Table Of Contents
Release Note for the Cisco Global Site Selector, Release 1.2(2)
Cisco-Supported Hardware and Software Compatibility
Before Upgrading to Version 1.2(2)
Expansion of the GSSM and GSS Recovery Procedures
Additional Information for Building and Modifying DNS Rules
Additional Information for Configuring DNS Sticky
Software Behavioral Differences
Changes to the Primary GSSM GUI Login and Logout Process
Changes to the Termination Method Options
Changes to the Sticky and Proximity Database Dump Process
Additions to the proximity database delete CLI Command
Additions to the show proximity database CLI Command
Changes to the GSSM Restore Warning Message
Changes to the show tech-support core-files Command
Addition of the logging facility CLI Command
Addition of the ftp-client enable CLI Command
GSS Syslog Messages and CiscoWorks RME Syslog Analyzer Compliancy
show proximity and show sticky CLI Commands in gslb Mode
DNS Server Not Ready Indicator Added to gss status Command Output
Changes to Host Naming Conventions for a GSS
Sticky and Proximity XML Schema Files
Operating Conditions for Software Version 1.2(2)
Software Version 1.2(2) Open Caveats, Resolved Caveats, and Command Changes
Open Caveats for Software Version 1.2(2)
Resolved Caveats for Software Version 1.2(2)
CLI Command Changes in Software Version 1.2(2)
Obtaining Documentation, Obtaining Support, and Security Guidelines
Release Note for the Cisco Global Site Selector, Release 1.2(2)
August 25, 2006
Note
The most current Cisco GSS documentation for released products is available on Cisco.com.
Contents
This release note applies to software version 1.2(2) for the Cisco Global Site Selector (GSS). It contains the following sections:
•
•
•
•
•
•
•
•
•
Cisco-Supported Hardware and Software Compatibility
The GSS software version 1.2(2) operates with the following Cisco hardware:
•
•
•
Cisco Catalyst 6500 Content Switching Module (CSM)
Software releases:
•
•
•
•
Software releases:
•
•
•
•
1 CSM software versions 3.2(2), 3.2(3) and 4.1(2) are not supported by the GSS when using the KAL-AP by tag keepalive method.
The GSS software version 1.2(2) network proximity and TACACS+ server features operate with the following Cisco software releases:
•
The GSS operates with Cisco IOS-based routers using the following DRP RTT probing methods: TCP ("DRP Server Agent") and ICMP ("ICMP ECHO-based RTT probing by DRP agents"). "DRP Server Agent" and "ICMP ECHO-based RTT probing by DRP agents" are the Cisco IOS feature names as shown in the Cisco Feature Navigator. The Cisco Feature Navigator is located on Cisco.com at:
http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp
•
Before Upgrading to Version 1.2(2)
You can directly upgrade to GSS software version 1.2(2) from the GSS version 1.2(1), 1.1, and 1.0 software releases.
Note
Before you upgrade your GSS software, be sure that you:
•
–
–
–
•
If you are currently running GSS software version 1.0 on your GSS 4480 and you want to have the opportunity to downgrade back to version 1.0, you must first upgrade to software version 1.1 before loading software version 1.2. Downgrading directly from software version 1.2 to version 1.0 is not supported at this time.
Expansion of the GSSM and GSS Recovery Procedures
In the Cisco Global Site Selector Administration Guide, a new section has been added to Chapter 2, Managing the GSS from the CLI, to describe the process that you can perform when you encounter problems with one of the GSS devices in your GSS network. The new "Replacing GSS Devices in Your GSS Network" section aids you in determining which GSS device exhibits the problem (primary GSSM, standby GSSM, or GSS) and the steps you can take to configure a replacement GSS device for use in your network.
You can locate the "Replacing GSS Devices in Your GSS Network" section on Cisco.com at the following URL:
Additional Information for Building and Modifying DNS Rules
This information augments the information provided in Chapter 7, Building and Modifying DNS Rules in the Cisco Global Site Selector Global Server Load Balancing Configuration Guide.
