Table Of Contents
Release Notes for Cisco ACNS Software, Release 5.4.3
Software Component Versions Supported in ACNS Software
New Features in the ACNS 5.4.3 Software
SmartFilter Version 4.1 Integration
FTP Service Disabled by Default
Node Manager Process Enhancement
Ability to Specify Addresses for Translog Files
Controls for Monitoring Outgoing Proxy Servers
New Rule Pattern to Filter Content Based on the X-Forwarded-For IP Address
Support for Content Router Request Overflow Routing
Multicast-In Sources in SSPLs Not Supported for Windows Media Streaming
No Downgrade Script to ACNS Releases Later than 5.3.3
RAM Requirements for ACNS 5.4 Software and Websense 5.5 Software
Websense Issues When Downgrading to the ACNS 5.0 Software or ACNS 5.1 Software
Media File System Issues When Downgrading to ACNS 5.0 Software
SmartFilter Issues When Upgrading or Downgrading to Another ACNS Software Release
Interoperability with ICAP Vendors
ICAP Maximum File Size Supported
Matrix of Supported Caching, Filtering, and Authentication Methods
Resolved Caveats—ACNS 5.4.3 Software
Cisco Product Security Overview
Reporting Security Problems in Cisco Products
Obtaining Technical Assistance
Cisco Technical Support & Documentation Website
Definitions of Service Request Severity
Obtaining Additional Publications and Information
Release Notes for Cisco ACNS Software, Release 5.4.3
September 4, 2006
ACNS Build 5.4.3 b17
Note
The most current Cisco documentation for released products is available at Cisco.com at http://www.cisco.com. The online documents may contain updates and modifications made after the hardcopy documents were printed.
Contents
This release note document contains information about the Cisco Application and Content Networking System (ACNS) 5.4.3 software. This release note describes the following topics:
•
Cisco Product Security Overview
•
Obtaining Technical Assistance
•
Obtaining Additional Publications and Information
Introduction
The ACNS software combines the technologies of demand-pull caching and pre-positioning for accelerated delivery of web applications, objects, files, and streaming media.
This release note document is intended for administrators who will be configuring, monitoring, and managing devices that are running the ACNS 5.4.3 software. This document describes the new product features, the supported hardware, and the open and resolved caveats regarding the ACNS 5.4.3 software release.
System Requirements
The ACNS software runs on Cisco Content Engine, Content Distribution Manager, Content Router, and Wide Area Application Engine (WAE) hardware platforms.
Table 1 shows the hardware platforms that are supported in each ACNS software release. An "X" indicates that the software supports the hardware models listed in that row.
Note
The ACNS 5.4.3 release is the required minimum software release for the WAE-512 and WAE-612 appliances. The ACNS 5.3.3 release is the required minimum software release for the WAE-511, WAE-611, and WAE-7326 appliances.
Software Component Versions Supported in ACNS Software
Table 2 describes which SmartFilter and Websense versions are supported in the ACNS software releases.
Table 2 Component Versions Supported in ACNS Software Releases
ACNS Software Release SmartFilter Version Supported Websense Version SupportedACNS 5.2.1
Version 4.0.1
Version 5.2
ACNS 5.3.x
Version 4.0.1
Version 5.2
ACNS 5.4.1
Version 4.0.1
Version 5.5.21
ACNS 5.4.3
Version 4.1.1
Version 5.5.2
ACNS 5.5.1
Version 4.0.1
Version 5.5.2
1 The integrated Websense Enterprise software Version 5.5 in the ACNS 5.4 software requires a minimum of 512 MB of RAM. We recommend that you upgrade the RAM on your device to 512 MB or greater, or move your integrated Websense server to another device that has at least 512 MB of RAM. When additional Websense components are enabled (such as the Network Agent), ACNS software requires a minimum of 1 GB of RAM.
Note
Performance is optimal when Websense Enterprise Manager, the Websense Policy Server, and all other Websense components are situated in the same LAN. If all components are not in the same LAN, you might experience communication latency between Websense Enterprise Manager and other components. A significant increase in latency can lead to a communication failure.
New and Changed Information
This section describes new and changed features in the ACNS 5.4.3 software release.
New Features in the ACNS 5.4.3 Software
The ACNS 5.4.3 software includes the following new features, enhancements, and changes:
•
SmartFilter Version 4.1 Integration
•
FTP Service Disabled by Default
•
Node Manager Process Enhancement
•
Ability to Specify Addresses for Translog Files
•
Controls for Monitoring Outgoing Proxy Servers
•
New Rule Pattern to Filter Content Based on the X-Forwarded-For IP Address
•
Support for Content Router Request Overflow Routing
New Hardware Features
The ACNS 5.4.3 release adds support for the WAE-512 and WAE-612 appliances. (For more information about hardware support in ACNS software, see Table 1.)
The WAE-512 supports a single-disk hardware configuration.
SmartFilter Version 4.1 Integration
The plug-in for SmartFilter software Version 4.1 has been integrated with ACNS 5.4.3 software. This version of SmartFilter has the following features:
•
Listens on port 9014 for block page requests.
The ACNS caching process listens on port 9015 for blocked pages and forwards the packets to port 9014 where SmartFilter listens.
•
Provides advanced block pages with a new look and feel.
•
Provides a new feature called temporary user override. (See the "About the Temporary User Override Feature" section.)
Note
To configure SmartFilter Version 4.1 features, you must obtain the SmartFilter Administration Console version 4.1.1, which can be downloaded from the Secure Computing website.
