When working on IOS update for one standalone Cisco 3560x to meet our environment requirement, I was so surprising the total time for Cisco 3560x taking new IOS image, which was more than 30+ minutes. I was thinking to reset it during the process because it is way longer than other Cisco routers, switches and firewalls I updated before. Usually total IOS update takes less than 5 minutes from the beginning process of uploading ios to new ios fully loaded.

All steps and outputs from console for updating Csico 3560x are listing below:

1. Check Cisco End-of-Sale and End-of-Life Products list to make sure it is not in this list

2. Download latest suggested IOS from Cisco Support Site

3. Start your tftp server on your computer.

I am using an open source, fully functional, free TFTP server PumpKIN. Select your IOS folder through Options button.

4. Check the existing IOS version and storage Space:

Switch#show version
cisco WS-C3560X-48 (PowerPC405) processor (revision A0) with 262144K bytes of memory.
Processor board ID FDOxxxX0UH
Last reset from power-on
1 Virtual Ethernet interface
1 FastEthernet interface
52 Gigabit Ethernet interfaces
2 Ten Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address       : E4:11:11:11:99:00
Motherboard assembly number     : 73-12556-06
Motherboard serial number       : FDOxxx0G0Q
Model revision number           : A0
Motherboard revision number     : A0
Model number                    : WS-C3560X-48T-S
Daughterboard assembly number   : 800-32786-02
Daughterboard serial number     : FDOxxx03QT
System serial number            : FDOxxxX0UH
Top Assembly Part Number        : 800-31330-03
Top Assembly Revision Number    : B0
Version ID                      : V03
CLEI Code Number                : COMxx00ARC
Hardware Board Revision Number  : 0x04

Switch Ports Model              SW Version            SW Image
------ ----- -----              ----------            ----------
*    1 54    WS-C3560X-48       12.2(55)SE5           C3560E-UNIVERSALK9-M

Configuration register is 0xF


Switch#dir flash:
Directory of flash:/

    2  -rwx        8225  Jan 31 2013 05:46:23 +00:00  config.text.renamed
    3  -rwx         976  Jan 17 2013 07:05:24 +00:00  vlan.dat.renamed
  503  -rwx        1048   Mar 1 1993 00:01:31 +00:00  multiple-fs
    5  -rwx          24  Jan 31 2013 05:46:23 +00:00  private-config.text.renamed
    6  drwx         512   Mar 1 1993 00:08:34 +00:00  c3560e-universalk9-mz.122-55.SE5

57671680 bytes total (38008320 bytes free)

5. Load new IOS into switch

5.1 Configure switch vlan 1 interface ip address 192.168.2.10 with following command

conf t
int vlan 1
ip address 192.168.2.10 255.255.255.0

5.2 connect your computer on int g0/1 and verify connectivity

Switch#sh ip int brie
Interface              IP-Address      OK? Method Status                Protocol
Vlan1                  192.168.2.10    YES manual up                    up
FastEthernet0          unassigned      YES unset  down                  down
GigabitEthernet0/1     unassigned      YES unset  up                    up
GigabitEthernet0/2     unassigned      YES unset  down                  down
GigabitEthernet0/3     unassigned      YES unset  down                  down

Switch#ping 192.168.2.100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms

5.3 Copy ios

Switch#copy tftp: flash:
Address or name of remote host [192.168.2.100]?
Source filename [c3560e-ipbasek9-mz.150-2.SE8.bin]?
Destination filename [c3560e-ipbasek9-mz.150-2.SE8.bin]?
Accessing tftp://192.168.2.100/c3560e-ipbasek9-mz.150-2.SE8.bin...
Loading c3560e-ipbasek9-mz.150-2.SE8.bin from 192.168.2.100 (via Vlan1): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK - 20305408 bytes]

20305408 bytes copied in 147.833 secs (137354 bytes/sec)

5.4 verify md5 value

Switch#verify /md5 flash:c3560e-ipbasek9-mz.150-2.SE8.bin
.......................................................................................................................................................
(Omit)
..............................................................................................................................................................Done!
verify /md5 (flash:c3560e-ipbasek9-mz.150-2.SE8.bin) = fea9c868b1fdf8b385d58046786df4b2

