Table Of Contents
Release Notes for the Cisco Broadband Wireless Gateway 2.1 for Cisco IOS Release 12.4(24)YG1
Determining the Software Version
Features Introduced Before Cisco IOS Release 12.4(24)YG1
Obtaining Documentation, Obtaining Support, and Security Guidelines
Release Notes for the Cisco Broadband Wireless Gateway 2.1 for Cisco IOS Release 12.4(24)YG1
Published: December 18, 2009Revised: December 18, 2009, OL-21495-01
Cisco IOS Release 12.4(24)YG1 is a special release that is based on Cisco IOS Release12.4, with the addition of enhancements to the Cisco Broadband Wireless Gateway (BWG) feature. The Cisco IOS Release 12.4(24)YG1 is a release optimized for the Cisco 7600 Internet router platform with the Cisco SAMI blade.
Contents
These release notes include important information and caveats for the Cisco BWG 2.1 software feature provided in Cisco IOS Release12.4(24)YG1 for the SAMI card on the Cisco 7600 Series Router platform.
Release notes for the Cisco 7600 Family for Release 12.4 can be found on Cisco.com at:
http://www.cisco.com/en/US/products/ps6441/prod_release_notes_list.html
This release note includes the following topics:
•
Features Introduced Before Cisco IOS Release 12.4(24)YG1
•
Introduction
The Cisco BWG functions in the gateway role in WiMax Access Service Network. WiMAX is a standards-based wireless technology that offers high throughput broadband connections over long distances. WiMAX can be used for a number of applications, including "last mile" broadband connections, hotspots and cellular backhaul, fixed and mobile cellular service, and high-speed enterprise connectivity for business.
The Cisco BWG colocates both the Decision and Enforcement Points (DP and EP), and acts as an interface to the Base-stations in each Access Services Network (ASN).
The BWG is the key to the IP mobility scheme. It provides the termination of the mobility function across base-stations and the foreign agent function. The BWG maps the radio bearer to the IP network. It works with the CSN and the policy servers to control policy on behalf of the user. Additionally, it acts as an IP gateway for the IP host function that is located on the Base Station. The BWG brings together IP functions performed for the access network including end-to-end Quality of Service, Mobility and Security.
•
http://www.cisco.com/en/US/products/ps6441/tsd_products_support_series_home.html
–
–
–
The Supervisor 720 is supported, both in single and redundant mode. For the Supervisor 720, the 3B and 3BXL versions are supported, with the latter recommended and tested.
The Supervisor 32 is also supported in this release.
•
http://www.cisco.com/en/US/products/ps6441/tsd_products_support_series_home.html
–
–
The BWG can co-exist with CSG2 and the HA on co-located blades.
System Requirements
The following sections list the BWG system requirements.
Memory Requirements
Table 1 shows the memory requirements for the BWG Software Feature Set is supported on the Cisco SAMI card on the Cisco 7600 Series Router platform.
Hardware Supported
Cisco IOS Release 12.4(24)YG1 is optimized for the Cisco BWG feature on the SAMI card on the Cisco 7600 Series Router platform.
A Hardware-Software Compatibility Matrix is available on Cisco.com for users with Cisco.com login accounts. This matrix allows users to search for supported hardware components by entering a Cisco platform and IOS Release. The Hardware-Software Compatibility Matrix tool is available at the following URL:
http://www.cisco.com/pcgi-bin/front.x/Support/HWSWmatrix/hwswmatrix.cgi
Software Compatibility
Cisco IOS Release 12.4(24)YG1 is a special release that is developed on Cisco IOS Release 12.4.
Cisco IOS Release 12.4(24)YG1 supports the same features that are in Cisco IOS Release 12.4, with the addition of the Cisco BWG feature.
Determining the Software Version
To determine the version of Cisco IOS software running on your router, log in to the router and enter the show version EXEC command.
SUP Backward Compatibility
The BWG Release 2.1 on the Cisco 7600 hardware platform requires SUP software version SRE. However, BWG Release 2.1 will also work with limited features with an earlier SUP software version SRD.
In order to make BWG 2.1work with an earlier version of SUP-SRD, configure the following hidden CLI at the global configuration mode:
Step 1
router(config)# wimax agw sup-backward-compatible
Specifies that the BWG will work with the SRD Supervisor image.
With SUP-SRD, BWG Release 2.1 will primarily be used for Cisco-R6, PMIP, and other BWG1.x features.
Note
•
•
Features Introduced Before Cisco IOS Release 12.4(24)YG1
The following features were introduced and supported on the BWG prior to Cisco IOS Release 12.4(24)YG1:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Limitations and Restrictions
The following limitations and restrictions apply to the Cisco BWG feature in Cisco IOS Release 12.4(24)YG1:
•
–
–
Caveats
Caveats describe unexpected behavior in Cisco IOS software releases. Severity 1 caveats are the most serious caveats; severity 2 caveats are less serious.
