Find all the information you need about this release—new features, known behavior, resolved and open bugs, and related information.


Note

Explore Content Hub, the all new portal that offers an enhanced product documentation experience. Content Hub offers the following features to personalize your content experience.

  • Faceted Search to help you find content that is most relevant

  • Customized PDFs

  • Contextual Recommendations


New and Enhanced Software Features for Cisco IOS XE Gibraltar 16.12.1a


Note

When you upgrade from one IOS XE release to another, you may see %Invalid IPV6 address error in the console log file. To rectify this error, enter global configuration mode, and re-enter the missing IPv6 alias commands and save the configuration. The commands will be persistent on subsequent reloads.


New and Enhanced Features for Cisco IOS XE Gibraltar 16.12.1a

  • Unclassified MAC Initiator with IANA—ISG IPv6 sessions are based on the unclassified MAC address of the subscriber. If you use DHCPv6 for IPv6 addresses, ISG creates subscriber sessions based on DHCPv6 packets with the IANA option.

  • Online Diagnostics —The online diagnostics contain tests to check different hardware components and to verify status of the software process and interfaces. The online diagnostics tests detect problems in areas such as hardware components, software process, and interfaces.

  • IPv6 Prefix for VxLAN Static Route—IPv6 over IPv6 and IPv6 over IPv4 encapsulation is introduced for VxLAN tunnels. The VxLAN tunnels that operate at more than 10 Gbps now has the following encapsulations :

    • IPv6 over IPv4

    • IPv6 over IPv6

    • IPv4 over IPv6

    • IPv4 over IPv4

  • Bridge-Domain Virtual IP Interface—The Bridge-Domain Virtual IP Interface (VIF) now connects multiple Bridge Domain Interfaces (BDI) with a single BD instance so that each IP subnet within an L2 network can be associated with a single VRF.

  • IPv6 support for Encrypted Traffic Analytics —Encrypted Traffic Analytics (ETA) uses passive monitoring, extraction of relevant data elements, and supervised machine learning with cloud-based global visibility. ETA is now extended to IPv6 addresses to identify malware communications in encrypted traffic.

  • Support for Federal Information Processing Standards (FIPS)—Federal Information Processing Standards (FIPS) are publicly announced standards developed by the United States Federal Government for use in computer systems by non-military government agencies and government contractors. Ensure to configure devices to use only FIPS approved algorithms (even though devices prevent the use of non-FIPS compatible algorithms in the FIPs mode) because some functionalities may fail in the FIPS mode if the device attempts to use non-FIPS compliant algorithms.

  • QSFP-100G-SM-SR on EPA-QSFP-1X100GE

  • EVC with MACSec—The Ethernet Virtual Circuit (EVC) support on MACsec and MKA feature provides the functionality to detect EVC and to bring up the physical interface that matches the EVC criteria. With this functionality, users can transport layer 2 traffic from multiple enterprises over a WAN link and independently secure their traffic with MACsec over EVC.

  • SISF support for multiple IA_NA and IA_PD—For Switch Integrated Security Features (SISF)-based device tracking, support has been added for multiple IA_NA and IA_PD. When SISF analyzes a DHCPv6 packet, it examines the IA_NA (Identity Association-Nontemporary Address) and IA_PD (Identity Association-Prefix Delegation) components of the packet, and extracts each IPv6 address contained in the packet, enabling SISF and any components that depend on SISF to be aware of all IPv6 addresses assigned to each network device.

  • Detailed error reporting of invalid commands in NETCONF session—Added the netconf detailed-error command, which adds helpful return codes to the network configuration protocol (NETCONF) output if an invalid command is executed in a NETCONF session.

  • BGP Support for TCP-AO—On a secure control plane, BGP uses Message Digest 5 (MD5) algorithm as the authentication mechanism. It uses TCP API to configure the keychain on a TCP connection. When authentication is enabled, any Transmission Control Protocol (TCP) segments belonging to BGP are exchanged between peers, verified and accepted only if authentication is successful.

  • Cisco Discovery Protocol over IPv6 Tunnels—The Cisco Discovery Protocol (CDP) delivers traffic through GRE IPv6 tunnels from other protocols and allows routing of IPv6 packets between private networks across public networks with globally routed IPv6 addresses.

  • PFS for GETVPN—If a Group Member (GM) is compromised, an attacker may access saved long-term keys and messages. With Perfect Forward Secrecy (PFS) for GETVPN, the attacker cannot use the keys and messages to obtain the keys of past or future sessions. Thus, the attacker cannot obtain keys to decrypt recorded or future communication.

  • TCP Authentication Option—TCP Authentication Option (TCP-AO) replaces TCP MD5, TCP-AO protects long-lived TCP connections against replays using stronger Message Authentication Codes (MACs) than TCP MD5. TCP-AO is resistant to collision attacks, and provides algorithmic agility and support for key management.

  • TCP-AO Support for SXP—CTS SXP peers exchange IP-SGT bindings over a TCP connection. TCP Authentication Option (TCP-AO) enables you to guard against spoofed TCP segments in CTS SXP sessions between the peers.

  • Web User Interface —Supports an embedded GUI-based device-management tool that provides the ability to provision the router, simplifies device deployment and manageability, and enhances user experience. The following features are supported on Web User Interface from Cisco IOS XE Gibraltar 16.12.1a:

    • Viewing File Manager

    • Configuring Trustsec

    • Monitoring Trustsec Statistics

  • Yang Data Models—For the list of Cisco IOS XE YANG models available with this release, navigate to https://github.com/YangModels/yang/tree/master/vendor/cisco/xe/16121/BIC Revision statements embedded in the YANG files indicate if there has been a model revision. The README.md file in the same GitHub location highlights changes that have been made in the release

  • Multi-SA Support for SVTI—You can define and associate an Access Control List (ACL) with an SVTI to select traffic between specific source and destination proxies. By associating the ACL, you are modifying the default configuration that uses a single any-any traffic selector and for every non-any-any traffic selector, IPSec SAs are created so that multiple SAs can be attached to an SVTI.

