topic Re: C2960X cannot configure policy-map in Network Access Control

C2960X cannot configure policy-map

tovifang — Fri, 13 Jan 2023 19:34:54 GMT

My device changed to the new-style command and I followed the documentation to configure the new version of dot1x and found that there are no class-map and policy-map commands under configure.

Is this related to the switch version, or what else needs to be configured after the auto-conversion?

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ibns/configuration/15-sy/ibns-15-sy-book/ibns-cntrl-pol.html#GUID-F3C64561-872A-442F-93BD-49DCF655644D

SW05-01-IDF#authentication display config-mode
Current configuration mode is new-style

SW05-01-IDF#show version
Cisco IOS Software, C2960X Software (C2960X-UNIVERSALK9-M), Version 15.2(7)E5, RELEASE SOFTWARE (fc3)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2021 by Cisco Systems, Inc.
Compiled Mon 13-Sep-21 09:41 by mcpre

ROM: Bootstrap program is C2960X boot loader
BOOTLDR: C2960X Boot Loader (C2960X-HBOOT-M) Version 15.2(6r)E, RELEASE SOFTWARE (fc1)

SW05-01-IDF uptime is 4 hours, 14 minutes
System returned to ROM by power-on
System restarted at 22:55:16 UTC Fri Jan 13 2023
System image file is "flash:/c2960x-universalk9-mz.152-7.E5.bin"
Last reload reason: power-on

SW05-01-IDF(config)#policy-map ?
% Unrecognized command

SW05-01-IDF(config)#class-map ?
% Unrecognized command

SW05-01-IDF#show run policy-map
Building configuration...

Current configuration : 6 bytes
end

SW05-01-IDF#show run class-map
Building configuration...

Current configuration : 6 bytes
end

Re: C2960X cannot configure policy-map

balaji.bandi — Fri, 13 Jan 2023 20:16:01 GMT

post below output :

show version (full)

show license (you need minimum lan base to use that command - lan lite not work)

show sdm prefer

Re: C2960X cannot configure policy-map

tovifang — Sat, 14 Jan 2023 06:54:34 GMT

hi balaji here is the information you need

ROM: Bootstrap program is C2960X boot loader
BOOTLDR: C2960X Boot Loader (C2960X-HBOOT-M) Version 15.2(6r)E, RELEASE SOFTWARE (fc1)

SW05-01-IDF uptime is 15 hours, 51 minutes
System returned to ROM by power-on
System restarted at 22:55:16 UTC Fri Jan 13 2023
System image file is "flash:/c2960x-universalk9-mz.152-7.E5.bin"
Last reload reason: power-on

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco WS-C2960X-24TS-LL (APM86XXX) processor (revision K0) with 262144K bytes of memory.
Processor board ID FOC2026V3YX
Last reset from power-on
2 Virtual Ethernet interfaces
1 FastEthernet interface
26 Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address : 00:A2:89:82:91:80
Motherboard assembly number : 73-15975-02
Power supply part number : 341-0529-02
Motherboard serial number : FOC202650A7
Power supply serial number : LIT20180J8C
Model revision number : K0
Motherboard revision number : C0
Model number : WS-C2960X-24TS-LL
Daughterboard assembly number : 73-14200-03
Daughterboard serial number : FOC20262H4Q
System serial number : FOC2026V3YX
Top Assembly Part Number : 800-41472-01
Top Assembly Revision Number : E0
Version ID : V03
CLEI Code Number : COMGJ00ARE
Daughterboard revision number : A0
Hardware Board Revision Number : 0x12

Switch Ports Model SW Version SW Image
------ ----- ----- ---------- ----------
* 1 26 WS-C2960X-24TS-LL 15.2(7)E5 C2960X-UNIVERSALK9-M
Configuration register is 0xF

SW05-01-IDF# show license
Index 1 Feature: lanbase
Period left: 0 minute 0 second
Index 2 Feature: lanlite
Period left: Life time
License Type: Permanent
License State: Active, In Use
License Priority: Medium
License Count: Non-Counted

SW05-01-IDF#show sdm prefer
The current template is "default" template.
The selected template optimizes the resources in
the switch to support this level of features for
0 routed interfaces and 64 VLANs.

number of unicast mac addresses: 16K
number of IPv4 IGMP groups + multicast routes: 1K
number of IPv4 unicast routes: 0.375k
number of directly-connected IPv4 hosts: 0.375k
number of indirect IPv4 routes: 64
number of IPv6 multicast groups: 1K
number of IPv6 unicast routes: 0.25K
number of directly-connected IPv6 addresses: 0.25K
number of indirect IPv6 unicast routes: 32
number of IPv4 policy based routing aces: 0
number of IPv4/MAC qos aces: 0.375k
number of IPv4/MAC security aces: 0.25K
number of IPv6 policy based routing aces: 0
number of IPv6 qos aces: 0.25K
number of IPv6 security aces: 0.25K

Re: C2960X cannot configure policy-map

balaji.bandi — Sat, 14 Jan 2023 10:39:27 GMT

Index 2 Feature: lanlite <- because of this it will not work. get landbased or higher to work.
Period left: Life time
License Type: Permanent
License State: Active, In Use
License Priority: Medium
License Count: Non-Counted

Re: C2960X cannot configure policy-map

tovifang — Mon, 16 Jan 2023 05:07:36 GMT

hi balaji thanks for your reply, I would also like to know the following questions
1, reset the switch to restore legacy mode, but I found that if I trying to remove the dot1x configuration on the port causes a direct mode switch, is there a way to stop the automatic use of new-style.

2, is there an example of configuring dot1x authentication on this new-style lanlite currently.

Re: C2960X cannot configure policy-map

balaji.bandi — Mon, 16 Jan 2023 10:39:22 GMT

the image not clear not sure - so post the output in text file and also post show run