cisco 9300 crashing during boot up after disabling password recovery and ignoring startup cfg

[chris.nelson]

Hi All,

I am hoping someone can help with this issue.

I have configured a cisco 9300 24T-A to disable password recovery and under a particular use case I need to ignore startup config. When both of these are enabled, my switch continuously crashes during boot up and always at the point where it asks "Do you want to erase the config?"

I am running Gibraltar 16.12.1

Has anyone seen this before?

[balaji.bandi]

Can you post complete boot log from start to rebooting again again, to understand.

[Leo Laohoo]

Console into the switch and reboot.
Post the entire boot-up process.

[chris.nelson]

Hi,

Thanks for the responses, and sorry for the late reply. I could only get access to the switch today.

I have attached a file that shows the boot up sequence from when I set the SWITCH_IGNORE_STARTUP_CFG variable in rommon.

Any help would be great. Thank you

[balaji.bandi]

Look at the below messages some bug : ( what happends when you make changes for the startup and password config put back- is this stable ?) - then only case if you diable having issue, then Raise an TAC case.

Both ignore startup configuration and disable password are set
This will result in erasing the startup config
Do you want to Erase the config? Default: n, Answer y/n:

Exception to IOS Thread:
Frame pointer 0x7F3F9AC35770, PC = 0x7F4089635D15

UNIX-EXT-SIGNAL: Segmentation fault(11), Process = Net Background
-Traceback= 1#1350f061a78508b993d0b9e25bd0eecc dpidb_config:7F408959C000+99D15 :556F0F39F000+B5BFA43 :556F0F39F000+B5BE3E8 :556F0F39F000+67B2EBC :556F0F39F

[chris.nelson]

Hi,

I hope that I understand your question correctly - everything works fine in any other case other than the one I have mentioned. So if I disable password recovery and I don't ignore startup config it works fine

if I enable password recovery and ignore the startup config it works fine.

funnily I have raised a TAC case and due to an office error, the device is no longer covered under support contract so they won't look into it until a new support contract has been bought. They suggested asking the community, so here I am.

Thank you for the response

[Leo Laohoo]

Try loading 16.12.3a.
NOTE: Unless the switch is passive highly-sensitive/highly-classified information, I do not recommend disabling the password recovery function.

[chris.nelson]

Hi,

Thank you for the response.

Do you know whether this issue exists in 16.12.3a?

It is a security requirement that we prevent anyone from being able to access the switch, so we have to disable password recovery

[chris.nelson]

Hi All,

I will try 16.12.3a next week when I get access to the switch. If it works I will respond and mark your solution as accepted

thank you for the help

[balaji.bandi]

was testing " 16.12.3a" last few weeks, they seems to stable (based on my requirement) but worth trying if you get chance and keep us posted how it goes.

[chris.nelson]

After a discussion with our security advisor, I have installed 17.2.1 (because it is the latest IOS available) and the issue is still there. disabling password recovery and ignoring the start up config causes the switch to crash during boot up.

I am going to downgrade to 16.9.1 -> this was the version that the switch shipped with and I know the issue wasn't there

[balaji.bandi]

yes to restore stable network going back to the old version. and raise a TAC case to investigate for you. hopefully, they come with solution.

[chris.nelson]

Hi All,

an update for you: I have installed 16.12.3a as well as 17.2.1 and both IOS builds include this bug.

I reverted to 16.9.1 and everything is working fine.

I have finally managed to raise a TAC case

Thank you all for your help

[balaji.bandi]

Thank you for the input and learned lession on this version and bug. TAC may add next relase and contact you.

[Ahoysoy]

We are experiencing the same problem with our 9300. Is there a known fix for this bug?