 Feedback
|
Table Of Contents
Release Notes for Cisco IOS Release 15.0SY
Chronological List of Releases
Policy Feature Card Guidelines and Restrictions
Distributed and Centralized Forwarding Cards
Distributed Forwarding Card 4XL
Centralized Forwarding Card (WS-F6700-CFC)
40-Gigabit Ethernet Switching Modules
WS-X6904-40G-2T 4-Port 40-Gigabit Ethernet Switching Module
10-Gigabit Ethernet Switching Modules
WS-X6908-10GE 8-Port 10-Gigabit Ethernet X2 Switching Module
WS-X6816-10T-2T, WS-X6716-10T 16-Port 10-Gigabit Ethernet Copper Switching Module
WS-X6816-10G-2T, WS-X6716-10GE 16-Port 10-Gigabit Ethernet X2 Switching Module
WS-X6704-10GE 4-Port 10-Gigabit Ethernet XENPAK Switching Module
Gigabit Ethernet Switching Modules
WS-X6848-SFP-2T, WS-X6748-SFP 48-Port Gigabit Ethernet SFP Switching Module
WS-X6824-SFP-2T, WS-X6724-SFP 24-Port Gigabit Ethernet SFP Switching Module
10/100/1000 Ethernet Switching Modules
WS-X6848-TX-2T, WS-X6748-GE-TX
WS-X6148A-GE-TX, WS-X6148A-GE-45AF
100MB Ethernet Switching Modules
10/100MB Ethernet Switching Modules
WS-X6148A-RJ-45, WS-X6148A-45AF
Power over Ethernet Daughtercards
Small Form-Factor Pluggable (SFP) Modules
Application Control Engine (ACE) Module
Firewall Services Module (FWSM)
Network Analysis Modules (NAMs)
Wireless Services Modules (WiSMs)
New Features in Release 15.0(1)SY4
New Hardware Features in Release 15.0(1)SY4
New Software Features in Release 15.0(1)SY4
New Features in Release 15.0(1)SY3
New Hardware Features in Release 15.0(1)SY3
New Software Features in Release 15.0(1)SY3
New Features in Release 15.0(1)SY2
New Hardware Features in Release 15.0(1)SY2
New Software Features in Release 15.0(1)SY2
New Features in Release 15.0(1)SY1
New Hardware Features in Release 15.0(1)SY1
New Software Features in Release 15.0(1)SY1
New Features in Release 15.0(1)SY
New Hardware Features in Release 15.0(1)SY
New Software Features in Release 15.0(1)SY
Software Features from Earlier Releases
Open Caveats in Release 15.0SY
Caveats Resolved in Release 15.0(1)SY4
Caveats Resolved in Release 15.0(1)SY3
Caveats Resolved in Release 15.0(1)SY2
Caveats Resolved in Release 15.0(1)SY1
Caveats Resolved in Release 15.0(1)SY
Additional Troubleshooting Information
System Software Upgrade Instructions
Obtaining Documentation and Submitting a Service Request
Release Notes for Cisco IOS Release 15.0SY
March 21, 2013
Note
•
•
•
http://www.cisco.com/en/US/products/hw/switches/ps708/prod_literature.html
The most current version of this document is available on Cisco.com at this URL:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/15.0SY/release_notes.html
Caution
Contents
This publication consists of these sections:
•
•
•
•
•
•
•
Chronological List of Releases
Note
•
This is a chronological list of the 15.0SY releases:
•
•
•
•
•
Hierarchical List of Releases
These releases support the hardware listed in the "Supported Hardware" section:
•
–
–
•
–
–
•
–
–
•
–
–
•
–
–
Note
FPD-Image Dependant Modules
FPD image packages update FPD images. If a discrepancy exists between an FPD image and the Cisco IOS image, the module that has the FPD discrepancy is deactivated until the discrepancy is resolved. These modules use FPD images:
•
•
http://www.cisco.com/en/US/products/sw/cscowork/ps5401/prod_release_notes_list.html
Supported Hardware
These sections describe the hardware supported in Release 15.0(1)SY and later releases:
•
•
•
•
•
•
•
•
Note
Supervisor Engine 2T-10GE
Note
http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/qa_c67_457347.html
(append "=" for spares)
Software
VersionSupervisor Engine 2T-10GE with PFC4XL
15.0(1)SY Supervisor Engine 2T-10GE with PFC4
Features
•
–
–
See the "Policy Feature Cards" section.
•
•
•
•
–
–
•
–
–
•
–
–
•
–
–
· With ports 1, 2, and 3 enabled: 2q4t/1p3q4t
· With ports 1, 2, and 3 disabled: 8q4t/1p7q4t
•
Note
•
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/cmp_configuration/guide/sup2T_10GEcmp.html
Supervisor Engine 2T-10GE Restrictions
•
•
Policy Feature Cards
•
Policy Feature Card Guidelines and Restrictions
•
•
The defaults for XL mode are:
–
–
The defaults for Non-XL mode are:
–
–
Note
These are the theoretical maximum numbers of routes for the supported protocols (the maximums are not supported simultaneously):
–
· IPv4 and MPLS: Up to 1,007,000 routes
· IPv4 multicast and IPv6 unicast and multicast: Up to 503,000 routes
· IPv4 and MPLS: Up to 239,000 routes
· IPv4 multicast and IPv6 unicast and multicast: Up to 119,000 routes
Enter the platform cef maximum-routes command to repartition the hardware FIB table. IPv4 unicast and MPLS require one hardware FIB table entry per route. IPv4 multicast and IPv6 unicast and multicast require two hardware FIB table entries per route. Changing the partition for one protocol makes corresponding changes in the partitions of the other protocols. You must enter the reload command to put configuration changes made with the platform cef maximum-routes command into effect.
Note
•
•
–
–
•
–
–
•
•
•
Policy Feature Card 4XL
Policy Feature Card 4
(append "=" for spares)
Software
VersionPolicy Feature Card 4 (PFC4)
With Supervisor Engine 2T-10GE
15.0(1)SY
Distributed and Centralized Forwarding Cards
•
•
•
Note
•
•
http://www.cisco.com/en/US/prod/collateral/modules/ps2797/ps11878/data_sheet_c78-648214.html
Distributed Forwarding Card 4XL
(append "=" for spares)
Software
Version
WS-F6K-DFC4-AXLDistributed Forwarding Card 4XL (DFC4XL)
With Supervisor Engine 2T-10GE
15.0(1)SY
Distributed Forwarding Card 4
(append "=" for spares)
Software
Version
WS-F6K-DFC4-ADistributed Forwarding Card 4 (DFC4)
With Supervisor Engine 2T-10GE
15.0(1)SY
Centralized Forwarding Card (WS-F6700-CFC)
(append "=" for spares)
Software
VersionCentralized Forwarding Card (CFC) for use on CEF720 modules
With Supervisor Engine 2T-10GE
15.0(1)SY
40-Gigabit Ethernet Switching Modules
WS-X6904-40G-2T 4-Port 40-Gigabit Ethernet Switching Module
(append "=" for spares)
Software
Version4-port 40-Gigabit Ethernet module
With Supervisor Engine 2T-10GE
15.0(1)SY1
•
•
•
•
•
•
–
–
•
Number of port groups: 2
Port per port group:
-Ports 1 and 2 or 5 through 12
-Ports 3 and 4 or 13 through 20•
•
•
•
•
–
—Four 40 Gigabit Ethernet ports
—Ports 1 through 4–
—Sixteen 10 Gigabit Ethernet ports
—Ports 5 through 20–
—Left bays:
-Either two 40 Gigabit Ethernet ports (1 and 2)
-Or eight 10 Gigabit Ethernet ports (5 through 12)
—Right bays:
-Either two 40 Gigabit Ethernet ports (3 and 4)
-Or eight 10 Gigabit Ethernet ports (13 through 20)
–
—Configurable per module or per bay:
no hw-module slot slot_number oversubscription [port-group port_group_number]—Supported in the top left bay and top right bay.
