Cisco Catalyst
9 posts on Cisco Catalyst: design decisions and how-to guides from small infrastructure estates run on a very low budget.
- Catalyst 3850: console access from a Linux jumphost and config backups
A USB serial adapter on the stack's console port, the operator in the dialout group, screen at 9600 8N1, and a small expect script that captures the running configuration into the repository. Plus the break-glass path and why management egress never goes over anyone else's WiFi.
- Catalyst 3850: send syslog to a SIEM instead of polling SNMP
Point the switch at the SIEM with logging host, raise the trap level to informational, timestamp with milliseconds, log configuration changes with archive, and let Wazuh decode the rest. Port flaps, LACP changes and failed logins become events next to everything else.
- Catalyst 3850: upgrade IOS-XE on a stack in install mode
Confirm install mode, clean the flash, copy and verify the image, install it to every member in one command, reload with a console attached, and keep the old image on flash for the rollback you hope not to need.
- OPNsense: VLANs on a trunk from a Catalyst, with Kea DHCP
Adding a tenant VLAN to an OPNsense pair fed by a Catalyst trunk, from the switch port to the CARP gateway, the firewall rule order that keeps tenants apart, and a Kea DHCP pool for provisioning. Done twice, because there are two nodes.
- Catalyst 3850: port-channel is up but no traffic passes
LACP bundles, the MAC table has entries, and nothing gets through. The port is tagging the wrong way for its host class, and the switch has no reason to tell you.
- Catalyst 3850: cross-stack LACP to a Proxmox bond, both sides
One port on each stack member, a port-channel in LACP active mode, a trunk whose native VLAN does not exist, and an 802.3ad bond under a VLAN-aware bridge on the Proxmox node. Both halves, and how to check they agree.
- Catalyst 3850: trunks with a native VLAN that does not exist
Set every trunk's native VLAN to one you never create, so untagged frames vanish instead of landing in VLAN 1. Then carry the provider's WAN handoff through the stack as a tagged VLAN to both firewalls.
- Catalyst 3850: stack two switches and add a member safely
Cable the stack ring, set priorities in EXEC mode (not config mode), match the software before the new member joins, and power on one switch at a time. The traps are the priority command and auto-upgrade.
Second-hand Catalyst, first-class conventionsA used two-member switch stack gives you cross-stack LACP for the price of a prosumer switch. The value is in the conventions, not the hardware.