5.5 confirm the new ios in the flash

Switch#dir flash:
Directory of flash:/

    2  -rwx        8225  Jan 31 2013 05:46:23 +00:00  config.text.renamed
    3  -rwx         976  Jan 17 2013 07:05:24 +00:00  vlan.dat.renamed
  503  -rwx        1048   Mar 1 1993 00:01:31 +00:00  multiple-fs
    4  -rwx    20305408   Mar 1 1993 00:08:29 +00:00  c3560e-ipbasek9-mz.150-2.SE8.bin
    5  -rwx          24  Jan 31 2013 05:46:23 +00:00  private-config.text.renamed
    6  drwx         512   Mar 1 1993 00:08:34 +00:00  c3560e-universalk9-mz.122-55.SE5

57671680 bytes total (17539072 bytes free)

5.6. Activate new IOS for next boot

Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)#boot system flash:c3560e-ipbasek9-mz.150-2.SE8.bin
Switch(config)#exit
Switch#wr
Building configuration...
[OK]

Switch#show boot
BOOT path-list      : flash:c3560e-ipbasek9-mz.150-2.SE8.bin
Config file         : flash:/config.text
Private Config file : flash:/private-config.text
Enable Break        : no
Manual Boot         : no
HELPER path-list    :
Auto upgrade        : yes
Auto upgrade path   :
NVRAM/Config file
      buffer size:   524288
Timeout for Config
          Download:    0 seconds
Config Download
       via DHCP:       disabled (next boot: disabled)

Switch#dir flash:c3560e-universalk9-mz.122-55.SE5
Directory of flash:/c3560e-universalk9-mz.122-55.SE5/

    7  drwx        5632   Mar 1 1993 00:06:20 +00:00  html
  500  -rwx    14581903   Mar 1 1993 00:07:17 +00:00  c3560e-universalk9-mz.122-55.SE5.bin
  501  -rwx     1024000   Mar 1 1993 00:08:29 +00:00  pucode_bundle.dat
  502  -rwx         533   Mar 1 1993 00:08:34 +00:00  info

57671680 bytes total (17533440 bytes free)

5.7 Reboot switch

Switch#reload
Proceed with reload? [confirm]

*Mar  1 00:14:22.986: %SYS-5-RELOAD: Reload requested by console. Reload reason: Reload command

6. New Image Booting Console Output

(This is the first reboot.)
Using driver version 1 for media type 2
Base ethernet MAC Address: e4:13:11:c7:99:00
Xmodem file system is available.
The password-recovery mechanism is enabled.
Initializing Flash...
mifs[2]: 10 files, 1 directories
mifs[2]: Total bytes     :    2097152
mifs[2]: Bytes used      :     612352
mifs[2]: Bytes available :    1484800
mifs[2]: mifs fsck took 2 seconds.
mifs[3]: 0 files, 1 directories
mifs[3]: Total bytes     :    4194304
mifs[3]: Bytes used      :       1024
mifs[3]: Bytes available :    4193280
mifs[3]: mifs fsck took 3 seconds.
mifs[4]: 5 files, 1 directories
mifs[4]: Total bytes     :     524288
mifs[4]: Bytes used      :       9216
mifs[4]: Bytes available :     515072
mifs[4]: mifs fsck took 0 seconds.
mifs[5]: 5 files, 1 directories
mifs[5]: Total bytes     :     524288
mifs[5]: Bytes used      :       9216
mifs[5]: Bytes available :     515072
mifs[5]: mifs fsck took 1 seconds.
mifs[6]: 494 files, 11 directories
mifs[6]: Total bytes     :   57671680
mifs[6]: Bytes used      :   40138240
mifs[6]: Bytes available :   17533440
mifs[6]: mifs fsck took 43 seconds.
...done Initializing Flash.
done.
Loading "flash:c3560e-ipbasek9-mz.150-2.SE8.bin"...@@@@@@@@@@@@@@@@@
(Omit)
@@@@@@@@@@@@@@@@@@@@@
File "flash:c3560e-ipbasek9-mz.150-2.SE8.bin" uncompressed and installed, entry point: 0x3000
executing...

              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706


Cisco IOS Software, C3560E Software (C3560E-IPBASEK9-M), Version 15.0(2)SE8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Wed 13-May-15 23:23 by prod_rel_team
HULC:Collect Entropy thread starting on box...
Initializing flashfs...
Using driver version 3 for media type 1
mifs[4]: 0 files, 1 directories
mifs[4]: Total bytes     : 6838272
mifs[4]: Bytes used      : 1024
mifs[4]: Bytes available : 6837248
mifs[4]: mifs fsck took 1 seconds.
mifs[4]: Initialization complete.

