Full Cisco Trademarks with Software License
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.
Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)
About Cisco 1000 Series Integrated Services Routers
The Cisco 1000 Series Integrated Services Routers (also referred to as router in this document) are powerful fixed branch routers based on the Cisco IOS XE operating system. They are multi-core routers with separate core for data plane and control plane. There are two primary models with 8 LAN ports and 4 LAN ports. Features such as Smart Licensing, VDSL2 and ADSL2/2+, 802.11ac with Wave 2, 4G LTE-Advanced and 3G/4G LTE and LTEA Omnidirectional Dipole Antenna (LTE-ANTM-SMA-D) are supported on the router.
 Note |
Cisco IOS XE Dublin 17.12.1a is the first release for Cisco 1000 Series Integrated Services Routers in the Cisco IOS XE Dublin 17.12.x release series. |
Note |
Cisco IOS XE 17.12.3 is the first release for Cisco 1000 Series Integrated Services Routers to support these models C1131-8PWx, C1131X-8PWx, C1131-8PLTEPWx, C1131X-8PLTEPWx, where "x" is N | H | K | F | D | R. |
Note |
Starting with Cisco IOS XE Amsterdam 17.3.2 release, with the introduction of Smart Licensing Using Policy, even if you configure a hostname for a product instance or device, only the Unique Device Identifier (UDI) is displayed. This change in the display can be observed in all licensing utilities and user interfaces where the hostname was displayed in earlier releases. It does not affect any licensing functionality. There is no workaround for this limitation. The licensing utilities and user interfaces that are affected by this limitation include only the following:
|
Product Field Notice
Cisco publishes Field Notices to notify customers and partners about significant issues in Cisco products that typically require an upgrade, workaround or other user action. For more information, see https://www.cisco.com/c/en/us/support/web/field-notice-overview.html.
We recommend that you review the field notices to determine whether your software or hardware platforms are affected. You can access the field notices from https://www.cisco.com/c/en/us/support/web/tsd-products-field-notice-summary.html#%7Etab-product-categories.
New and Changed Hardware and Software Features
New and Changed Software Features in Cisco IOS XE 17.12.6
There are no new software features in this release.
New and Changed Software Features in Cisco IOS XE 17.12.5c
There are no new features in this release.
New and Changed Software Features in Cisco IOS XE 17.12.5b
There are no new software features in this release.
New and Changed Software Features in Cisco IOS XE 17.12.5a
There are no new software features for this release.
New and Changed Software Features in Cisco IOS XE 17.12.4b
There are no new software features in this release.
New and Changed Software Features in Cisco IOS XE 17.12.2
This release provides a fix for CSCwh87343: Cisco IOS XE Software Web UI Privilege Escalation Vulnerability. For more information, see the Security Advisory: cisco-sa-iosxe-webui-privesc-j22SaA4z.
|
Feature |
Description |
||||
|---|---|---|---|---|---|
|
The Managed Cellular Activation solution provides a programmable subscriber identity module (SIM), called an eSIM, a physical SIM card that you can configure with a cellular service plan of your choice. When ordering a pluggable interface module (PIM) to provide cellular connectivity for your router, choose a PIM model with a preinstalled eSIM. The Managed Cellular Activation solution comes with a “bootstrap” cellular plan to provide internet connectivity with a limited amount of data intended only for Day 0 onboarding of the device to your cellular plan. For information about configuring Cisco SD-WAN Manager with the details of your cellular plan in preparation for onboarding the device, see the Cisco Managed Cellular Activation Configuration Guide. Prepare the configuration in Cisco SD-WAN Manager before powering on and onboarding the device, to avoid running out of the limited data in the bootstrap cellular plan. Added Cisco Managed Cellular Activation (eSIM) support for the following Pluggable Interface Module (PIM) model:
|
|||||
New and Changed Software Features in Cisco IOS XE 17.12.1a
|
Feature |
Description |
||
|---|---|---|---|
|
This feature allows you to perform management operations for SD-Routing devices using Cisco Catalyst SD-WAN Manager. You can use a single network manage system (Cisco Catalyst SD-WAN Manager) to monitor all the SD-Routing devices and therefore help in simplifying solution deployments. |
|||
|
To clean the cellular modem completely, users can press the physical factory-reset button on the device, which enables the inbuilt lte cellular-profile-cleanup command to erase the configuration setup and profiles. This command is disabled by default, but can be enabled only when the factory-reset button is pressed. |
|||
|
This enhancement introduces support for Quantum-Safe Encryption using Post-Quantum Preshared Keys for the following platforms:
|
|||
|
This feature allows you to delete the entries from the logging buffer. You can configure the local syslog retention period after which the entries are purged from the device automatically. To enable this feature, use the logging purge-log buffer days command. |
|||
|
TrustSec and Software-Defined Access Scale Measurement |
With this feature, the scale numbers for TrustSec and Software-Defined Access (SDA) are measured for the following:
|
||
|
Cube Features |
|||
|
From Cisco IOS XE Dublin 17.12.1a onwards, VoIP Trace for SIP messages displays cause code in the cover buffer. |
|||
Note |
From Cisco IOS XE Release 17.9.1a, guestshell is removed from the IOS XE software image. As a result, Zero Touch Provisioning (ZTP) python script is no longer supported on Cisco 1000 Series Integrated Services Routers. If you need to use guestshell, then download it from https://developer.cisco.com/docs/iox/#!iox-resource-downloads/downloads. For more information, see Guestshell installation procedure. |
Cisco ISR1000 ROMmon Compatibility Matrix
The following table lists the ROMmon releases supported in Cisco IOS XE 16.x.x releases and Cisco IOS XE 17.x.x releases.
