Upgrade Cisco 3560X IOS Take 30+ Minutes

When working on IOS update for one standalone Cisco 3560x to meet our environment requirement, I was so surprising the total time for Cisco 3560x taking new IOS image, which was more than 30+ minutes. I was thinking to reset it during the process because it is way longer than other Cisco routers, switches and firewalls I updated before. Usually total IOS update takes less than 5 minutes from the beginning process of uploading ios to new ios fully loaded.

All steps and outputs from console for updating Csico 3560x are listing below:

1. Check Cisco End-of-Sale and End-of-Life Products list to make sure it is not in this list

2. Download latest suggested IOS from Cisco Support Site

Suggested version is 15.0.2-SE8(MD). But latest is 15.2.3E2(ED). 

There are two available versions - IP Base version and Universal version. By default, your device will get Universal version with IP Base license on your device. You can use license code to upgrade to IP Service.

3. Start your tftp server on your computer.

I am using an open source, fully functional, free TFTP server PumpKIN. Select your IOS folder through Options button.

4. Check the existing IOS version and storage Space:

Switch#show version
cisco WS-C3560X-48 (PowerPC405) processor (revision A0) with 262144K bytes of memory.
Processor board ID FDOxxxX0UH
Last reset from power-on
1 Virtual Ethernet interface
1 FastEthernet interface
52 Gigabit Ethernet interfaces
2 Ten Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address       : E4:11:11:11:99:00
Motherboard assembly number     : 73-12556-06
Motherboard serial number       : FDOxxx0G0Q
Model revision number           : A0
Motherboard revision number     : A0
Model number                    : WS-C3560X-48T-S
Daughterboard assembly number   : 800-32786-02
Daughterboard serial number     : FDOxxx03QT
System serial number            : FDOxxxX0UH
Top Assembly Part Number        : 800-31330-03
Top Assembly Revision Number    : B0
Version ID                      : V03
CLEI Code Number                : COMxx00ARC
Hardware Board Revision Number  : 0x04

Switch Ports Model              SW Version            SW Image
------ ----- -----              ----------            ----------
*    1 54    WS-C3560X-48       12.2(55)SE5           C3560E-UNIVERSALK9-M

Configuration register is 0xF


Switch#dir flash:
Directory of flash:/

    2  -rwx        8225  Jan 31 2013 05:46:23 +00:00  config.text.renamed
    3  -rwx         976  Jan 17 2013 07:05:24 +00:00  vlan.dat.renamed
  503  -rwx        1048   Mar 1 1993 00:01:31 +00:00  multiple-fs
    5  -rwx          24  Jan 31 2013 05:46:23 +00:00  private-config.text.renamed
    6  drwx         512   Mar 1 1993 00:08:34 +00:00  c3560e-universalk9-mz.122-55.SE5

57671680 bytes total (38008320 bytes free)

5. Load new IOS into switch

5.1 Configure switch vlan 1 interface ip address 192.168.2.10 with following command

conf t
int vlan 1
ip address 192.168.2.10 255.255.255.0

5.2 connect your computer on int g0/1 and verify connectivity

Switch#sh ip int brie
Interface              IP-Address      OK? Method Status                Protocol
Vlan1                  192.168.2.10    YES manual up                    up
FastEthernet0          unassigned      YES unset  down                  down
GigabitEthernet0/1     unassigned      YES unset  up                    up
GigabitEthernet0/2     unassigned      YES unset  down                  down
GigabitEthernet0/3     unassigned      YES unset  down                  down

Switch#ping 192.168.2.100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/9 ms

5.3 Copy ios

Switch#copy tftp: flash:
Address or name of remote host [192.168.2.100]?
Source filename [c3560e-ipbasek9-mz.150-2.SE8.bin]?
Destination filename [c3560e-ipbasek9-mz.150-2.SE8.bin]?
Accessing tftp://192.168.2.100/c3560e-ipbasek9-mz.150-2.SE8.bin...
Loading c3560e-ipbasek9-mz.150-2.SE8.bin from 192.168.2.100 (via Vlan1): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[OK - 20305408 bytes]

