLAN and it is spanned across MAN link (10GB and less than 10ms delay). The spanning tree on those ports are forwarding as well.
    I have rebooted the second unit but no luck.
    The interface between two DC is using MTU 9216 which I do not think would cause this issue.
    Anyone has come across same or similar issue with me or know the solution? If you do, plz enlighten me.
    Thanks

    Thanks Leo and Scott for your feedback. I notice there are two newer software for WLC version 7.3.102.0 and 7.4.100.0.
    Both of them seem to have many open caveats. In my wireless environment, I also use ISE, MSE and Prime Infrastructure and unfortunately WLC 7.4 does not support prime solution and MSE yet according to below compatibility matrix.
    http://www.cisco.com/en/US/docs/wireless/controller/5500/tech_notes/Wireless_Software_Compatibility_Matrix.html
    I think I only have choice to do minor upgrade to 7.3.102.0 at this moment (please correct me if I am wrong). This software was published on 30th Jan 2013 so I wonder if someone else has tried this and managed to get WLC AP-SSO setup working flawlessly where 2nd WLC unit is at different location?
    Appreciate for more info and advise.

  • ACE bridge mode , FWSM routed mode

    i have the following senario:
    MSFC ---vlan 777----FWSM----vlan160---ACE----VLAN180
    FWSM is working in routed mode and vlan 777 is shared between the MSFC and FWSM
    ACE is working in bridged mode and vlan 160 is shared between the FWSM and ACE
    vlan 180 is the server side vlan
    i want he FWSM ip address to be the Server gateway while ACE module in
    bridge mode
    i create bvi interface but i can't ping from ACE to FWSM or from FWSM to
    ACE
    if i change ACE to routed mode , i can ping to FWSM
    any body can help me in this issue?

    The config looks good.
    I would look at the arp table on FWSM and ACE when the ping fails and also capture a sniffer trace of ACE tengig interface and see if the ping request goes out - on which vlan - and if we get a response.
    Is evertyhing else working ?
    Like ping through the ACE module ?
    Your config does not show a 'no shutdown' on the vlan interface, but I assume you fixed that already.
    Gilles.

  • Looking for a Powershell Script which can put the scom servers in maintenance mode

    Looking for a Powershell Script which can put the scom servers in maintenance mode so that SCOM should not send an alert during planned task.
    Rahul

    1. Provide list of servers line-by-line in C:\ServerList.txt, make sure you provide limited no. of servers, do not exceed 20 - 25 per batch
    2. Save the script with suitable name (test.ps1)
    3. Open PowerShell cmd prompt
    4. Script accepts 3 params - TimeInMinutes, Reason and Comment
    **** Please note, this script will work for SCOM 2012 R2
    param([int32]$TimeMin, [string]$Reason, [string]$Comment)
    try
    $api = new-object -comObject 'MOM.ScriptAPI'
    Import-Module operationsmanager
    New-SCOMManagementGroupConnection
    $Servers = Get-Content "C:\ServerList.txt"
    $Time = (Get-Date).Addminutes($TimeMin)
    Foreach ($Server in $Servers)
    #Get Computer instance
    $ComputerClass = Get-SCOMClass -Name Microsoft.Windows.Computer
    $ComputerClassInstance = Get-SCOMClassInstance  -Class $ComputerClass | Where {$_.DisplayName -eq $Server}
    If ($ComputerClassInstance -ne $Null)
    $HealthServiceWatcherClass = Get-SCOMClass -name:Microsoft.SystemCenter.HealthServiceWatcher
    #Get Health Service Watcher Class instance of the server
    $HSWClass = Get-SCOMClass -Name Microsoft.SystemCenter.HealthServiceWatcher
    $HSWClassIns = Get-SCOMClassInstance  -Class $HSWClass | Where {$_.DisplayName -eq $Server}
    #Starting the maintenance mode
    Start-SCOMMaintenanceMode -Instance $HSWClassIns -EndTime $Time -Reason $Reason -Comment $Comment
    Start-SCOMMaintenanceMode -Instance $ComputerClassInstance -EndTime $Time  -Reason $Reason -Comment $Comment
    Write-Host "Health Service Watcher and Agent server "$Server " kept in maintenance mode"  -foregroundcolor "green"
    $api.LogScriptEvent('MaintenanceModeScript.ps1', 200, 0, "$Server kept in maintenance mode for $TimeMin minutes")
    Else
    Write-Host $Server" not found " -foregroundcolor "red"
    $api.LogScriptEvent('MaintenanceModeScript.ps1', 201, 1, "$Server could not be found in domain")
    Catch [system.exception]
    $api.LogScriptEvent('MaintenanceModeScript.ps1', 201, 1, $_.Exception.Message)
    Faizan