—Any of these combinations:
-40 Gigabit Ethernet port 1 (top left bay) and port 3 (top right bay)
-10 Gigabit Ethernet ports 5 through 9 (top left bay) and ports 13 through 16 (top right bay)
-Top left bay: 40 Gigabit Ethernet port 1 or 10 Gigabit Ethernet ports 5 through 9
Top right bay: 40 Gigabit Ethernet port 3 or 10 Gigabit Ethernet ports 13 through 16–
—Either of these combinations:
-Top left bay: 40 Gigabit Ethernet port 1
Right bays: eight 10 Gigabit Ethernet ports (13 through 20)-Left bays: eight 10 Gigabit Ethernet ports (5 through 13)
Top right bay: 40 Gigabit Ethernet port 3–
—Either of these combinations:
-Top left bay: four 10 Gigabit Ethernet ports (5 through 9)
Right bays: two 40 Gigabit Ethernet ports (3 and 4)-Left bays: two 40 Gigabit Ethernet ports (1 and 2)
Top right bay: four 10 Gigabit Ethernet ports (13 through 16)•
40 Gigabit Ethernet on Cisco Catalyst 6500 Series Switches: How It Works
Note: Some features described in the whitepaper will be supported in future releases.40 Gigabit Ethernet Interface Module for Cisco Catalyst 6500 Series Switches Data Sheet
10-Gigabit Ethernet Switching Modules
•
•
•
•
WS-X6908-10GE 8-Port 10-Gigabit Ethernet X2 Switching Module
(append "=" for spares)
Software
Version8-port 10-Gigabit Ethernet X2 module
With Supervisor Engine 2T-10GE
15.0(1)SY
•
•
•
•
•
•
Fabric Channel #1: Ports 2, 3, 6, 8
Fabric Channel #2: Ports 1, 4, 5, 7•
Number of port groups: 8
Port ranges per port group: 1 port in each group•
WS-X6816-10T-2T, WS-X6716-10T 16-Port 10-Gigabit Ethernet Copper Switching Module
(append "=" for spares)
Software
Version16-port 10-Gigabit Ethernet copper (RJ-45) module
With Supervisor Engine 2T-10GE
15.0(1)SY
•
–
–
–
–
•
•
•
•
–
–
•
Fabric Channel #1: ports 1-8
Fabric Channel #2: ports 9-16•
Number of port groups: 4
Port ranges per port group: 1-4, 5-8, 9-12, 13-16•
•
WS-X6816-10G-2T, WS-X6716-10GE 16-Port 10-Gigabit Ethernet X2 Switching Module
(append "=" for spares)
Software
Version
(Has WS-F6K-DFC4-E)16-port 10-Gigabit Ethernet X2 module
With Supervisor Engine 2T-10GE
15.0(1)SY
•
–
–
–
–
•
•
•
•
–
–
•
Fabric Channel #1: ports 1-8
Fabric Channel #2: ports 9-16•
Number of port groups: 4
Port ranges per port group: 1-4, 5-8, 9-12, 13-16•
•
WS-X6704-10GE 4-Port 10-Gigabit Ethernet XENPAK Switching Module
(append "=" for spares)
Software
Version4-port 10-Gigabit Ethernet XENPAK
With Supervisor Engine 2T-10GE
15.0(1)SY
•
•
•
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/hardware/Config_Notes/78_12409.html
•
•
Fabric Channel #1: Ports 3 and 4
Fabric Channel #2: Ports 1 and 2•
Number of port groups: 4
Port ranges per port group: 1 port in each group•
•
•
•
Gigabit Ethernet Switching Modules
•
•
WS-X6848-SFP-2T, WS-X6748-SFP 48-Port Gigabit Ethernet SFP Switching Module
(append "=" for spares)
Software
Version48-port Gigabit Ethernet SFP
With Supervisor Engine 2T-10GE
15.0(1)SY
•
•
•
•
Fabric Channel #1: Ports 2, 4, 6, 8, 10, 12,
14, 16, 18, 20, 22, 24, 26, 28, 30, 32, 34,
36, 38, 40, 42, 44, 46, 48
Fabric Channel #2: Ports 1, 3, 5, 7, 9, 11,
13, 15, 17, 19, 21, 23, 25, 27, 29, 31, 33,
35, 37, 39, 41, 43, 45, 47•
Number of port groups: 4
Port ranges per port group:
1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23
2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24
25, 27, 29, 31, 33, 35, 37, 39, 41, 43, 45, 47
26, 28, 30, 32, 34, 36, 38, 40, 42, 44, 46, 48•
WS-X6824-SFP-2T, WS-X6724-SFP 24-Port Gigabit Ethernet SFP Switching Module
(append "=" for spares)
Software
Version24-port Gigabit Mbps Ethernet SFP
With Supervisor Engine 2T-10GE
15.0(1)SY
•
•
•
•
Number of port groups: 2
Port ranges per port group: 1-12, 13-24•
10/100/1000 Ethernet Switching Modules
These sections descibe the supported 10/100/1000 Ethernet switching modules:
•
•
WS-X6848-TX-2T, WS-X6748-GE-TX
(append "=" for spares)
Software
Version48-port 10/100/1000 RJ-45
With Supervisor Engine 2T-10GE
15.0(1)SY
•
•
•
•
Fabric Channel #1: Ports 25-48
Fabric Channel #2: Ports 1-24•
Number of port groups: 4
Port ranges per port group: 1-12, 13-24, 25-36, 37-48•
WS-X6148E-GE-45AT
(append "=" for spares)
Software
Version48-port 10/100/1000 Mbps
With Supervisor Engine 2T-10GE
15.0(1)SY
•
•
•
•
Number of port groups: 6
Port ranges per port group: 1-8, 9-16, 17-24, 25-32, 33-40, 41-48•
•
•
WS-X6148A-GE-TX, WS-X6148A-GE-45AF
(append "=" for spares)
Software
Version
WS-X6148A-GE-45AF48-port 10/100/1000 Mbps
With Supervisor Engine 2T-10GE
15.0(1)SY
•
•
•
•
•
•
Number of port groups: 6
Port ranges per port group: 1-8, 9-16, 17-24, 25-32, 33-40, 41-48•
•
•
100MB Ethernet Switching Modules
WS-X6148-FE-SFP
(append "=" for spares)
Software
Version48-port 100BASE-FX
With Supervisor Engine 2T-10GE
15.0(1)SY
•
•
•
Number of port groups: 3
Port ranges per port group: 1-16, 17-32, and 33-48•
•
10/100MB Ethernet Switching Modules
•
•
WS-X6148A-RJ-45, WS-X6148A-45AF
(append "=" for spares)
Software
Version
WS-X6148A-45AF48-port 10/100TX RJ-45
With Supervisor Engine 2T-10GE
15.0(1)SY
•
•
•
•
•
Number of port groups: 6
Port ranges per port group: 1-8, 9-16, 17-24, 25-32, 33-40, 41-48•
WS-X6196-RJ-21, WS-X6196-21AF
(append "=" for spares)
Software
Versions
WS-X6196-21AF96-port 10/100TX RJ-21
With Supervisor Engine 2T-10GE
15.0(1)SY1
•
•
•
•
•
Power over Ethernet Daughtercards
Transceivers
•
CFP Modules
(append "=" for spares)
Software
VersionCFP-40G-LR4 40GBASE-LR4
15.0(1)SY1 CFP-40G-SR4 40GBASE-SR4
15.0(1)SY1 FourX coverter to convert each 40GE port into 4 10GE SFP+ ports
15.0(1)SY1
X2 Modules
Note
•
•
•
(append "=" for spares)
Software
Version10G X2 to SFP+ Converter
15.0(1)SY 10GBASE-DWDM 1560.61 nm X2 (100-GHz ITU grid)
ITU 21
15.0(1)SY 10GBASE-DWDM 1559.79 nm X2 (100-GHz ITU grid)
ITU 22
15.0(1)SY 10GBASE-DWDM 1558.98 nm X2 (100-GHz ITU grid)
ITU 23
15.0(1)SY 10GBASE-DWDM 1558.17 nm X2 (100-GHz ITU grid)
ITU 24
15.0(1)SY 10GBASE-DWDM 1556.55 nm X2 (100-GHz ITU grid)
ITU 26
15.0(1)SY 10GBASE-DWDM 1555.75 nm X2 (100-GHz ITU grid)
ITU 27
15.0(1)SY 10GBASE-DWDM 1554.94 nm X2 (100-GHz ITU grid)
ITU 28
15.0(1)SY 10GBASE-DWDM 1554.13 nm X2 (100-GHz ITU grid)
ITU 29
15.0(1)SY 10GBASE-DWDM 1552.52 nm X2 (100-GHz ITU grid)
ITU 31
15.0(1)SY 10GBASE-DWDM 1551.72 nm X2 (100-GHz ITU grid)
ITU 32
15.0(1)SY 10GBASE-DWDM 1550.92 nm X2 (100-GHz ITU grid)
ITU 33
15.0(1)SY 10GBASE-DWDM 1550.12 nm X2 (100-GHz ITU grid)
ITU 34
15.0(1)SY 10GBASE-DWDM 1548.51 nm X2 (100-GHz ITU grid)
ITU 36
15.0(1)SY 10GBASE-DWDM 1547.72 nm X2 (100-GHz ITU grid)
ITU 37
15.0(1)SY 10GBASE-DWDM 1546.92 nm X2 (100-GHz ITU grid)
ITU 38
15.0(1)SY 10GBASE-DWDM 1546.12 nm X2 (100-GHz ITU grid)
ITU 39
15.0(1)SY 10GBASE-DWDM 1544.53 nm X2 (100-GHz ITU grid)
ITU 41
15.0(1)SY 10GBASE-DWDM 1543.73 nm X2 (100-GHz ITU grid)
ITU 42
15.0(1)SY 10GBASE-DWDM 1542.94 nm X2 (100-GHz ITU grid)
ITU 43
15.0(1)SY 10GBASE-DWDM 1542.14 nm X2 (100-GHz ITU grid)
ITU 44
15.0(1)SY 10GBASE-DWDM 1540.56 nm X2 (100-GHz ITU grid)
ITU 46
15.0(1)SY 10GBASE-DWDM 1539.77 nm X2 (100-GHz ITU grid)
ITU 47
15.0(1)SY 10GBASE-DWDM 1538.98 nm X2 (100-GHz ITU grid)
ITU 48
15.0(1)SY 10GBASE-DWDM 1538.19 nm X2 (100-GHz ITU grid)
ITU 49
15.0(1)SY 10GBASE-DWDM 1536.61 nm X2 (100-GHz ITU grid)
ITU 51
15.0(1)SY 10GBASE-DWDM 1535.82 nm X2 (100-GHz ITU grid)
ITU 52
15.0(1)SY 10GBASE-DWDM 1535.04 nm X2 (100-GHz ITU grid)
