I recently had to install a new HP c7000 chassis with 16 half height blades.
This came with 4 Cisco 3020’s switches in the back, 2 for normal network traffic and 2 for the iSCSI fabric. This was to be placed in a PCI environment and so had to meet PCI requirements.
PCI DSS states:
So we need to encrypt the management access to the switches, by default the Cisco IOS doesn’t support SSH or HTTPS Encryption. To enable SSH and HTTPS we need to update the IOS with the K9 image:
From the cisco website
You need a valid Service Contract login to download IOS software.
Note K9 in the IOS filename just make sure you look for this then you know you have the correct IOS update.
Now you need a TFTP server so you can upload the image to the switch, I usually use TFTPD for Windows. You can download it from here:
Open TFTP and then select the directory in which the IOS update is located. Now TFTPD is looking at the correct directory you need to log on to the switch.
You will obviously need to use the console cable and set an IP address on the Management Interface or VLAN depending on your setup. The 3020’s I am dealing with have a seperate FastEthernet (fa0) interface connecting to the HP Onboard Administrator for management. In my case as well because of the HP Onboard Administrator the fa0 interface is given an IP address through EBIPA. Now connect to the same Subnet as the Management interface.
As you can see above I’ve downloaded the archive update file which contains the updated HTTP files as you never know in the future you might want to use the HTTP interface.
On the switch type the following command:
Switch# archive download-sw /overwrite /reload tftp://ipaddress/cbs30x0-ipbasek9-mz.122-58.SE1.tar
This command will download the image from the specified TFTP server, it will overwrite the current IOS and attempt to reload the switch. If the config hasn’t been saved then the reload will be aborted. To save the config I always run the following before running the above command:
Switch# copy run start
This will copy the running config to the start up config then the switch will automatically reload on the update.
Once the switch has booted up fully it should now have the K9 image installed. you can always confirm this by running the following:
Switch# show version
Cisco IOS Software, CBS30X0 Software (CBS30X0-IPBASEK9-M), Version 12.2(58)SE1