I have a task to upgrade Cisco switch with a cryptographic image. However, I can't figure out with one I can choose from the list that I have available to me. Please advice.

Here is my current switch info:

Cisco Internetwork Operating System Software 
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(22)EA4a, RELEASE SOFTWARE (fc1)
!--- the version of software is 121-22.EA4

Copyright (c) 1986-2005 by cisco Systems, Inc.
Compiled Fri 16-Sep-05 10:46 by yenanh
Image text-base: 0x80010000, data-base: 0x80562000

ROM: Bootstrap program is C2950 boot loader

SW-MNGT-C1 uptime is 1 year, 41 weeks, 6 days, 2 hours, 56 minutes
System returned to ROM by power-on
System restarted at 10:41:46 UTC Wed Feb 25 2015
System image file is "flash:/c2950-i6q4l2-mz.121-22.EA4a.bin"
Model number: WS-C2950G-24-EI

And here is the list of cisco images that I have to choose from:

 3041280 2008-05-17 11:04 c2950-c3h2s-mz.120-5.2.WC.1.tar
 3041280 2008-08-27 14:43 c2950-c3h2s-mz.120-5.3.WC.1.tar
 3041280 2008-08-27 14:43 c2950-c3h2s-mz.120-5.4.WC.1.tar
 1681612 2008-08-22 05:09 c2950-c3h2s-mz.120-5.wc2b.bin
 3041280 2008-08-22 05:09 c2950-c3h2s-mz.120-5.WC2b.tar
 3041280 2008-08-22 05:09 c2950-c3h2s-mz.120-5.WC2.tar
 1356288 2008-05-17 07:47 c2950-html-plus.120-5.2.WC.1.tar
 1356288 2008-05-17 07:47 c2950-html-plus.120-5.3.WC.1.tar
 1356288 2008-05-17 08:06 c2950-html-plus.120-5.4.WC.1.tar
 1356288 2008-05-17 08:06 c2950-html-plus.120-5.WC2.tar
 3681121 2008-08-22 03:00 c2950-i6k2l2q4-mz.121-22.ea3(1).bin
 3681121 2008-08-22 06:52 c2950-i6k2l2q4-mz.121-22.ea3.bin
 3692710 2008-05-17 08:03 c2950_i6k2l2q4_mz.121_22.ea5a.bin
 3699303 2008-08-22 06:52 c2950-i6k2l2q4-mz.121-22.ea6.bin
 3704943 2008-08-22 02:54 c2950-i6k2l2q4-mz 121-22 ea7.bin
 3706442 2008-05-17 07:48 c2950-i6k2l2q4-mz.121-22.ea8a.bin
 5409280 2008-08-22 14:32 c2950-i6k2l2q4-tar.121-13.EA1b.tar
 5693440 2008-05-17 07:50 c2950-i6k2l2q4-tar.121-22.EA9.tar
 2774747 2008-05-17 07:50 c2950-i6q4l2-mz.121-12c.ea1.bin
 2980487 2008-08-21 20:57 c2950-i6q4l2-mz.121-19.ea1a.bin
 2974409 2008-05-17 07:50 c2950-i6q4l2-mz.121-19.ea1.bin
 2980731 2008-08-21 22:28 c2950-i6q4l2-mz.121-19.ea1c.bin
 3081999 2008-08-21 22:28 c2950-i6q4l2-mz.121-22.ea1.bin
 3097872 2008-05-17 07:51 c2950-i6q4l2-mz.121-22.ea4.bin
 3103337 2008-08-21 19:22 c2950-i6q4l2-mz.121-22.ea5a.bin
 3103308 2008-05-17 07:51 c2950-i6q4l2-mz.121-22.ea5.bin
 3110758 2008-08-27 14:39 c2950-i6q4l2-mz.121-22.ea6.bin
 3117090 2008-08-27 14:39 c2950-i6q4l2-mz.121-22.ea7.bin
 3117954 2008-05-17 07:54 c2950-i6q4l2-mz.121-22.ea8a.bin
 3117390 2008-08-27 14:39 c2950-i6q4l2-mz.121-22.ea8.bin
 2251822 2008-08-27 14:49 c2950-i6q4l2-mz.121-6.EA2b.bin
 3974656 2008-08-27 14:49 c2950-i6q4l2-mz.121-6.EA2b.tar
 2253443 2008-08-27 14:41 c2950-i6q4l2-mz.121-6.EA2c.bin
 3978240 2008-08-22 02:46 c2950-i6q4l2-mz.121-6.EA2c.tar
 3974656 2008-08-27 14:49 c2950-i6q4l2-mz.121-6.EA2.tar
 2490607 2008-05-17 07:57 c2950-i6q4l2-mz.121-9.EA1.bin
 2487439 2008-05-17 07:58 c2950-i6q4l2-mz.121-9.EA1d.bin
 4500992 2008-05-17 09:53 c2950-i6q4l2-tar.121-12c.EA1.tar
 4464576 2008-05-17 09:53 c2950-i6q4l2-tar.121-12c.EA1.zip
 4877312 2008-05-17 08:00 c2950-i6q4l2-tar.121-13.EA1c.tar
 4823040 2008-05-17 08:00 c2950-i6q4l2-tar.121-22.EA4.tar
 5109760 2008-08-27 15:07 c2950-i6q4l2-tar.121-22.EA9.tar
 4013232 2008-08-22 16:22 c2950-i6q4l2-tar.121-9.EA1.zip
 4213760 2008-08-22 16:22 c2950lre-i6l2q4-tar.121-11.YJ2.tar
 4214272 2008-05-17 08:03 c2950lre-i6l2q4-tar.121-11.YJ3.tar
 4235776 2008-05-17 08:03 c2950lre-i6l2q4-tar.121-11.YJ4.tar

