Release Notes for Cisco Catalyst IR1101, IR1800, IR8140, and IR8340 Routers, IOS XE 26.2.x
Available Languages
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
- US/Canada 800-553-2447
- Worldwide Support Phone Numbers
- All Tools
Feedback
Feedback
Cisco Catalyst Rugged Series Routers, IOS XE 26.2.x
Cisco Catalyst Rugged Series Routers, IOS XE 26.2.x
This release note provides information about the new features, resolved and open issues, supported software packages and information on how to obtain support and documentation for Cisco IOS XE releases.
This section provides a brief description of the new software features introduced in this release.
IOS XE 26.2.1
Table 1. New software features for Cisco Catalyst Rugged Series Routers, IOS XE 26.2.1
| Product Impact |
Feature |
Description |
| Security |
As part of Cisco’s Resilient Infrastructure program and Cisco’s commitment to secure infrastructure, this release includes additional changes aimed towards continuing to make Cisco IOS XE more secure by default. Note that some of these changes may require operational changes if you are not following secure best practices. This release includes the following changes: · The RADIUS client appends the Message-Authenticator attribute (Attribute 80 HMAC-MD5) to all outgoing Access-Request packets to mitigate cryptographic forgery and Blast-RADIUS vulnerabilities (CVE-2024-3596). · The RADIUS client drops incoming Access-Accept, Access-Reject, and Access-Challenge packets if the Message-Authenticator is absent or invalid. Ensure AAA servers (example, Cisco ISE) are configured to return Attribute 80. · Outbound SSH connections enforce Trust-On-First-Use (TOFU). The device prompts to verify and store remote server host keys in the known-hosts database on first connection and validates against them on subsequent sessions. · Proxy ARP is disabled by default across all routed interfaces, SVIs, and sub interfaces to reduce Layer 2 broadcast domains and prevent ARP spoofing. Configure the ip proxy-arp command explicitly if required. · The embedded web server daemon is disabled by default on factory configurations to restrict unauthenticated management access. Web UI and RESTCONF require explicit enablement of the ip http secure-server command. · The IOS XE device rejects unauthenticated NTP Mode 6 and Mode 7 control queries (monlist) to prevent NTP reflection and amplification DDoS attacks. Standard time synchronization (Modes 3 and 4) is unaffected. · System logging timestamps automatically include the four-digit calendar year (service timestamps log datetime msec year) to standardize multi-year audit logs and SIEM compliance. · Integrates Linux auditd inside Cisco IOx Guest Shell. All commands, system calls, and privilege escalation events (sudo) executed inside the container are forwarded to the host syslog facility. · Warning messages are emitted on the console and logged to syslog whenever legacy insecure protocols (telnet, ftp, tftp, http) are enabled in the configuration. · Real-time tracking of active insecure services is published to the operational database (operDB) and YANG data models, allowing management controllers (such as Cisco Catalyst Center) to monitor security compliance. |
|
| Enhanced Security |
Password Encryption Types for Wireless Profile Configuration |
From this release, credentials entered as Type 0 in wireless profile configurations are automatically converted to and stored as Type 6 encrypted values. Type 7 credentials are deprecated and rejected. This behavior applies to WLAN profile passphrases and management credentials in Embedded Wireless Controller mode and to SSID profile secret keys in Workgroup Bridge mode. Supported device: IR1800 |
| Greater Control |
Segment Routing over MPLS on WAN Ports |
From this release, you can configure Segment Routing over Multiprotocol Label Switching (SR-MPLS) on supported WAN ports. SR-MPLS encodes an ordered list of segments in the packet and integrates with MPLS services such as Layer 3 VPN and Ethernet VPN. It provides scalable path control, traffic-engineering capabilities, and protection against link and node failures without requiring per-flow state in the network. |
| Enhanced Security |
SGT Inline Tagging on LAN Ports |
From this release, you can configure Security Group Tag (SGT) Inline Tagging on supported IR8340 LAN ports. The router can impose and propagate SGT metadata in Ethernet frames, enabling Cisco TrustSec micro-segmentation without requiring Security Group Tag Exchange Protocol peering. This release supports SGT imposition and tag propagation on LAN ports; Cisco TrustSec enforcement on those ports is not supported. A Network Advantage license is required. Supported device: IR8340 |
| Enhanced Security |
IKEv2 and IPsec PFS Post Quantum Cryptography
|
This feature combines a traditional Diffie-Hellman key exchange with the NIST-standardized Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) to establish keys for IKEv2/IPsec sessions. This hybrid approach helps protect recorded VPN traffic against future harvest-now, decrypt-later attacks. You can configure ML-KEM algorithms with IPsec Perfect Forward Secrecy. |
| Greater Control |
DHCP Option 82 |
From this release, DHCP servers on routers support DHCP Option 82 relay information. The DHCP server can use the Circuit ID and Remote ID inserted by a DHCP relay agent to select an address pool for a client. This support enables predictable, location-based IP address assignment without requiring administrators to track client MAC addresses. |
| Greater Visibility |
OT Application Recognition in NBAR |
This feature enhances the NBAR engine to identify a foundational set of Operational Technology (OT) protocols including DNP3, IEC104, MMS, NTCIP, and OPC-UA. Supported devices: IR1101, IR1800, IR8340, IR8140 |
| Enhanced Security |
Post Quantum Cryptography for SSHv2 Sessions |
Starting with this release, you can configure ML-KEM-based hybrid key-exchange algorithms for SSHv2 client and server sessions. These algorithms combine ML-KEM with a classical elliptic-curve component to provide quantum-resistant key establishment for secure remote management. PQC algorithms must be explicitly enabled and are not supported when the device operates in FIPS mode. |
This section provides a brief description of the new hardware features introduced in this release.
