I have a setup with dual redundant Cisco catalyst 4506-E using the WS-X45-SUP8L-E supervisor engine and two 48-port switches below it.

  • My task is to access and modify the switch configuration.

  • Access shall be accomplished locally only, through console port using serial cable and user/pass combo.

  • When connecting to the console port I notice that synchronous terminal mode has not been enabled, and logging to console has been set up.

  • The switch is in production and should not be power cycled unless absolutely neccessary.

  • I can't type or paste in the username because console logging blocks the input.

  • Can't authenticate -> Can't access config mode -> Can't turn off logging temporarily to login.

Any suggestions on how to access this switch?

  • Is this a homework question? – Cown Jul 26 at 8:57
  • 2
    It's funny how it's "redundant", but you can't plan a service window to fix the problem? I've never seen a system so important, combined with the fact it's redundant, that cannot be put into maintenance. – Cown Jul 26 at 9:05
  • 4
    To follow up on Cown comment. If a system is redundant you should put it down from time to time to ensure the redundancy works as expected. If you don't, the day you need it, it will not work. – JFL Jul 26 at 9:59
  • @Cown: Not homework. Work-work and I just started with this setup this morning. Absolutely agree, but my instructions were clearly stated beforehand: I was not allowed to power down the device, and the only configured auth method was user/pass combo. – Spcaeyob Jul 26 at 18:47
up vote 6 down vote accepted

I have a setup with dual redundant Cisco catalyst 4506-E using the WS-X45-SUP8L-E supervisor engine and two 48-port switches below it.

  • My task is to access and modify the switch configuration.
  • Access shall be accomplished locally only, through console port using serial cable and user/pass combo.

The notion that "thou shalt not use ssh / telnet / SNMP to fix this problem" is broken. Use what you can to fix it. Yes, console logging at a lower baud rate relative to a constant stream of incoming console syslog messages blocks authentication with logging synchronous on that line. However, you can't change what's already happened.

If nobody set up SNMP / telnet / ssh authentication methods and you can't change the environment which is generating so many logs, the right answer to take to your management is: "Sorry but this service was not set up in a maintainable manner. We have to take an outage to fix it."

Then fix what you know is wrong:

  • Common practice is to disable console logging completely with no logging console. I use no logging console guaranteed, but that's a personal preference.
  • Set up SNMP RO / SNMP RW communities with the right ACLs if not already in place
  • Set up SSH access
  • It sounds like there is a lack of confidence in the redundancy provided by this service. During your outage window, demonstrate expected outage times when you drop power on the active chassis (do this at least 3 to 5 times so you know how repeatable it is). If the redundancy performance is not what you want, sometimes you can change timers or the protocol to get what you want.

Our community is here to help if you have questions about how to improve failover performance, or configuring the items above.

  • Thank you for a great answer. I ultimately ended up power cycling the active chassis and authenticating before syslog output had started streaming too frequently to block my input. After that I did no logging console, and to be sure also activated logging synchronous. Set up SSH and spent half the work day doing what I came to do. – Spcaeyob Jul 26 at 18:56
  • FYI, there is no need to "race login" against the logging flood. Tell the router to ignore the default configuration; then edit it / save. To do so, go into rommon mode, then set your confreg to 0x2142. You could also just unplug the input cables if there aren't a bunch. – Mike Pennington Jul 26 at 19:34

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.