Hello,

I am facing a RADIUS authentication issue between a Juniper QFX and Cisco ISE.

When I try to SSH into the switch, authentication fails. A packet capture (monitor traffic) clearly shows that the QFX sends the Access-Request and receives an Access-Accept back from ISE. Despite receiving the Accept packet, the switch ignores it and logs No valid RADIUS responses received.

QFX Configuration:

set system authentication-order [ radius password ]
set system radius-server 10.x.x.x secret xxx
set system radius-server 10.x.x.x source-address 10.y.y.y
set system login user remote class super-user

I am sending the following VSA in the response. I suspect the data type or format might be causing Junos to drop the packet:

• Attribute: Juniper-Local-User-Name
• Value: remote

QFX Logs:

Oct 15 17:27:55 QFX sshd: PAM_RADIUS_SEND_REQ_FAIL: Sending radius request failed with error (No valid RADIUS responses received).
Oct 15 17:27:55 QFX sshd[93694]: error: PAM: authentication error for userName from 10.z.z.z
Oct 15 17:27:55 QFX sshd: SSHD_LOGIN_FAILED: Login failed for user 'userName' from host '10.z.z.z'
Oct 15 17:28:00 QFX sshd[93694]: Disconnected from authenticating user userName 10.z.z.z port 1835 [preauth]

Any help is appreciated.

Planning an upgrade from FMC 7.2.5 to 7.2.12 for a small deployment (6 FTD HA pairs). I've read the Cisco upgrade guide and the release notes, but I wanted to check with the community before I commit to a maintenance window.

A few specific things I'm trying to nail down:

1. Direct upgrade path: Is 7.2.5 → 7.2.12 a supported direct jump, or does Cisco require any intermediate steps? The upgrade matrix isn't always crystal clear on maintenance-to-maintenance hops.

2. Readiness check surprises: Did anyone hit readiness check failures that weren't obvious from the docs? I'm mainly worried about disk space and NTP drift, but curious if there were other blockers.

3. HA FMC specifics: If you run FMC in HA, did the "pause sync / upgrade standby first / expect split-brain" process go smoothly, or did you run into issues when re-syncing afterward?

4. Post-upgrade weirdness: Any cosmetic bugs, policy deployment issues, or smart licensing problems that showed up after the reboot? I saw some chatter about object search being broken in certain 7.4 builds, wasn't sure if 7.2.12 had anything similar.

5. Timing: Roughly how long did the actual FMC upgrade take from start to login screen? Trying to size my outage window.

Not looking for a full walkthrough (I have the Cisco guide bookmarked), just want to hear from anyone who's actually done this specific hop. If you ran into a TAC case or a workaround, that's especially useful.

Thanks in advance.

Hi everyone,

I'm trying to recover a Cisco ISR 1111-4P router stuck in a boot loop (Last reset cause: LocalSoft).

System Details:

- Hardware: Cisco ISR C1111-4P (4GB RAM)

- ROMmon Version: System Bootstrap, Version 16.9(1r)

- Target IOS-XE Image: c1100-universalk9.17.09.04a.SPA.bin (loaded via usb0:)

What I've tried so far:

1. Set boot variable and config register:

   BOOT=usb0:c1100-universalk9.17.09.04a.SPA.bin

   confreg 0x2102

2. Booted directly from USB using: boot usb0:c1100-universalk9.17.09.04a.SPA.bin

Behavior (as shown in attached images):

- The image decompress/loads from usb0: completely.

- SHA-1 hash calculation and validation PASSES.

- RSA Signed RELEASE Image Signature Verification is SUCCESSFUL ("Image validated / Rom image verified correctly").

- Immediately after validation, the router reboots itself back into ROMmon instead of unpacking the IOS-XE kernel.

Is this issue caused by an outdated ROMmon 16.9(1r) failing to process the 17.09.04a package header structure, or am I looking at a permanent hardware failure (NAND/RAM corruption)?

