Post the output of the command 'show power inline gigabitEthernet x/y detail' This should show you what type of PD the switch thinks is connected. ... View more

No, you do not need to manually set the power.  The 802.3af/at mechanism will negotiate the Class of the attached PD device.  LLDP is optional and allows for more granular power requirements.  The five classes (0 - 4) allow for 15.4W, 4W, 7W, 15.4W and 30W respectively (Class 0 is for a device that doesn't support 802.3af/at Class negotiation).  Once a device has booted CDP/LLDP can signal more granular requirements. If your devices don't signal their PD class - i.e. they are Class 0 - then they will be allocated 15.4W.  Any 802.3at PD Class 4 device should be detected as a Class 4 device.  If it doesn't then it isn't complying with the standard and I'd be reluctant to plug it in... A bit more detail here - https://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3.2_0_se/multibook/configuration_guide/b_consolidated_config_guide_3850_chapter_011010.html A device that is detected as Class 4 will initially be allocated 15.4W only.  Once its booted and CDP or LLDP kick in it can request more power up to 30W.  If your Class 4 device doesn't support CDP or LLDP then it will only be allocated 15.4W.  I am guessing a prerequisite for 802.3at is LLDP support on the PD (or at least that is what the Catalyst is expecting).  Are you sure your device doesn't support LLDP?  Have you enabled LLDP on the switch as it isn't on by default. Some notes here that are similar I think - https://community.ui.com/questions/Workaround-for-UAP-AC-802-3at-non-compliance-POE-power-problems-reboots-for-newer-Cisco-catalyst-/baf59f23-e89c-4042-8349-d05b6e3e95b7     ... View more

CDP & LLDP only happen AFTER the device has powered up.  PoE/PoE+ uses a more 'basic' mechanism that has to kick in first. You don't need to manually configure the power on any of the interfaces assuming you aren't planning to oversubscribe the PoE on the switch.  Once the PD device has booted then CDP/LLDP can do additional things that aren't possible with the 802.3af/at standard. Read this https://en.wikipedia.org/wiki/Power_over_Ethernet  and the other post with a link to the 3750 PoE troubleshooting.   Andy ... View more

@ab_ahmadi wrote: We have the same problem.most installation of the lower end devices like C2960 and C800 and even lower end ASA/Firepower are just one operation as install devices , config those devices and make it work for a while until we patch/upgrade device OS on regular basis .most of our customer located on remote , hard to reach with limited IT infra and it is not feasible for them to have a new server , virtualization and have a satellite server as VM just for SL.and we don't want any DIA in those facility.as some  customers are happy with old school PAK , why we need to break that?  For Catalyst 2960 & C800 series routers there is (currently?) no Smart License requirement and these are hardware-locked (C2960), right-to-use or license key file.  As is the ASA when running ASA/FirePOWER softwar.  FTD needs smart licensing though (however FTD software on this platform is, well you know....).  So if its just these platforms then you should be OK.   The C1100 series routers and the Catalyst 9x00 series its all Smart Licensing and there is no alternative (unless you stay below IOS-XE 16.10.x on the C1100).  I have now had to build a 'Cisco Smart Licensing' section into any design documents I write that explains to the customer their requirements.  This covers us somewhat and forces the customer to 'embrace' smart licensing...   ... View more

If it works, you are happy with the performance and you have spares then I'd honestly stay with what you have got. If you are looking at new technologies or ways to automate the configuration of the devices in the network (IBN) or if you feel you need to secure stuff more than 802.1x gives you then look to upgrade.  Catalyst 9x00 series and DNAC would be the way to go. However its a fairly big cost and I suspect you won't see many benefits.   48-port Catalyst 3560G current price on any popular auction site is no more than $100.  This will provide 48-ports at 1Gbps (plus SFP uplinks).  It supports 802.1q VLANs & trunks, IPv4 & IPv6 Routing, Routing protocols - RIP, EIGRP, OSPF, ISIS & BGP (IP Base/IP Services image restrictions obviously), IPv4 Multicast routing (IP Services), VRF-lite (IP Services).  It will do QoS (sort of - MLS QoS so ingress classification & policing and egress queuing..), it will do 802.1x so you can secure your wired Ethernet ports to authorised devices only (EAP or MAB but that's a whole other conversation and design), it supports lots of monitoring options via SNMP.  It doesn't however support MACsec, VRF/full MPLS or SD-Access like the 9x00 series does (as well as the 3650/3850 series that are nearing EoS). The L2 2960's support all these features except the L3 routing functions (the later 2960S/X support some L3 forwarding features but its very limited). Even the old 2950 supports 802.1q VLANs & trunks as well as some rudimentary QoS features and 802.1x.   If you don't need the newer features (MACsec, VRF/MPLS & SD-Access) then I would honestly stick with the older (and massively cheaper if purchased used...) switches.   Andy (I don't work for Cisco obviously...) ... View more

OK, just read through the thread again and looked at the diagram. You have 10.20.0.0/16 one one site and 10.21.0.0/16 on the other with a routed link between the two routers using 172.22.209.136/30 (i am assuming a /30 P2P link here?).  I suspect what's happening is your router 10.20.1.3 is proxy-arping for hosts on subnets 10.20.8.0/24 & 10.20.7.0/24 since it has a more specific routes that its own 10.20.0.0/16.  Check the ARP cache on the DHCP server and see if there are entries that correspond to the BAD_ADDRESS entries?   Its a 'bodged' design though and should be fixed rather than trying to work around it - engineer the crap out of the equation so its never an issue....   Andy ... View more