 Warning |
Device unrecoverable after upgrade failure If a device running certain older Cisco IOS XE releases (earlier than 17.5.x) has password recovery disabled and experiences an upgrade failure to Cisco IOS XE 17.11.x or later, the device may become unrecoverable. To mitigate this risk, upgrade the device to any Cisco IOS XE image between 17.5.x and 17.10.x before upgrading to the destination Cisco IOS XE release (17.11.x or later). Refer to the Release Notes for Cisco 1000 Series Integrated Services Routers, Cisco IOS XE 17.11.x for specific upgrade steps. Subsequent release notes include this guidance. For example, refer to the Release Notes for Cisco ISR 1000 Series, Cisco IOS XE Dublin 17.13.1. |
Warning |
Recommendations before upgrade Before you upgrade, consider these actions:
(After upgrade) |
Note |
Reset button behavior The Reset button behavior changes when specific ROMmon and Cisco IOS XE versions are in use:
|
Note |
To identify the manufacturing date, use the show license udi command. For example: The xxxx in the command output represents the manufacturing date.
|
Note |
To upgrade to Cisco IOS XE Dublin 17.12.x, follow these steps:
|
|
Cisco IOS XE Release |
Minimum ROMmon Release for IOS XE |
Recommended ROMmon Release for IOS XE |
|---|---|---|
|
16.6.x |
16.6(1r) |
16.6(1r) |
|
16.7.x |
16.6(1r) |
16.6(1r) |
|
16.8.x |
16.8(1r) |
16.8(1r) |
|
16.9.x |
16.9(1r) |
16.9(1r) |
|
16.10.x |
16.9(1r) |
16.9(1r) |
|
16.11.x |
16.9(1r) |
16.9(1r) |
|
16.12.x |
16.9(1r) |
16.12(1r) |
|
17.2.x |
16.9(1r) |
16.12(1r) |
|
17.3.x |
16.12(2r) |
16.12(2r) |
|
17.4.x |
16.12(2r) |
16.12(2r) |
|
17.5.x |
17.5(1r) |
17.5(1r) |
|
17.6.x |
17.5(1r) |
17.5(1r) |
|
17.7.x |
17.5(1r) |
17.5(1r) |
|
17.8.x |
17.5(1r) |
17.5(1r) |
|
17.9.x |
17.5(1r) |
17.5(1r) |
|
17.10.x |
17.5(1r) |
17.5(1r) |
|
17.11.x |
17.5(1r) |
17.5(1r) |
|
17.12.x |
17.5(1r) |
17.5(1r) |
Resolved and Open Bugs in Cisco IOS XE 17.12.x
Resolved Bugs in Cisco IOS XE 17.12.6
|
Identifier |
Headline |
|---|---|
|
Cisco IOS and IOS XE Software SNMP Denial of Service and Remote Code Execution Vulnerability. |
|
|
Multiple inside local addresses are translated to the same inside global IP address and port. |
|
|
Endpoint tracker remains in up status when DNS is reachable from the other interface. |
|
|
VRRP IPv6 master/backup state failover failed. |
|
|
Large number of BFD sessions are stuck due to out-of-window drops reported with control connections and NAT flaps. |
|
|
SNMPwalk fails to consistently return tunnel names due to incomplete tunnel setup. |
|
|
Unexpected reload of standby during PKI Trustpoint removal. |
|
|
Deprecate request platform software package expand commands for upgrades. |
|
|
Device may experience an unexpected reload while connecting with MFA. |
|
|
BFD flaps on public IP change on a private color tloc. |
|
|
Device reloaded due to critical process cpp_ha_top_level_server fault . |
|
|
Serial interface configuration lost after reload. |
|
|
FlexVPN - IP address assigned to spoke changes to unassigned. |
|
|
Configuring access-class xx in vrf Mgmt-vrf on line vty causes the Login Block to be inactive. |
|
|
Unexpected reload due to critical process linux_iosd_image fault. |
|
|
Unexpected reload due to performance monitor with packet service insertion from spoke. |
|
|
Cache coherency rare timing race condition. |
|
|
Standby Embedded Wireless controller reloads after upgrade. |
|
|
Unexpected reboot during dialer initialization. |
|
|
The ip vrf receive command adds connected route to vrf table even though interface is admin down. |
|
|
Terminal server drops protocol sessions upon executing show memory command. |
|
|
Memory leak on Chunk Manager via DBAL EVENTS process. |
|
|
Out of Class-Group Manager memory intermittently with scaled ZBFW policy. |
|
|
Ping failure from VRRP backup to VRRP primary virtual address when enabling security policy |
|
|
Administrative distance of IPv6 static route to cellular interface overwritten with 254. |
|
|
NTP will not authenticate with open source NTP servers using 32B cmac-aes-128. |
|
|
Device crashes with "Bad magic number in chunk header", with ACL logging hash-generation. |
|
|
Unexpected reload due to segmentation fault on IP SLA DynHostName process. |
|
|
Cellular interface UP/UP with no IP seen during last-resort testing. |
|
|
Unexpected reboot due to multicast prune. |
|
|
Device crashed due to memory pressure exceeding threshold. |
|
|
Missing Calling-Station-ID (31) in RADIUS accounting. |
|
|
IKEv2 fails to parse certain route-set prefix VSA attributes from RADIUS server. |
|
|
Tx/Rx optical power values differ between show int and show hw-module command. |
|
|
Interface status down after restarting multiple times when autonegotiation is disabled. |
|
|
Crash when clearing L2TP tunnels with the command clear vpdn tunnel l2tp <ID>. |
|
|
High CPU on Virtual EXEC and TTY Background. |
|
|
ACL delete and reapply removes PBR mapping but TCAM remains populated. |
|
|
Device crashes when running a NWPI trace initiated from management system. |
|
|
Enable strict-kex support in SSH to address CVE-2023-48795 (Terrapin Attack). |
|
|
PPP is not establishing when L2TP over IPsec is used. |
|
|
