Table Of Contents
Release Notes for the Cisco Home Agent 2.0 Feature in Cisco IOS Release 12.3(8)XW
Determining the Software Version
Upgrading to a New Software Release
Unresolved Caveats Prior to IOS 12.3(8)XW
Open Caveats Prior to Cisco IOS Release 12.3(7)XJ1
Resolved Caveats Prior to Cisco IOS 12.3(8)XW
Cisco IOS Software Documentation Set
Release 12.3 Documentation Set
Obtaining Technical Assistance
Cisco Technical Support Website
Definitions of Service Request Severity
Obtaining Additional Publications and Information
Release Notes for the Cisco Home Agent 2.0 Feature in Cisco IOS Release 12.3(8)XW
June 2004
Cisco IOS Release 12.3(8)XW is a special release that is based on Cisco IOS Release12.3, with the addition of enhancements to the Cisco Mobile Wireless Home Agent feature. The Cisco IOS Release 12.3(8)XW is a release optimized for the Cisco Mobile Wireless Home Agent Release 2.0 feature on the Cisco 7206VXR router platform, on the Cisco 7301 Series Internet router platform, and for the Cisco Multi-Processor WAN Application Module on the Cisco 6500 Catalyst switch platform, and the 7600 Internet router platform.
Contents
These release notes include important information and caveats for the Cisco Mobile Wireless Home Agent software feature provided in Cisco IOS 12.3(8)XW for the Cisco 7206 Series Internet Router, Cisco 7301 Series Internet Router, and the MWAM card on the 6500 Catalyst Switch and Cisco 7600 Series Router platforms.
Caveats for Cisco IOS Releases 12.3 can be found on Cisco.com at:
http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/prod_release_notes_list.html
Release notes for Cisco 7000 Family for Release 12.3T can be found on Cisco.com at:
http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/prod_release_notes_list.html
Release notes for the Cisco 6000 and 7600 Family for 12.3T can be found on Cisco.com at:
http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/prod_release_notes_list.html
This release note includes the following topics:
•
Obtaining Technical Assistance
Introduction
The Cisco Mobile Wireless Home Agent (HA) maintains mobile user registrations and tunnels packets destined for the mobile to the PDSN/FA. It supports reverse tunneling, and can securely tunnel packets to the PDSN using IPSec. Broadcast packets are not tunneled. Additionally, the HA performs both static and dynamic home address assignment for the mobile. Home address assignment can be from address pools configured locally, through either DHCP, ODSP, or AAA server access.
System Requirements
This section describes the system requirements for Cisco IOS Release 12.3(8)XW:
•
•
•
Memory Requirements
Table 1 shows the memory requirements for the Cisco Mobile Wireless Home Agent Software Feature Set that supports the Cisco 7206 Series Internet Router, Cisco 7301 Series Internet Router, and the MWAM on the 6500 Catalyst Switch and Cisco 7600 Series Router. The table also lists the memory requirements for the IP Standard Feature Set (for the Cisco Mobile Wireless Home Agent [HA]).
Hardware Supported
The Cisco IOS Release 12.3(8)XW is a release optimized for the Cisco Home Agent Release 2.0 feature on the Cisco 7206VXR router platform, and for the Cisco Multi-Processor WAN Application Module on the Cisco 6500 Catalyst Switch platform and the 7600 Internet Router platform.
For recommended hardware configuration, and for a complete list of supported interfaces on the 7200 platform, refer to the 12.3(8)XW Product Bulletin. If you require a different configuration you should consult with your Cisco representative before you order.
The recommended hardware configuration for Home Agent Release 2.0 is based on a Catalyst 6500 or 7600 chassis with a SUP2/MSFC2, and 512 MB of DRAM.
A Cisco IPSec Services Module (VPNSM) is required for hardware support of IPSec. VAMII is used for 7200 and the Cisco IPSec VPN Services Module is used for 6500/7600.
For a complete list of interfaces supported on 6500 and 7600 platforms, please refer to the on-line product information at Cisco.com home page. For hardware details on the 6500 and 7600 platforms, please refer to the Catalyst 6500 product specifications at http://www.cisco.com/en/US/products/hw/switches/ps708/index.html.
Software Compatibility
Cisco IOS Release 12.3(8)XW is a special release that is developed on Cisco IOS Release 12.3.
Cisco IOS Release 12.3(8)XW supports the same features that are in Cisco IOS Release 12.3, with the addition of the Cisco Home Agent Release 2.0 feature.
