Catalyst on Barash Helvadzhaogluhttps://barashhelvadzhaoglu.com/en/tags/catalyst/Recent content in Catalyst on Barash HelvadzhaogluHugo -- 0.168.0enFri, 16 Oct 2026 00:00:00 +0000Cisco Catalyst 3560 IOS Upgrade: Two Methods and Verificationhttps://barashhelvadzhaoglu.com/en/posts/catalyst-3560-ios-upgrade/Fri, 16 Oct 2026 00:00:00 +0000https://barashhelvadzhaoglu.com/en/posts/catalyst-3560-ios-upgrade/Upgrading IOS on a Cisco Catalyst 3560 — archive download-sw versus manual copy and boot system, flash space, MD5 verification and rollback.Upgrading IOS on a Catalyst 3560 is not complicated, but the details matter: which file format you download, how much space is left in flash, and whether the boot variable points to the right image. A mistake in any of these leaves you with a switch that boots into the boot loader instead of IOS.

There are two ways to do it:

  • Method A: archive download-sw with a .tar file. The switch extracts the image, the web device manager files and sets the boot variable itself.
  • Method B: manual upgrade with a .bin file. You copy the image, verify it, set boot system and reload.

Lab note: I am upgrading my own Catalyst 3560 8-port PoE switch with both methods. Console outputs and timings from that lab will be added to this guide.

1. Before You Start

Back Up the Configuration

Switch# copy running-config startup-config
Switch# copy startup-config tftp:

Keep the backup off the switch: on your laptop, a TFTP or SCP server, or your configuration management tool.

Identify the Model, Version and Feature Set

Switch# show version
Switch# show inventory

Write down three things:

  • Exact model, for example WS-C3560-8PC-S. The image must match the platform.
  • Current IOS version.
  • Feature set, for example IP Base (ipbasek9) or IP Services (ipservicesk9). Choose the same feature set for the new image unless you deliberately change it.

Check the Boot Settings and Flash Space

Switch# show boot
Switch# dir flash:

show boot shows which image the switch loads at the next reload. dir flash: shows the files and, at the bottom, the free space. Compact switches like the 8-port 3560 have little flash. Often there is not enough room for two images at the same time.

Download the Image

Download the image from Cisco Software Download. A service contract is required. You will find two file types:

File Contents Used with
.tar IOS image plus web device manager files archive download-sw (Method A)
.bin IOS image only Manual copy and boot system (Method B)

Note the MD5 checksum shown on the download page. You will compare it on the switch.

The classic Catalyst 3560 is end of life, so the latest release on the download page is the final one for this platform.

2. Method A: archive download-sw

This is the method Cisco recommends for this switch family. One command transfers the .tar file, extracts it into a new directory in flash, updates the boot variable and optionally reloads.

Switch# archive download-sw /overwrite /reload tftp://192.0.2.10/c3560-ipservicesk9-tar.<version>.tar

The most useful options:

Option Effect
/overwrite Replaces the current image if there is not enough space for both
/leave-old-sw Keeps the old image (only if flash has room for both)
/reload Reloads the switch after a successful download
/imageonly Installs only the IOS image, without the web device manager files

If you have room for both images, use /leave-old-sw instead of /overwrite. Rollback is then just a boot variable change.

Without /reload, check the result before reloading:

Switch# show boot
Switch# dir flash:
Switch# reload

3. Method B: Manual Upgrade with a .bin File

The manual method gives you full control over each step. It is useful when you only have a .bin file, or when you want to verify the image before touching the boot variable.

Copy the Image

Switch# copy tftp://192.0.2.10/c3560-ipservicesk9-mz.<version>.bin flash:

If there is not enough space, you must delete the old image first. That removes your rollback option on the switch, so make sure you have the old image on your TFTP server and a console connection ready.

TFTP works for small files but is slow and unreliable over long distances. If your IOS version supports it, SCP or FTP is faster.

Verify the Checksum

Switch# verify /md5 flash:c3560-ipservicesk9-mz.<version>.bin

Compare the result with the MD5 value from the Cisco download page. If they differ, delete the file and copy it again. Never boot an image that failed verification.

Set the Boot Variable and Reload

Switch# configure terminal
Switch(config)# boot system flash:c3560-ipservicesk9-mz.<version>.bin
Switch(config)# end
Switch# copy running-config startup-config
Switch# show boot
Switch# reload

Check show boot before the reload. The BOOT path-list must point to the new image, with the correct file name and path.

