3850 failure state requirement

[kirkchris01]

I am trying to research the failure state options and settings for the requirement below:

If the device fails, it must not fail in a manner that will allow unauthorized access. If the switch fails for any reason, it must stop forwarding traffic altogether or maintain the configured security policies. If the device stops forwarding traffic, maintaining network availability would be achieved through device redundancy.

What are the failure state options/configurations for a 3850 switch? I read the document on failure state and I do not see it. 

[Reza Sharifi · Accepted solution]

Hi,

What are the failure state options/configurations for a 3850 switch?

So, if device fails physically (power failure, PSU failure or someone unplugging the cord(s)) the device will not be accessible and will stop forwarding traffic.

If the device fails say by an IOS crash, than it usually stops forwarding traffic as well. In both cases, if you have a redundancy the redundant device should take over packet forwarding. 

HTH

[aspangenberg]

Any chance you could link to documentation on this?  I agree with the statements you made, but my security group needs some type of official doc in regards to how IOS crash affects traffic forwarding.

[Reza Sharifi]

Have a look at this troubleshooting document.

https://www.cisco.com/c/en/us/support/docs/universal-gateways-access-servers/90-series-customer-premises-equipment/7900-crashes-router-troubleshooting.html

HTH