Determining the Software Version
To determine the version of Cisco IOS software running on your router, log in to the router and enter the show version EXEC command:
Router#show versionCisco Internetwork Operating System SoftwareIOS (tm) MWAM Software (MWAM-H1IS-M), Version 12.3(8)XW, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) Synched to technology version 12.3(8)TTAC Support: http://www.cisco.com/tacCopyright (c) 1986-2004 by cisco Systems, Inc.Upgrading to a New Software Release
For information on upgrading to a new software release, see the product bulletin Cisco IOS Software Upgrade Ordering Instructions located at:
http://www.cisco.com/warp/public/cc/pd/iosw/prodlit/957_pp.htm
MIBs
Old Cisco Management Information Bases (MIBs) will be replaced in a future release. Currently, OLD-CISCO-* MIBs are being converted into more scalable MIBs—without affecting existing Cisco IOS products or NMS applications. You can update from deprecated MIBs to the replacement MIBs as shown in Table 2.
Cisco IOS Feature Sets
The Cisco IOS software is packaged in feature sets consisting of software images—depending on the platform. Each feature set contains a specific set of Cisco IOS features.
Cisco IOS Release 12.3(8)XW supports the same feature sets as Cisco Release 12.2, with the exceptions that Cisco Release 12.3(8)XW includes the Cisco Home Agent Release 2.0 feature. The Home Agent Release 2.0 feature is optimized for the Cisco 7206 router, the Cisco 6500 Catalyst Switch, and the 7600 Internet Router.
Caution
Caveats
Caveats describe unexpected behavior in Cisco IOS software releases. Severity 1 caveats are the most serious caveats; severity 2 caveats are less serious.
Caveats for Cisco IOS Releases 12.2 can be found on CCO at http://www.cisco.com/en/US/docs/ios/12_2/release/notes/122mcavs.html
The"Open Caveats" section lists open caveats that apply to the current release and might also apply to previous releases.
The "Resolved Caveats" section lists caveats resolved in a particular release, which may have been open in previous releases.
Note
Open Caveats
The following caveats are unresolved in Cisco IOS Release 12.3(8)XW:
•
On a 7200 VXR NPE-G1 functioning as Home Agent, significant drops are observed on Gigabit interface thereby causing a drop in performance of the product.
Workaround: none.
•
On a Cisco router running Home Agent release 2.0, Proxy Mobile IP flow fails to come up for "New Session" Hot-lining.
Workaround: none.
•
Flapping of MOIP bindings, the RF lost its peer. After some time the process received unknown tracebacks were observed on console.
Workaround: none.
•
Clearing the VRF routing table using the clear ip route command also deletes the route corresponding to the Mobile Node.
Workaround: do not clear IP routes using the clear ip route command.
•
While opening and closing bindings on Home Agent (HA) at a high rate, both active and standby HAs reloaded.
The following sequence of events caused both the active and standby HAs to reload:
–
–
–
–
–
Workaround: none.
•
When a Home Agent is handling calls and traffic to simulate background load conditions, and a processor acting as active is forcibly made standby by shutting down the interface, NULLIDB Trace backs will appear.
Workaround: none.
•
The show ip mobile binding vrf summary command displays the wrong value under the following conditions:
–
–
–
–
Workaround: ensure that VRF configuration exists before opening bindings.
•
The active HA reloads on unconfiguring the HSRP interface address, after opening a binding for a user with dhcp-proxy-client.
The following conditions exist
a.
b.
c.
d.
e.
f.
Workaround: unconfigure the HSRP interface IP address only if there are no active flows.
•
Security-Association for the NAI is deleted when one of the flows are closed on HA under the following conditions:
–
–
–
Workaround: none.
•
Lease time is not in sync on the active and standby HAs. This will result in the active and standby HAs being out of sync.
The following conditions exist:
–
–
–
Additional issues causing subnet renewal problem after switchover include:
a.
b.
Workaround: avoid getting into the first condition by not switching over until the new active has a chance to renew the leases.
Once the first condition manifests itself, manually clear the affected subnet from the active and standby units.
•
Subnets do not sync from Active ODAP server to standby, after standby is reload.
When you open a large number of bindings, the leased subnets are available on both active and standby ODAP servers. Reload the standby server using the reload command. After the standby comes back it is not synching subnets from active.
Workaround: none.
•
Both active and standby HAs keeps reloading with Redundancy Framework (RF) induced reload, one after the other. This behavior started after the active HA reloaded and preempted.
Workaround: none.
•
The standby HA reloads when bindings are cleared while the standby exchanges HSRP state information with the active HA. This problem is very rare and was seen only once during testing.
The bindings on the standby HA are cleared after reloading the active HA.
Workaround: none.
•
Spurious memory access is seen when the ip mobile home-agent aaa user-password command is configured, and a user with default password "cisco" tries to down load a security association from AAA.
Workaround: use default password "cisco".
•
Security Associations are not downloaded when the ip mobile secure aaa-download rate 100 command is configured.
Workaround: do not use the ip mobile secure aaa-download rate 100 command on the HA image.
•
Alignment and spurious memory errors occur, and the HA may reload when bindings are cleared after a stress test as explained in the conditions below.