20305408 bytes copied in 147.833 secs (137354 bytes/sec)

5.4 verify md5 value

Switch#verify /md5 flash:c3560e-ipbasek9-mz.150-2.SE8.bin
.......................................................................................................................................................
(Omit)
..............................................................................................................................................................Done!
verify /md5 (flash:c3560e-ipbasek9-mz.150-2.SE8.bin) = fea9c868b1fdf8b385d58046786df4b2

5.5 confirm the new ios in the flash

Switch#dir flash:
Directory of flash:/

    2  -rwx        8225  Jan 31 2013 05:46:23 +00:00  config.text.renamed
    3  -rwx         976  Jan 17 2013 07:05:24 +00:00  vlan.dat.renamed
  503  -rwx        1048   Mar 1 1993 00:01:31 +00:00  multiple-fs
    4  -rwx    20305408   Mar 1 1993 00:08:29 +00:00  c3560e-ipbasek9-mz.150-2.SE8.bin
    5  -rwx          24  Jan 31 2013 05:46:23 +00:00  private-config.text.renamed
    6  drwx         512   Mar 1 1993 00:08:34 +00:00  c3560e-universalk9-mz.122-55.SE5

57671680 bytes total (17539072 bytes free)

5.6. Activate new IOS for next boot

Switch#conf t
Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)#boot system flash:c3560e-ipbasek9-mz.150-2.SE8.bin
Switch(config)#exit
Switch#wr
Building configuration...
[OK]

Switch#show boot
BOOT path-list      : flash:c3560e-ipbasek9-mz.150-2.SE8.bin
Config file         : flash:/config.text
Private Config file : flash:/private-config.text
Enable Break        : no
Manual Boot         : no
HELPER path-list    :
Auto upgrade        : yes
Auto upgrade path   :
NVRAM/Config file
      buffer size:   524288
Timeout for Config
          Download:    0 seconds
Config Download
       via DHCP:       disabled (next boot: disabled)

Switch#dir flash:c3560e-universalk9-mz.122-55.SE5
Directory of flash:/c3560e-universalk9-mz.122-55.SE5/

    7  drwx        5632   Mar 1 1993 00:06:20 +00:00  html
  500  -rwx    14581903   Mar 1 1993 00:07:17 +00:00  c3560e-universalk9-mz.122-55.SE5.bin
  501  -rwx     1024000   Mar 1 1993 00:08:29 +00:00  pucode_bundle.dat
  502  -rwx         533   Mar 1 1993 00:08:34 +00:00  info

57671680 bytes total (17533440 bytes free)

5.7 Reboot switch

Switch#reload
Proceed with reload? [confirm]

*Mar  1 00:14:22.986: %SYS-5-RELOAD: Reload requested by console. Reload reason: Reload command

6. New Image Booting Console Output

(This is the first reboot.)
Using driver version 1 for media type 2
Base ethernet MAC Address: e4:13:11:c7:99:00
Xmodem file system is available.
The password-recovery mechanism is enabled.
Initializing Flash...
mifs[2]: 10 files, 1 directories
mifs[2]: Total bytes     :    2097152
mifs[2]: Bytes used      :     612352
mifs[2]: Bytes available :    1484800
mifs[2]: mifs fsck took 2 seconds.
mifs[3]: 0 files, 1 directories
mifs[3]: Total bytes     :    4194304
mifs[3]: Bytes used      :       1024
mifs[3]: Bytes available :    4193280
mifs[3]: mifs fsck took 3 seconds.
mifs[4]: 5 files, 1 directories
mifs[4]: Total bytes     :     524288
mifs[4]: Bytes used      :       9216
mifs[4]: Bytes available :     515072
mifs[4]: mifs fsck took 0 seconds.
mifs[5]: 5 files, 1 directories
mifs[5]: Total bytes     :     524288
mifs[5]: Bytes used      :       9216
mifs[5]: Bytes available :     515072
mifs[5]: mifs fsck took 1 seconds.
mifs[6]: 494 files, 11 directories
mifs[6]: Total bytes     :   57671680
mifs[6]: Bytes used      :   40138240
mifs[6]: Bytes available :   17533440
mifs[6]: mifs fsck took 43 seconds.
...done Initializing Flash.
done.
Loading "flash:c3560e-ipbasek9-mz.150-2.SE8.bin"...@@@@@@@@@@@@@@@@@
(Omit)
@@@@@@@@@@@@@@@@@@@@@
File "flash:c3560e-ipbasek9-mz.150-2.SE8.bin" uncompressed and installed, entry point: 0x3000
executing...

              Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706


Cisco IOS Software, C3560E Software (C3560E-IPBASEK9-M), Version 15.0(2)SE8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Wed 13-May-15 23:23 by prod_rel_team
HULC:Collect Entropy thread starting on box...
Initializing flashfs...
Using driver version 3 for media type 1
mifs[4]: 0 files, 1 directories
mifs[4]: Total bytes     : 6838272
mifs[4]: Bytes used      : 1024
mifs[4]: Bytes available : 6837248
mifs[4]: mifs fsck took 1 seconds.
mifs[4]: Initialization complete.

Using driver version 3 for media type 2
mifs[7]: 10 files, 1 directories
mifs[7]: Total bytes     : 2097152
mifs[7]: Bytes used      : 612352
mifs[7]: Bytes available : 1484800
mifs[7]: mifs fsck took 0 seconds.
mifs[7]: Initialization complete.

mifs[8]: 0 files, 1 directories
mifs[8]: Total bytes     : 4194304
mifs[8]: Bytes used      : 1024
mifs[8]: Bytes available : 4193280
mifs[8]: mifs fsck took 0 seconds.
mifs[8]: Initialization complete.

mifs[9]: 5 files, 1 directories
mifs[9]: Total bytes     : 524288
mifs[9]: Bytes used      : 9216
mifs[9]: Bytes available : 515072
mifs[9]: mifs fsck took 1 seconds.
mifs[9]: Initialization complete.

mifs[10]: 5 files, 1 directories
mifs[10]: Total bytes     : 524288
mifs[10]: Bytes used      : 9216
mifs[10]: Bytes available : 515072
mifs[10]: mifs fsck took 0 seconds.
mifs[10]: Initialization complete.

mifs[11]: 494 files, 11 directories
mifs[11]: Total bytes     : 57671680
mifs[11]: Bytes used      : 40138240
mifs[11]: Bytes available : 17533440
mifs[11]: mifs fsck took 1 seconds.
mifs[11]: Initialization complete.

...done Initializing flashfs.
Checking for Bootloader upgrade..
Boot Loader upgrade not required (Stage 2)


FIPS: Flash Key Check : Begin
FIPS: Flash Key Check : End, Not Found, FIPS Mode Not Enabled

POST: CPU MIC register Tests : Begin
POST: CPU MIC register Tests : End, Status Passed

POST: MA BIST : Begin
POST: MA BIST : End, Status Passed

POST: TCAM BIST : Begin
POST: TCAM BIST : End, Status Passed

POST: SF ASIC BIST : Begin
POST: SF ASIC BIST : End, Status Passed

POST: Switch Fabric Memory Tests : Begin
POST: Switch Fabric Memory Tests : End, Status Passed

POST: CPU MIC interface Loopback Tests : Begin
POST: CPU MIC interface Loopback Tests : End, Status Passed