  • Show tech ospf—You can specify a vrf-instance with the show tech-support ospf command so that the following commands are executed for the specified VRF:

    • show ip route summary

    • show ip route ospf

  • Syslog Messages for excessive tmpfs usage—Two new syslog messages are generated to alert excess memory consumption by tmpfs.

    PLATFORM-3-TMPFS_WARNING is generated when the tmpfs memory usage exceeds 40% of the total DRAM capacity.

    PLATFORM-3-TMPFS_CRITICAL is generated when the tmpfs memory usage exceeds 50% of the total DRAM capacity.

  • Show command updates for SRTP Rollover Counter (ROC)—The output of the following commands is enhanced to display SRTP ROC information.

    • show voip fpi calls

    • show voip fpi stats

    • show voip rtp connections


Note

The last supported release for Cisco ASR 1000 Series 20-Gbps Embedded Services Processor (ASR1000-ESP20) is IOS XE release 16.12.x.


Resolved and Open Bugs for Cisco IOS XE Gibraltar 16.12.1a

About the Cisco Bug Search Tool

Use the Cisco Bug Search Tool to access open and resolved bugs for a release.

The tool allows you to search for a specific bug ID, or for all bugs specific to a product and a release.

You can filter the search results by last modified date, bug status (open, resolved), severity, rating, and support cases.

Resolved Bugs for Cisco IOS XE Gibraltar 16.12.1a

All resolved bugs for this release are available in the Cisco Bug Search Tool through the Resolved Bug Search.

Caveat ID Number

Description

CSCua57391

isdn cause-location command support for switch-type primary-ntt

CSCva76745

show running-config | format with DHCP pool results in a reload

CSCvb87675

BGP event crash@bgp_afpriv_imp_is_imported_path

CSCvh73576

config revert Rollback visible in console and locks up config from VTY

CSCvh92659

BFD flaps everytime with dynamic tunnel creation in DMVPN

CSCvi26188

Watchdog crash within mgcpapp_free_sys_event_Q event dequeue loop after running 'ccm-manager config'

CSCvi86071

Crash seen after configuring SCP path under archive

CSCvj28921

High CPU due to Alignment Corrections - SMEF & IWAN

CSCvk27129

The requirement to shutdown dialer interface before its deletion causes an issue for vManage

CSCvk71047

Router fails to reserve necessary ports for VPN traffic (UDP 500 & 4500) for ISAKMP

CSCvk75838

netconf/yang or telemetry retrieval of /trustsec-state/cts-rolebased-policies breaks

CSCvm07353

Router may crash when a SSH session is closed after configure TACACS

CSCvm10850

Crash after CPUHOG in ISDN L2D SRQ Process

CSCvm25921

Signaling interface inactive on "show snmp mib ifmib ifindex de" on IOS 16.6.3

CSCvm46362

ASR1000 node in HA pair might crash due to punt-keepalive failures

CSCvm75066

MPLSoVPN: Change behavior of default route in NHRP. Must insert 0.0.0.0/0 instead of /32

CSCvm91642

MACsec SAP 128 Bits doesn't work with network-essentials license

CSCvm94112

DSM-3-INTERNAL: Internal Error : No DSM handle provided traceback on TDM voice gateway

CSCvm94788

Device reloads when applying #client <IP> vrf Mgmt-vrf server-key 062B0C09586D590B5656390E15

CSCvm96960

ASR1001-X throwing: ETH_SPA_MAC-3-SPI4_ERROR: SIP0/1: Marvel MAC

CSCvn00104

Software crash due to memory corruption after packet trace was enabled.

CSCvn03502

SR: CFLOW input intf index is 0xffffffff for Service-engine DSP module interface

CSCvn09468

Netconf shows each overwrite of cts role-based sgt-map command

CSCvn17073

ARP HA and other clients sync together causing high cpu on CBR

CSCvn23906

DHCP Server sends Renew ACKs to Clients with 00:00:00:00:00:00 MAC in L2 frame

CSCvn24992

Add support for DHCP "utilization" CLI in Cisco-IOS-XE-dhcp YANG model

CSCvn27449

PBR doesn't work for dialer intf when it doesn't have fixed ip address

CSCvn37237

ASR1002-HX crashed after huge traffic is transmitted over it

CSCvn44400

Login banner does accept banners over 238 characters

CSCvn45150

tclsh: socket -server open <port> allows multiple bindings in IOS-XE

CSCvn45732

Device crashing if we unconfigure the NTP on the device

CSCvn49351

Async line not visible in show run and show int brief output but visible in show line output

CSCvn51557

Negating dialer watch-list command without alterning the entered CLI command.

CSCvn52019

Crashed while checking condition debug

CSCvn53969

Memory leak in SMD process due to AAA Idle-timer not being freed

CSCvn54470

ASR1006X linecard down after Active RP3 OIR

CSCvn56017

Crash while processing ISIS updates when DiffServ-TE is enabled

CSCvn56579

MQIPC memory corruption resulting dot1x/MAB not working for wired clients

CSCvn57165

Static Nat fails to translate SIP Trying L7 header

CSCvn57771

3850 sending hostname as NAS-ID

CSCvn57892

High Memory utilization due to Wireless Manager IOSD process

CSCvn58922

With 3 KS in COOP, overlapping KSSID range is not detected

CSCvn59020

Modified EIGRP timers on Virtual-Template put all associated Vi interfaces into passive mode

CSCvn59626

NTP template attach fails with a non default vrf and source interface configured

CSCvn60318

After reload, standby can't join stack due to crash in rbm_request_new()

CSCvn61479

16.11:ASR1k:ESP-X: Lisp mroute verification failed for eid vrf.

CSCvn63084

The WS-C3850-48XS stack crashes due to LACP

CSCvn63309

VRF Associated to an interface is not considered as associated with pim sparse-mode configurations

CSCvn66258

ASR1000-2T+20X1GE interface speed change from 100 to 1000 after switchover

CSCvn67837

TCP port takes 4 minutes to get released after it is closed

CSCvn67870

Reorder ip nat configuration - to be placed after ip http configuration

CSCvn68370

C3PL (Cisco Common Classification Policy Language) changes for CSCvn56365 AppNav-XE WAAS issues

CSCvn68893

ASR1000 Process = TUN ETHER Thread crash

CSCvn70066

ASR1000 Crash on device when SNMP walk is done while configuring QoS on interface.