I assume that my current version of iOS is 121-22.EA4 A also assume that the crypto image has a "k" letter in the file name. Am I right? From there I get confused. Which file should I use to upgrade my current iOS to the newer and crypto one? (The reason behind why we need a crypto version is because need to control it remotely) Thank you!

  • I don't understand why you would need cryptographic software on a transparent layer-2 switch. The switch will not do anything with the traffic, other than switch it. Normally, you want cryptographic software on a router. "The Cisco Catalyst 2950SX-48, 2950T-48, 2950SX-24, 2950-24 and 2950-12 switches are available only with the Standard Image (SI) software for the Cisco Catalyst 2950 Series. They cannot be upgraded to the Enhanced Image (EI) software."
    – Ron Maupin
    Jan 10, 2017 at 17:15
  • The reason behind that is because need to safely control it remotely.
    – ilushkin
    Jan 10, 2017 at 17:20
  • We cannot tell you which on to use; you need to decide that. I don't see why you can't remotely control the switch in a safe manner, even with your current software. Use RADIUS or TACACS+ to authenticate, and use SSH to connect to the switch. Cisco provides guidance on hardening of network devices.
    – Ron Maupin
    Jan 10, 2017 at 17:24
  • Still, if you had to choose one of these files, which one would you choose? I've got confused with Cisco iOS file naming convention.
    – ilushkin
    Jan 10, 2017 at 17:29
  • Edited the question: added model number: WS-C2950G-24-EI
    – ilushkin
    Jan 10, 2017 at 17:31

1 Answer 1


We cannot tell you which image to use. That is up to you to decide, based on the features, bugs, etc. in each image, and you need to go to https://www.cisco.com to get the information on each image. The latest image is not always the correct one because as features are added, new bugs are often introduced. If what you have now works for your needs, then you could simply use that one.

Your switch has what you need to remotely manage the device in a secure manner. As is, it supports TACACS+ or RADIUS authentication. It also supports SSH for connectivity.

Cisco Catalyst 2950 Series Switches with Standard Image SW:


Cisco Catalyst 2950 Series switches offer enhanced data security through a wide range of security features. These features allow customers to provide network security based on users or MAC addresses. The security enhancements are available free by downloading the latest software for the Cisco Catalyst 2950 Series switches.

Secure Shell version 2 (SSHv2) protects information from being eavesdropped or being tampered with by encrypting information being passed on the network, thereby guarding administrative information. Private VLAN Edge isolates ports on a switch, ensuring that traffic travels directly from the entry point to the aggregation device through a virtual path and cannot be directed to another port. In addition, for authentication of users with a TACACS+ or a RADIUS server, 802.1x provides port-level security. Simple Network Management Protocol Version 3 (SNMPv3) (non-cryptographic) monitors and controls network devices as well as manages configurations, performance, collection of statistics, and security.

For authentication of users with a Terminal Access Controller Access Control System (TACACS+) or RADIUS server, 802.1x provides port-level security. 802.1x, in conjunction with a RADIUS server, allows for dynamic port-based user authentication. 802.1x-based user authentication can be extended to dynamically assign a VLAN based on a specific user, regardless of where they connect on the network. With 802.1x with Guest VLAN, guests are allowed access to the Internet via the Guest VLAN but cannot access the customer's internal network. This intelligent adaptability allows IT departments to offer greater flexibility and mobility to their stratified user populations. By combining access control and user profiles with secure network connectivity, services, and applications, enterprises can more effectively manage user mobility and drastically reduce the overhead associated with granting and managing access to network resources.

With the Cisco Catalyst 2950SX-48, 2950T-48, 2950SX-24, 2950-24, and 2950-12 switches, network managers can make ports and consoles highly secure. MAC-address-based port-level security prevents unauthorized stations from accessing the switch. Multilevel access security on the switch console and the Web management interface prevents unauthorized users from accessing or altering switch configurations and can be implemented using an internal user database on each switch or a centrally administered TACACS+ or RADIUS server. Using 802.1x in conjunction with a RADIUS server allows dynamic port-based user authentication. In addition, 802.1x can coexist with port security on a per-port basis. Security features can be deployed using Cisco Network Assistant software security wizards, which ease the deployment of security features that restrict user access to a server or portion of the network or restrict the applications used in certain areas of the network.

Cisco has guides on how to harden your network devices. For example, the Cisco Guide to Harden Cisco IOS Devices

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.