POST: PortASIC RingLoopback Tests : Begin
POST: PortASIC RingLoopback Tests : End, Status Passed


extracting front_end/front_end_ucode_info (309 bytes)
 Software version is different so extracting
 the whole bundle

front_end/ (directory)
extracting front_end/fe_type_4 (78520 bytes)
extracting front_end/fe_type_3 (78520 bytes)
extracting front_end/fe_type_2 (78520 bytes)
extracting front_end/fe_type_5_0 (594412 bytes)
extracting front_end/fe_type_5_3 (86370 bytes)
extracting front_end/fe_type_5_2 (25166 bytes)
extracting front_end/fe_type_5_1 (362114 bytes)
extracting front_end/front_end_ucode_info (309 bytes)
extracting ucode_info (77 bytes)

Front-end Microcode IMG MGR: Installed 4 image(s) in cache:

Front-end Microcode IMG MGR: found microcode images for 4 devices.
Image for front-end 0: flash:/front_end_ucode_cache/ucode.3
Image for front-end 0: flash:/front_end_ucode_cache/ucode.4
Image for front-end 0: flash:/front_end_ucode_cache/ucode.5
Image for front-end 0: flash:/front_end_ucode_cache/ucode.6

Front-end Microcode IMG MGR: Preparing to program device microcode...
Front-end Microcode IMG MGR: Preparing to program device[0]...594412 bytes.
Front-end Microcode IMG MGR: Programming device 0...rwRrrrrrrwssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssss
(Omit)(This step takes about 12 minutes. I was thinking it must be failed. The switch fan was making huge of noise during who Programming device process)
ssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssss
ssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssssssssssssssssssp
Front-end Microcode IMG MGR: Preparing to program device[0]...362114 bytes.
Front-end Microcode IMG MGR: Programming device 

0...rrrrrrwssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsss
(Omit)(This step takes about 5 minutes.)
sssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssssssssssssssssssp
Front-end Microcode IMG MGR: Preparing to program device[0]...25166 bytes.
Front-end Microcode IMG MGR: Programming device 
(This step takes about 1 minutes.)
0...rrrrrrwssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssssssssssssssss
sspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssss
sssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssssssssssss
sssssspssssssssssssssssssspssssssssssssssssssspsssssssssssssssssssp
Front-end Microcode IMG MGR: Preparing to program device[0]...86370 bytes.
Front-end Microcode IMG MGR: Programming device 
(This step takes about 3 minutes.)
0...rrrrrrwssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssssssssssssssss
sspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssss
ssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspsssssssss
sssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspssssssssssssssssssspw
% Front-end Microcode IMG MGR: HW image is upgraded. MCU reset causes the switch to reload

(This is the second reboot.)


Cisco IOS Software, C3560E Software (C3560E-IPBASEK9-M), Version 15.0(2)SE8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Wed 13-May-15 23:23 by prod_rel_team
HULC:Collect Entropy thread starting on box...
Initializing flashfs...
Using driver version 3 for media type 1
mifs[4]: 0 files, 1 directories
mifs[4]: Total bytes     : 6838272
mifs[4]: Bytes used      : 1024
mifs[4]: Bytes available : 6837248
mifs[4]: mifs fsck took 1 seconds.
mifs[4]: Initialization complete.

Using driver version 3 for media type 2
mifs[7]: 10 files, 1 directories
mifs[7]: Total bytes     : 2097152
mifs[7]: Bytes used      : 612352
mifs[7]: Bytes used      : 612352
mifs[7]: Bytes available : 1484800
mifs[7]: mifs fsck took 0 seconds.
mifs[7]: Initialization complete.

mifs[8]: 0 files, 1 directories
mifs[8]: Total bytes     : 4194304
mifs[8]: Bytes used      : 1024
mifs[8]: Bytes available : 4193280
mifs[8]: mifs fsck took 0 seconds.
mifs[8]: Initialization complete.

mifs[9]: 5 files, 1 directories
mifs[9]: Total bytes     : 524288
mifs[9]: Bytes used      : 9216
mifs[9]: Bytes available : 515072
mifs[9]: mifs fsck took 1 seconds.
mifs[9]: Initialization complete.