CSCvn71041

TACACS group server is not seen, when "transport-map type console test" is configured.

CSCvn71505

Incorrect Bandwidth Calculation for Priority Level 2 on 100 gig Interface

CSCvn72208

RP3 Punt Interface May Drop Traffic Due to VLAN Filter Hardware

CSCvn72973

Device is getting crashed on the "cts role-based enforcement"

CSCvn74807

Cisco TrustSec crash while processing CoA update

CSCvn76107

Static NAT configs missing in netconf get-config

CSCvn76837

DMVPN Phase 2 shortcut triggered from a spoke behind PAT may end up in stuck DNX state

CSCvn77783

class-attributes support in ISG radius proxy scenario

CSCvn78113

Tunnel PMTUD not being aged out after PMTUD ager timer expires

CSCvn78203

Router crashed when printing logs while constructing rekey packets (GETVPN)

CSCvn78349

FlexVPN with password encryption - keyring aaa LIST password 6 xxxxx encrypted again upon reload

CSCvn78961

Subscribers cannot re-login due to CoA time-out (lite-sessions in routed mode)

CSCvn81585

%CTS-3-SAP_MANUAL_PMKID_MISMATCH: PMKID Mismatch when primary switch failover in a 6 switch stack

CSCvn82063

Input CRC counter increasing on Tengi interface.

CSCvn82245

EIGRP session is not coming up if the dynamic PBR is applied on interface

CSCvn83172

Router reloads on 'show track' command when there is track object for deleted serial sub-interface.

CSCvn84682

AAA Common Criteria writes password in cleartext to configuration on change

CSCvn85422

Int index is 0 for the Cellular inteface in the exported flow

CSCvn86400

SISF-3-INTERNAL: Internal error, Cannot create binding entry -Process= "SISF Main Thread"

CSCvn87990

Showing wrong release version in 'show eigrp plugins'

CSCvn99748

Client can not get DHCP address again when the Client's ARP entry remained

CSCvo00585

Split DNS in case of UDP query to WAN interface IP via LAN interface

CSCvo00664

SUP reload after running the command " show plat hard qfp act infr bqs debug qmrt_dump "

CSCvo00968

Radius attr 32 NAS-IDENTIFIIER not sending the FQDN.

CSCvo01298

Correction to Quick RP3 recovery after the Punt Path XAUI link goes down

CSCvo01504

%QFPOOR-4-TOP_EXMEM_USER reports negative memory allocation

CSCvo03458

PKI "revocation check crl none" does not fallback if CRL not reachable

CSCvo05751

Polaris : Changes for sending vlan attrs in access request

CSCvo06817

Router crash while executing show commands using '|' (pipe) to filter the output.

CSCvo08132

BUILT-IN-2T+20X1GE - VLAN bytes and packets counters are frozen.

CSCvo09059

"no autostate" will auto add after re-configure svi interface

CSCvo10145

Memory overlay crash when using include-cui

CSCvo11361

Priority queueing on port-channel interfaces causes frame re-ordering.

CSCvo11786

SCCP Application does not clear failed sockets leading to leak and socket pool exhaustion

CSCvo12745

Packet drop occurs after acl permit configurations

CSCvo15201

IPSLA IPv6 ICMP Probe is showing status as OK with no IPv6 connectivity

CSCvo17287

ASR1001-X crashed upon receiving Radius Access-Accept message

CSCvo17528

Reload initiated via SNMP on IOS-XE causes a crash

CSCvo17738

Cellular interface lte Network Selection Mode switches to manual

CSCvo18177

IPV4 routes on the global routing table learnt via BGP refreshes upon adding or removing a VRF

CSCvo18415

Unable to remove "logging source-interface <if-name>" command on 3850

CSCvo19395

Router crashes when removing a crypto map

CSCvo19984

Class map containing no-match result-type method dot1x none never results in success

CSCvo20934

FMAN crash due to Flexible Netflow (fnf)

CSCvo23199

SDA:16.9.2S - Arp issue during wired host mobility

CSCvo25785

Crash on an LNS router in process ACCT Periodic Proc

CSCvo26034

Replace all BGP/route-map communities in "set community" array with <edit-config> "replace" operatio

CSCvo27553

PKI incorrect fingerprint calulation during CA authentication

CSCvo29096

SRTE ODN: After removing "mpls traffic-eng router-id loopback" OSPF not adv links in TE opaque LSA

CSCvo30329

Router crashing after upgrade due to Crypto commands "Block overrun at 284B2160 (red zone 000110DF)"

CSCvo30641

Traceback: Error seen after tunnel flap: DATACORRUPTION-1-DATAINCONSISTENCY

CSCvo31617

16121: ISIS local-LFA repair path has no label causing high convergence

CSCvo36031

WSMA crash formatting show command output

CSCvo36188

Crash at NAT clear

CSCvo36948

Router crash when running show aaa user all command

CSCvo36969

Crash during SSO config sync

CSCvo38655

16.11.1-systest: Segmentation fault : CEF bgrnd process with DUT reload with Sw to Rtd port

CSCvo41815

When roaming to another AP, services received from RADIUS are not applied to the session

CSCvo41879

Interface is not joined to mcast map-notify after reload

CSCvo42105

IOS-XE DHCP server creates option 125 with invalid format

CSCvo43597

Dot1x Users MAc address not present on the correct Vlan after SSO

CSCvo46127

MaxSusRate is not working with service class

CSCvo47436

IOSXE - firewall corrupts half open list

CSCvo47655

SDA-FHR not registering multicast source with RP

CSCvo47866

Crash at Process = SCCP Auto Config

CSCvo49876

SISF not honoring 1 IPv4-to-MAC rule when DHCP ACK comes from a different VLAN (via Relay)

