Release Note for the Cisco 4700 Series Application Control Engine Appliance Software Version vA5(3.x)

---

Enhancements in TLS Feature

In ACE A5(3.1) release following changes are being introduced:

ACE can be provisioned to use the cipher TLS_RSA_WITH_AES_128_CBC_SHA256 for SSL communication under front-end, back-end and end-to-end configuration modes. A new command has been added under the parameter-map type SSL command. In the cipher sub command support for TLS_RSA_WITH_AES_128_CBC_SHA256 { 0x00,0x3C }has been added.

Configuration

Example:

---

Note This Cipher is only supported with TLS1.2

---

Note This cipher is not supported by HTTPS probes.

Support of Radius Sticky Information

In this Software version support for ‘Deleting Fip Sticky Entries on Acct Stop with Session Stop Indicator’ feature has been added. This features enables to delete the sticky entry based on the Attribute 26 (VSA) 11 called the ‘Session Stop Indicator’ in the Accounting Stop request. In Device Manager 5(3.1) version, under the menu Config >Devices >Load Balancing >Stickiness >Add/Edit screen, when TYPE is selected as RADIUS, parameters can be added in the form of a check box - ‘Radius Purge Information’ parameter.

New Command

Support of Hex data in TCP / UDP Probe Send-data and Expect Regex

ACE software version A5(3.0) supports configuring of send-data and expect regex CLI commands to accommodate the configuration of Hex data. If Hex data configured is “ae5530”(6 bytes) then the converted value will be Hex ae,55,30 (3 bytes).

The first two bytes of the Hex string are taken and converted to one byte actual Hex value (For example- ‘a’ & ‘e’ from the string would be combined to form hex value ‘ae’). This conversion model is based on the existing hash value config under HTTP/HTTPS probe. The same CLI command modification can be covered under TCP and UDP probes.

New CLI Commands

The following new commands have been added to configure hex data and hex regex under TCP and UDP probes:

---

Note You can use the keyword send-hex-data to configure the probe for allowing hex data.

---

Note You can use the keyword hex-regex to configure the probe for allowing hex in expect regex CLI commands.

Guidelines and Restrictions

The following conditions should be taken care while configuring hex data:

• Enter Hex data in an even numbered length and a maximum size of 254
• The Hex data entered must be a single string consisting of alphanumeric within the range of 0-9, a-f or A-F.
• The Hex data configured will be stored and shown as ASCII text in the show probe detail and show running-config CLI commands.
• For send-hex-data <data>, the conversion from Hex ASCII to Binary will occur when the probe data is sent out.
• For expect hex-regex <data>, the configured regex hex data is converted to binary data at the time of parsing the server response against the configured regex hex data.
• If send-hex-data is configured then expect hex-regex should be configured and if send-data is configured then expect regex should be configured.
• Data strings should be even-numbered length both in send-hex-data and in expect hex-regex
• Do not include white space
• Only specify hex values
• expect hex-regex ae5530da offset 2 behavior will be same as expect regex aedsfte offset 2.
• Users should take care of expect regex configuration. For example, if send-hex-data is configured then expect hex-regex should be configured and if send-data is configured then expect regex should be configured.

Enhancements in HTTP Content Rewrite

The HTTP content rewrite feature provides the capability to rewrite configured regex patterns in the HTTP response data. This feature has been enhanced to introduce the rewrite functionality to support rewrite for HTTP content in server to client direction.

The feature uses a rule-based rewriting engine (based on a regular-expression parser) to rewrite requested patterns on the fly. Content rewrite will provide a flexible and powerful content manipulation mechanism. URL content rewrite feature is effectively a search on the full content for each HTTP response in range and replace a match of regex search pattern with the defined regex replace pattern.

New CLI Commands

The following content rewrite command has been added newly as part of HTTP modify action list

Example:

---

Note Only one rewrite configuration is allowed per action list.

Configuration and Restrictions

The content-rewrite happens for the response data based on the amount of data that HTTP module received from TCP. By default, HTTP receives up to 32K bytes (including headers) of response data (Default TCP buffer share is 32K). Hence the content-rewrite works fine up to first 32K response data, if the response data is more than 32K then ACE will send out the remaining data without doing any content-rewrite.

If you want to send more data from TCP to HTTP then you can increase the tcp buffer-share size to up to 48K, then ACE will do the content-rewrite for the first 48K response data and bypasses the remaining response data without content-rewrite.

Example:

---

Note We have observed ACE is taking more time to do content-rewrite for large response files, (For one GET request of 48K byte data with content-rewrite is taking approximately 6 seconds.)

The ability to support basic and extended regex will depend on the support of regex parser on DP. Content rewrite rule must have both content regex pattern and replacement pattern.

Support of TLS1.1 and TLS1.2

ACE Software A5(3.0) supports the newer versions of TLS (TLS 1.1 and TLS 1.2). This enables ACE to successfully negotiate with TLS1.1 and TLS1.2 clients (in front-end and end-to-end SSL configuration) and to also act as a TLS1.1 or TLS1.2 server (in back-end and end-to-end SSL configuration).

This feature is implemented over existing SSL/TLS software stack. The existing Handshake design or packet flow is re-designed to support application record and handshake record interleave feature, at the same time it does not impact existing features of SSL/TLS.

New CLI Commands

The following new commands have been added to support TLS1.1 and TLS1.2:

Note The configuration version Upto_TLS1_1 indicates that ACE supports SSL3.0, TLS1.0 and TLS1.1 versions.

Note The configuration version Upto_TLS1_2 indicates that ACE supports SSL3.0, TLS1.0, TLS1.1 and TLS1.2 versions.

---

Note Only one version configuration is allowed in one ssl parameter map. The previous version gets overwritten if a new version is configured.

Modified CLI Commands

For TLS1.1:

For TLS1.2:

Configuration

For TLS1.1

switch/Admin(config-parammap-ssl)# version Upto_TLS1_1

For TLS1.2:

Signature Hash Algorithm

ACE only supports SHA256(0x04)/RSA(0x01) as the signature hash algorithm hash/signature hash algorithm signature in the case of TLS1.2 if client authentication is used. Handshake will fail if the peer doesn't support this combination.

Guidelines and Restrictions

For TLS1.1 and TLS1.2 SSL versions, only certain ciphers are supported as mentioned in the tables below. If you try to configure any unsupported SSL version or unsupported cipher, an error message will be displayed.