FLOWDB_OOM condition can lead to packet loss with GRE non-IPsec tunnel. |
|
|
Memory leak observed in IPsec/IKE session bringup with certificate-based authentication. |
|
|
Memory leak in nbar-sdavc-scheduler. |
|
|
Tunnel delete/create flaps unexpectedly for PWK case with private control NAT changes. |
|
|
Crash occurs when show running-config full | format begins to print QoS policy-map configuration. |
|
|
Crash occurs during haripin call. |
|
|
Crash when receiving BGP MVPN update/withdraw with BGP MVPN update debug enabled. |
|
|
ESP crash at stile_check_and_run_mpe_after_ft(). |
|
|
High CPU utilization after executing show zbfw-dp sessions | tab command. |
|
|
Unable to read power sensor from NIM module. |
Open Bugs in Cisco IOS XE 17.12.6
|
Identifier |
Headline |
|---|---|
|
The maximum MTU for dialer interface with PPPoA is 1492. |
|
|
Unexpected reload occurs when running a speed test from the management system and leaving the page before it completes. |
|
|
Unexpected reload after importing a sub-CA chain. |
|
|
PPPoE session with sub-interface gets stuck after reboot. |
|
|
Missing Calling-Station-ID in RADIUS messages. |
|
|
NHRP Encap Error for Purge Request appears on spoke even when routing is correct at the hub. |
|
|
SELinux subject denials reported for polaris_iosd_t. |
|
|
Route processor crash while debugging IKEv2. |
|
|
Trustpoint loop in Cisco TrustSec triggers PKI segmentation fault. |
|
|
Device does not process the configuration file when one port is off-hook. |
Resolved Bugs in Cisco IOS XE 17.12.5c
|
Bug ID |
Description |
|---|---|
|
FNF AOR might have double-free risk. |
|
|
Clean up needed for /tmp files created post admin tech generation. |
|
|
Elevated memory usage on devices. |
|
|
Post upgrade, the cellular interface IP address negotiated is mismatching. |
|
|
Implement clean up of /tmp/tmppub/interceptor pid files created. |
Open Bugs in Cisco IOS XE 17.12.5c
There are no customer impacting bugs that were identified in this release.
Resolved Bugs in Cisco IOS XE 17.12.5b
|
Bug ID |
Description |
|---|---|
|
Device crashed due to memory pressure exceeds threshold. |
|
|
IPsec-related crash on an IOS-XE device. |
Open Bugs in Cisco IOS XE 17.12.5b
There are no customer impacting bugs that were identified in this release.
Resolved Bugs in Cisco IOS XE 17.12.5a
|
Bug ID |
Description |
|---|---|
|
Unexpected reboot due to IOSXE-WATCHDOG DBAL EVENTS after cellular interface flap. |
|
|
Memory leak under vDaemon process. |
|
|
GETVPN/Migrating to new KEK RSA key does not trigger GM re-registration. |
|
|
Config and dp show command do not match the dp oper output. |
|
|
DSL module gets stuck in a booting state. |
|
|
IOS-XE port-channel sub-interface overload port-channel interface must be created first and deleted. |
|
|
Deleting and adding the rules in a ZBFW policy with 510 rules results in traffic drop. |
|
|
Modem locks up after reboot of router, modem reset or cellular profile change. |
|
|
Band-select feature not working for the LM960 modem. |
|
|
Modem locks up, modem reset or cellular profile change - additional fix. |
|
|
IOSd crash after radium boot up and online. |
|
|
Mean queue calculation is incorrect on WRED hierarchical QoS. |
|
|
IPv6 flowspec nexthop redirect policy is not redirecting the traffic on IOS XE. |
|
|
Unexpected reload due to cpp-mcplo-ucode process when handling fragments with SRv6 routing. |
|
|
Unencrypted traffic due to non-functional IPSec tunnel in FLEXVPN hub and spoke setup. |
|
|
Device crashed due to IOSXE_INFRA-2-FATAL_NO_PUNT_KEEPALIVE. |
|
|
Issue with ethernet/gig interface with second-dot1q is not working as expected. |
|
|
OMP is redistributing summary routes in the service VPN even though the exact networks do not exist. |
|
|
Device null-way audio within the same layer2. |
|
|
Inbound calls through device results in phantom calls (64.3.0, 60.1.4, 62.3.3). |
|
|
LLDP packets dropped when came through active port-channel interface. |
|
|
P-5GS6-GL FN980 modem fW upgrade failing. |
|
|
Endpoint tracker does not fail if default route is removed. |
|
|
PPPoA session down until QoS policy-map removed from dialer interface. |
|
|
RRI static not populating route after reload if stateful IPSec is configured. |
|
|
MGCP GW fails to respond with 250 OK when there is a delay from dataplane in gathering statistics. |
|
|
Procyon synchronize DTL does not wait until complete due to compiler optimization. |
|
|
Cisco IOS and IOS XE SNMP Denial of Service vulnerabilities. |
|
|
Cisco IOS and IOS XE SNMP Denial of Service vulnerabilities. |
|
|
Cisco IOS and IOS XE SNMP Denial of Service vulnerabilities. |
|
|
Cisco IOS and IOS XE SNMP Denial of Service vulnerabilities. |
|
|
Cisco IOS and IOS XE SNMP Denial of Service vulnerabilities. |
|
|
Cisco IOS and IOS XE SNMP Denial of Service vulnerabilities. |
|
|
Dial-peer never recovers an active state if it goes partial or busyout. |
|
|
Dial-peer never recovers an active state if it goes partial or busy out. |
|
|
CUBE gets forked 180 and 183 with SDP, CUBE is not adding SRTP key when sending 183, causing failure. |
|
|
CUBE incorrectly offers rtp instead of srtp in 200OK for srtp fallback scenario. |
|
|
CDR file accounting creates dummy files. |
|
|
