You may need to reconfigure the network because of the need to renumber certain network segments or to make the configuration change effective quickly. Typically, this has been done by reducing the lease times for clients in advance of the change, then applying the change, and restoring the lease times to their original values. In other words, you need to compress the renewal times into a relatively narrow window (maintenance window), and then expand them back to even out the load on the server. These steps are manual and error prone. Cisco Prime Network Registrar 10.1 helps to automate this process and to reduce the renewal load on the DHCP server before, during, and after the maintenance window. For more information, see the “Elastic Lease Times” section in Cisco Prime Network Registrar 10.1 DHCP User Guide.

Cisco Prime Network Registrar 10.1 supports Rate Limiting, which helps the DNS server from being overwhelmed by a small number of clients. It also protects against upstream query attacks against Authoritative DNS servers. The rate limiting feature helps to mitigate some of the DDoS attacks and prevents the server from being overwhelmed by a small number of clients. This feature allows you to limit the malevolent traffic. For more information, see the “Managing Caching Rate Limiting” section in Cisco Prime Network Registrar 10.1 Authoritative and Caching DNS User Guide.

Whenever Authoritative DNS servers face an outage or are offline for other reasons, this could cause issues with being able to reach Internet services that are likely not impacted. Cisco Prime Network Registrar 10.1 includes support for smart caching, which allows the Caching DNS server to continue to serve the expired data (last known answer) when it cannot reach the authoritative name servers. The Caching DNS server will continue to contact the authoritative name servers and when the name servers are once again functional, the Caching DNS server will update its expired data. For more information, see the “Enabling Smart Caching” section in Cisco Prime Network Registrar 10.1 Authoritative and Caching DNS User Guide.

Cisco Prime Network Registrar 10.1 supports packet logging for Caching DNS server to help analyze and debug the Caching DNS server activity. Packet logging settings determine the type of packet logging (summary or detail), the type of packets logged, and to which log file the messages are logged. For more information, see the "Enabling Packet Logging" section in Cisco Prime Network Registrar 10.1 Authoritative and Caching DNS User Guide.

Cisco Prime Network Registrar supports randomizing upstream queries, but there are some name servers that do not maintain the randomized case. Therefore, if you enable case randomization, you may block out valid name servers. The randomize-query-case-exclusion attribute in Cisco Prime Network Registrar 10.1 allows you to create an exclusion list, so that you can continue to use case randomization, but exclude selected name servers but still respond with a valid answer. For more information, see the "Specifying Resolver Settings" section in Cisco Prime Network Registrar 10.1 Authoritative and Caching DNS User Guide.

Cisco Prime Network Registrar 10.1 supports blocking the recursive queries. This helps the server to not spend resources trying to process these queries. The Drop Recursive Queries (drop-recursive-queries) attribute controls whether the DNS server accepts or drops the queries, which have RD flag on. When this attribute is enabled, recursive queries will be dropped by the server. For more information, see the “Blocking Recursive Queries from Authoritative Server” section in Cisco Prime Network Registrar 10.1 Authoritative and Caching DNS User Guide.

Cisco Prime Network Registrar 10.1 supports Certification Authority Authorization (CAA) Resource Record type. For more information, see the “DNS Certification Authority Authorization (CAA) Resource Record” section in Cisco Prime Network Registrar 10.1 Authoritative and Caching DNS User Guide.

Cisco Prime Network Registrar 10.1 supports Uniform Resource Identifier (URI) Resource Record type. For more information, see the “Uniform Resource Identifier (URI) Resource Records” section in Cisco Prime Network Registrar 10.1 Authoritative and Caching DNS User Guide

The following commands are added in the CLI:

• cdns-rate-limit—Controls and configures DNS rate limiting in the DNS Caching server.

• dhcp-maintenance-window—Configures a DHCP maintenance window.

New attributes are added to, or definitions modified for, the following commands:

• expert—Expert mode commands

  • Deleted the following command:

    ccm sync-to-dhcp [FailoverPair]

  • Added the following commands:

    cdns execute flush-ns-cache ip-address | all—Drops information about all or a specific name server.

    cdns execute dump-ns-cache filename—Dumps the contents of the remote-ns-cache to the specified file.

    cdns execute flush-negative—Drops information about non-existing or empty domains.

• cdns—Configures and controls the DNS Caching server.

  • Updated the getStats command as follows:

    cdns getStats [ <server | top-names | rate-limit | all> [total | sample] ]

  • Added the rate-limiting=11 flag to the activity-summary-settings attribute.

  • Added the following attributes:

    packet-log-settings, packet-logging, packet-logging-file, randomize-query-case, randomize-query-case-exclusion, smart-cache, smart-cache-expiration, and smart-cache-expiration-reset.

  • Updated the description of the remote-ns-host-ttl attribute.

• ccm—Configures and controls the CCM server.

