Cisco 3560 downgrade from 15.2 to 12.2

[Almas]

Hello,

I have a switch 3560. When I checked version of the switch in July, it was 15.2. Today when I have checked it again it was 12.2. And I didn't find 15.2 IOS in flash.

Can you help me? Why did switch change version?

[Richard Burts]

We do not have much detail about your situation and that makes it difficult to give good advice. The one thing we can say is that if in July the switch was running 15.2 and if 15.2 was not in flash, and if the switch rebooted for some reason (perhaps a power interruption, perhaps a bug induced crash, or something else) then the switch would boot using what it found in flash, which seems to be 12.2.

The interesting question is how did the switch boot (at some point) 15.2. Is it possible that 15.2 was in flash, the switch booted using that image, and for some reason that version was later deleted from flash? Is is possible that the switch booted 15.2 using some external source and no longe has access to that remote source?

[Almas]

Hello, 

all our switches use only flash to boot IOS. We use tftp server to download IOS from tftp server to flash. 

And I don't know why 15.5 IOS was deleted and how was it deleted. this is generally strange. 

show version
Cisco IOS Software, C3560E Software (C3560E-UNIVERSALK9-M), Version 12.2(55)SE8, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Wed 26-Jun-13 10:58 by prod_rel_team
Image text-base: 0x00003000, data-base: 0x02800000

ROM: Bootstrap program is C3560E boot loader
BOOTLDR: C3560E Boot Loader (C3560X-HBOOT-M) Version 12.2(58r)SE1, RELEASE SOFTWARE (fc1)

ALMATY-AHB-SW5 uptime is 11 weeks, 1 day, 2 hours, 27 minutes
System returned to ROM by power-on
System restarted at 10:56:33 ALM Sun Jul 4 2021
System image file is "flash:/c3560e-universalk9-mz.122-55.SE8/c3560e-universalk9-mz.122-55.SE8.bin"

Switch Ports Model SW Version SW Image
------ ----- ----- ---------- ----------
* 1 30 WS-C3560X-24P 12.2(55)SE8 C3560E-UNIVERSALK9-M

Configuration register is 0xF

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

show boot
BOOT path-list : flash:c3560e-universalk9-mz.122-55.SE8
Config file : flash:/config.text
Private Config file : flash:/private-config.text
Enable Break : no
Manual Boot : no
HELPER path-list :
Auto upgrade : yes
Auto upgrade path :
NVRAM/Config file
buffer size: 524288
Timeout for Config
Download: 0 seconds
Config Download
via DHCP: disabled (next boot: disabled)

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

dir flash:
Directory of flash:/

2 -rwx 4012 Apr 1 2021 15:43:52 +06:00 private-config.text
3 -rwx 1516 Mar 1 1993 06:01:02 +06:00 vlan.dat
4 -rwx 9627 Apr 1 2021 15:43:52 +06:00 config.text
503 -rwx 4120 Mar 1 1993 06:01:08 +06:00 multiple-fs
6 drwx 512 Mar 1 1993 06:08:42 +06:00 c3560e-universalk9-mz.122-55.SE8

57671680 bytes total (38003712 bytes free)

[Leo Laohoo]

Post the complete output to the command "sh log on up detail".

[Almas]

sh log on up detail
--------------------------------------------------------------------------------
UPTIME SUMMARY INFORMATION
--------------------------------------------------------------------------------
First customer power on : 03/01/1993 06:06:20
Total uptime : 3 years 35 weeks 1 days 16 hours 10 minutes
Total downtime : 27 years 37 weeks 0 days 0 hours 45 minutes
Number of resets : 10
Number of slot changes : 0
Current reset reason : 0x0
Current reset timestamp : 07/04/2021 11:02:13
Current slot : 1
Current uptime : 0 years 11 weeks 1 days 2 hours 0 minutes
--------------------------------------------------------------------------------
Reset | |
Reason | Count |
--------------------------------------------------------------------------------
No historical data to display
--------------------------------------------------------------------------------

--------------------------------------------------------------------------------
UPTIME CONTINUOUS INFORMATION
--------------------------------------------------------------------------------
Time Stamp | Reset | Uptime
MM/DD/YYYY HH:MM:SS | Reason | years weeks days hours minutes
--------------------------------------------------------------------------------
03/01/1993 06:06:20 0x0 0 0 0 0 0
03/01/1993 06:06:20 0x0 0 48 5 23 0
03/01/1993 06:06:20 0x0 0 6 2 6 0
03/01/1993 06:06:20 0x0 0 0 0 15 0
03/01/1993 06:06:20 0x0 0 1 5 18 0
03/01/1993 06:06:20 0x0 0 25 4 1 0
03/01/1993 06:06:20 0x0 1 11 4 19 0
10/03/2019 12:52:50 0x0 0 0 3 22 0
07/04/2021 10:39:39 0x0 0 33 3 6 0
07/04/2021 11:02:13 0x0 0 0 0 0 10
--------------------------------------------------------------------------------

[Leo Laohoo]

Is NTP configured on the switch?

[Almas]

yes,

show clock detail
13:43:46.136 ALM Mon Sep 20 2021
Time source is NTP

[Leo Laohoo]

It looks to me someone has deleted the 15.X subdirectories, leaving the default 12.2(58)SE2 firmware behind, before the switch was rebooted.

---

@Almas wrote:
07/04/2021 10:39:39 0x0 0 33 3 6 0

---

After an uptime of 33 weeks, 3 hour and 6 minutes, the switch rebooted.  I suspect the switch rebooted in 15.X firmware on 1039z, 04 July 2021. 

---

@Almas wrote:
07/04/2021 11:02:13 0x0 0 0 0 0 10

---

After 10 minutes of uptime, the switch rebooted at 1049z, 04 July 2021.  Normally, it takes for a switch around 5 minutes to reboot.  This one took longer because the switch downgraded from 15.X to 12.2(58)SE2 and this means there is a ROMMON downgrade process.  And this is why the last timestamp was 1102z, 04 July 2021.  This is the time when the switch "came back" after the IOS downgrade.

I would also say that it was during this time that the 15.X firmware files were deleted between 1039z and 1049z, 04 July 2021.

[Almas]

Thank you,

I checked the ISE (tacacs report). And on this day nobody connected to the
switch and wrote the commands.
Can the switch delete the IOS image by himself?

[Leo Laohoo]

---

@Almas wrote:
Can the switch delete the IOS image by himself?

---

No, it can't. 

---

@Almas wrote:
And on this day nobody connected to the switch and wrote the commands.

---

SNMP push a command to delete the directory/file(s).