r/Cisco

Hello, Any help would be appreciated. Here's my situation.

I have a Cisco 8300 Edge Series platform router. It's managmeent IP comes from two SVIs on VPC connected Core Nexus 9300s. VIP is .1 - Core 1 SVI IP is .2 & Core 2 is .3

My symptoms:

I can set a constant Ping to the IP .4 IP of the router from my user vlan deep within the network on an access switch.

Then I can clear the IP Arp of the virtual gateway ip .1 and it'll ping for EXACTLY 5 minutes/300 seconds. During that time I can access it via my TACACS account (ssh Putty). As well as ping the the VIP .1, .2 and .3.

Once exactly 300 seconds is up I can't do any of that. I CAN However, log into the Core via Putty and SSH into the Router using the emergency account. (ssh acountname@ip.ip.rtr.ip).

But I usually just keep a console connection about 10 feet away with a stand alone to clear the ip arp when it stops pinging.

I've researched about everything 6 ways to Sunday from Arp/mac aging to who knows what else. I've taken all config commands that mention 300 seconds out. And nothing has succeeded. It's like there's something flapping. But nothing has a duplicate IP.

It started Thursday after the upgrade (mentioned below). I didn't have much time to troubleshoot until today. But when I came in from over the weekend it was up and pinging. BUT as soon as I logged in via TACACS and 5 minutes went by, it stopped pinging again. Of course kicking me out of my session.

Today I added the Virtual .1 (which was already there and has alway worked until like 3 days ago), the SVI gateways .2 and .3 as IP default routes (0.0.0.0 0.0.0.0 x.x.x.3)

After some testing it seemed like I could take all default routes out but 0.0.0.0 0.0.0.0 x.x.x.3 and it'd ping and respond with no issue and go well beyond 5 minutes. So there's either something with my router config or something got knocked loose in my HSRP SVIs on my VPC peer Cores..... I just do not know. This network has never given me this problem and it just feels like I'm being punked almost.

What am I missing folks?? Has this happened to you? I don't have a duplicate IP. I don't know what other caches I can clear.

***NOTE: It is connected to the Firewall and Core via a layer 2 switch which is also above the firewall and it is having zero issues. And no other devices, switches, ISE, Firewalls or otherwise are having any trouble at all reaching the SVIs virtual gateway. Including, the aforementioned layer 2 switch sitting just under the router, above the firewall. No traffic is being blocked by firewall. And there's nothing at all in the the logs. It's like there's a 5 minute timer that just says no, no more .1 pangin for you!!!

The only changes I've made recently are upgrades to the os versions of the router and core switches. Biggies I know! But I've even rolled back and nothing seemed to change.

Is there 24x7 support for catalyst 1200? I cannot find any documentation for this model and also in ccw.

Hi everyone,
I am facing a very frustrating and illogical licensing behavior on a Cisco Catalyst 3560-CX (WS-C3560CX-12PC-S) running IOS 15.2(7)E11 (August 2024 release).
Whenever I activate the permanent Right-To-Use (RTU) ipservices license, everything works perfectly after a normal CLI reload. However, if the switch undergoes a cold boot / power cycle (pulling the power cord), it ignores the permanent license configuration and reverts back to the Evaluation license (Active, In Use), while putting the PermanentRightToUse into an Inactive state.
Here is the exact output of show license all after a cold boot:

text
StoreIndex: 0 Feature: ipservices Version: 1.0
License Type: Evaluation
License State: Active, In Use
...
StoreIndex: 1 Feature: ipservices Version: 1.0
License Type: PermanentRightToUse
License State: Inactive
Χρησιμοποιήστε τον κώδικα με προσοχή.

During bootup, the logs explicitly state that it reads the boot level variable correctly:
*Mar 1 00:00:29.405: Read env variable - LICENSE_BOOT_LEVEL = ipservices
Next reboot level = ipservices and License = ipservices
Yet, it still forces the Evaluation index to become active.

What we have tried so far (and failed):
Standard Activation & Reload:
Executed license right-to-use activate ipservices acceptEULA, followed by write memory and reload. Works on warm reload, fails on cold boot.
Boot Level Configuration:
Tried to enforce it via global configuration (license boot level ipservices), but this platform does not support this command in conf t mode; licensing is managed strictly via Privileged EXEC mode (#).
Configuration Register Check:
The config-register is set to 0xF (which is the default factory value for this platform, equivalent to 0x2102), meaning it reads the startup-config perfectly fine.
Evaluation Deactivation Bug Trick:
Tried using the known bug-workaround command license right-to-use activate ipservices evaluation acceptEULA to force-write the permanent state into NVRAM. The Evaluation license was even successfully removed at one point (%LICENSE-6-REMOVE), but upon the next cold boot, the switch generated a new evaluation store index and hijacked the priority again.