4. After the Upgrade

Switch# show version
Switch# show interfaces status
Switch# show power inline
Switch# show logging
  • show version: the new IOS version is running.
  • show interfaces status: all expected ports are up.
  • show power inline: PoE devices are powered again.
  • show logging: no errors during boot.

When you are sure the new version works, remove the old image to free up space, unless you want to keep it for rollback.

5. Rollback

  • Old image still in flash: point the boot variable back to it with boot system flash:<old-image>, save and reload.
  • Old image deleted: copy it back from your TFTP server, verify the MD5 and set the boot variable.
  • Switch does not boot IOS at all: it stops at the switch: prompt. This is covered in When a Catalyst 3560 Won’t Boot: Recovery from the Boot Loader.

Common Mistakes

  • Wrong platform or feature set. An image for another model does not boot.
  • Deleting the old image before the new one is verified. If the copy is corrupted, you have nothing to boot.
  • A typo in boot system. The switch cannot find the image and stops at the boot loader.
  • No console connection during the reload. If something goes wrong, you can only see it from the console.
]]>Cisco Catalyst 3560 Password Recovery: Two Methods, Step by Stephttps://barashhelvadzhaoglu.com/en/posts/catalyst-3560-password-recovery/Fri, 16 Oct 2026 00:00:00 +0000https://barashhelvadzhaoglu.com/en/posts/catalyst-3560-password-recovery/How to recover a lost enable or console password on a Cisco Catalyst 3560 — keep the configuration with the boot loader method, or reset when password recovery is disabled.You inherit a switch, the documentation is gone, and nobody knows the enable password. Or a lab switch comes back from storage and the console asks for a password you never set. On a Cisco Catalyst 3560 you can recover from both without losing the configuration, as long as you have physical access and a console cable.

This guide covers the two situations you will meet in practice:

  • Method 1: keep the configuration. The switch boots without loading its startup configuration, you reset the passwords, and you put the original configuration back.
  • Method 2: password recovery is disabled. Someone configured no service password-recovery. You can still get the switch back, but only by resetting it to factory defaults.

Lab note: I am running these procedures on my own Catalyst 3560 8-port PoE switch. Console outputs from that lab will be added to this guide.

What You Need

  • Physical access to the switch. Password recovery is deliberately impossible remotely.
  • A console cable (RJ-45 rollover or USB-to-serial) and a terminal program such as SecureCRT, PuTTY or screen.
  • Terminal settings: 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.
  • A maintenance window. The switch reboots twice and does not forward traffic during the procedure.

For console access from a distance, a console server is the professional answer. See Next-Gen Console Server Architecture.

How the Recovery Works

The Catalyst 3560 stores its startup configuration as a file called config.text in flash. When the switch boots normally, IOS loads that file. Password recovery interrupts the boot process before IOS starts and gives you the boot loader, a small environment with the switch: prompt.

In the boot loader you can access the flash file system. If config.text is renamed, IOS boots without a configuration, which means without passwords. You then log in, restore the configuration manually and set new passwords.

Method 1: Recover the Password and Keep the Configuration

Step 1: Interrupt the Boot Process

  1. Connect the console cable and open your terminal session.
  2. Unplug the power cable.
  3. Press and hold the Mode button on the front panel.
  4. Reconnect the power while still holding Mode.
  5. Release the button after about 15 seconds, when the console shows that the system was interrupted before the flash file system was initialized.

You should now see the switch: prompt. If the switch boots normally instead, power off and try again, holding the button a little longer.

Step 2: Initialize Flash

The flash file system is not mounted yet. Initialize it:

switch: flash_init

On some older boot loader versions you also need to load helper files:

switch: load_helper

Then list the contents of flash:

switch: dir flash:

You should see the IOS image (or a directory containing it), config.text, vlan.dat and possibly private-config.text.

Step 3: Rename the Configuration File

switch: rename flash:config.text flash:config.text.old

Do not delete config.text. Renaming it is enough to stop IOS from loading it, and you still need its contents later.

Step 4: Boot IOS Without the Configuration

switch: boot

The switch boots with an empty configuration. When it asks whether you want to enter the initial configuration dialog, answer no.

