Table Of Contents
Release Notes for Cisco BBSM 5.3 Service Pack 2
Patches Included in BBSM 5.3 SP2
Microsoft Hotfixes Included in BBSN 5.3 SP2
Caveats Resolved By BBSN 5.3 SP2
Changes Affecting the Cisco BBSM 5.3 Software Installation Guide
Changes Affecting the BBSM Network Device Compatibility Guide
Changes Affecting the Cisco BBSM 5.3 SP1 Configuration Guide
Changes to Figure 3-4 on Page 3-8
IP Spoofing Workaround for Switches
IP Spoofing Workaround for Access Points
Increasing the DHCP Lease Time
Cisco Product Security Overview
Reporting Security Problems in Cisco Products
Obtaining Technical Assistance
Cisco Technical Support Website
Definitions of Service Request Severity
Obtaining Additional Publications and Information
Release Notes for Cisco BBSM 5.3 Service Pack 2
March 2005
OL-7303-01These release notes describe the Cisco Building Broadband Service Manager (BBSM) 5.3 Service Pack 2 (SP2), which includes:
•
Ten BBSM patches (see Patches Included in BBSM 5.3 SP2)
•
•
•
•
SP2 is released as a web patch on Cisco.com and is incorporated into the default image shipped with the HP/Compaq D530 and Quanta S19 platforms. SP2 is not dependent on any other BBSM patch or service pack, and can be installed on any BBSM 5.3 server. This service pack (BBSM53SP2.exe) is also known as Patch 5325.
Note
Contents
•
•
•
•
•
•
•
Installation
This service pack can be installed locally onto any BBSM 5.3 server with Internet access or remotely onto multiple BBSM servers from another computer.
Caution
Follow these steps to install BBSM 5.3 SP2 onto your BBSM 5.3 server:
Step 1
http://www.cisco.com/pcgi-bin/tablebuild.pl/bbsm53
Note
Step 2
•
•
Note
Step 3
Note
Step 4
Step 5
Note
Step 6
Step 7
Note
Patches Included in BBSM 5.3 SP2
These patches are included in BBSM 5.3 SP2:
Microsoft Hotfixes Included in BBSN 5.3 SP2
The following Microsoft hotfixes are included in BBSM 5.3 SP2:
Caveats Resolved By BBSN 5.3 SP2
This service pack includes caveats resolved in SP2. These appear below those resolved in SP1.
BBSM SP1 Caveats
This section describes the caveats that were resolved with BBSM 5.3 SP1.
•
When BBSM has an incorrect RADIUS shared secret (password), the RADIUS Authentication server now writes a warning message to the event log.
•
When configuring dual VLANs, BBSM no longer reboots continuously if a user forgets to unbind AtNat from the internal NIC.
•
In the ISA outgoing web requests configuration, the connection timeout is now set to 5 seconds.
•
To be compatible with BBSM 5.3 SP1, the Cisco Catalyst 3750 with the earlier version of IOS must be upgraded to IOS release 12.1(14) EA1 or later. The port settings for the Cisco Catalyst 3750 switch are now generated correctly.
•
The BBSM 5.3 online help title bar and header have been updated to reflect the current BBSM version number.
•
When you click the "Configuring Dual VLAN's" link in the BBSM 5.3 online help, the correct web page now appears.
•
When you click the "Alerts" link in the BBSM 5.3 online help, the correct web page now appears.
•
When you click the "System Summary" link in the BBSM 5.3 online help, the correct web page now appears
•
The BBSM 5.3 online help Search feature now works as designed.
•
When examining DNS server replies to BBSM clients, BBSM no longer classifies certain normal replies from the DNS server as failure replies. This fix allows for FTP and Telnet applications from Macintosh and certain Unix clients to work properly.
•
Malicious browser clients can no longer use the BBSM web proxy server (ISA) from outside of BBSM.