ITU 53
15.0(1)SY 10GBASE-DWDM 1534.25 nm X2 (100-GHz ITU grid)
ITU 54
15.0(1)SY 10GBASE-DWDM 1532.68 nm X2 (100-GHz ITU grid)
ITU 56
15.0(1)SY 10GBASE-DWDM 1531.90 nm X2 (100-GHz ITU grid)
ITU 57
15.0(1)SY 10GBASE-DWDM 1531.12 nm X2 (100-GHz ITU grid)
ITU 58
15.0(1)SY 10GBASE-DWDM 1530.33 nm X2 (100-GHz ITU grid)
ITU 59
15.0(1)SY 10GBASE-ZR X2 Module for SMF
15.0(1)SY X2-10GB-CX4 10GBASE for CX4 (copper) cable
15.0(1)SY X2-10GB-ER 10GBASE-ER Serial 1550-nm extended-reach, single-mode fiber (SMF), dispersion-shifted fiber (DSF)
Note
15.0(1)SY X2-10GB-LR 10GBASE-LR Serial 1310-nm long-reach, single-mode fiber (SMF), dispersion-shifted fiber (DSF)
Note
15.0(1)SY X2-10GB-LRM 10GBASE-LRM for FDDI-grade multimode fiber (MMF)
Note
15.0(1)SY X2-10GB-LX4 10GBASE-LX4 Serial 1310-nm multimode (MMF)
Note
•
http://www.cisco.com/en/US/ts/fn/misc/FN62840.html
•
15.0(1)SY X2-10GB-SR 10GBASE-SR Serial 850-nm short-reach multimode (MMF)
15.0(1)SY
10 GE SFP+ Modules
XENPAKs
Note
•
Small Form-Factor Pluggable (SFP) Modules
These sections describe SFPs:
Gigabit Ethernet SFPs
Note
•
•
•
Fast Ethernet SFPs
Note
•
Note
Service Modules
Note
•
•
http://www.cisco.com/en/US/ts/fn/610/fn61935.html
•
•
•
•
Application Control Engine (ACE) Module
(append "=" for spares)
Software
Versions
ACE20-MOD-K9Application Control Engine (ACE) module
With Supervisor Engine 2T-10GE
15.0(1)SY •
http://www.cisco.com/en/US/products/ps6906/tsd_products_support_model_home.html
•
ASA Services Module
(append "=" for spares)
Software
VersionsASA Services Module
With Supervisor Engine 2T-10GE
15.0(1)SY1 Note
Firewall Services Module (FWSM)
(append "=" for spares)
Software
VersionFirewall Services Module
With Supervisor Engine 2T-10GE
15.0(1)SY •
•
http://www.cisco.com/en/US/products/hw/modules/ps2706/ps4452/tsd_products_support_model_home.html
See the WS-SVC-FWM-1-K9 software release notes for information about the minimum required WS-SVC-FWM-1-K9 software version.
Network Analysis Modules (NAMs)
(append "=" for spares)
Software
VersionNetwork Analysis Module 3
With Supervisor Engine 2T-10GE
15.0(1)SY1
WS-SVC-NAM-1Network Analysis Module 2
Network Analysis Module 1With Supervisor Engine 2T-10GE
15.0(1)SY •
•
–
–
See the software release notes for information about the minimum required NAM software version.
Wireless Services Modules (WiSMs)
(append "=" for spares)
Software
Versions
WS-SVC-WISM2-3-K9
WS-SVC-WISM2-5-K9Wireless Services Module 2 (WiSM2)
With Supervisor Engine 2T-10GE
15.0(1)SY Wireless Services Module (WiSM)
With Supervisor Engine 2T-10GE
15.0(1)SY Wireless services modules run their own software—See these publications:
http://www.cisco.com/en/US/products/ps6526/tsd_products_support_model_home.html
See the wireless services modules software release notes for information about the minimum required wireless services module software version.
Power Supplies
WS-C6504-E Power Supplies
(append "=" for spares)
Software
Version2700 W AC power supply
15.0(1)SY 2700 W DC power supply
15.0(1)SY
WS-C6503-E Power Supplies
All Other Power Supplies
Note
•
•
Chassis
Note
13-Slot Chassis
9-Slot Chassis
(append "=" for spare)
Software
VersionCatalyst 6509-V-E chassis:
•
•
•
–
–
With Supervisor Engine 2T-10GE
15.0(1)SY Cisco 7609-S chassis:
•
•
•
–
–
With Supervisor Engine 2T-10GE
15.0(1)SY1 Catalyst 6509-E chassis:
•
•
–
–
Note
•
With Supervisor Engine 2T-10GE
15.0(1)SY
6-Slot Chassis
(append "=" for spare)
Software
VersionCatalyst 6506 chassis:
•
•
–
–
Note
•
With Supervisor Engine 2T-10GE
15.0(1)SY
4-Slot Chassis
(append "=" for spare)
Software
VersionCatalyst 6504-E chassis:
•
•
With Supervisor Engine 2T-10GE
15.0(1)SY
3-Slot Chassis
(append "=" for spare)
Software
Version•
•
•
With Supervisor Engine 2T-10GE
15.0(1)SY
Unsupported Hardware
Release 15.0SY supports only the hardware listed in the "Supported Hardware" section. Unsupported modules remain powered down if detected and do not affect system behavior.
Release 12.2SX supported these modules, which are not supported in Release 15.0SY:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Images and Feature Sets
Use Cisco Feature Navigator to display information about the images and feature sets in Release 15.0(1)SY.
The releases includes strong encryption images. Strong encryption images are subject to U.S. and local country export, import, and use laws. The country and class of end users eligible to receive and use Cisco encryption solutions are limited. See this publication for more information:
Universal Boot Loader Image
The Universal Boot Loader (UBL) image is a minimal network-aware image that can download and install a Cisco IOS image from a running active supervisor engine in the same chassis. When newly installed as a standby supervisor engine in a redundant configuration, a supervisor engine running the UBL image automatically attempts to copy the image of the running active supervisor engine in the same chassis.
EFSU Compatibility
SX SY EFSU Compatibility Matrix
Release 15.0(1)SY1 provides initial Release 15.0SY support for these modules:
•
•
•
•
Do not install these modules before an EFSU upgrade to Release 15.0(1)SY1. These modules should not be installed if EFSU downgrade to Release 15.0(1)SY is required.
If any of the listed modules were installed in a non-VSS system prior to an EFSU upgrade to Release 15.0(1)SY1, perform these steps:
1.
2.
3.
If any of the listed modules were installed in (or were installed and then removed from) a VSS system prior to an EFSU upgrade to Release 15.0(1)SY1, perform these steps:
1.
2.
3.
4.
5.
If any of the listed modules were installed in (or were installed and then removed from) a non-VSS system prior to an EFSU downgrade to Release 15.0(1)SY, perform these steps:
1.
2.
3.
4.
5.
6.
If any of the listed modules were installed in (or were installed and then removed from) a VSS system prior to an EFSU downgrade to Release 15.0(1)SY, perform these steps:
1.
2.
Router# show running-config | begin provisionmodule provision switch 1slot 3 slot-type 95 port-type 30 number 8 virtual-slot 19slot 4 slot-type 322 port-type 112 number 16 virtual-slot 20slot 7 slot-type 318 port-type 31 number 3 port-type 60 number 2 virtual-slot 23slot 8 slot-type 318 port-type 31 number 3 port-type 60 number 2 virtual-slot 24slot 12 slot-type 147 port-type 61 number 48 virtual-slot 28slot 13 slot-type 333 port-type 113 number 4 port-type 60 number 16 virtual-slot 29!module provision switch 2slot 1 slot-type 333 port-type 113 number 4 port-type 60 number 16 virtual-slot 33slot 3 slot-type 328 port-type 60 number 8 virtual-slot 35slot 7 slot-type 318 port-type 31 number 3 port-type 60 number 2 virtual-slot 39slot 8 slot-type 318 port-type 31 number 3 port-type 60 number 2 virtual-slot 40slot 9 slot-type 156 port-type 31 number 24 virtual-slot 41slot 11 slot-type 156 port-type 31 number 24 virtual-slot 433.
Router# configure terminalRouter(config)# module provision switch 1Router(config-prov-switch)# no slot 13 slot-type 333 port-type 113 number 4 port-type 60 number 16 virtual-slot 29Router(config-prov-switch)# exitRouter(config)# module provision switch 2Router(config-prov-switch)# no slot 1 slot-type 333 port-type 113 number 4 port-type 60 number 16 virtual-slot 33Router(config-prov-switch)# end4.
