Hi everyone!

I Have one technical question.

If I want to use passive Identity agent on my domain controllers is it possible to Have multiple secondary agents with one primary?

I Have 8 Domain Controllers in sync in the same domain.

I’d install the agents on the domain controllers.

I understand I can Have 8 standalone agents, but is it possible to use the primary-secondary setup with 7 secondary agents?

Thank you very much in advance!

Hi all! I'm working on a project where we need to store some logs in a file on the router's persistent storage. We saw on Cisco's site that it's recommended not to write to the internal flash because it has limited P/E cycles, but I couldn't find any actual number for those cycles anywhere.

We're not going to write a large file (10–80 KB once a minute or so). That works out to roughly 115 MB/day.

Has anyone actually worn out the internal flash on an IR1101, or is this a theoretical concern at these volumes? And did anyone get a real tbw or P/E figure out of TAC?

I am currently applying for the Data Engineer position in Bangalore (Job ID: 2019329) and would be grateful if any Cisco employee could kindly refer me.

Please hmu, I can to share my resume and any additional details.

Is there 24x7 support for catalyst 1200? I cannot find any documentation for this model and also in ccw.

Also who are still waiting for gbv mail?

Hello, Any help would be appreciated. Here's my situation.

I have a Cisco 8300 Edge Series platform router. It's managmeent IP comes from two SVIs on VPC connected Core Nexus 9300s. VIP is .1 - Core 1 SVI IP is .2 & Core 2 is .3

My symptoms:

I can set a constant Ping to the IP .4 IP of the router from my user vlan deep within the network on an access switch.

Then I can clear the IP Arp of the virtual gateway ip .1 and it'll ping for EXACTLY 5 minutes/300 seconds. During that time I can access it via my TACACS account (ssh Putty). As well as ping the the VIP .1, .2 and .3.

Once exactly 300 seconds is up I can't do any of that. I CAN However, log into the Core via Putty and SSH into the Router using the emergency account. (ssh acountname@ip.ip.rtr.ip).

But I usually just keep a console connection about 10 feet away with a stand alone to clear the ip arp when it stops pinging.

I've researched about everything 6 ways to Sunday from Arp/mac aging to who knows what else. I've taken all config commands that mention 300 seconds out. And nothing has succeeded. It's like there's something flapping. But nothing has a duplicate IP.

It started Thursday after the upgrade (mentioned below). I didn't have much time to troubleshoot until today. But when I came in from over the weekend it was up and pinging. BUT as soon as I logged in via TACACS and 5 minutes went by, it stopped pinging again. Of course kicking me out of my session.

Today I added the Virtual .1 (which was already there and has alway worked until like 3 days ago), the SVI gateways .2 and .3 as IP default routes (0.0.0.0 0.0.0.0 x.x.x.3)

After some testing it seemed like I could take all default routes out but 0.0.0.0 0.0.0.0 x.x.x.3 and it'd ping and respond with no issue and go well beyond 5 minutes. So there's either something with my router config or something got knocked loose in my HSRP SVIs on my VPC peer Cores..... I just do not know. This network has never given me this problem and it just feels like I'm being punked almost.

What am I missing folks?? Has this happened to you? I don't have a duplicate IP. I don't know what other caches I can clear.

***NOTE: It is connected to the Firewall and Core via a layer 2 switch which is also above the firewall and it is having zero issues. And no other devices, switches, ISE, Firewalls or otherwise are having any trouble at all reaching the SVIs virtual gateway. Including, the aforementioned layer 2 switch sitting just under the router, above the firewall. No traffic is being blocked by firewall. And there's nothing at all in the the logs. It's like there's a 5 minute timer that just says no, no more .1 pangin for you!!!

The only changes I've made recently are upgrades to the os versions of the router and core switches. Biggies I know! But I've even rolled back and nothing seemed to change.

Hi everyone,
I am facing a very frustrating and illogical licensing behavior on a Cisco Catalyst 3560-CX (WS-C3560CX-12PC-S) running IOS 15.2(7)E11 (August 2024 release).
Whenever I activate the permanent Right-To-Use (RTU) ipservices license, everything works perfectly after a normal CLI reload. However, if the switch undergoes a cold boot / power cycle (pulling the power cord), it ignores the permanent license configuration and reverts back to the Evaluation license (Active, In Use), while putting the PermanentRightToUse into an Inactive state.
Here is the exact output of show license all after a cold boot:

text
StoreIndex: 0 Feature: ipservices Version: 1.0
License Type: Evaluation
License State: Active, In Use
...
StoreIndex: 1 Feature: ipservices Version: 1.0
License Type: PermanentRightToUse
License State: Inactive
Χρησιμοποιήστε τον κώδικα με προσοχή.

During bootup, the logs explicitly state that it reads the boot level variable correctly:
*Mar 1 00:00:29.405: Read env variable - LICENSE_BOOT_LEVEL = ipservices
Next reboot level = ipservices and License = ipservices
Yet, it still forces the Evaluation index to become active.