CSCvo51252

AirOS Parity : Local to Radius Fallback failing for Webaut and TACACS for 9800

CSCvo58098

CTS PACS not downloading to the devices

CSCvo58118

CTS Environment-data is not getting refreshed on the device

CSCvo58195

HSRP VIP is not reachable locally

CSCvo58854

ASR1000/16.9.2 - Duplicate entries in dangling list

CSCvo61610

FXS - no busy tone is generated on remote-onhook condition with call pickup scenario

CSCvo61772

"ip nat translation port-timeout" limited to overflows after reaching 16bit

CSCvo61914

GC NAT unable to detect dns packet

CSCvo65415

ASR1000 crashes by handling DHCP packet

CSCvo66216

IPSec-Session count in "show crypto eli" reaches max causing VPN failure

CSCvo70504

Missing Calling-Station-ID in Accounting Ticket for Web-Tal locations

CSCvo71381

dot1x dynamic voice assignment failure after data domain auth such

CSCvo71445

MACSEC license is not being consumed for sub-interfaces

CSCvo71721

When sending account-logon ISG do not reply with ACK nor NACK.

CSCvo73205

Identity policy won't update after config changes.

CSCvo73897

[SDA] [PI changes] No audio during first few seconds of voice call between 2 Fabric Edge

CSCvo73954

ASR1001-HX: Excessive pause frames (IEEE802.3x compliant) affect traffic on other interfaces

CSCvo74486

IOS-XE ACL port information preserved after encapsulation

CSCvo75992

tdl_fw_stats in FMAN logs errors

CSCvo76021

L3VNI:VPNv4 routes are not imported into BGP-EVPN upon reload/SSO while VPNV6 routes are imported

CSCvo83945

Ping failure on Port-channel sub interface when is using EVC in main port channel

CSCvo87488

GetCACaps is using wrong CA-IDENT when using enrollment profiles

CSCvo87827

Crash when polling IPForwarding MIB

CSCvo94211

Traffic stops flowing on Xconnect tunnel when upgraded to 16.9.2

CSCvp00271

Read and Write lock fix for ACL cache

CSCvp03655

Observing 100% CPU utilization for sessmgrd

CSCvp05070

Overlay BGP down when configured "ip nhrp server-only"

CSCvp09091

When sourcing Radius from loopback in VRF, auth right out of boot up might fail

CSCvp10711

Hierarchical QoS stops working on GRE tunnel if dest route flaps between 2nd tunnel and physical int

CSCvp10830

Client with VNID override on roaming gets into authorization failure due to vlan 0

CSCvp14338

LISP: "flood" configuration broken under "instance / service ethernet" submode

CSCvp16606

sdwan isr receiving any SOO changes AD to 252

CSCvp16730

Incoming ESP packets with SPI value starting with 0xFF are dropped due to Invalid SPI error

CSCvp19568

L2VPN - Xconnect - filtering of LDP targeted hellos using ACL not working

CSCvp20770

Nas Identifier not sent in Accounting Packet

CSCvp21680

Delay on sub interface doesn't match physical interface causing issues for routing

CSCvp23796

"no cts role-based enforcement " is not honored and enforcement continues to happen

CSCvp24981

When FQDN used for APN, IOS DNS resolves FQDN to IP, but GTP stays in DNS pending and IP 0.0.0.0

CSCvp25052

ISR4K: Router crash due to twice memory release

CSCvp27220

Tail drops on IPSLA sender when using scaled udp-jitter probes

CSCvp30475

ASR1000: VLAN counter mismatch on sub-interfaces

CSCvp32910

Bad root chunk pointer in chunk header post SSO - ASR1000

CSCvp38317

MGCP GW doesn't reset SSRC/ROC on receiving MDCX with new IP/port/SDP parameter for SRTP call.

CSCvp38424

On-Prem DMVPN fails to establish a dynamic tunnel between Spoke nodes.

CSCvp46197

GETVPN suite-B does not work on ASR1006x router

CSCvp46381

static nat which has been deleted is shown when show ip nat translation

CSCvp47792

VG3x0 - groundstart voice-port configuration removed after reload

CSCvp49863

Incomplete arp in management interface

CSCvp56737

Counters of interfaces are reporting inexistent peaks

CSCvp62811

Engine keyword missing after "show utd engine standard statistics url-filtering"

CSCvp63616

Crash due to too many DSPs

CSCvp66049

%DATACORRUPTION-1-DATAINCONSISTENCY: due to PMIPv6

CSCvp66443

HTTP Client inside IOS-XE incorrectly reports "Invalid IP address in Hostname" for legal IP address

CSCvp66980

ISG : Changes in circuit-id and remote-id are not reflected after roaming

CSCvp70211

Crash when running show crypto map

CSCvp70443

isdn cause-location command support for switch-type primary-ntt

CSCvp70707

Should provide a repair path for the Strict SID even when the repair path is NOT a TI-LFA

CSCvp71303

Router crashes when "tod-clock revertive" command is executed

CSCvp72220

crash at sisf_show_counters after entering show device-tracking counters command

CSCvp72379

ip dns primary command does not get removed

CSCvp73344

Standby crash during ISSU

CSCvp75121

Ucode crash when PfRv3 and IPv6 monitor are configured on the same tunnel with IPv6 VRF configured

CSCvp77100

ASR1000: Crypto Engine remains in stuck state post dataplane crash

CSCvp81102

IPsec SA installation fails with simultaneous negotiations despite fix for CSCve08418

CSCvp85916

Crash when "show running" is used

CSCvp87488

no login on-success log CLI does not persist across device reloads

CSCvp92334

Crash after Media monitor look up.

CSCvp95070

"encr aes 256" config removed from CDB & invisible to netconf/yang and restconf

CSCvq18793

NIM-2FXS/4FXOP crashing due to DSP failed to reply properly

CSCvq20005

SRMS tries to build a snapshot when there are no SIDs

CSCvq39840

CiscoFlashFile - Get-Next request takes longer time for last file on directory.

Open Bugs for Cisco IOS XE Gibraltar 16.12.1a

All open bugs for this release are available in the Cisco Bug Search Tool through the Open Bug Search.