About the Temporary User Override Feature
In the ACNS 5.4.3 software release, the temporary user override is a new feature that is available with the SmartFilter software version 4.1. This feature allows the SmartFilter plugin to override the filtering mechanism that is being applied to the user group to which users have been added in the authentication server (in Step 3). You must configure this new feature through the SmartFilter Administrator Console (vesrion 4.1.1).
To use the temporary user override feature, follow these steps:
Step 1
Install the SmartFilter authentication server software on the machine that is running the SmartFilter Administrator Console or on a different machine.
Step 2
From the SmartFilter Administrator Console, add the authentication server.
Step 3
From the SmartFilter Administrator Console, add the users to the authentication server.
Step 4
Deploy the changes to the authentication server.
Step 5
From the SmartFilter Administrator Console, select the Content Engine, and add the configured authentication server to the Content Engine's list of authentication servers.
Step 6
From the SmartFilter Administrator Console, add the users who should be allowed to override the filtering mechanism in the overrides for the Content Engine.
Step 7
Deploy the changes to the Content Engine.
FTP Service Disabled by Default
To enable FTP proxy service on port 21, the FTP server service must be disabled on the Content Engine. You cannot have both FTP server and proxy services running on the Content Engine when the FTP proxy service is configured to use port 21.
In the ACNS 5.4.3 release, a code change has been made so that FTP service on the Content Engine is disabled by default. FTP is disabled by default in the following releases:
•
ACNS 5.3.7 and later 5.3.x releases
•
ACNS 5.4.3 and later 5.4.x releases
•
ACNS 5.5.1 (b110) and later 5.5.x releases
On Content Engines that run ACNS software releases earlier than 5.3.7, 5.4.3, and 5.5.1 the FTP server service is enabled by default.
To enable FTP server service on Content Engines where the FTP server service is disabled, use the inetd ftp enable global configuration command.
Node Manager Process Enhancement
In the ACNS 5.4.3 software release, the Content Engine Node Manager process (nodemgr) generates a core file that is useful for troubleshooting before it exits.
New syslog Message Added
A new syslog message has been added to the ACNS 5.4.3 software. Multicast-in source objects in server-side playlists are not supported for Windows Media streaming. If you have such an unsupported configuration, the Windows Media stream will fail, and the problem will be identified in the syslog file, as shown in the following example:
Jul 9 21:30:09 new-stream-ce2-158-3 mms_server: %CE-WMT-2-512078: Multicast-in with SSPL source is not supportedAbility to Specify Addresses for Translog Files
In the ACNS 5.4.3 software, the transaction-logs global configuration command was modified, and a new option filename and suboption label have been added. These new command options allow you to configure a customized string to appear in the transaction log in the transaction-logs filename label field, which replaces the IP address field. The length of the string cannot exceed 15 characters, and only alphanumeric characters and the period (.) character are allowed.
ce(config)# transaction-logs filename label custom_string
The following example configures the filename label as 10.77.155.160.
ce-14(config)# transaction-logs filename label 10.77.155.160The following sample show running-config command output shows that the new filename label is configured:
ce-14# show running-config! ACNS version 5.4.3!!hostname ce-14!http anonymizer enablehttp append x-forwarded-for-header..........transaction-logs enabletransaction-logs archive interval 120transaction-logs export enabletransaction-logs export compresstransaction-logs export interval 10transaction-logs export ftp-server 172.19.228.125 admin **** /temptransaction-logs filename label 10.77.155.160 <========================The following show transaction-logging command output shows the new filename label as it appears in the transaction log:
ce-14# show transaction-loggingTransaction log configuration:---------------------------------------Logging is enabled.End user identity is visible.File markers are disabled.Archive interval: 120 secondsMaximum size of archive file: 2000000 KB Log File format is squid.Filename label string is 10.77.155.160 <==========================Windows domain is not logged with the authenticated usernameExporting files to ftp servers is enabled.File compression is enabled.Export interval: 10 minutes......Controls for Monitoring Outgoing Proxy Servers
The ACNS 5.4.3 software supports controls in both the CLI and in the Content Distribution Manager GUI to enable and disable the monitoring of outgoing proxy servers. The following three new CLI commands are available in the ACNS 5.4.3 software:
•
http proxy outgoing monitor enable
•
ftp-over-http proxy outgoing monitor enable
•
https proxy outgoing monitor enable
To enable or disable outgoing proxy monitoring using the Content Distribution Manager GUI, follow these steps:
Step 1
Navigate to one of the following configuration windows:
•
For HTTP connections, choose Devices > Applications > Web > HTTP > HTTP Connections.
•
For FTP-over-HTTP connections, choose Devices > Applications > Web > FTP > FTP-Over-HTTP Connections.
•
For HTTPS connections, choose Devices > Applications > Web > HTTPS > Proxy.
Step 2
Check or uncheck the Enable Outgoing Proxy Monitor check box.
Step 3
Click Submit to save your changes.
Enhancements to ICAP Support
The Internet Content Adaptation Protocol (ICAP) is an open standards protocol for content adaptation, typically at the network edge. The ACNS 5.4.3 software supports the following enhancements for ICAP support:
•
ICAP Request Modification Support for HTTPS Requests
•
Compatibility with the Data Trickling of WebWasher ICAP Server
•
Support for Accessing Blank Pages over ICAP-Enabled Networks
•
New CLI Command and GUI support for Configuring the ICAP Connection Timeout
ICAP Request Modification Support for HTTPS Requests
The ACNS 5.4.3 software supports an ICAP request modification (reqmod) for the HTTPS proxy-style requests. Support for ICAP reqmod processing allows proxy-style requests that use the HTTPS protocol to be modified as they are sent from the Content Engine to the ICAP server on their way to the origin server. For more information on ICAP support, see the "Interoperability with ICAP Vendors" section.