The Workaround (EEM Script):
Since the switch hardware/NVRAM sync appears to have a fundamental flaw during a cold boot sequence, I had to resort to an EEM (Embedded Event Manager) script to automate the fix.
The trick was that the licensing process isn't fully ready immediately after bootup, so we had to introduce a 180-second delay to let the system stabilize before forcing the evaluation license to deactivate.
Here is the script currently running in my config:

text
event manager applet LOCK_PERMANENT_LICENSE
event syslog pattern "SYSTEM_RESTART|CONFIG_I"
action 0.5 cli command "wait 180"
action 1.0 cli command "enable"
action 2.0 cli command "license right-to-use deactivate ipservices" pattern "confirm"
action 3.0 cli command "yes"
action 4.0 cli command "write memory"
Χρησιμοποιήστε τον κώδικα με προσοχή.

While the EEM script successfully fixes the license and flips it back to Permanent Right-To-Use 3 minutes after every cold boot, this behavior is completely broken.
Has anyone else encountered this specific RTU sync bug on the 3560-CX series? Is there an actual permanent fix via a specific hidden command or hidden rommon variable, or is this a known software bug that Cisco never patched, even in recent 2024 releases?
Any insights would be greatly appreciated!

Hi everyone,

I'm actively preparing for 350-401 ENCOR 1.2 from original v1.0 book and wanted to hear some feedback from someone who recently took the exam? what kind questions and labs? how difficult they are and how difficult is to shift from v1.0 to v1.2?

Thanks

I have joined a year back in cisco and we are around the hike cycle, I am just curious how percent we usually get, I know it depends on performance, I just want to know the range from worst to best. Can anyone tell, and when exactly it would happen in india

Hi everyone,
I’m troubleshooting an authentication issue with Cisco routers/switches using \*\*Microsoft NPS as the RADIUS server\*\*.
\*\*Environment:\*\*
Cisco routers/switches
RADIUS authentication
Microsoft NPS
Trying to authenticate using an AD account
RADIUS communication appears to be working between the Cisco device and NPS
User credentials have been verified and are correct
\*\*Issue:\*\*
When I try to perform an administrative login to the Cisco router/switch using RADIUS/NPS, authentication fails with \*\*NPS Reason Code 66\*\*.
The same issue occurs on multiple Cisco devices.
I have already checked:
AD username/password
RADIUS server configuration
RADIUS shared secret
Cisco aaa configuration
NPS Network Policy
NPS connection request policy
Connectivity between the Cisco device and NPS
RADIUS ports
I’m still getting the authentication rejection.
\*\*Cisco configuration is roughly:\*\*
aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius local

radius server NPS
address ipv4 <NPS-IP> auth-port 1812 acct-port 1813
key <shared-secret>
NPS is receiving the authentication request, but it is rejecting it with \*\*Reason Code 66\*\*.
Does anyone know what specifically causes \*\*NPS Reason Code 66\*\* when authenticating Cisco IOS/IOS-XE devices against Microsoft NPS?
What should I check next — NPS Network Policy conditions, authentication method (PAP/CHAP/MS-CHAPv2), AD permissions, or something specific on the Cisco side?
Any troubleshooting steps or examples would be appreciated.
Thanks!

I have couple sev3-4 tickets nothing too urgent. Going through normal Sherlock email Q&A back and forth.
It’s getting better but looks like Sherlock is misinterpreting my questions but it’s better than first working with it 2020.

So After Sherlock escalates to human TAC I get response introduction email then I don’t hear back from them in days. Anybody else seeing this? I even updated one ticket asking to confirm the meeting and no response. So Webex meeting never happened and that was 3 days ago.
The other case I figured it out but no response from TAC regarding ISE certificate import conversion.

Oh forgot to add humor to this back in 2020 I caught onto Sherlock when I realized it wasn’t human because it responded so fast and name was funny.
I remember responding to Sherlock like “wait a minute I’m on to you!”
Then it responded with something like reassigning to respective TAC speciality team. 😂

I am very novice to IT field. I have a quick question. Every or nowadays use cloud like AWS , GCP and Oracle. Where do we use CISCO knowledge?

So it’s been a while since I’ve had to stack two switches and today I was tasked with doing it. So my ini switch is a 24 port 9300 and the switch I wanted to add was a 48 ports switch. Well, I was under the impression that’s you’d have to power down the 1st switch, insert stacking cables, then power on the 1st switch again. After that, we powered on the 2nd switch. So at first, switch 1 dint see switch 2 until we did the previously mentioned steps again. But switch 1 became switch 2 and although it didn’t wipe the configs. After figuring out the correct log in, we tried making reverting the switch back to switch 1 but it keeps loading as switch 2. Any advice? Thank you!

Hey,

I'm trying to build SONiC locally for a Cisco switch (8000 series platform) and hitting a wall with the platform-cisco-8000 module.

According to the official SONiC build docs, this platform package is only available through Cisco Support / Enterprise channels. I don't have a Cisco enterprise account, so I can't pull it.

