Harden Cisco IOS Devices

[Rodrigo Belo]

I am trying to "harden" my network devices:

- Cisco Catalyst 3750 (IOS Version 12.2(52)SE)

- Cisco Catalyst 3550 (IOS Version 12.2(52)SE)

- Cisco Catalyst 2960 (IOS Version 12.2(52)SE)

- Cisco Catalyst 2950 (IOS Version 12.1(22)EA13)

I found some documents very usefull available at

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080120f48.shtml

http://www.cisco.com/en/US/docs/ios/12_2/configfun/configuration/guide/fcf013.html

The problem is that I don't know what values/thresholds I should use on such features as:

- memory free low-watermark processor <threshold_in_KBytes>

- memory free low-watermark io <threshold_in_KBytes>

- memory reserve critical <value>

- exception memory minimum processor <value_in_Bytes>

- exception memory minimum io <value_in_Bytes>

- exception memory fragment processor <value_in_Bytes>

- exception memory fragment io <value_in_Bytes>

How can I know/troubleshoot how much memory the devices need to work properly??

How can know when the devices reach a critical state??

I understand it will depend on what kind of features I have enabled but...what should I do to check how much memory the current configuration needs to work properly?

thanks in advance

[Marvin Rhoads]

The particular commands you reference were only integrated into mainline builds like the ones you cited above in IOS 12.3 versions or later.

Personally I'd say if you did all of the other less esoteric reommended actions that you are ahead of 75% of your peers.

[Rodrigo Belo]

Hi Marvin,

I'm not sure what you mean by

"The particular commands you reference were only integrated into mainline builds like the ones you cited above in IOS 12.3 versions or later."

I'm using IOS 12.2 and I am using the comands!! I'm just trying to trim the values/thresholds...

I have experienced memory issues in the past and the alerts did me no good as they were either:

1) received too soon, and there was no problem with the switches;

2) received too late and I didn't had time to fix it before the network "crashed";

thanks

[Marvin Rhoads]

Some "S" build had the commands but they weren't universally implemented until 12.3.

Interesting that you have had switches crash due to memory usage. I've personally never run across a memory use-induced crash since back in the days of Cisco 7000 routers (with token ring, FDDI, source route bridging and IOS 10.x!).

[Rodrigo Belo]

The crashes were cause by "improper" configurations.

Between others, the switches were sending SNMP informs to 3 snmp servers. On a period where those servers were disconnected for maintenance, the switches could not receive SNMP response to the informs...eventually the switch memory was exausted at it failed to allocate memory for other processes like "spanning-tree".

hint: On Layer2 topologies make sure to implement features like "loop guard"

I was not expecting this at all... From that day forward I decided to harden configurations as much as  can.