Table 1 Cipher suites supported by TLS 1.1

Table 2 Cipher suites supported by TLS 1.2

ACE does not block the configuration of export ciphers even when version version Upto_TLS1_1 or version Upto_TLS1_2 is configured. This is because when version Upto_TLS1_1 or version Upto_TLS1_2 is configured ACE will still negotiate with SSL3/TLS1 clients and use those export ciphers with those clients. ACE will not select export ciphers for TLS1.1/1.2 even if you have export ciphers configured in the parameter map.

If only export ciphers are configured in the ssl parameter map along with version Upto_TLS1_1/Upto_TLS1_2 (or a combination of Upto_TLS1_2 and only RSA_WITH_DES_CBC_SHA) then:

1. ACE as a server will not be able to accept any TLS1.1/1.2 request and will send an alert (no_shared_cipher)

2. ACE as a client will send a client hello with only TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff), which is not a cipher but only indicates that it supports secure renegotiation. Server will send alert (no_shared_cipher) in this case.

---

Note TLS1.1 requests will work with the combination of Upto_TLS1_2 and only RSA_WITH_DES_CBC_SHA.

New MIB Objects for TLS1.1 and TLS1.2

Following are the new MIB objects for TLS1.1 and TLS1.2:

• cspTl1cFullHandShake–-Displays the number of full handshakes done with TLS1.1
• cspTl1cResumedHandShake–-Displays the number of resumed handshakes done with TLS1.1
• cspTl1cHandShakeFailed–-Displays the number of handshakes failed for TLS1.1
• cspTl1cDataFailed–-Displays the number of data failures for TLS1.1
• cspTl2cFullHandShake–-Displays the number of full handshakes done with TLS1.2
• cspTl2cResumedHandShake–- Displays the number of resumed handshakes done with TLS1.2
• cspTl2cHandShakeFailed–-Displays the number of handshakes failed for TLS1.2
• cspTl2cDataFailed–-Displays the number of data failures for TLS1.2

FTP SLB IPV6 Support

The application firewall currently supports a list of applications including HTTP, SIP, FTP. The FTP deep inspection is an application firewall that statefully monitors the File Transfer Protocol. Earlier version of ACE supports FTP with IPv4. With A5(3.0), the ACE now supports FTP with both IPv4 and IPv6.

This feature does not support the following:

• SSL based FTP for IPv6.
• FTP from IPv4 client to IPv6 server.
• Addition of static Route cannot be done with SLB64.
• 1-Arm mode config is not supported with SLB64 as static route addition is not supported.
• SFTP is not supported.

Sample Configuration

Included below is a summary of the sample configuration to support FTP IPv6 in A5(3.0):

For FTP IPv6:

 

For Strict IPv6:

Updates to Resource Parameter Monitoring

The existing CLI show resource monitor-params has been extended for displaying 1 min and 5 min average of the following utilization parameters:

1. System Level: Bandwidth, CPU, Memory, CPS, Total connections, Total SSL connections

2. Per Context: Bandwidth, CPS, Total connections

3. Per VIP: Bandwidth, CPS, Total connections

4. Per Rserver: Bandwidth, CPS, Total connections

---

Note 1 minute average is calculated based on 2 readings at 30 sec interval and 5 min average is calculated based on 5 readings at 1 minute interval.

Sample output of the CLI commands are as follows:

Ability to Configure Fragment Timeout in Milliseconds

With A5(3.0) release you can configure the fragment timeout in seconds (fragment timeout for IPV4 and ipv6 fragment timeout for IPV6). In re-assembly module, the shadow table maintains the time-out values of fragments received by ACE re-assembly. The Re-assembly module scans the shadow table entries and cleans the timed out entries. By default the Re-assembly timer interval timeout is 5 seconds for IPV4 and 60 seconds for IPV6. With the A5(3.0) release, the ACE includes the re-assembly-time-interval CLI command to provide a command option to configure the timer interval. By default, the re-assembly timeout scan happens once in a 1000 milliseconds (1 second). By using this command the time interval can be configured as per the requirement.

New CLI Commands

The syntax for the fragment timeout are as follows:

For IPV4:

fragment timeout-msec <timeout value in mille seconds>

For IPV6:

ipv6 fragment timeout-msec <timeout in mille seconds >

Example:

Ability to Configure the Re-assembly Timer Interval

In re-assembly module, the shadow table maintains the timeout values of fragments received by re-assembly. The re-assembly timer scans the shadow table entries and cleans the timed out entries. By default the re-assembly timer interval is 1 second (1000 msecs). ACE A5(3.0) provides command option to configure the timer interval. By default, the re-assembly timeout scan happens once in a 1000 mille seconds (1 second). By using this CLI command the interval can be configured as per the requirement. This is a system level parameter.

The syntax for the re-assembly timer interval command is as follows:

system-defaults reassembly-timer-interval

Example:

---

Note This is a global level CLI command which is applicable for all the contexts.

Automatic Capture of Exec Command Mode Output

With A5(3.0), the ACE now supports the ability to automatically capture output of any non-interactive Exec mode show command for debugging purposes.

Use the following CLI command to configure the automatic capture of Exec command mode output:

• Interval – specifies the time difference in minutes between two snapshots. This value can be between 5 and 32767 minutes
• Count – specifies the number of periodic snapshots that should be stored.
• Command – specifies the non-interactive exec mode/show command that has to be executed at the specified interval

In the sample configuration shown above, the output of show tech CLI command will be captured and stored every 5 minutes and the latest 4 such outputs will get stored in core:AUTO-SNAP directory.

The content will be stored in.gz format, you must download and extract the content to obtain the text file with the required collected output.

Sample Content:

---

Note This command will occupy disk space and hence needs to be used sparingly (only for debugging purpose).

Ability to Capture the Complete Output of the LbInspect Tool

With software version A5(3.0), the show np x lb-stats command is extended to include a sub-option all under following type of stats which would dump lb stats for:

New CLI Commands

Example:

If we want LB-stats of 256 contexts, the following will have to be specified:

Caching of snmp-get response for L4-L7 Resource Limit MIB

With software version A5(3.0), caching has been implemented for snmpget query for objects in CISCO-L4L7MODULE-RESOURCE-LIMIT-MIB (1.3.6.1.4.1.9.9.480).

In earlier version of ACE, snmpget requests for objects in above MIB was timing out intermittently due to read operations taking longer time. To overcome this, caching has been implemented. Hence, when first snmpget query is done, the response is cached and subsequent queries received within 15 secs interval of the 1st query are provided the same response.