Any help or confirmation on whether this unit is dead/recoverable would be greatly appreciated!

Has anyone here worked with Cisco 7925G wireless VoIP phones and older Cisco Aironet APs?

I recently joined a company that uses wireless VoIP phones throughout its warehouse. They’ve had call-quality issues for quite some time, predating my arrival.

After reviewing the configuration, I found several potential problems:

• No proper QoS configuration on the APs.
• No QoS on the trunk links between the APs and switches.
• An older wireless infrastructure that the company isn't planning to replace immediately.

I've convinced management to budget for new switches and APs, and possibly new phones, but I need to keep the existing phones working reliably until the upgrades happen.

Current equipment:

• Phones: Cisco 7925G
• APs: Cisco AIR-CAP2702E-A-K9

The main issue is intermittent poor call quality, which seems to happen more frequently in the evenings.

I've configured QoS on the trunk links and added the following configuration to the APs:

class-map match-all Voice
 match ip dscp ef
class-map match-all CallControl
 match ip dscp cs3
!
policy-map voip
 class Voice
  set cos 6
 class CallControl
  set cos 4
!
!
interface dot11radio0
 service-policy input voip
 service-policy output voip
!
interface dot11radio1
 service-policy input voip
 service-policy output voip
!
end

When I check the policy-map configuration, the Voice and CallControl classes appear to be configured correctly.

However, one thing that caught my attention is the output of show dot11 qos:

QOS Trust: Disabled
QOS Stats: Disabled

I'm not sure whether this is expected on this AP model or whether I'm missing an important configuration step.

My questions:

1. Does QOS Trust: Disabled indicate that the AP isn't trusting or prioritizing the voice traffic as intended?
2. Is there additional QoS configuration required on the AP radios or WLANs for the 7925G phones?
3. What would you check next to improve call quality without replacing the existing hardware?

I'm looking for practical troubleshooting advice from anyone who's worked with this equipment. I'd appreciate specific commands or configuration examples, especially if you've dealt with these phones in a warehouse environment.

Thanks!

Hi
we are a Hyper V site, running Azure Local. ive got 2 clusters and have built 2 WLC VMs, following the documentation from Cisco about 3 nics, and labelling them trunking etc etc. upon a fresh build of the WLCs we seem to be happy. However when VMs migrate from one host to another within the cluster (as they will do for either performance reasons, or if you are taking a host down to perform maintenance on it), the HA seems to break. and the only way weve been able to get back is to tear down the WLCs and build them again.

currently, ive got one VM that only has 2 nics, its lost its HA one, and my other VM has somehow managed to change the naming of the nics that it has, so whilst they are still eth1, eth2 and eth3 at the hyper-visor level, they are 4 5 and 6.

does anyone have any ideas as to what might be happening. ive got a case logged with TAC, but we seem to be going round in circles a bit at the moment, and looking like i may need to build the WLCs again from scratch..... so figured id throw out to a wider audience.

Dear everyone,

I have issue with nexus switch 93180yc-fx3 high speed 100%, it running firmware NX OS with 10.6.2F version.

Anyone have issue same to me, and how to fix this issue?

Thank you so much.

Hi everyone! Has anyone taken the Cisco CCST Cybersecurity (100-160) certification exam? How difficult is it?

I've been studying with Cisco Networking Academy (NetAcad) courses and other study guides, but I'm still a bit worried about the exam. I'd really appreciate hearing about your experiences or any advice you might have!

We have two 7841s giving me a headache.

One will not use the partition for internal and external calls but can receive either or using the local or outside call partitions. Everyone else's works fine on the dual use partition, same phone model throughout.

Another phone will not use certain Forced Authentication Codes but, again, they work on all other phones I've tried.

We use CUCM, not Webex - if that helps at all.

Any thoughts? This is racking my brain and I'm about to replace the physical phones over this seemingly software issue (because that one thing I haven't tried).