  • 5508-HA standby in Maintenance mode

    My standby controller is in maintenance mode. Other post say to simply reboot the standby but I'm worried about doing this during business hours. Say I did reboot it during business hours, would it affect the active controller? All redundancy links are connected.
    (Cisco Controller) >show redundancy sum
     Redundancy Mode = SSO ENABLED
         Local State = MAINTENANCE
          Peer State = UNKNOWN - Communication Down
                Unit = Secondary - HA SKU
             Unit ID = 00:06:F6:DC:17:00
    Redundancy State = Non Redundant
        Mobility MAC = 68:EF:BD:8E:61:E0
    Maintenance Mode = Enabled
    Maintenance cause= Negotiation Timeout

    No it won't affect the active controller:
    While booting, the WLCs will negotiate the HA role as per the configuration done. Once the role is determined, the configuration is synced from the Active WLC to the Standby WLC via the Redundant Port. Initially WLC is configured, as Secondary will report XML mismatch and will download the configuration from Active and reboot again. During the next reboot after role determination, it will validate the configuration again, report no XML mismatch, and process further in order to establish itself as the Standby WLC
    http://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/7-5/High_Availability_DG.pdf
    https://supportforums.cisco.com/discussion/11758901/ask-expert-high-availability-wireless-lan-controller-wlc

  • Warning: The system has not been taken off maintenance mode completely

    After I enabled Maintenance mode using adadmin, I ran Compile Flexfields. Then I disabled Maintenance mode. But, on the 11i login page, I keep getting a warning message:
    Warning
    The system has not been taken off maintenance mode completely. Please contact your System Administrator.
    I am sure I disabled the Maintenance mode in adadmin. Why I still get the warning? How to fix it? Thanks a lot.

    Thanks a lot. That is the fix.
    One more question. After I ran "Compile Flexfields", I got
    Number of successful descriptive flex compilations : 7520
    Number of failed descriptive flex compilations : 1
    How can I find the failed description flex? The log does not give info on this. And, how to fix it?
    Thanks a lot for your help.

  • Cairo-dock starts in "maintenance mode"

    Hi,
    I've recently upgraded the cairo-dock, but since then it starts along with the <maintenance mode window>... When I try to close it, it reappears until the wifi connection settles down. I suspect that weather-dock is making troubles when it does not have connection to the internet.
    I've looked through the cairo-dock options, and it has an option to force maintenance mode, but it does not have one to force disabling it unfortunately.
    Anyone has any idea how to get rid of this?

    probably an issue with your configuration. had this once, deleted my .config/cairo-doc ( at least i think thats where it was) folder and it worked again - with default settings.