Caveat ID Number

Description

CSCva53392

Polaris 16.3.1 : Machine and bus error failures in ESP20

CSCvd75992

3650: pnp profile config causes line console config to be copied over to vty after "show run"

CSCvg68226

Excluding cisco802TapMIB or ciscoTap2MIB should not require Lawful Intercept licence

CSCvo46253

BGP Oper model rpc reply error with aggregate bgp ipv6 route.

CSCvo56553

ASR1000: RP3 crash due to punt-keepalive failures

CSCvo67036

ASR1000 routers crashed when TCM received an illegal command from the ucode

CSCvp08353

Add ERROR message over IOS console when HSPRDA TCAM region gets full

CSCvp16862

EVPN Prefix import Count/Limit show incorrectly

CSCvp27139

Async lines configuration is not retrievable over netconf

CSCvp30081

BGP looped update among 3 peers

CSCvp38407

"Radius-server attribute 31" command broken on LNS when LAC sends Remote-Id string

CSCvp47006

QoS counter didn't generate at ASR1001-X

CSCvp53001

ASR1001-HX: bay1 1G link stays up when Rx cable of remote end is removed

CSCvp69393

Router crashes after snmpget to OID related to NHRP

CSCvp79485

DMVPN - Packet is encapsulated but not encrypted going out DMVPN tunnel

CSCvp89419

Error messages seen when configuring "logging persistent protected" on ASR1K routers

CSCvp91554

16.12.1 SIT: UNIX-EXT-SIGNAL: Segmentation fault and Memory related crash during SXP bringup

CSCvp96086

Additional display for incorrect profile with reset on backoff :

CSCvp97235

Crash while BGP was updating rib table

CSCvq00263

Device crashed @ radius_io_stats_timer_handler due to dynamic-author

CSCvq01379

Revert the changes of CSCvo75201 in rel21

CSCvq09061

.py file check is not done while registering the policy and the error is seen

CSCvq18004

BGP evpn table and vrf table out of sync

CSCvq18328

SSH: host_key->name is not null after reload which prevents SSH from starting up

CSCvq19808

Egress shaping on port-channel sub-intf tail dropping traffic long before rate

CSCvq20685

ESP40 crash in CGN mode after apply "ip nat setting mode cgn"

CSCvq23869

ASR 1000 sub-interface counters wrong.

CSCvq25297

BRI leased line can't come up automatically after remove/insert one side's cable

CSCvq25320

Get-Config using NETCONF interrupted if authenticated with TACACS+

CSCvq26821

shaper of the internal crypto interface is incorrectly programmed

CSCvq29953

IP SLA react for packetloss and successivepacketloss do not set $_ipsla_react_type in EEM

CSCvq31129

AppNav: Optimization failed with Asymmetrical traffic, VRF, FNF and NBAR

CSCvq31871

Router crashes with ZBF HA sync.

CSCvq33073

OBS : PE ignores IGP metric while advertising the MED value to CE

CSCvq33994

BGP YANG oper address-family fails with vpnv4-unicast

CSCvq34054

BGP updates missing ISIS advertising-bits when redistribute level-1 is applied

CSCvq35581

Unable to configure half duplex on cEdge

CSCvq35925

The switch crashes when processing a 'unknown' message from 'PKISSL read mqipc'.

CSCvq36130

Router is on Bootloop after QoS configuration.

CSCvq36179

Interfaces with 'shutdown' configuration in UP state

CSCvq36984

Netconf-yang service not starting properly

CSCvq39840

CiscoFlashFile - Get-Next request takes longer time for last file on directory.

CSCvq40443

"Clock: inserting leap second" message doesn't output on NTP client when leap second inserted

CSCvq42239

F0: fman_fp unexpectedly crashed with exmem chunk alloc

CSCvq42607

Delay during vrf aware bgp address-family configuration over netconf

CSCvq44860

Static routing redistribution under RIP with route-map is not working after reload

CSCvq45088

ASR 1000 BDI not working properly for packet fragmentation - very small fragments are getting dropped

CSCvq46526

DMVPN | Spoke to Spoke traffic fails when Tunnel initiated by Tunnel IP to tunnel IP pings.

CSCvq48438

ASR1000: ucode crash @ uidb_subblock_lookup__output_nat_sb

CSCvq49000

Supervisor reloaded due to cpp_cp_svr process crashing

CSCvq58144

cpp_cp_svr crash in cpp_bqs_rm_yoda_select_sch_exponent

CSCvq58237

Supervisor reload due to cpp_cp_svr crash.

CSCvq61062

mip crash reloading the router

Resolved and Open Bugs for Cisco IOS XE Gibraltar 16.12.2s

Resolved Bugs for Cisco IOS XE Gibraltar 16.12.2s

All resolved bugs for this release are available in the Cisco Bug Search Tool through the Resolved Bug Search.

Caveat ID Number

Description

CSCvt03982

IOS-XE NAT - protect customer data

Open Bugs for Cisco IOS XE Gibraltar 16.12.2s

All open bugs for this release are available in the Cisco Bug Search Tool through the Open Bug Search.

Caveat ID Number

Description

NA

There are no open caveats in 16.12.2s

Resolved and Open Bugs for Cisco IOS XE Gibraltar 16.12.3

Resolved Bugs for Cisco IOS XE Gibraltar 16.12.3

All resolved bugs for this release are available in the Cisco Bug Search Tool through the Resolved Bug Search.


Note

In Cisco IOS XE Release 16.12.3, the semantic version number for the YANG models is not updated and is therefore not accurate. However, this limitation does not impact the functionality of the YANG models

Caveat ID Number

Description

CSCvq33563

AFW_application_process triggers a crash with voice conference

CSCvq44603

ISR 4000 Reloads Unexpectedly, Crashing in the "IP NAT Ager" Process

CSCvq80928

CME/BE4K SNR: Crash when config changes are made while SNR call is active

CSCvr15127

ASR 1000/ISR 4000 Calls fade to no-way audio due to media inactivity detection after 20 minutes

CSCvr17670

ISR G3, ASR 1000 crash after VoIP AAA test

CSCvr24316

Router crashes due to Segmentation Fault when 'ccb' gives a NULL Pointer

CSCvr39932

IPSEC install failed IPSEC_PAL_SA shows "unexpected number of parents"

CSCvr41433

Unexcpected reboot when copying anchorspi context from parent to child.