The errors are seen only when NAI related CLI (ip mobile host nai) is configured and unconfigured while mobiles are sending messages, traffic is flowing upstream through the sessions established by these nodes, and Change of Authorization messages are sent by the RADIUS server.
Workaround: do not change the NAI related configuration for a mobile while sessions are being brought up or down.
•
The standby ODAP server reloads without any Preempt configuration on active with RF interdev config.
The ODAP servers are configured with redundancy (HSRP and RF interdev configured). On reload of an active MWAM card, the standby processor will become active. After some time the current active server reloads without any preempt configured on original active processor.
Workaround: none.
•
In a redundant HA setup, during an upgrade, when the standby HA is brought down with the new R2.0 load and brought back to service with the active HA still running the R1.2 load, bindings do not get synched to the HA with R2.0 load.
The active HA complains about unsupported VendorID in the BindInfo Request Bulk synch message sent by the standby HA, and sends back BindInfo Reply with unknown CVSE-Type error.
Workaround: upgrade when no active bindings are present.
•
Hot Lining is not enabled for a NAI-based MN with static IP address allocation.
If the ip mobile host command is configured with nai, instead of configuring realm and specifying static IP address allocation, as below, Hot-lining is not enabled for that host.
Workaround: none.
•
On a Cisco router running Home Agent Release 2.0 Software in a redundant network, spurious memory access is observed on standby HA while opening and closing of bindings using DHCP.
The problem only occurs when IP address allocation is from DHCP.
Workaround: none.
•
On a Cisco router running Home Agent Release 2.0 Software "Null IDB" tracebacks are observed while opening bindings with DHCP.
The following sequence of actions lead to this issue:
–
–
–
–
Workaround: none.
•
On a Cisco router running Home Agent Release 2.0 Software in a redundant mode, the standby HA reloads intermittently when unconfiguring and configuring ip mobile host command.
Workaround: none.
•
In a redundant Home Agent network, the option to use RFC2002bis or RFC2002 style of authentication calculation (learned by the active HA on a per-PDSN basis) is not relayed to the standby HA.
Workaround: none.
•
When a routemap name is configured for mobile ip tunnels using the ip mobile tunnel route-map command, you cannot unconfigure the route-map using no ip mobile tunnel route-map.
Workaround: There is no workaround to unconfigure the route-map configuration. However, if the running-config with the this CLI has not been saved to the memory, the router can be reloaded.
•
The HA reloads while processing 32-byte key in 3gpp2 format. Currently, the HA accepts MN-HA-SHARED-KEY or hex format key in Cisco Av-pair attribute of length 16 bytes only.
The expected behavior for other length keys in this format is to reject the RRQ.
Workaround: Use the MN-HA-SHARED-KEY of max 16 bytes
•
In an Active-Standby configuration, where both active and standby has equal priority, after an active to standby transition, when a MIP flow is closed, the active HA reloads.
Workaround: none.
Unresolved Caveats Prior to IOS 12.3(8)XW
The following caveats were unresolved in Cisco IOS Release 12.3(7)XJ1, which was the release branch just prior to IOS 12.3(8)XW:
•
On a 7200 VXR NPE-G1 functioning as Home Agent, significant drops are observed on Gigabit interface thereby causing a drop in performance of the product.
Workaround: none.
•
When bindings are brought up and torn down on IPSEC tunnels for an extended periods of time using multiple iterations, a is seen.
Workaround: none.
•
n a Cisco router running Home Agent release R2.0, Proxy Mobile IP flow fails to come up for "New Session" Hot-lining.
Workaround: none.
•
When flapping (Open and Closing) of Mobile IP Bindings with ODAP, the RF lost its peer. This happens only under stressed conditions.
Workaround: configure path-retransmit, assoc-transmit timeouts to avoid this problem.
•
Flapping of MOIP bindings, the RF lost its peer. After some time the process received unknown tracebacks were observed on console.
Workaround: none.
•
When mobile IP bindings are opened over different tunnels, and each over IPSEC tunnel, if the router loaded with HA is left idle for around 5 hours, the IPSEC tunnel goes down.
Workaround: none.
•
Clearing the VRF routing table using the clear ip route command also deletes the route corresponding to the Mobile Node.
Workaround: do not clear IP routes using the clear ip route command.
•
When ODAP with HA redundancy is configured, the subnets on the Standby and Active may not match as observed from show ip dhcp pool.
Workaround: clear the mismatched subnets manually using clear ip dhcp pool pool-name subnet command.
•
When the interface configured with crypto map has interface link state changes (due to administratively shutting the interface, or link connectivity issues), crypto map is removed from the interface. The problem is observed when the ip mobile tunnel crypto map map-name command is configured.
Workaround: remove the ip mobile tunnel crypto map configuration.
•
While opening and closing bindings on Home Agent (HA) at a high rate, both active and standby HAs reloaded.
