Cisco Prime Network Registrar 10.0 provides administrator functions to monitor user sessions, manage system configuration for session management, and report login information for each user. Session events are added to provide login and logout details for each user. For more information, see the "Session Management" section of the Cisco Prime Network Registrar 10.0 Administration Guide.

Prior to Cisco Prime Network Registrar 10.0, in the DNS Host Health Check, DNS used ICMPV4 and ICMPV6 to determine the host health. In Cisco Prime Network Registrar 10.0, DNS host health check now also supports GTP echo message to determine whether hosts are available or unavailable, and the end result is the same as the ping (i.e., unresponsive end points are not returned in the query response). For more information, see the "DNS Host Health Check" chapter of the Cisco Prime Network Registrar 10.0 Caching and Authoritative DNS User Guide.

Cisco Prime Network Registrar 10.0 supports RFC 8357 (Generalized UDP Source Port for DHCP Relay). These are not "configurable" options and require specialized server processing. A new DHCPv6 attribute, client-relay-port, is added to the Lease6 objects.

Note	You must upgrade both the failover partners to make use of this feature.

Prior to 10.0 release, the DHCP server generated a Server ID (DUID) using the DUID-LLT (link layer address plus time) format and wrote this into the lease state database if no stored entry already existed in the database. This server identifier would be used thereafter unless explicitly removed using the leaseadmin tool (leaseadmin -d server-duid). This could cause problems if the lease state database was copied and moved to a different cluster unless the leaseadmin tool was used to remove the server identifier from the copied database.

To eliminate the need for special steps if a lease state database is copied to another cluster, starting with 10.0 release the server can instead use the local cluster's Universal Unique Identifier (UUID) using the DUID-UUID format. This UUID is stored by ccmsrv and is not stored in the lease state database. Therefore, copying just the lease state database will not cause the same server identifier to be used on both clusters.

However, for upgrades from earlier versions, the existing Server ID will continue to be used unless explicitly removed after the upgrade by using the leaseadmin tool. Therefore, if you are upgrading from an earlier release where the server identifier was written to the database, you should use the leaseadmin tool to remove the server identifier stored in the lease state database to move to the cluster UUID based server identifier.

Note	When the server identifier changes, existing clients that attempt to renew DHCPv6 leases will fail to get a response until they send a Rebind request (at the "T2" time).

To simplify configuration, the default behavior uses a single KSK for all zones associated with a given tenant. However, they will all rollover at the same time because the zones use the same keys. Key groups let you create different keys for different groups of zones or even individual zones. Each set of keys will then have its own rollover schedule. In Cisco Prime Network Registrar 10.0, the key-group attribute is added to specify the zone KSK and ZSK. If set, these keys and any associated rollover keys will be used to sign the zones, instead of all available keys.

The dnssec-key getStatus command is added to manage rollover of multiple keys more easily.

Cisco Prime Network Registrar 10.0 supports CDS and CDNSKEY Resource Records (as described in RFC 7344 and RFC 8078) to ease the KSK rollover process in split DNS server setups, where the parent zone is externally owned.

The following REST APIs are added in Cisco Prime Network Registrar 10.0. For more information, see Cisco Prime Network Registrar 10.0 REST APIs Reference Guide.

• REST APIs to obtain the utilization data for scopes and prefixes (v4 and v6 utilization)

• REST APIs to apply scope, zone, prefix, and link templates. These can be applied to new or existing configuration objects using the applyTemplate action. General template support is added for other types of configuration objects.

• REST API to get the server system stats for the individual servers. REST support is added for SystemStats and ServerSystemStats classes.

The following commands are added in the CLI:

• address-type—Configures a address space type

• task—Configures a scheduled task

New attributes are added to, or definitions modified for, the following commands:

• admin—Creates administrators and assigns them groups and passwords

  • Added the unlimited-sessions attribute.

• ccm—Configures and controls the CCM server

  • Added the following attributes:

    admin-failed-login-limit, admin-suspended-timeout, admin-token-session-limit, admin-user-session-limit, and log-settings

• dns—Configures and controls the DNS server

  • Updated the getStats command to include the update statistics.

    dns getStats [performance | query | update | errors | security | maxcounters | ha | ipv6 | dns-pn | cache | datastore | top-names | dns-hhc | all] [total | sample]

  • Updated the rollover-ksk command to inlude the key-group attribute.

    dns rollover-ksk [tenant-id=<value>] [next-key=<keyname> | key-group=<value>]

  • Added the update=16 flag to the activity-counter-log-settings attribute.