Hi, I bought a Cisco ISR 1100 series (C1111) router and tried to configure it properly. It’s not going very well, mainly because I don't have much experience. After the configuration, I have a problem: I don't have internet access on my laptop. I can't ping sites like google.com. Could someone with extensive knowledge please send me a private message and help me out?Hi, I bought a Cisco ISR 1100 series (C1111) router and tried to configure it properly. It’s not going very well, mainly because I don't have much experience. After the configuration, I have a problem: I don't have internet access on my laptop. I can't ping sites like google.com. Could someone with extensive knowledge please send me a private message and help me out?

Hi, I bought a Cisco ISR 1100 series (C1111) router and tried to configure it properly. It’s not going very well, mainly because I don't have much experience. After the configuration, I have a problem: I don't have internet access on my laptop. I can't ping sites like google.com. Could someone with extensive knowledge please send me a private message and help me out?Hi, I bought a Cisco ISR 1100 series (C1111) router and tried to configure it properly. It’s not going very well, mainly because I don't have much experience. After the configuration, I have a problem: I don't have internet access on my laptop. I can't ping sites like google.com. Could someone with extensive knowledge please send me a private message and help me out?

I’m troubleshooting Cisco Secure Client VPN authentication with Duo MFA.

Most of our Dell laptops work fine, but we're experiencing issues with Lenovo ThinkPad E16 Gen 2 and Gen 3 laptops.

Hardware:
Failing: Lenovo ThinkPad E16 Gen 2 (21MA) and Gen 3 (21SR)
Working: Dell Precision 3590
Same iPhone and Duo account work on the Dell
Windows 11, Duo Desktop 7.22

Issue:
When logging into Cisco Secure Client, the Duo authentication page prompts us to Install Duo Desktop, even though it's already installed and running.
Clicking Open App launches Duo Desktop, briefly attempts to load, then returns to the installation prompt. Previously, we also encountered Duo Push notifications where the iPhone's Approve button was greyed out during Bluetooth proximity verification.

Troubleshooting completed:
-Updated Lenovo BIOS, Bluetooth/Wi-Fi drivers, and firmware
-Verified Bluetooth LE Enumerator and other Bluetooth components are working
-Confirmed all three Duo Desktop services are running
-Verified local Duo Desktop ports 53100/53106 are listening and reachable
-Confirmed HTTPS connectivity to localhost
-Verified Duo Desktop's URL protocol handler launches the application
-Tested disabling Secure Boot with no improvement

Duo Desktop logs contain repeated TrustedPeerConnection RPC timeout errors.

Has anyone encountered this with Lenovo ThinkPads and Duo Desktop/Cisco Secure Client?

I’m pulling my hair out with this, and would appreciate any pointers.

Man... Idk if it's just me, but I'm starting to feel like if you don't actively ask yourself questions about a topic, you don't really deepen your understanding of it.

Look at this, for example...

I'm configuring DAI because that's the topic I'm currently covering in Jeremy's IT Lab. Then I realize my clients aren't getting IP addresses.

Okay... I check the switch, and DAI is doing its thing because I haven't configured DHCP Snooping yet.

Fine, let's configure DHCP Snooping. But then I'm like, "WTF? Which interfaces am I actually supposed to configure as trusted in this topology?"

The example in JITLab was pretty straightforward, so I start thinking about the path the DHCP messages will take during the DORA process. Eventually, I figure out which interfaces need to be trusted.

But then I start asking myself more questions:

1. What happens if STP reconverges and the new forwarding path takes DHCP traffic through an interface I haven't configured as trusted? Could that prevent clients from getting IP addresses?
2. What happens when you have multiple VLANs? You can't configure a trunk port to be trusted for DHCP Snooping in one VLAN but untrusted in another. So how are you supposed to approach this in a real network?

Something about my understanding clearly wasn't adding up.

I asked NotebookLM 'bout it, and the solution it suggested was something I'd briefly considered but hadn't seen Jeremy explicitly recommend: treat DHCP Snooping similarly to DAI and trust the appropriate interfaces connecting to other network devices, rather than trying to trust only the interfaces used by the current DHCP traffic path.