The following sequence of events caused both the active and standby HAs to reload:
–
–
–
–
–
Workaround: none.
•
When a Home Agent is handling calls and traffic to simulate background load conditions, and a processor acting as active is forcibly made standby by shutting down the interface, NULLIDB Trace backs will appear.
Workaround: none.
•
The show ip mobile binding vrf summary command displays the wrong value under the following conditions:
–
–
–
–
Workaround: ensure that VRF configuration exists before opening bindings.
•
The active HA reloads on unconfiguring the HSRP interface address, after opening a binding for a user with dhcp-proxy-client.
The following conditions exist
a.
b.
c.
d.
e.
f.
Workaround: unconfigure the HSRP interface IP address only if there are no active flows.
•
Security-Association for the NAI is deleted when one of the flows are closed on HA under the following conditions:
–
–
–
Workaround: none.
•
Lease time is not in sync on the active and standby HAs. This will result in the active and standby HAs being out of sync.
The following conditions exist:
–
–
–
Additional issues causing subnet renewal problem after switchover include:
a.
b.
Workaround: avoid getting into the first condition by not switching over until the new active has a chance to renew the leases.
Once the first condition manifests itself, manually clear the affected subnet from the Active and Standby units.
•
Subnets do not sync from Active ODAP server to standby, after standby is reload.
When you open a large number of bindings, the leased subnets are available on both active and standby ODAP servers. Reload the standby server using the reload command. After the standby comes back it is not synching subnets from active.
Workaround: none.
•
Both active and standby HAs keeps reloading with Redundancy Framework (RF) induced reload, one after the other. This behavior started after the active HA reloaded and preempted.
Workaround: none.
•
The standby HA reloads when bindings are cleared while the standby exchanges HSRP state information with the active HA. This problem is very rare and was seen only once during testing.
The bindings on the standby HA are cleared after reloading the active HA.
Workaround: none.
•
Spurious memory access is seen when the ip mobile home-agent aaa user-password command is configured, and a user with default password "cisco" tries to down load a security association from AAA.
Workaround: use default password "cisco".
•
Security Associations are not downloaded when the ip mobile secure aaa-download rate 100 command is configured.
Workaround: do not use the ip mobile secure aaa-download rate 100 command on the HA image.
•
Alignment and spurious memory errors occur, and the HA may reload when bindings are cleared after a stress test as explained in the conditions below.
The errors are seen only when NAI related CLI (ip mobile host nai) is configured and unconfigured while mobiles are sending messages, traffic is flowing upstream through the sessions established by these nodes, and Change of Authorization messages are sent by the RADIUS server.
Workaround: do not change the NAI related configuration for a mobile while sessions are being brought up or down.
•
The standby ODAP server reloads without any Preempt configuration on active with RF interdev config.
The ODAP servers are configured with redundancy (HSRP and RF interdev configured). On reload of an active MWAM card, the standby processor will become active. After some time the current active server reloads without any preempt configured on original active processor.
Workaround: none.
•
In a redundant HA setup, during an upgrade, when the standby HA is brought down with the new R2.0 load and brought back to service with the active HA still running the R1.2 load, bindings do not get synched to the HA with R2.0 load.
The active HA complains about unsupported VendorID in the BindInfo Request Bulk synch message sent by the standby HA, and sends back BindInfo Reply with unknown CVSE-Type error.
Workaround: upgrade when no active bindings are present.
•
Hot Lining is not enabled for a NAI-based MN with static IP address allocation.
If the ip mobile host command is configured with nai, instead of configuring realm and specifying static IP address allocation, as below, the Hot lining is not enabled for that host.
Workaround: none.
•
On a Cisco router running Home Agent R2.0 Software in a redundant network, spurious memory access is observed on standby HA while opening and closing of bindings using DHCP.
The problem only occurs when IP address allocation is from DHCP.
Workaround: none.
•
On a Cisco router running Home Agent software R2.0 in a redundant mode, HSRP operation stops working after changing interface on active HA into Shutdown state. When the HSRP interface on active HA is shutdown, the HRSP state of standby HA does not change to Active. The original active HA also still remains in the active state.
Workaround: none.
•
On a Cisco router running Home agent R2.0 Software 'Null IDB' trace backs are observed while opening bindings with DHCP.
The following sequence of actions lead to this issue:
–
–
–
–
Workaround: none.
•
On a Cisco router running Home agent R2.0 Software in a redundant mode, the standby HA reloads intermittently when unconfiguring and configuring ip mobile host command.
Workaround: none.
•
On Cisco router running Home Agent software release R2.0, for small sized data packet (example 36, 48 bytes), the packets do not get redirected even though the flow is actively hotlined.
This problem is observed only for small sized packets and is not seen if the packet is of size 100 or greater.
Workaround: none.