•
The new RADIUSBlock page set and access policy are very similar to the existing RADIUS page set and access policy. The only difference is that the RADIUSBlock page set now passes a block duration parameter to the RADIUSBlock access policy in the SendActivateSession method invocation and the RADIUSBlock access policy automatically terminates any active sessions when this block duration has been reached.
•
For clients that use the Macintosh IE browser, the BBSM Page Set Wizard now generates page sets that work as designed.
•
When access codes by duration are created with the duration of 60 minutes or longer, the client session now expires and disconnects after the duration specified by the access codes.
•
When port hopping is turned on, clients can now port hop from one network device to another. BBSM no longer incorrectly deactivates the client sessions when clients port hop to another device after the port hop delay timer expires.
BBSM SP2 Caveats
This section describes the caveats that were resolved with BBSM 5.3 SP2.
•
The Page Set Wizard preview feature stopped functioning if the value for the descriptive text contains certain characters, including apostrophes, ampersands, and double quotation marks. The Page Set wizard now safely processes these characters.
•
The "Usage by room" report failed when the port location field contained an apostrophe. Several other reports display the port location field and have been updated to properly handle apostrophes.
•
The Port Test utility in BBSM, by default, set the bandwidth setting for Cable Modem Termination Systems (CMTS) to 10 MB. The default setting caused the utility to report an abnormally high number of errors. The default bandwidth setting for CMTS is now 1 MB.
•
When a network element was defined as "NULL:Clients connect to router" and the user enabled port hopping, clients never disconnected as a result of inactivity. Additionally, if the access code page set was used, access codes were never released. The administrative interface now disables the port hopping check box when the "NULL" switch type is set.
•
When a Cisco Access Point is defined to use more than one VLAN, and the guest VLAN has an identifier higher than 254, it was assigned to Bridge Group 255. This occurred unless there was a VLAN identifier higher than the value assigned to the guest VLAN value. If the guest VLAN belonged to Bridge Group 255, clients were not redirected correctly to the splash screen. BBSM now correctly displays the splash screen.
In this scenario, BBSM sends improper SNMP queries to determine the MAC address of the client. Consequently, the clients cannot view the splash screen.
•
During initialization of Atdial, each row in the port map table was updated. If a large internal range was specified (for example, 64K or larger addresses), CPU utilization could spike for an abnormally long period of time. BBSM now optimizes the initialization sequence to reuse SQL connections rather than creating a new connection for each row updated.
•
When configuring access codes by date, if the `Set End Date' button was clicked without selecting a day in the calendar, the end date was set to the month displayed in the calendar and the day to 31, regardless of whether 31 days were present for the selected month. BBSM now pulls the end date from a month with fewer than 31 days.
•
When changing IP addressing after the initial configuration of DUAL VLAN, the RRAS Input filters for each VLAN were not changed or removed. The new IP address filter was added along with the old filter. BBSM now removes the old filters.
•
When WebPatch was used to install a patch and the installation failed, the summary level message that appears in the patch install log indicated completion. BBSM now indicates unsuccessful patch in summary level with reasons in detail level.
•
The Dashboard > Port Control > Port Settings feature failed when the port location field contained an apostrophe. This no longer happens.
•
The WEBpatch install dropdown clipped off long filenames, particularly in multi-part x.x to y.y upgrade files, and the part number was not readable. This no longer happens.
•
The WEBconfig Software version sometimes displayed an incorrect (rollback) version after a new patch was installed. This no longer happens.
•
BBSM rebooted if a client released the DHCP lease and certain timing conditions were met. This no longer happens.
Changes to BBSM Documentation
The Cisco BBSM 5.3 Software Installation Guide, the BBSM Network Device Compatibility Guide, and the BBSM 5.3 SP1 Configuration Guide are changed by SP2.
Changes Affecting the Cisco BBSM 5.3 Software Installation Guide
Changes in this service pack affect the information in the Cisco BBSM 5.3 Software Installation Guide. This document currently is located at http://www.cisco.com/en/US/products/sw/netmgtsw/ps533/prod_installation_guide09186a00801d8cdc.htm.