  • Added the scp-request-detail=11 and scp-response-detail=12 flags to the log-settings attribute.

  • Added the scp-request-detail and scp-response-detail attributes.

• dhcp—Configures and controls the DHCP server.

  • Added the following command:

    dhcp getRenewalData [max-buckets]

  • Added the following attributes:

    distribute-renewals, distribute-renewals-bucket-interval, and distribute-renewals-max-renewal-time.

• dns—Configures and controls the DNS server.

  • Added the drop-recursive-queries attribute.

  • Updated the default value of the edns-max-payload attribute to 1232.

• failover-pair—Configures a DHCP failover relationship.

  Added the rebind-limit attribute.

• lease—Manages DHCP lease objects.

  • Added the renewal-tracked=25 flag to the client-flags attribute.

  • Added the lease-rebinding-time attribute.

• lease6—Manages DHCP lease6 objects.

  Added the renewal-tracked=11 flag to the client-flags attribute.

• link—Configures IPv6 network links for use in DHCPv6.

  Added the maintenance attribute.

• prefix—Configures IPv6 network prefixes for use in DHCPv6.

  Added the maintenance attribute.

• resource—Configures resources limits and allows for viewing and resetting resources.

  • Updated the default value of the rr-count-critical-level attribute to 25000000.

  • Updated the default value of the rr-count-warning-level attribute to 20000000.

  • Updated the default value of the zone-count-critical-level attribute to 10000.

  • Updated the default value of the zone-count-warning-level attribute to 8000.

• scope—Specifies the scope's properties.

  Added the maintenance attribute.

• task—Configures a scheduled task.

  Added the sync-mode attribute.

The following table lists the key issues resolved in the Cisco Prime Network Registrar 10.1 release.

For the complete list of bugs for this release, see the cpnr_10_1_buglist.pdf file available at the product download site. See this list especially for information about fixes to customer-reported issues.

The following table lists the key enhancement features added in the Cisco Prime Network Registrar 10.1 release.

For the complete list of enhancement features added in this release, see the cpnr_10_1_enhancements.pdf file available at the product download site.

The following table lists the open bugs in the Cisco Prime Network Registrar 10.1 release.

Starting from Cisco Prime Network Registrar 10.1, to install Cisco Prime Network Registrar on Red Hat Enterprise Linux or CentOS, the following x86_64 (64-bit) packages must be installed (over and above the Java Run-Time):

The installer will report any packages that may be missing before beginning the installation process.

IP fragmentation is a problem on the Internet today, especially when it comes to large DNS messages. Even if fragmentation works, it might not be secure enough for DNS. These issues can be fixed by a) setting the EDNS buffer size lower to limit the risk of IP fragmentation and b) allowing DNS to switch from UDP to TCP when a DNS response is too big to fit in this limited buffer size. The default EDNS buffer size for both the Caching and Authoritative DNS servers is 4096 bytes, but may be lowered to a smaller value (that is, 1232 bytes) to prevent IP fragmentation.

Use the following commands to set the EDNS buffer size:

nrcmd> session set visibility=3
nrcmd> dns set edns-max-payload=1232
nrcmd> dns reload

nrcmd> session set visibility=3
nrcmd> cdns set edns-buffer-size=1232
nrcmd> cdns set max-udp-size=1232
nrcmd> cdns reload

When using the local.superusers file, all users in the file must now be prefixed with "local$". For more information, see the "Managing Administrators" section in Cisco Prime Network Registrar 10.1 Administration Guide.

When the shadow backup utility creates the backup directory, it will now protect it, so that only the owner has access. However, this is only done if the directory is created - not if it already exists. If you are upgrading, you may want to review the protection and adjust it accordingly.

For example:

• To remove other (world) access, use the following command:

  chmod o-rwx /var/nwreg2/local/data.bak

• To remove group access, use the following command:

  chmod g-rwx /var/nwreg2/local/data.bak

In Cisco Prime Network Registrar 10.1, the SCP client provides additional information about the connection when available and can be:

• The source address and port of the incoming HTTP/HTTPS connections (for web UI and REST sessions).

• The source address, port, and user information for the incoming CLI, tools, or SDK sessions. The addresses and ports for the initiating user's SSH connection may also be provided, if available (this is based on the user's SSH_CONNECTION environment variable).

• Other useful indications, such as:

  • “Regional-to-local management” or “Local-to-regional management” for CCM connections between the local and regional clusters.

  • “Local-to-local management” for failover or HA sync, or other CCM-to-CCM connections between the local clusters.

  • Other identifiers, enclosed in < and >, for server related connections that identify the server (and sometimes additional details).

Note	As this information is supplied to CCM by the client, it may be subject to spoofing and should be treated as informational, but not authoritative.

For more information, see the "Active User Sessions" and "Logs for Session Events" sections in Cisco Prime Network Registrar 10.1 Administration Guide.