Compatibility with the Data Trickling of WebWasher ICAP Server
The ACNS 5.4.3 software allows you to download large files over an ICAP-enabled network. Because of some compatibility issues with the data trickling feature of the WebWasher ICAP server, downloading large files over ICAP-enabled ACNS networks used to fail before the download was completed. However, starting with release 5.4.3, the ACNS software has become compatible with the data trickling feature of the WebWasher ICAP server. (See resolved caveat CSCsc29267.)
Support for Accessing Blank Pages over ICAP-Enabled Networks
The ACNS 5.4.3 software allows you to access blank pages (null body pages, where there is no content) over an ICAP-enabled ACNS network. When you try to access blank pages, earlier versions of the ACNS software used to return error messages saying that the page could not be retrieved because the server was either unreachable or temporarily busy.
New CLI Command and GUI support for Configuring the ICAP Connection Timeout
The ACNS 5.4.3 software allows you to configure a timeout value for ICAP connections. You can configure an ICAP connection timeout value using the following CLI command:
CE(config)#icap connection-timeout minutesYou can enter a number between 1 and 480 as the ICAP connection timeout interval in minutes to allow a longer timeout interval when you want to download large files from ICAP-protected sites.
Alternatively, you can configure the ICAP connection timeout from the Content Distribution Manager GUI.
To configure the ICAP connection timeout from the Content Distribution Manager GUI, follow these steps:
Step 1
Choose Devices > Devices. (Alternatively, choose Devices > Device Groups.)
Step 2
Click the Edit icon that corresponds to the Content Engine or device group for which you want to configure the ICAP timeout interval.
Step 3
Choose Request Processing > ICAP. The ICAP Settings window for the chosen device or device group appears.
Step 4
To configure the ICAP connection timeout interval, enter a number between 1 and 480 in the Connection-Timeout field. The default value is 20 minutes.
Step 5
To save the settings, click Submit.
New Rule Pattern to Filter Content Based on the X-Forwarded-For IP Address
The ACNS 5.4.3 software allows you to use a new rule pattern to filter content based on the x-forwarded-for IP address in the HTTP header. The x-forwarded-for attribute contains the IP address of the device from which the request originated. Only the use-server rule action is supported for the x-forwarded-for rule pattern. The use-server action sends server-style HTTP requests from the Content Engine to the specified IP address and port on a cache miss.
You can configure the x-forwarded-for rule pattern using the following CLI command:
CE(config)#rule pattern-list 1 header-field x-forwarded-for ip-addressAlternatively, you can configure the x-forwarded-for rule pattern from the Content Distribution Manager GUI.
To configure the rule pattern from the Content Distribution Manager GUI, follow these steps:
Step 1
Choose Devices > Devices. (Alternatively, choose Devices > Device Groups.)
Step 2
Click the Edit icon that corresponds to the Content Engine or device group for which you want to configure the rule pattern.
Step 3
In the Contents pane, choose Request Processing > Service Rules.
Step 4
In the taskbar, click the Create New Service Rules icon. The Creating New Service Rules window appears.
Step 5
Configure a pattern list and add a pattern to it by following these steps:
a.
From the Rule Type drop-down list, choose pattern-list.
a.
In the Rule Parameters field, configure the pattern list number and the pattern type as list-num header-field x-forwarded-for IP Address.
b.
To save the settings, click Submit.
Step 6
Associate an action with an existing pattern list by following these steps:
a.
In the Creating New Service Rule window (see Step 1 through Step 4), choose use-server action type from the Rule Type drop-down list.
Note
Only the use-server rule action is supported for the x-forwarded-for rule pattern.
b.
In the Rule Parameter field, enter the list number of the x-forwarded-for pattern list that you want associated with this action.
c.
To save the settings, click Submit.
For more information about creating rule patterns and configuring rule actions, see Chapter 16, "Configuring Request Processing Services" in the Cisco ACNS Software Configuration Guide for Centrally Managed Deployments, Release 5.5.
Support for Content Router Request Overflow Routing
In the ACNS 5.4.1 implementation of load-based content routing, when all Content Engines in a domain became overloaded and the configured resource utilization thresholds were exceeded, the Content Router began dropping requests.
In the ACNS 5.4.3 release, when the original domain is overloaded, client requests can be redirected to an overflow or alternate domain. This feature applies to the following two situations:
•
Load-based routing is configured and all Content Engines in the domain are overloaded.
•
All Content Engines in the domain are offline. (Load-based routing does not have to be configured in this instance.)
Note
The request overflow routing feature must be configured on a per-domain basis.
When request overflow routing is not configured for the domain requested, requests that exceed Content Engine load-based thresholds or that are otherwise undeliverable, are redirected to an error notification message, and the requests are dropped.
Request overflow routing works dynamically when Content Engines are overloaded or deactivated. When the load of one or more Content Engines in the original host domain is reduced below threshold limits or Content Engines are reactivated, new requests are routed to the original host domain automatically.
Request overflow routing supports requests from RTSP, HTTP, and MMS clients.