Caveats for Cisco IOS Releases 12.4 can be found on Cisco.com at:
http://www.cisco.com/en/US/products/ps6441/prod_release_notes_list.html
The Open Caveats section lists open caveats that apply to the current release and might also apply to previous releases.
The Resolved Caveats section lists caveats resolved in a particular release, which may have been open in previous releases.
Note
Open Caveats
The following caveats are unresolved in Cisco IOS Release 12.4(24)YG1:
•
The VTP feature in certain versions of Cisco IOS software is vulnerable to a locally-exploitable buffer-overflow condition. This might result in the execution of arbitrary code. On the 13th September 2006, Phenoelit Group posted an advisory containing the following vulnerabilities:
–
–
–
These vulnerabilities are addressed by Cisco IDs:
–
–
–
An advisory on these vulnerabilities is posted at: http://www.cisco.com/warp/public/707/cisco-sr-20060913-vtp.shtml
•
FP emulation library (libgcc_math.c & libgcc_longlong.h) needs to be removed from shr-ukernel.
•
On single IP applications, LCP fails to reload a SAMI card if the show gprs gtp pdp all command is run when two PPCs have crashed simultaneously.
To work around this issue, reload the card explicitly either from SUP or from LCP.
Resolved Caveats
The following caveats are resolved in BWG 2.1 for Cisco IOS Release 12.4(24)YG1:
•
To avoid IP address conflicts, BWG should verify the host IP address against the interface IP addresses configured in the BWG.
•
During a CoA(hotlining) transition, BWG fails to send the Session-Continue attribute.
When BWG receives a CoA, an accounting stop and an accounting start message is sent to the AAA server with the Hotline indication attribute. A Session-Continue attribute (as defined in NWG) is not sent. Therefore, the AAA terminates the session after receiving the accounting stop message.
•
BWG ignores the results of uplink service flow reservation in the path registration response message(PATH_REG_RSP). Therefore, fails to deregister sessions.
When a base station (BS) sends a service-flow (downlink or uplink) reservation result with errors, for ISF or critical flows, the session should be deregistered. Currently, the BWG checks only the downlink service-flow reservation result for errors. As a result, if the uplink service flow reservation result contains errors, and the downlink service flow reservation result does not contain any error, the session is not deregistered.
•
BWG fails to disable user-group Subscriber Multi Host on an SMX modem in a WiMax setup.
•
The SR-standby BWG crashes while initiating authenticated calls.
When a user-name vendor sepcific attributes (VSA) is created on Access-Accept from AAA, the attribute synchronization to SR-standby may cause BWG to crash. However, when the SR-standby BWG re-starts, it successfully synchronizes with the SR- active and becomes operational.
•
BWG fails to set the correct value for account terminate cause parameter in an accounting stop message to AAA. For example, when a session is terminated by a PoD message (Packet of Disconnect Message) from AAA, BWG should set Acct-Terminate-Cause[49]=user-request in an accounting stop message to AAA.
•
BWG crashes when a large number of Proxy Mobile IP (PMIP) subscribers are cleared from BWG using the following commands:
–
–
–
To workaround this issue, avoid clearing large number of PMIP subscribers from BWG, and use the R6 Keepalive mechanism for BWG and BS to stay in sync.
•
User-group names are not consistently case-sensitive in BWG.
For example, when modifying the user-group configuration, the user-group name is case-insensitive. But, when matching the user-realm and user-group during authentication, the user-group name is case-sensitive.
For BWG 2.1 and later, the user-group name is not case sensitive.
•
While deploying CoA and hotlining, BWG sends malformed accounting packets to the AAA server when the CoA request does not have the hotline-indication attribute.
•
BWG 2.0 crashes while processing UDP packets in a WiMax environment when the registration request is replayed when the source base station and the target base station are same.
•
When the base station sends an error in service-flow reservation result for ISF or critical flows, the session should be de-registered. BWG fails to deregister sessions when the uplink service flow fails.
•
A vulnerability that exists in the Fast Ethernet driver code of UC520, Cisco 880 series, Cisco VG202, Cisco VG204, IAD2435-8FXS and Cisco 1861 routers may cause unexpected CPU errors. This vulnerablity might also stop some of these routers from establishing L2TPv3 sessions.
•
Devices running Cisco IOS Software and configured for Cisco Unified Communications Manager Express (CME) or Cisco Unified Survivable Remote Site Telephony (SRST) operation are affected by two denial of service vulnerabilities that may result in a device reload if successfully exploited. The vulnerabilities are triggered when the Cisco IOS device processes specific, malformed Skinny Call Control Protocol (SCCP) messages.