CSCvr48349

ESP ucode crashed when running NAT with bpa (CGN)

CSCvr61217

GetVPN-ISR4461// Getvpn traffic is failing with Transport mode with all the versions.

CSCvr76534

ISR 4000 : Crash seen at Process Exec

CSCvr87906

ISR 4461: Large un-fragmented IPSEC packets cause router to crash

CSCvr90926

CUBE is updating the resolved IP only after the REGISTER expires

CSCvr93969

C9800:ISSU: wncd crash@ crypto_engine_pk_crypto during ISSU downgrade scenario

CSCvr96597

IOS-XE crash after doing a SCEP enrollment

CSCvr99034

ISR 4000 router crash during updating the OpenDNS bypass allowed list

CSCvs04194

Process = Exec crash seen on dmap longevity testbed with clear cry sa peer several times

CSCvs08681

Crash triggered with IPv6, IPv4, PPPoE, PortChannel and NAT

CSCvs13960

IWAN High CPU and Memory

CSCvs25682

GETVPN: IpsecInvalidSA drops are seen on ESP200X/ESP100X after %LOGGER-6-DROPPED: message

CSCvs29535

IWAN crash related to DCA channel

CSCvs47682

Router crashed on removing trustpoint on dspfarm profile

CSCvs55066

ISR 4000 only: MGCP status remains Down and does not register with CUCM after a reboot or power cycle

CSCvs60195

ASR 1000 ucode crash after too many locks in ZBF pair setup

CSCvs70052

ALG with NAT trigger a crash when a DNS writeback occurs

CSCvs71952

IOS-XE ZBFW Crash When Exceeding Half-Open Session limit

Open Bugs for Cisco IOS XE Gibraltar 16.12.3

All open bugs for this release are available in the Cisco Bug Search Tool through the Open Bug Search.

Caveat ID Number

Description

CSCvj26197

Update statistics from Oecteon viptela code to platform

CSCvm75074

Correct the severity level of logs generated by smart-agent

CSCvp60827

Delay of 30 sec while creating a new config file for phone using tftp.

CSCvp70459

IOS: Prevent crypto ACL change if already mapped with crypto map configuration

CSCvp93108

ISR4k Crash seen in skinny_unreserve_xcode_stream on 16.9

CSCvq00617

CME Crash with call to shared line when 1 setup leg is NULL

CSCvq43004

Need to check qfp ucode crash with RTCP traffic - chunk memory corruption in RTCP path

CSCvq65366

Cube might crash when sending a SIP message over TLS

CSCvq69866

HSRPv2 crash whilst retrieving group from received packet

CSCvq76305

ASR 900 autoRP listener functionality issue

CSCvq84990

Remove show ip/ipv6 access-list from syncfd-<ewlc-SIT>17.1-Observed Traceback followed by IOSD crash

CSCvq87063

getvpn suiteb:KS sends delete payload to gm's while scheduled rekey after primary KS dead/readded

CSCvq91046

ASR 1000 crash in NAT code when processing PPTP traffic

CSCvr24434

yang missing for "ipv6 locator reachability minimum-mask-length 128 proxy-etr-only"

CSCvr25074

power event detected when connect with switch module

CSCvr28935

IOS crash in DHCPd Receive with Unnumbered interfaces

CSCvr39868

Unexpected reload when issueing show ip mroute vrf <vrf> verbose

CSCvr41932

17.1.1 - Memory leak @ SAMsgThread.

CSCvr61879

"static ip addresses not configured for the list" message

CSCvr76593

Memory leak in CC-API_VCM and CCSIP_SPI_CONTROL

CSCvr80334

Pubd process on the controller goes down, managed by DNA-C 1.3.2

CSCvr85094

Enabling Telemetry can cause router to crash.

CSCvr91021

SESM Policy-Interface on ISG ignoring Radius Requests on port 1812

CSCvs00961

Memory leak under CCSIP_UDP_SOCKET / MallocLite

CSCvs05043

ESP40 crash in CGN mode after apply "ip nat setting mode cgn" and "no shut" interface

CSCvs10266

Cat9K/16.11.1c/SDA- Ingress QOS Service Policy not applying to interface

CSCvs13561

Post SSO, if service template is getting downloaded and switch crashes, client is stuck in authc

CSCvs17812

GETVPN generated core upon RP switchover, cpp_cp crashed

CSCvs18780

SR Labels not installed in forwarding plane when there are multiple sources for the prefix SID

CSCvs30865

rLFA for LDP causes loss of MPLS traffic after RSP switchover

CSCvs48777

9800-L has crashed on Smart Licensing

CSCvs53749

EVPN RMAC stale routes seen

CSCvs54855

Catalyst 9300 Wrong implementation of CBQOS MIB

CSCvs56255

Crash on BGP NSAP address-family when adding CLNS next-hop route-map

CSCvs56586

While upgrading the IOS-XE version from 16.9.2 to 16.9.4 , smart licensing registration was lost

CSCvs58945

Missing constraints and PRCs lead to broken model

CSCvs59402

Random IPSEC drops on ESP200 with esp-gcm transform set

CSCvs64107

Memory Leak in IPv6 ND Process

CSCvs66432

SISF installing target IP of an ARP request when sent with src 0.0.0.0

CSCvs74389

User cannot login in GUI if present in both local database and AAA server

CSCvs75268

OSPF process crash due to chunk corruption in Flood DB

CSCvs75958

ISR4331/K9 Dialer cannot make calls suddenly

CSCvs80225

RAR: RFC5578 does not work in 16.12 and later

CSCvs81736

heavily oversubscribing the EGRESS interface IPv6 priority traffic is "silently" being dropped

CSCvs85642

4331 16.9.4 QFP ucode crash due to null derefence

CSCvs96732

SDWAN cEdge VRRP fail recovery take 10-15 mins for OMP tracking, with prefix list tracking no output

CSCvs98578

ISR 4221 router with NIM switch module MAB/Dot1x does not start

CSCvt00422

Updating an existing ZBFW policy requires a detach/re-attach to push successfully

CSCvt01186

Interface does down when "l2vpn xconnect" command is removed

Resolved and Open Bugs for Cisco IOS XE Gibraltar 16.12.4

Resolved Bugs for Cisco IOS XE Gibraltar 16.12.4

All resolved bugs for this release are available in the Cisco Bug Search Tool through the Resolved Bug Search.


