Cisco WAE 6.4.14 Release Notes

WAE System

Installation

The WAE installer indicates a conflict with rsync31u and ansible1.9. The WAE Planning platsvcs component has a problem with the ansible1.9 dependency. (This problem is tracked as CSCuy79752.)

This problem occurs because the WAE installer requires an older version of Ansible, which is no longer available on EPEL. If you do 'yum install ansible', version 2 is installed and the WAE installation fails. Note also:

• One aspect of the problem is that ansible1.9 and rsync31u are no longer available in EPEL.
• WAE requires ansible1.9 because an API that WAE uses changed in ansible2.0.

As a workaround, do the following:

1. Ensure that Ansible is not installed. (If necessary, uninstall it with yum uninstall ansible.)

2. Install the EPEL repository, if it is not already present.

3. Download and install ansible1.9-1.9.6-2.el6.noarch.rpm and its dependencies.

4. If necessary, install rsync31u-3.1.2-2.ius.centos6.x86_64.rpm.

5. Run the WAE installation.

Removal of wae-dlc

A wae-dlc folder is created under $CARIDEN_HOME/wae-platsvcs-server when wae-dlc is installed. If the yum remove wae-dlc command is used, the wae-dlc folder is not deleted. You must manually remove $CARIDEN_HOME/wae-platsvcs-server/wae-dlc.

Startup

• The WAE NI server and the WAE Core server cannot reside on the same device or on the same VM. Note that the Cisco WAE Server Installation Guide assumes that they are on the same device. If needed, contact your support representative for further installation details.
• If the OS is using an old CA certificate to verify the integrity of the EPEL repository, you might see this error from the OS vendor:

– One workaround is to perform an offline installation. For instructions, see the “Offline Installation” chapter in the Cisco WAE Server Installation Guide.

– Another workaround is to change https to http.

Note This is not a secure solution. For information on how to resolve OS security issues, contact your OS vendor.

1. In the /etc/yum.repos.d/epel.repo file, change the first instance of https to http.

Change https to http in the following line:

2. Execute yum to clean up makecache.

3. Rerun the installer. For instructions, see the Cisco WAE Server Installation Guide.

• The $CARIDEN_HOME directory is not automatically added to $PATH (only $CARIDEN_HOME/bin is). If not in $CARIDEN_HOME/bin, to start the WAE Design GUI from the command line, you must specify its full path.

Web Server

The embedded_web_server tool is deprecated. The recommendation is to use the wae-web-server service, which is constantly monitored to be brought up automatically.

By default, this web service starts upon installation completion. Therefore, if you stop the web server using the embedded_web_server tool (embedded_web_server -action stop), the web server does not stop. The workaround is the following:

WAE Statistics UI

The WAE Statistics page does not appear in some web browsers if you do not have the correct SSL certificates. To work around this, install the correct SSL certificates (see the “Installing an SSL Web Certificate” section in the Cisco WAE System Administration Guide) or do the following:

1. Click the WAE Statistics link. The URL format is https:// <server_IP> :8443; for example, https://192.0.2.14:8443.

2. Copy the URL of the page to another browser window.

3. In the new browser, change the URL port from 8443 to 8843; for example, https://192.0.2.14:8843.

4. Follow the browser messages to accept the connection and add it as an exception.

Web User Management

Both the System UI and the WAE Design Archive UI have local user management capabilities. If both are used to configure users, WAE uses the most recently updated information. The recommendation is to use only the System UI to manage local users.

License Check Failures on Newer Linux Distributions

Some newer Linux distributions have started using a new way (via biosdevname) of naming hardware devices, including the network interfaces. This causes some software that depends on the traditional naming (for example, eth0, eth1) to fail on license checks, including MATE.

The workaround is to append biosdevname=0 to the kernel line of the grub configuration file and reboot. (Syntax varies among distributions.)

After reboot, you should be able to use ifconfig to verify that the NICs are named eth0 (or eth1,...) instead of the biosdevname names (such as p34p1).

Java Memory

Certain tools (such as parse_configs) might require more memory to start than what is available. The symptom is an error message similar to the following:

The workaround is to set the maximum memory to a low enough value in the CARIDEN_JAVA_OPTIONS variable before calling the tool. An example setting is as follows:

NetFlow Collection

NetFlow collection is not supported on Alcatel-Lucent devices.

Coordinated Maintenance

Coordinated Maintenance 1.2.1 is not supported in this release.

WAE Live

After deleting an archive ( archive_delete), you must do one of the following to remove the deleted plan file from the Time Navigation in the Live Map:

• Restart the web server
• Navigate to a different tab, then return to the Live Map.

WAE Design

macOS Sierra 10.12 and later implements an additional security measure for applications that are not distributed through the App Store; this includes WAE Design.

By default, WAE Design is in a quarantine state as shown by the following command on a terminal:

The command returns the following output for a quarantined application:

As a workaround, remove WAE Design from quarantine by entering the following command in the directory where WAE Design is installed:

You can now run WAE Design on macOS Sierra 10.12 and later.

FlexLM License Server

You cannot run the floating license server on a setup (Linux VM or actual host) that uses bonded virtual interfaces (that is, a setup with multiple interfaces that have the same MAC address but different IP addresses within a VM). If the WAE Design client tries to check out a license from a setup that uses bonded virtual interfaces, the license checkout fails with the error “No license found.”