Using driver version 3 for media type 2
mifs[7]: 10 files, 1 directories
mifs[7]: Total bytes     : 2097152
mifs[7]: Bytes used      : 612352
mifs[7]: Bytes available : 1484800
mifs[7]: mifs fsck took 0 seconds.
mifs[7]: Initialization complete.

mifs[8]: 0 files, 1 directories
mifs[8]: Total bytes     : 4194304
mifs[8]: Bytes used      : 1024
mifs[8]: Bytes available : 4193280
mifs[8]: mifs fsck took 0 seconds.
mifs[8]: Initialization complete.

mifs[9]: 5 files, 1 directories
mifs[9]: Total bytes     : 524288
mifs[9]: Bytes used      : 9216
mifs[9]: Bytes available : 515072
mifs[9]: mifs fsck took 1 seconds.
mifs[9]: Initialization complete.

mifs[10]: 5 files, 1 directories
mifs[10]: Total bytes     : 524288
mifs[10]: Bytes used      : 9216
mifs[10]: Bytes available : 515072
mifs[10]: mifs fsck took 0 seconds.
mifs[10]: Initialization complete.

mifs[11]: 494 files, 11 directories
mifs[11]: Total bytes     : 57671680
mifs[11]: Bytes used      : 40138240
mifs[11]: Bytes available : 17533440
mifs[11]: mifs fsck took 1 seconds.
mifs[11]: Initialization complete.

...done Initializing flashfs.
Checking for Bootloader upgrade..
Boot Loader upgrade not required (Stage 2)


FIPS: Flash Key Check : Begin
FIPS: Flash Key Check : End, Not Found, FIPS Mode Not Enabled

POST: CPU MIC register Tests : Begin
POST: CPU MIC register Tests : End, Status Passed

POST: MA BIST : Begin
POST: MA BIST : End, Status Passed

POST: TCAM BIST : Begin
POST: TCAM BIST : End, Status Passed

POST: SF ASIC BIST : Begin
POST: SF ASIC BIST : End, Status Passed

POST: Switch Fabric Memory Tests : Begin
POST: Switch Fabric Memory Tests : End, Status Passed

POST: CPU MIC interface Loopback Tests : Begin
POST: CPU MIC interface Loopback Tests : End, Status Passed

POST: PortASIC RingLoopback Tests : Begin
POST: PortASIC RingLoopback Tests : End, Status Passed


extracting front_end/front_end_ucode_info (309 bytes)
 Software version is different so extracting
 the whole bundle

front_end/ (directory)
extracting front_end/fe_type_4 (78520 bytes)
extracting front_end/fe_type_3 (78520 bytes)
extracting front_end/fe_type_2 (78520 bytes)
extracting front_end/fe_type_5_0 (594412 bytes)
extracting front_end/fe_type_5_3 (86370 bytes)
extracting front_end/fe_type_5_2 (25166 bytes)
extracting front_end/fe_type_5_1 (362114 bytes)
extracting front_end/front_end_ucode_info (309 bytes)
extracting ucode_info (77 bytes)

Front-end Microcode IMG MGR: Installed 4 image(s) in cache:

Front-end Microcode IMG MGR: found microcode images for 4 devices.
Image for front-end 0: flash:/front_end_ucode_cache/ucode.3
Image for front-end 0: flash:/front_end_ucode_cache/ucode.4
Image for front-end 0: flash:/front_end_ucode_cache/ucode.5
Image for front-end 0: flash:/front_end_ucode_cache/ucode.6

Front-end Microcode IMG MGR: Preparing to program device microcode...
Front-end Microcode IMG MGR: Preparing to program device[0]...594412 bytes.
Front-end Microcode IMG MGR: Programming device 0...rwRrrrrrrwssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssss
(Omit)(This step takes about 12 minutes. I was thinking it must be failed. The switch fan was making huge of noise during who Programming device process)
ssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssss
ssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssssssssssssssssssp
Front-end Microcode IMG MGR: Preparing to program device[0]...362114 bytes.
Front-end Microcode IMG MGR: Programming device 