Optimize voip trace handling with tenants. |
|
|
Crash observed on router while performing the conference call. |
|
|
Router crash during SGW sync in VOICE REG BG process. |
|
|
CUBE does not relay/pass 488 Media unacceptable from one leg to another leg for FAX (T.38) Re-INVITEs. |
|
|
IOS-XE unexpected reboot after CLI show sip-ua connection. |
|
|
Memory leak under Dead caused by AFW_application_proc. |
|
|
CDR file accounting credentials exposure. |
|
|
MWI app not registering on Vcube. |
|
|
Cannot dial to/from phone after it reboots in survivability mode. |
|
|
CUBE memory leak for SIP out-of-dialog SUBSCRIBE under CCSIP_SPI_CONTROL process. |
|
|
setPthruCryptoData: mfPthruCrypto NULL showing up excessively in the log. |
|
|
OOD subscribe with event message-summary is causing memory leak on CUBE. |
|
|
No audio issue on call transfer and conference. |
|
|
DATA_RECREATE_ERR: (STBY-Modify): HA Module DSP_MSP reported CALL_MODIFY RECREATE failure on standby. |
|
|
Memory leak under Dead caused by AFW_application_proc. |
Open Bugs in Cisco IOS XE 17.12.5a
|
Bug ID |
Description |
|---|---|
|
Breakout port fails to initialize. |
|
|
Some BFD flapping on PWK ipsec-rekey on all devices. |
|
|
Upgrade from vmanage declared successful even though device boots up with different version than requested. |
|
|
SNMPv3 user credentials to be stored as part of running-configuration with encryption. |
Resolved Bugs - Cisco IOS XE 17.12.4b
There are no customer impacting bugs that were fixed in this release.
Open Bugs - Cisco IOS XE 17.12.4b
There are no customer impacting bugs that were identified in this release.
Resolved Bugs in Cisco IOS XE 17.12.4a
|
Identifier |
Headline |
|---|---|
|
CPP unexpectedly reboot due to QFP CPP stuck at waiting for rw_lock - Lock id of 0 released. |
|
|
Endpoint tracker using DNS does not log "DOWN" message when DNS server reachability is lost. |
|
|
HTX: UTD snort crash at memif_shm_peek_first_packet (handle=0x0). |
|
|
Memory Leak due to security violation by new MAC address and '"Del Pend" object increases - ACE_IPV4. |
|
|
ZBFW TCAM misprogramming after rules are reordered on the device. |
|
|
Memory leak in fman_rp under acl_db. |
Open Bugs in Cisco IOS XE 17.12.4a
There are no customer impacting bugs that were identified in this release.
Resolved Bugs in Cisco IOS XE 17.12.4
|
Bug ID |
Description |
|---|---|
|
Crypto IKEv2 - Fragmented authentication packets detected as malformed on 3rd party vendor device. |
|
|
GETVPN COOP KS | Wrong severity for rekey acknowledgement configuration mismatch log message. |
|
|
FMFP-3-OBJ_DWNLD_TO_DP_FAILED observed when delete and configure zone-pair back. |
|
|
Memory leak in crypto IKEv2 due to C_NewObject. |
|
|
Unexpected reboot in WLC due to SSL. |
|
|
Memory leak in the crypto IKMP process. |
|
|
mGRE tunnels with shared ipsec profile cause ucode crash. |
|
|
NAT46 translations are dropped when NAT64 router is also carrier supporting carrier CE. |
|
|
crypto pki certificate pool in running configuration. |
|
|
Failure to communicate a period of time after the stp status changes. |
|
|
PnP gets stuck when cellular backhaul is used. |
|
|
Segmentation fault - process = IPSec dummy packet process. |
|
|
IPSec tunnel fails to establish due to error IPSec policy invalidated proposal. |
|
|
show sdwan policy service-path command gives inconsistent results with app name specified. |
|
|
Memory dump outputs appear without debugs enabled in SSL VPN code. |
|
|
Only one split-exclude subnet is pushed to client PC with IOS-XE headend for a RA VPN connection. |
|
|
NAT pool does not work under prefix 16. Available address = zero. |
|
|
Unexpected reboot due CPP ucode on the router. |
|
|
ENH: Config parser issue for NAT with extendable and redundancy. |
|
|
Disabling PMTU-Discovery with MTU change and BFD flap breaks packet duplication. |
|
|
Flex: Peer failed to up after shut/noshut L2 port with SFP inserted and switchport mode configured. |
|
|
Trim installed certificate on upgrade. |
|
|
Reload in tcp_sanity due to l4 pointer not set. |
|
|
FW upgrade does not work properly on P-LTE-MNA with 17.12.1a and 17.12.2 IOS. |
|
|
AnyConnect connection trough IPSec fails when connecting from an RDP user to an IOS/IOS-XE headend. |
|
|
IPv6 PREFIX delegation is not working on ADSL PPPOA. |
|
|
Segmentation fault and core files are seen on IOS-XE in controller-manged SD-WAN due to speedtest. |
|
|
IPv6 tcp adjust-mss not working after delete and reconfigure. |
|
|
AAA authorization failure during IKEv2 phase negotiation caused unexpected reboot. |
|
|
Auto-negotiation fails to endpoint hardcoding 10/half. |
|
|
History-info header compatibility between CUBE and MS direct routing. |
|
|
CUBE Media Proxy(CMP) dual forking not working after upgrade. |
|
|
IOS-XE router may crash during transfer call flow in SRST. |
|
|
Unexpected reload caused by crash in skinny message server process. |
|
|
Media forking not working in CUBE. |
|
|
SIP cause code incorrect for CCAPI cause code 31. |
|
|
authentication command under dial-peer is missing challenge. |
|
|
IOS-XE router experiences memory leak in ucode_pkt_PPE0 process. |
|
|
%DSMP-3-INTERNAL: Internal Error : NO MEMORY seen in standby router while check pointing logs. |
|