•
In a redundant Home Agent Network, the option to use RFC2002bis or RFC2002 style of Authentication calculation (learned by the active HA on a per-PDSN basis) is not relayed to the standby HA.
Workaround: none.
•
On Cisco router running Home Agent software release R2.0, Mobile IP route-map cannot be unconfigured and then re-configured using the ip mobile tunnel route-map command.
Workaround: none.
•
The HA reloads while processing 32-byte key in 3gpp2 format. Currently, the HA accepts MN-HA-SHARED-KEY or hex format key in Cisco Av-pair attribute of length 16 bytes only.
The expected behavior for other length keys in this format is to reject the RRQ.
Workaround: Use the MN-HA-SHARED-KEY of max 16 bytes
Open Caveats Prior to Cisco IOS Release 12.3(7)XJ1
The following caveats are unresolved in Cisco Release 12.3(7)XJ:
•
With NAI-based debug condition set, the debugs pertaining to Parsing of authentication extension in MIP RRQ are not printed.
The problem is observed when a NAI based condition is set to filter the debugs.
Workaround: either set the ip address based condition to filter debugs, or do not set any debug conditions.
•
Once an active HA is reloaded, the standby HA is not able to renew the DHCP lease, and eventually the Mobile ip binding gets deleted on the HA.
On reload the active HA returns the address to the DHCP server. This happens after the standby renews the lease time, to which DHCP binding gets deleted from the Server; thus further renewals fail.
Workaround: none
•
When bindings are brought up and torn down on IPSEC tunnels for an extended periods of time using multiple iterations, memory leak of 0.8MB to 1MB is seen.
When 235k bindings are opened and closed, a memory leak of 0.8 MB is observed in each iteration. The 235k bindings are opened over 40 IPSEC tunnels (and 40 Mobile IP tunnels).
Workaround: none
•
When flapping (Open and Closing) of Mobile IP Bindings with ODAP, the RF lost its peer. This happens only under stress conditions.
Workaround: to avoid this problem, configure path-retransmit and assoc-transmit timeouts.
•
Flapping of MOIP bindings, RF lost its peer. After some time, process received unknown tracebacks observed on console.
Workaround: none.
•
When an HA that has MobileIP bindings, opened over different Mobile IP tunnels and also over different IPSEC tunnels, is left idle for 5 hours, the IPSEC tunnel goes down while Mobile IP binding and tunnel still exist.
Workaround: none.
•
When ODAP with HA redundancy is configured, the subnets on the standby and active may not match as observed from show ip dhcp pool.
Workaround: clear the mismatched subnets manually using the clear ip dhcp pool pool-name subnet command.
•
Clearing the VRF routing table with the clear ip route command also deletes the route corresponding to the Mobile Node.
Workaround: Do not clear IP routes with the clear ip route command.
•
When an interface with crypto map has interface link state changes (for example, administratively shutting the interface, or link connectivity issues), crypto map is removed from the interface and the crypto map CLI is deleted from the interface. The crypto map command should not be removed from the interface.
Workaround: none.
•
While opening and closing bindings on Home Agent (HA) at a high rate, both active and standby HAs reloaded.
The following sequence of events result in a reload of both Active and Standby HA:
a.
b.
c.
d.
e.
Workaround: none.
•
When a Home Agent is handling calls and traffic to simulate background load conditions, and a processor acting as active is forcibly made standby by shutting down the interface, NULLIDB Trace backs will appear.
Workaround: do not shut the active interfaces, such as interface between the HA-FA, and the HA-RADIUS.
•
After you open a binding for a user with dhcp-proxy-client, the active HA reloads if you unconfigure the hsrp interface address.
The following conditions exist:
a.
b.
c.
d.
e.
f.
Workaround: Unconfigure the hsrp interface IP address only if there are no active flows.
•
The show ip mobile binding vrf summary command displays the wrong value under the following conditions:
–
–
–
–
Workaround: ensure that VRF configuration exists before opening bindings.
•
When dhcp-proxy-client address allocation is used on lease expiry, although the address is returned back to the pool, the Mobile IP binding is not deleted.
Workaround: none.
•
Security-Association for the NAI is deleted when one of the flows are closed on the HA.
The following conditions exist:
–
–
–
Workaround: none.
•
Lease time is not in sync on active and standby HAs. This causes the active and standby HAs to be out sync.
The following conditions exist:
–
–
–
Workaround: none.
•
Subnets do not sync from active ODAP server to standby, after standby is reloaded.
This condition exists when you open 25 k bindings. Leased subnets are available on both the active and standby ODAP server. Reload the standby server using the reload command. After the standby comes back up it is not synching subnets from the active.
Workaround: none.
•
Both active and standby HAs keep reloading with RF-induced reload, one after the other. This behavior started after active HA reloaded and Preempted.
Workaround: none.
