Release Notes for Cisco 8200 Series Secure Routers, Release 17.18.x
Available Languages
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
- US/Canada 800-553-2447
- Worldwide Support Phone Numbers
- All Tools
Feedback
Feedback
Cisco 8200 Series Secure Routers, Release 17.18.x
Cisco 8200 Series Secure Routers, Release 17.18.x
Cisco IOS XE 17.18.1a is the first release for the Cisco 8200 Series Secure Routers in the Cisco IOS XE 17.18.x release series.
Cisco 8200 Series Secure Routers deliver secure networking simplified. Powered by the all-new secure networking processor and the unified Cisco secure networking platform, Cisco 8200 Series Secure Routers deliver robust, platform-level security, advanced performance engineering via routing and SD-WAN, and on-premises, infrastructure-as-code, or cloud management flexibility that enables businesses to seamlessly scale and grow. Each class of secure routers is designed to deliver risk reduction, enhanced reliability, and future readiness.
For information on the hardware features supported on the Cisco 8200 Series Secure Routers, refer to the Cisco 8200 Series Secure Routers datasheet.
This section provides a brief description of the new hardware features introduced in this release.
New hardware features for Cisco IOS XE 17.18.1a
Table 1. New hardware features for Cisco 8200 Series Secure Routers, Release 17.18.1a
| Feature |
Description |
| Cisco 8200 Series Secure Routers |
From Cisco IOS XE17.18.1a, Cisco 8200 Series Secure Routers are available in these models: ◦ C8231-G2 ◦ C8235-G2 ◦ C8231-E-G2 ◦ C8235-E-G2 |
This section provides a brief description of the new software features introduced in this release.
New software features in Cisco IOS XE 17.18.2
Table 2. New hardware features for Cisco 8200 Series Secure Routers, Release 17.18.2
| Product impact |
Feature |
Description |
| Security |
Starting with the Cisco IOS XE 17.18.2 release and in future releases, Cisco software will display warning messages when configuring features or protocols that do not provide sufficient security such as those transmitting sensitive data without encryption or using outdated encryption mechanisms. Warnings will also appear when security best practices are not followed, along with suggestions for secure alternatives. This list is subject to change, but the following is a list of features and protocols that are planned to generate warnings in releases beyond the version Cisco IOS XE 17.18.1. Release notes for each release will describe exact changes for that release: ● Plain-text and weak credential storage: Type 0 (plain text), 5 (MD5), or 7 (Vigenère cipher) in configuration files. Recommendation: Use Type 6 (AES) for reversible credentials, and Type 8 (PBKDF2-SHA-256) or Type 9 (Scrypt) for non-reversible credentials. ● SSHv1 Recommendation: Use SSHv2. ● SNMPv1 and SNMPv2, or SNMPv3 without authentication and encryption Recommendation: Use SNMPv3 with authentication and encryption (authPriv). ● MD5 (authentication) and 3DES (encryption) in SNMPv3 Recommendation: Use SHA1 or, preferably, SHA2 for authentication, and AES for encryption. ● IP source routing based on IP header options Recommendation: Do not use this legacy feature. ● TLS 1.0 and TLS 1.1 Recommendation: Use TLS 1.2 or later. ● TLS ciphers using SHA1 for digital signatures Recommendation: Use ciphers with SHA256 or stronger digital signatures. ● HTTP Recommendation: Use HTTPS. ● Telnet Recommendation: Use SSH for remote access. ● FTP and TFTP Recommendation: Use SFTP or HTTPS for file transfers. ● On-Demand Routing (ODR) Recommendation: Use a standard routing protocol in place of CDP-based routing information exchange. ● BootP server Recommendation: Use DHCP or secure boot features such as Secure ZTP. ● TCP and UDP small servers (echo, chargen, discard, daytime) Recommendation: Do not use these services on network devices. ● IP finger Recommendation: Do not use this protocol on network devices. ● NTP control messages Recommendation: Do not use this feature. ● TACACS+ using pre-shared keys and MD5 Recommendation: Use TACACS+ over TLS 1.3, introduced in release Cisco IOS XE 17.18.1 |
|
| Ease of Setup
|
From Cisco IOS XE 17.18.2, you can configure IPv6 data prefix lists, rule with rule sets, and object groups in security policy using Cisco SD-WAN Manager. |
|
| Upgrade |
IPv6 GRE-TP tunnel as protected link support for SRv6 TI-LFA with IS-IS |
From Cisco IOS XE 17.18.2, this feature extends IPv6 GRE-TP tunnel as protected link support for SRv6 TILFA with ISIS. |
| Upgrade |
IPv4 GRE-TP tunnel as protected link support for SR-MPLS TI-LFA with OSPFv2 |
From Cisco IOS XE 17.18.2 this feature extends IPv4 GRE-TP tunnel as protected link support for SR-MPLS TILFA with OSPFv2. |
| Upgrade |
IPv4 GRE-TP tunnel as protected link support for SR-MPLS TI-LFA with IS-IS |
From Cisco IOS XE 17.18.2 this feature extends IPv4 GRE-TP tunnel as protected link support for SR-MPLS TILFA with ISIS. |
| Ease of use |
Configure vDSP to enable voice processing functions such as transcoding, conferencing and hardware media termination point services. |
New software features for Cisco IOS XE 17.18.1a
Table 3. New software features for Cisco 8200 Series Secure Routers, Release 17.18.1a
| Product impact |
Feature |
Description |
| Licensing Process
|
Cisco 8200 Series Secure Routers supports platform-based licensing, a way of grouping licenses and devices based on platform-classes. A platform class is a hierarchical categorization based on the product family and place in the network. In this platform-based licensing model, Essentials and Advantage licenses are available. License portability is supported across devices within the same platform class and usage of the same license across different modes is also possible. |
|
| Ease of Use |
From Cisco IOS XE 17.18.1a, you can identify potential tampering on the Cisco 8200 Series Secure routers by using the platform tamper detection command in config mode. |
Resolved issues
This table lists the resolved issues in this specific software release.
