Table Of Contents
Release Notes for Cisco ACNS Software, Release 4.2.11
Open Caveats - ACNS Software, Release 4.2.11
Resolved Caveats - ACNS Software, Release 4.2.11
SmartFilter and the No-Auth Rule Interaction
Obtaining Technical Assistance
Obtaining Additional Publications and Information
Release Notes for Cisco ACNS Software, Release 4.2.11
July 7, 2003
Note
The most current Cisco documentation for released products is available at Cisco.com at http://www.cisco.com. The online documents may contain updates and modifications made after the hardcopy documents were printed.
Documentation Survey
Is Cisco documentation helpful? Click here to give us your feedback.
Contents
These release notes contain information about ACNS software, Release 4.2.11. These release notes describe the following topics:
•
•
•
Introduction
These release notes describe new features, supported hardware, and open and resolved caveats regarding ACNS software, Release 4.2.11.
New and Changed Information
This section describes existing features that have changed and new features in ACNS software, Release 4.2.11.
The Content Engine security feature is new.
Content Engine Security
In releases prior to ACNS software, Release 4.2.11, HTTP traffic is allowed to all destination ports. As a result, it is not possible to deny access to any specific port. ACNS software, Release 4.2.11 allows users to configure specific ports for which HTTP requests must be allowed or denied. To prevent any unauthorized access to any HTTP destination port when a request from a web client is going through a Content Engine, use the following global configuration command.
http destination-port {allow {all | ports | port_range} | {deny {all | ports | port_range}
You can choose to allow or deny access either to an individual port or to a series of ports by specifying the starting and ending port number in a range of ports. Currently, a maximum of eight port ranges can be specified using this command.
By default, the http destination-port command denies access to ports in the range 1 to 79 and 88 to 1024. Ports that fall within this range must be explicitly allowed access using the http destination-port allow 1-79 88-1024 command.
An example of the command to block the outgoing HTTP traffic to TCP port 25 while a proxy request is being handled and also to a set of ports ranging from port number 80 to port number 90 follows.
ContentEngine(config)# http destination-port deny 25 80-90ContentEngine(config)#
Note
You can also use the no version of the command, no http destination-port {allow {all | ports | port_range} | {deny {all | ports | port_range} to deny or allow access to specified ports. The default http destination-port command sequence is as follows:
http destination-port deny 1-79 88-1024
no http destination-port allow 1-79 88-1024
For example, when these commands are configured on the Content Engine and a request made to access port 23 at domain.com is redirected to the Content Engine, the connection to port 23 is denied. This configuration is valid both in transparent caching mode and proxy-style mode.
Additional Hardware Supported
ACNS software, Release 4.2.11 supports the Content Engine Network Module for the 2600, 3600, and 3700 series branch office routers. The following table lists the supported branch office router part numbers and descriptions.
Caveats
This section lists and describes caveats that are still open in ACNS software, Release 4.2.11, and caveats that were resolved in this release. Caveats describe unexpected behavior in ACNS software, Release 4.2.11. Severity 1 caveats are the most serious; severity 2 caveats are less serious. Severity 3 caveats are moderate caveats.
Open Caveats - ACNS Software, Release 4.2.11
•
Symptom: The contents of a file whose name exceeds 215 characters cannot be imported.
Condition: This occurs on a Content Distribution Manager 4630 or 4650 running ACNS software, Release 4.2.
Workaround: Rename filenames so that they are shorter than 215 characters.
•
Symptom: WCCP bypass does not function properly when bypassing packets of large size from the client. Therefore, the client never receives an acknowledgment from the server for the data sent.
Condition: This problem occurs when the Content Engine bypasses the connection and the server advertises a maximum segment size (MSS) of 1460 bytes.
Workaround: If the client's path is configured to discover the maximum transmission unit (MTU), users can configure a lower value of MTU on the router interface connected to the Content Engine. Thus if a client sent a large packet, the router would drop it and would send an Internet Control Message Protocol (ICMP) message with the reduced MTU value. Clients would then adjust to the lower value.