  • Added the minimize-ttls attribute.

• dnssec-key—Manages Authoritative DNSSEC Key objects

  • Added the following command:

    dnssec-key getStatus

  • Added the following attributes:

    key-group, rollover-due-date, and status

• export—Exports configuration information to a file

  • Added the following command:

    export changeLog <filename> [<attribute>=<value> ...] [-all]

• lease6—Manages DHCP lease6 objects

  • Added the client-relay-port attribute.

• prefix—Configures IPv6 network prefixes for use in DHCPv6

  • Added the range-end and range-start attributes.

• prefix-template—Configures a prefix template

  • Added the following attributes:

    range-end-expr, range-start-expr, and restrict-to-admin-allocation

• zone—Configures a DNS zone

  • Updated the rrSet command to include the gtp-echo option.

    zone <name> rrSet <rr-name> [set <host-health-check=off/ping/gtp-echo>] [get <host-health-check>] [unset <host-health-check>] [show]

  • Added the key-group attribute.

The following table lists the key issues resolved in the Cisco Prime Network Registrar 10.0 release.

For the complete list of bugs for this release, see the cpnr_10_0_buglist.pdf file available at the product download site. See this list especially for information about fixes to customer-reported issues.

The following table lists the key enhancement features added in the Cisco Prime Network Registrar 10.0 release.

For the complete list of enhancement features added in this release, see the cpnr_10_0_enhancements.pdf file available at the product download site.

When using lookup keys for DHCPv6 leases, the server may end up using disambiguated (-1) names in DNS for these clients (the original entries will not be deleted). To solve this, you should validate the original name is either the same or no longer in use, and manually remove these entries from the DNS zone(s). This is only an issue for forward zones.

The fixes for the Spectre and Meltdown vulnerabilities add new overhead for all kernel transitions, which particularly impacts the networking calls used by Cisco Prime Network Registrar. This additional overhead results in considerable degradation in the Cisco Prime Network Registrar performance. For a general explanation of these issues (independent of Cisco Prime Network Registrar), conduct an internet search for “Controlling the Performance Impact of Microcode and Security Patches”.

When operating on a system with the Spectre and Meltdown security fixes in operation, Cisco Prime Network Registrar performance is significantly lower than it is on a system without any of these fixes. However, it is possible to use an up to date system and disable most of the Spectre and Meltdown security fixes.

Disabling the fixes will largely restore the Cisco Prime Network Registrar performance to what it was prior to the implementation of these fixes.

In our testing, with Spectre and Meltdown fixes disabled, DHCP New Lease performance improves by approximately ~20%, and renewal performance improves by approximately ~85%. DNS Non-Cached query performance improves by approximately ~24%, and Cached performance improves by ~29%.

Note	These improvements are measured from the degraded performance created by the Spectre and Meltdown fixes themselves. These improvements return the performance of Cisco Prime Network Registrar close to the performance prior to the implementation of the fixes for Spectre and Meltdown.

Using Red Hat Enterprise/CentOS Linux Tunables, you can control the performance impact of the Spectre and Meltdown vulnerability patches of the following CVEs:

• CVE-2017-5754

• CVE-2017-5715

• CVE-2017-5753

It is of paramount importance that you understand that if you decide to disable the Spectre and Meltdown fixes, you may face the very attacks that these fixes are designed to prevent. We are not recommending that you disable these fixes. We are simply informing you of the consequences of running Cisco Prime Network Registrar with them enabled or disabled.

echo 0 > /sys/kernel/debug/x86/pti_enabled
echo 0 > /sys/kernel/debug/x86/retp_enabled
echo 0 > /sys/kernel/debug/x86/ibrs_enabled

mount | grep debugfs

debugfs on /sys/kernel/debug type debugfs (rw,relatime)

cat /sys/kernel/debug/x86/pti_enabled
cat /sys/kernel/debug/x86/retp_enabled
cat /sys/kernel/debug/x86/ibrs_enabled

It is possible to persistently disable the required parameters (i.e., to be effective across a reboot). For an explanation and instructions on how to do this, refer to the vendor site, found through your previous internet search.