5.
6.
Cisco IOS Behavior Changes
Behavior changes describe the minor modifications that are sometimes introduced in a software release. When behavior changes are introduced, existing documentation is updated.
Release 15.0(1)SY4
•
Old Behavior: Release 12.2(50)SY and rebuilds, Release 15.0(1)SY and rebuilds, and Release 15.1(1)SY and later releases do not support the Services SPA Carrier (SSC) and IPsec SPA, but the associated CLI is present and can cause problems if entered.
New Behavior: The CLI associated with the Services SPA Carrier (SSC) and IPsec SPA is not present.
Release 15.0(1)SY3
•
Old Behavior: When the neighbor remove-private-as command is configured and a route-map without a continue clause is configured, the processing order is:
1. neighbor remove-private-as processing
2. set as-path prepend or set as-path prepend last-as
If the route-map contains a continue clause, the processing order is reversed.
New Behavior: When the neighbor remove-private-as command is configured and a route-map is configured (whether it has a continue clause or not), the processing order is always:
1. neighbor remove-private-as processing
2. set as-path prepend or set as-path prepend last-as
•
Old Behavior: You must shut down 1-Gigabit Ethernet ports before you enter the platform qos 10g-only command.
New Behavior: You must shut down 1-Gigabit Ethernet ports and ensure that no trust state and the default class of service (CoS) are configured before you enter the platform qos 10g-only command.
Release 15.0(1)SY2
•
Old Behavior: When using the no form of the exec-timeout command, the EXEC command interpreter is reconfigured to wait for user input for the configuration default period of 10 min 0 sec.
New Behavior: The no form of the exec-timeout command configures a wait period of 0 min 0 sec before timeout.
Additional Information:
•
Old Behavior: For WS-SVC-NAM3-6G-K9, the show module command displays "Trifecta NAM Module". For WS-SVC-WISM2, the show module command displays "WiSM Jian Service Module".
New Behavior: For WS-SVC-NAM3-6G-K9, the show module command displays "Network Analysis Module 3". For WS-SVC-WISM2, the show module command displays "WiSM 2 WLAN Service Module".
•
Old Behavior: On WS-X6904-40G-2T ports, the bandwidth command is required if you configure any nondefault values for any other queueing commands on the port, but the CLI does not enforce the requirnment.
New Behavior: On WS-X6904-40G-2T ports, the CLI enforces the requirement for the bandwidth command if you configure any nondefault values for any other queueing commands on the port.
•
Old Behavior: The unsupported energywise management configuration mode command was present in the CLI.
New Behavior: The unsupported energywise management configuration mode command is not present in the CLI.
New Features in Release 15.0(1)SY4
These sections describe the new features in Release 15.0(1)SY4, 21 Mar 2013:
•
•
New Hardware Features in Release 15.0(1)SY4
None.
New Software Features in Release 15.0(1)SY4
None.
New Features in Release 15.0(1)SY3
These sections describe the new features in Release 15.0(1)SY3, 26 Nov2012:
•
•
New Hardware Features in Release 15.0(1)SY3
None.
New Software Features in Release 15.0(1)SY3
•
http://www.cisco.com/en/US/docs/ios-xml/ios/ipaddr_dhcp/configuration/15-sy/dhcp-relay-agent.html
New Features in Release 15.0(1)SY2
These sections describe the new features in Release 15.0(1)SY2, 16 Jul 2012:
•
•
New Hardware Features in Release 15.0(1)SY2
None.
New Software Features in Release 15.0(1)SY2
None.
New Features in Release 15.0(1)SY1
These sections describe the new features in Release 15.0(1)SY1, 24 Feb 2012:
•
•
New Hardware Features in Release 15.0(1)SY1
•
•
•
•
•
Note
New Software Features in Release 15.0(1)SY1
•
http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_bfd/configuration/15-sy/irb-bi-fwd-det.html
•
http://www.cisco.com/en/US/docs/ios/iproute_bfd/configuration/guide/irb_bfd.html
•
•
•
•
•
http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-confg.html
http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-overview.html•
http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-confg.html
http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-overview.html•
http://www.cisco.com/en/US/docs/ios/iproute_eigrp/configuration/guide/ire_cfg_eigrp.html
•
http://www.cisco.com/en/US/docs/switches/lan/energywise/phase2/ios/configuration/guide/ew_v2.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/12-2sx/ip6-addrg-bsc-con.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-mgt-ts.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-shared-svcs.html
•
•
The following commands have been added in this release to support this feature:
[match | collect] routing destination as [4-octet][match | collect] routing destination as peer [4-octet][match | collect] routing source as [4-octet][match | collect] routing source as peer [4-octet]For more information on export types, see the NetFlow Layer 2 and Security Monitoring Exports document:
http://www.cisco.com/en/US/docs/ios/netflow/configuration/guide/nf_lay2_sec_mon_exp.html
Note
•
•
http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/15-2mt/ip6-ospf.html
•
•
•
http://www.cisco.com/en/US/docs/ios/iproute_ospf/configuration/guide/iro_snmp_ifindex.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/15-2mt/ip6-ospf.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/15-2mt/ip6-bfd.html
•
•
http://www.cisco.com/en/US/docs/switches/lan/trustsec/release/notes/rn_cts_crossplat.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-overview.html
http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-confg.html
http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-shared-svcs.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-mgt-ts.html
•
Note
The following is an example of the supported configuration:
ip nat outside sourcestatic real_ip_address nat_ip_address interface vlan vlan_ID_Xip natinsideip vrf forwardingvrf_name ip address vrf_ip_add mask_value interface vlan vlan_ID_Yip natoutsideip vrf forwardingvrf_name ip address vrf_ip_add mask_value ! Configuration of up to 248 interfaces supported. !ip nat inside sourcestatic local_ip1 global_ip1 vrf vrf_nameip nat inside sourcestatic local_ip2 global_ip2 vrf vrf_name ! ! Up to 124 of these statements
Note
•
•
New Features in Release 15.0(1)SY
These sections describe the new features in Release 15.0(1)SY, 27 Sep 2011:
•
•
New Hardware Features in Release 15.0(1)SY
•
•
–
–
–
These hardware products are also supported in Release 12.2SY:
•
•
•
•
•
•
•
–
–
Note
•
–
–
–
–
New Software Features in Release 15.0(1)SY
Note
•
•
•
•
You can support management connections with FIPS encryption.
•
–
–
•
–
–
•
•
http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-bfd.html
•
http://www.cisco.com/en/US/docs/ios/iproute_bgp/configuration/guide/irg_event_vpn_import.html
•
http://www.cisco.com/en/US/docs/ios/iproute_bgp/configuration/guide/irg_basic_net.html
•
http://www.cisco.com/en/US/docs/ios/iproute_bgp/configuration/guide/irg_neighbor_soo.html
•
http://www.cisco.com/en/US/docs/ios/iproute_bgp/configuration/guide/irg_event_vpn_import.html
•
•
http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-imode-ospfv2.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/fnetflow/configuration/15-sy/support-issu-sso-xe.html
•
•
http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/12-2sx/ip6-fhrp.html
•
•
•
http://www.cisco.com/en/US/docs/ios/iproute_rip/command/reference/irr_rip.html#ip_rip_initial-delay
•
http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/12-2sy/ip6-mptcl-bgp.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_isis/configuration/15-sy/irs-instance-vrf.html
•
http://www.cisco.com/en/US/docs/ios/ipmulti/configuration/guide/imc_high_availability.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/12-2sy/ip6-multicast.html
•
http://www.cisco.com/en/US/docs/ios/mpls/configuration/guide/mp_6vpe_6pe_issu_sso.html
•
http://www.cisco.com/en/US/docs/ios/media_monitoring/configuration/guide/mm_mediatrace.html
•
http://www.cisco.com/en/US/docs/ios/mpls/configuration/guide/mp_vpn_ias_optab.html
•
http://www.cisco.com/en/US/docs/ios/mpls/configuration/guide/mp_vpn_ias_optab.html
•
http://www.cisco.com/en/US/docs/ios/interface/configuration/guide/ir_mplsvpnomgre.html
Note
•
–
–
–
Because the total number of configurable data MDTs is 1024, the user can use this maximum number of mappings in any of the described combinations.
•
http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/12-2sy/ip6-multicast.html
•
http://www.cisco.com/en/US/docs/ios/iproute_ospf/configuration/guide/iro_cfg.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-ttl.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-cfg.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-ttl.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-local-rib.html
•
http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-bfd.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/15-2mt/ip6-ospf.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/15-2mt/ip6-ospf.html
•
http://www.cisco.com/en/US/docs/ios/fundamentals/configuration/guide/cf_config-lock.html
•
http://www.cisco.com/en/US/docs/ios/media_monitoring/configuration/guide/mm_pasv_mon.html
•
http://www.cisco.com/en/US/docs/ios-xml/ios/qos_rsvp/configuration/15-0sy/rsvp_prvs_hop_overwrt.html
•
http://www.cisco.com/en/US/docs/ios/qos/configuration/guide/config_rsvp.html
•
http://www.cisco.com/en/US/docs/ios/qos/configuration/guide/config_rsvp.html
•
http://www.cisco.com/en/US/docs/ios/qos/configuration/guide/config_rsvp.html
•
•
http://www.cisco.com/en/US/docs/ios/saf/configuration/guide/saf_cg.html
•
http://www.cisco.com/en/US/docs/ios/mpls/configuration/guide/mp_6vpe_6pe_issu_sso.html
•
•
Note
Software Features from Earlier Releases
Use Cisco Feature Navigator to display supported features that were introduced in earlier releases.