mifs[10]: 5 files, 1 directories
mifs[10]: Total bytes     : 524288
mifs[10]: Bytes used      : 9216
mifs[10]: Bytes available : 515072
mifs[10]: mifs fsck took 0 seconds.
mifs[10]: Initialization complete.

mifs[11]: 494 files, 11 directories
mifs[11]: Total bytes     : 57671680
mifs[11]: Bytes used      : 40138240
mifs[11]: Bytes available : 17533440
mifs[11]: mifs fsck took 1 seconds.
mifs[11]: Initialization complete.

...done Initializing flashfs.
Checking for Bootloader upgrade..
Boot Loader upgrade not required (Stage 2)


FIPS: Flash Key Check : Begin
FIPS: Flash Key Check : End, Not Found, FIPS Mode Not Enabled

POST: CPU MIC register Tests : Begin
POST: CPU MIC register Tests : End, Status Passed

POST: MA BIST : Begin
POST: MA BIST : End, Status Passed

POST: TCAM BIST : Begin
POST: TCAM BIST : End, Status Passed

POST: SF ASIC BIST : Begin
POST: SF ASIC BIST : End, Status Passed

POST: Switch Fabric Memory Tests : Begin
POST: Switch Fabric Memory Tests : End, Status Passed

POST: CPU MIC interface Loopback Tests : Begin
POST: CPU MIC interface Loopback Tests : End, Status Passed

POST: PortASIC RingLoopback Tests : Begin
POST: PortASIC RingLoopback Tests : End, Status Passed

extracting front_end/front_end_ucode_info (309 bytes)
POST: Thermal, Fan Tests : Begin
POST: Thermal, Fan Tests : End, Status Passed

POST: PortASIC Port Loopback Tests : Begin
POST: PortASIC Port Loopback Tests : End, Status Passed

POST: PortASIC Macsec Loopback Tests : Begin
POST: PortASIC Macsec Loopback Tests : End, Status Passed

POST: EMAC Loopback Tests : Begin
POST: EMAC Loopback Tests : End, Status Passed

Waiting for Port download...Complete


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco WS-C3560X-48 (PowerPC405) processor (revision A0) with 262144K bytes of memory.
Processor board ID FDOxxxxX0UH
Last reset from power-on
1 Virtual Ethernet interface
1 FastEthernet interface
52 Gigabit Ethernet interfaces
2 Ten Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address       : E4:13:11:C7:99:00
Motherboard assembly number     : 73-12556-06
Motherboard serial number       : FDOxxxx0G0Q
Model revision number           : A0
Motherboard revision number     : A0
Model number                    : WS-C3560X-48T-S
Daughterboard assembly number   : 800-32786-02
Daughterboard serial number     : FDOxxxx03QT
System serial number            : FDOxxxxX0UH
Top Assembly Part Number        : 800-31330-03
Top Assembly Revision Number    : B0
Version ID                      : V03
CLEI Code Number                : COMJN00ARC
Hardware Board Revision Number  : 0x04

Switch Ports Model              SW Version            SW Image
------ ----- -----              ----------            ----------
*    1 54    WS-C3560X-48       15.0(2)SE8            C3560E-IPBASEK9-M


Press RETURN to get started!