Ability to Allow SSL Record Parsing to a Specific Size

ACE allocates predefined number of buffers for each packet that needs to be parsed due to some L7 configuration, this is 17 by default. However, the valid SSL records can potentially occupy more than this default number of buffers depending on the record size. For example, a record of 16400 bytes can occupy as many as 33 buffers. This falsely triggers an error and packet drop. In order to prevent this ACE allocates as many buffers for SSL requests as per the record size that the client legitimately sends. This will override the default buffer size of 17 for SSL packets that get parsed.

New CLI Commands

The syntax to configure the ACE SSL maximum record size is as follows:

Example:

---

Note This will allow ACE to parse SSL records up to the size defined (<number>) without resulting in a rejection such as a slow-loris detection.

Configuration

Ability to Allow HTTP to Parse the Non-encoded Characters

With A5(3.0) release you can configure ACE HTTP to parse the non-encoded special characters.

By default, ACE follows RFC-2396 compliance and if any unwise characters (non-encoded special characters) comes in the url request then HTTP detects those non-encoded characters and resets the connection. If you configure this CLI command then ACE will allow the non-encoded special characters.

New CLI Commands

The syntax for this are as follows:

Example:

---

Note This is a global level CLI which is applicable for all the contexts.

Sample Output of Show Serverfarm Detail

Following are the sample output of “show serverfarm detail”. Here, the count under current represents the total active connections associated with the rserver. The count under total represents the total successful connections hit the rserver and this includes the count of current connection. The count under failure represents the total failed connections to hit the rserver.

Support for A5(3.0)-Specific Features in ACE Appliance Device Manager GUI

With the A5(3.0) software release, the ACE appliance Device Manager GUI includes support for:

• Support of Hex data in TCP / UDP Probe Send-data and Expect Regex
• Enhancements in the HTTP Content Rewrite
• Support of TLS1.1 and TLS1.2
• FTP SLB IPV6 Support
• Updates to Resource Parameter Monitoring
• Ability to Configure the Reassembly Timer Interval
• Automatic Capture of Exec Command Mode Output
• Ability to Allow SSL Record Parsing to a Specific Size
• Caching of snmp-get response for L4-L7 Resource Limit MIB

For details, refer to the Device Manager GUI Guide, Cisco ACE 4700 Series Application Control Engine Appliance.

---

---

Table 3 Supported Browsers

Browser	Version	Client Platform
Microsoft Internet Explorer	IE 7.0	Windows XP Professional with Service Pack 2 or Windows Vista with Service Pack 1
	IE 8.0	Windows XP Professional with Service Pack 2, Windows Vista with Service Pack 1, or Windows 7
	IE 9.0	IE 9.0 Windows Vista with Service Pack 2 and Windows 7.
	IE 10.0	IE 10.0 Windows 8.
Firefox	20	Windows XP Professional with Service Pack 2, Windows Vista with Service Pack 1, or Windows 7 Red Hat Enterprise Linux 5

---

Table 4 Redundancy Feature Availability Between Major ACE Software Versions

Platform	Active	Standby	Bulk Sync	Incr Sync	Conn Repl	Sticky Repl	Operation	Comments
Appliance	A3(x)	A5(x)	Yes	No	Yes	Yes	Upgrade	—
Appliance	A4(1.x)	A5(x)	Yes	No	Yes	Yes	Upgrade	—
Appliance	A4(2.x)	A5(x)	Yes	No	Yes	Yes	Upgrade	—
Appliance	A5(x)	A3(x)	Yes	No	Yes (IPv4 flows)	Yes (IPv4 flows)	Downgrade	Standby supports only IPv4
Appliance	A5(x)	A4(1.x)	Yes	No	Yes (IPv4 flows)	Yes (IPv4 flows)	Downgrade	Standby supports only IPv4
Appliance	A5(x)	A4(2.x)	Yes	No	Yes (IPv4 flows)	Yes (IPv4 flows)	Downgrade	Standby supports only IPv4

---

---

Document Title	Description
Cisco 4710 Application Control Engine Appliance Hardware Installation Guide	Provides hardware information for installing the Cisco ACE 4710 appliance.
Regulatory Compliance and Safety Information for the Cisco 4710 Application Control Engine Appliance	Provide regulatory compliance and safety information for the Cisco ACE 4710 appliance.

Document Title	Description
Release Note for the Cisco 4700 Series Application Control Engine Appliance	Provides information about operating considerations and caveats for the ACE.
Getting Started Guide, Cisco ACE 4700 Series Application Control Engine Appliance	Describes how to use the ACE appliance Device Manager GUI and CLI to perform the initial setup and configuration tasks.
Upgrade/Downgrade Guide, Cisco ACE 4700 Series Application Control Engine Appliance	Describes how to perform the following ACE software upgrade/downgrade tasks: Upgrade scenarios Effects of upgrading or downgrading Ordering an upgrade license and generating a key Upgrading your ACE software in a redundant configuration Downgrading your ACE software in a redundant configuration

Document Title	Description
Device Manager GUI Guide, Cisco ACE 4700 Series Application Control Engine Appliance	Describes how to use the ACE appliance Device Manager. The Device Manager resides in Flash memory on the ACE appliance to provide a browser-based graphical user interface for configuring and managing the ACE.

Document Title	Description
Administration Guide, Cisco ACE Appliance Control Engine	Describes how to perform the following administration tasks on the ACE: Setting up the ACE Establishing remote access Managing software licenses Configuring class maps and policy maps Managing the ACE software Configuring SNMP Configuring redundancy Configuring the XML interface Upgrading the ACE software
Application Acceleration and Optimization Guide, Cisco ACE 4700 Series Application Control Engine Appliance	Describes the configuration of the application acceleration and optimization features of the ACE. It also provides an overview and description of the application acceleration features and operation.
Cisco Application Control Engine (ACE) Configuration Examples Wiki	Provides examples of common configurations for load balancing, security, SSL, routing and bridging, virtualization, and so on.
Cisco Application Control Engine (ACE) Troubleshooting Wiki	Describes the procedures and methodology in wiki format to troubleshoot the most common problems that you may encounter during the operation of your ACE.
Command Reference, Cisco ACE Application Control Engine	Provides an alphabetical list and descriptions of all CLI commands by mode, including syntax, options, and related commands.
Routing and Bridging Guide, Cisco ACE Application Control Engine	Describes how to perform the following routing and bridging tasks on the ACE: Ethernet interface ports VLAN interfaces IPv6, including transitioning IPv4 networks to IPv6, IPv6 header format, IPv6 addressing, and supported protocols Routing Bridging Dynamic Host Configuration Protocol (DHCP)
Security Guide, Cisco ACE Application Control Engine	Describes how to perform the following ACE security configuration tasks: Security access control lists (ACLs) User authentication and accounting using a Terminal Access Controller Access Control System Plus (TACACS+), Remote Authentication Dial-In User Service (RADIUS), or Lightweight Directory Access Protocol (LDAP) server Application protocol and HTTP deep packet inspection TCP/IP normalization and termination parameters Network Address Translation (NAT)
Server Load-Balancing Guide, Cisco ACE Application Control Engine	Describes how to configure the following server load-balancing tasks on the ACE: Real servers and server farms Class maps and policy maps to load balance traffic to real servers in server farms Server health monitoring (probes) Stickiness Dynamic workload scaling (DWS) Firewall load balancing TCL scripts
SSL Guide, Cisco ACE Application Control Engine	Describes how to configure the following Secure Sockets Layer (SSL) tasks on the ACE: SSL certificates and keys SSL initiation SSL termination End-to-end SSL
System Message Guide, Cisco ACE Application Control Engine	Describes how to configure system message logging on the ACE. This guide also lists and describes the system log (syslog) messages generated by the ACE.
Virtualization Guide, Cisco ACE Application Control Engine	Describes how to operate your ACE in a single context or in multiple contexts.
Cisco CSS-to-ACE Conversion Tool User Guide	Describes how to use the CSS-to-ACE conversion tool to migrate Cisco Content Services Switches (CSS) running-configuration or startup-configuration files to the ACE.