|
SGW calling to TDM, AOR is not getting changed to number. |
|
|
SRST running on device fails to register SCCP phones after reload. |
|
|
CUBE incorrectly change dtmf payload in asymmetric case. |
|
|
SIPREC secure media forking -1 of 2 audio streams is encrypted due to same key sent for both streams. |
|
|
Router crashed when port-channel interface flap with scale of per-tunnel QoS policies. |
|
|
Password created with key config-key password-encrypt ending with a \ are lost after reload. |
|
|
IOS XE wrong audio rtp packet marking for SCCP SRST. |
|
|
CUBE - rtp port range configuration lost under voice service voip after reload. |
Open Bugs in Cisco IOS XE 17.12.4
|
Bug ID |
Description |
|---|---|
|
C1121X SD-WAN Router does not establish BFD sessions after upgrade to 17.9.3a or 17.9.4a |
|
|
Create CLI to push at#enadis=0 followed with at#reboot to FN980 required when configuring Multi-PDN |
|
|
NAT Command not readable after reloaded |
|
|
Cellular interface in last-resort mode should be admin up, line protocol down |
|
|
GETVPN / Migrating to new KEK RSA key doesn't trigger GM re-registration |
|
|
C1117 - DSL module gets stuck in a booting state |
|
|
Watchdog crash during IPv6 cef adjacency routines |
|
|
Startup Configuration Failure Post PKI Server Enablement |
|
|
IOS XE Controller Mode - WAN IP is allowed to be configured as SYSTEM IP |
|
|
SD-WAN ZBFW TCAM misprogramming after rules are reordered on c8300 |
|
|
Repeated and endless messages "Network change event - activated 4G Carrier Aggregation." |
|
|
High CPU utilisation for confd_cli |
|
|
Crash due a segmentation fault due a negative value |
|
|
**** Unable to Install HSEC K9 Licence for PID C1111-8PLTELAWF & C1111X-8P **** |
|
|
After deleting a NAT configuration, the IP address still shows up in routing table. |
|
|
C9800: Key manager crash after hostname change with usage keys |
|
|
Device reloaded due to ezManage mobile app Service. |
|
|
Unexpected reboot due to IOSXE-WATCHDOG DBAL EVENTS after Cellular interface flap |
|
|
Device crashed unexpectedly after a successful WGB/AP config deployment from OD. |
|
|
C1118-8P / DSL router crashing due to %PLATFORM-3-ELEMENT_CRITICAL memory level / iomd process |
|
|
P-5GS6-GL FN980 modem fW upgrade is failing. |
|
|
IOS XE:Traffic not encrypted and droped over IPSEC SVTI tunnel |
|
|
Dialer interface MAX MTU for PPPOA is 1492 |
|
|
Unencrypted Traffic Due to Non-Functional IPsec Tunnel in FLEXVPN Hub & Spoke Setup |
|
|
PPPoE session with sub-interface getting stuck after reboot |
|
|
IKEv2 session is down after reload if identity local address is assigned to interface on Switch |
|
|
Unable to build two IPSec SAs w/same source/destination where one peer is PAT'd through the other. |
|
|
Traceback seen @_nhrp_cache_delete due to negative global cache count. |
Resolved Bugs - Cisco IOS XE 17.12.3a
All resolved bugs for this release are available in the Cisco Bug Search Tool.
|
Bug ID |
Description |
|---|---|
|
Template attach fail with unknown element: ssh-version in /ios:native/ios:ip/ios:ssh |
|
|
PPPoE with NAT DIA feature validation failed post upgrade. |
Resolved Bugs in Cisco IOS XE 17.12.3
|
Bug ID |
Description |
|---|---|
|
Router keeps crashing when processing a firewall feature. |
|
|
IKEv2 - diagnose feature is taking 11% CPU during session bring up. |
|
|
Unexpected reboot after establishing control plane of EVPN MPLS and receiving packets. |
|
|
NAT HSL logging vrf-filter is not working. |
|
|
SNMP unable to poll tunnel data after a minute. |
|
|
SKA_PUBKEY_DB leak in TDL. |
|
|
Security policy w/IPS external syslog config failing generation for specific models. |
|
|
ZBFW is unable to detect packets on TenGig interface. |
|
|
Endpoint tracker triggers a CPU hog. |
|
|
Cosmetic 3G issue causing distress to customers - modem WCDMA 900 is displayed as unknown. |
|
|
Add verbose log to indicate grant ra-auto to undo configuring the grant auto in PKI server. |
|
|
Device does not boot up in full configuration. |
|
|
Device creates crooked NAT entry if 2 or more IP phones from NAT outside register to the same server. |
|
|
Mobile-app causing excessive authorization attempts with a null username. |
|
|
Router may crash due to crypto IKMP process. |
|
|
Device audio loss for 4 seconds. |
|
|
PKI crash after failing a CRL fetch. |
|
|
Router unexpectedly reloads during Trustpool retrieval for SIP TLS certificate. |
|
|
Router unexpectedly reloads while fetching certificate Trustpool for SIP TLS. |
|
|
EPBR generates error when the policy is added and deleted multiple times. |
|
|
Unexpected reboot while dispalying information from cleared SSS session. |
|
|
PMTUD incorrectly converging without attempting to learn a higher MTU. |
|
|
Cannot disable the DMVPN logging. |
|
|
Router should discard IKE notification messages with incorrect DOI. |
|
|
Race condition crash on IOS-XE device. |
|
|
Frame relay DTE router crashes due to EXMEM exhaustion. |
|
|
cpp_mcplo_ucode crash with port-channel and NAT. |
|
|
FTMD crash observed in ENCS platform while running PWK suite. |
|
|
CPP CP SVR crash after decoding all packets to text (using l2 copy) on FIA trace. |
|
|