Important Notes
This section emphasizes important information regarding the ACNS 5.4.x software. It includes the following sections:
•
Multicast-In Sources in SSPLs Not Supported for Windows Media Streaming
•
No Downgrade Script to ACNS Releases Later than 5.3.3
•
RAM Requirements for ACNS 5.4 Software and Websense 5.5 Software
•
Websense Issues When Downgrading to the ACNS 5.0 Software or ACNS 5.1 Software
•
Media File System Issues When Downgrading to ACNS 5.0 Software
•
SmartFilter Issues When Upgrading or Downgrading to Another ACNS Software Release
•
Interoperability with ICAP Vendors
•
ICAP Maximum File Size Supported
•
Matrix of Supported Caching, Filtering, and Authentication Methods
Multicast-In Sources in SSPLs Not Supported for Windows Media Streaming
Multicast-in source objects in server-side playlists are not supported for Windows Media streaming. If you have such an unsupported configuration, the Windows Media stream will fail, and the problem will be identified in the syslog file, as shown in the following example:
Jul 9 21:30:09 new-stream-ce2-158-3 mms_server: %CE-WMT-2-512078: Multicast-in with SSPL source is not supportedNo Downgrade Script to ACNS Releases Later than 5.3.3
There is no downgrade script in the ACNS 5.4.3 code base to downgrade directly to ACNS 5.3.x releases that are later than ACNS 5.3.3. To downgrade from ACNS 5.4.3 software to ACNS 5.3.x software you must use the following guidelines:
•
Use the Downgrade5_4_to_5_3_3 downgrade script if you are downgrading from ACNS 5.4.3 to any ACNS 5.3 version that is greater than or equal to ACNS 5.3.3.
•
Use the Downgrade5_4_to_5_3 downgrade script if you are downgrading from ACNS 5.4.3 to any ACNS 5.3 version that is earlier than ACNS 5.3.3.
•
Before or after you run the downgrade script, you must install the version of ACNS 5.3.x software that you need.
RAM Requirements for ACNS 5.4 Software and Websense 5.5 Software
The integrated Websense Enterprise software Version 5.5 in the ACNS 5.4 software requires a minimum of 512 MB of RAM. We recommend that you upgrade the RAM on your device to 512 MB or greater, or move your integrated Websense server to another device that has at least 512 MB of RAM.
Websense Issues When Downgrading to the ACNS 5.0 Software or ACNS 5.1 Software
If the local (internal) Websense server is enabled on the Content Engine and you downgrade from the ACNS 5.2.x software to either ACNS 5.0 software or ACNS 5.1 software, the WebsenseEnterprise directory is removed from the Content Engine and the local Websense server stops working. The ACNS 5.2.x software does not generate an error message indicating that the WebsenseEnterprise directory has been removed. However, in the ACNS 5.3.1 software and later releases, the following error message is displayed to notify you about this Websense downgrade issue:
WARNING:Websense does not support downgradeHence removing /local/local1/WebsenseEnterpriseWebsense will stop working after copy ftp installTo avoid this problem when downgrading from the ACNS 5.3.x or ACNS 5.2.x software to either ACNS 5.1.x software or ACNS 5.0.x software, follow these steps:
Step 1
Disable the local (internal) Websense server on the Content Engine.
Step 2
Deactivate the Websense services on the Content Engine.
Step 3
Install the ACNS 5.1 software or ACNS 5.0 software downgrade image on the Content Engine.
Media File System Issues When Downgrading to ACNS 5.0 Software
If you have configured the media file system (mediafs) with the ACNS 5.1 software and later releases, and then downgrade to the ACNS 5.0 software, the mediafs disk space assignment is lost and reverts to the ACNS network file system (cdnfs) disk space. (The mediafs is used for on-demand content that is fetched through the two streaming protocols [RTSP and WMT]. The cdnfs is used for pre-positioned content in the ACNS network.)
This situation occurs because of a design change that was implemented in the ACNS 5.1 software. Because the ACNS 5.0 software is not compatible with this change, the disk space becomes assigned to cdnfs instead of mediafs. To work around this problem, follow these steps:
1.
After you downgrade to the ACNS 5.0 software, use the CLI (disk config EXEC command) or the GUI to assign the mediafs disk space.
Use the Content Distribution Manager GUI for Content Engines that are registered with a Content Distribution Manager. Use the Content Engine GUI for standalone Content Engines (Content Engines that are not registered with a Content Distribution Manager and are being managed through the Content Engine GUI or CLI).
2.
Reboot the Content Engine for the disk configuration changes to take effect.
SmartFilter Issues When Upgrading or Downgrading to Another ACNS Software Release
When you upgrade or downgrade the Content Engine to a different release of the ACNS software, if there is a difference in the SmartFilter plug-in version, the SmartFilter database and configuration files are deleted and default configurations are loaded. This change occurs because the configuration details might be changed with each new version of SmartFilter software. After each upgrade or downgrade of the SmartFilter plug-in, a fresh database has to be downloaded from the SmartFilter Administration Console to the Content Engine. (For a description of which SmartFilter versions are supported in the ACNS software releases, see Table 2.)
Interoperability with ICAP Vendors
The Internet Content Adaptation Protocol (ICAP) is an open standards protocol for content adaptation, used typically at the network edge. Content adaptation includes virus scanning, content translation, content filtering, content insertion, and other methods of improving the value of content to end users. ICAP specifies how a Content Engine, acting as an HTTP proxy server, can communicate with an external device that is acting as an ICAP server to filter and adapt the requested content.