And I just can't help thinking... combining these technologies must be pretty normal in real-world networks.

If I were working in IT and got a ticket saying that PCs weren't getting IP addresses, only to discover that DHCP Snooping was dropping DHCP messages because of a trust configuration issue, I'd be completely lost.

And that's what got me thinking: you can follow a tutorial, understand everything the instructor explains, and still not understand how to actually troubleshoot or apply that knowledge in a real network.

Sometimes, it's the questions you ask yourself after the lesson that teach you the most.

Has anyone gone through the Cisco MISL program? If so, what was it like? what can you expect or get out of it? Specifically looking at their Sales pathway

After passing my CCNA last Sept 28, I started diving straight into enterprise networking topics. I finally got access to our company's PNETLab server, and honestly, going from Packet Tracer to running actual images is mind-blowing.

​I just finished building a Site-to-Site VPN tunnel with IKEv2. Being able to run real debug commands and watch the actual packet exchanges and DPD checks happen live in the CLI (instead of Packet Tracer's limited sim mode) made everything click so much faster.

​Up next: diving into BGP configuration now that the tunnel transport is rock solid!

​If you're still relying solely on Packet Tracer, definitely make the jump to PNETLab or EVE-NG when you can. It makes practicing real-world troubleshooting way more satisfying.

Would like to know what people use and where to get started with this. We have over complicated application deployments which require a lot of manual effort.

I made a simple diagram below dumbing down my network. Basically I have 2 sites connected by microwave with three different networks at each site that need to talk across the microwave, but the networks don't talk with each other, which is why I have them segmented by VLANS in diagram.

I was looking to use a layer 2 switch to aggregate the three connections at each site, into one connection going to the microwave to consolidate ports but ALSO I want to enable COS (class of service, not quality of service) on the switch to make sure my most important traffic makes it through in times of microwave link degradation where my bandwidth is limited from normal.

I am trying to setup, what seems like something simple where I have COS based on my VLAN traffic. So for example:

- VLAN 100 = COS 6

- VLAN 200 = COS 5

- VLAN 300 = COS 4

In this case my most important traffic is on VLAN 100, and will always get through no matter what, 200 is next and if there is anything left 300 gets a shot.

I dont want to do QOS based on bandwidth allocations, or round robin scheduling or anything like that. I want to setup strict policing of the traffic based on my criteria.

All of the routers/switchs in the diagram below are IE4010 devices.

I could use some help!

October 2026: Cisco NX-OS Software Security Hardening Release

Cisco Advance Notification for Publication of October 7, 2026, Security Advisories

October 2026: Cisco License (Smart Software Manager) On-Prem Security Hardening Release

Exploitation and Public Announcements

The Cisco PSIRT is not (yet) aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.

I am getting gibberish on all baud speeds trying to connect to a 4221 ISR, prolific rj45 to usb serial works fine for 8200s and 1121s though, I don't know what to do, somebody wants this 4221 working today.

I work as a Network Administrator in a mostly Cisco environment and regularly work with Catalyst switches, Catalyst Center, ISE, 802.1X/MAB, VLANs/trunking, and troubleshooting.

There's obviously a huge amount you could learn in the Cisco ecosystem, but I'm curious what experienced engineers think is actually worth going deep on.

If you could pick one or two Cisco technologies/skills to master for the next 5-10 years, what would you choose and why?

I'm especially interested in what's becoming more valuable with automation, cloud, and modern enterprise networking.

I’ve attempted to setup tacacs over tls. Login is working perfectly. I debug the log watch tls being established see the ise logs everything is good. However when I try to escalate privilege by typing enable it fails. The most interesting part of the failure is the log entry I get.

TAC+: Invalid key

My AAA for enable is configured the same as my AAA line for login (which is working). I’m on iosxe 17.18.4.