ATO: Session fails to come up when the tunnel is repeatedly shut and no shut in a loop (similar to customer unplugging and plugging in a cable). |
|
|
IPsec traffic is being dropped on strongswan when PPK is implemented. |
|
|
Packet drops observe between LISP EID over GRE tunnel. |
|
|
Upgrade failure for a routing device through the management system due to a modified system configuration. |
|
|
AAA: Template push fail when AAA authorization is set to local. |
Open Bugs in Cisco IOS XE 17.12.3
|
Bug ID |
Description |
|---|---|
|
Create CLI to push at#enadis=0 followed with at#reboot to FN980 required when configuring Multi-PDN. |
|
|
Unexpected reload when using show running-config full | format. |
|
|
ipv6 tcp adjust-mss not working after delete and reconfigure. |
|
|
NAT command not readable after reloaded. |
|
|
Critical process cpp_ha_top_level_server fault on fp_0_0 (rc=69). |
Resolved Bugs in Cisco IOS XE 17.12.2
|
Bug ID |
Description |
|---|---|
|
Device observes memory leak at process "SSS Manager". |
|
|
Memory leak with pubd. |
|
|
ip name-server command not pushed. |
|
|
IOS process crash during VRRP hash table lookup. |
|
|
Device running IOS-XE crashes when removing FQDN ACL. |
|
|
NTP authentication removed after reload using more than 16 bytes. |
|
|
Segmentation fault at IPv6 BGP backup route notification. |
|
|
Unable to migrate from ADSL to VDSL without reboot. |
|
|
Extranet multicast code improvements for better handling of data structure. |
|
|
VC down due to control-word negotiation. |
|
|
BDI + NTP configuration puts DMI process in degraded mode. |
|
|
Using special characters in the password while generating TP generates an invalid TP. |
|
|
CPU usage mismatch in show sdwan system status vs show proc cpu platform. |
|
|
crashes@crypto_map_unlock_map_head. |
|
|
Environmental syslog is not appearing when power cord is disconnected from the redundant PS. |
|
|
Crash when modifying tunnel after running show crypto commands. |
|
|
Device to host C1117-4PLTE loopback unreachable. |
|
|
Data plane crash in Umbrella/OpenDNS processing due to incorrect UDP length. |
|
|
configure replace command fails due to the license udi PID XXX SN:XXXX line on IOS-XE devices. |
|
|
Crypto PKI-CRL-IO_0 process crash when PKI trustpoint is requested and deleted. |
|
|
ITU channel configuration seems not working on device. |
|
|
Crashed by TRACK client thread at access invalid memory location. |
|
|
Unable to migrate from ADSL to VDSL without reboot on C1117-4PLTEEA. |
|
|
Crash in IP Input process during tunnel encapsulation. |
|
|
DDNS update retransmission timer fails to work with a traceback error. |
|
|
SMS archive does not work when ftp transaction is of VRF. |
|
|
IPv4 connectivity over PPP not restored after reload. |
|
|
Custom-app based policy triggering protocol deactivation and CPP traceback with traffic failure. |
|
|
EVPN: BUM traffic is not flooded to bridge domain interface. |
|
|
Flowspec on device will not revoke. |
|
|
Static NAT entry gets deleted from running config; but remains in startup config. |
|
|
B2B NAT: when configration ip nat inside/outside on VASI intereface, ack/seq number abnormal. |
|
|
Show platform hardware throughput crypto/ambiguous outputs. |
|
|
Cisco IOS XE Software Web UI Privilege Escalation Vulnerability. For more information, see Security Advisory: cisco-sa-iosxe-webui-privesc-j22SaA4z. |
|
|
Carrier Grade NAT reaching max host entries and failing to translate due to gatekeeper |
Open Bugs in Cisco IOS XE 17.12.2
|
Bug ID |
Description |
|---|---|
|
IPv6 SPD min/max defaulting to values 1 and 2. |
|
|
High CPU due to MPLS MIB poll. |
|
|
WNCD process crashes. |
|
|
VPLS IRB not working when traffic came from VPNv4 and next-hop is learned over VPLS. |
|
|
pubd process showing high CPU utilization. |
|
|
1Gig int on device using GLC-SX-MMD are down/down after changing connection. |
|
|
Memory leak with pubd. |
|
|
Convergence improvement after device reboot with mVPN profile 14. |
|
|
NETCONF: DMI enters degraded mode caused by BGP neighbor configured under the SCOPE command. |
|
|
FIB/LFIB inconsistency after BGP flap. |
|
|
IOS XE router may experience "%FMANRP_QOS-4-MPOLCHECKDETAIL:" errors. |
|
|
EEM is running daily instead of weekly or monthly if special strings @weekly or @monthly are used. |
|
|
Mismatch between the resource allocation and "app-resource profile custom" configuration. |
|
|
Incorrect local MPLS label in CEF after BGP flap. |
|
|
Cisco IOS-XE IPv6 based subscription telemetry does not work. |
|
|
Guestshell connectivity not working with NAT overload. |
|
|
SDA - using "spt-threshold infinity" and having LHR+FHR can cause the S,G to be pruned on the RP. |
|
|
Unexpected reload when using rsh/rcmd. |
|
|
Locally generated traffic received on incorrect interface inbound and dropped by ACL. |
|
|
WLC unable to get telemetry data due to pubd unexpected reload and fail. |
|
|
Device crash due to dhcpd_binding_check. |
|
|
Site tag change wncd working/failing EAP-TLS. |
|
|
ARP incomplete in VRF Mgmt-intf - G0/0/0 - Switch -G0. |
|
|
LLDP location information not sent when configured. |
|
|
clear bgp command does not consider AFIs when used with update-group option. |
|
|
Device sending incomplete SGT to ISE. |
|
|
Only portion of HSRP config being pushed via CLI ADDON template. |