0...rrrrrrwssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsss
(Omit)(This step takes about 5 minutes.)
sssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssssssssssssssssssp
Front-end Microcode IMG MGR: Preparing to program device[0]...25166 bytes.
Front-end Microcode IMG MGR: Programming device 
(This step takes about 1 minutes.)
0...rrrrrrwssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssssssssssssssss
sspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssss
sssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssssssssssss
sssssspssssssssssssssssssspssssssssssssssssssspsssssssssssssssssssp
Front-end Microcode IMG MGR: Preparing to program device[0]...86370 bytes.
Front-end Microcode IMG MGR: Programming device 
(This step takes about 3 minutes.)
0...rrrrrrwssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssssssssssssssss
sspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssss
ssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssssssss
sssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspw
% Front-end Microcode IMG MGR: HW image is upgraded. MCU reset causes the switch to reload

(This is the second reboot.)


Cisco IOS Software, C3560E Software (C3560E-IPBASEK9-M), Version 15.0(2)SE8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Wed 13-May-15 23:23 by prod_rel_team
HULC:Collect Entropy thread starting on box...
Initializing flashfs...
Using driver version 3 for media type 1
mifs[4]: 0 files, 1 directories
mifs[4]: Total bytes     : 6838272
mifs[4]: Bytes used      : 1024
mifs[4]: Bytes available : 6837248
mifs[4]: mifs fsck took 1 seconds.
mifs[4]: Initialization complete.

Using driver version 3 for media type 2
mifs[7]: 10 files, 1 directories
mifs[7]: Total bytes     : 2097152
mifs[7]: Bytes used      : 612352
mifs[7]: Bytes used      : 612352
mifs[7]: Bytes available : 1484800
mifs[7]: mifs fsck took 0 seconds.
mifs[7]: Initialization complete.

mifs[8]: 0 files, 1 directories
mifs[8]: Total bytes     : 4194304
mifs[8]: Bytes used      : 1024
mifs[8]: Bytes available : 4193280
mifs[8]: mifs fsck took 0 seconds.
mifs[8]: Initialization complete.

mifs[9]: 5 files, 1 directories
mifs[9]: Total bytes     : 524288
mifs[9]: Bytes used      : 9216
mifs[9]: Bytes available : 515072
mifs[9]: mifs fsck took 1 seconds.
mifs[9]: Initialization complete.

mifs[10]: 5 files, 1 directories
mifs[10]: Total bytes     : 524288
mifs[10]: Bytes used      : 9216
mifs[10]: Bytes available : 515072
mifs[10]: mifs fsck took 0 seconds.
mifs[10]: Initialization complete.

mifs[11]: 494 files, 11 directories
mifs[11]: Total bytes     : 57671680
mifs[11]: Bytes used      : 40138240
mifs[11]: Bytes available : 17533440
mifs[11]: mifs fsck took 1 seconds.
mifs[11]: Initialization complete.

...done Initializing flashfs.
Checking for Bootloader upgrade..
Boot Loader upgrade not required (Stage 2)


FIPS: Flash Key Check : Begin
FIPS: Flash Key Check : End, Not Found, FIPS Mode Not Enabled

POST: CPU MIC register Tests : Begin
POST: CPU MIC register Tests : End, Status Passed

POST: MA BIST : Begin
POST: MA BIST : End, Status Passed

POST: TCAM BIST : Begin
POST: TCAM BIST : End, Status Passed

POST: SF ASIC BIST : Begin
POST: SF ASIC BIST : End, Status Passed

POST: Switch Fabric Memory Tests : Begin
POST: Switch Fabric Memory Tests : End, Status Passed

POST: CPU MIC interface Loopback Tests : Begin
POST: CPU MIC interface Loopback Tests : End, Status Passed

POST: PortASIC RingLoopback Tests : Begin
POST: PortASIC RingLoopback Tests : End, Status Passed

extracting front_end/front_end_ucode_info (309 bytes)
POST: Thermal, Fan Tests : Begin
POST: Thermal, Fan Tests : End, Status Passed

POST: PortASIC Port Loopback Tests : Begin
POST: PortASIC Port Loopback Tests : End, Status Passed

POST: PortASIC Macsec Loopback Tests : Begin
POST: PortASIC Macsec Loopback Tests : End, Status Passed

POST: EMAC Loopback Tests : Begin
POST: EMAC Loopback Tests : End, Status Passed

Waiting for Port download...Complete


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
[email protected].