•
Symptom: A banner message cannot be set in Content Engines running ACNS software, Release 4.x.
Workaround: There is no known workaround.
•
Symptom: A core dump is seen under /local1/core_dir for Real-Time Streaming Protocol (RTSP) and the video server.
Condition: This core dump is generated by the video server when the E-CDN software is enabled in a CE-507.
Workaround: There is no known workaround.
•
Symptom: The CE-5xxAV runs 9 hours ahead of Japan Standard Time (JST) in the playlist review when the time zone is set to JST (Asia/Tokyo, GMT + 9 hours). In other words, the time is an additional 9 hours ahead of GMT.
Condition: This symptom appears when you change time zones for the Content Engine.
Workaround: There is no known workaround.
•
Symptom: Users receive a DNS failure message when the Cache application is unable to resolve the host names presented in the URL.
Condition: DNS failure occurs when users attempt to access a website. However, this symptom is transient and rare.
Workaround: Use the reload function of the browser, although the problem vanishes on its own after a short while.
•
Symptom: If the server responds with a "100 Continue" message for a POST request from the user, the Content Engine stops parsing all requests on the connection, and subsequent requests are not handled properly.
Condition: This symptom occurs in ACNS software, Release 4.2.5 or earlier.
Workaround: To partially address the problem with proxy connection, users can upgrade to ACNS software, Release 4.2.7 and later. Known servers respond with the "100 Continue" message to the POST request method only. This results in slightly higher latency because of a break in the persistent connection.
•
Symptom: iMac systems running OS X and Windows Media Player 7.1 cannot stream E-CDN video-on-demand (VOD) content from ACNS software, Release 4.2.5.
Condition: This symptom affects iMac systems only. Windows systems work correctly.
Workaround: There is no known workaround.
•
Symptom: Users cannot play live streaming content from a Microsoft Windows Media Server that tries to obtain a stream from a Content Engine broadcast station alias.
Condition: This problem occurs when a Windows Media Server is configured to obtain a WMT live stream from the Content Engine. The user's media player receives a "corrupted data" error or an "invalid state" error. This problem does not occur if the stream that has been obtained from the Content Engine is not a live stream. However, playing a stream from the Windows Media Server fails. The Windows Media Server is failing to retrieve the stream from the Content Engine, which in turn is obtaining the stream from the origin server.
Workaround: There is no known workaround. If possible, users should use a Content Engine to obtain the stream from a Windows Media Server.
•
Symptom: Web servers that interoperate with Content Engines in reverse proxy caching mode seem to fail. The Content Engine's syslog.txt and error log files display this message:
HTTP Proxy may be down! Keepalives haltedCondition: This problem occurs when WCCP support is enabled on Content Engines. The WCCP keepalive messages are not being sent to the Content Engine by the WCCP-enabled router at the prescribed interval. Therefore, the Content Engine assumes that the connection is down because it does not receive a response from the WCCP-enabled router.
Workaround: Reboot the Content Engine.
•
Symptom: Clients rebuffer streaming media content repeatedly when Content Engines are connected in a chained manner. This typically occurs twice a week.
Condition: Each Content Engine is configured with a broadcasting alias to deliver an incoming stream from the upstream Content Engines using multicasting. The root Content Engine at the top of the chain obtains streaming content from the Windows Media Server using the broadcasting alias. Windows Media Technologies clients that are connected to the downstream Content Engines rebuffer the live stream repeatedly and begin to fail.
Workaround: Restart the Content Engine at the top of the chain.
•
Symptom: Requests for content intercepted and redirected by a WCCP-enabled router to a CE-507 causes the Content Engine to pause indefinitely.
Condition: This occurs on a Content Engine running ACNS software, Release 4.2.x with HTTP persistent connection configuration options set and when the content distributed from the origin server to the Content Engine exceeds the values specified in the Content-length header of a response.
Workaround: Disable persistent connections on the Content Engine using the no http persistent-connections all global configuration command.