|
|
"match pktlen-range" does not work with GRE/IPSEC GRE. |
|
|
In the show tech file, "enable secret" does not get hidden. |
|
|
Unexpected reload on device ucode core @l2_dst_output_goto_output_feature_ext_path. |
|
|
ISIS crash in local uloop. |
|
|
Wrong /32 self, complete map-cache entry for fabric hosts on iBN when overlapping summary exists. |
|
|
Member interface config not applied with mis-match in pcakages.conf files. |
|
|
WLC not sending accounting start for user auth after machine auth on 9105AXW RLAN dot1x port. |
|
|
Router unexpectedly reloads while using DHCP for ISG. |
|
|
IOS-XE router not installing classless-static-routes from DHCP option 121. |
|
|
SVL, 10G link on the active chassis will go down after reload. |
|
|
Device sync fails when device prompt comes along with device banner and TACACS is used. |
|
|
Unexpected reboot in device due to SISF and STP initialization. |
|
|
Crash on device polling SPA sensor data. |
|
|
VLAN name mismatch when authorizing vlan name from radius server and enable vlan fallback. |
|
|
Password getting visible for the mask-secret in show logging. |
|
|
Upgrade failing with config check track-id-name. |
|
|
CTS CORE process crash after configuring role based ACL. |
|
|
IPv6 traffic is passing through when the client is in Webauth Pending state (CWA). |
|
|
Option 121 never requested by IOS-XE client. |
|
|
[IPv6 BGP] multiple sourced paths present for the same prefix. |
|
|
IP SPD queue thresholds are out of range. |
|
|
CBQoS polling for the object cbQosCMPostPolicyBitRate returns incorrect value. |
|
|
Device unexpected reload. |
|
|
After migration MAC/IP only MAC is advertised. |
|
|
"BGP Router" process crash. |
|
|
Memory leak under MallocLite/AAA proxy with NETCONF/RESTCONF. |
|
|
Memory leak in linux_iosd-imag due to SNMP. |
|
|
After a reboot, EAP-FAST/PEAP does not authenticate unless credentials are changed. |
|
|
Device keeps crashing when processing a firewall feature. |
|
|
WLC segmentation fault crash with Network Mobility Services Protocol (NMSP). |
|
|
Unexpected reboot after establishing control plane of EVPN MPLS and receiving packets. |
|
|
PoE module is not providing enough power to bring the ports after an unexpected reload. |
|
|
HSEC license installation from the workflow does not complete. |
|
|
SNMP unable to poll SDWAN tunnel data after a minute. |
|
|
Add verbose log to indicate grant ra-auto un configures grant auto in PKI server. |
|
|
WP7607 Requires shut/no shut to populate IP address from modem to host. |
|
|
Silent reload due to LocalSoftADR causes crash without core file. |
|
|
Device crash with segmentation fault(11), Process = NHRP when processing NHRP traffic. |
|
|
CUBE router unexpectedly reloads while fetching certificate Trustpool for SIP TLS. |
|
|
NAT pool does not working under prefix 16. Available address = zero. |
|
|
Carrier grade NAT reaching max host entries and failing to translate due to gatekeeper. |
|
|
Unexpected reboot while dispalying information from cleared SSS session. |
|
|
PMTUD incorrectly converging without attempting to learn a higher MTU. |
|
|
Packets with L2TP headers cause device to crash. |
|
|
NHRP phase 3 spoke-spoke cache got purged after 5-6 hours with always on traffic running. |
|
|
IOS XE: Traffic not encrypted and droped over IPSEC SVTI tunnel. |
|
|
Cannot disable DMVPN logging in. |
|
|
Enable SoS/ROC feature for DSL. |
|
|
Frame relay DTE router crashes due to EXMEM exhaustion. |
Resolved Bugs in Cisco IOS XE 17.12.1a
|
Bug ID |
Description |
|---|---|
|
Not all HSL entries get pushed to device if more than 1 HSL entries are configured via vManage. |
|
|
Issues/discrepancies around CPU alarms generated and sent to vManage from cEdge. |
|
|
TLS control-connections down, traffic from controller dropped with SDWAN implicit ACL drop. |
|
|
MACSEC remains marked as SECURED, but randomly the traffic stops working. |
|
|
Route-map not getting effect when its applied in OMP for BGP routes. |
|
|
With Pure IPv6, minimal bootstrap unable to onboard Non-Fabric - ipv6 config missing in wan int G1. |
|
|
Unexpected behavior due to unstable power source. |
|
|
(EPC, packet-trace) for IPsec running COFF (Crypto OFFLOAD). |
|
|
NAT ALG is changing the Call-ID within SIP message header causing calls to fail. |
|
|
Upgrade fails due to advertise aggregate with vrf. |
|
|
AAR: BoW feature ignoring color preference from tiered transport preference configuration |
|
|
VPN is established although the peer is using a revoked certificate for authentication. |
|
|
Crash seen when umbrella/zscaler template pushed to device when name_lookup takes 30 sec. |
|
|
NAT entries expire on standby router. |
|
|
With pure IPv6 overlay, vbond vpn 0 ge0/0 interface if-oper-status down after power off/on. |
|
|
Dataplane memory utilization issue - 97% QFP DRAM memory utilization |
|
|
Unexpected reboot due to IOSXE-WATCHDOG: Process = Crypto IKMP. |
|
|
Device punt-policer is not configurable. |
|
|
For some error condition platform_properties may double free. |
|
|
Same label is assigned to different VRFs |
|
|
Auto-update cycle incorrectly deletes certificates. |
|
|
All usb internal communication is closed when using platform usb disable command. |