Unsupported Commands
Release 15.0(1)SY does not support mls commands or mls as a keyword. See this document for a list of some of the mls commands that have been replaced:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/replacement_commands.html
Note
Release 15.0(1)SY does not support these commands:
•
•
•
Unsupported Features
Note
These features are not supported in Release 15.0(1)SY:
•
•
•
•
Note
•
•
•
•
•
Note
•
Note
•
•
•
•
Note
—Rapid Spanning Tree Protocol (RSTP):
· spanning-tree mode rapid-pvst global configuration mode command
· Enabled by default
—Multiple Spanning Tree Protocol (MSTP):
· spanning-tree mode mst global configuration mode command
· Can be enabled•
•
•
Note
•
•
•
•
•
Restrictions
Caveats in Release 15.0SY
•
•
•
•
•
•
Open Caveats in Release 15.0SY
Caveats Resolved in Release 15.0(1)SY4
•
The Cisco IOS Software implementation of the virtual routing and forwarding (VRF) aware network address translation (NAT) feature contains a vulnerability when translating IP packets that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130327-nat
Note: The March 27, 2013, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. All advisories address vulnerabilities in Cisco IOS Software. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the March 2013 bundled publication.
Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar13.html
Other Caveats Resolved in Release 15.0(1)SY4
Caveats Resolved in Release 15.0(1)SY3
Caveats Resolved in Release 15.0(1)SY2
Resolved IPServices Caveats
•
Symptoms: Memory may not properly be freed when malformed SIP packets are received on the NAT interface.
Conditions: None
Workaround: None
Further Problem Description: None.
PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 5/4.8: https://intellishield.cisco.com/security/alertmanager/cvssCalculator.do?dispatch=1&version=2&vector=AV:N/AC:L/Au:N/C:N/I:N/A:P/E:F/RL:U/RC:C CVE ID CVE-2011-2578 has been assigned to document this issue. Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
Other Resolved Caveats in Release 15.0(1)SY1
Caveats Resolved in Release 15.0(1)SY1
Resolved Infrastructure Caveats
•
Symptoms: Entering the show snmp pending command may cause a Cisco switch to crash.
Conditions: None
Applicable to all.
Workaround:
1. Do not configure v3 informs.
2. Do not enter the show snmp pending if the v3 informs are pending.
•
Summary: A vulnerability exists in the Cisco IOS software that may allow a remote application or device to exceed its authorization level when authentication, authorization, and accounting (AAA) authorization is used. This vulnerability requires that the HTTP or HTTPS server is enabled on the Cisco IOS device.
Products that are not running Cisco IOS software are not vulnerable.
Cisco has released free software updates that address these vulnerabilities.
The HTTP server may be disabled as a workaround for the vulnerability described in this advisory.
This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-pai
PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 8.5/7: https://intellishield.cisco.com/security/alertmanager/cvssCalculator.do?dispatch=1&version=2&vector=AV:N/AC:M/Au:S/C:C/I:C/A:C/E:F/RL:OF/RC:C CVE ID CVE-2012-0384 has been assigned to document this issue. Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
Resolved IPServices Caveats
•
Symptom: DNS Memory Leak in DNS queries
Conditions: DNS server configured: `ip dns server'
This bug can only possibly surface if the "ip dns-server" is configured, and then only when specific malformed datagrams are received on the DNS udp port 53. This specific datagram malfrmation is that the udp length field indicates a zero-length payload. This should never happen during normal DNS operation.
Workaround: No Workaround at this time
•
Summary: A vulnerability in the Multicast Source Discovery Protocol (MSDP) implementation of Cisco IOS Software and Cisco IOS XE Software could allow a remote, unauthenticated attacker to cause a reload of an affected device. Repeated attempts to exploit this vulnerability could result in a sustained denial of service (DoS) condition.
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-msdp
Note: The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.
Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html
PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 7.1/5.9: https://intellishield.cisco.com/security/alertmanager/cvssCalculator.do?dispatch=1&version=2&vector=AV:N/AC:M/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C CVE ID CVE-2012-0382 has been assigned to document this issue. Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
Resolved QoS Caveats
•
Cisco IOS Software and Cisco IOS XE Software contain a vulnerability in the RSVP feature when used on a device configured with VPN routing and forwarding (VRF) instances. This vulnerability could allow an unauthenticated, remote attacker to cause an interface wedge, which can lead to loss of connectivity, loss of routing protocol adjacency, and other denial of service (DoS) conditions. This vulnerability could be exploited repeatedly to cause an extended DoS condition.
A workaround is available to mitigate this vulnerability.
Cisco has released free software updates that address this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-rsvp
Resolved Routing Caveats
•
A router processes a packet that is sent to the network address of an interface, if the layer-2 frame that is encapsulating that packet is specifically crafted to target the layer-2 adress of the interface or a broadcast layer-2 address.
This happens only in the process switching path and does not happen in Cisco Express Forwarding (CEF) path.
Workaround is to use CEF.
Resolved Cisco IOS Caveats
•
The Cisco IOS Software Internet Key Exchange (IKE) feature contains a denial of service (DoS) vulnerability.
Cisco has released free software updates that address this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-ike
Note: The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.
Individual publication links are in "Cisco Event Response: Semi-Annual Cisco IOS Software Security Advisory Bundled Publication" at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html
Other Resolved Caveats in Release 15.0(1)SY1
Caveats Resolved in Release 15.0(1)SY
Resolved AAA Caveats
•
Symptoms: The Cisco IOS software image may unexpectedly restart when a crafted "msg-auth-response-get-user" TACACS+ packet is received.
Conditions: This symptom is observed after the Cisco platform had send an initial "recv-auth-start" TACACS+ packet.
Workaround: There is no workaround.
•
Symptom: Spurious memory access and/or crash when configuring a TACACS/AAA server connection.
Conditions: From internal review, this issue has been seen when a physical connection to the TACACS server isn't present or the server isn't online. If the server is connected and available, this issue may not happen.
Workaround: Ensure that a connection to the server is present on the device in question and the server is active to try and avoid this crash.
•
Symptoms: Password is prompted for twice for authentication.
Conditions: This issue occurs when login authentication has the line password as fallback and RADIUS as primary. For example: aaa authentication login default group radius line
Workaround: Change the login authentication to fall back to the enable password that is configured on the UUT. For example: enable password <keyword> aaa authentication login default group radius enable
Further Information: The fix for this bug also fixes an unrelated problem that may allow unauthorized users access to EXEC mode if the `'line`' authentication method is configured with fallback to the "none" authentication method. In other words, if the following is configured:
aaa new-model aaa authentication login MYMETHOD line noneline con 0 login authentication MYMETHOD password <some password>then users providing the wrong password at the password prompt will be granted access.
This issue was originally introduced by Cisco Bug ID CSCee85053, and fixed in some Cisco IOS releases via Cisco Bug IDs CSCsb26389 ("Failover for aaa authentication method LINE is broken") and CSCsv06823 ("Authentication request doesnt failover to any method after enable"). However, the fix for this problem was not integrated into some Cisco IOS releases and this bug (CSCth25634) takes care of that.
Note that Cisco Bug ID CSCti82605 ("AAA line password failed and access to switch still passed") is a recent bug that was filed once it was determined that the fix for CSCee85053 was still missing from some Cisco IOS releases. CSCti82605 was then made a duplicate of this bug (CSCth25634) since the fix for this bug also fixes CSCti82605.
Resolved Infrastructure Caveats
•
Symptom: Three separate Cisco IOS Hypertext Transfer Protocol (HTTP) cross-site scripting (XSS) vulnerabilities and a cross-site request forgery (CSRF) vulnerability have been reported to Cisco by three independent researchers.
The Cisco Security Response is posted at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityResponse/cisco-sr-20090114-http
Conditions: See "Additional Information" section in the posted response for further details.
Workarounds: See "Workaround" section in the posted response for further details.
•
Symptoms: Cisco IOS device may experience a device reload.
Conditions: This issue occurs when the Cisco IOS device is configured for SNMP and receives certain SNMP packets from an authenticated user. Successful exploitation causes the affected device to reload. This vulnerability could be exploited repeatedly to cause an extended DoS condition.
Workaround: There is no workaround.
PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 6.8/5.6:
CVE ID CVE-2010-3050 has been assigned to document this issue.
Additional information on Cisco's security vulnerability policy can be found at the following URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
•
Symptom: Standby Route Processor reloads, with trace backs indicating NAT Port allocations with high availability.
Conditions: If the device is configured for:
a) High Availability - SSO via the configuration command mode sso under redundancy
b) Is configured with NAT Interface Overload.
c) Is configured with IP SLA (or SNMP -- See Cisco Bug ID CSCtj44746) and a lot of NAT traffic is flowing through the active route processor while the standby route processor is booting up.