*Mar  1 00:00:06.601: Read env variable - LICENSE_BOOT_LEVEL =
*Jan  2 00:00:00.713: %IOS_LICENSE_IMAGE_APPLICATION-6-LICENSE_LEVEL: Module name = c3560x Next reboot level = ipbase and License = ipbase
*Jan  2 00:01:34.237: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed state to down
*Jan  2 00:01:34.246: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0, changed state to down
*Jan  2 00:01:37.895: %SPANTREE-5-EXTENDED_SYSID: Extended SysId enabled for type vlan
*Jan  2 00:01:38.943: %DC-4-FILE_OPEN_WARNING: Not able to open flash:/dc_profile_dir/dc_default_profiles.txt
*Jan  2 00:01:38.943: %DC-6-DEFAULT_INIT_INFO: Default Profiles DB not loaded.
*Jan  2 00:01:39.740: %PLATFORM_ENV-6-FRU_PS_OIR: FRU Power Supply 1 inserted
*Jan  2 00:01:39.740: %PLATFORM_ENV-6-FRU_PS_OIR: FRU Power Supply 2 inserted
*Jan  2 00:01:39.740: %PLATFORM_ENV-1-FRU_PS_ACCESS: FRU Power Supply is not responding
*Jan  2 00:01:41.904: %SYS-5-CONFIG_I: Configured from memory by console
*Jan  2 00:01:43.834: %SYS-5-RESTART: System restarted --
Cisco IOS Software, C3560E Software (C3560E-IPBASEK9-M), Version 15.0(2)SE8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Wed 13-May-15 23:23 by prod_rel_team
*Jan  2 00:01:45.830: %LINK-3-UPDOWN: Interface FastEthernet0, changed state to down
*Jan  2 00:01:46.837: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0, changed state to down
*Jan  2 00:01:46.862: %USB_CONSOLE-6-MEDIA_RJ45: Console media-type is RJ45.
*Jan  2 00:01:48.582: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to up
*Jan  2 00:01:49.588: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to up

Switch>en% Generating 1024 bit RSA keys, keys will be non-exportable...

Switch#
[OK] (elapsed time was 3 seconds)

*Jan  2 00:02:01.408: %SSH-5-ENABLED: SSH 1.99 has been enabled
*Jan  2 00:02:01.718: %PKI-6-AUTOSAVE: Running configuration saved to NVRAM[OK]

Switch#
Switch#show ver
Cisco IOS Software, C3560E Software (C3560E-IPBASEK9-M), Version 15.0(2)SE8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Wed 13-May-15 23:23 by prod_rel_team

ROM: Bootstrap program is C3560E boot loader
BOOTLDR: C3560E Boot Loader (C3560X-HBOOT-M) Version 12.2(53r)SE2, RELEASE SOFTWARE (fc1)

Switch uptime is 2 minutes
System returned to ROM by power-on
System image file is "flash:c3560e-ipbasek9-mz.150-2.SE8.bin"


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

License Level: ipbase
License Type: Permanent
Next reload license Level: ipbase

cisco WS-C3560X-48 (PowerPC405) processor (revision A0) with 262144K bytes of memory.
Processor board ID FDOxxxxX0UH
Last reset from power-on
1 Virtual Ethernet interface
1 FastEthernet interface
52 Gigabit Ethernet interfaces
2 Ten Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address       : E4:13:11:C7:99:00
 --More--
*Jan  2 00:02:16.625: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan1, changed sMotherboard assembly number     : 73-12556-06
Motherboard serial number       : FDOxxxx0G0Q
Model revision number           : A0
Motherboard revision number     : A0
Model number                    : WS-C3560X-48T-S
Daughterboard assembly number   : 800-32786-02
Daughterboard serial number     : FDOxxx03QT
System serial number            : FDOxxxxX0UH
Top Assembly Part Number        : 800-31330-03
Top Assembly Revision Number    : B0
Version ID                      : V03
CLEI Code Number                : COMJN00ARC
Hardware Board Revision Number  : 0x04


Switch Ports Model              SW Version            SW Image
------ ----- -----              ----------            ----------
*    1 54    WS-C3560X-48       15.0(2)SE8            C3560E-IPBASEK9-M


Configuration register is 0xF

Checkpoint NAT Concepts and Server Side NAT Explanation

Checkpoint have four main NAT concepts we will need to know their difference when implement a NAT rule:
a. Automatically NAT vs Manual NAT
b. Static NAT vs Dynamic NAT (Hide)
c. Source NAT vs Destination NAT
d. Client Side Destination NAT vs Server Side Destination NAT