What I'm looking for:

1. Prebuilt SONiC image that already includes the cisco-8000 platform — anyone have a working ISO/IMG they can share? Lab/testing only.
2. Alternative source for platform-cisco-8000 — is there a community fork, unofficial repo, or another legal way to get the platform files for individual/lab use?
3. Different approach — is there a way to compile SONiC without the official Cisco platform package, or use an open-source alternative platform that's compatible?

My goal: Get SONiC running on a Cisco switch for homelab/experimentation. No production use.

I know Cisco content is licensed, but if there's a documented path for individuals to get the platform files or a community-maintained build, I'd really appreciate the pointer.

Thanks!

AMA - 2026 IOS XE Software Security Hardening update

Cisco has released the August 2026 IOS XE Software Security Hardening update, which includes important security fixes for vulnerabilities impacting Cisco IOS XE-based platforms.

This release is particularly important as the Wireless PSIRTS security release has been impacted by two high-severity defects:

• CSCwv93265 - Downstream 802.11 action frames are not seen over the air

• CSCwv98483 - 9800 Foreign dropping client traffic from Anchor

We understand that you might be having questions about these defects, the latest PSIRTS release, recommended software versions, and most importantly, how to plan an upgrade leveraging tools like WLAN Poller, RADKit that addresses the security vulnerabilities safely while also taking the associated defects/FN CNSS bug id into consideration. We are happy to address any queries you might be having related PSIRT, FN, CNSS, Upgrade steps so you can effectively plan your upgrades to make sure your APs are safe.

I am an operations engineer in a datacenter, we have a lot of leaf switches going to NVidia spine switches, aggregating to 400G uplinks. We have had over 100 Cisco optics fail this past quarter, which has been annoying, anyone else notice something similar in PROD? Specifically the QSFP-100G-FR-S. My guess is that we are getting positive DB, these are FR optics, going maybe, 20M between p2p. The 400Gs might just be blasting those poor Cisco optics to oblivion. Otherwise I am just thinking failed FW updates or crap hardware, I went to the Cisco community forums, no one could give me an answer, maybe someone here? Thanks!

Note, sorry in the title I meant FR, not LR4, thanks.

Release notes says no caveats were fixed.

Is that all?

Binary image is larger than 26.1.1.

What is purpose of this version then?

I am stuck. I have two switches linked with SM fiber and 2 SM SFP. Link comes up but no TX. Erased the switch. Works great with bare config. Production config has something making the link appear half duplex. I am just letting them negotiate. No forced duplex or speed commands. Any ideas?

Manufacturing, 14 sites in 3 countries, on MPLS since before my time. Renewal landed about 30% up for the same thing and the account manager's capacity cost story didn't pass the smell test.

The traffic changed and the circuits didn't. Everything's going to M365 and a couple SaaS, we haul cloud traffic across the private network to break out centrally which is the daftest route for it. The MPLS is doing a stellar job carrying traffic to a data center that hosts less every year.

I know roughly where this ends: SD-WAN, broadband and LTE at the little sites, keep something private where two plants talk. But on is security I’m abit fuzzy cause right now it's at the central breakout. Local breakout means either a box at every site or cloud inspection and I've run neither.

Cato keeps coming up for the cloud inspection side and part of me just wants to stay in the Cisco world, I know.

Whoever's done this migration, what issues came up that the plan didn't show? Give me war story, not the pitch.

I have some legacy Catalyst 3650 and 3850 switches that I don't see any reason to replace currently other than they are EoL. Cisco released IOS-XE 16.12.15 back in April 2026 and I've upgraded the ones we have and these have been running solidly without issues. When I last checked this was a 'Gold Star' release.

I noticed yesterday that this release is no longer available and 16.12.14 is the latest. I'm guessing a vulnerability was uncovered (probably in the WEB server again...) and this release was silently pulled.

Anyone know if its likely to be replaced (16.12.16?) or are Cisco just holding on to 31st October when EoS(upport) kicks in.

Was sort of spend do you need on Cisco products to get higher than a 65% discount?

Hi everyone! Is anyone else waiting for the results of the Cisco Ideathon - Consulting Engineer role?

Has anyone received their interview results or any update from Cisco yet? Also, does anyone know how Cisco releases the results, are the results announced separately based on each role, or does Cisco send one common selection list to the college for all roles?

If anyone has received an update or has any information about the result timeline/process, please let me know.

Thanks.

Hi everyone,

I recently interviewed for a Cisco role through campus placements and was informed that I’m currently on the waiting list.

Around 80 candidates were initially shortlisted, and after the technical/other rounds, around 25–30 candidates reached the final HR round. I was placed on the waiting list after the process.

For anyone who has gone through a similar Cisco hiring process:

How does Cisco generally handle the waiting list?

What are the chances of getting moved to the final selection/main list?

Does the waiting list usually depend on candidates declining offers or additional headcount?

If you’ve experienced this before, how long did it take to receive an update?

Would really appreciate insights from anyone who has been through a similar situation, especially Cisco campus hires. Thanks!