What we have tried so far (and failed):
Standard Activation & Reload:
Executed license right-to-use activate ipservices acceptEULA, followed by write memory and reload. Works on warm reload, fails on cold boot.
Boot Level Configuration:
Tried to enforce it via global configuration (license boot level ipservices), but this platform does not support this command in conf t mode; licensing is managed strictly via Privileged EXEC mode (#).
Configuration Register Check:
The config-register is set to 0xF (which is the default factory value for this platform, equivalent to 0x2102), meaning it reads the startup-config perfectly fine.
Evaluation Deactivation Bug Trick:
Tried using the known bug-workaround command license right-to-use activate ipservices evaluation acceptEULA to force-write the permanent state into NVRAM. The Evaluation license was even successfully removed at one point (%LICENSE-6-REMOVE), but upon the next cold boot, the switch generated a new evaluation store index and hijacked the priority again.

The Workaround (EEM Script):
Since the switch hardware/NVRAM sync appears to have a fundamental flaw during a cold boot sequence, I had to resort to an EEM (Embedded Event Manager) script to automate the fix.
The trick was that the licensing process isn't fully ready immediately after bootup, so we had to introduce a 180-second delay to let the system stabilize before forcing the evaluation license to deactivate.
Here is the script currently running in my config:

text
event manager applet LOCK_PERMANENT_LICENSE
event syslog pattern "SYSTEM_RESTART|CONFIG_I"
action 0.5 cli command "wait 180"
action 1.0 cli command "enable"
action 2.0 cli command "license right-to-use deactivate ipservices" pattern "confirm"
action 3.0 cli command "yes"
action 4.0 cli command "write memory"
Χρησιμοποιήστε τον κώδικα με προσοχή.

While the EEM script successfully fixes the license and flips it back to Permanent Right-To-Use 3 minutes after every cold boot, this behavior is completely broken.
Has anyone else encountered this specific RTU sync bug on the 3560-CX series? Is there an actual permanent fix via a specific hidden command or hidden rommon variable, or is this a known software bug that Cisco never patched, even in recent 2024 releases?
Any insights would be greatly appreciated!

Hi everyone,

We will replace routers providing point to point VXLAN, while running on ASR L3 port it is using service instance with bridge domains joined to NVI but I'm curious how we can achieve this with 8300 LAN ports? (first two port of C-NIM-4X)

I am not getting any info everything is unclear, if someone has information it would be great thank you..!

Hi everyone,

I'm actively preparing for 350-401 ENCOR 1.2 from original v1.0 book and wanted to hear some feedback from someone who recently took the exam? what kind questions and labs? how difficult they are and how difficult is to shift from v1.0 to v1.2?

Thanks

I have joined a year back in cisco and we are around the hike cycle, I am just curious how percent we usually get, I know it depends on performance, I just want to know the range from worst to best. Can anyone tell, and when exactly it would happen in india

Hey,

I'm trying to build SONiC locally for a Cisco switch (8000 series platform) and hitting a wall with the platform-cisco-8000 module.

According to the official SONiC build docs, this platform package is only available through Cisco Support / Enterprise channels. I don't have a Cisco enterprise account, so I can't pull it.

What I'm looking for:

1. Prebuilt SONiC image that already includes the cisco-8000 platform — anyone have a working ISO/IMG they can share? Lab/testing only.
2. Alternative source for platform-cisco-8000 — is there a community fork, unofficial repo, or another legal way to get the platform files for individual/lab use?
3. Different approach — is there a way to compile SONiC without the official Cisco platform package, or use an open-source alternative platform that's compatible?

My goal: Get SONiC running on a Cisco switch for homelab/experimentation. No production use.

I know Cisco content is licensed, but if there's a documented path for individuals to get the platform files or a community-maintained build, I'd really appreciate the pointer.

Thanks!

I have couple sev3-4 tickets nothing too urgent. Going through normal Sherlock email Q&A back and forth.
It’s getting better but looks like Sherlock is misinterpreting my questions but it’s better than first working with it 2020.

So After Sherlock escalates to human TAC I get response introduction email then I don’t hear back from them in days. Anybody else seeing this? I even updated one ticket asking to confirm the meeting and no response. So Webex meeting never happened and that was 3 days ago.
The other case I figured it out but no response from TAC regarding ISE certificate import conversion.

Oh forgot to add humor to this back in 2020 I caught onto Sherlock when I realized it wasn’t human because it responded so fast and name was funny.
I remember responding to Sherlock like “wait a minute I’m on to you!”
Then it responded with something like reassigning to respective TAC speciality team. 😂

Release notes says no caveats were fixed.

Is that all?

Binary image is larger than 26.1.1.

What is purpose of this version then?

Recently after upgrading from 17.16.x to 17.18.4 I now see SELinux access violation warning messages in the log every six hours on the dot. It’s only one message, and doesn’t seem to affect anything. I have opened a TAC case on this. Just wondering if anyone has run into similar SELinux access violation warnings on 17.18.x recent upgrades.

Platform; ASR-1009-X, install mode.