Changes Affecting the BBSM Network Device Compatibility Guide
Changes in this service pack affect the information in the BBSM Network Device Compatibility Guide. This document currently is located at http://www.cisco.com/en/US/products/sw/netmgtsw/ps533/products_user_guide09186a00801a9752.html.
Changes to Table 4
Use the following updated table in place of Table 4. New and changed information is highlighted.
1900
(does not support port-to-port security)X
X
X
2912 series
Cisco 2912
Link status
X
X
X
Cisco 2912 Packet
Packet inactivity
X
X
Cisco 2912M
Link status
X
X
X
Cisco 2912 VLAN/Port
VLAN/Port
X
X
X
2916M
Cisco 2916M
Link status
X
X
X
2924 series
Cisco 2924
Link status
X
X
X
Cisco 2924 Hub
Forwarding table
X
X
Cisco 2924 Packet
Packet inactivity
X
X
Cisco 2924M
Link status
X
X
X
Cisco 2924M Packet
Packet inactivity
X
X
Cisco 2924 VLAN/Port
VLAN/Port
X
X
X
Cisco 2924 VLAN/Port Hub
Forwarding table
X
2940 series
2940
Link status
X
X
2940 Packet
Packet inactivity
X
X
2948
Cisco 2948
Link status
X
X
X
2950 series1
Cisco 2950-12 (v. 12.0)
Link status
X
X
X
X
Cisco 2950-12 (v. 12.1.11)
Link status
X
X
X
X
Cisco 2950-24 (v. 12.0)
Link status
X
X
X
X
Cisco 2950-24 (v. 12.1.11)
Link status
X
X
X
X
Cisco 2950-48 (v. 12.1.11)
Link status
X
X
X
X
Cisco 2950Packet-12 (v. 12.1.11)
Packet inactivity
X
X
X
X
Cisco 2950Packet-24 (v. 12.1.11)
Packet inactivity
X
X
X
X
Cisco 2950Packet-48 (v. 12.1.11)
Packet inactivity
X
X
X
X
2970 series
2970
Link status
X
X
2970 Packet
Packet inactivity
X
X
3512 series
Cisco 3512
Link status
X
X
X
X
Cisco 3512 VLAN/Port2
Link status
X
X
X
X
ยท3524 series
Cisco 3524
Link status
X
X
X
X
Cisco 3524 Hub
Forwarding table
X
X
X
Cisco 3524 Packet
Packet inactivity
X
X
X
Cisco 3524 VLAN/Port2
Link status
X
X
X
X
3548 series
Cisco 3548
Link status
X
X
X
X
Cisco 3548 Packet
Packet inactivity
X
X
X
Cisco 3548 VLAN/Port2
Link status
X
X
X
X
3550 series1
(including the 3550-PWR switch)Cisco 3550-12 (v. 12.1.11)
Link status
X
X
X
X
Cisco 3550-24 (v. 12.1.11)
Link status
X
X
X
X
Cisco 3550-48 (v. 12.1.11)
Link status
X
X
X
X
Cisco 3550Packet-12 (v. 12.1.11)
Packet inactivity
X
X
X
X
Cisco 3550Packet-24 (v. 12.1.11)
Packet inactivity
X
X
X
X
Cisco 3550Packet-48 (v. 12.1.11)
Packet inactivity
X
X
X
3560 Series
Cisco 3560-24
Link status
X
X
Cisco 3560Packet-24
Packet inactivity
X
X
Cisco 3560-48
Link status
X
X
Cisco 3560Packet-48
Packet inactivity
X
X
3750 series3
3750
Link status
X
3750 Packet
Packet inactivity
X
4000 series4
Cisco 400x
Link status
X
X
X
Cisco 4x0x Packet
Packet inactivity
X
4500 series5
Cisco 4x0x
Link status
X
X
X
65096
Cisco 6x0x
Link status
X
X
X
Cisco 6x0x Packet
Packet inactivity
X
1 For the Catalyst 2950 and 3550 switches, you must upgrade to Cisco IOS Release 12.1(11)EA1 or later if you are running Cisco IOS Release 12.1(6) or 12.1(9).
