[PREDATOR_P1B] Mystery Catalyst 4500X switch. What is it? What IOS image?

kln_nurv · ‎01-02-2019

I have come across a cat45x device that I at first thought just had a bad rommon installed. The hardware looks almost identical to a C4540-X, with the air intake slot along the top of the front, but some of the details such as air vent patterns look more like Nexus 3000 style. The fan tray at the back is similar to C4900 series. The fans cannot be removed individually.

The rommon says that the hardware is a WS-C4932X, which as far as I can tell does not exist. There are no stickers or silkscreening on the outside of the device at all. The device does boot c45x-universalk9 ios-xe images, but it complains about some unknown pci devices and the license service crashes (date is 1/1/2000).

The serial number on the system board comes up as "unknown" to TAC. There is a sticker that says "PREDATOR_P1B_18" on the system board, as well as the usual hologram sticker.

I can see only 2 possibilities. Either this is a fake device, or it is a prototype based on a modified C4540.

So, what exactly do i have, and is it possible to make it work well enough for lab use? Thanks in advance.

Leo Laohoo · ‎01-02-2019

Never heard of a WS-C4932X. I am suspecting you are looking at a engineering unit handed out to companies to "field test" or evaluation.
But the 2nd picture resembles that of a 6840.

kln_nurv · ‎01-02-2019

It seems likely that it is an engineering sample, but this unit seems newer/better than a normal C4540 despite being dated 2011. I have reason to believe it was used in production at some point because there are 2 (unreadable) labels on it of the sort used in labs and datacenters.

Are there any telltale signs to look for in determining if it is in fact an engineering sample?

Also: how can I boot ios-xe on a switch with a reset system clock? there seems to be no command to set the date from rommon. The first thing ios-xe does is check the license (and crash).

Leo Laohoo · ‎01-02-2019

The internal clock is dead. That's why the license is not working. That's my suspicion.
You might want to contact a Cisco office and give them the pictures. I think they may want this switch back.

kln_nurv · ‎01-02-2019

Yes, the internal clock is dead. I can swap the battery easily but how to get around this chicken-and-egg problem? I dont think NTP works in rommon.

I have been in touch with TAC and they dont want it back. It isnt on any list of confidential or stolen hardware that they could check. They couldnt tell me what it is, but they did confirm that if it was under NDA in the past (if it is a sample/dev unit) it would have most likely expired long ago. It would have to be examined and certified by an authorized support partner before buying a contract, and as its not a production model it would be unlikely to pass. In short they dont want anything to do with it.

Leo Laohoo · ‎01-03-2019

@kln_nurv wrote:

I have been in touch with TAC and they dont want it back. It isnt on any list of confidential or stolen hardware that they could check. They couldnt tell me what it is, but they did confirm that if it was under NDA in the past (if it is a sample/dev unit) it would have most likely expired long ago. It would have to be examined and certified by an authorized support partner before buying a contract, and as its not a production model it would be unlikely to pass. In short they dont want anything to do with it.

I don't believe you've "hit" TAC. I suspect you reached the "gatekeepers", aka the Entitlements Team. They don't have the serial number in the DB because they're not meant to see it.

Contact the local Cisco office. Tell the local Cisco office that you have stumbled upon an engineering sample unit.

kln_nurv · ‎01-03-2019

I called them again and got through to someone who could lookup the more special hardware. It is in fact an engineering sample but they couldnt tell me anything more than that as the serial number is for a child part (the system board). They dont want it back though.

The main hurdle is the lack of a chassis serial number. Without that, they cant open a tac case even if they want to.

So, given that its mostly a 4500X, with a powerpc cpu, which ios image should be able to boot enough to show the chassis serial number and/or set the system clock? It doesnt even have to bring up any of the interfaces. Compared to older 'green' hardware, theres surprisingly little technical info available, so its hard to know what should work. despite 4500E/4500X/4900 supposedly being very similar, booting images has been very hit-and-miss. Most of my attempts have no error at all, just 4 broken pipe characters then nothing.