Workaround: None.
•
The Cisco IOS IP Service Level Agreement (IP SLA) feature contains a denial of service (DoS) vulnerability. The vulnerability is triggered when malformed UDP packets are sent to a vulnerable device. The vulnerable UDP port numbers depend on the device configuration. Default ports are not used for the vulnerable UDP IP SLA operation or for the UDP responder ports.
Cisco has released free software updates that address this vulnerability.
This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110928-ipsla.
•
Symptom: The changes introduced by Cisco bug ID CSCsi73899 introduced some performance impact.
Conditions: Only IOS versions with CSCsi73899 integrated and not CSCsl39986 are affected. These images are only interim images and should not be available on Cisco.com for general download purposes.
Workaround: None.
Resolved IPServices Caveats
•
Symptom: DHCPv6 relay process crash on Actice RP.
Conditions: Unknown at this time.
Workaround: Unknown at this time.
•
Symptom: Under unique circumstances erroneous routing prefixes may be added to the routing table.
Conditions: When the DHCPv6 relay feature is enabled and a router receives a normal DHCPv6 relay reply packet, this may lead to an erroneous route being added to the routing table.
Workaround: No workaround except turning off DHCPv6 relay.
•
Symptom: DNS Memory Leak in DNS queries
Conditions: DNS server configured: `ip dns server'
This bug can only possibly surface if the "ip dns-server" is configured, and then only when specific malformed datagrams are received on the DNS udp port 53. This specific datagram malfrmation is that the udp length field indicates a zero-length payload. This should never happen during normal DNS operation.
Workaround: No Workaround at this time
•
The Cisco IOS Software network address translation (NAT) feature contains multiple denial of service (DoS) vulnerabilities in the translation of the following protocols:
NetMeeting Directory (Lightweight Directory Access Protocol, LDAP)
Session Initiation Protocol (Multiple vulnerabilities)
H.323 protocolAll the vulnerabilities described in this document are caused by packets in transit on the affected devices when those packets require application layer translation.
Cisco has released free software updates that address these vulnerabilities.
This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110928-nat
•
A vulnerability in the Internet Group Management Protocol (IGMP) version 3 implementation of Cisco IOS Software and Cisco IOS XE Software allows a remote unauthenticated attacker to cause a reload of an affected device. Repeated attempts to exploit this vulnerability could result in a sustained denial of service (DoS) condition. Cisco has released free software updates that address this vulnerability.
This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20100922-igmp.
Note: The September 22, 2010, Cisco IOS Software Security Advisory bundled publication includes six Cisco Security Advisories. Five of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses vulnerabilities in Cisco Unified Communications Manager. Each advisory lists the releases that correct the vulnerability or vulnerabilities detailed in the advisory. The table at the following URL lists releases that correct all Cisco IOS Software vulnerabilities that have been published on September 22, 2010, or earlier:
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b4a315.shtml
Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication" at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep10.html
•
Symptom: Cisco IOS Software crashes when processing a specially crafted DNS reply packet.
Conditions: Router is configured to request DNS server lookups via the command ip name-server a.b.c.d and has domain look up enabled (enabled by default).
Affects all versions of Cisco IOS Software prior to first fixed software.
Workaround: Disable the IP Name server look up functionality on Cisco IOS Software, with the command no ip domain-lookup.
PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 5.4/4.5: https://intellishield.cisco.com/security/alertmanager/cvssCalculator.do?dispatch=1&version=2&vector=AV:N/AC:H/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C
CVE ID CVE-2011-0958 has been assigned to document this issue.
Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
•
Summary A vulnerability in the Multicast Source Discovery Protocol (MSDP) implementation of Cisco IOS Software and Cisco IOS XE Software could allow a remote, unauthenticated attacker to cause a reload of an affected device. Repeated attempts to exploit this vulnerability could result in a sustained denial of service (DoS) condition.
Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-msdp
Note: The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication.
Individual publication links are in `'Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication`' at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar12.html
PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 7.1/5.9: https://intellishield.cisco.com/security/alertmanager/cvssCalculator.do?dispatch=1&version=2&vector=AV:N/AC:M/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C CVE ID CVE-2012-0382 has been assigned to document this issue. Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
Resolved LegacyProtocols Caveats
•
Summary A router configured for DLSw might crash when it receives a series of certain malformed packets. This issue requires a number of conditions and a narrow timing window.
Conditions: Cisco IOS devices configured for DLSw.
Workaround: The only workaround in the device is to disable DLSw if not needed.
Additional mitigations can be found in the following Applied Mitigation Bulletin: http://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20080326-dlsw
PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 5.4/4.5:
CVE ID CVE-2011-1625 has been assigned to document this issue. Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
•
Cisco IOS Software contains a memory leak vulnerability in the Data-Link Switching (DLSw) feature that could result in a device reload when processing crafted IP Protocol 91 packets.
Cisco has released free software updates that address this vulnerability.
This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110928-dlsw.
Resolved MPLS Caveats
•
A device running Cisco IOS Software, Cisco IOS XE Software, or Cisco IOS XR Software is vulnerable to a remote denial of service condition if it is configured for Multiprotocol Label Switching (MPLS) and has support for Label Distribution Protocol (LDP).
A crafted LDP UDP packet can cause an affected device running Cisco IOS Software or Cisco IOS XE Software to reload. On devices running affected versions of Cisco IOS XR Software, such packets can cause the device to restart the mpls_ldp process.
A system is vulnerable if configured with either LDP or Tag Distribution Protocol (TDP).
Cisco has released free software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are available.
This advisory is posted at: http://www.cisco.com/warp/public/707/cisco-sa-20100324-ldp.shtml
Resolved Multicast Caveats
•
Symptom: A Cisco IOS device may experience an unexpected reload as a result of mtrace packet processing.
Conditions:
Workaround: None other than avoiding the use of mtrace functionality.
Resolved Routing Caveats
•
Symptom: Device may experience memory leak when receiving a flood of ICMPv6 messages. The memory leak will recover (ie., memory will be released successfully in about 4 hours).
Conditions: Device configured for IPv6 and PMTUD.
Workaround: PMTUD is enabled by default when using TCP over IPv6, and it is not possible to disable it. For this reason a possible workaround is to use an ACL to block the ICMPv6 "packet too big" message.
Please note that filtering out ICMPv6 "packet too big" messages means that the Layer 3 (IPv6) PMTUD is being shut down as well. Therefore, it is necessary to make sure that the MTU is set on the end host to the lowest possible IPv6 MTU - 1280 bytes. Otherwise, since the device is not seeing the "packet too big" message, the device will not know that an intermediate system has dropped a packet because it was too big.
ICMPv6 "packet too big" messages are the IPv6 equivalent to the ICMPv4 "fragmentation needed and DF bit set" message.
Resolved Security Caveats
•
Symptoms: A Cisco router that is running Cisco IOS Release 12.4(25) may crash due to SSH.
Conditions: This symptom occurs when SSH is enabled on the router. An attempt to access the router via SSH is made.
Workaround: Do not use SSH. Disable SSH on the router by removing the RSA keys:
"crypto key zeroize rsa"
Further Problem Description: This issue has not been seen in Cisco IOS Release 12.4(23) and earlier releases. It also has not been seen in Cisco IOS Release 12.4T images.
•
Symptom: Device crashes in SSH Process
Conditions: SSH process has to fail to allocate memory for the new connection. This would only occur in extremely low memory conditions.
Workaround: None.
Resolved Cisco IOS Caveats
•
Symptoms: Router may experience reload after certain corrupted packets are injected into MPLS path.
Conditions: Certain corrupted packets are injected into MPLS path.
Workaround: None.
PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 7.1/5.9: https://intellishield.cisco.com/security/alertmanager/cvssCalculator.do?dispatch=1&version=2&vector=AV:N/AC:M/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C No CVE ID has been assigned to this issue. Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
•
Symptom: 6500 may experience redzone crash at UDLD process. Message may appear %SYS-SP-3-OVERRUN: Block overrun at 44456570 (red zone 6D000700) -Traceback= 40291448 402938DC 40D74570 40D763A0
Traceback will vary from code to code.
Conditions: UDLD configured
Workaround: Disable UDLD.
•
Symptoms: Memory leak detected in SSH process during internal testing. Authentication is required in order for a user to cause the memory leak.
Conditions: This was experienced during internal protocol robustness testing.
Workaround: Allow SSH connections only from trusted hosts.
PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 6.8/5.6: https://intellishield.cisco.com/security/alertmanager/cvssCalculator.do?dispatch=1&version=2&vector=AV:N/AC:L/Au:S/C:N/I:N/A:C/E:F/RL:OF/RC:C CVE ID CVE-2011-2568 has been assigned to document this issue. Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
•
Symptom: System may crash when receiving LLDPDUs.
Conditions: Incoming LLDPDUs with more than 10 LLDP MA(Management Address) TLVs
Workaround: Disable LLDP MA TLV sending on the peers.
Further Problem Description: Currently LLDP supports 10 MA TLVs per LLDP neighbor entry, however, it is not processed properly when more than 10 MA TLVs are received.