|
|
%CRYPTO_SL_TP_LEVELS-6-VAR_NEW_VALUE message is observed in each write config with same crypto value. |
|
|
cEdge BFD session down with interface flap. |
|
|
Pseudowire control word not working on device. |
|
|
Double GR_Additional log enablement defect. |
|
|
Segmentation fault in SDWAN PB rx when per-tunnel qos config withdraw. |
|
|
No way audio when using secure Hardware conference with secure endpoints. |
|
|
IOS-XE cpp crash when entering no ip nat create flow-entries. |
|
|
Certificate output is not getting changed on renew when cloud certificate authorization is automated. |
|
|
AAR overlay actions are applied to DIA traffic. |
|
|
Configuring entity-information xpath filter causes syslogs to print, does not return data. |
|
|
cEdge unexpected reload when doing ips test with UTD ips engine. |
|
|
Autotunnel IPsec tracker: Tracker does not come up at all on vEdge. |
|
|
AppNav-XE: Policy-map edit on cluster with multiple service context fails to program TCAM. |
|
|
Port-channel DPI Load-balancing not utilizing all the member-links. |
|
|
GARP on port up/up status from router is not received by remote peer device. |
|
|
Enable VFR CLI in sdwan mode. |
|
|
Telstra Cert: FN980 modem is showing 4 additional NR bands support - 1, 3, 7, and 28. |
Open Bugs in Cisco IOS XE 17.12.1a
|
Bug ID |
Description |
|---|---|
|
Changes to speed on the interface via CLI/GUI does not go through unless first done via shell access. |
|
|
Device unexpectedly reloads due to LocalSoft. |
|
|
Using special characters in the password while generating TP generates an invalid TP. |
|
|
APN password in plain text when cellular controller profile is configured. |
|
|
Punt keep alive failure crash on device controller managed apparently due to for us data packets. |
|
|
With pure IPv6, minimal bootstrap unable to onboard non-fabric - IPv6 config missing in wan int G1. |
|
|
Misprograming during vpn-list change under data policy. |
|
|
SFP transceiver DOM not working after some time, however interface forwards the traffic as expected. |
|
|
BFD going down for newly onboarded device. |
|
|
No licenses in use after upgrading from traditional to Smart Licensing IOS-XE versions. |
|
|
Speed tests to internet from device triggered. |
|
|
Unexpected rebooted while classifying packet with CTF (Common Flow Table). |
|
|
NAT64 prefix is not originated into OMP. |
|
|
Crash when modifying tunnel after running show crypto commands |
|
|
SIP calls not working on device with ZBFW enabled. |
|
|
Can not access any show sdwan commands at all. |
|
|
Device observes Memory Leak at process SSS Manager. |
|
|
Configure replace command fails due to the license udi PID XXX SN:XXXX line on IOS-XE devices. |
|
|
Unable to migrate from ADSL to VDSL without reboot. |
|
|
SDRA-SSLVPN : The SSL VPN session closes with re-authentication error after some interval of time. |
|
|
Traffic forwarded to wrong VPN hence traffic gets wrong zonepair matched and gets dropped. |
|
|
IPv4 connectivity over PPP not restored after reload. |
|
|
OMP to BGP redistribution leads to incorrect AS_Path installation on chosen Next-Hop. |
|
|
Unexpected reboot due qfp uCode due to IPSec functions. |
|
|
BFD entries removed. |
|
|
Router has Local Soft ADR crash, writes flat core, and reloads. |
|
|
Multiple crashes observed on platform due to memory exhaustion. |
|
|
Static route keep advertising via OMP even though there is no route. |
|
|
Static NAT entry gets deleted from running config; but remains in startup config |
|
|
B2B NAT: when configuration ip nat inside/outside on VASI intereface, ack/seq number abnormal. |
|
|
Crashes@crypto_map_unlock_map_head. |
|
|
Unable to configure crypto map on a physical interface due to which crypto map-based VPN's cannot be formed. |
Related Information
Communications, Services, and Additional Information
-
To receive timely, relevant information from Cisco, sign up at Cisco Profile Manager.
-
To get the business results you’re looking for with the technologies that matter, visit Cisco Services.
-
To submit a service request, visit Cisco Support.
-
To discover and browse secure, validated enterprise-class apps, products, solutions and services, visit Cisco DevNet.
-
To obtain general networking, training, and certification titles, visit Cisco Press.
-
To find warranty information for a specific product or product family, access Cisco Warranty Finder.
Cisco Bug Search Tool
Cisco Bug Search Tool (BST) is a web-based tool that acts as a gateway to the Cisco bug tracking system that maintains a comprehensive list of defects and vulnerabilities in Cisco products and software. BST provides you with detailed defect information about your products and software.
Documentation Feedback
To provide feedback about Cisco technical documentation, use the feedback form available in the right pane of every online document.
Troubleshooting
For the most up-to-date, detailed troubleshooting information, see the Cisco TAC website at https://www.cisco.com/en/US/support/index.html.
Go to Products by Category and choose your product from the list, or enter the name of your product. Look under Troubleshoot and Alerts to find information for the issue that you are experiencing.
Feedback