What image can i upgrade to on a WS-C3560-48PS-S switch?

[jjones0021]

Hello,

On this device we currently have the c3560-ipbase-mz.122-25.SEE2.bin image. I need do install a crypto image in order to enable SSH and disable telnet as part of a security requirement. With other switches i have just found the associated crypto image i.e c3560-ipbaseK9-mz.122-25.SEE2.bin, however this image no longer exists. I can find a c3560-ipbaseK9-mz.122-25.SEE3.bin, which seems to be the next version. However this is also deferred and i expect soon to be removed.

Basically, i want a compatible crypto image, ideally that isn't deferred, but if it is that's fine. I cant find any information with upgrade compatibility. What am i able to upgrade the current image to?

Kind regards,

Jay

[Johannes Botha]

Can you paste the output from show version. Would like to see how much memory total. also if you can do dir in cli.

[jjones0021]

Here is the show version output Johannes.

ET-LAN-3560-SW1>show version
Cisco IOS Software, C3560 Software (C3560-IPBASE-M), Version 12.2(25)SEE2, RELEA                                                                                                                       SE SOFTWARE (fc1)
Copyright (c) 1986-2006 by Cisco Systems, Inc.
Compiled Fri 28-Jul-06 07:19 by yenanh
Image text-base: 0x00003000, data-base: 0x00EB0F14

ROM: Bootstrap program is C3560 boot loader
BOOTLDR: C3560 Boot Loader (C3560-HBOOT-M) Version 12.2(25r)SEC, RELEASE SOFTWAR                                                                                                                       E (fc4)

ET-LAN-3560-SW1 uptime is 1 year, 17 weeks, 4 days, 20 hours, 55 minutes
System returned to ROM by power-on
System restarted at 17:26:24 UTC Fri Oct 25 2013
System image file is "flash:c3560-ipbase-mz.122-25.SEE2/c3560-ipbase-mz.122-25.S                                                                                                                       EE2.bin"

cisco WS-C3560-48PS (PowerPC405) processor (revision M0) with 118784K/12280K byt                                                                                                                       es of memory.
Processor board ID CAT1048RJPJ
Last reset from power-on
2 Virtual Ethernet interfaces
48 FastEthernet interfaces
4 Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address       : 00:1A:6D:16:2C:00
Motherboard assembly number     : 73-9676-12
Power supply part number        : 341-0029-05
Motherboard serial number       : CAT10485LLV
Power supply serial number      : DTH1047C1EM
Model revision number           : M0
Motherboard revision number     : A0
Model number                    : WS-C3560-48PS-S
System serial number            : CAT1048RJPJ
SFP Module assembly part number : 73-7757-03
SFP Module revision Number      : A0
SFP Module serial number        : CAT10485H6V
Top Assembly Part Number        : 800-25859-03
Top Assembly Revision Number    : G0
Version ID                      : V04
CLEI Code Number                : CNMV3N0CRC
Hardware Board Revision Number  : 0x01

Switch   Ports  Model              SW Version              SW Image
------   -----  -----              ----------              ----------
*    1   52     WS-C3560-48PS      12.2(25)SEE2            C3560-IPBASE-M

Configuration register is 0xF

Here are the contents of the flash:/ directory

ET-LAN-3560-SW1#dir
Directory of flash:/

    2  -rwx         143   Nov 5 2010 10:47:50 +00:00  private-config.text
    3  -rwx         736   Mar 1 1993 00:01:01 +00:00  vlan.dat
    4  -rwx       23160   Nov 5 2010 10:47:50 +00:00  config.text
    5  drwx         192   Mar 1 1993 00:06:17 +00:00  c3560-ipbase-mz.122-25.SEE2
  409  -rwx        2072   Nov 5 2010 10:47:50 +00:00  multiple-fs

15998976 bytes total (7817728 bytes free)

Looks like the image file is in the diretory with the same name.

Directory of flash:/c3560-ipbase-mz.122-25.SEE2/

    6  -rwx     6428863   Mar 1 1993 00:05:31 +00:00  c3560-ipbase-mz.122-25.SEE2.bin
    7  drwx        4096   Mar 1 1993 00:05:48 +00:00  html
  408  -rwx         414   Mar 1 1993 00:06:17 +00:00  info

15998976 bytes total (7817728 bytes free)

[rakeshvelagala]

You can upgrade to below

Description:	IP BASE
Release:	12.2.55-SE10
Release Date:	13/Feb/2015
File Name:	c3560-ipbasek9-mz.122-55.SE10.bin
Min Memory:	DRAM 128 MB Flash 16 MB
Size:	11.23 MB (11773637 bytes)
MD5 Checksum:	5e6b0a8846fbf5a1929a533bcd343bcf

[jjones0021]

Hello,

This is the latest IOS version correct? Can you find any documentation that shows upgrade compatibility? Ideally i would like to upgrade to this version, but without some reassurances i cant make such a jump.