¦¦¦¦

kln_nurv · ‎01-14-2019

Here's a bootlog:

FPGA signature verification PASSED for primary image

#####
#     #     #     ####    ####    ####
#           #    #       #    # #    #
#           #     ####   #       #    #
#           #         # #       #    #
#     #     #    #    # #    # #    #
#####      #     ####    ####    ####

######
#     # ###### #####   #    #   ####
#     # #       #    # #    # #    #
#     # #####   #####   #    # #
#     # #       #    # #    # # ###
#     # #       #    # #    # #    #
######   ###### ####     ####    ####

#     #
#     # ###### #####    ####      #     ####   #    #
#     # #       #    # #          #    #    # ##   #
#     # #####   #    #   ####      #    #    # # # #
#   #   #       #####        #     #    #    # # # #
   # #    #       #   #   #    #     #    #    # #   ##
    #     ###### #    #   ####      #     ####   #    #

***********************************************************
*                                                         *
* Welcome to Rom Monitor for        WS-4932X System.      *
* Copyright (c) 2000-2011 by Cisco Systems, Inc.          *
* All rights reserved.                                    *
*                                                         *
***********************************************************

Rom Monitor Program Version 15.0(1r)SG(0.301)
CPU Rev: 2.2 Board Rev: 1, Board Type: 107, CPLD Mobat Rev:1.0x3571.0xba3
Chassis: WS-4932X
Got Mac Address: 00:22:bd:cf:51:f3

MAC Address : 00-22-bd-cf-51-f3
IP Address   : 10.1.1.242
Netmask      : 255.255.255.0
Gateway      : Not set.
TftpServer   : 10.1.1.1

Peer supervicor not detected or is not running IOS
Supervisor uplinks and all linecards have been reset

Established physical link 1Gb Full Duplex
Network layer connectivity may take a few seconds

rommon 1 >boot tftp://10.1.1.1/cat4500e-universalk9.SPA.03.07.00.E.bin:

Tftp Session details are .....

Filename:    : /cat4500e-universalk9.SPA.03.07.00.E.bin
Ip Address   : 10.1.1.242
Loading from TftpServer: 10.1.1.1

Received data packet # 362698

Loaded 185701352 bytes successfully.

Checking digital signature
tftp://10.1.1.1/cat4500e-universalk9.SPA.03.07.00.E.bin
Digitally Signed Release Software with key version A

Rommon reg: 0x00084F80
Reset2Reg: 0x00000F00

Image load status: 0x00000000
###
Winter 110 controller 0x0468ADD8..0x047F413F Size 0x002FDB9D
Program Done!
#####################
[    0.061948] pci 0000:00:00.0 ignoring class b20 (doesnt match header type 01)
[    0.152040] pci 0000:04:00.0 ignoring class b20 (doesnt match header type 01)
[    0.243874] pci 0000:0c:00.0 ignoring class b20 (doesnt match header type 01)
Starting System Services
devpts /dev/pts devpts rw,nosuid.noexec,relatime,gid-4,mode=600,ptmxmode=000 0 0
Jan 1 00:10:06 %IOSXE-3-PLATFORM: process kernel: [ 14.630979] hub 1-0:1.0: over-current condition on port 2
Error!! POST pre-start: /flash0 is not mounted.
Error!! POST post-stop: /flash0 is not mounted.
Jan 1 00:10:19 %IOSXE-3-PLATFORM: process kernel: [ 28.342199] mpc85xx_pci_err_probe: Unable to request irq 0 for MCP85xx PCI err.
Jan 1 00:10:19 %IOSXE-3-PLATFORM: process kernel: [ 28.354457] mpc85xx_pcie_err_probe: Unable to request irq 0 for MCP85xx PCIe err.
Loading gsbu64atomic as gdb64atomic
Failed to bring interface "eth1" up
Using 1 for MTS slot
Platform Manager: acquire hwlock chassis()
Platform Manager: starting in standalone mode
Jan 1 00:10:42 %
<Sat Jan 1 00:10:42 2000> Message from sysmgr: Reason code:[2] Reset Reason:Service [licensed] pid:[3985] terminated abnormally [256].
Details:
--------
Service: License Daemon
Description: License Daemon
Executable: /usr/binos/bin/licensed

Started at Sat Jan 1 00:10:34 2000 (839074 uS)
Stopped at Sat Jan 1 00:10:42 2000 (454468 uS)
Uptime: 8 seconds

Start type: SRV_OPTION_RESTART_STATELESS (23)
Death reason: SYSMGR_DEATH_REASON_FAILURE_exit (1)
Last heartbeat 0.00 secs ago
Exit code: SYSMGR_EXITCODE_SYSERR (1)

PID: 3985
UUID: 511
umount:/proc/fs/nfsd: not mounted
/etc/rc6.d/S01reboot: line 198: umount_cisco_filesystems: command not found
Please stand by while rebooting the system...
[   73.999512] Restarting system.

I'd just like to get this thing to boot IOS and save it from the scrap heap. Unfortunately there's less technical information 'out there' compared to older green hardware. Anyone have any ideas how to get around the license service crashing?

Is there anywhere that has a list of what CPU architecture is used by each family of switches? How about a list of min and max supported IOS versions for each? Is it normal for a bad date alone to cause licensed to crash? If not, what would? Surely someone knows something.