User Guide, Cisco Application Networking Manager

Describes how to use Cisco Application Networking Manager (ANM), a networking management application for monitoring and configuring network devices, including the ACE.

Software Version A5(3.5) Resolved Caveats

The following resolved caveats apply to software version A5(3.5):

• CSCvb16317—Cisco ACE Denial of Service Vulnerability. When processing some SSL packets, the ACEs reloads with back trace. This issue was able to repro in lab by using script from the cipherscan from the Redhat Website.
• CSCux95091—Evaluation of ace for NTP_January_2016. This bug has been filed against Cisco Application Control Engine (ACE30/ ACE 4710) to address the vulnerability known as NTP_January_2016 and identified by the Common Vulnerability and Exposures (CVE) IDs:

1. CVE-2015-7973

2. CVE-2015-7974

3. CVE-2015-7975

4. CVE-2015-7976

5. CVE-2015-7977

6. CVE-2015-7978

7. CVE-2015-7979

8. CVE-2015-8138

9. CVE-2015-8139

10. CVE-2015-8140

11. CVE-2015-8158

• CSCuz92646—Evaluation of ace for NTP_June_2016. This bug has been filed against Cisco Application Control Engine (ACE30/ ACE 4710) to address the vulnerability known as NTP_June_2016 and identified by the Common Vulnerability and Exposures (CVE) IDs:

1. CVE-2016-4957

2. CVE-2016-4953

3. CVE-2016-4954

4. CVE-2016-4955

5. CVE-2016-4956

Software Version A5(3.4) Resolved Caveats

The following resolved caveats apply to software version A5(3.4):

• CSCuw09152—VLAN 4095 was not downloaded properly. It may cause encap table to get full
• CSCuw14044—FT synch takes too long to complete with TACACS enabled - When TACACS is being used for authentication, the FT sync takes a longer time to complete with the A5(3.x)

– New CLI Commands: The following new command has been added to disable crypto chaingroup update feature:

– Functionality: The CLI is restricted to Admin and it is a global CLI. When we configure this CLI it will disable the "crypto chaingroup update function"(CSCue49212) to reduce the HA sync time after reload.

– Configuration:

– Guidelines and Restrictions: The following conditions should be taken care while configuring CLI:
1. When we configure CLI we should not remove any certificate under "crypto chaingroup <NAME>
2. If we remove the certificates under "crypto chaingroup <NAME>" when CLI is configured, we need to add particular chaingroup again under ssl-proxy once again.

• CSCuw36845— IPV6 VIP gets stuck in DAD TENTATIVE state and not passing traffic - IPV6 VIP stuck in TENTATIVE state and not passing traffic. Were able to reproduce the issue by replying the service policy for the VIP. In customer case it occurred on its own.
• CSCuw84697—Evaluation of ace for NTP_October_2015 - This bug has been filed against Cisco Application Control Engine (ACE30/ ACE 4710) to address the vulnerabilities known as NTP_October_2015 and identified by the Common Vulnerability and Exposures (CVE) IDs:

1. CVE-2015-7691

2. CVE-2015-7692

3. CVE-2015-7701

4. CVE-2015-7702

5. CVE-2015-7703

6. CVE-2015-7704

7. CVE-2015-7705

8. CVE-2015-7848

9. CVE-2015-7849

10. CVE-2015-7850

11. CVE-2015-7851

12. CVE-2015-7852

13. CVE-2015-7853

14. CVE-2015-7854

15. CVE-2015-7855

16. CVE-2015-7871

Software Version A5(3.3) Resolved Caveats

The following resolved caveats apply to software version A5(3.3):

• CSCut83796—April 2015 NTPd vulnerabilities - This product includes a version of NTPd that is affected by the vulnerability identified by the Common Vulnerability and Exposures (CVE) IDs:

1. CVE-2015-1798

2. CVE-2015-1799

• CSCuu39811—Make the SNMP fix for CSCuf30894 configuration to provide faster resp.

– In earlier versions, snmpget requests for objects in L4-L7 Resource Limit MIB used to time out intermittently due to more time taken for read operations. To resolve this, caching mechanism has been implemented in A5(3.0). The 15 seconds delay has been introduced for the snmpget bulk requests.

– In CSCuu39811, disabling the cache option has been provided to get a faster response. By default the cache is enabled and the CLI provides an option to disable the cache.

– A new CLI "get-request-cache-disable" is added under the token "snmp-server" to disable the cache i.e. the15 secs delay (To know more on the caching mechanism implementation please refer this link http://www.cisco.com/c/en/us/td/docs/app_ntwk_services/data_center_app_services/ace_appliances/VA5_3_x/release/note/ACE_app_rn_A53x.html#pgfId-907398). So once the CLI "snmp-server get-request-cache-disable" is configured and a bulk of snmpget is sent to ACE, the updated information is returned immediately.