Checkpoint Firewall NAT is quite different than any other firewall vendors, especially on destination NAT. For first three NAT concepts, Automatically NAT / Manual NAT, Static NAT / Dynamic NAT, Source NAT / Destination NAT, are easy to understand, and almost all vendors are using same way to handle packets. But on the part regarding source NAT and destination NAT, for all other vendors, they are acting same, which is doing destination NAT first at inbound traffic to firewalls, then do source NAT at outbound traffic before packets leave firewalls. Checkpoint is having two different place to handle destination NAT, which is client side (inbound side) or server side (outbound side).

Please keep following diagram in mind, not all packets will go through all those steps. There are three or maybe more different paths for Checkpoint firewall to fast deliver the packets to destination, that is why Checkpoint can be so fast without a hardware acceleration.

(Source: Packet Flow in Checkpoint Firewall)

When starting configuration a NAT rule, you can use automatic NAT and manual NAT depending on your preference and situation. Make sure you have well understanding the difference between them. In some cases, manual NAT will need extra configuration at Proxy Arp or route.

The setting for client / server side translation is in the SmartDashboard Menu -> Policies -> Global Properties -> NAT - Network Address Translation:

By default, both Translate destination on client side options are checked. If you unchecked it, it will become Translation destination on server side.

Notes:  Rule > NAT - The kernels will  always process the rules before the NAT at inbound and outbound process.

Running this basic fw monitor will show you the 4 primary points, iIoO (pre-inbound, post-Inbound, pre-outbound, post-Outbound).

For the full firewall chain (which can differ based on what blades are active), you can run the following fw monitor:
fw monitor -p all -e "accept host (<HOSTIP>);"

Topology:

There is a ipsec site to site vpn tunnel between Cisco ASAv and Checkpoint R77.30. Checkpoint is using Server end NAT.
192.168.2.34 is on gateway's eth0, and 172.17.3.34 is on gateway's eth1. 172.17.3.100 will be NAT-ed to 192.168.2.100.  10.1.1.100 will access 192.168.2.100 which is NATed to 172.17.3.100 at server side (outbound).

We will see how packets flow through Checkpoint firewalls with server side NAT settings.

Server side Translation Process Explanation:

a. Inbound Process
1. The packet that was sent to Server's NATed IP 192.168.2.100, arrives on the "Source/Client" side at the inbound interface eth0 of the Security Gateway (Pre-Inbound chains).
2. The packet passes the Security Policy rules (inside Virtual Machine).
3. If accepted, the connection is recorded in the Connections Table (Table ID 8158).
4. The packet is matched against NAT rules for the Destination. The packet is translated if a match is found - in this case, no translation occurs because we are using server side translation (outbound).
5. The packet passes additional inspection (Post-Inbound chains).

b. OS Kernel

6.However, since the default routing table will not contain the correct route for NATed IP address 192.168.2.100, the packet can not be routed correctly. The packet arrives at the TCP/IP stack of the underlying operating system, and should routed to the outbound interface eth1.
7.If the correct static host/network route for "Destination/Server" was added into the routing table of the underlying operating system, the packet will be routed corrected to the outbound interface eth1. In this case, we will need to add route for 192.168.2.100/32 with gateway 172.17.3.34

c. Outbound Process
8.The packet goes through the outbound interface eth1 (Pre-Outbound chains).
9.The packet passes the Security Policy rules (inside Virtual Machine).
10.The packet is matched against NAT rules for the Destination. The packet is translated if a match is found - in this case, from IP 192.168.2.100 to IP 172.17.3.100.
11.The packet is matched against NAT rules for the Source (if such rules exist). The packet is translated if a match is found - in this case, no translation occurs.
12.The packet passes additional inspection (Post-Outbound chains).13.The packet leaves the Security Gateway machine on the "Destination/Server" side for server 172.17.3.100.