  • OM2012 – Putting a Monitor in maintenance mode

    Hi there,
    I need to write a powershell script to put a Monitor in Maintenance mode. This is easily doable manually on the console whenever an alert comes up by putting the alert in Maintenance Mode.
    So far I managed to make my script to put the class of the Monitor into maintenance, as per bellow
    i.e. if the monitor is “Total CPU Utilization Percentage”, it would put  Microsoft Windows Server 2012 R2 Datacenter in maintenance mode for the computer $ComputerName.
    $ComputerName = Read-Host “Enter computer name”
    $MonitorName = “Total CPU Utilization Percentage”
    $Monitors=Get-SCOMMonitor -ComputerName $strComputerName | where {$_.DisplayName -eq $MonitorName}
    $Time = ((Get-Date).AddMinutes(6))
    foreach ($Monitor in $Monitors) {
    $Instance = Get-SCOMclass -name $Monitor.target.identifier.path | Get-SCOMClassInstance #| where {$_.Path -eq $ComputerName}
    Start-SCOMMaintenanceMode -Instance $Instance -EndTime $Time -Comment: “Server maintenance”
    I can’t figure our how to simply put “Total CPU Utilization Percentage” (or any other Monitor) in maintenance mode
    Thanks for your help !

    Yes, use the "Start Maintenance Mode" Activtiy of the Integration Pack for OpsMgr.
    www.sc-orchestrator.eu ,
    Blog sc-orchestrator.eu

  • Redirect users to page when we take system in maintenance mode.

    I would like to redirect users to page when we take system in maintenance mode. We are on 12.1.3 application. please provide me document which have these details

    Please see old threads which discuss the same topic.
    http://forums.oracle.com/forums/search.jspa?threadID=&q=Redirect+AND+Maintenance&objID=c3&dateRange=all&userID=&numResults=15&rankBy=10001
    http://forums.oracle.com/forums/search.jspa?threadID=&q=Maintenance+AND+Message&objID=c3&dateRange=all&userID=&numResults=15&rankBy=10001
    http://forums.oracle.com/forums/search.jspa?threadID=&q=Outage+AND+Maintenance&objID=c3&dateRange=all&userID=&numResults=15&rankBy=10001
    Please search the forum before posting similar questions.
    Thanks,
    Hussein

  • SCCM 2012 Software Update Management for Windows Servers and how to automatic set SCOM maintenance mode?

    Hi,
    We planning to go one level higher to automat and have more dynamic Software Update Management for Windows Servers. We have SCCM 2012 R2, SCOM 2012 R2 and SCO 2012 R2.
    Our plan is to pur server in an AD-Group to get Update Schedule, from the servers will be importet to an Collection for Automatic Update and reboot. If I understand Everything right SCOM can't read AD-Group and put then in an Schedule maintenance mode. SCOM
    can read reg value as exempel.
    IS there any smar way to make the SCOM Maintenance Mode Schedule dynamic?
    I found this
    http://www.scom2k7.com/scom-2012-maintenance-mode-scheduler/?
    /SaiTech

    You could use Orchestrator to put the servers from a specific collection, or AD group, in maintenance mode in SCOM. For an example see:
    http://www.systemcentercentral.com/orchestrator-how-to-scom-maintenance-mode-for-windows-computers-in-an-sccm-collection/
    My Blog: http://www.petervanderwoude.nl/
    Follow me on twitter: pvanderwoude

  • Unable to enter maintenance mode - dtrt1000

    Over the last few weeks my box is almost useless.  With frequency it only part records, freezes requiring rebooting, momintary screen blanks, and is generally a pain in the rear.  I've tried to get into maintenance mode to try and reset it, but following the guide from Youview it doesn't work, and the box just starts as normal.
    My understanding is that you (1) Switch the box off from the back (2) Switch it back on after 30secs (3) Press the power button and immediately hold of the -vol button until the splash screen appears...Then you can access the menu.
    I've tried holding the holiding the -vol button before the power button, holding it immediately after power button, holding it until the nearly ready screen, in low and high eco modes etc but get the same result, it just goes straight into normal programes???