• CSCuu82343—Evaluation of ace for OpenSSL June 2015 - This product includes a version of OpenSSL that is affected by the vulnerability identified by the Common Vulnerability and Exposures (CVE) IDs:

1. CVE-2015-4000

2. CVE-2015-1788

3. CVE-2015-1789

4. CVE-2015-1790

5. CVE-2015-1792

6. CVE-2015-1791

7. CVE-2014-8176

• CSCuv33150—Cisco ACE30/4710 TLS Poodle variant vulnerability that is affected by the vulnerability identified by the Common Vulnerability and Exposures (CVE) ID:

– CVE-2015-4595

• CSCuv36100—The Logjam Vulnerability has been addressed by disabling the related ciphers. The following are the disabled ciphers:

a. TLS_DHE_RSA_WITH_AES_128_CBC_SHA

b. TLS_DHE_RSA_WITH_AES_256_CBC_SHA

– The Mozilla Firefox will disable the weak ciphers (mentioned above) in the version 39 or above. The DM 5.3.3 will work with the Mozilla Firefox version 39 or above with the fix to disable the ciphers. However in the older versions of Mozilla Firefox, we will be seeing the impact as there is no cipher overlap supporting these ciphers. Hence, login screen may not appear. Additionally, if the below versions of DM (A5.3.2 and below) are used in the Mozilla Firefox version 39 or above, it will result in the weak DHE Key being used for Handshake, and hence the login page may not appear.

– For new configurations, these will not be valid ciphers to put into the command and an error will be the result due to failed Handshake if the valid ciphers are not used.

Software Version A5(3.3) Open Caveats

The following open caveats apply to software version A5(3.3):

• CSCul90247—ACE:ACE resets both sides after sending false encap alert type_21
• CSCuo74623—ACE 30: device crashed with "last boot reason: CP Kernel Crash"
• CSCus40778—ACE: dst cache overflow

Software Version A5(3.2) Resolved Caveats

The following resolved caveats apply to software version A5(3.2):

• CSCuj91023—ACE A5(2.x) Https probes unable to handle split SSL with Server 2012.
• CSCug88070—ACE HTTPS probe (version A522) does not send traffic on wire. Yet ACE thinks it is firing -gives probe fail reason and counters as if probe really fired.
• CSCup84117—ACE 30A5(3.0) - Memory Leak
• CSCuq60062—Revert CSCug93530 fix
• CSCuq66230—A5(3.1) ACE30 Health Monitoring (HM) crash
• CSCuq92623—IPV6 address starts pinging even though VIP is out of service.
• CSCur02195—ACE evaluation for CVE-2014-6271 and CVE-2014-7169.
• CSCur16238—ACE: MIB definition is incorrect.
• CSCur18171—Ace X-Forwarded-For rewrite breaks for the subsequent flows.
• CSCur23304—/bin/bash user exists in ACE30 that authenticates using external AAA
• CSCur23683—ACE4710 content rewrite does not work when compression is enabled.
• CSCur31344—Avg 'idle CPU' in "show system resources" is much lower in A5(3.0).
• CSCur41610—Failed routed probes shows 0.0.0.0 ip address in syslogs.
• CSCur42025—ACE: dir image output not showing byte counts.
• CSCur57515—ACE: dir image output not showing byte counts.
• CSCur92238—HTTPS probe failing with "ssl certificate-expiration ignore"
• CSCus42709—JANUARY 2015 OpenSSL Vulnerabilities.
• CSCus43274—CVE-2010-4755 - OpenSSH - Memory Corruption Issue with SFTP.
• CSCus69159—ACE 30: SSL probe script needs to be fixed for poodle vulnerability
• CSCus72091—Telnet failure.
• CSCur73173—Web pages do not display when using client authentication and crl.

Software Version A5(3.2) Open Caveats

None.

Software Version A5(3.1b) Resolved Caveats

The following resolved caveats apply to software version A5(3.1b):

• CSCur02195—The ACE 4710 and ACE30 include a version of bash that is affected by the vulnerabilities identified by the Common Vulnerability and Exposures (CVE) IDs:

1. CVE-2014-6271

2. CVE-2014-6277

3. CVE-2014-6278

4. CVE-2014-7169

5. CVE-2014-7186

6. CVE-2014-7187

• CSCur23683—ACE30: evaluation of SSLv3 POODLE vulnerability.

---

Note ACE will no longer support SSLv3 version of SSL. ACE will support the following SSL versions TLS1.0, TLS1.1, and TLS1.2. A performance degradation of 9% may be observed while using TLS1.0 compared to SSLv3.

• CSCur27691—CVE-2014-3566 related to Poodle vulnerability has been fixed in DM release 5.3.1.

Software Version A5(3.1b) Open Caveats

The following open caveats apply to software version A5(3.1b):

• CSCur92238—HTTPS probe failing with “ssl certificate-expiration ignore.

Configuring the command “ssl certificate-expiration ignore” under HTTPS probe will cause the HTTPS probes to fail.

Workaround: To make probes work, you have to remove this command by using “no ssl certificate-expiration ignore” under HTTPS probe and use valid certificates.

• CSCuj91023—ACE A5(2.x) Https probes unable to handle split SSL with Server 2012.
• CSCuo30577—ACE/A5(3.0): silent reboot with no core dump.
• CSCup61227—ACE 30 A5(3.0) - Warning:- MTS queue is full opcode 4062sap%d pid %d.
• CSCup84117—ACE 30A5(3.0) - Memory Leak.
• CSCuq53270—ACE 30: device crashed with "last boot reason: CP Kernel Crash”.
• CSCuq60062—Revert CSCug93530 fix.
• CSCuq92452—LMS 4.2.5 ssh sessions getting stuck on ACE.
• CSCuq92623—IPV6 address starts pinging even though VIP is out of service.
• CSCur16238—ACE: MIB definition is incorrect.
• CSCur18171—Ace X-Forwarded-For rewrite breaks for the subsequent flows.
• CSCur23304—/bin/bash user exists in ACE30 that authenticates using external AAA.
• CSCur31344—ACE4710 content rewrite does not work when compression is enabled.
• CSCur41610—Avg 'idle CPU' in "show system resources" is much lower in A5(3.0).
• CSCur42025—Failed routed probes shows 0.0.0.0 ip address in syslogs.
• CSCur57515—ACE: dir image output not showing byte counts.
• CSCur63959—Sticky entries with time-to-expire higher than timeout.
• CSCur75687—ACE in bridge mode causes L2 loop during ft switchover.

Software Version A5(3.1a) Resolved Caveats

The following resolved caveats apply to software version A5(3.1a):

• CSCuq66230—ACE crashed after upgrading to A5(3.1) from A5(3.0).