The balance clauses that you configure in a DNS rule are evaluated in order, with parameters established to determine when a clause should be skipped and the next clause is to be used. A balance clause is skipped when any one of the following conditions exits:
•
•
•
•
Additional Information for Configuring DNS Sticky
This information augments the information provided in Chapter 8, Configuring DNS Sticky in the Cisco Global Site Selector Global Server Load Balancing Configuration Guide.
•
•
–
–
–
Software Behavioral Differences
The following sections describe the software behavioral differences that apply to software version 1.2(2):
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Changes to the Primary GSSM GUI Login and Logout Process
The primary GSSM GUI now prompts you for your username and password in a new Primary GSSM GUI Login window (Figure 1) as part of the primary GSSM GUI login process. Enter your username and password in the fields provided on the primary GSSM GUI and click Login. The Primary GSSM Welcome window appears (Figure 2).
With the GSS version software 1.2(2) release, the primary GSSM performs login authentication; you no longer enter your username and password in the client browser's pop-up box to access the GUI. The primary GSSM GUI directly uses the SSL session to maintain the session and user state. Users are authenticated only once during login, similar to when you perform remote access to the GSS CLI using the Secure Shell (SSH), Telnet, or FTP protocols.
To log out of a primary GSSM GUI session, click Logout at the upper right of the window. The browser confirms that you want to log out of the primary GSSM GUI session. Click OK to confirm the logout (or Cancel). When you click OK, the primary GSSM logs you out of the session and redisplays the Primary GSSM GUI Login window (see Figure 1).
Figure 1 Primary GSSM GUI Login Window
Figure 2 Primary GSSM Welcome Window
Changes to the Termination Method Options
In the primary GSSM GUI, the Default option for the connection termination method on both the Shared Keepalive details page (Figure 3, shown for a TCP keepalive) and the VIP Answer details page (Figure 4, shown for a TCP keepalive) has been renamed to Global. The function of the Global option has not changed; this option still instructs the primary GSSM to use the keepalive connection method defined on the Configure Global KeepAlive Properties details page.
Figure 3 Creating New Shared Keepalive Details Page—TCP Keepalive
Figure 4 Answer Details Page—TCP KeepAlive VIP Answer
In addition, the Termination Method column has been added to the Shared Keepalives list page (Figure 5) to inform you of the connection termination method specified for each shared keepalive.
Figure 5 Shared Keepalives List Page
Changes to the Sticky and Proximity Database Dump Process
When you enter the sticky database dump format xml and proximity database dump format xml commands, the GSS now waits to complete dumping the sticky database entries or proximity database entries in XML format before displaying the CLI prompt. A message appears upon the successful completion of a sticky or a proximity database dump. In addition, if the XML database dump is large, the GSS displays progress messages to indicate how many entries have been dumped at that point in the process.
For example, when you enter the sticky database dump format xml command at the CLI, the following progress message appears:
gssm1.example.com#sticky database dump stest.xml format xmlStarting Sticky Database dump.As the database dump progresses, additional messages appear:
gssm1.example.com#sticky database dump stest.xml format xmlSticky Database dump is in progress...Sticky Database has dumped 12345 of 345123 entries...Upon completion of the XML database dump, a final message appears:
gssm1.example.com#sticky database dump stest.xml format xmlSticky Database dump completed. The number of dumped entries: 182346.gssm1.example.com#The GSS prevents you from overwriting an existing sticky database or proximity database dump output file. If you attempt to overwrite an existing file with the same filename, the GSS displays the following message: Sticky Database dump failed, a file with that name already exists.
Additions to the proximity database delete CLI Command
The proximity database delete command has a series of additional options to provide more control over the entries you can delete from the proximity database. You may now delete proximity database entries based on a specific criteria. The proximity database delete command, however, does not delete proximity database entries saved as part of an automatic dump to a backup file on disk. To ensure that you successfully remove all or the selected proximity database entries from both GSS memory and disk, enter the specific proximity database delete command followed by the proximity database periodic-backup now command to force an immediate backup of the empty proximity database residing in GSS memory.