IOS XE 26.2.1
Table 2. New hardware features for Cisco Catalyst Rugged Series Routers, IOS XE 26.2.1
| Product Impact |
Feature |
Description |
| Enhanced Connectivity |
P-5GS6-RC-GL PIM Support |
The P-5GS6-RC-GL Pluggable Interface Module adds 5G Standalone (SA) Reduced Capability (RedCap) and 4G LTE connectivity. The module supports primary or secondary WAN deployments and provides a seamless migration path to 5G RedCap while maintaining existing operational workflows. The module automatically falls back to 4G LTE when 5G service is unavailable. Supported devices: IR1800 |
ACL enforcement for raw-socket serial connections
Starting with Cisco IOS XE Release 26.2.1, an access control list (ACL) applied to an asynchronous serial-line configuration might not block raw-socket traffic.
This behavior occurs when:
The IR8340 router has an IRM-NIM-RS232 module installed.
The serial interface uses the encapsulation raw-tcp or encapsulation raw-udp command.
An ACL is applied by using the access-class access-list-number {in | out} command.
To control this traffic, apply an ACL to an upstream Layer 3 interface. Alternatively, use a zone-based firewall to permit or deny connections to the configured raw-socket TCP or UDP port.
Note: This behavior affects Cisco IR platforms running Cisco IOS XE that support raw-socket serial connections.
You can also access the resolved caveats for this release through the Cisco Bug Search Tool.
Note:
● This software release may contain bug fixes first introduced in other releases. To see additional information, click the bug ID to access the Cisco Bug Search Tool.
● To search for a documented Cisco product issue, enter the bug ID in the Cisco Bug Search Tool.
This table lists the resolved issues in this specific software release.
Table 3. Resolved issues for Cisco Catalyst Rugged Series Routers, IOS XE 26.2.1
| Bug ID |
Description |
| IR8340: PTP from UTC to TAI on an IR8340 is not working |
|
| IR8340: Access list failing to block when applied to raw-socket serial line config |
|
| IR8140 wpan hardware key-info does not match mesh-security keys |
|
| IR8340 is failing upgrade from 17.15.1a to 17.15.4 using install commands |
|
| NVRAM Header Corruption on Power Cycle on IR8100, IR1101 and C6300 devices |
|
| BBU shows in idle state with low SOC and it starts charging after resetting the BBU |
|
| Telemetry sends incorrect data when sensor's reading is negative |
|
| Unhelpful message when IOx app fail to match expected version with actual version |
|
| IR8340 does not send BPDU when using EtherChannel |
|
| %TDLDB-3-DBPERSIST_OPERATION_FAILURE on DB: /tmp/rp/tdldb/0/CTRL_MNG_CFG_DB and unable to save config or reload router |
|
| IR8140: WPAN incoming packet totals incorrectly calculated |
|
| SD-Routing: with no ignition-enable and no ignition-sense, throws config error |
|
| vManage app installation fails with "Failed to install appid ..." when app built on Windows |
|
| IR8340 Unexpected Reload with LocalSoftADR and Kernel Panic with SMP NOPTI |
You can also access the open caveats for this release through the Cisco Bug Search Tool.
This table lists the open issues in this specific software release.
Table 4. Open issues for Cisco Catalyst Rugged Series Routers, IOS XE 26.2.1
| Bug ID |
Description |
| Fragmented Multicast traffic being dropped due to DHCP Snooping |
There are no known issues in this release.
This section lists compatibility information for cellular module modem firmware and OEM/PRI versions, including the latest firmware available for each modem used by Cisco IoT routers. See the Cisco Firmware Upgrade Guide for 4G LTE and 5G Cellular Modems for upgrade instructions.