I do have a tac case open but not getting anywhere with it. Just curious if anyone else has seen this before or really if anyone has it working at all on 17.18.4.

FN74445 - Cisco Unified CCE and Packaged CCE Releases 12 and 15 - Administrators and Supervisors Are Unable to Log In to CCE Administration

Problem Description

Cisco has identified an incompatibility between Cisco Unified Contact Center Enterprise (Unified CCE), Cisco Packaged Contact Center Enterprise (Packaged CCE) and Apache Tomcat releases 9.0.121 and later. Due to a change that was introduced in Apache Tomcat Release 9.0.121, users can no longer log in to CCE Administration after upgrading to Release 9.0.121 or later. 

Background

Cisco Unified CCE Administration relies on a Cisco software component that integrates with Apache Tomcat to perform user login, covering single sign-on (SSO), hybrid, and local authentication. Apache Tomcat Release 9.0.121 changed the way that Apache Tomcat interacts with components of this type.  On Apache Tomcat releases 9.0.121 and later, the Cisco login component is no longer invoked, so login requests to CCE Administration are not processed, which causes authentication to fail.

Every time I opened Packet Tracer it asked me to log in, and the only way around it was turning off my whole Wi-Fi, which kills YouTube and Discord too. So I wrote a small PowerShell script that blocks internet access for Packet Tracer only. PT thinks it's offline while the rest of my PC stays online.

It just adds two Windows Firewall rules for `PacketTracer.exe`, with no patching or modifying PT at all. It finds Packet Tracer on any drive, is safe to run repeatedly, and has a one-command way back online. If it saves you the same headache, a ⭐ on the repo helps a lot, and feel free to open an issue if you find a bug.

https://github.com/nabilfp/CiscoPacketTracer-Offline

I am trying to deploy CSC with XDR using Jamf to a fleet of macs andI have the policy, installer and script set up to install Cisco Secure Client and the XDR module, but now I'm running into an issue with PPPC payload in my config profile to allow CSC full disk access.

I have followed the directions here, https://docs.xdr.security.cisco.com/Content/Client-Management/deployment-management.htm at the bottom to provide full disk access for network visibility module - XDR, i also went into terminal and ran

codesign -display -requirements

along with the csc app and pulled out that codesign statement and i keep getting,

the key 'CodeRequirement' has an invalid value.

Can anyone help me figure out what i'm missing exactly to get this to deploy correctly?

We have a few sites that have 5-10 trailers that need an internet connection for testing, but the solutions we have used in the past are getting expensive. The trailers are around 200-500 yards from the nearest IDF and it would be too expensive to run fiber for temporary trailers. We are currently using IW-3702's but they are approaching EOS and we want to get a new solution at least a year before. We have talked with the sales team about Cisco CURWB, but just wondering if there is anything else that could be used.

My home network has two older Cisco Aironet 2600 Wifi Access Points in autonomous mode that my new Pixel 11 won't connect to. It fails with saved/check password try again even though the password is correct (literally copied and pasted from the APs web interface)

Previously they were on Dual Band, WPAv1, with AES + TKIP encryption and worked on every other device I threw at them (Pixels up to 8, Galaxy up to Z Flip 8)

Have tried switching to single band, dropped legacy TKIP support, and moved to WPAv2 all without success. Trying WPAv2dot11 doesn't change anything for the Pixel 11 but stops my older devices connecting. There's no unusual characters in either the SSID or Pre-Shared Key. All the other advice I've seen suggests this phone has issues with some WiFi7 settings, but the APs pre-date those.

They do work if I switch all encryption off, and if I change any settings that would push them towards WEP the phone seems willing to connect, but warns that WEP is a older protocol and the connection would be insecure. I haven't however tried creating a WEP key to see if it would actually work.

Is it a case that the APs are just too old (which is a concern as they're still in use out there in some commercial settings) and I need to replace them with WPAv3 compatible ones, or is there something else I'm obviously missing?