The syntax for this command is:
proximity database delete {all | assigned | group {name} | inactive minutes | ip {ip_address} netmask {netmask} | no-rtt | probed}
The options and variables are:
•
•
•
•
•
•
•
For example, to remove the D-proxy IP address 192.168.8.0 and subnet mask 255.255.255.0, enter:
gss1.example.com# proximity database delete ip 192.168.8.0 netmask 255.255.255.0Additions to the show proximity database CLI Command
The show proximity database CLI command has a series of additional options to provide more control over the entries you can view in the proximity database. You may now display proximity database entries based on a specific criteria.
The syntax for this command is:
show proximity database {all | assigned | group {name} | inactive minutes | ip {ip_address} netmask {netmask} | no-rtt | probed}
The options and variables are:
•
•
•
•
•
•
•
For example, to remove the D-proxy IP address 192.168.8.0 and subnet mask 255.255.255.0, enter:
gss1.example.com# proximity database delete ip 192.168.8.0 netmask 255.255.255.0Changes to the GSSM Restore Warning Message
There has been a clarification to the warning message that appears when you enter the gssm restore command to restore your primary GSSM from a previous backup.This restore warning message now reads:
% WARNING WARNING WARNINGYou will be asked which portion(s) of the system configuration to overwrite. You may want to create a database backup before proceeding.Are you sure you wish to continue? (y/n): yChanges to the show tech-support core-files Command
The show tech-support core-files command output has been modified to display the core file size in KB, Mb, or GB, as appropriate. For example:
gss2.example.com#show tech-support core-files/core-files/keepalive/core-keepalive-Mon-Mar-28-06.34.56 43 Mb/core-files/keepalive/core-keepalive-Mon-Mar-28-07.15.48 106 Mb/core-files/proximity/core-proximity-Mon-Mar-31-06.25.44 10 Mb/core-files/proximity/core-proximity-Mon-Mar-31-06.26.13 10 MbThe verbose option has been added to the show tech-support core-files command to assist in troubleshooting by Cisco engineers in instances where the internal GSS applications generate core files. The verbose option provides a backtrace of the stack of all the core files.
Addition of the logging facility CLI Command
The GSS allows you to specify a syslog facility type to identify the behavior of the syslog daemon (syslogd) on the host. The syslog daemon uses the specified syslog facility to determine how to process messages. Each facility configures how the syslog daemon on the host handles a message. Use the new logging facility command to specify a syslog facility type.
Note
The syntax for this global configuration mode command is:
logging facility type
Enter the type option to specify the syslog facility type. The default logging facility is local5. The GSS supports the following facility types:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
For example, to change the logging facility to local7, enter:
gss2.example.com(config)#logging facility local7To restore the default logging facility back to local5, use the no form of this command. For example:
gss2.example.com(config)#no logging facility local7
The related GSS software commands include:
logging host enable
logging host ip
logging host priority
logging host subsystem
show logging
show running-config
For the procedures on how to configure logging for a GSS and view logged information, refer to the Cisco Global Site Selector Administration Guide, Chapter 8, Viewing Log Files. This chapter is located on Cisco.com at:
Addition of the ftp-client enable CLI Command
By default, the File Transfer Protocol (FTP) client is disabled for all users. A new configuration mode command has been created to allow you to enable access to the FTP client for different types of users.
The syntax for this global configuration mode command is:
ftp-client enable {all | admin}
Enter ftp-client enable to enable access to the FTP client and then follow it with all to enable access for all users, or admin to enable access for administrative users only. For example:
gss.example.com(config)#ftp-client enable allgss.example.com(config)#ftp-client enable adminIssue the no ftp-client enable all or no ftp-client enable admin CLI command to remove a specific FTP client configuration and return to the default disabled state.