•
Symptom: Cisco IOS Software is affected by two vulnerabilities that cause a Cisco IOS device to reload when processing IP version 6 (IPv6) packets over a Multiprotocol Label Switching (MPLS) domain. These vulnerabilities are:
–
–
Cisco has released free software updates that address these vulnerabilities.
Workarounds that mitigate these vulnerabilities are available.
This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110928-ipv6mpls
•
The Cisco IOS Software Network Address Translation (NAT) feature contains two denial of service (DoS) vulnerabilities in the translation of IP packets.
The vulnerabilities are caused when packets in transit on the vulnerable device require translation.
Cisco has released free software updates that address these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-nat
Note: The September 26, 2012, Cisco IOS Software Security Advisory bundled publication includes 9 Cisco Security Advisories. Eight of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the September 2012 bundled publication.
Individual publication links are in the "Cisco Event Response: Semi-Annual Cisco IOS Software Security Advisory Bundled Publication" at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep12.html
•
Symptom: Cisco IOS Software is affected by two vulnerabilities that cause a Cisco IOS device to reload when processing IP version 6 (IPv6) packets over a Multiprotocol Label Switching (MPLS) domain. These vulnerabilities are:
–
Cisco has released free software updates that address these vulnerabilities.
Workarounds that mitigate these vulnerabilities are available.
This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20110928-ipv6mpls
•
Symptom: An external loop between 2 dot1x enabled ports can cause a storm of unicast EAPoL pdus in the network.
Workaround: Avoid creating a loop.
PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 6.1/5.8: https://intellishield.cisco.com/security/alertmanager/cvssCalculator.do?dispatch=1&version=2&vector=AV:A/AC:L/Au:N/C:N/I:N/A:C/E:F/RL:U/RC:C CVE ID CVE-2011-2058 has been assigned to document this issue. Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
•
Symptom: Currently in EARL7 system, For an IPv6 packet the 96 bytes cover DBUS header (22), Ether header (14), IPv6 harder (40), IPv6 extension headers, and L4 header. That means only 20 bytes (96 - 22 - 14 - 40) are for extension header(s) and L4 header. So even packet with small extension header(s) can use up to 20 bytes that would cause l4_hdr_vld = 0. When that happens, all L4 features cannot be applied and packet would be hardware forwarded based on L3 forwarding result.
Conditions: This issue is present from day one but would cause threat only when ipv6 access-list is configured on any interface and that access-list is containing L4 options.
Workaround: No Workaround
•
Symptom: Start-Control-Connection-Request (SCCRQ) packets may cause tunnel to reset after digest failure.
Conditions: This issue is observed when the SCCRQ packets are sent with an incorrect hash.
Workaround: There is no workaround.
•
Symptoms: A Cat4k switch may reload after receiving a malformed packet on one specific specific port.
Conditions: This symptom may be observed on a Cat4k switch that enables DNSIX audit trail and recieves crafted IP packets on a specific port.
Workaround: Do not enable the DNSIX audit trail.
•
Symptoms: This bug has been filed to enhance the code to follow secure best practices and enhance resiliency of the product.
Conditions: Not applicable.
Workaround: Not applicable
PSIRT Evaluation: The Cisco PSIRT has evaluated this issue and does not meet the criteria for PSIRT ownership or involvement. This issue will be addressed via normal resolution channels.
If you believe that there is new information that would cause a change in the severity of this issue, please contact psirt@cisco.com for another evaluation.
Additional information on Cisco's security vulnerability policy can be found at the following URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
Resolved VPDN Caveats
•
Symptom: Cisco ASR1000 routers running Cisco IOS software may experience a crash when PPTP packets are sent under certain conditions to a router with VPN features configured.
Conditions: Normal Conditions.
Workaround: CoPP may be configured on the device to protect the management and control planes and to workaround this risk by explicitly permitting only authorized traffic sent to the route processor in accordance with existing security policies and configurations. The following example can be adapted to your network.
!-- Permit all TCP and UDP PPTP traffic sent to all IP addresses!-- configured on all interfaces of the affected device so that it!-- will be policed and dropped by the CoPP featureaccess-list 100 permit tcp any any eq 1723 access-list 100 permit udp any any eq 1723!-- Permit (Police or Drop)/Deny (Allow) all other Layer3 and Layer4!-- traffic in accordance with existing security policies and!-- configurations for traffic that is authorized to be sent!-- to infrastructure devices!!-- Create a Class-Map for traffic to be policed by!-- the CoPP featureclass-map match-all drop-pptp-class match access-group 100!-- Create a Policy-Map that will be applied to the!-- Control-Plane of the devicepolicy-map drop-pptp-traffic class drop-pptp-class police 8000 conform-action drop!-- Apply the Policy-Map to the Control-Plane of the!-- devicecontrol-plane service-policy input drop-pptp-trafficResolved WAN Caveats
•
Symptom: Cisco IOS Software is affected by NTP mode 7 denial-of-service vulnerability. Note: The fix for this vulnerability has a behavior change affect on Cisco IOS Operations for Mode 7 packets. See the section Further Description of this release note enclosure.
Conditions: Cisco IOS Software with support for Network Time Protocol (NTP) contains a vulnerability processing specific NTP Control Mode 7 packets. This results in increased CPU on the device and increased traffic on the network segments.
This is the same as the vulnerability which is described in http://www.kb.cert.org/vuls/id/568372
Cisco has release a public facing vulnerability alert at the following link: http://tools.cisco.com/security/center/viewAlert.x?alertId=19540
Cisco IOS Software that has support for NTPv4 is NOT affected. NTPv4 was introduced into Cisco IOS Software: 12.4(15)XZ, 12.4(20)MR, 12.4(20)T, 12.4(20)YA, 12.4(22)GC1, 12.4(22)MD, 12.4(22)YB, 12.4(22)YD, 12.4(22)YE and 15.0(1)M.
All other versions of Cisco IOS and Cisco IOS XE Software are affected.
To see if a device is configured with NTP, log into the device and issue the CLI command show running-config | include ntp. If the output returns either of the following commands listed then the device is vulnerable:
ntp master <any following commands>ntp peer <any following commands>ntp server <any following commands>ntp broadcast client ntp multicast clientThe following example identifies a Cisco device that is configured with NTP:
router#show running-config | include ntp ntp peer 192.168.0.12The following example identifies a Cisco device that is not configured with NTP:
router#show running-config | include ntp router#To determine the Cisco IOS Software release that is running on a Cisco product, administrators can log in to the device and issue the show version command to display the system banner. The system banner confirms that the device is running Cisco IOS Software by displaying text similar to "Cisco Internetwork Operating System Software" or "Cisco IOS Software." The image name displays in parentheses, followed by "Version" and the Cisco IOS Software release name. Other Cisco devices do not have the show version command or may provide different output.
The following example identifies a Cisco product that is running Cisco IOS Software Release 12.3(26) with an installed image name of C2500-IS-L:
Router#show version Cisco Internetwork Operating System Software IOS (tm) 2500 Software (C2500-IS-L), Version 12.3(26), RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright ) 1986-2008 by cisco Systems, Inc. Compiled Mon 17-Mar-08 14:39 by dchih<output truncated>The following example shows a product that is running Cisco IOS Software release 12.4(20)T with an image name of C1841-ADVENTERPRISEK9-M:
Router#show version Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(20)T, RELEASE SOFTWARE (fc3) Technical Support: http://www.cisco.com/techsupport Copyright ) 1986-2008 by Cisco Systems, Inc. Compiled Thu 10-Jul-08 20:25 by prod_rel_team<output truncated>Additional information about Cisco IOS Software release naming conventions is available in "White Paper: Cisco IOS and NX-OS Software Reference Guide" at the following link: http://www.cisco.com/web/about/security/intelligence/ios-ref.html
Workaround: There are no workarounds other than disabling NTP on the device. The following mitigations have been identified for this vulnerability; only packets destined for any configured IP address on the device can exploit this vulnerability. Transit traffic will not exploit this vulnerability.
Note
–
Warning: Because the feature in this vulnerability utilizes UDP as a transport, it is possible to spoof the sender's IP address, which may defeat access control lists (ACLs) that permit communication to these ports from trusted IP addresses. Unicast Reverse Path Forwarding (Unicast RPF) should be considered to be used in conjunction to offer a better mitigation solution.
!--- Configure trusted peers for allowed accessaccess-list 1 permit 171.70.173.55!--- Apply ACE to the NTP configurationntp access-group peer 1For additional information on NTP access control groups, consult the document titled "Performing Basic System Management" at the following link:
http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_basic_sys_manage.html#wp1034942
–
Warning: Because the feature in this vulnerability utilizes UDP as a transport, it is possible to spoof the sender's IP address, which may defeat ACLs that permit communication to these ports from trusted IP addresses. Unicast RPF should be considered to be used in conjunction to offer a better mitigation solution.
Although it is often difficult to block traffic that transits a network, it is possible to identify traffic that should never be allowed to target infrastructure devices and block that traffic at the border of networks.