Software Version A5(3.1a) Open Caveats

The following open caveats apply to software version A5(3.1a):

• CSCug27629—As the Access Control List (ACL) configuration is modified it is sometimes seen that an ACL merge error will be reported on one or more of the interfaces where the ACL list is applied. This leaves the interface in an inconsistent state. The dynamic configuration of ACLs lists within a context. Workaround:

1. Remove the offending lines one at a time until the ACL can be applied successfully.

2. Remove the offending lines and try a different line number

Reload the ACE.

• CSCuj91023—ACE A5(2.x) is unable to handle Split SSL Records when using HTTPS Probes on Windows Server 2012 ( IIS Server). Only happens with Windows Server 2012, the security update seems to be present in every server OS since 2003. Workaround: Change the https probe to SSL v3.

Or

Follow the instructions here: http://support.microsoft.com/kb/2643584

Software Version A5(3.1) Resolved Caveats

The following resolved caveats apply to software version A5(3.1):

• CSCuo24300— DM 5.3.1 Purge Sticky information
• CSCup39438— New feature to support TLS_RSA_WITH_AES_128_CBC_SHA256 in DM
• CSCup11314— Standby ACE GUI does not reflect SNMP user change.
• CSCuo34438—ICMP probe works fine in admin context but it fails in other context. All contexts are having same VLAN as dedicated management VLAN but different IP. "show acl-merge acls vlan 108 in" shows data only for admin context but not for other context. show acl-merge acls vlan 108 in`. Workaround: None.
• CSCul15825—ACE with NTPv3 with authentication configured shows one of those symptoms:

1. show ntp peer-status does not show NTP server

2. ACE cannot sync clock with NTPv3 server with authentication configured

3. "Could not find the relevant data" when trying to delete ntp server configured with authentication

Workaround:

1. Make sure that NTP key is entered before NTP server where this key is referenced:

2. This workaround will work until the box is rebooted, workaround should be applied again afterwards.

• CSCul39399—Some sylog messages are missing in 'show logging' even though all messages are sent to the syslog server successfully. Workaround: None.
• CSCum24735—"no logging message 199008" is added twice to ACE running/startup configuration that can cause ACE import to ANM to fail. Workaround: Enabled logging of this specific message: "logging message 199008"
• CSCum65701—Unable to reach outside ip addresses, by using the ldap://57.250.237.230/cn=CRL52,o=EQUANT certificateRevocationList;binary ldap request, Unable to see the ACE sending the ?binary? part of the attribute. Workaround: None.
• CSCun02703—ACE30 sends HTTP request using cookie insert to backup rserver instead of primary rserver that is active. Workaround: In the serverfarm do "no inservice standby" followed by "inservice standby" for the backup rserver, when the primary rserver comes back online, in order to update the sticky entry, so that it points to the primary rserver again.
• CSCuo52444—URL rewrite feature isn't including the entire query string in the new url. Instead, the regex match stops at first ampersand (&) in query string resulting in an incomplete rewrite. Workaround: None.
• CSCud71628—HTTP performance across ACE is very bad. Packet captures show, that ACE drops the TCP Window Size it advertises to the client to a very low value early in the connection and never recovers from this.Workaround: Disable the "tcp-options window-scale allow".
• CSCup80089—ACE4710 crashed running A5(3.0) code and created four core files:np1_hw_state, np1_crash.txt.gz, np1_core.bin.tar.gz, and outstanding_syslogs. Workaround: Block multicast fragmented packets thru ace via ACL or other means.
• CSCuq30645—Syslog to inform hash collision while adding VIP IP in "icmp-vip" table.
• CSCum24308—”show IPv6 neighbors” output is showing wrong VLAN in Bridge mode.Workaround: Configuring static entry of the IPv6 neighbor solves the issue.
• CSCui30210—ACE unknown Silent reboot without Core Dump.

Software Version A5(3.1) Open Caveats

The following open caveats apply to software version A5(3.1):

• CSCug27629—As the Access Control List (ACL) configuration is modified it is sometimes seen that an ACL merge error will be reported on one or more of the interfaces where the ACL list is applied. This leaves the interface in an inconsistent state. The dynamic configuration of ACLs lists within a context. Workaround:

1. Remove the offending lines one at a time until the ACL can be applied successfully.

2. Remove the offending lines and try a different line number

3. Reload the ACE.

Software Version A5(3.1) System Log Messages

442008

Error Message ACE-4-442008: Real Server test1 is down, config change is not updated internally.

442009

Error Message ACE-4-442009: Context:0 Hash collision occurred while creating entry in icmp-vip table for VIP ip: 80.0.0.100 ifid: 3

---

Note If we add/modify VIP address into class-map, ACE internally adds the new VIP address into icmp-vip table. During this, icmp-vip table update if there is any collision, the above sys log is generated.

Software Version A5(3.0) Resolved Caveats

The following resolved caveats apply to software version A5(3.0):

CSCud71628—The bad performance is due to the way TCP tries to recover from the low Window Size ACE reports: When the client receives a Window Size lower than a certain threshold, it will wait for 5 seconds to allow the peer devices (the ACE in this case) to process the data in its buffers after which it should update the Window Size again. As ACE never sends an updated Window Size, the client waits for the full 5 seconds before attempting to send further data. As ACE still responds to this additional data with the same low (or an even lower) Window Size, the same procedure starts over again. Workaround : Disable the "tcp-options window-scale allow”.

CSCue38032—"ACE appliance giving ""write error: No space left on device"" when issuing various commands. Condition : ACE appliance with heavy use of the DM. Workaround: Log to debuguser and issue the following commands from the shell:

CSCue38310—ACE with IPV6 Enabled attempt to give same IPV6 address to different non shared interfaces fails. Workaround : None.

CSCue49212—The order of issuer certs in the SSL/TLS cert chain sent by the ACE in Server Hello, may be different than their order in the configured chaingroup.Workaround: Remove/re-apply chaingroup or configure a new chaingroup with the certs in the chaingroup in order, from lowest sub at the top, to root CA at the bottom.

CSCue73311—Cisco ACE includes a version of OpenSSL that is affected by the vulnerabilities identified by the following Common Vulnerability and Exposures (CVE) IDs:CVE-2011-1473. Wokaround : The SSL/TLS renegotiation can be disabled by disabling the ''rehandshake'.

CSCue78766—Arp entry may be incorrect for an interface on a context. The output for that interface via ""show arp"" and ""show int"" do not match Workaround:Do a ""shut"" followed by ""no shut"" on the interface in the context."

CSCue75913—”ACE30 module crashes and generates core file snmpd_log.xxxx.tar.gz Workaround:Stop SNMP polling of ACE30 module."