The show running-config and show startup-config CLI commands have been updated to provide status on the FTP client enable state, for example:
gss.example.com#show running-config...ftp-client enable all...gss.example.com#show startup-config...ftp-client enable all...The show ftp CLI command has also been updated to provide status on the FTP client enable state, for example:
gss.example.com#show ftp...ftp-client is enabled for all users...GSS Syslog Messages and CiscoWorks RME Syslog Analyzer Compliancy
The format of the host syslog messages generated by a GSS is now CiscoWorks RME Syslog Analyzer compliant. The CiscoWorks RME Syslog Analyzer reports syslog messages logged by GSS devices. The Syslog Analyzer uses embedded Cisco IOS technology to provide detailed device information. Reports are based on user-defined filters that highlight specific errors or severity conditions and help identify when specific events occurred, such as a link-down or a device reboot.
Note
The following is an example of the host syslog message format generated by a GSS. The fields are described in Table 1.
<IP or DNS name of Device> <BLANK> <:> <Time Stamp> <BLANK><:> %FACILITY-SEVERITY-MNEMONIC <:> Message-text
The related GSS software commands include:
logging host enable
logging host ip
logging host priority
logging host subsystem
logging facility
show proximity and show sticky CLI Commands in gslb Mode
You may now access the show proximity and show sticky CLI commands from the global server load-balancing configuration mode. The show proximity and show sticky commands include:
•
•
•
•
•
•
•
•
For example:
gssm1.example.com(config-gslb)#show ?proximity Display Proximity subsystem informationrunning-config Show Running configurationsticky Display Sticky Database informationgssm1.example.com(config-gslb)#show proximity ?group-name Display configuration summary of one proximity groupgroup-summary Display configuration summary of all proximity groups<cr>gssm1.example.com(config-gslb)#show sticky ?database Display entries in the Sticky Database.global Display status of Global Stickygroup-name Display configuration summary of one sticky groupgroup-summary Display configuration summary of all sticky groupsmesh Display status of the Sticky Mesh.<cr>gssm1.example.com(config-gslb)#show stickyDNS Server Not Ready Indicator Added to gss status Command Output
To inform you that the DNS Server is not ready to serve DNS requests, the gss status command output displays a "Not Ready to Serve Requests" indicator. The indicator disappears once the DNS Selector is ready to serve DNS requests.
For example:
gssm1.example.com# gss statusCisco GSS - 1.2(2) GSS [Thu Mar 31 21:09:09 UTC 2005]Registered to primary GSSM: 10.86.209.167Normal Operation [runmode = 5]START SERVERMar25 BoomerangMar25 Config Agent (crdirector)Mar25 Config Server (crm)Mar25 DNS Server [ Not Ready to Serve Requests ]Mar25 DatabaseMar25 GUI Server (tomcat)Mar25 Keepalive EngineMar25 Node ManagerMar25 ProximityMar25 StickyMar25 Web Server (apache)When the DNS Server is ready to serve DNS requests, it generates the following subsystem log message and saves it in the system.log file:
Mar 25 10:45:26 gssm1.example.com DNS-5-SELREADYINFO[2073] Selector ready to start serving DNS requestsChanges to Host Naming Conventions for a GSS
When you specify a hostname for a GSS (primary GSSM, standby GSSM, or GSS device) that is operating in a lab network environment, the top-level domain of the hostname cannot begin with a numerical value. For example, you cannot name a primary GSSM as gssm.1lab. If you attempt to create or change a hostname for a top-level domain to a name that begins with a number, the following messages appears:
Top level domains of hostnames cannot begin with a numberWhen you upgrade to software version 1.2(2), if one or more of your GSS devices has a hostname with a top-level domain beginning with a number, each GSS device will log the following ERROR level (3) log message in the gss.log file:
Bad hostname: top level domain should not begin with numberSticky and Proximity XML Schema Files
The GSS includes two XML schema files that you can use to describe and validate the sticky XML and proximity XML output files. The purpose of a schema is to define a class of XML documents. The sticky and proximity schemas consist of a series of elements, subelements, and attributes that appear in the XML output files to determine the appearance of the content in the XML file.
