THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.
Migration to new field notice system
Fixed Broken Image Links and Formatting
|Affected Product ID
||CDE250 IPMI FW older than v3.12 have a weak cypher issue that is fixed in the CDE250 IPMI v3.12|
||CDE250 the i2C bus can hang because of contention on the i2C bus|
This Field Notice addresses two issues on the Content Delivery Engine 250 (CDE250):
- Updates to the Intelligent Platform Management Interface (IPMI) firmware in order to remove weak ciphers from IPMI Secure Socket Shell (SSH) support.
- The current Super Doctor (SDT) utility might result in Inter-Integrated Circuit (I2C) Bus hang.
Cipher is an algorithm used to perform encryption or decryption in the SSH protocol. The CDE250 IPMI firmware versions 3.09 and earlier have weak cipher. The CDE250 system utilizes IPMI in order to monitor and manage the health of the system. This function is implemented with embedded IPMI firmware that runs within the Baseboard Management Controller (BMC) that resides on the motherboard. The new security enhancement in IPMI version 3.12 improves the cipher.
The SDT utility versions 2.112 and earlier directly access the BMC and do not validate the I2C bus availability. This possibly causes contention issues which could result in I2C bus hang. SDT version 2.113 addresses this particular issue.
There is no error message for the weak cipher.
This symptom can be observed for the I2C hang issue:
Cisco recommends that these steps be taken in order to update the IPMI for VDS-TV, VQE, and VDS-IS applications and the SDT utility for VDS-TV and VD-IS applications. This update needs to be done during a maintenance window.
||IPMI FW Version
||FW version = 3.12 or later (SDT v2.113 required)
||Unit is good, no action required
||FW version = 1.33 or 2.05 or 3.03, 3.06 or 3.09
||Upgrade IPMI FW
- Determine the IPMI FW version (see the How to Identify Affected Products section).
Note: The new IPMI FW requires SDT version 2.113.
- If the IPMI version is not 3.12, update the IPMI FW to version 3.12 with the IPMI dedicated Ethernet port and web interface or a DOS boot stick with the IPMIUP.BAT (yafukcs -full X8DAH312.ima).
- Reboot the system.
- Verify the IPMI FW is updated successfully.
For further details, refer to the IPMI Firmware v3.12 and SDT 2.113 Upgrade instructions.
For the VDS-IS application, patches have been developed in order to upgrade the SDT version 2.113 as it is required for the new IPMI FW.
||3.12 and later
||All customers that use version 3.x up to the latest 3.3.1b138 imaged
||Apply the corresponding patch in VDS-IS to upgrade the SDT version to 2.113
||3.12 and later
||All customers that use version 4.x up to the latest 4.3.2-b28 image
||Apply corresponding patch in VDS-IS to upgrade the SDT version to 2.113
Update the VDS-IS Application with the Script
- Unzip the required IPMI_VDS-IS_3x_SDT-2.113_Patch.zip / IPMI_VDS-IS_4x_SDT-2.113_Patch.zip file.
- Copy all the files to the CDE250. Make sure all the files are copied to the location "local/local1".
- Use these commands in order to check and execute the script: script check ipmi_script.sh script execute ipmi_script.sh
- Once the patch is executed properly, reload the box.
Refer to the Release Notes and IPMI Firmware downloads for further details:
How To Identify Affected Products
The hardware information can be obtained either with a CLI command or a physical inspection of the chassis. The CLI command as shown in this screenshot must be used in order to determine the IPMI FW version.
CDE Product ID Information
In order to identify the affected chassis, check the Product ID (PID) located on the right front corner of the top of the chassis.
This label is located on top right front corner of the chassis.
For More Information
If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:
Receive Email Notification For New Field Notices
Cisco Notification Service—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.