As a workaround, run the floating license server in a standard Linux VM or host.

WAE Collector and WAE Network Interface (NI)

• Due to vendor MIB limitations, Collector cannot represent QoS traffic on interfaces that have more than one VLAN configured. If a network contains such interfaces, their queue traffic statistics are omitted from the collection. The total traffic on these interfaces is still measured. As a result, per class-of-service demands estimated through Demand Deduction are less accurate. Estimates of traffic totals over all classes of services, however, are not affected.
• Due to lack of MIB support, SR tunnel type is not collected for Cisco IOS XR routers through SNMP.
• Collection of interface egress shaping rate for Alcatel-Lucent devices does not support LAG interfaces.

WAE NI

• The interval for continuous LSP discovery in WAE NI cannot be less than 60 seconds.
• LSP’s ActualPathHop cannot be resolved when using continuous collection. As a workaround, use interval-based collection.

Collector

• Juniper MIBs do not support P2MP LSPs.
• OSPFv3 and IPv6 IS-IS databases cannot be collected. The workaround is to use a manual snapshot.
• SNMPv3 is not an available option when configuring default credentials.
• snmp_find_interfaces

– Does not support association of a GRE tunnel with the physical interface it uses to reach the tunnel destination since the IP-Tunnel MIB lacks this information.

– Does not update LAG port status if LAGs are discovered running both parse_configs and snmp_find_interfaces. The workaround is to run only snmp_find_interfaces.

• Juniper routers: Signaled standby LSP path option is not available from the standard MPLS-TE MIB for Juniper routers. Only the active path option name is collected.
• Cisco IOS XR routers

– IGP topology collected through parse_igp and login_find_igp_db

– IS-IS link-state database with TE extensions contains incorrect interface “admin-weights” (TE metric) on Intel-based routers.

– IPv6 IS-IS link-state database does not contain IPv6 interface addresses or parallel interfaces. This information is only available when Cisco IOS XR supports IS-IS IPv6 TE extensions. The snmp_find_interfaces tool collects this information.

– snmp_find_rsvp does not set the Standby value in the <LSPPaths> table for signaled backup paths or collect named affinities configured with affinity-maps.

• BGP peers

– find_bgp does not build BGP pseudo-nodes among internal ASNs.

– find_bgp does not collect BGP peers under PE-CE VRFs.

• parse_configs

– Does not accurately detect the bandwidth of some Juniper ‘ge’ interfaces that have a capacity of 10 Gbps.

– Collects POS bundles, but has limitations due to unavailability of the port OperStatus property.

• TE Extended Admin Groups (EAGs), also known as extended affinities, are only supported from Juniper and parse_configs.
• There is no support for building port circuits for LAG members that are not within the same IGP (inter-AS circuits)
• It is not possible to distinguish between physically connected and unconnected LAG ports that are down for LAG port matching.
• snmp_find_ospf_db cannot be used when routers have a large number of links that cannot fit into a single PDU.
• find_bgpls does not support multi-area OSPF or multi-level IS-IS, non-TE-enabled interfaces, and pseudo-nodes. The workaround is to use SNMP- or login-based discovery.
• get_inventory does not collect Juniper multi-chassis router hardware inventory.
• Segment routing

– SR protected adjacency SIDs are not supported.

– Concurrent RSVP-TE and SR-TE paths are not supported on the same LSP.

Credential File Management for collector_get_plan and collector_push_plan Tools

The collector_get_plan tool obtains plan files from the wae-web-server. If collector_get_plan is executed locally on the same machine where the wae-web-server resides, the credential file (/opt/cariden/etc/collector/credentials.enc) is auto-generated every time the wae-web-server restarts. In this scenario, the credentials-file option is not required. If the collector_get_plan is executed remotely, then the user should initialize the credential file once using the set-credentials true option to create the credentials at a different collection location (not in /opt/cariden/etc/collector/credentials.enc).

The collector_push_plan tool sends the plan file to wae-ni. The user should always initialize the credential file once using the set-credentials true option to create the credentials at a different collection location (not /opt/cariden/etc/collector/credentials.enc), or it may collide with the auto-generated credential file.

Cisco Open SDN Controller (OSC)

During detailed PCEP tunnel creation or when modifying PCEP tunnels, affinity values are misinterpreted if multiple affinities are specified. This limits you to specifying one affinity for IncludeAffinity, IncludeAnyAffinity, and ExcludeAffinity, and each of these values must be a number within [0,31].

NSO Controller

• LSP affinities are deployed, while interfaces affinities require separate provisioning.
• LSPs that exist in the network by another controller cannot be updated.
• Deployment of each RSVP-TE named-path or SR-TE segment-list is limited to a single LSP.
• Cisco IOS XR: WAE client specifies the XR LSP signaled-name, while NSO service and device use tunnel-id. The workaround is to deploy all Cisco IOS XR LSPs using the tunnel-id and to make sure that existing LSPs are not redeployed.
• NEDs (NSO console)

– For Cisco IOS XR, there is no option to give the IP address of the LSP directly; you can only specify a loopback address. There is no option to give tunnel affinity values directly; you can only specify an affinity-map name.

– For Junos, there is no inter-domain keyword, which is used only when an inter-area LSP is created.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2017 Cisco Systems, Inc. All rights reserved.