Release Notes for Cisco Catalyst 8500 Series Edge Platforms, Release 26.1.x

Software Reliability

Post Quantum Crypto for IKEv2, SSH and MACsec

Post-Quantum Cryptography (PQC) refers to cryptographic algorithms designed to be secure against attacks from quantum computers which can break many classical encryption methods. Post-Quantum Cryptography is implemented by using the algorithms available as part of Module-lattice based Cryptography. Cisco utilizes a hybrid approach to implement PQC. The hybrid approach to Post-Quantum Cryptography (PQC) combines a quantum-resistant algorithm, such as the module-lattice based ML-KEM (e.g., mlkem768), with a classical elliptic curve key exchange algorithm like NIST P-256 or X25519, along with a hash function such as SHA-256.

Ease of Use

BGP Advertisement Startup Delay

The BGP Advertisement Startup Delay feature addresses this issue by introducing a configurable delay before BGP begins advertising routes to its neighbors. This delay allows

sufficient time for routes to be installed in the hardware, ensuring traffic forwarding is ready before new routes are announced.

Security

Resilient Infrastructure

Starting with the Cisco IOS XE 26.1 release and in future releases, Cisco software will display warning messages when configuring features or protocols that do not provide sufficient security such as those transmitting sensitive data without encryption or using outdated encryption mechanisms. Warnings will also appear when security best practices are not followed, along with suggestions for secure alternatives.

This list is subject to change, but the following is a list of features and protocols that are planned to generate warnings in releases beyond the version Cisco IOS XE 17.18.1. Release notes for each release will describe exact changes for that release:

●     Plain-text and weak credential storage: Type 0 (plain text), 5 (MD5), or 7 (Vigenère cipher) in configuration files.

Recommendation: Use Type 6 (AES) for reversible credentials, and Type 8 (PBKDF2-SHA-256) or Type 9 (Scrypt) for non-reversible credentials.

●     SSHv1  

Recommendation: Use SSHv2.

●     SNMPv1 and SNMPv2, or SNMPv3 without authentication and encryption

Recommendation: Use SNMPv3 with authentication and encryption (authPriv).

●     MD5 (authentication) and 3DES (encryption) in SNMPv3   

Recommendation: Use SHA1 or, preferably, SHA2 for authentication, and AES for encryption.

●     IP source routing based on IP header options

Recommendation: Do not use this legacy feature.

●     TLS 1.0 and TLS 1.1   

Recommendation: Use TLS 1.2 or later.

●     TLS ciphers using SHA1 for digital signatures

Recommendation: Use ciphers with SHA256 or stronger digital signatures.

●     HTTP  

Recommendation: Use HTTPS.

●     Telnet  

Recommendation: Use SSH for remote access.

●     FTP and TFTP  

Recommendation: Use SFTP or HTTPS for file transfers.

●     On-Demand Routing (ODR)  

Recommendation: Use a standard routing protocol in place of CDP-based routing information exchange.

●     BootP server

Recommendation: Use DHCP or secure boot features such as Secure ZTP.

●     TCP and UDP small servers (echo, chargen, discard, daytime)  

Recommendation: Do not use these services on network devices.

●     IP finger  

Recommendation: Do not use this protocol on network devices.

●     NTP control messages  

Recommendation: Do not use this feature.

●     TACACS+ using pre-shared keys and MD5

Recommendation: Use TACACS+ over TLS 1.3, introduced in release Cisco IOS XE 17.18.1

Ease of use

One minute granularity interface statistics using Cisco Catalyst SD-WAN Manager

This feature enables the collection of granular interface statistics from devices every minute, providing real-time insights for effective troubleshooting and ensuring optimal performance.

Licensing Process

Enhancements for NGFW in Policy Groups

This feature introduces support for NGFW Policy Groups, that includes import and export of firewall policies, display of rule hit counts, drag-and-drop rule reordering to update priority, visibility of policy and object usage references in the NGFW Dashboard, and retention of rule and policy names in the running CLI configuration.

Bug ID

Headline

CSCws40263

uCode Crash due to Stuck Thread during NAT Session DB Walk

CSCwr30573

TLOC Extension unable to program due to module boot up timing

CSCws89172

Crash @cft_engine_handle_vrf_associate_if_needed on C8500 platform with IPv6 traffic

CSCwr11064

Speed test session Timeout not clear enough for user to get details

CSCwq77458

fman crash after fnf config changes

CSCwr00088

Add CLI to change per MPLS label CEF statistics query interval on FMAN FP

CSCwr06399

Certificate verify fails & id cert not installed (after reload of device), of certs with EC Key 521

CSCwr08462

[C8500L-8S4X] There seems to be an issue where the NAT router is not responding to ARP requests

CSCws62501

IOSd crash with "match authen-status unauthenticated" configured

CSCwr44921

SDWAN C-Edge Router Crashes - CPU Usage due to Memory Pressure exceeds threshold

CSCwo91087

DWDM-SFP10G-C SFP is not working when connecting C8500L-8S4X through a MUX

CSCwq43883

Converting L2 Routed port channel to L3 is broken in Aurora2

CSCwq98154

[XE MCAST] Multicast traffic not forwarded over P2P DMVPN phase 1 tunnel

Bug ID

Headline

CSCws66553

fpmd crash seen with 17.12.6B respin image with longer soak + clear sdwan omp events

CSCwt22006

Web UI bootstrapping failure due to invalid configuration causes persistent config merge errors despite subsequent corrections

CSCwt07572

Radius packet silently consumed by utd

CSCwt22873

High QFP Caused by "all-host" Limit in - Carrier Grade NAT mode

CSCwt28048

Preferred-color-group restrict is not honored in data policy

CSCws99246

Regarding the operation enabling communication from outside the NAT

CSCwt27474

20.18.2 Cisco SPA:The hardcoding of the AS number 64512 needs to be removed and changed to autodetect

CSCwt18839

Segmentation Fault in cpp_cp_svr while Printing FIA Trace Data

CSCws95387

PCG config is not getting deleted from FP

CSCwr76176

BFD SD-WAN PMTUD: PMTU Converges Unexpectedly to 970 Bytes After dbg2:1 Event

CSCws98086

Update "reason for state change: MAX" in BFD Syslog

CSCwq00263

ipv6 ipsec packets dropped in svti AH in transport mode - ping failed with specific size packet

C8500-12X4QC and C8500–12X

16 GB(default)

17.2(1r)

17.11(1r)

32GB

17.2(1r)

17.11(1r)

64GB

17.3(2r)

17.11(1r)

C8500-20X6C

All variants

17.10(1r)

17.15(1r)

Note: Downgrading to a ROMmon version lower than 17.15(1r) is not supported.

C8500L-8S4X

-

17.10(1r)

17.14(1r)*

Note:

This version of ROMmon is only available with Cisco IOS XE 17.15.1a onwards.

17.3(1r)

Supports 64GB DRAM for C8500-12X4QC & C8500-12X

17.10 (1r)

Added support for new platform C8500-20X6C

17.14(1r)

CSCwf98337 - Evaluation of C8500L-8S4X for Intel 2023.3 IPU and SMRAM vulnerabilities.

CSCwe21026 - Evaluation of C8500L-8S4X for Intel 2023.1 IPU and SMM vulnerabilities.

17.15(1r)

CSCwf98335 - Evaluation of all_routing_iosxe for Intel 2023.3 IPU and SMRAM vulnerabilities.

CSCwd96405 - ASR1k:BL and ML hashes not seen in the "Show system intergrity" CLI for Aikido based platforms. Additional minor fixes.