ICAP provides two content-processing modes for HTTP services. These modes define the transactions that can occur between a Content Engine acting as an ICAP client and an ICAP server. The two modes are as follows:
•
Request modification (reqmod)—Allows modification of requests as they are sent from the Content Engine to the ICAP server on their way to the origin server. The ICAP server can modify these requests depending on the services requested.
•
Response modification (respmod)—Allows modification of requests after they return from the origin server. The ICAP server only acts on requested objects after they return from the origin server.
The following is a complete list of the ICAP vendors that have been certified to interoperate with the Content Engine:
•
TrendMicro for reqmod and respmod
•
Symantec for respmod
ICAP Performance
With the respmod vectoring point, which is used by virus-scanning ICAP vendors, the performance of the Content Engine model CE-7305 will be 300 transactions per second.
With the reqmod-precache vectoring point, which is used by URL filtering ICAP vendors, the performance of the Content Engine model CE-7305 will drop 20 percent from the rated performance.
Note
The performance of the Content Engine will be limited by the performance of the ICAP server.
ICAP Maximum File Size Supported
For ACNS 5.4.x software and later, the maximum file size that is supported in the ACNS software is 2 GB. Files that exceed this size limit are not supported for ICAP processing.
Matrix of Supported Caching, Filtering, and Authentication Methods
Table 3 lists the caching, filtering, and authentication methods supported by Content Engines that are running the ACNS 5.4.x software. An asterisk (*) indicates that a feature is supported for that particular protocol.
Caveats
This section lists and describes the open and resolved Severity 1, 2, and 3 caveats in the ACNS 5.4.3 software. Caveats describe unexpected behavior in the ACNS 5.4.3 software. Severity 1 caveats are the most serious; Severity 2 caveats are less serious. Severity 3 caveats are moderate caveats.
Open Caveats
This section lists caveats that have not been resolved in the ACNS 5.4.3 software release.
•
CSCdy82311
Symptom: Content cannot be acquired using strong authentication from secure origin servers that use certificates from nonstandard certificate authorities (CAs). If strong authentication is chosen for content acquisitions from such a site, the acquirer error statistics will contain a 401 (Unauthorized) error code, and the acquirer error log will display the following error message:
Strong Cert Authentication rejects certificate due to error: ssl error codeCondition: This problem occurs if the origin server uses a certificate that is not known as a standard certificate to the ACNS software acquirer. For content acquisition from secure sites over HTTPS using strong authentication, only sites with certificates from standard certificate authorities are supported.
Note
With strong authentication, if any errors occur during certificate verification by the ACNS acquirer, then content from that site will not be acquired. With weak authentication, certain errors (for example, a certificate has expired, certificate is not yet valid, and a subject issuer mismatch has occurred) are allowed during certificate verification.
Workaround: Use one of the following workarounds:
–
Use weak authentication.
–
On the secure server, use a certificate that was generated by one of the standard certificate authorities. ACNS network administrators should refer to the following information to determine which CA certificate to install on their origin servers. Note that the certificate list differs based on the version of the ACNS software. For the ACNS 5.1.x software release or later, refer to the certificate list in the Cisco ACNS Software Upgrade and Maintenance Guide, Release 5.x.
•
CSCea51815
Symptom: When a Content Engine model CE-565 is attached to a Storage Array SA-7 device, if too large a cache file system (cfs) partition is configured, and a combined streaming and caching workload is used, then a lower HTTP performance is observed.
Condition: This problem occurs when the CE-565 has Windows Media Technologies (WMT) enabled, a combined streaming and caching workload is used, and the Content Engine is attached to an SA-7 device.
Note
The Storage Array device is used for the cache file system (cfs).
Workaround: Allocate less space to the cfs if a Storage Array is attached to the Content Engine.
•
CSCec52221
Symptom: Windows Media Technologies (WMT) is enabled with no media file system (mediafs) after you downgrade from the ACNS 5.1b300 software to the ACNS 5.0.7b8 software.
Condition: This problem occurs if you upgrade from the ACNS 5.0.7b8 to the ACNS 5.1bx software, configure the disk, and then downgrade to the ACNS 5.0.7b4 software.
Workaround: Reconfigure the disk with a mediafs partition and reload the software.
•
CSCed68727
Symptom: The Content Distribution Manager only checks if coverage zone files refer to invalid Content Engines after there is a fresh import. When there is a configuration change that can cause already imported coverage zone files to refer to invalid Content Engines, the Content Distribution Manager does not check or display the correct error message until the next fresh import.
Condition: This problem occurs if there is a coverage zone configuration change that causes already-imported coverage zone files to refer to invalid Content Engines.
Workaround: There is no known workaround.
•
CSCed77655
Symptom: The Content Engine stops spoofing the client IP address and uses its own IP address to fetch content from the origin server.
Condition: The http l4-switch spoof-client-ip enable global configuration command turns on IP spoofing on a Content Engine that is functioning as a caching engine. When a rule action use-server global configuration command is used, the Content Engine stops spoofing the client IP address and instead uses its own IP address to fetch the content.
Workaround: Remove the rule configurations.
•
CSCed84227
Symptom: The network management system (NMS) host does not know where SNMP traps are coming from.
Condition: This problem occurs if there are two interfaces and you configure interface redundancy using both interfaces. You must use a dummy address for the physical addresses. You then configure a real address that floats between the two interfaces. If you then configure SNMP traps, the traps are being sourced from the dummy address and not the routable address. Therefore, the NMS host does not know where the trap is coming from.