Reference:

a. sk85460: Explanation about Client side NAT and Server side NAT
b. Check Point - Client vs Server Side NAT

Checkpoint Standby Cluster Member Interface Not Reachable

This summary is not available. Please click here to view the post.

Pulse Secure (formerly Juniper Pulse) - UAC Configuration Summary

Juniper Networks® Network Control and Access Solution - Unified Access Control (UAC) including at Junos Pule product line as a whole packge has been sold to Siris Capital and renamed to Pulse Secure for independent operations. This deal was announced about $250 million based on eWeek's Jeffrey Burt's post.

This will affect following two products in our environment.
a. IC4500

• Juniper UAC Appliance IC4500 Step by Step Configuration (Part 1)
• Juniper UAC Appliance IC4500 Step by Step Configuration (Part 2) - Certificates based Authentication
• Pulse Secure (formerly Juniper Pulse) - UAC Configuration Summary

b. MAG6611

As a many years UAC/MAG solutions customer, there are some significant support change we have to be aware of from their transition website:

Pulse Secure is currently operating under a Transition Services Agreement (TSA) with Juniper Networks that will end on July 31, 2015. All support requests should go through Pulse Secure as of August 1, 2015. If you contact Juniper Networks after that date, you will be redirected to Pulse Secure support.
This includes support for already deployed products, products purchased during the transition period, and products purchased from Pulse Secure after the TSA ends. If a customer has purchased any support contract prior to July 31 through Juniper Networks and its partner network—or through Pulse Secure and its partner network—Pulse Secure will honor these terms throughout the life of the contract.

In order to keep records for some of my daily work, this post summarizes a few basic configuration steps relating to UAC4500. More posts posted before in this blog:

• Juniper UAC Appliance IC4500 Step by Step Configuration (Part 1)
• Juniper UAC Appliance IC4500 Step by Step Configuration (Part 2) - Certificates based Authentication
• Pulse Secure (formerly Juniper Pulse) - UAC Configuration Summary

1. Upgrade

Find out the latest recommend version from Juniper website. Right now it is 5.2R1.0.

There are two options. One is from local file, another is from staged package. Either one should work as soon as you have downloaded correctly. 

2. Create a new role Test1 for new testing users

Most configuration are done through wizard and you should be able to use default settings. 

 Pulse Secure logo has been planted into the system if you come into UI options. It was Juniper Networks logo before on 5.0 version.

3. Create a new realms Test1

After created roles, you will need to create Realms to hold those roles/resources. Usually roles will associate with resources. The configuration for resources will be done at step 4.

3.1 Authetication
Choose proper authentication method from Administrators, Cert_Auth, Guest Authentication and System_Local. This will decide how you want to authenticate your users in your realm. The popular option will be local, ldap, radius, AD and certificate.

3.2 Rool Mapping
In this screenshot, it shows we are using certs as our authentication and it will verify if the certs has altName.UPNuid attribute. If UAC found this attribute match, it will assign a role Test1 created in step 2.

4. Create Resources for Test1 Role

This page will associate your network resources with your role defined at step1. In this example, one RDP and icmp resources have been configured for role Test1. One resource can belongs multiple roles.

5. Choose proper Authentication Realm on Signing In page

Signing In page is for the user. You can have multiple signing in pages for different user groups based on your company needs.

In this rdp page, there are two realms assigned on. rdp and Test1. It will allow the role mapping users in Realm Test1 to log in on this page and use the resources defined on step 4.

After above 5 steps, your users created in Realm 'Test1' will be able to log into Signing In page 'rdp'. After logged in, they will be assigned int role 'Test1' and have RDP access and ICMP access to the server 10.9.2.9.

References:

a. Juniper UAC Appliance IC4500 Step by Step Configuration (Part 1)
b. Juniper UAC Appliance IC4500 Step by Step Configuration (Part 2)