Infrastructure ACLs (iACLs) are a network security best practice and should be considered as a long-term addition to good network security as well as a workaround for this specific vulnerability. The iACL example below should be included as part of the deployed infrastructure access-list, which will help protect all devices with IP addresses in the infrastructure IP address range:
!---!--- Feature: Network Time Protocol (NTP)!---access-list 150 permit udp TRUSTED_SOURCE_ADDRESSES WILDCARD INFRASTRUCTURE_ADDRESSES WILDCARD eq 123!--- Note: If the router is acting as a NTP broadcast client!--- via the interface command "ntp broadcast client"!--- then broadcast and directed broadcasts must be!--- filtered as well. The following example covers!--- an infrastructure address space of 192.168.0.Xaccess-list 150 permit udp TRUSTED_SOURCE_ADDRESSES WILDCARD host 192.168.0.255 eq ntp access-list 150 permit udp TRUSTED_SOURCE_ADDRESSES WILDCARD host 255.255.255.255 eq ntp!--- Note: If the router is acting as a NTP multicast client!--- via the interface command "ntp multicast client"!--- then multicast IP packets to the mutlicast group must!--- be filtered as well. The following example covers!--- a NTP multicast group of 239.0.0.1 (Default is!--- 224.0.1.1)access-list 150 permit udp TRUSTED_SOURCE_ADDRESSES WILDCARD host 239.0.0.1 eq ntp!--- Deny NTP traffic from all other sources destined!--- to infrastructure addresses.access-list 150 deny udp any INFRASTRUCTURE_ADDRESSES WILDCARD eq 123!--- Permit/deny all other Layer 3 and Layer 4 traffic in!--- accordance with existing security policies and!--- configurations. Permit all other traffic to transit the!--- device.access-list 150 permit ip any any!--- Apply access-list to all interfaces (only one example!--- shown)interface fastEthernet 2/0 ip access-group 150 inThe white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection access lists and is available at the following link
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml
–
Provided under Control Plane Policing there are two examples. The first aims at preventing the injection of malicious traffic from untrusted sources, whilst the second looks at rate limiting NTP traffic to the box.
–
Warning: Because the feature in this vulnerability utilizes UDP as a transport, it is possible to spoof the sender's IP address, which may defeat ACLs that permit communication to these ports from trusted IP addresses. Unicast RPF should be considered to be used in conjunction to offer a better mitigation solution.
Control Plane Policing (CoPP) can be used to block untrusted UDP traffic to the device. Cisco IOS software releases 12.0S, 12.2SX, 12.2S, 12.3T, 12.4, and 12.4T support the CoPP feature. CoPP can be configured on a device to help protect the management and control planes and minimize the risk and effectiveness of direct infrastructure attacks by explicitly permitting only authorized traffic that is sent to infrastructure devices in accordance with existing security policies and configurations. The CoPP example below should be included as part of the deployed CoPP, which will help protect all devices with IP addresses in the infrastructure IP address range.
!--- Feature: Network Time Protocol (NTP)access-list 150 deny udp TRUSTED_SOURCE_ADDRESSES WILDCARD any eq 123!--- Deny NTP traffic from all other sources destined!--- to the device control plane.access-list 150 permit udp any any eq 123!--- Permit (Police or Drop)/Deny (Allow) all other Layer3 and!--- Layer4 traffic in accordance with existing security policies!--- and configurations for traffic that is authorized to be sent!--- to infrastructure devices!--- Create a Class-Map for traffic to be policed by!--- the CoPP featureclass-map match-all drop-udp-class match access-group 150!--- Create a Policy-Map that will be applied to the!--- Control-Plane of the device.policy-map drop-udp-traffic class drop-udp-class drop!--- Apply the Policy-Map to the!--- Control-Plane of the devicecontrol-plane service-policy input drop-udp-trafficIn the above CoPP example, the access control list entries (ACEs) that match the potential exploit packets with the "permit" action result in these packets being discarded by the policy-map "drop" function, while packets that match the "deny" action (not shown) are not affected by the policy-map drop function.
–
Warning: If the rate-limits are exceeded valid NTP traffic may also be dropped.
!--- Feature: Network Time Protocol (NTP)access-list 150 permit udp any any eq 123!--- Create a Class-Map for traffic to be policed by!--- the CoPP featureclass-map match-all rate-udp-class match access-group 150!--- Create a Policy-Map that will be applied to the!--- Control-Plane of the device.!--- NOTE: See section "4. Tuning the CoPP Policy" of!--- for more information on choosing the most!--- appropriate traffic ratespolicy-map rate-udp-traffic class rate-udp-class police 10000 1500 1500 conform-action transmit exceed-action drop violate-action drop!--- Apply the Policy-Map to the!--- Control-Plane of the devicecontrol-plane service-policy input drop-udp-trafficAdditional information on the configuration and use of the CoPP feature can be found in the documents, "Control Plane Policing Implementation Best Practices" and "Cisco IOS Software Releases 12.2 S - Control Plane Policing" at the following links: http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html
Further Description
Cisco IOS Software releases that have the fix for this Cisco bug ID, have a behavior change for mode 7 private mode packets.
Cisco IOS Software release with the fix for this Cisco bug ID, will not process NTP mode 7 packets, and will display a message "NTP: Receive: dropping message: Received NTP private mode packet. 7" if debugs for NTP are enabled.
To have Cisco IOS Software process mode 7 packets, the CLI command ntp allow mode private should be configured. This is disabled by default.
Other Resolved Caveats in Release 15.0(1)SY1
Troubleshooting
These sections describes troubleshooting guidelines for the Catalyst 6500 series switch configuration:
•
•
System Troubleshooting
This section contains troubleshooting guidelines for system-level problems:
•
•
•
Module Troubleshooting
This section contains troubleshooting guidelines for module problems:
•
•
VLAN Troubleshooting
Note
Although DTP is a point-to-point protocol, some internetworking devices might forward DTP frames. To avoid connectivity problems that might be caused by a switch acting on these forwarded DTP frames, do the following:
•
•
Spanning Tree Troubleshooting
The Spanning Tree Protocol (STP) blocks certain ports to prevent physical loops in a redundant topology. On a blocked port, switches receive spanning tree bridge protocol data units (BPDUs) periodically from neighboring switches. You can configure the frequency with which BPDUs are received by entering the spanning-tree vlan vlan_ID hello-time command (the default frequency is set to 2 seconds). If a switch does not receive a BPDU in the time period defined by the spanning-tree vlan vlan_ID max-age command (20 seconds by default), the blocked port transitions to the listening state, the learning state, and to the forwarding state. As it transitions, the switch waits for the time period specified by the spanning-tree vlan vlan_ID forward-time command (15 seconds by default) in each of these intermediate states. If a blocked spanning tree interface does not receive BPDUs from its neighbor within 50 seconds, it moves into the forwarding state.
Note
To debug STP problems, follow these guidelines:
•
•
Note
•
•
•
•
•
Additional Troubleshooting Information
For additional troubleshooting information, refer to the publications at this URL:
System Software Upgrade Instructions
See this publication:
Notices
The following notices pertain to this software license.
OpenSSL/Open SSL Project
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/).
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com).
This product includes software written by Tim Hudson (tjh@cryptsoft.com).
License Issues
The OpenSSL toolkit stays under a dual license, i.e. both the conditions of the OpenSSL License and the original SSLeay license apply to the toolkit. See below for the actual license texts. Actually both licenses are BSD-style Open Source licenses. In case of any license issues related to OpenSSL please contact openssl-core@openssl.org.
OpenSSL License:
Copyright © 1998-2007 The OpenSSL Project. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1.
2.
3.
4.
5.
6.
"This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/)".
THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT "AS IS"' AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes software written by Tim Hudson (tjh@cryptsoft.com).
Original SSLeay License:
Copyright © 1995-1998 Eric Young (eay@cryptsoft.com). All rights reserved.
This package is an SSL implementation written by Eric Young (eay@cryptsoft.com).
The implementation was written so as to conform with Netscapes SSL.
This library is free for commercial and non-commercial use as long as the following conditions are adhered to. The following conditions apply to all code found in this distribution, be it the RC4, RSA, lhash, DES, etc., code; not just the SSL code. The SSL documentation included with this distribution is covered by the same copyright terms except that the holder is Tim Hudson (tjh@cryptsoft.com).
Copyright remains Eric Young's, and as such any Copyright notices in the code are not to be removed. If this package is used in a product, Eric Young should be given attribution as the author of the parts of the library used. This can be in the form of a textual message at program startup or in documentation (online or textual) provided with the package.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1.
2.
3.
"This product includes cryptographic software written by Eric Young (eay@cryptsoft.com)".
The word `cryptographic' can be left out if the routines from the library being used are not cryptography-related.
4.
THIS SOFTWARE IS PROVIDED BY ERIC YOUNG "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
The license and distribution terms for any publicly available version or derivative of this code cannot be changed. i.e. this code cannot simply be copied and put under another distribution license [including the GNU Public License].
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see What's New in Cisco Product Documentation at: http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html.
Subscribe to What's New in Cisco Product Documentation, which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.
This document is to be used in conjunction with the Catalyst 6500 Series Cisco IOS Software Configuration Guide publication.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
©2013, Cisco Systems, Inc.
All rights reserved.
