topic Re: CSM 3.3.1 and 6500 in Network Security

CSM 3.3.1 and 6500

Nikos Nicolaides — Fri, 21 Feb 2020 12:13:55 GMT

Hello,

We are facing a problem with CSM 3.3.1 and 6500 switch with FWSM. We have 2x 6500 switches with 2 supervisors in each + 2 FWSM cards one in each chassis. The problem is that we have CSM 3.3.1 that manages the switch and FWSM. The problem is that when we try to delete a VLAN in 6500 we get a deployment failure because the switch outputs this message:

% Applying VLAN changes may take few minutes. Please wait..

We are using the following IOS version.

CSR-CORE#sh ver

Cisco IOS Software, s72033_rp Software (s72033_rp-IPSERVICESK9_WAN-M), Version 12.2(33)SXI2a, RELEASE SOFTWARE (fc2)

Technical Support: http://www.cisco.com/techsupport

Compiled Wed 02-Sep-09 01:00 by prod_rel_team

ROM: System Bootstrap, Version 12.2(17r)SX6, RELEASE SOFTWARE (fc1)

CSR-CORE uptime is 22 weeks, 6 days, 23 hours, 59 minutes

Uptime for this control processor is 22 weeks, 6 days, 23 hours, 55 minutes

Time since CSR-CORE switched to active is 22 weeks, 6 days, 23 hours, 55 minutes

System returned to ROM by power cycle at 06:42:16 UTC Fri Feb 12 2010 (SP by power on)

System restarted at 11:10:39 EEST Mon Jun 14 2010

System image file is "sup-bootdisk:s72033-ipservicesk9_wan-mz.122-33.SXI2a.bin"

Last reload reason: Reload Command

This product contains cryptographic features and is subject to United

States and local country laws governing import, export, transfer and

use. Delivery of Cisco cryptographic products does not imply

third-party authority to import, export, distribute or use encryption.

Importers, exporters, distributors and users are responsible for

compliance with U.S. and local country laws. By using this product you

agree to comply with applicable laws and regulations. If you are unable

to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:

http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to

export@cisco.com.

cisco WS-C6509-E (R7000) processor (revision 1.5) with 983008K/65536K bytes of memory.

Processor board ID SMC1401000U

SR71000 CPU at 600Mhz, Implementation 0x504, Rev 1.2, 512KB L2 Cache

Last reset from s/w reset

30 Virtual Ethernet interfaces

116 Gigabit Ethernet interfaces

12 Ten Gigabit Ethernet interfaces

1917K bytes of non-volatile configuration memory.

8192K bytes of packet buffer memory.

65536K bytes of Flash internal SIMM (Sector size 512K).

Configuration register is 0x2102

CSR-CORE#

Note that we are NOT using VSS.

TIA,

Nicos

Re: CSM 3.3.1 and 6500

Panos Kampanakis — Wed, 26 Jan 2011 16:28:57 GMT

Geia sou Niko,

I would suggest looking into https://supportforums.cisco.com/docs/DOC-14307#212_Failed_deployment

Your deployment fails because the parser doesn't consider the warning as a success code. Your workaround for these commands could be a FlexConfig that pushes the command.

I hope it helps.

Re: CSM 3.3.1 and 6500

Stefano De Crescenzo — Sat, 12 Feb 2011 10:08:02 GMT

Hi Nicolas,

did Panos answer answers your question? Otherwise let us know and we will investigate further.

Thanks

Stefano

Re: CSM 3.3.1 and 6500

Nikos Nicolaides — Mon, 11 Apr 2011 13:56:51 GMT

Hi all,

Sorry for not replying earlier. We found a workaround, as quoted below:

Changing How Security Manager Responds to Device Messages

Security Manager has built-in responses to many of the response messages that can be encountered when configuring a device. You might find that messages Security Manager treats as errors are messages that you want to ignore or treat as informational. Although you can configure your deployment jobs to ignore errors, you might instead want to update Security Manager to treat specific messages differently. To change how Security Manager treats a message, you need to update the DCS.properties file in \CSCOpx\MDC\athena\config folder in the installation directory (usually c:\Program Files).

Use a text editor such as NotePad to update the file. It is easiest to determine the message you want to ignore by looking at the transcript of a deployment job that encountered the error using these steps:

Step 1 Select the job with the error message from the Deployment Manager window.

Step 2 Click the Transcript button in the Deployment Details tab to open the transcript.

Step 3 Identify the error text that you want to ignore.

Step 4 Locate the appropriate warning expressions property in the DCS.properties file. For example, for PIX devices the property is called dev.pix.warningExpressions, whereas for IOS devices the property is called dev.ios.warningExpressions.Conversely, you can make device responses that are not tagged with the Error prefix to appear as error messages. To do this, add the message to the Error Expressions list (for example, dev.pix.ErrorExpressions).

Step 5 Add the error text to the warning expressions list. The warning message should be a generic regular expression string. Except for the last expression, you must delimit all expressions with “$\”. For example, if the message you want to ignore is “Enter a public key as a hexadecimal number,” enter the following string: .*Enter a public key as a hexidecimal number .*$

Step 6 Restart the CiscoWorks Daemon Manager

This has resolved the issue successfully