CSCue88110—"ACE30 module crashes and generates core file snmpd_log.1033.xxxx.tar.gz. Last boot reason: Service ""snmpd"". Death reason: SYSMGR_DEATH_REASON_FAILURE_SIGNAL malloc_printerr () from /lib/tls/libc.so.6 in backtrace. Workaround:Stop SNMP polling of ACE30 module."

CSCue93409—ACE crashed due to service NTP. Workaround: none, the box recovers after the crash.

CSCue97543—"TCP connections across ACE are extremely slow (delays of several minutes are possible) or fail completely. In packet captures you will see a jump of the TCP timestamp (TSval) sent from ACE to the backend server at some point (more precisely: when the connection is unproxied on ACE). Workaround:a. Either remove the ""tcp-options timestamp allow"" b. Or, if the timestamp option is required, force the connection to remain proxied on ACE throughout its lifetime by adding ""set tcp wan-optimization rtt 0"" to the parameter map of type connection."

CSCuf16964—"If you add up current ""regexp"" for all contexts in an ACE, that can exceed Max. Workaround: none.

CSCuf90272—SNMPD on both Active and Standby crashed and core dumped Workaround:None.

CSCuf93815—"Fail-over between active and standby ACE registered. Workaround:None"

CSCty11329—"ACE appliance primary and standby units rebooted and created core files incfgmgr process while configuring class-map Workaround:A4x does not have this issue"

CSCub87352—"In A5(2.0), the ACE reloads/crashes with a cfgmgr crash continuously.Workaround:</B>Downgrade to A5(1.2)"

CSCug27144—"ACE30 crash with last boot reason: Service ""cfgmgr"" and cfgmgr_log core dump produced."

CSCub18452—SNMPD on both Active and Standby crashed and core dumped Workaround:None.

CSCug51467—"ACE intermittently rejects valid SSL certificates as revoked during the difference hours between timezones in CRL ""Next update"" and on the ACE itself.Workaround: As workaround a parameter map with ""cdp-errors ignore"" command can be configured."

CSCug93530—ACE FT behavior with equal priorities. one with highest IP address always elected as ACTIVE.

CSCuh47599—ACE inserts "internal error" as Session-Verify-Result when using an action-lists with "ssl header-insert session Verify-Result" and OCSP to validate the certificate. Workaround: None.

CSCui06230—’time-to-expire' value of sticky http-cookie database on standby ACE may not be decreased. This symptom maybe observed when ACE only receives 'Set-cookie' from server.It doesn't occur and recover when ACE receives http request with cookie from client. It only occur on standby ACE. Workaround: Send http request with cookie from client.

CSCui27005—"During config changes to HTTPS probes on ACE, the following error occurs %ACE-3-440003: Deletion failed for Probe Sfarm Table and no further probe config changes can be made. Workaround:Reload the device."

CSCui40439—ACE show rserver xml output has changed in A5(2.2).

CSCue56293—ACE is vulnerable to CVE-2013-0169 ''Lucky Thirteen'' TLS/DTLS attack. Workaround :None.

CSCui59155—ACE30 running A5(2.2) crash last boot reason ifmgr with signal 6. Workaround: None.

CSCuh30270—"Cisco Application Control Module (ACE) may accept a non-CA certificate under certain configurations.". Configuring a line using a CA certificate and afterwards changing the ''respsigncert'' for the same OCSP server will cause ACE to accept the non-CA certificate. Workaround: None

CSCuj31362—"Output of debug hm-scripted all does not show the received bind response code sent by Ldap server if ldap scripted probe is configured.

Workaround:

1. Take packet capture to verify the response code sent by server

2. Upgrade to A530 or higher to see the complete message in debug output.

CSCui38998—"FT sync does not happen as well as loss of network reachability in some contexts <B>Conditions:</B> If we go past the string limit of the port-channel interface vlan configuration <B>Workaround:</B> Workaround 1:Remove ""extra "" correct vlans and then try sync. Once sync successfully completes readd the vlans.However if device reloads, remove the 'extra, truncated' vlan, give sync and then add the ""extra correct"" vlans Workaround 2: consolidate the vlans. E.g Switchport trunk allowed vlan 1-4095 Workaround 2 is the preferred option."

CSCuj22959—"ACE 4710 running version A5(2.1) rebooted unexpectedly. Conditions: last boot reason: Service ""cfgmgr"""

CSCuj24550—"SSH to ACE (A5.x) fails from IOS switch/Router Conditions:User trying to connect to ACE module using SSH from IOS switch/router.Workaround: Use Putty/Secure CRT as a SSH client"

CSCuf25829—ACE 4710 config is lost. Workaround: Recover config from checkpoint or external archive."

CSCua85445—When multiple snmpwalk request is made along with LB traffic for extended hours ACE seems to crash with the reason NP 4 Failed : NP ME Hung.

CSCug24208—cfgmgr crash with certain configs in A5(2.0).

CSCuh42954—While sending TLS1.2 ipv6 EE in context request i am seeing NP ME Hung Crash.

CSCug78717—seeing?ME Dumper Process Crashed? in A530 #42 with SSl v3 configs while running the codenomicon script. Please find the core pcap and config in enclosures.

CSCtz96319—ACE crashes while doing checkpoint rollback on a config having user 'Admin' in non-default domain.

CSCui49546—ACE crashes while doing checkpoint rollback on a config having user 'Admin' in non-default domain. FT GOING TO COLD STATE AFTER KILL THE SYSINFO SIGNAL 11

CSCug44749—"conc-conn" traps are not generated for Per Rserver and per VIP

CSCuf35487—Unable to CERT in SSL Proxy.

CSCuh14830—ACE is sending malformed packet as a part of handshake message instead of certificate request when configured with TLS version 1.2 FE with authgroup.

CSCue29552—Service "Tacacs Daemon" crash on Active Appliance.

CSCuh54020—When ACE is configiured in BE with highest version as TLS1.2 and server is running on TLS1.1, ACE is sending CSS message with TLS1.2.

Software Version A5(3.0) Open Caveats

The following open caveats apply to software version A5(3.0):

CSCul34480—Using IE 9 browser, user can create Virtual Server by using the existing Server Farm and existing HTTP Header Modify Action List. However, when you try to Create/Edit “Server Farm” and “HTTP Header Modify Action List”, IE 9 will display a Java Script error message “SCRIPT70: Permission Denied”. To overcome this error in IE 9 browser, the following steps needs to be followed:

• Workaround to create new Virtual Server by creating the NEW Server Farm and NEW HTTP Header Modify Action List in IE 9 browser:

1. Navigate to Config > Virtual Contexts > Load Balancing > Server Farm > Add and create the Server Farm.

2. Navigate to Config > Virtual Contexts > Expert > HTTP Header Modify Action List > Add and create the HTTP Header Modify Action List.