Cisco has released free software updates that address these vulnerabilities. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20100324-cucme.shtml
•
When SIP is enabled, IOS device might crash while processing an incoming SIP message.
•
Recent versions of Cisco IOS Software support RFC4893 ("BGP Support for Four-octet AS Number Space") and contain two remote denial of service (DoS) vulnerabilities when handling specific Border Gateway Protocol (BGP) updates.
These vulnerabilities affect only devices running Cisco IOS Software with support for four-octet AS number space (here after referred to as 4-byte AS number) and with BGP routing configured.
The first vulnerability could cause an affected device to reload when processing a BGP update that contains autonomous system (AS) path segments that are made up of more than one thousand autonomous systems.
The second vulnerability could cause an affected device to reload when the affected device processes a malformed BGP update that has been crafted to trigger this issue.
Cisco has released free software updates to address these vulnerabilities. This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20090729-bgp.shtml
•
Cisco IOS software crashes and reloads if the device receives a malformed ICMPv6 neighbor solicitation message, when IPV6 is active on one or more interfaces.
•
After a dynamic PMIP session is established and then closed, active BWG crashes if service wimax agw is configured immediately after unconfiguring it.
The following caveats were resolved in Cisco IOS Release 12.4(24)YG:
•
A vulnerability exists in Cisco IOS software where an unauthenticated attacker could bypass access control policies when the Object Groups for Access Control Lists (ACLs) feature is used. Cisco has released free software updates that address this vulnerability. There are no workarounds for this vulnerability other than disabling the Object Groups for ACLs feature. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090923-acl.shtml.
•
A vulnerability exists in Cisco IOS software where an unauthenticated attacker could bypass access control policies when the Object Groups for Access Control Lists (ACLs) feature is used. Cisco has released free software updates that address this vulnerability. There are no workarounds for this vulnerability other than disabling the Object Groups for ACLs feature. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090923-acl.shtml.
•
Cisco IOS Software configured with Authentication Proxy for HTTP(S), Web Authentication or the consent feature, contains a vulnerability that may allow an unauthenticated session to bypass the authentication proxy server or bypass the consent webpage.
There are no workarounds that mitigate this vulnerability.
This advisory is posted at the following link:
http://www.cisco.com/warp/public/707/cisco-sa-20090923-auth-proxy.shtml
•
The H.323 implementation in Cisco IOS Software contains a vulnerability that can be exploited remotely to cause a device that is running Cisco IOS Software to reload. Cisco has released free software updates that address this vulnerability. There are no workarounds to mitigate the vulnerability apart from disabling H.323 if the device that is running Cisco IOS Software does not need to run H.323 for VoIP services. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090923-h323.shtml.
•
A vulnerability exists in the Session Initiation Protocol (SIP) implementation in Cisco IOS Software that could allow an unauthenticated attacker to cause a denial of service (DoS) condition on an affected device when the Cisco Unified Border Element feature is enabled. Cisco has released free software updates that address this vulnerability. For devices that must run SIP there are no workarounds; however, mitigations are available to limit exposure of the vulnerability. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090923-sip.shtml.
•
Cisco IOS Software contains a vulnerability that could allow an attacker to cause a Cisco IOS device to reload by remotely sending a crafted encryption packet. Cisco has released free software updates that address this vulnerability. This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090923-tls.shtml.
•
Cisco devices running affected versions of Cisco IOS Software are vulnerable to a denial of service (DoS) attack if configured for IP tunnels and Cisco Express Forwarding.
Cisco has released free software updates that address this vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20090923-tunnels.shtml.
Related Documentation
Except for feature modules, documentation is available in electronic form. Feature modules are available online on Cisco.com.
Use these release notes with these documents:
Release-Specific Documents
•
http://www.cisco.com/en/US/docs/ios/12_4/12_4y/12_4_24yg/bwg_2_0/feature_guide/124xl5feat.html
•
http://www.cisco.com/en/US/docs/ios/12_4/12_4y/12_4_24yg/bwg_2_0/command_ref/bwg2_0_cr.html
Platform-Specific Documents
•
http://www.cisco.com/en/US/products/hw/routers/ps368/prod_installation_guides_list.html
–
–
–
The Supervisor 720 is supported, both in single and redundant mode. For the Supervisor 720, the 3B and 3BXL versions are supported, with the latter recommended and tested.
The Supervisor 32 is also supported in this release.
Obtaining Documentation, Obtaining Support, and Security Guidelines
For information on obtaining documentation, obtaining support, providing documentation feedback, security guidelines, and also recommended aliases and general Cisco documents, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0910R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2009 Cisco Systems, Inc. All rights reserved.