•
Symptom: When Windows NT LAN Manager (NTLM) authentication is configured on a Content Engine, the Content Engine fails to query each of the configured name servers iteratively if the primary name server fails.
Condition: The Content Engine sends the fully qualified domain name (FQDN) only to the first name server in the list of name servers specified for name and address resolution (using the ip name-server {ip-addresses | serial-lookup} global configuration command). The Content Engine sends only the host name and not the FQDN to the remaining configured name servers. As a result, if the first name server fails, the name does not get resolved.
Workaround: Disable NTLM authentication using the no ntlm server enable global configuration command.
•
Symptom: When you perform an upgrade from ACNS software, Release 4.x to ACNS software, Release 5.x and use the acns5_cdm_ip.meta file to automatically configure the Content Engine to use the ACNS software 5.x Content Distribution Manager and enable the Centralized Management System (CMS) at the end of the upgrade, the entire process is not completed as desired. At the end of the upgrade, the Content Engine is not configured to use the ACNS software 5.x Content Distribution Manager and the CMS is not enabled.
Condition: This problem occurs when the acns5_cdm_ip.meta file is imported through the MANUAL_UPGRADE channel on the Content Engine during the upgrade from ACNS software, Release 4.x to ACNS software, Release 5.x. When the file is imported through the MANUAL_UPGRADE channel, the filename changes. However, the upgrade process still searches for the original filename instead of the filename of the imported acns5_cm_ip.meta file.
Workaround: Place the acns5_cdm_ip.meta file in the /local/local1 directory on the Content Engine.
•
Symptom: When SmartFilter software is configured for URL filtering on Content Engines, it is possible to bypass the SmartFilter software policy by making a request for a partial download of the blocked category of sites.
Condition: This problem occurs when the Content Engine serves as a proxy and a partial download is performed of the category for which you have chosen to deny access. When the partial download option is used, the SmartFilter software policy is not verified and access is therefore allowed.
Workaround: There is no known workaround.
•
Symptom: A restart of the Content Engine causes certain error messages to be displayed in the syslog. However, the Content Engine continues to function normally. An example of the error message is:
Jun 20 15:00:02 CNNYFLUAR01 Nodemgr: Start service 'mingetty' using: '/sbin/mingetty --noclear ttyS0 vt100' with pid: 14281Workaround: There is no known workaround.
•
Symptom: Newly constructed websites which are still under construction and which have broken hyperlinks fail to download. The following error message appears on any web browser:
The page cannot be displayedCondition: This problem occurs when a CE-590 running ACNS software, Release 4.2.9 is used as for proxy-style or reverse proxy style caching.
Workaround: There is no known workaround.
•
Symptom: Establishing a connection to the Content Distribution Manager using FTP from the CLI is very slow. It takes about ten minutes before the CLI prompts you for the username and password.
Condition: This problem occurs when you attempt to connect to a CDM-4630 running ACNS software, Release 4.2.9.
Workaround: There is no known workaround.
•
Symptom: The clear cache real-proxy EXEC command does not clear the RealProxy cache content.
Condition: This problem occurs when RealProxy is enabled on a Content Engine. When you clear the RealProxy cache content, configure the RealPlayer proxy settings to enable the Content Engine as the RealProxy, and request a media file, the RealProxy statistics are incorrectly displayed. This situation occurs on a Content Engine running ACNS software, Release 4.2.11.
Workaround: There is no known workaround.
•
Symptom: The default start and stop times are those of the user's system device and not of the TV-out device. This is observed when the TV-out device is in a different time zone with a different day, month, or year.
Condition: This problem occurs in E-CDN software, Release 2.1 or later (including ACNS software, Release 4.x).
Workaround: There is no known workaround.
Resolved Caveats - ACNS Software, Release 4.2.11
•
Clearing the cache on a Content Engine running ACNS 4.2.1 software that is actively caching information might result in the following message:
cache-2# clear cache httpbin_err_mesg: Error 32: Verifier not responding.cache-2#The Cache application also stops functioning at this point. However, the WCCP process still shows the Content Engine in the cache farm. When this occurs, the connections might have been redirected and not served from the cache.