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

(55)SE10 is not the latest IOS version, although it's probably one of the latest revisions released.

If Cisco lists an IOS image for your hardware, that's your reassurance that it's compatible.  Of course, it's a good idea to review the release notes.

Many using 3750s (the hardware sibling of the 3560) have found the later 55SE releases (8..9) very stable/solid.  I think I recall last time I looked at the 3750 software, (55)SE9 was even recommended by Cisco as being very stable.

[jjones0021]

Thanks for the clarification on this. I'm just being extra cautious as these switches are for our office LAN. I'm sticking to the 122-35.SE5 image for now, see how that goes and then upgrade in the future if need be. At present the requirement is that we enable SSH and turn off Telnet as it is deemed a security risk.

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Usually, new IOS versions support older IOS version features, unless the older IOS feature was replaced by something better.  I.e. usually a new IOS will "digest" an upgraded system's config file.

The latter 55SE versions have been generally found to be very stable, so if you're going to upgrade, moving to it might be a good option for you.  If you want to stay closer to your existing version, find the oldest 3560 version, after your 25SE, and select the last of a series of patches.  This will minimize the introduction of new features, but it will also avoid generic functional improvements and/or security patches that are not applied to very old IOS versions.

[jjones0021]

Thanks for your reply Joseph. So as they are generally stable maybe its worth attempting the latest image? I will do a config backup so i can just stick that back in if it goes West.

Is there a difference between the SEE IOS i have and the latest SE IOS? Do i need to keep to the highest SEE version or are all of the IOS available for the model compatible?

[jjones0021]

OK so i tried to upload the 55SE IOS and it failed with lots of !OOO! erroring. Pretty scary stuff. Looks like i haven't got enough memory in flash to do this. Can i remove the old IOS file or does it need to be there for the switch to function?

[Joseph W. Doherty · Accepted solution]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

Some of the very original 3560/3750 only had a 16MB flash, so they have insufficient space to hold 15.x IOS versions.  (Unless you need features within those, I would recommend staying with 12.2.)  It shouldn't matter whether is image is SE or SEE for compatibility as long as Cisco notes the image is supported on your model.

Even the later models with 32 MB flash might not have space to hold both an old and new image.  (Much depends on how old the old image is.)

Space usage is also slightly higher with .tar images, that have web management "stuff" and  the IPServices or universal images are also slightly larger than the IPBase images.

Often with the later images you need to erase the old image to provide sufficient space for the new image.  This is okay unless your switch reloads before you have a good image in flash.  If you don't have one, switch will load into ROMMOM and you then need to load image via console, which is very, very slow compared to network loads.

From your errors, I wonder whether you have lack of space or a "flaky" network connection.  How exactly were you doing the new software load?

[jjones0021]

Hi Joseph,

We must have early models as they only have 16MB flash. I've managed to squeeze the 122-35.SE5 IOS onto each of the switches. Ive got some maintenance time planned on Friday so will try loading from the new image and see how it goes.

I was uploading the images onto each switch via a management server over the network, using a tftp server on that management server.

"This is okay unless your switch reloads before you have a good image in flash." - So does this mean if i removed the existing image from flash then it wouldn't effect the switch? At least until i did a reload? Of course at that point i would have to tell it to reload from the new image?

Thanks for your help so far!

[Joseph W. Doherty]

Disclaimer

The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.

Liability Disclaimer

In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.

Posting

The switch doesn't use the flash image what it's running it. It only needs the image when you boot it.  So, yes, you can delete the running image without impacting the switch.

However, if you've room for both, you can set up the boot variable to try to boot images in a selected sequence.  I.e. you can inform the switch to boot the new image while retaining the old image.

[jjones0021]

Thanks for your help throughout this. I have successfully loaded the crypto image onto each switch and reloaded then onto that IOS. This has enabled me to disable telnet and enable SSH. 

[Joseph W. Doherty]

Oh, that's great to hear!  Thanks for the update.