Step 5: Restore the Original Configuration

Switch> enable
Switch# rename flash:config.text.old flash:config.text
Switch# copy flash:config.text system:running-config

The switch now runs your original configuration, including the hostname, VLANs, interfaces and the old passwords. You are still in privileged mode because you entered it before the configuration was loaded.

Step 6: Set New Passwords

Switch# configure terminal
Switch(config)# enable secret <new-enable-secret>
Switch(config)# username admin privilege 15 secret <new-password>
Switch(config)# line con 0
Switch(config-line)# login local
Switch(config-line)# line vty 0 15
Switch(config-line)# login local
Switch(config-line)# end

Adjust this to how authentication was set up before. If the switch used TACACS+ or RADIUS, check that the local fallback account still works.

Step 7: Check Interfaces and Save

Copying a configuration into the running configuration merges it. It does not reproduce every interface state. Check for interfaces that are administratively down, especially VLAN interfaces (SVIs):

Switch# show ip interface brief

Bring up any interface that should be up with no shutdown. Then save:

Switch# copy running-config startup-config

Reload once and log in with the new credentials to confirm that everything survives a reboot.

Method 2: When Password Recovery Is Disabled

If the switch was configured with no service password-recovery, the Mode button procedure behaves differently. You cannot access the flash file system from the boot loader. Instead, the switch tells you that password recovery has been disabled and asks whether you want to reset the system to its default configuration.

  • If you answer yes, the switch deletes the configuration file and the VLAN database and boots with factory defaults. The IOS image stays in flash.
  • If you answer no, the switch boots normally with its current configuration, and you are back at the password prompt.

This is the intended trade-off of the feature. An attacker with physical access cannot read the configuration, but you lose it too.

Before you reset, make sure you have a recent backup of the configuration from another source, for example a configuration management tool, a TFTP server or an archived show running-config. After the reset:

  1. Log in without a password and set new credentials.
  2. Restore the configuration from your backup.
  3. Recreate the VLANs if your backup does not include them. The VLAN database (vlan.dat) is deleted too.
  4. Decide whether no service password-recovery should be enabled again. It makes sense for switches in public or unlocked locations, as long as the configuration is backed up somewhere else.

Newer Boot Loaders: Ignoring the Startup Configuration

Newer Catalyst models and boot loader versions offer a cleaner alternative to renaming config.text: a boot loader variable that tells IOS to ignore the startup configuration for one boot. Whether your switch supports it depends on the model and boot loader version. Run set at the switch: prompt to see the variables your boot loader knows.

I will document what the 3560 boot loader offers once I have the lab outputs.

Common Mistakes

  • Deleting config.text instead of renaming it. The configuration is gone, and your only option is a backup.
  • Forgetting to rename the file back. The switch boots without configuration at the next reload.
  • Using copy startup-config running-config before renaming. The startup configuration does not exist under its normal name at that point.
  • Not saving after changing the passwords. The old passwords come back at the next reload.
  • Shut down SVIs after the merge. Management access over the network fails even though the configuration looks correct.
]]>When a Catalyst 3560 Won't Boot: Recovery from the Boot Loaderhttps://barashhelvadzhaoglu.com/en/posts/catalyst-3560-boot-loader-recovery/Fri, 16 Oct 2026 00:00:00 +0000https://barashhelvadzhaoglu.com/en/posts/catalyst-3560-boot-loader-recovery/Recovering a Cisco Catalyst 3560 stuck at the switch: prompt — boot loader variables, booting a different image, and transferring a new IOS image over the console with Xmodem.Sooner or later every network engineer sees it: after a reload, the switch does not come back. On the console there is only a switch: prompt. The IOS image is missing, corrupted, or the boot variable points to a file that does not exist.

This is not a reason to replace the switch. The Catalyst 3560 boot loader has everything you need to get IOS running again, even when the image in flash is gone. This guide covers:

  • How to read the boot loader environment and why the switch stopped there
  • How to boot an image that is already in flash
  • How to transfer a new image over the console with Xmodem when flash is empty
  • How to make the fix permanent

Lab note: I am testing these scenarios on my own Catalyst 3560 8-port PoE switch. Console outputs and transfer times from that lab will be added to this guide.