cisco WS-C3560X-48 (PowerPC405) processor (revision A0) with 262144K bytes of memory.
Processor board ID FDOxxxxX0UH
Last reset from power-on
1 Virtual Ethernet interface
1 FastEthernet interface
52 Gigabit Ethernet interfaces
2 Ten Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address       : E4:13:11:C7:99:00
Motherboard assembly number     : 73-12556-06
Motherboard serial number       : FDOxxxx0G0Q
Model revision number           : A0
Motherboard revision number     : A0
Model number                    : WS-C3560X-48T-S
Daughterboard assembly number   : 800-32786-02
Daughterboard serial number     : FDOxxxx03QT
System serial number            : FDOxxxxX0UH
Top Assembly Part Number        : 800-31330-03
Top Assembly Revision Number    : B0
Version ID                      : V03
CLEI Code Number                : COMJN00ARC
Hardware Board Revision Number  : 0x04

Switch Ports Model              SW Version            SW Image
------ ----- -----              ----------            ----------
*    1 54    WS-C3560X-48       15.0(2)SE8            C3560E-IPBASEK9-M


Press RETURN to get started!


*Mar  1 00:00:06.601: Read env variable - LICENSE_BOOT_LEVEL =
*Jan  2 00:00:00.713: %IOS_LICENSE_IMAGE_APPLICATION-6-LICENSE_LEVEL: Module name = c3560x Next reboot level = ipbase and License = ipbase
*Jan  2 00:01:34.237: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
*Jan  2 00:01:34.246: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0, changed state to down
*Jan  2 00:01:37.895: %SPANTREE-5-EXTENDED_SYSID: Extended SysId enabled for type vlan
*Jan  2 00:01:38.943: %DC-4-FILE_OPEN_WARNING: Not able to open flash:/dc_profile_dir/dc_default_profiles.txt
*Jan  2 00:01:38.943: %DC-6-DEFAULT_INIT_INFO: Default Profiles DB not loaded.
*Jan  2 00:01:39.740: %PLATFORM_ENV-6-FRU_PS_OIR: FRU Power Supply 1 inserted
*Jan  2 00:01:39.740: %PLATFORM_ENV-6-FRU_PS_OIR: FRU Power Supply 2 inserted
*Jan  2 00:01:39.740: %PLATFORM_ENV-1-FRU_PS_ACCESS: FRU Power Supply is not responding
*Jan  2 00:01:41.904: %SYS-5-CONFIG_I: Configured from memory by console
*Jan  2 00:01:43.834: %SYS-5-RESTART: System restarted --
Cisco IOS Software, C3560E Software (C3560E-IPBASEK9-M), Version 15.0(2)SE8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Wed 13-May-15 23:23 by prod_rel_team
*Jan  2 00:01:45.830: %LINK-3-UPDOWN: Interface FastEthernet0, changed state to down
*Jan  2 00:01:46.837: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0, changed state to down
*Jan  2 00:01:46.862: %USB_CONSOLE-6-MEDIA_RJ45: Console media-type is RJ45.
*Jan  2 00:01:48.582: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
*Jan  2 00:01:49.588: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

Switch>en% Generating 1024 bit RSA keys, keys will be non-exportable...

Switch#
[OK] (elapsed time was 3 seconds)

*Jan  2 00:02:01.408: %SSH-5-ENABLED: SSH 1.99 has been enabled
*Jan  2 00:02:01.718: %PKI-6-AUTOSAVE: Running configuration saved to NVRAM[OK]

Switch#
Switch#show ver
Cisco IOS Software, C3560E Software (C3560E-IPBASEK9-M), Version 15.0(2)SE8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Wed 13-May-15 23:23 by prod_rel_team

ROM: Bootstrap program is C3560E boot loader
BOOTLDR: C3560E Boot Loader (C3560X-HBOOT-M) Version 12.2(53r)SE2, RELEASE SOFTWARE (fc1)

Switch uptime is 2 minutes
System returned to ROM by power-on
System image file is "flash:c3560e-ipbasek9-mz.150-2.SE8.bin"


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
[email protected].