Cisco IOS XE updates do not automatically update modem firmware. You should manually check and update all modems to the latest firmware version, including any related PRI and/or OEM PRI components. Refer to the following table for the most up-to-date information.
Table 5. Cellular Module Modem Firmware
| Cellular Module |
Modem and Firmware version |
Software download link |
| P-5GS6-GL |
FN980 38.03.0202
|
|
| P-LTEAP18-GL IRMH-LTEAP18-GL |
LM960 32.00.1x9
|
Generic: https://software.cisco.com/download/home/286324996/type North America: |
| P-LTEA-EA IRMH-LTEA-EA |
Generic and Europe: EM7455 02.39.00.00 Canada, North America ATT, North American Sprint: EM7455 02.32.11.00 North America Verizon: EM7455 02.33.03.00 |
Generic: https://software.cisco.com/download/home/286308426/type Europe: https://software.cisco.com/download/home/286308426/type Canada: https://software.cisco.com/download/home/286319713/type North America ATT: https://software.cisco.com/download/home/286311442/type North American Sprint: https://software.cisco.com/download/home/286311455/type North America Verizon: |
| P-LTEA-LA IRMH-LTEA-LA |
Generic: EM7430 02.38.00.00 Australia Telstra EM7430 02.33.03.00 Japan: EM7430 02.38.00.00 |
Generic: https://software.cisco.com/download/home/286308413/type Australia Telstra: https://software.cisco.com/download/home/286311403/type Japan: |
| P-LTE-VZW |
WP7601 02.37.0x.00 |
|
| P-LTE-US |
WP7603 02.37.0x.00 |
|
| P-LTE-JN |
WP7605 02.28.03 |
|
| P-LTE-GB |
WP7607 02.37.03.05 |
|
| P-LTE-IN |
WP7608 02.28.03 |
|
| P-LTE-AU |
WP7609 02.28.03 |
|
| P-LTE-MNA |
WP7610 02.37.03.05 |
|
| P-LTEA7-NA |
EM7411 01.14.24.00 |
|
| P-LTEA7-EAL |
EM7421 01.14.22.00 |
|
| P-LTEA7-JP |
EM7431 01.16.08.00 |
|
| P-5GS6-R16SA-GL |
EM9293 03.04.10.01 |
|
| P-5GS6-RC-GL |
EM8695 02.01.03.00 |
|
| IRMH-5GS6-RC-GL |
EM8695 02.01.03.00 |
|
| P-LTE-450 |
Not applicable v1.3.0 |
Contact Intelliport for the software download link (info@intelliport.hu) |
This section provides information about the release packages associated with Cisco Catalyst Rugged Series Routers.
For the latest software downloads, see the Software Download page.
Table 6. Software packages for Cisco Catalyst Rugged Series Routers, IOS XE 26.2.1
| Router |
Image type |
Filename |
| IR1101 |
Universal |
ir1101-universalk9.26.02.01.SPA.bin |
| IR1800 |
Universal |
ir1800-universalk9.26.02.01.SPA.bin |
| UTD Engine for Cisco IR1800 |
secapp-utd.26.02.01prd7.1.0.6_SV3.12.4.0_XE26.2.aarch64.tar |
|
| IR8100 |
Universal |
ir8100-universalk9.26.02.01.SPA.bin |
| UTD Engine for Cisco IR8100 |
secapp-utd.26.02.01prd7.1.0.6_SV3.12.4.0_XE26.2.aarch64.tar |
|
| IR8340
|
Universal |
ir8340-universalk9.26.02.01.SPA.bin |
| UTD Engine for Cisco IR8340 |
secapp-utd.26.02.01prd7.1.0.6_SV3.12.4.0_XE26.2.x86_64.tar |
This section shows the names of the ports on Cisco Catalyst IR1101, IR1800, IR8140, and IR8340 routers.