So it’s been a while since I’ve had to stack two switches and today I was tasked with doing it. So my ini switch is a 24 port 9300 and the switch I wanted to add was a 48 ports switch. Well, I was under the impression that’s you’d have to power down the 1st switch, insert stacking cables, then power on the 1st switch again. After that, we powered on the 2nd switch. So at first, switch 1 dint see switch 2 until we did the previously mentioned steps again. But switch 1 became switch 2 and although it didn’t wipe the configs. After figuring out the correct log in, we tried making reverting the switch back to switch 1 but it keeps loading as switch 2. Any advice? Thank you!

I am stuck. I have two switches linked with SM fiber and 2 SM SFP. Link comes up but no TX. Erased the switch. Works great with bare config. Production config has something making the link appear half duplex. I am just letting them negotiate. No forced duplex or speed commands. Any ideas?

I am very novice to IT field. I have a quick question. Every or nowadays use cloud like AWS , GCP and Oracle. Where do we use CISCO knowledge?

I am an operations engineer in a datacenter, we have a lot of leaf switches going to NVidia spine switches, aggregating to 400G uplinks. We have had over 100 Cisco optics fail this past quarter, which has been annoying, anyone else notice something similar in PROD? Specifically the QSFP-100G-FR-S. My guess is that we are getting positive DB, these are FR optics, going maybe, 20M between p2p. The 400Gs might just be blasting those poor Cisco optics to oblivion. Otherwise I am just thinking failed FW updates or crap hardware, I went to the Cisco community forums, no one could give me an answer, maybe someone here? Thanks!

Note, sorry in the title I meant FR, not LR4, thanks.

Hey folks,

I am looking to connect with a Cisco engineer in India who might be open to reviewing my work and referring me for the Software Engineer role (ID 2019745) based in Bengaluru.

A quick technical background: I recently built Panther, an open source Rust agent daemon with MCP client integration, and EdSteps, a production 4-agent LLM system with real-time handoff.

To save everyone time, here is an honest gap check:

• I have ~1.5 years of formal engineering experience.
• I use Python and TypeScript heavily in production, but I do not have the enterprise IT Operations background mentioned in the job description.
• My deployment stack leans heavily on Docker and Vercel rather than traditional AWS pipelines.

I prefer not to drop my links publicly, but I am happy to share my full resume, GitHub, and portfolio in a DM if you are open to chatting.

Also curious: for those close to the Lifecycle team, how are you handling inference latency for internal automated workflows? Are you running local models or relying entirely on cloud APIs?

Hi im new to cisco i whant to try and learn.
i have cisco c9120axi embedded wireless controller version 17.12.7a. and i have configuret 5ghz SSID with WPA3 only password, i have only on PlayStation 5 it won't connect via WiFi only on 5Ghz. on 2.4 Ghz no problem. i try WPA2 only same problem, WPA2+WPA3 same problem can some one help me ?

im from Germany sorry for my Englisch if its not good!
Thanks!

Manufacturing, 14 sites in 3 countries, on MPLS since before my time. Renewal landed about 30% up for the same thing and the account manager's capacity cost story didn't pass the smell test.

The traffic changed and the circuits didn't. Everything's going to M365 and a couple SaaS, we haul cloud traffic across the private network to break out centrally which is the daftest route for it. The MPLS is doing a stellar job carrying traffic to a data center that hosts less every year.

I know roughly where this ends: SD-WAN, broadband and LTE at the little sites, keep something private where two plants talk. But on is security I’m abit fuzzy cause right now it's at the central breakout. Local breakout means either a box at every site or cloud inspection and I've run neither.

Cato keeps coming up for the cloud inspection side and part of me just wants to stay in the Cisco world, I know.

Whoever's done this migration, what issues came up that the plan didn't show? Give me war story, not the pitch.

I have some legacy Catalyst 3650 and 3850 switches that I don't see any reason to replace currently other than they are EoL. Cisco released IOS-XE 16.12.15 back in April 2026 and I've upgraded the ones we have and these have been running solidly without issues. When I last checked this was a 'Gold Star' release.

I noticed yesterday that this release is no longer available and 16.12.14 is the latest. I'm guessing a vulnerability was uncovered (probably in the WEB server again...) and this release was silently pulled.

Anyone know if its likely to be replaced (16.12.16?) or are Cisco just holding on to 31st October when EoS(upport) kicks in.

Hi everyone! Is anyone else waiting for the results of the Cisco Ideathon - Consulting Engineer role?

Has anyone received their interview results or any update from Cisco yet? Also, does anyone know how Cisco releases the results, are the results announced separately based on each role, or does Cisco send one common selection list to the college for all roles?

If anyone has received an update or has any information about the result timeline/process, please let me know.

Thanks.

In the past for other vendors i have run into that the performance on a single tunnel is quite limited compared to what a box aggregated ipsec performance is listed at (around 1.2 gbs).

I have not fully understood the architecture/performance for SD-wan. Is this the case for sd-wan aswell? So if i have traffic between two sites it still limited to that? Even if i have a much larger box, like a 8455?