System Behavior and Functionality Updates

• In Cisco EPN Manager 6.1 release, under Inventory > Other > Circuits,/VCs & Network Interfaces, the column order was retained and maintained as it was stored in the database. However, in Cisco EPN Manager 7.1 release, there has been a change in the storage mechanism for column order. The column order will now be stored in the browser session storage instead of the database. Therefore, any adjustments that are made to the column order will be applicable only for the current session and will not be permanently saved in the database.

Securing User Inputs to Prevent XSS Vulnerabilities

Cross-site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into applications. These scripts can be used to steal information or perform other malicious actions. To safeguard the Cisco EPN Manager, it is crucial to avoid certain patterns in user input fields and POST/PUT payloads.

The following patterns have been identified as vulnerable and are blocked by the Cisco EPN Manager's XSS prevention feature. The Cisco EPN Manager will not execute the command or proceed to the next step if it finds these patterns; therefore, ensure they are not used in user inputs or API calls.

• src=’…’ (multiline, case insensitive pattern): Avoid using src= followed by any text or newline within single quotes. For example, <img src='malicious_code'>.

• src=”…” (multiline, case insensitive pattern): Avoid using src= followed by any text or newline within double quotes. For example, <img src="malicious_code">.

• </script> (case insensitive pattern): Avoid using the closing script tag in any form.

• <script…> (multiline, case insensitive pattern): Avoid using the opening script tag with any content inside.

• eval(…) (multiline, case insensitive pattern): Avoid using the eval function in any context. For example, eval('malicious_code').

• expression(…) (multiline, case insensitive pattern).

• javascript: (case insensitive pattern): Avoid using javascript: protocol in any field.

• vbscript: (case insensitive pattern): Avoid using vbscript: protocol.

• onload…= (multiline, case insensitive pattern): Avoid using event handlers like onload in any of the fields.

• <…> (multiline, case insensitive pattern).

• <script…/script> (multiline, case insensitive pattern): Avoid any complete script tags with content.

Limited Scope of Specific Devices

• The Cisco 8608-SYS and Cisco 8011-2X2XP4L platforms do not support provisioning and related use cases for any technology.

Upgrade Issues

• FTP and TFTP are disabled by default.

• Active Threshold Crossing Alarms (TCA) for temperature remain active and are not cleared automatically. Clear these alarms manually.

• You must resync your devices to view ISIS links.

• You must resync LDP-enabled devices to view LDP feature-related information.

• You must recreate the TCAs for inbound/outbound errors and inbound/outbound discards in the Interface Health monitoring policy.

Limitations on Carrier Ethernet Circuit Provisioning

• Promotion of services using the old probe name format is now supported. These probes are listed in the user interface with the appropriate standard OAM Profile name after promotion.

  • Sample profile: profile PM2_3_8_CoS5_DM type cfm-delay-measurement.

• While custom profile names are supported in EPN Manager, modifying brownfield services with a different naming format deletes the existing custom profile and adds a new profile with a supported naming format.

• Inventory models do not correctly display the profiles that are not associated to a service.

• The validation limit for the number of profiles is 100. If you create a new SLA operation profile after 100 existing profiles, the device generates an error and deployment fails.

TLS 1.2 Required for Secured Channel Communication for HTTPS and TLS

Only Transport Layer Security (TLS) 1.2 is supported for HTTPS and TLS related secured communication, for example, RADIUS EAP-TLS.

Support for TLS 1.0, TLS 1.1, and all versions of SSL has been disabled due to security vulnerabilities.

This means that all peer systems and clients that transact with Cisco EPN Manager using HTTPS/TLS must support TLS 1.2. If they do not support TLS 1.2, you must upgrade these systems. Wherever possible, the Cisco EPN Manager documentation highlights the potentially affected systems. Contact your Cisco representative for support in this regard, if necessary.

Reconciliation Report Limitations

If you have not provided a value for an attribute while provisioning a service, the provisioned value for that attribute is displayed as “Missing” in the reconciliation report. The device may have a default value for this attribute, but Cisco EPN Manager does configure this value.

Limitations on Cisco ME 1200 Devices

The Y.1564 performance test does not work if the source/destination is a Cisco ME 1200 device.

Limitations on Cisco NCS 4200 Devices Running IOS-XE 16.8.1

The following functionalities do not work on Cisco NCS 4200 devices running IOS-XE 16.8.1:

• Alarm profile

• Configuration of SONET LOP and CT3 LOP from the GUI

• Admin shut/no shut functionality on SONET/T1/T3 HOP/LOP

Limitations on Cisco NCS 540 and Cisco NCS 5500 devices

Cisco NCS 540 and Cisco NCS 5500 device series do not support Fault-OAM, Wrap-Protection, and BFD.

Use CLI Templates for Configuring PTP Commands

On ASR920 devices with software version 16.9.1, IEEE 1588-2008 BC/MC license is required to execute the 1588 PTP commands.

Configuration and Inventory Not Supported for PTP Templates

The behavior of modeling the configurations that are pushed through PTP templates may not work as expected because the model may not be in place for all the configurations that are pushed through PTP templates. Configuration/Inventory is not supported for these configurations.

Deprecation of Support for ONS 10.00.10, 10.01.00, 10.03.00

ONS 10.00.10, 10.01.00, 10.03.00 ONS 10.00.10, 10.01.00, and 10.03.00 are no longer supported on Cisco NCS 2002, Cisco NCS 2006, and Cisco NCS 2015 devices.

Data Center Device Lifecycle Support Only

Cisco EPN Manager provides essential support for a few selected UCS compute systems, Nexus series devices, and the CSR 1000v devices.

LINK_DOWN alarm on sub interfaces in Gig Port

LINK_DOWN alarms will not be generated when a link is down on subinterfaces in a Gig Port.