Table 7. Cisco Catalyst IR1101 Rugged Series Router
| Port |
Naming Convention |
| Gigabit Ethernet combo port |
GigabitEthernet0/0/0 |
| Gigabit Ethernet SFP port on IRM-1100 |
GigabitEthernet0/0/5 |
| Gigabit Ethernet on IRM-1100-4A2T mounted on the Expansion side |
GigabitEthernet0/0/5 GigabitEthernet0/0/6 |
| Fast Ethernet ports |
FastEthernet0/0/1 FastEthernet0/0/2 FastEthernet0/0/3 FastEthernet0/0/4 |
| Cellular Interface on IR1101 Base |
Cellular 0/1/0 Cellular 0/1/1 |
| Cellular Interface on IRM-1100 mounted on the top (EM) side |
Cellular 0/3/0 Cellular 0/3/1 |
| Cellular Interface on IRM-1100 mounted on the bottom (CM) side |
Cellular 0/4/0 Cellular 0/4/1 |
| Asynchronous Serial Interface Base |
async0/2/0 |
| IRM-1100-4A2T is mounted on the top (EM) side |
async 0/3/0 async 0/3/1 async 0/3/2 async 0/3/3 |
| IRM-1100-4A2T is mounted on the bottom (CM) side |
async 0/4/0 async 0/4/1 async 0/4/2 async 0/4/3 |
| USB |
usbflash0: |
| mSATA |
msata: |
| IR1101 Base Unit Alarm input |
alarm contact 0 |
| GPIO on IRM-1100 |
alarm contact 1-4 |
| LoRaWAN interface on IR1101 Base |
LORAWAN0/1/0 |
| LoRaWAN interface on the top (EM) side |
LORAWAN0/3/0 |
| Gigabit Ethernet interface for LTE 450MHz module on IR1101 Base |
GigabitEthernet0/1/0 GigabitEthernet0/1/0.x for multiPDN operation |
Table 8. Cisco Catalyst IR1800 Rugged Series Router
| Port |
Naming Convention |
| Gigabit Ethernet combo port |
GigabitEthernet0/0/0 |
| Gigabit Ethernet ports |
GigabitEthernet0/1/0 GigabitEthernet0/1/1 GigabitEthernet0/1/2 GigabitEthernet0/1/3 |
| Cellular Interface |
Cellular 0/4/0 Cellular 0/4/1 Cellular 0/5/0 Cellular 0/5/1 |
| Asynchronous Serial Interface |
Async0/2/0 Async0/2/1 (when the base platform supports two asynchronous serial interfaces) |
| Wi-Fi Interface |
Wl0/1/4 |
| USB |
usbflash0: |
| mSATA |
msata: |
| GPIO |
alarm contact 1-4 |
Table 9. Cisco Catalyst IR8140 Heavy Duty Series Router
| Port |
Naming Convention |
| Gigabit Ethernet ports |
GigabitEthernet0/0/0 GigabitEthernet0/0/1 |
| Cellular Interface |
Cellular 0/2/0 Cellular 0/2/1 Cellular 0/3/0 Cellular 0/3/1 |
| SSD |
VirtualPortGroup0 |
| WPAN |
Wpan 0/1/0 Wpan 0/2/0 Wpan 0/3/0 |
| Digital I/O |
alarm contact 1-2 |
Table 10. Cisco Catalyst IR8340 Rugged Series Router
| Port |
Naming Convention |
| Gigabit Ethernet WAN ports |
GigabitEthernet0/0/0 GigabitEthernet0/0/1 |
| Gigabit Ethernet LAN ports |
GigabitEthernet0/1/0 GigabitEthernet0/1/1 GigabitEthernet0/1/2 GigabitEthernet0/1/3 GigabitEthernet0/1/4 GigabitEthernet0/1/5 GigabitEthernet0/1/6 GigabitEthernet0/1/7 GigabitEthernet0/1/8 GigabitEthernet0/1/9 GigabitEthernet0/1/10 GigabitEthernet0/1/11 |
| Cellular Interface |
Cellular 0/4/0 Cellular 0/4/1 Cellular 0/5/0 Cellular 0/5/1 |
| NIM Interface (Asynchronous/Synchronous Serial Ports or E1/T1 ports) |
0/2/0 0/2/1 0/3/0 0/3/1 |
| mSATA SSD |
msata: |
| GPIO |
alarm contact 0-2 |
| USB Port |
usb0: |
| Console Port |
Line console 0 |
Related resources
Table 11. Related resources
| Document |
Description |
| Provides information about products supported by Cisco IOS XE. |
|
| Cisco Catalyst IR1101 Rugged Series Router Cisco Catalyst IR1800 Rugged Series Router |
Provides data sheets for the specified routers. |
| Cisco Industrial Routers and Industrial Wireless Access Points Antenna Guide |
Provides descriptions and installation instructions for wireless antennas supported on the Cisco Industrial Series Routers and Industrial Wireless Access Points. |
| Provides information about SD-WAN releases and resources. |
|
| Provides information about Cisco IoT Field Network Director releases and resources. |
|
| Provides information about Cisco Industrial Network Director releases and resources. |
|
| Smart Licensing Using Policy on the Cisco Catalyst IR1101, IR1800, IR8140, and IR8340 Routers or the |
Provides information about Smart Licensing Using Policy solutions and their deployment on IOS XE routers. |
| You can submit a service request here. |
|
| Provides the most up-to-date troubleshooting information. |
|
| Use CFN to browse Cisco products and find relevant features and licenses. It allows you to compare platforms, determine common features between products, and identify unique product features. Cisco Feature Navigator also includes a MIB Locator tab. |
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2026 Cisco Systems, Inc. All rights reserved.