Note

In Cisco IOS XE Release 16.12.4, the semantic version number for the YANG models is not updated and is therefore not accurate. However, this limitation does not impact the functionality of the YANG models

Caveat ID Number

Description

CSCvg79330

enable platform ipsec control plane conditional debug might cause FP/QFP IPsec outbound SA leak

CSCvh24730

PfRv3: Crash while Printing the Same TCA Message

CSCvn06203

"logging origin-id ip" seen as 0.0.0.0 in the logs when used with VRF or Management port

CSCvp33578

Crash at the moment of deleting a DVTI

CSCvp88044

Performance Monitor crash

CSCvq20936

CUBE router crashed due to memory corruption in subscription control block

CSCvq62065

SIP phone paging party hears own voice

CSCvq87063

getvpn suiteb:KS sends delete payload to gm's while scheduled rekey after primary KS dead/readded

CSCvq90342

PIM process crashed during clear arp-cache

CSCvq91046

ASR 1000 crash in NAT code when processing PPTP traffic

CSCvr05193

IOS PKI | Intermittently SubCA fails to rollover

CSCvr05504

Dialer interface counter does not correlate to the counter of interfaces bounded to

CSCvr12455

KPML dialing fails after CSCvq20936 commit

CSCvr37717

VSS Experiences Unexpected Reboot Due to PIM process

CSCvr39868

Unexpected reload when issueing show ip mroute vrf <vrf> verbose

CSCvr41932

17.1.1 - Memory leak @ SAMsgThread.

CSCvr42504

ping is not working on port-channel after router reload

CSCvr66463

With CRL fetch failed, stuck at Failed to send the request. There is another request in progress

CSCvr76593

Memory leak in CC-API_VCM and CCSIP_SPI_CONTROL

CSCvr85094

Enabling Telemetry can cause router to crash.

CSCvr98154

Out of IDs in webauth module resulted crash due to memory leak

CSCvs08368

FlexVPN Hub Memory Leak in AAA process when IKEv2 sessions are being established

CSCvs11971

With should-secure traffic is getting blocked when mka moves to init state during key rollover

CSCvs28073

IOS-XE device has memory leak in linux_iosd-imag

CSCvs29412

x509 SSH authentication incorrect UPN value selected

CSCvs30625

SRTP - RTP Crash on ASR with GCM Ciphers

CSCvs30865

rLFA for LDP causes loss of MPLS traffic after RSP switchover

CSCvs42498

NAT Alias not created for some configuration when using application redundancy

CSCvs45107

AnyConnect fails to reconnect when original session expires

CSCvs56255

Crash on BGP NSAP address-family when adding CLNS next-hop route-map

CSCvs56559

show crypto pki server shows wrong expire certificate date

CSCvs61652

Router crash upon receiving a BGP L3VPN route with a color extended community to be imported in EVPN

CSCvs66432

SISF installing target IP of an ARP request when sent with src 0.0.0.0

CSCvs68349

16.12.3 ZBFW- Firewall stats file for vmanage not generated for inspect/drop traffic

CSCvs70206

CUBE DNS cache clear should be limited only to the matched connection id

CSCvs74389

User cannot login in GUI if present in both local database and AAA server

CSCvs75505

Cisco IOS XE SD-WAN Software Command Injection Vulnerability

CSCvs75868

esg:destination overwhelmed messages are seen on sending high rate TCP traffic leading to iosd crash

CSCvs80225

RAR: RFC5578 does not work in 16.12 and later

CSCvs86218

Config save prompt on reload even after saving config when configured via ZTP

CSCvs91526

Memory leak present after BMP BGP server is enabled

CSCvs92848

Crash due to DHCP relay

CSCvs96344

ASR 1000 : OIR after clock set doesn't save the time in RTC(recommit of CSCvr27554)

CSCvt01186

Interface does down when "l2vpn xconnect" command is removed

CSCvt01532

SD-WAN router running 16.10.3 crashes with cpp_cp_svr fault

CSCvt02567

bgp crash @ bgp_db_ipstr2address when get bgp neighbor via bgp-oper yang

CSCvt04864

cpp_cp_svr fault and fman_fp_image fault on ASR 1002-X routers running 16.12.2r

CSCvt09354

Active RP running Polaris crash when standby running 3.X inserted

CSCvt10151

Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability UTD

CSCvt10462

BgpBackwardTransition was sent when peer device links up

CSCvt12245

16.12.3 ZBFW-Mismatch in firewall stats between the device and vmanage

CSCvt19472

ASR 1000 crash at SSS manager sss_info_get_next_elem()

CSCvt19873

ASR 1000:Router stops forwarding traffic with MPLS TE & FRR when member link of port-channel is shut

CSCvt21373

unexpected reload in CPP ucode forced by nat 514 .

CSCvt33018

MACsec 128/256 XPN on 40g/100g, stop passing traffic for one of AN and interface link flap seen

CSCvt33028

Part of double encapsulated frames dropped with TunnelDecapTooManyTimes code reason

CSCvt33799

Virtual address not reachable: "mac:0000:0c07:xxxx download to DP failed" for HSRP / VRRP over BDI.

CSCvt36887

ASR1002-HX crashing with IPSEC+QoS+DPI+FNF+NAT+ZBFW profile - half open list corrupted

CSCvt38466

SNMP TIMETICKS difference between sysUpTime vs ipslaEtherJAggStatsStartTimeId

CSCvt40021

Omp-tag is not being set via route-map configuration under bgp

CSCvt46779

Route export not working as desired during failover testing

CSCvt47898

Cisco 9800 reloads when processing AVC or FNF

CSCvt49705

Device Crash observed with NAT and once there is traffic from outside

CSCvt50461

cEdge crashes after the push of a template for Umbrella

CSCvt51433

Process sessmgrd crash due to clear radius sg-stats command.