License Level: ipbase
License Type: Permanent
Next reload license Level: ipbase

cisco WS-C3560X-48 (PowerPC405) processor (revision A0) with 262144K bytes of memory.
Processor board ID FDOxxxxX0UH
Last reset from power-on
1 Virtual Ethernet interface
1 FastEthernet interface
52 Gigabit Ethernet interfaces
2 Ten Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address       : E4:13:11:C7:99:00
 --More--
*Jan  2 00:02:16.625: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed sMotherboard assembly number     : 73-12556-06
Motherboard serial number       : FDOxxxx0G0Q
Model revision number           : A0
Motherboard revision number     : A0
Model number                    : WS-C3560X-48T-S
Daughterboard assembly number   : 800-32786-02
Daughterboard serial number     : FDOxxx03QT
System serial number            : FDOxxxxX0UH
Top Assembly Part Number        : 800-31330-03
Top Assembly Revision Number    : B0
Version ID                      : V03
CLEI Code Number                : COMJN00ARC
Hardware Board Revision Number  : 0x04


Switch Ports Model              SW Version            SW Image
------ ----- -----              ----------            ----------
*    1 54    WS-C3560X-48       15.0(2)SE8            C3560E-IPBASEK9-M


Configuration register is 0xF

2015

2014

2013

2012

2011 

2010

SIEM is hot topic.SPLUNK is going to IPO started on Jan 12 2012. Also in last two years, there are a couple of milestone events happened in SIEM venders which has been listed below:

HP acquired ArcSight Sep 13, 2010, $1.5B
Solarwinds bought TriGeo Jun 23 2011, $3500
IBM acquired Q1 Labs, Oct 4 2011, $????
McAfee acquired NitroSecurity, Dec 1, 2011 $????
.
.
.

I listed some my favourite and useful Internet websites and network tools in previous post used in my daily IT life. There are some network security related tools I am using at home and work environment. This post is a summarize those tools and also I am trying to extend this list to add more for my collection.

1.  Packets Capturing and Analysing

• Tcpdump - Packet sniffers
• Wireshark - Wireshark (known as Ethereal until a trademark dispute in Summer 2006) is a fantastic open source multi-platform network protocol analyzer. It allows you to examine data from a live network or from a capture file on disk. You can interactively browse the capture data, delving down into just the level of packet detail you need. Wireshark has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session. It also supports hundreds of protocols and media types. A tcpdump-like console version named tshark is included. One word of caution is that Wireshark has suffered from dozens of remotely exploitable security holes, so stay up-to-date and be wary of running it on untrusted or hostile networks (such as security conferences).

2. TCP/UDP Tools

• TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. 
• The Process Explorer display details your computer's running processes in a more visual representation than the standard Windows Task Manager. 
• RINETD - Redirects TCP connections from one IP address and port to another. 

3. Integrity Check

• Tripwire - It was a simple tool to check file and folder integrity. Now Tripwire provide a whole set solution to discovers every asset on an organization’s network and delivers high-fidelity visibility and deep intelligence about these endpoints. Tripwire solutions also deliver actionable reports and alerts and enable the integration of valuable endpoint intelligence into operational systems like change management databases, ticketing systems, patch management and security solutions including SIEMS, malware detection and risk and analytics. 

4. Penetration Test Tools

• World's most used penetration testing software - metasploit
• Nessus® is the industry’s most widely-deployed vulnerability, configuration, and compliance scanner.
• BackTrack - BackTrack is a free bootable Linux distribution that contains a plethora of open source tools that you can use for network security and penetration testing. The tools are organized into different categories such as ‘Information Gathering’, ‘Vulnerability Assessment’, ‘Exploitation Tools’, ‘Privilege Escalation’ and ‘Maintaining Access’, amongst others.
• Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security auditing. 

5. Proxy Software

• ccproxy from youngzsoft

6. Network Automation Tools

• NetMRI provides automatic network discovery, switch port management, network change automation, and continuous security policy and configuration compliance management for multi-vendor routers, switches, and other layer-2 and layer-3 network devices. NetMRI is the only platform that supports traditional and virtual network constructs (such as VRF) for multi-vendor network automation.

7. Security Intelligence

• Lancope, Inc. is a leading provider of network visibility and security intelligence to protect enterprises against today’s top threats. 
• FireEye Network Security (NX) products, now available in modular 2- and 4-Gbps appliances, enable organizations to prevent, detect, and respond to network-based zero day exploit attempts, web drive-by downloads, and advanced malware that routinely bypass conventional signature-reliant defenses.