2 This network device type supports VLAN per port (Switchport Multi command) for port-to-port security on Cisco Catalyst 2900 and 3500 XL series switches for running Cisco IOS Releases 11.2(8)SA3 through 12.0(5.1)XW. IOS releases later than 12.0(5.1)XW have a new method of implementing port-to-port security through private VLAN edge (port protected and switch port protected). Use Catalyst 2900 or 3500 link status switch types for switches with IOS releases later than 12.0(5.1)XW. For more information, consult the IOS guide for your software release.
3 You must upgrade to Cisco IOS Release 12.1(14) EA1 or later to use the Cisco Catalyst 3750 switch with BBSM.
4 BBSM was tested with Cisco Catalyst 4006, Supervisor III, Cisco IOS releases 12.1(12c)EW and 12.1(14)E1, and Supervisor IV, Cisco IOS Release 12.1(12c)EW.
5 BBSM was tested with Cisco Catalyst 4507, Supervisor IV, Cisco IOS Release 12.1(12c)EW.
6 BBSM was tested with Cisco Catalyst 6509, Supervisor I, Cisco IOS release 7.4(3).
Changes Affecting the Cisco BBSM 5.3 SP1 Configuration Guide
Changes to Figure 3-4 on Page 3-8
Refer to the following updated figure in place of Figure 3-4 on page 3-8.
Figure 3-4 Address Change Wizard IP Addresses Window (Singlenet, Dual VLAN)
Additional Changes to Text
Important Dual VLAN Note
With this service pack, you no longer need to use the Intel PROset utility on the BBSM server to create management and client VLANs. VLANS are now fully created, configured, and deleted by using the Address Change and Switch Discovery wizards. For additional information, see the Cisco BBSM 5.3 Configuration Guide.
Important Port Hopping Note
Configuring port hopping on a "Null: Clients connect to router" or a packet type Cisco Aironet access point breaks packet inactivity functionality. When this happens, BBSM does not disconnect clients in time. The workaround is to disable port-hopping on those network elements. If the packet inactivity switch type is used, there is no need to turn on port-hopping since packet inactivity allows clients to port-hop.
Important IP Spoofing Note
As referenced in the Release Notes for Cisco BBSM 5.3, a new feature has been added in BBSM 5.2 SP2 that detects IP spoofing, which occurs when a second MAC address, such as a laptop, tries to use the same IP address. Consequently, the second MAC address is prevented from accessing the system.
Because the IP address spoofing feature blocks a DHCP client if its IP address is already associated with an existing active session, some DHCP clients cannot connect although they have IP addresses assigned through DHCP. The affected clients cannot ping BBSM's internal NIC address. They receive "The Page Cannot Be Displayed" error message on their browsers.
This problem can occur in these situations:
1.
2.
3.
4.
In all of these cases, BBSM maintains a session although a client is no longer in the network or is not requesting to renew the IP address. Since the DHCP server is not aware of the existing session in BBSM, it assigns the IP address to another client when the default lease time expires. When this occurs, the IP address spoofing logic in BBSM blocks packets from the IP address because packets are from a different IP and MAC combination.
IP Spoofing Workaround for Switches
For situations 1 and 2 above, the workaround is either to remove the hub or other device from the port or to change the activity detection method, which is set through WEBconfig.
Otherwise, the switch type of the affected devices must be changed to the packet inactivity switch type, and the packet inactivity period must be configured to be less than 15 minutes. See the ("Important Port Hopping Note" section.) To do this:
Step 1
Step 2
Note
Step 3
Step 4
Step 5
Only Cisco switches support Packet Inactivity switch types. If you are using other switch types, they are considered legacy devices and are not supported by TAC.