•
The standby HA reloads when bindings are cleared while the standby exchanges HSRP state information with the active HA. This problem is very rare and was seen only once during testing.
The bindings on standby HA are cleared after reloading the active HA.
Workaround: none.
•
Spurious memory access is seen when the ip mobile home-agent aaa user-password command is configured, and a user with default password "cisco" tries to download a security association from AAA.
Workaround: use default password "cisco".
•
Unconfiguring the ip mobile host command fails when configured for a Non-NAI user on a virtual-network. This condition arises only when you unconfigure the command specifying the whole CLI.
Workaround: use only a partial configuration (for example, no ip mobile host x.x.x.x to unconfigure the command.
•
Alignment and spurious memory errors occur and the HA may reload when bindings are cleared after a stress test.
The errors are seen only when the NAI-related ip mobile host nai command is configured and unconfigured while mobiles are sending messages, traffic is flowing upstream through the sessions established by these nodes, and Change of Authorization messages are sent by the RADIUS server.
Workaround: do not change the NAI related configuration for a mobile while sessions are being brought up or down.
•
Security Associations are not downloaded when the ip mobile secure aaa-download rate 100 command is configured.
Workaround: Do not use the ip mobile secure aaa-download rate 100 command on the HA image.
•
The standby ODAP server reloads without any Preempt configuration on active with RF interdev configuration.
The ODAP Servers are configured with redundancy (HSRP and RF interdev configured). On reload of the active MWAM card, the standby processor will become active. After some time the current active server reloads without any preempt configured on original active processor.
Workaround: none.
•
In a redundant HA setup during an upgrade, when the standby HA is brought down with the new R2.0 load and brought back to service with the Active HA still running R1.2 load, bindings do not get synched to the HA with R2.0 load.
The Active HA complains about unsupported VendorID in the BindInfo Request Bulk synch message sent by the Standby HA and sends back BindInfo Reply with unknown CVSE-Type error.
Workaround: upgrade when no active bindings are present.
•
The active HA releases the DHCP address for the binding when the HSRP interface of standby HA goes down (when proxy DHCP allocation is configured).
This condition is observed when the Standby HA's HSRP interface is shut down, while the active and standby has active Mobileip bindings with dynamic allocation using proxy DHCP.
Workaround: none
•
The HA reloads while processing 32-byte key in 3gpp2 format. Currently, the HA accepts MN-HA-SHARED-KEY or hex format key in "Cisco Av-pair" attribute of length 16 bytes only.
The expected behavior for other length keys in this format is to reject the RRQ.
Workaround: Use MN-HA-SHARED-KEY of max 16 bytes
•
When HA-SLB operates in dispatched mode, it forwards MIP RRQs to the real HAs without changing the destination IP address. So when HAs receive RRQs with non-zero Home-agent address the destination IP address will be that of the SLB virtual server. The binding is established but the HA sends back an RRP with the destination ip address of the received packet as the home-agent address regardless of the home-agent address in the RRQ. So the tunnel is established between the FA and the vserver addr.
Subsequent re/de-registrations are sent to HA-SLB instead of the HA. The SLB drops the de- registrations as the lifetime is zero and can forward the re-registrations to some other HA. So the concerned HA may/will not get the re/de-registrations.
Workaround: Do not use HA-SLB in dispatched mode when the incoming RRQs have a non-zero home-agent address.
Resolved Caveats
The following caveats are resolved in Cisco Release 12.3(8)XW:
•
When ODAP with HA redundancy is configured, the subnets on the standby and active may not match as observed from the show ip dhcp pool command.
Workaround: clear the mismatched subnets manually using clear ip dhcp pool pool-name subnet command.
•
When the interface configured with crypto map has interface link state changes (due to administratively shutting the interface, or link connectivity issues), crypto map is removed from the interface. The problem is observed when the ip mobile tunnel crypto map map-name command is configured.
Workaround: remove the ip mobile tunnel crypto map configuration.
•
On Cisco router running Home Agent software release 2.0, for small sized data packet (example 36, 48 bytes), the packets do not get redirected even though the flow is actively hotlined.
This problem is observed only for small sized packets and is not seen if the packet size is 100 or greater.
Workaround: none.
•
In a redundant HA setup when standby HA come up and downloads the bind info from active HA, the Lifetime remaining on standby HA is reset back to the initial value. This leads to discrepancies in lifetime values on the active and standby HAs. This problem is seen when a bulksync happens between the standby and active HA.
Workaround: none.
•
On a Cisco 7200/7600 router running Home Agent Release 2.0 Software, CPU HOG is observed when synching of subnets from active to standby. The problem is observed in a redundant HA setup with a preempt configuration, and with address allocation from ODAP.
Workaround: none.