•
Request for content from certain websites fails and causes the Content Engine to pause indefinitely. This occurs on a CE-560 running ACNS software, Release 4.2.3.
•
Importing media files from a Domino web server on the Internet, using the Media Importer window in the Content Distribution Manager GUI, fails. However, it is possible to successfully import media files from a Microsoft Internet Information Services (IIS) server. This occurs on a Content Distribution Manager running ACNS software, Release 4.2.1.
•
When the Content Engine is configured as an incoming FTP proxy server and file names with a leading 4 digit number followed by a space are created on the FTP server, requests for download of files from the web client fails. This occurs because the Content Engine removes the leading numeric values from the filename. This problem is observed on a Content Engine running ACNS software, Release 4.2.7.
•
Authentication of users fails when a Content Engine is configured with proxy mode authentication and when child proxy servers such as a Microsoft Internet Security and Acceleration (ISA) Server —which also require proxy mode authentication—fail. This problem occurs in a network configured with an ISA Server and a Content Engine to serve as the proxy to the client. The ISA Server fails to preserve the user information contained in the header until the request reaches the Content Engine. However, the Squid proxy functions properly as an upstream proxy to the ISA Server.
•
When the clear cache real-proxy EXEC command is used to clear the RealProxy cache content, the following error message appears:
error opening from stat del dir /media/media1/real_movies/uns-symlink-treeHowever, the RealProxy cache content is removed from all the mounted cfs volumes when you issue this command.
•
Changing the position of a user's group within an access control list (using the access-lists global configuration command) to a position equal to or greater than that of the last group in the list causes the group in that position to be deleted.
•
In ACNS software, Release 4.2.9, no option is available in the TACACS+ window in the Content Engine GUI to change the TACACS+ password type although the tacacs password ascii global configuration command is available to change the password type.
To enable users to configure the TACACS+ password type using the Content Engine GUI, the Password Type radio button has been added to the TACACS+ window in ACNS software, Release 4.2.11. To configure Password Authentication Protocol (PAP) as the authentication scheme, you must click the PAP radio button. To configure ASCII as the password type, you must click the ASCII radio button.
•
Configuration of a Content Engine's network host name using the hostname name global configuration command is not consistent with the Host Name field available in the Basic Networking window in the Content Engine GUI. The Content Engine GUI allows host names to be configured with characters such as an underscore (_), whereas the CLI does not allow such characters. Also, the Content Engine GUI does not allow host names to be longer than 30 characters.
•
In the Device Groups Console window of the Content Distribution Manager GUI, the page links used to browse through multiple device group status pages do not work. Although the Previous and Next links function properly, the links denoting the page numbers are not clickable. This problem occurs when a large number of device groups are created and the number of rows chosen for display causes the device groups to be displayed on multiple pages. Refreshing the Device Groups Console window causes the following message to be displayed:
There are no Device Groups defined at this time•
When the show services ports portnum command is used to display the services by port number, the service name is displayed only for the first service. For the remaining services, the numerical value of the services as shown in the output listing is displayed instead of service names.
•
When you enable a URL filtering method and disable another URL filtering method that is not currently enabled the currently configured URL filtering method is also disabled. This problem occurs on a Content Engine running ACNS software, Release 4.2.9 or earlier. For example, when SmartFilter is configured for URL filtering and an N2H2 server is disabled, the output of the show url-filter command shows that URL filtering has been disabled, although SmartFilter is still enabled.
•
The following message appears during bootup or when disk commands are used:
You are using unsupported hardware.This occurs on a CE-560, CE-590, or CE-7320 running ACNS software, Release 5.0.3 or earlier and with a Cisco Storage Array SA-7 or SA-14 attached.
Documentation Updates
This section describes some documentation updates.
SmartFilter and the No-Auth Rule Interaction
The no-auth rule permits specific login and content requests to bypass authentication and authorization features such as LDAP, RADIUS, SSH, or TACACS+. For example, any requests from the source IP address (src-ip) of 172.16.53.88 are not authenticated.