Each schema file, stickySchema.xsd and proximitySchema.xsd, resides in the /home directory upon boot up of a GSS device. The /home directory is the same directory where each XML output file resides.
The following document identifies the contents of the sticky XML schema, stickySchema.xsd:
<xsd:schema xmlns="http://www.cisco.com/gss/sticky"xmlns:xsd="http://www.w3.org/2001/XMLSchema"targetNamespace="http://www.cisco.com/gss/sticky"elementFormDefault="qualified"attributeFormDefault="unqualified"><xsd:annotation><xsd:documentation xml:lang="en">Cisco GSS Sticky Database</xsd:documentation></xsd:annotation><xsd:element name="Sticky_Database" type="StickyDatabaseType"/><xsd:element name="Header" type="HeaderType"/><xsd:element name="Source_Entries" type="SourceEntriesType"/><xsd:element name="Source_Entry" type="SourceEntryType"/><xsd:element name="Group_Entries" type="GroupEntriesType"/><xsd:element name="Group_Entry" type="GroupEntryType"/><xsd:complexType name="StickyDatabaseType"><xsd:sequence><xsd:element ref="Header" minOccurs="1" maxOccurs="1"/><xsd:element ref="Source_Entries" minOccurs="0" maxOccurs="1"/><xsd:element name="Source_Entry_Count" type="xsd:integer"minOccurs="0" maxOccurs="1"/><xsd:element ref="Group_Entries" minOccurs="0" maxOccurs="1"/><xsd:element name="Group_Entry_Count" type="xsd:integer"minOccurs="0" maxOccurs="1"/></xsd:sequence></xsd:complexType><xsd:complexType name="HeaderType"><xsd:sequence><xsd:element name="Version" type="xsd:integer"minOccurs="1" maxOccurs="1"/><xsd:element name="Time_Stamp" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="Entry_Count" type="xsd:integer"minOccurs="1" maxOccurs="1"/><xsd:element name="Mask" type="xsd:string"minOccurs="1" maxOccurs="1"/></xsd:sequence></xsd:complexType><xsd:complexType name="SourceEntriesType"><xsd:sequence minOccurs="0" maxOccurs="unbounded"><xsd:element ref="Source_Entry" minOccurs="0"/></xsd:sequence></xsd:complexType><xsd:complexType name="GroupEntriesType"><xsd:sequence minOccurs="0" maxOccurs="unbounded"><xsd:element ref="Group_Entry" minOccurs="0"/></xsd:sequence></xsd:complexType><xsd:complexType name="SourceEntryType"><xsd:sequence><xsd:element name="IP" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="D" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="R" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="A" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="H" type="xsd:integer"minOccurs="1" maxOccurs="1"/><xsd:element name="T" type="xsd:integer"minOccurs="1" maxOccurs="1"/></xsd:sequence></xsd:complexType><xsd:complexType name="GroupEntryType"><xsd:sequence><xsd:choice minOccurs="1" maxOccurs="1"><xsd:element name="N" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="G" type="xsd:integer"minOccurs="1" maxOccurs="1"/></xsd:choice><xsd:element name="D" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="R" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="A" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="H" type="xsd:integer"minOccurs="1" maxOccurs="1"/><xsd:element name="T" type="xsd:integer"minOccurs="1" maxOccurs="1"/></xsd:sequence></xsd:complexType></xsd:schema>The following document identifies the contents of the proximity XML schema, proximitySchema.xsd:
<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"><xsd:annotation><xsd:documentation xml:lang="en">Cisco GSS Proximity Database</xsd:documentation></xsd:annotation><xsd:element name="ProximityDatabase" type="ProximityDatabaseType"/><xsd:element name="Header" type="HeaderType"/><xsd:element name="Entry" type="EntryType"/><xsd:element name="ProbeTarget" type="ProbeTargetType"/><xsd:element name="Zone" type="ZoneType"/><xsd:complexType name="ProximityDatabaseType"><xsd:sequence><xsd:element ref="Header" minOccurs="1" maxOccurs="1"/><xsd:element ref="Entry" minOccurs="0" maxOccurs="unbounded"/></xsd:sequence></xsd:complexType><xsd:complexType name="HeaderType"><xsd:sequence><xsd:element name="Version" type="xsd:integer"minOccurs="1" maxOccurs="1"/><xsd:element name="Time_Stamp" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="EntryCount" type="xsd:integer"minOccurs="1" maxOccurs="1"/></xsd:sequence></xsd:complexType><xsd:complexType name="EntryType"><xsd:sequence><xsd:element name="EntryID" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="ModificationTimeStamp" type="xsd:integer"minOccurs="1" maxOccurs="1"/><xsd:element name="Static" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="DirectProbingInProgress" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="HitTimeStamp" type="xsd:integer"minOccurs="1" maxOccurs="1"/><xsd:element name="HitCount" type="xsd:integer"minOccurs="1" maxOccurs="1"/><xsd:element ref="ProbeTarget" minOccurs="1" maxOccurs="1"/><xsd:element ref="Zone" minOccurs="32" maxOccurs="32"/></xsd:sequence></xsd:complexType><xsd:complexType name="ProbeTargetType"><xsd:sequence><xsd:element name="IP" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="Method" type="xsd:string"minOccurs="1" maxOccurs="1"/><xsd:element name="Type" type="xsd:string"minOccurs="1" maxOccurs="1"/></xsd:sequence></xsd:complexType><xsd:complexType name="ZoneType"><xsd:sequence><xsd:element name="ID" type="xsd:integer"minOccurs="1" maxOccurs="1"/><xsd:element name="RTT" type="xsd:integer"minOccurs="1" maxOccurs="1"/><xsd:element name="RefreshTime" type="xsd:integer"minOccurs="1" maxOccurs="1"/></xsd:sequence></xsd:complexType><xsd:simpleType name="StaticType"><xsd:restriction base="xsd:string"><xsd:enumeration value="true"/><xsd:enumeration value="false"/></xsd:restriction></xsd:simpleType><xsd:simpleType name="MethodType"><xsd:restriction base="xsd:string"><xsd:enumeration value="TCP"/><xsd:enumeration value="ICMP"/><xsd:enumeration value="NotUsed"/></xsd:restriction></xsd:simpleType><xsd:simpleType name="TypeOfType"><xsd:restriction base="xsd:string"><xsd:enumeration value="static"/><xsd:enumeration value="non-static"/></xsd:restriction></xsd:simpleType><xsd:simpleType name="ZoneIdType"><xsd:restriction base="xsd:integer"><xsd:minInclusive value="1"/><xsd:maxInclusive value="32"/></xsd:restriction></xsd:simpleType></xsd:schema>Operating Conditions for Software Version 1.2(2)
The following operating conditions apply to software version 1.2(2):
•
•
If DRP probe requests fail between the GSS and a Cisco router running IOS release 12.1, even when the GSS indicates that the router is ONLINE, verify the DRP authentication configurations on both the Cisco router and the GSS.
–
–
Modify the DRP authentication configuration on either the Cisco router running IOS release 12.1 or the primary GSSM GUI and make them consistent to avoid a DRP authentication mismatch.
•
The workaround is to enter the tacacs-server host command on the GSS, and then specify the same encryption key on the TACACS+ server before you enter the aaa authorization commands CLI command on the GSS. If the GSS fails authorization on all CLI commands and you are unable to change the encryption key on the TACACS+ server, power cycle the GSS. Because the CLI commands entered prior to the power cycle were not saved in the GSS startup-configuration file, you can regain access to the GSS CLI and redo the TACACS+ configuration.
•
Depending on the number of TCP keepalives you require to send on port 23 to servers running Windows Server 2003, specify the Number of Retries value as follows:
–
–
•
•
•
•
%access-list list1 is already assigned to interface eth1.To resolve this issue, generate an identical access list for the second Ethernet interface.