Resolved Caveats Prior to Cisco IOS 12.3(8)XW
The following caveats are resolved in Cisco Release 12.3(7)XJ1, which was the branch release just prior to the Cisco IOS 12.3(8)XW release:
•
On the Cisco HA image, with NAI based debug condition set, the debugs pertaining to parsing of authentication extension in MIP RRQ are not printed.
The above-mentioned problem is observed when a NAI-based condition is set to filter the debugs.
Workaround: The workaround is as follows:
a.
b.
•
Once the active HA is reloaded, the Standby HA is not able to renew the DHCP lease, and eventually the Mobile IP binding gets deleted on the HA.
On reload, the active HA returns the address to DHCP server. This happens after the standby renews the lease time due to which DHCP binding gets deleted from the Server. Thus further renewals fail.
Work around: none.
•
The problem is seen on Cisco routers running Home Agent R2.0 software in a redundant network. When a binding is deleted on the active Home Agent due to receipt of Radius Disconnect message, it does not automatically delete the corresponding binding on standby Home Agent.
Workaround: none.
•
A Cisco router running the Home Agent in a redundant mode does not synch the bindings deleted due to clear command to the peer HRSP Home Agent.
Workaround: none.
•
On a Cisco MWG Home Agent running R2.0 image, when dhcp-proxy-client address allocation is used (on lease expiry), although the address is returned back to the pool, the Mobile IP binding is not deleted.
Workaround: none.
•
Mobile nodes which can not ignore NVSE may fail initial registration because of the inclusion of a Prefix length NVSE.
Workaround: none.
•
Home Agent rejects Registration Request (RRQ) from mobile when Home Agent address is configured on Loopback interface and address allocation for the mobile is done from local pool.
Workaround: do not configure the Home Agent address as a Loopback address.
The problem is seen because configuring the Home Agent address under Loopback interface treats the redundancy setup in a peer-to-peer mode. In this mode, loop pool is not allowed for redundancy.
This issue is solved by adding a new mode active-standby variable in the ip mobile home-agent redundancy command.
•
A Cisco router running the Cisco Home Agent (HA), always sends out Registration revocation message with Authentication extension (AE) as described in RFC 3012bis. The HA should be able to append the AE in RFC 3012 or RFC 3012bis format on a per PDSN basis.
Workaround: none.
•
In a redundant Home Agent network, the standby HA intermittently reloads while processing the Bindupdate from the active unit during sync process.
Workaround: none.
•
The clock summer-time configuration is not synced from supervisor to MWAM processor, while clock timezone is being synced alright. So, the timezone on the MWAM processor is wrong during daylight savings time.
This problem occurs when the clock sumer-time command is configured on the supervisor.
Workaround: none.
•
In a redundant HA setup, when standby HA come up and downloads the bind info from Active, the lifetime remaining on Standby HA is reset back to the initial value. This leads to discrepancy in lifetime values on Active and standby HA.
This problem is seen when a bulk synch happens between the standby and active.
Workaround: none.
•
Tracebacks, due to alignment error, can be seen on Home Agent while opening Proxy Mobile IP flows when ip mobile debugging is turned on.
The problem is observed only for Proxy Mobile IP flows and IP mobile debugging is turned on.
Workaround: do not enable IP mobile debugging.
•
The Cisco Home Agent reloads on receiving Registration Revocation message when the Revocation feature is enabled, but the Foreign Home (FH) Security Association (SA) is not configured.
Workaround: configure FH SA when enabling the registration revocation feature.
•
In a redundant Home Agent network, the active HA reloads when the standby downloads mobileip bindings and security associations after it goes down and comes back up. The program counter gets corrupted and causes the Home Agent to reload.
Workaround: none.
•
When HA-SLB operates in dispatched mode, it forwards MIP RRQs to the real HAs without changing the destination IP address. So, when the HAs receive RRQs with non-zero Home-agent addresses, the destination IP address will be that of the SLB virtual server.
The binding is established, but the HA sends back an RRP with the destination IP address of the received packet as the home-agent address regardless of the home-agent address in the RRQ. So the tunnel is established between the FA and the vserver address.
Subsequent re/de-registrations are sent to HA-SLB instead of the HA. The SLB drops the de-registrations as the lifetime is zero, and can forward the re-registrations to some other HA. So the concerned HA may or will not get the re/de-registrations.
Workaround: Do not use HA-SLB in dispatched mode when the incoming RRQs have a non-zero home-agent address.
•
Requirement 1: When not using the unknown-ha CLI option, debug error message displayed for RRQ (where the Home Agent address is not right) is incorrect. Proper debug message needs to be printed under such conditions.
Requirement 2: In this case, the HA should return to the PDSN with "unknown HA" as the error code in RRP.
Workaround: none.
•
Better debug messages are required on the HA to display the details about the registration reply message contents and options sent back in the reply.
Workaround: none.
•
In the current implementation on R2.0 HA, Mobile IP Registration Revocation feature is not supported with HA redundancy. Support for the Resource Revocation feature with HA redundancy is required.