IP Spoofing Workaround for Access Points
For situations 3 and 4 above, the workaround is to reduce the packet inactivity period or the combined packet inactivity periods and port hop delay to be less than 15 minutes. See the "Important Port Hopping Note" section. To do so, follow these steps:
Step 1
Step 2
Note
Step 3
Step 4
Step 5
Only Cisco access points support Packet Inactivity switch types. If you are using other access point types, they are considered legacy devices and are not supported by TAC.
Increasing the DHCP Lease Time
Follow these steps to increase the DHCP lease time:
Step 1
Step 2
Note
Step 3
Step 4
Related Documentation
The following documents provide information about BBSM:
•
•
•
•
•
Obtaining Documentation
Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation at this URL:
http://www.cisco.com/univercd/home/home.htm
You can access the Cisco website at this URL:
You can access international Cisco websites at this URL:
http://www.cisco.com/public/countries_languages.shtml
Documentation DVD
Cisco documentation and additional literature are available in a Documentation DVD package, which may have shipped with your product. The Documentation DVD is updated regularly and may be more current than printed documentation. The Documentation DVD package is available as a single unit.
Registered Cisco.com users (Cisco direct customers) can order a Cisco Documentation DVD (product number DOC-DOCDVD=) from the Ordering tool or Cisco Marketplace.
Cisco Ordering tool:
http://www.cisco.com/en/US/partner/ordering/
Cisco Marketplace:
http://www.cisco.com/go/marketplace/
Ordering Documentation
You can find instructions for ordering documentation at this URL:
http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm
You can order Cisco documentation in these ways:
•
http://www.cisco.com/en/US/partner/ordering/
•
Documentation Feedback
You can send comments about technical documentation to bug-doc@cisco.com.
You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883We appreciate your comments.
Cisco Product Security Overview
Cisco provides a free online Security Vulnerability Policy portal at this URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
From this site, you can perform these tasks:
•
•
•
A current list of security advisories and notices for Cisco products is available at this URL:
If you prefer to see advisories and notices as they are updated in real time, you can access a Product Security Incident Response Team Really Simple Syndication (PSIRT RSS) feed from this URL:
http://www.cisco.com/en/US/products/products_psirt_rss_feed.html
Reporting Security Problems in Cisco Products
Cisco is committed to delivering secure products. We test our products internally before we release them, and we strive to correct all vulnerabilities quickly. If you think that you might have identified a vulnerability in a Cisco product, contact PSIRT:
•
•
Tip
Never use a revoked or an expired encryption key. The correct public key to use in your correspondence with PSIRT is the one that has the most recent creation date in this public key server list:
http://pgp.mit.edu:11371/pks/lookup?search=psirt%40cisco.com&op=index&exact=on
In an emergency, you can also reach PSIRT by telephone:
•
•
Obtaining Technical Assistance
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, Cisco Technical Support provides 24-hour-a-day, award-winning technical assistance. The Cisco Technical Support Website on Cisco.com features extensive online support resources. In addition, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not hold a valid Cisco service contract, contact your reseller.
Cisco Technical Support Website
The Cisco Technical Support Website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, 365 days a year, at this URL:
http://www.cisco.com/techsupport
Access to all tools on the Cisco Technical Support Website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:
http://tools.cisco.com/RPF/register/register.do
Note
Submitting a Service Request
Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool provides recommended solutions. If your issue is not resolved using the recommended resources, your service request is assigned to a Cisco TAC engineer. The TAC Service Request Tool is located at this URL:
http://www.cisco.com/techsupport/servicerequest
For S1 or S2 service requests or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco TAC engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.
To open a service request by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447For a complete list of Cisco TAC contacts, go to this URL:
http://www.cisco.com/techsupport/contacts
Definitions of Service Request Severity
To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.
Severity 1 (S1)—Your network is "down," or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.
Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Severity 3 (S3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
•
http://www.cisco.com/go/marketplace/
•
•
•
http://www.cisco.com/go/iqmagazine
•
•
http://www.cisco.com/en/US/learning/index.html
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
Guest
