AngelMedina

After provisioning Catalyst 9200L switches through Cisco Catalyst Center, we started seeing CPU hit 100% driven by the SISF-switcher process. The switches became sluggish and management was intermittently unreachable. These were among the only 9200L models in our environment, so it took a while to isolate.

Root cause: the default device-tracking policy was tracking every host it saw on every port - including AP trunk ports carrying broadcast traffic from hundreds of wireless clients and the uplink. The switch was trying to create binding table entries for everything, which hammered the SISF-switcher process.

Fix: created a new DT trunk policy with device-tracking policy DT_TRUNK_POLICY / device-role switch, applied it to all trunk/uplink interfaces. Also disabled IPv6 tracking across all DT policies since we don't run IPv6. CPU dropped immediately back to normal. Deployed the fix as a Day-N CLI template in CCC so all future 9200L provisioning gets it automatically.

Helpdesk tickets often come in with just an IP address or MAC and no other context. To speed up resolution, I built an internal web app using the Cisco Catalyst Center API that lets anyone on the IT team look up a device instantly - enter an IP or MAC and get back the connected switch, port, VLAN, device type, and user info. No CLI access required, no waiting on the network team for basic lookups. Built with Python on the backend querying the CCC REST API, with a simple web frontend anyone can use. Pending internal deployment.

Over time, network configs drift. VLANs get created and forgotten, security settings go stale, and STP best practices get skipped during rushed deployments. I wrote a Python/Netmiko script to audit and remediate over 215 switch stacks across our three campuses in one push.

Changes deployed: updated passwords and encryption to meet current security standards, removed legacy weak hashing, enabled login banners and hardened VTY lines. For STP, enabled Rapid PVST+, configured Root Guard on all downlinks, and enabled BPDU Guard on access ports. For VLANs, pruned all unnecessary VLANs from trunk uplinks - both legacy networks that no longer existed and new VLANs that had no presence on those switches.

What would have taken weeks manually was done in hours. The same script now runs as part of our standard switch onboarding process.