CSCvt57181

Leaf sends packets to a wrong BVI MAC of ASR GOLF routers

CSCvt58616

L2VPN Crash @ Process = XC Mgr

CSCvt58858

Incorrect CEF programming for local SVI

CSCvt60979

1731: ODN Policy for Global prefix still UP even after withdrawing global routes

CSCvt65588

FlexVPN IKEv2 Tunnel route removed after establishing new IKEv2 SA to another peer

CSCvt70639

Device reload due to tunnel flapping

CSCvt85954

IWAN routers ISR4K unexpected reload multiple times

CSCvt89337

Incorrect Source IP when resolving DNS

CSCvt90424

CRC increasing on down int Te0/0/20

CSCvt94577

Incorrect CEF entry for LISP action signal-fwd

CSCvt98034

BGP communities: changes to route-map which sets BGP communities discards existing communities

CSCvu00069

CLI addition to tune MSRP timers

CSCvu11115

IOS-XE MTP Fails to Interwork DTMF RFC2833 from Payload 100 to Payload 101

CSCvu21761

RAR: PADG and PADC are not being consumed properly. PPPoE session statistics are not matching.

CSCvu22003

vManage FW dashboard doesn't show all matched applications

CSCvu34009

Calls going through T1 are rejected with "no dsps found" Analog/TDM Hairpin calls

CSCvu35345

AVB: msrp stream fails to re-establish after mcast addr change

CSCvu43248

%IP-4-DUPADDR: Duplicate address issue at NAT-HSRP ISR4k router

CSCvu52218

Router crashes frequently on NBAR

Open Bugs for Cisco IOS XE Gibraltar 16.12.4

All open bugs for this release are available in the Cisco Bug Search Tool through the Open Bug Search.

Caveat ID Number

Description

CSCuw75352

ASR 1000-lisp:Standby RP complains when eid-table removed from Active RP

CSCux68415

ASR 1000: lisp instance are not operational with vrf Deletion error

CSCvp60827

Delay of 30 sec while creating a new config file for phone using tftp.

CSCvq55323

Getting below error while pushing template:<bad-command>no license smart enable</bad-command>

CSCvq84990

Remove show ip/ipv6 access-list from syncfd-<ewlc-SIT>17.1-Observed Traceback followed by IOSD crash

CSCvq87541

Synchronization of running configuration failed to Netconf running datastore due to bfd min_rx

CSCvq95106

netconf <edit-config> merge is not working properly

CSCvr09310

vManage should be able to work with cEdge banners in the same way as with vEdges

CSCvr24434

yang missing for "ipv6 locator reachability minimum-mask-length 128 proxy-etr-only"

CSCvr28935

IOS crash in DHCPd Receive with Unnumbered interfaces

CSCvr91021

SESM Policy-Interface on ISG ignoring Radius Requests on port 1812

CSCvs61402

CFLOW_INSERT ABORT errors continue to increment

CSCvt00228

DDNS triggers a crash when an update is sent to delete an entry

CSCvt04814

CPP crash due to a long QoS Policy and Class name

CSCvt16988

Existing configuration on a cEdge could not be modified by a new template

CSCvt32383

ASR1000 RP2 upgrade fails from 16.9.4 to the 16.9.5

CSCvt50050

BGP next-hop is unexpectedly set to self in confederation scenario

CSCvt51568

Unexpected Reload due to Sessmgr

CSCvt64551

Crash when configuring eBGP

CSCvt68348

Unexpected reload when using "show radius server-group all" or "show aaa server"

CSCvt73592

missing/corrupt IOS-XE PKSC10 format

CSCvt76844

ASR1002-X ESP crash in multikey_hash_ager_tw_timer_to()

CSCvt79205

ASR1001-X: 'show environment' is no longer monitoring R0 voltage sensors

CSCvt82613

IOS-XE: ACL on Management Interface ignoring ICMP-Type information.

CSCvt89441

IOS-XE device crashed with CGD shared memory corruption freed by FMAN-FP

CSCvt98883

Cisco-IOS-XE-policy yang model incomplete support for match access-group

CSCvu01690

CPUHOGS produced while executing the command - client fireall access-list ?

CSCvu04665

CUBE keeps sending REINVITES to peer legs leading to high CPU and eventually crashes.

CSCvu08116

RP failed after show ip cef command was executed

CSCvu16200

Router May Crash When a SSH session is Closed After a TACACS Configuration Change (Part 2)

CSCvu20040

LTE module unresponsive after test cellular command.

CSCvu25765

EPC not working with netflow enabled.

CSCvu26585

"req plat software trace archive" faills with "STORAGE_TARGET: unbound variable Operation failed"

CSCvu27953

Crash due to a segmentation fault in the "IPsec background proc" process

CSCvu31425

DHCP Offer is going out on the same PMIP tunnel that received it.

CSCvu31813

ASR 1000 - valid Vendor Specific TLV dropped for invalid header length

CSCvu36476

memory corruption in IOMEM in polaris 16.11.1

CSCvu40093

Crash when tearing down a PPPoE client session

CSCvu42109

Traceback: Standby RSP3 reloads "HSCF Failed to sync private-config"

CSCvu47079

Memory leak in "VTEMPLATE bkgrnd" process leading to isis_delete_isisidb

CSCvu47707

ASR 1001-X in Partial Collection Failure

CSCvu52322

CBR8: do not drop malformed dhcp option 125 packets

CSCvu57372

ASR1000 - 16.9.4 - PLATFORM_INFRA-5-IOS_INTR_OVER_LIMIT +TB when sessions at scale

CSCvu57706

CUBE fails to send calls with below error after updating IOS to 16.9.5 Error (Resource busy)

CSCvu58791

RADIUS not sent for 802.1x

Related Documentation