Workaround: none.
•
On a Cisco router running Release 2.0 Home Agent software, in rare situations, an incorrect value is sent for the STC attribute in a Radius Access-Request message, when RADIUS disconnect capability is enabled on PDSN.
Workaround: none.
•
If configured in hex format, the MN-HA shared key should always be 16bytes long. A hex key with length less than 16 bytes results in authentication failure.
Workaround: Use key format as string instead of hex.
•
As per IS835C, the HA should provide enable or disable radius disconnect capabilities for a session based on the STC attribute value authorized for the user by the AAA. In the current implementation, the STC attribute received in the Access-Accept message from AAA is not used to enable or disable the radius disconnect capability per user. Currently, the capability can be enabled or disabled at the box level.
Workaround: none.
•
The unknown-ha accept option in the ip mobile home-agent unknown-ha accept CLI is not working as expected. The Home Agent rejects the Mobile IP registration request (RRQ) with error code "Unknown HA", instead of accepting the RRQ.
Workaround: none.
Related Documentation
Except for feature modules, documentation is available as printed manuals or electronic documents. Feature modules are available online on CCO and the Documentation CD-ROM.
Use these release notes with these documents:
•
Release-Specific Documents
The following documents are specific to Cisco IOS Release 12.3(8)XW:
•
http://www.cisco.com/en/US/products/ps5940/tsd_products_support_series_home.html
The following documents are specific to Release 12.3 and are located on Cisco.com:
•
http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/prod_release_notes_list.html
•
http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/prod_release_notes_list.html
Note
•
http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/tsd_products_support_eol_series_home.html
Platform-Specific Documents
Documentation specific to the Cisco 7206 Router is located at the following locations:
•
Documentation specific to the Cisco 7600 Router is located at the following location:
•
Documentation specific to the Cisco Catalyst 6500 Switch is located at the following location:
•
Feature Modules
Feature modules describe new features supported by Release 12.3 and are updates to the Cisco IOS documentation set. A feature module consists of a brief overview of the feature, benefits, configuration tasks, and a command reference. As updates, the feature modules are available online only. Feature module information is incorporated in the next printing of the Cisco IOS documentation set.
Cisco IOS Software Documentation Set
The Cisco IOS software documentation set consists of the Cisco IOS configuration guides, Cisco IOS command references, and several other supporting documents that are shipped with your order in electronic form on the Documentation CD-ROM, unless you specifically ordered the printed versions.
Documentation Modules
Each module in the Cisco IOS documentation set consists of two books: a configuration guide and a corresponding command reference. Chapters in a configuration guide describe protocols, configuration tasks, Cisco IOS software functionality, and contain comprehensive configuration examples. Chapters in a command reference provide complete command syntax information. Use each configuration guide with its corresponding command reference.
On CCO, two master hot-linked documents provide information for the Cisco IOS software documentation set.
On CCO at:
•
•
Release 12.3 Documentation Set
Note
On CCO at:
http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/tsd_products_support_eol_series_home.html
Note
Obtaining Documentation
Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation from the Support and Documentation page at this URL:
http://www.cisco.com/cisco/web/support/index.html
You can access the Cisco website at this URL:
You can access international Cisco websites at this URL:
http://www.cisco.com/public/countries_languages.shtml
Ordering Documentation
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0.
Documentation Feedback
You can send comments about technical documentation to bug-doc@cisco.com.
You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883We appreciate your comments.
Obtaining Technical Assistance
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, Cisco Technical Support provides 24-hour-a-day, award-winning technical assistance. The Cisco Technical Support Website on Cisco.com features extensive online support resources. In addition, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not hold a valid Cisco service contract, contact your reseller.
Cisco Technical Support Website
The Cisco Technical Support Website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, 365 days a year at this URL:
http://www.cisco.com/techsupport
Access to all tools on the Cisco Technical Support Website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:
http://tools.cisco.com/RPF/register/register.do
Submitting a Service Request
Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool automatically provides recommended solutions. If your issue is not resolved using the recommended resources, your service request will be assigned to a Cisco TAC engineer. The TAC Service Request Tool is located at this URL:
http://www.cisco.com/techsupport/servicerequest
For S1 or S2 service requests or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco TAC engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.
To open a service request by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553 2447For a complete list of Cisco TAC contacts, go to this URL:
http://www.cisco.com/techsupport/contacts
Definitions of Service Request Severity
To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.
Severity 1 (S1)—Your network is "down," or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.
Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Severity 3 (S3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
•
http://www.cisco.com/go/marketplace/
•
http://www.cisco.com/en/US/products/index.html
•
•
•
•
http://www.cisco.com/en/US/learning/index.html
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0403R)
Copyright © 2004, Cisco Systems, Inc.
All rights reserved.