Workaround: Configure the Content Engine to generate SNMP version 2c type trap messages. Because the SNMP version 2c trap message does not contain the IP address of the SNMP agent, the NMS software will use the source IP address of the UDP message to identify the address of the SNMP agent.
•
CSCee25042
Symptom: Even though you entered the url-filter wmt bad-sites-deny global configuration command on the Content Engine, the Content Engine is not filtering requests for content that is pre-positioned in its wmt_vod directory.
Condition: This problem occurs in the following situation:
a.
You pre-position a file (for example, file.asf) on the Content Engine in its wmt_vod directory.
b.
After pre-positioning the file, you configure the bad site list for URL filtering using mmst://Content Engine IP address/wmt_vod/file.asf.
c.
A user makes a content request for this URL (mmst://Content Engine IP address/wmt_vod/file.asf).
Workaround: Configure the bad site list using mmst://127.0.0.1/wmt_vod/file.asf instead of mmst://Content Engine IP address/wmt_vod/file.asf.
•
CSCee38190
Symptom: A WMT live stream in a managed live event environment is accessible for a period longer than the scheduled duration.
Condition: This problem occurs only with WMT live programs that have unicast access enabled. In this situation, streams can be accessible for up to 24 hours after the last playtime of the event if "Auto Delete" is set to true or can be accessible indefinitely if "Auto Delete" is set to false.
Workaround: Control the live-stream source through the schedule for the event. Typically, this process involves starting and stopping the WMT encoder.
•
CSCee49106
Symptom: The content replication status can show an incorrect manifest item count.
Condition: This problem can occur if too many channels share the same content (for example, if over 100 channels share the same 30 files in each channel). Even though all 100 channels should show the 30 files that were acquired and distributed, it takes an extended period (days) before the correct manifest item count is displayed.
Workaround: Reduce the number of channels that share the same contents.
•
CSCee56998
Symptom: The CPU usage on the Content Engine hits a peak of 100 percent.
Condition: This problem can occur if the internal (local) Websense server is enabled on the NM-CE-BP models.
Workaround: There is no known workaround.
•
CSCee67227
Symptom: If you specify foo as a folder URL in the manifest file, and there is a single item redirection from foo to foo/ by the web server, the ACNS acquirer fails to process such redirections and generates a 716 error message. If you are using the quick crawl tool in the Channel Content window, some of the files also report 716 error messages.
Condition: This problem occurs if you are using the quick crawl tool and there is a single item redirect from foo to foo/. However, if foo is a link from a crawl job, single item redirections from foo to foo/ are allowed.
Workaround: Specify foo/ in the manifest file, or specify a crawl job instead of using the quick crawl tool.
•
CSCee67330
Symptom: Microsoft NT LAN Manager (NTLM) authentication fails and the pop-up window is displayed again.
Condition: This problem occurs if NTLM authentication is being used and the specified domain name is longer than 50 characters.
Workaround: For NTLM authentication, use a domain controller (DC) that has a domain name shorter than 35 characters.
•
CSCee71157
Symptom: Channel routing causes loops for several Content Engines.
Condition: This problem can occur if there are Content Engines that are running the ACNS 5.1.x software or earlier, and these Content Engines are registered with a Content Distribution Manager that is running the ACNS 5.2.x software.
Workaround: Upgrade the Content Engines to the ACNS 5.2.x software. Currently, a Content Distribution Manager that is running the ACNS 5.2.x software does not propagate some configuration changes to Content Engines that are running an ACNS software release earlier than the ACNS 5.2.x software. Therefore, Content Engines that are running the ACNS 5.1.x software or earlier, may not recognize that the root Content Engine was changed from one Content Engine to another. Consequently, routing loops can develop within the system.
•
CSCee81376
Symptom: The CMS service on the Content Distribution Manager cannot start and fails to create the CMS database backup file.
Condition: This problem can occur if the ACNS network configuration is very large (for example, with 2000 configured Content Engines) and the sysfs partition is 2 GB or less.
Workaround: Create a sysfs partition that is greater than 2 GB.
•
CSCee90245
Symptom: Microsoft NT LAN Manager (NTLM) authentication occurs even though you disabled it on the Content Engine.
Condition: This problem occurs very rarely. In very rare situations, even though you entered the no ntlm server enable global configuration command to disable NTLM proxy authentication on the Content Engine, NTLM proxy authentication is still not turned off. In such cases, NTLM authentication can still occur, although the output of the show running EXEC command shows that the NTLM server is not enabled on the Content Engine.
Workaround: Enter the no ntlm server enable global configuration command again on the Content Engine.
•
CSCee92698
Symptom: The ICAP service is enabled on the Content Engine, but the Content Engine is unable to retrieve the content.
Condition: This problem can occur if the Content Engine is running the ACNS 5.x software, and you configure two or more ICAP services to subscribe to the same vectoring point (the response modification [RESPMOD] vectoring point).
Workaround: There is no known workaround.
•
CSCee92917
Symptom: A cleanup of the sysfs partition removes all pre-positioned RealMedia contents from the /local1/real_vod/ directory on the Content Engine.
Condition: This problem occurs if the sysfs partition is saturated because of the population of content in the real_vod directory.
Workaround: There is no known workaround.
•
CSCef11091
Symptom: The WCCP cache farm (a cluster of Content Engines that are running WCCP) is formed using the assignment method even though you specified the mask-assignment assign-method- strict option when configuring the WCCP service.