ContentEngine(config)# rule enableContentEngine(config)# rule action no-auth pattern-list 1 protocol allContentEngine(config)# rule pattern-list 1 src-ip 172.16.53.88 255.255.255.255If ACNS software is configured for authentication and SmartFilter URL filtering, requests that are allowed to bypass authentication will also bypass the URL filter.
Related Documentation
Your product shipped with a minimal set of printed documentation, as well as a Documentation CD. The printed documentation provides enough information for you to install and initially configure your product. The CD contains additional product documentation (user guides, configuration manuals, and so forth), which you can access and print out.
Product Documentation Set
In addition to these release notes, the product documentation set includes:
•
•
•
Refer to the Documentation Guide for a complete documentation roadmap and URL documentation links for this product.
Hardware Documentation
•
•
•
•
Software Documentation
•
•
•
•
•
•
Obtaining Documentation
Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation on the World Wide Web at this URL:
http://www.cisco.com/univercd/home/home.htm
You can access the Cisco website at this URL:
International Cisco websites can be accessed from this URL:
http://www.cisco.com/public/countries_languages.shtml
Documentation CD-ROM
Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which may have shipped with your product. The Documentation CD-ROM is updated regularly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual or quarterly subscription.
Registered Cisco.com users can order a single Documentation CD-ROM (product number DOC-CONDOCCD=) through the Cisco Ordering tool:
http://www.cisco.com/en/US/partner/ordering/ordering_place_order_ordering_tool_launch.html
All users can order annual or quarterly subscriptions through the online Subscription Store:
http://www.cisco.com/go/subscription
Ordering Documentation
You can find instructions for ordering documentation at this URL:
http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm
You can order Cisco documentation in these ways:
•
http://www.cisco.com/en/US/partner/ordering/index.shtml
•
Documentation Feedback
You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click Feedback at the top of the page.
You can send your comments in e-mail to bug-doc@cisco.com.
You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883We appreciate your comments.
Obtaining Technical Assistance
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, the Cisco Technical Assistance Center (TAC) provides 24-hour, award-winning technical support services, online and over the phone. Cisco.com features the Cisco TAC website as an online starting point for technical assistance.
Cisco TAC Website
The Cisco TAC website (http://www.cisco.com/tac) provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The Cisco TAC website is available 24 hours a day, 365 days a year.
Accessing all the tools on the Cisco TAC website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a login ID or password, register at this URL:
http://tools.cisco.com/RPF/register/register.do
Opening a TAC Case
The online TAC Case Open Tool (http://www.cisco.com/tac/caseopen) is the fastest way to open P3 and P4 cases. (Your network is minimally impaired or you require product information.) After you describe your situation, the TAC Case Open Tool automatically recommends resources for an immediate solution. If your issue is not resolved using these recommendations, your case will be assigned to a Cisco TAC engineer.
For P1 or P2 cases (your production network is down or severely degraded) or if you do not have Internet access, contact Cisco TAC by telephone. Cisco TAC engineers are assigned immediately to P1 and P2 cases to help keep your business operations running smoothly.
To open a case by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447For a complete listing of Cisco TAC contacts, go to this URL:
http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
TAC Case Priority Definitions
To ensure that all cases are reported in a standard format, Cisco has established case priority definitions.
Priority 1 (P1)—Your network is "down" or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.
Priority 2 (P2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Priority 3 (P3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
Priority 4 (P4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
•
http://www.cisco.com/en/US/products/products_catalog_links_launch.html
•
•
http://www.cisco.com/go/packet
•
http://www.cisco.com/go/iqmagazine
•
http://www.cisco.com/en/US/about/ac123/ac147/about_cisco_the_internet_protocol_journal.html
•
http://www.cisco.com/en/US/learning/index.html
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, MGX, MICA, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, Stratm, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.
All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0304R)
Copyright © 2003 Cisco Systems, Inc. All rights reserved.
Guest