Why the Switch Stops at the Boot Loader

The boot loader starts IOS from the image listed in the BOOT variable. If that fails, or if no BOOT variable is set and the boot loader cannot find a bootable image itself, the switch stops at the switch: prompt. Typical causes:

  • The upgrade went wrong: a typo in boot system, or the image was deleted before the new one was in place.
  • The image file is corrupted, for example after an interrupted copy.
  • The MANUAL_BOOT variable is set to yes, so the switch always waits at the prompt.
  • The flash file system is damaged.

Another symptom is a boot loop: the switch starts loading IOS, crashes and reboots again and again. To break the loop, interrupt the boot process with the Mode button. The procedure is described in the password recovery guide.

Step 1: Look Around

Initialize flash and look at what is there:

switch: flash_init
switch: dir flash:

Then show the boot loader environment variables:

switch: set

The most important variables:

Variable Meaning
BOOT Image(s) the switch tries to boot, separated by semicolons
MANUAL_BOOT yes = always stop at the boot loader prompt
BAUD Console speed. Default is 9600 when the variable is not set
CONFIG_FILE Configuration file name, default config.text

Use help to see which commands your boot loader version supports.

Step 2: Boot an Image That Is Already in Flash

If dir flash: shows a valid IOS image, you can boot it directly. Images installed with archive download-sw are in a subdirectory, so check the full path:

switch: dir flash:c3560-ipservicesk9-mz.<version>
switch: boot flash:c3560-ipservicesk9-mz.<version>/c3560-ipservicesk9-mz.<version>.bin

If MANUAL_BOOT was the problem, fix it:

switch: set MANUAL_BOOT no

When IOS is running, fix the boot variable permanently:

Switch# configure terminal
Switch(config)# boot system flash:<path>/<image>.bin
Switch(config)# end
Switch# copy running-config startup-config
Switch# show boot

Step 3: Flash Is Empty: Transfer an Image with Xmodem

If there is no usable image in flash, you need to bring one in. On the classic Catalyst 3560, the boot loader has no network stack and the switch has no USB storage port, so the console is the way in. The protocol is Xmodem, which every serious terminal program supports.

Prepare the Image

Use the .bin file, not the .tar file. Xmodem transfers a single file and the boot loader cannot extract archives. Check the MD5 checksum on your PC before you start, because the transfer is long and you do not want to repeat it.

Increase the Console Speed

At 9600 baud, transferring an IOS image of this size takes several hours. Increase the speed first:

switch: set BAUD 115200

The console output becomes unreadable immediately. Change your terminal program to 115200 baud and press Enter until the switch: prompt comes back.

Start the Transfer

switch: copy xmodem: flash:c3560-ipservicesk9-mz.<version>.bin

The switch waits for the file. In your terminal program, start an Xmodem send:

  • SecureCRT: Transfer > Send Xmodem
  • Tera Term: File > Transfer > XMODEM > Send
  • minicom / screen: use sx from the lrzsz package

At 115200 baud, expect a transfer time in the range of half an hour to an hour, depending on the image size and the terminal program. Do not touch the console session during the transfer.

Boot the New Image

switch: dir flash:
switch: boot flash:c3560-ipservicesk9-mz.<version>.bin

Step 4: Clean Up

When IOS is running:

  1. Verify the image: verify /md5 flash:<image>.bin
  2. Set boot system to the new image and save, as in Step 2.
  3. Reset the console speed. If you leave the boot loader BAUD at 115200, the console stays at that speed. Anyone who connects at the default 9600 baud later will see only garbage. Set it back in the boot loader (set BAUD 9600) or make sure the console line speed in IOS matches what your team expects.
  4. Reload once to confirm that the switch boots without help.

What About TFTP and USB?

On newer Catalyst platforms the boot loader can do more. Some models have a USB storage port (usbflash0:) or can boot an image over the network from the management port. That is much faster than Xmodem. On the classic 3560, these options are not available, so Xmodem is the only path when flash is empty. Run help at the switch: prompt to see what your platform supports.

The same idea, booting from TFTP or USB when the device does not start, is covered for data center switches in the Nexus NX-OS upgrade guide.

Prevention

  • Keep a copy of the current and the previous image on a TFTP server you can reach.
  • Verify the MD5 checksum before every reload after an upgrade.
  • Check show boot before every planned reload.
  • Have console access ready for every upgrade. A console server makes this possible remotely: Next-Gen Console Server Architecture.
]]>