Condition: This problem occurs if the WCCP cache farm is associated with Cisco routers instead of switches.
Workaround: There is no known workaround. Mask assignment was only designed for Catalyst 6500 series switches and is not supported by Cisco routers.
•
CSCef16345
Symptom: The stream scheduler in the edge Content Engine retrieves stale Session Description Protocol (SDP) information from its forwarder and stores it in its local1/cse_live/ucast folder if the encoding is modified through IP/TV Program Manager. All further RTSP requests are served with this stale SDP content.
Condition: This problem occurs if the stream scheduler retrieves stale SDP information from its forwarder because the program has been edited and the encoding changed for a program. This situation occurs if the Content Distribution Manager notification at the edge Content Engine triggers the stream scheduler before the same occurs at the root Content Engine. Consequently, the edge Content Engine obtains the SDP content from its forwarder, which is valid content at that moment.
Workaround: Reload the Content Engine.
•
CSCef37606
The Content Engine becomes unresponsive, and it takes a long time for commands to be executed.
Condition: This problem occurs when the load that is running on the Content Engine is almost as high as the maximum permissible load for a Content Engine, and you then enable ICAP (especially with request modification [REQMOD] transactions). This situation causes the Content Engine to go into an overload state and not recover easily.
Workaround: The load on the Content Engine with ICAP enabled (for the response modification [respmod] transactions) should be kept to 50 percent of the load that it can handle without ICAP.
•
CSCef37947
Symptom: A URL in the Synchronized Multimedia Integration Language (SMIL) file that has the "repeatCount" value set, may not be requested as many times as specified by the "repeatCount" setting.
Condition: This problem occurs only when RealPlayer Version 10 is used. The player exhibits the same behavior whether or not there is a Content Engine between the client and the origin server.
Workaround: Use RealOne player instead of RealPlayer Version 10, or request the SMIL file again. The URL will be played at least once in the player.
•
CSCef44709
Symptom: An HTTP 1.0 request that is received by the Content Engine from a client web browser is sent as an HTTP 1.1 request by the Content Engine to the origin server.
Condition: This problem occurs only when the ICAP service is enabled on the Content Engine.
Workaround: There is no known workaround.
•
CSCef57641
Symptom: The cache process on the Content Engine restarts.
Condition: This problem occurs if a large volume of HTTPS and FTP traffic is being directed to the Content Engine, which is operating in transparent mode.
Workaround: There is no known workaround.
•
CSCef60282
Symptom: Even though you entered a write memory command, after an immediate reload, a prompt appears that the configuration has been changed.
Condition: This problem occurs if the following conditions are met:
–
You have enabled Websense on the Content Engine.
–
The IP address of the Content Engine is removed or changed.
–
You enter a write memory command on the Content Engine.
–
You reload the Content Engine.
Workaround: Note that ACNS functionality is not affected if this problem occurs. However, if a prompt appears stating that the configuration has been changed, enter yes to save the configuration.
•
CSCef61845
Symptom: Unicast access to a live program does not work.
Condition: This problem occurs only when you use special characters ("?" and "#") in the unicast reference URL.
Workaround: To publish a live event, use URLs that do not contain special characters.
•
CSCef62968
Symptom: The Content Engine reboots suddenly when you are performing database maintenance.
Condition: The problem can occur because of a platform issue in the power supply of the device.
Workaround: Properly trim the power supply of the Content Engine.
•
CSCef67934
Symptom: The proxy autoconfiguration file is missing from the Content Engine after you switch from group settings to device settings, and then switch back to group settings.
Condition: This problem can occur under the following conditions:
a.
You have specified values in the Client Proxy Autoconfig Device Group window of the Content Distribution Manager GUI.
b.
You override these values through the Client Proxy Autoconfig Device window of the Content Distribution Manager GUI.
c.
You revert the Content Engine back to the device group settings (you click the Force device group settings button in the device group window or you select the device group from the drop-down menu in the device window).
The autoconfiguration file is not found but the proxy autoconfiguration feature is shown as enabled.
Workaround: Return to the device window in the Content Distribution Manager GUI, delete the values from the proxy autoconfiguration fields in the device window, and then select device group from the drop-down menu.
•
CSCef67938
Symptom: When using the quick start tool in the Content Distribution Manager GUI, if you repeatedly click the Add-Router to List button before the window completely loads in your browser, the following message appears in your browser:
The system had trouble processing your last request.This situation can occur under the following circumstances:
–
You click the BACK or REFRESH browser buttons.
–
Multiple browser windows from the same client machine are accessing the Content Distribution Manager GUI.
–
Another user deletes the item that you are working with in the Content Distribution Manager GUI.
Condition: This problem occurs only when there is a slow connection between the Content Distribution Manager and your browser and you perform any of the unsupported actions described above.
Workaround: Return to the Content Distribution Manager GUI and wait until the window is completely loaded in your browser before you click the Add-Router to List button.
•
CSCeg04809
Symptom: HTTP VoD file statistics are not being updated correctly.
Condition: This problem can occur if you enter the show statistics wmt requests EXEC command while you are using the HTTP protocol to play a stream. The command output shows the total unicast requests field as 2 but shows the other types of requests (for example, the number of served streaming requests) as only 1.
Workaround: Wait until the stream ends before you enter the show statistics wmt requests EXEC command.
•
CSCeg22697
Symptom: The Websense EIM server that is running on the Content Engine generates a core file.