1st issue - secondary IPv4 addressing and DHCP...  You need to create three scopes for each of the networks and then combine them into a Super Scope on the DHCP servers so they know they can issue addresses from any of the subnets when they receive DHCP requests forwarded by the routers primary IPv4 address. 2nd issue - DHCP resilience.  Three options here.  Cluster (MS Clustering with a VIP so both DHCP servers need to be on the same L2 network), DHCP failover (available from 2012 R2 where the DHCP server database is replicated so each server knows what has been leased) or split the scopes so the servers don't have overlapping addresses to dish out. ... View more

Actually the Catalyst 3560, 3750, 3560X & 3750X do support NetFlow in the form of performance monitoring. https://community.cisco.com/t5/other-network-architecture/3750-x-and-performance-monitor/td-p/1909463 https://www.cisco.com/c/en/us/td/docs/ios/media_monitoring/configuration/guide/12_2_58_se/mm_12_2_58_se/mm_pasv_mon.html I have had this configured on an uplink on a Catalyst 3560G for ages.  Just replaced it for a 3560X and get the same features.  It lacks any IPv6 support though. ... View more

Just added the 'fips authorization-key xxxxx' to the original 3560X I was playing with that is running 15.2(4)E9 but with the 12.2(53r)SE1 bootloader.  The bootloader gets upgraded but only to 15.0(2.1.15)SE1: Checking for Bootloader upgrade..New version = Version 15.0(2.1.15)SE1 Fri Ja, Current version = Version 12.2(53r)SE1, RELEASE Upgrading Boot Loader... So I think older hardware versions never originally supported FIPS so when this came about Cisco had to provide an update to the bootloader that verified the IOS image as part of the FIPS accreditation.  Newer hardware versions I suspect already have this functionality built-in to the bootloader (anything after 15.0 I guess?). If I come across any other 3560x or 3750x's that are newer hardware versions I might see what happens when you add the fips command.   I think...   ... View more

OK, so I managed to get hold of another 3560X running 12.2(55)SE software with bootloader 12.2(53r)SE1.  This is an even older hardware version (Version ID: V01).  I upgraded it to 15.0(2)SE1 and the bootloader didn't upgrade.  The output on the console during boot simply says: ...done Initializing flashfs. Checking for Bootloader upgrade.. Boot Loader upgrade not required (Stage 2) However if you add a fips authorization key and reload it the bootloader does get upgraded: Checking for Bootloader upgrade..New version = Version 15.0(2.1.15)SE1 Fri Ja, Current version = Version 12.2(53r)SE1, RELEASE Upgrading Boot Loader... Completed processing ucode0 Completed processing bstage: Completed processing brom: Completed processing bsdcs: writing boot sectors.. Boot Upgrade image auto-rebooting ... Burning parameters into flash parameter block: MAC address: C4:71:00:00:00:00 Motherboard assembly number: 73-12557-04 Motherboard serial number: FDXXXXXXXXX Model revision number: A0 Motherboard revision number: A0 Model number: WS-C3560X-48P-L System serial number: FDXXXXXXXXX Daughterboard assembly number: 800-32786-01 Daughterboard serial number: FDXXXXXXXXX Top assembly part number: 800-31328-01 Top assembly revision number: A0 Version ID: V01 CLEI Code Number: COMJP00ARA Board configuration revision number: 0 Reading parameter block...done. Editing copy...done. Writing parameter block...done. Parameters burned into parameter block. done. The system will now restart So the bootloader is now version 15.0(2.1.15)SE1.  I then proceeded to upgrade to some later versions to see whether the bootloader would get upgraded to something later (I am aiming for 15.2(3r)E or later).  So far it hasn't.  I tried 15.2(1)E1, 15.2(3)E3 and I have just upgraded to the latest 15.2(4)E9.  The same message is displayed on the console saying the bootloader doesn't need upgrading. ...done Initializing flashfs. Checking for Bootloader upgrade..New version = Version 15.0(2.1.15)SE1 Mon Se, Current version = Version 15.0(2.1.15)SE1, TEST Boot Loader upgrade not needed(v) Still somewhat confused over this tbh... ... View more

With Network Essentials you are limited to a single OSPFv2 instance (and a single OSPFv3 instance if you are running IPv6/OSPFv3).  You are also limited to 1000 dynamically learned routes (I am not sure whether this is 1000 OSPFv2 & 1000 OSPFv3 or whether its a combined maximum though?). It is designed for 'routed edge' access switches.  If you have it designed well (stub areas etc) or your OSPF routing table is less than 1000 routes you'll be fine. ... View more

You could try with pressing the mode button on power up: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-2950-series-switches/12040-pswdrec-2900xl.html It does sound like its knackered though... ... View more

@Leo Laohoo wrote: @andrew.butterworth wrote: The VID on the older bootloader switch is V04, whereas the other two are V07.  Is this what you are looking for? That is exactly what I'm looking for.   And I believe this is the answer to your question. Hi Leo, are you going to follow that up with anything or just leave me hanging? If your assumptions is that Hardware VID 04 is bootloader 12.2(53r)SE2 and VID 07 is 15.2(3r)E then what do the release notes regarding FIPS and bootloader upgrades refer to?  I am sure someone has an old spare 3560X or 3750X that can do some IOS upgrades/downgrades and add/change the 'fips authorization-key xxxxx' to see what actually happens?     ... View more