3. Navigate to Config > Virtual Contexts > Load Balancing > Virtual Servers > Add and Deploy the Virtual Server by associating already created Server Farm and HTTP Header Modify Action under the Default L7 Load-Balancing Action.

• Workaround to create new Virtual Server by editing the existing Server Farm and existing HTTP Header Modify Action List in IE 9 browser:

1. Navigate to Config > Virtual Contexts > Load Balancing > Server Farm > Select existing Server Farm and Edit it.

2. Navigate to Config > Virtual Contexts > Expert > HTTP Header Modify Action List > Select an existing HTTP Header Modify Action and Edit it.

3. Navigate to Config > Virtual Contexts > Load Balancing > Virtual Servers > Add and Deploy the Virtual Server by associating already edited Server Farm and HTTP Header Modify Action under the Default L7 Load-Balancing Action.

• Workaround to edit the existing Virtual Server by creating the NEW Server Farm and NEW HTTP Header Modify Action List in IE 9 browser:

1. Navigate to Config > Virtual Contexts > Load Balancing > Server Farm > Add and create the Server Farm.

2. Navigate to Config > Virtual Contexts > Expert > HTTP Header Modify Action List > Add and create the HTTP Header Modify Action List.

3. Navigate to Config > Virtual Contexts > Load Balancing > Virtual Servers > Edit and Deploy the Virtual Server by associating already created Server Farm and HTTP Header Modify Action under the Default L7 Load-Balancing Action.

• Workaround to edit the existing Virtual Server by editing the existing Server Farm and existing HTTP Header Modify Action List in IE 9 browser:

1. Navigate to Config > Virtual Contexts > Load Balancing > Server Farm > Select existing Server Farm and Edit it.

2. Navigate to Config > Virtual Contexts > Expert > HTTP Header Modify Action List > Select an existing HTTP Header Modify Action and Edit it.

3. Navigate to Config > Virtual Contexts > Load Balancing > Virtual Servers > Edit and Deploy the Virtual Server by associating already edited Server Farm and HTTP Header Modify Action under the Default L7 Load-Balancing Action.

CSCul76427—ACE: kernel crash "Unable to handle kernel paging request".

CSCul99139—startup-config is not synced during bulk-sync.Conditions: This symptom may be observed when ACE boots up.

CSCum36871—ACE-30 crash A5(2.2b) / ME Dumper Process Crashed last boot reason: ME Dumper Process Crashed

CSCum41871—"%ACE-3-251014 message output wrong port#. Conditions: This symptom maybe observed when rserver is configured with port# in serverfarm.Workaround: None, it's just a cosmetic issue."

CSCue79554—"TCP connections destined for SSL-Proxy VIP stuck in connection table in CLSRST state well beyond TCP IDLE timeout configured. Workaround: Switching over the the standby context will clear the CLSRST conns that got stuck until that moment, but new ones will continue to pile on on the newly active ACE.”

CSCui02937—"Bandwidth resource denies occur prior to hitting maximum when the global pool is in use. Conditions: Modifying resource classes multiple times. Workaround: Reboot to allow resource pools to re-carve."

CSCui56286—The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.CVE-2010-5107 vulnerability seen on ACE4710.

CSCul39399—"Some messages are missing in 'show logging' output even though all messages are sent to the syslog server successfully."

CSCul90247—"SSL termination configured on ACE. ACE sending RESET after sending encrypt alert even after decrypting the packet"

Software Version A5(3.0) Command Changes

Table 5 lists the command changes in software version A5(3.0).

---

Note For a summary of new features for software version A5(3.0), including the associated new or modified commands, see the “New Software Features in Version A5(3.1)” section.

Related SNMP Changes for A5(3.0)

Per bug CSCtt13316, the following MIB objects have been added to the CISCO-SSL-PROXY-MIB:

• cspTl1cFullHandShake OBJECT-TYPE

SYNTAX Counter32

MAX-ACCESS read-only

STATUS current

DESCRIPTION

"This object indicates the total number of full TLS 1.1 handshakes completed."

::= { cspTls11Counters 1 }

• cspTl1cResumedHandShake OBJECT-TYPE

SYNTAX Counter32

MAX-ACCESS read-only

STATUS current

DESCRIPTION

"This object indicates the total number of resumed TLS 1.1

handshakes completed."

::= { cspTls11Counters 2 }

• cspTl1cHandShakeFailed OBJECT-TYPE

SYNTAX Counter32

UNITS "number of connections"

MAX-ACCESS read-only

STATUS current

DESCRIPTION

"This object indicates the total number of TLS 1.1 connections failed in handshake phase."

::= { cspTls11Counters 3 }

• cspTl1cDataFailed OBJECT-TYPE

SYNTAX Counter32

UNITS "number of connections"

MAX-ACCESS read-only

STATUS current

DESCRIPTION

"This object indicates the total number of TLS 1.1 connections failed in data phase."

::= { cspTls11Counters 4 }

• cspTl2cFullHandShake OBJECT-TYPE

SYNTAX Counter32

MAX-ACCESS read-only

STATUS current

DESCRIPTION

"This object indicates the total number of full TLS 1.2 handshakes completed."

::= { cspTls12Counters 1 }

• cspTl2cResumedHandShake OBJECT-TYPE

SYNTAX Counter32

MAX-ACCESS read-only

STATUS current

DESCRIPTION

"This object indicates the total number of resumed TLS 1.2 handshakes completed."

::= { cspTls12Counters 2 }

• cspTl2cHandShakeFailed OBJECT-TYPE

SYNTAX Counter32

UNITS "number of connections"

MAX-ACCESS read-only

STATUS current

DESCRIPTION

"This object indicates the total number of TLS 1.2 connections failed in handshake phase."

::= { cspTls12Counters 3 }

• cspTl2cDataFailed OBJECT-TYPE

SYNTAX Counter32

UNITS "number of connections"

MAX-ACCESS read-only

STATUS current

DESCRIPTION

"This object indicates the total number of TLS 1.2 connections failed in data phase."

:= { cspTls12Counters 4 }

Software Version A5(3.0) System Log Messages

302032

---

Note Customers should only open TAC case if they notice any functional impact.

 

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

© 2014 Cisco Systems, Inc. All rights reserved.