Condition: This problem can occur when the Websense server is enabled on the Content Engine.
Workaround: No user intervention is required. If this problem occurs, the Websense server functionality is not affected. After generating a core file, the Websense server will be automatically restarted and the functionality is restored.
•
CSCeg47793
Symptom: If you modify a Content Engine GUI page and reload the page without first clicking the Update button, the new (unsaved) values are displayed on the page instead of the old (saved) values.
Condition: This problem only occurs if you are using the latest versions of the Netscape browser (Version 7.0 or later) to access the Content Engine GUI.
Workaround: Go to another Content Engine GUI page, and then return to the same Content Engine GUI page instead of reloading the page. The redisplayed Content Engine GUI page will display the old (saved) values instead of the new (unsaved) values.
•
CSCeg56075
Symptom: RealPlayer crashes when the streams are switched from the first stream to the second stream.
Condition: This problem can occur if you have set the reconnect as automatic for broadcast redundancy.
Workaround: Set the reconnect as manual instead of automatic.
•
CSCeg82405
Symptom: The Internet Explorer client retrieves a partial (incomplete) customized error page and displays it along with some partial HTML code.
Condition: This problem occurs if a customized error page is configured on the Content Engine and an Internet Explorer client requests a nonexistent HTTPS URL, which causes the customized error page to be returned.
Workaround: There is no known workaround.
•
CSCeg84004
Symptom: NTLM authentication for a valid user may take a longer period than usual (approximately two minutes) if the client sends the request when the Content Engine has been idle for a long period of time.
Condition: This problem can occur under the following conditions:
a.
NTLM request authentication is enabled on the Content Engine.
b.
The request is sent after the Content Engine has been idle for a long period of time.
c.
The client machine has some malfunctioning program (for example, spyware or a virus) and is sending HTTP requests to the Content Engine along with the first request from the browser. The user agent is named Tioga, and the request is as follows:
GET http://somehostname/Zone-UVWXYZ/config.cfg HTTP/1.0\r\nRequest Method: GETAccept: */*\r\nUser-Agent: Tioga\r\nHost: somehostname\r\nPragma: no-cache\r\nwhere somehostname is a hostname.
The user will be authenticated after waiting approximately two minutes. After reporting a failure to the browser, the Content Engine uses the same credential and retrieves the group information for that user from its HTTP authentication cache.
Workaround: On the Content Engine, configure a rule to either reject requests from the user agent named Tioga, or configure the no-auth rule to bypass authentication for this user agent.
•
CSCeg86386
Symptom: In a Content Router environment, users are not able to choose RTSPU (UDP) or RTPST(TCP) by requesting with rtspu:// or rtspt:// from their Windows Media players. Another symptom is that an RTSPT stream is returned when an RTSPU stream is requested. A third symptom is that even though you specified the wmt disallowed-client-protocols rtspu global configuration command, it is not preventing clients from being served for a request rtspu://crfqdn/file.asf, which will return an RTSP stream instead of an error.
Condition: This problem can occur if a Content Router is being used for RTSP redirection.
Workaround: There is no known workaround.
•
CSCeh20906
Symptom: Even though you have the transaction log sanitize feature enabled on the Content Engine, the RealProxy or RealServer access logs still display the client IP address even though it should be hidden.
Condition: This problem is caused because the transaction-logs sanitize CLI command is not working properly for the RealProxy and RealServer. Even though you have entered the transaction-logs sanitize global configuration command, the RealProxy or RealServer access logs still display the client IP address even though it should be hidden.
Workaround: There is no known workaround.
•
CSCeh23466
Symptom: The table of contents and the index of the ACNS Content Distribution Manager online help are not functioning. When you open the online help window, the left pane, which contains the table of contents and index, appears blank.
Condition: This problem is caused by the Windows Security Update MS05-001. This security patch prevents the creation of an instance of the HTML Help ActiveX control that is served in HTML content from outside the Local Machine zone.
Workaround: Because the ACNS Content Distribution Manager is part of your internal network, you may modify the Windows registry to allow execution of ActiveX controls that are served from within the intranet zone. For more information on modifying the registry to workaround this issue, refer to Microsoft Knowledge Base article 892675, which is available at this URL: http://support.microsoft.com/kb/892675.
•
CSCeh34292
When the WMT player is being proxied to the Content Engine, the player stops and starts buffering several times when it is playing a media file.
Condition: This problem can occur under the following condition:
a.
WMT is disabled on the Content Engine.
b.
The media file is located on the Windows Media Series 9.1 server that will send back a keepalive header without a content-length header.
Workaround: Enter the http ignore-resp-len-conn-hdr-check global configuration command, which is a hidden CLI command, on the Content Engine.
•
CSCeh35923
Symptom: When you are trying to install the ACNS software on a Content Engine, DMA errors are displayed.
Condition: This problem only occurs under the following condition:
a.
You are trying to install the ACNS software image on a CE-7326.
b.
You select Option 7 from the Installer main menu as follows:
Installer Main Menu:1. Configure Network2. Manufacture flash3. Install flash cookie4. Install flash image from network5. Install flash image from cdrom6. Install flash image from disk7. Wipe out disks and install .bin image8. Exit (and reboot)Choice [0]: 7Workaround: The DMA errors are displayed four to five times in sequence and then the normal operation of the Content Engine continues without any user intervention.
•
CSCeh73477
Symptom: The acquirer experiences a problem with a samba crawl. The acquirer is recrawling the same crawl job.
Condition: This problem can occur if both of