Just for a quick testing, I have tried to ping other interfaces on Checkpoint 4200 active and passive firewalls. The result was interesting, I am able to ping both active (10.9.30.43) and standby (10.9.30.44) interfaces at the same zone as PC (10.9.30.14), but not all of other interfaces on both cluster members. Only those active member interfaces (such as 172.17.30.43) are reachable. Standby cluster member's interface (172.17.30.44) is unreachable. Not only icmp traffic, but also all other traffic such as https, ssh, sync traffic does not work on standby member's interface.

By checking Checkpoint Support Site, Checkpoint's explanation is "this is expected behavior. Connections to the Standby cluster members are not supported in HA clusters, by default."

Here are some troubleshoot I did.

While I am pinging from  pc 10.9.30.14 to standby member 172.17.30.44, I got echo timed out. But 172.17.30.43 replied back

Check the drop packets from Active member 172.17.30.43, it seems the packets dropped by active firewall.It did not pass the traffic to standby member.

[Expert@CP1:0]# fw ctl zdebug drop | grep 10.9.30.14
;[cpu_0];[fw4_1];fw_log_drop_ex: Packet proto=1 10.9.30.14:2048 -> 172.17.30.43:19538 dropped by fwchain_reject_mtu Reason: rejected;
;[cpu_0];[fw4_1];fw_log_drop_ex: Packet proto=1 10.9.30.14:2048 -> 172.17.30.43:19537 dropped by fwchain_reject_mtu Reason: rejected;
;[cpu_0];[fw4_1];fw_log_drop_ex: Packet proto=1 10.99.30.14:2048 -> 172.17.30.43:19536 dropped by fwchain_reject_mtu Reason: rejected;

Note: during the research, also SK97587 mentioned "in some cases when the traffic originates from the standby member, return traffic is forwarded from the VIP to the active member, which drops that traffic."

My old post "Check Point Cluster Member Gateway Drops Ping Packets Without Log in Smartview Tracker" has a similar symptoms as this case, but cause is different. The solution is enable simultaneous ping parameter in the kernel by this command:  fw ctl set int fw_allow_simultaneous_ping

Resolution:

[Expert@CP1:0]# fw ctl get int fwha_forw_packet_to_not_active
fwha_forw_packet_to_not_active = 0

When this parameter is set to "0", packet forwarding will NOT be done to a non-active member.
Instead, a reset packet will be sent to the client.

Set following command on both Cluster Members:

# fw ctl set int fwha_forw_packet_to_not_active 1

With following command you can verify the setting:
# fw ctl get int fwha_forw_packet_to_not_active


To set it permanently to survive reboot, add this line to the file $FWDIR/boot/modules/fwkern.conf :

fwha_forw_packet_to_not_active=1

Then reboot. Perform this on both cluster members.

Reference:

a. Troubleshooting "Clear text packet should be encrypted" error in ClusterXL

Gartner’s Magic Quadrant for Wireless LAN Infrastructure has been released for a couple of years. This post listed all reports found from Internet since 2010. If you are not familiar with this research publication or Gartner, please see graphic below. Gartner places vendors in one of four quadrants – Leaders, Visionaries, Niche Players and Challengers based on their score system.

Source: Gartner (July 2013)

2014

In Gartner 2014 June's Magic Quadrant for Wired and Wireless LAN Infrastructure report, for the 3rd year in a row, Cisco, Aruba and HP Networking are positioning at Leaders quadrant, which are same as last two years. On May 19, 2015, HP completed the acquisition of Aruba Networks for a transaction value of $3 billion. In Gartner's 2015's report, there will be only two vendors showing in the Leaders quadrant.

Huawei, Dell and D-link lost their challengers position and become niche players. Aerohive, Acatel-Lucent Enterprise, Ximus and Avaya are in visionaries quadrant, which means they have innovated in one or more of the key areas of access layer technologies within the enterprise (e.g., convergence, security, management or operational efficiency).

2014 Magic Quadrant for the Wired and Wireless LAN Access Infrastructure

2013 

2013 Magic Quadrant for the Wired and Wireless LAN Access Infrastructure

2012

2012 Magic Quadrant for the Wired and Wireless LAN Access Infrastructure

2011

2011 Magic Quadrant for the Wired and Wireless LAN Access Infrastructure

2010

2010 Magic Quadrant for the Wired and Wireless LAN Access Infrastructure

Reference:

1. 2014 Magic Quadrant for the Wired and Wireless LAN Access Infrastructure
2. Magic Quadrants and MarketScopes: How Gartner Evaluates Vendors Within a Market