•
There is no workaround for this behavior; the GSS always requires a functioning nameserver. To enable the GSS to perform DNS resolution, always configure more than one nameserver. For example:
gss.example.com(config)#ip name-server 192.168.1.1gss.example.com(config)#ip name-server 192.168.2.2gss.example.com(config)#ip name-server 192.168.3.3This behavior may also occur if you configure access lists for the GSS. In this case, the workaround is to create access lists that allow the DNS responses from a nameserver. For example:
gss.example.com(config)#access-list acl1 permit udp any eq 53Another solution is to limit incoming DNS response packets only from your configured nameservers (more secure). For example:
gss.example.com(config)#access-list acl1 permit udp 192.168.1.1255.255.255.255 eq 53gss.example.com(config)#access-list acl2 permit udp 192.168.1.2255.255.255.255 eq 53gss.example.com(config)#access-list acl3 permit udp 192.168.1.3255.255.255.255 eq 53•
To resolve this behavior, use the KAL-AP by VIP format when you need the GSS to send a detailed query on load for hundreds of VIPs configured to a single primary or optional secondary (backup) IP address. Another solution is to use the KAL-AP by Tag format, but to limit the length of Tag Names to ensure that the packets do not exceed 1.4K.
•
gss.example.com(config-eth1)#show interface eth1Interface eth1ip address 192.168.1.2 255.0.0.0duplex fullspeed 1000Interface StateLink is upnegotiated, 1000 mbps, full duplexSupported modes: 10-half, 10-full, 100-half, 100-full, 1000-fullAdvertised modes: 1000-full•
•
Software Version 1.2(2) Open Caveats, Resolved Caveats, and Command Changes
The following sections contain the open caveats, resolved caveats, and command changes in GSS software version 1.2(2):
•
•
•
Open Caveats for Software Version 1.2(2)
This section lists the open caveats for Cisco Global Site Selector Version 1.2(2).
•
The following log is a symptom of this behavior:
CRD-4-EXCEPTION[3794] java.rmi.UnmarshalException: err or unmarshalling return; nested exception is: %0A%09java.io.InvalidClassExceptio n: com.sightpath.merlot.server.SslClientSocketFactory; Local class not compatible: stream classdesc serialVersionUID=1590222007190899010 local class serialVersi onUID=1656318867001291063Workaround: Upgrade all GSS devices running an older version of GSS software to the latest GSS software version 1.2(2.0.3).
Note
•
The following logs are symptoms of a misconfiguration in either the keepalive engine or DNS server:
KAL-4-KALSTATSNOGID[916] Could not find KAL-GID [208]KAL-4-KALGIDNOTFOUND[20077] kalDeleteVip: No KAL-GID found, removing based on GID [88]: successCRD-4-ANSWERNOTEXT[912] answer id 214 doesn't exist in selector but in kaleThe presence of a core file in the /core-files/keepalive and /core-files/dnsserver is evidence of this problem.
Workaround: Ensure the standby GSSM and all GSS devices have network connectivity with the primary GSSM and perform the following procedure:
a.
b.
gss1.yourdomain.com> enablegss1.yourdomain.com#c.
gss1.yourdomain.com# gss stopd.
gss1.yourdomain.com# cd /gss1.yourdomain.com# del node.stategss1.yourdomain.com# cd /homee.
gss1.yourdomain.com# gss startf.
•
Workaround: To use a TACACS+ server for user authentication, disable the use of SSH key pairs on the GSS. Use the ssh keys CLI command to enable and disable SSH private and public key pairs. Refer to the Cisco Global Site Selector Getting Started Guide for details about configuring the GSS for remote access over an SSH session that uses private and public key pairs for authentication.
•
Workaround: Reduce the number of concurrent sessions running on the same GSS to less than seven by logging out of one or more CLI sessions.
•
–
Guest