    1 Start with the YouView box powered off from the switch on the REAR panel power button
    2. Power back on the YouView box using the REAR panel power button
    3. When the FRONT power button is illuminated with an orange circle, press the FRONT panel power button firmly once and it will turn blue 
    4. Immediately press and hold the "VOL-" button which can be found on the right of the FRONT panel the first silver button. 
    5. A message saying "Enter Maintenance Mode Y/N (Y: POWER)" appears on the TV screen
    So if I understand correctly your experience is that steps 1, 2 & 3 occur but when doing step 4  the message step 5 (does not occur ) and your box boots as normal.
    My own (historic ) experience is that the timing of stages 3 and 4 is quite tight - ie the power button turning blue followed immediately by the VOL- button being pressed and held.
    Your options if the maintenence mode will not  work are to contact BT support and seek their advice or if you are not concerned about the recordings remaining on the box you can do a factory reset from from main Youview menu
    https://community.youview.com/youview/topics/top_tip_soft_reset_reboot_power_cycling_maintenance_mod...

  • All services stuck in maintenance mode

    I've got a problem on Solaris 10. All of the enabled inet services are in maintenance mode. rlogin, ftp, telnet, stlisten, xfs, etc, etc - are all in maintenance mode. The inetadm command shows no online services, only disabled and maintenance. I've tried clearing them with svcadm but they won't clear. It won't show any explanation for why.
    What could be wrong to cause this?
    Thanks for any suggestions.
    Randy

    Thanks very much for the very helpful suggestions. svcs -xv does not show anything helpful - for the Reason, simply "Restarter gave no explanation". The svc:/network/inetd:default is indeed enabled and healthy.
    /var/adm/messages, however, has information that might point to the problem. Regrettably, I don't understand the message and am hoping someone here can enlighten me. For each of the services that is in maintenance mode, these messages appear:
    Nov 3 17:59:44 trsun006 inetd[322]: [ID 702911 daemon.error] Property exec for method inetd_start of instance svc:/network/login:rlogin is invalid
    Nov 3 17:59:44 trsun006 inetd[322]: [ID 702911 daemon.error] Invalid configuration for instance svc:/network/login:rlogin, placing in maintenance
    I don't understand what it means by "Property exec for method inetd_start ... is invalid".
    I issued these commands-
    [trsun006 27] sbin > inetadm -l rlogin | grep exec
    exec="/usr/sbin/in.rlogind"
    [trsun006 28] sbin > ls -l /usr/sbin/in.rlogind
    -r-xr-xr-x 1 root bin 36372 Jan 22 2005 /usr/sbin/in.rlogind*
    How can I debug this problem?
    Randy

  • Need to place the SCOM agents in Maintenance Mode automatically during Patching activity

    Hi,
    I have a requirement to place the SCOM agent servers in MM automatically during shceduled patching every month. I have gone through few blogs but could not find an apt solution for SCOM 2012 R2 environment.
    I think the process should be..
     1. Create a management pack to monitor all servers for event 1074 (or/and 22), which gets triggere during the patching
     2. Write some powershell to put a machine into maintenance mode.
     3. Trigger the powershell script to run when needed.
    Any suggestions please?
    Thanks

    Where doing this in our environment. We have a SCOM monitor looking for Reboot events (ID 1074) where the event contains Shutdown Type: Reboot. the monitor creates an Informational alert which Orchestrator picks up and then sets the machine in MM for 30
    minutes. So its any time the machine is intentionally rebooted. You can have it look for CcmExec in the Event description (assuming you're using SCCM) if you only want it to work when being patched. 
    - Slow is smooth and smooth is fast.

  • 'Update' maintenance mode in transaction PRAA

    Hi,
    We are trying to create an employee vendor using the transaction PRAA by selecting the 'Update' maintenance mode.
    The issue is that the clerk's email address is being copied from the reference vendor if the personnel does not have an email address maintained in the HR records.
    Please could you let me know if this is the standard functionality.
    Thank you.

    Hello
    Not sure that is a standard functionnality. You should check user-exit and BAdIs implemented in your system for PRAA... (there is 2 exit).
    If not you should open an incident to SAP because it doesnt looks like very clean to me to copy the email from template.

Maybe you are looking for