Cisco Catalyst 9200 User Manual

Verifying Software Integrity
The following example displays the checksum record for the boot stages. The hash measurements
are displayed for each of the three stages of software successively booted. These hashes can be
compared against Cisco-provided reference values. An option to sign the output gives a verifier the
ability to ensure the output is genuine and is not altered. A nonce can be provided to protect against
replay attacks.
Boot integrity hashes are not MD5 hashes. If you run verify /md5 cat9k_iosxe.16.10.01.SPA.bin
command for the bundle file, the hash will not match.
Note
The following is a sample output of the show platform integrity sign nonce 123 command in install
mode. This output includes measurements of each installed package file.
Device# show platform integrity sign nonce 123
Platform: C9200L-24T-4G
Boot 0 Version: SBOOT0.v27
Boot 0 Hash:
EE98DCD0D6AEA85C8891039F649664FCC3CF709CCFC7A6F248C9D5BA8463528F
Boot Loader Version: System Bootstrap, Version 10.2, DEVELOPMENT SOFTWARE
Boot Loader Hash:
9220B87E7A153A79EB9AE37311A1FDE2313C9996F21032F8A1E7EF4935D3E7427657E4CDEE537E7B3C50E84121C00BD2D556786A4EE155D3C0AFF67F63F1A69B
OS Version: 16.10.01
OS Hashes:
cat9k_lite-rpbase.16.10.01.SPA.pkg :
D0D155C1DEFDB03EB0C64057AD6A9673E2114FA7CCCAAA7ED0AE935CB0BD84E0D0D155C1DEFB03EB0C64057AD6A9673E2114FA7CCCAAA7ED0AE935CB0BD84E0
cat9k_lite-rpboot.16.10.01.SPA.pkg :
AD6A9673E2114FA7CCCAAA7ED0AE935CB0BD84E0D0D155C1DEFDB03EB0C64057AD6A9673E2114FA7CCCAAA7ED0AE935CB0BD84E0D0D155C1DEFB03EB0C64057
cat9k_lite-srdriver.16.10.01.SPA.pkg :
4FA7CCCAAA7ED0AE935CB0BD84E0D0D155C1DEFDB03EB0C64057AD6A9673E2114FA7CCCAAA7ED0AE935CB0BD84E0D0D155C1DEFB03EB0C64057AD6A9673E211
cat9k_lite-webui.16.10.01.SPA.pkg :
CCCAAA7ED0AE935CB0BD84E0D0D155C1DEFDB03EB0C64057AD6A9673E2114FA7CCCAAA7ED0AE935CB0BD84E0D0D155C1DEFB03EB0C64057AD6A9673E2114FA7
cat9k-wlc.16.10.01.SPA.pkg :
AA7ED0AE935CB0BD84E0D0D155C1DEFDB03EB0C64057AD6A9673E2114FA7CCCAAA7ED0AE935CB0BD84E0D0D155C1DEFB03EB0C64057AD6A9673E2114FA7CCCA
PCR0: 750E5D2EDAE6E3A68050638E0BFD8619BE4EA13066025D39DF79408719F5177E
PCR8: EB6E739A63F53E703B6CDAF3F6188833CEF6D32E2F726006B9AA34E1E73048C4
Signature version: 1
Signature:
5AA41E6C722D841D02F5A7B6D096395E786D6949CFC9EC1C476F776BC1C599CBEF3E69A9891DC100EA256CE19B7CCA27774AA7894F1AC14D17F67176029029222825861B679493A0BB207F67463172A0989E2CB3A3D8293799B2A6A8FA4757E27767ACBFF947DB826D94AAB47AC3B6EBE697F79A56B2D0501BF22CF7331787C3C42F4BDC78843D3949D10E78BBBCF39DD8B42D9D4B0BBBD803355F68631598926583379968510B0F8FA3EBF6D09B3FC46D09EDE9C0BD6AF9E24658399C54818CE61C4AC855805BDCEFFD73905AB811745B4B20F9BC07AA8D6B24B34351FDF75151C8496090382A936C77B23DCAF90D0D5996F0AAFC019C53F12F4E40285D1824
The following is a sample output of the show platform integrity sign nonce 123 command in bundle
mode. This output includes measurements of the bundle file and each installed package.
Device# show platform integrity sign nonce 123
Platform: C9200L-24T-4G
Boot 0 Version: SBOOT0.v27
Boot 0 Hash:
EE98DCD0D6AEA85C8891039F649664FCC3CF709CCFC7A6F248C9D5BA8463528F
Boot Loader Version: System Bootstrap, Version 10.2, DEVELOPMENT SOFTWARE
System Management Configuration Guide, Cisco IOS XE Gibraltar 16.10.x (Catalyst 9200 Switches)
48
Boot Integrity Visibility
Verifying Platform Identity and Software Integrity

Cisco Catalyst 9200 Specifications

General

Operating System	Cisco IOS XE
Model	Catalyst 9200
Ports	24 or 48
Port Types	10/100/1000BASE-T, 1G/2.5G/5G/10GBASE-T, SFP, SFP+
Switching Capacity	176 Gbps
Forwarding Rate	131 Mpps
Stacking	Yes, up to 8 switches
Security Features	TrustSec
Management	Cisco DNA Center
Operating Temperature	32°F to 104°F (0°C to 40°C)