Note: This software release may contain open bugs first identified in other releases. To see additional information, click the bug ID to access the Cisco Bug Search Tool. To search for a documented Cisco product issue, type in the browser: <bug_number> site:cisco.com.
Resolved issues in Cisco IOS XE 17.18.2
Table 4. Resolved issues for Cisco 8200 Series Secure Routers, Release 17.18.2
| Bug ID |
Description |
| Device On-Demand Tunnels do not expire when UMTS is enabled. |
|
| NAT64 static entry removed when command to delete non-existent entry is applied. |
|
| Device may boot up into prev_packages.conf due to power outage. |
|
| NWPI not capturing self-generated syslog traffic. |
|
| Device crash when removing SGT caching on an interface. |
|
| Device sending a 2 Byte packet of FLOW_SAMPLER_RANDOM_INTERVAL instead of a 4-Byte packet. |
|
| After upgrade to earlier releases sd-wan service-tracker in vrf selects source IP address from GRT when MPLS Inter-AS VPN option B configured. |
|
| Device exporters with ETA enabled are generating invalid template data errors in SNA. |
|
| EPBR set interface action get missing after reboot. |
|
| Device crash when initializing DNS channels. |
Resolved issues in Cisco IOS XE 17.18.1a
There are no customer impacting bugs that were fixed in this release.
This table lists the open issues in this specific software release.
Note: This software release may contain open bugs first identified in other releases. To see additional information, click the bug ID to access the Cisco Bug Search Tool. To search for a documented Cisco product issue, type in the browser: <bug_number> site:cisco.com.
Open issues in Cisco IOS XE 17.18.2
Table 5. Open issues for Cisco 8200 Series Secure Routers, Release 17.18.2
| Bug ID |
Description |
| Device ignore the keepalive command under the SIG tunnel interface pushed by the vmanage. |
|
| Incorrect NAT translation from service-vrf to global for self-generated ICMP 11 (Time Exceeded) packets. |
|
| fman crash after fnf config changes. |
|
| Device not able to onboard sd-routing devices using generic bootstrap file stored in USB. |
|
| Device port forward issue with multiple ISP. |
|
| Out of sync when CLI Template was attached (missing element: authentication in /ios:native/ios:line/ios:vty[ios:first='0']/ios:login/ios:authentication). |
|
| Strange behavior with the Cisco Umbrella SIG tunnels configured from vManage to Umbrella. |
|
| TLOC Extension unable to program due to module boot up timing. |
|
| Cipher Suites TLS 1.2 for control connections. |
|
| Device crashes when configuring SSL VPN with Policy-Based Routing (PBR) and NAT. |
|
| There seems to be an issue where the NAT router is not responding to ARP requests. |
|
| Device Crashes - CPU Usage due to Memory Pressure exceeds threshold. |
|
| Slow performance on Netconf RPC on stateless static NAT translation. |
|
| FIB table routes: Next Hop (NH) ID 0 is getting corrupted and assigned to a value other than Blackhole. |
|
| dmiauthd process crashes, due to which the configuration does not sync between startup-config and the running-config. |
|
| Traceback seen when detaching the CN railways customer configs. |
|
| Control Connection to vManage is only Attempted over Highest Priority TLOC. |
|
| Add CLI to change per MPLS label CEF statistics query interval on FMAN FP. |
|
| Device experienced Critical process ompd fault on rp_0_0. |
|
| Device crash in TDM-TDM call when debug voip fpi enabled. |
|
| Multicast traffic not forwarded over P2P DMVPN phase 1 tunnel. |
|
| BFD sessions flapping and not recovering - SYMNAT port not updating to data-plane. |
|
| Periodic Service Restart May Generate Crash Files. |
|
| Unexpected reload on ftmd SDWAN device. |
|
| Device experiences an unexpected reboot due to NAT in the data-plane after a policy push. |
|
| Flapping nat will casue bfd session down with ipsec session shown. |
|
| PMTU Converges Unexpectedly to 970 Bytes After dbg2:1 Event. |
|
| Device crashed in crypto library. |
Open issues in Cisco IOS XE 17.18.1a
Table 6. Open issues for Cisco 8200 Series Secure Routers, Release 17.18.1a
| Bug ID |
Description |
| Device: bfd may be flapping when save configuration with write cmd. |
|
| ipv6 ipsec tunnel, ping failed with specific size. |
|
| Counters are cleared after shut/no shut gi0 interface. |
|
| selinux: vmanage failed to factory reset device caused by selinux deny. |
|
| Device: POE module insert time incorrect if reloading with future time and then sync back to correct time source. |
|
| Crash Encountered During PIM Swap quickly on device. |
ROMMON compatibility matrix
The table lists the ROMMON releases supported in Cisco IOS XE 17.18.x releases.
| Platforms |
Cisco IOS XE Release |
Minimum ROMMON Release supported for IOS XE |
Recommended ROMMON Release supported for IOS XE |
| C8231-G2 |
17.18.1a |
17.18(1.5r).s1.cp |
Not applicable |
| C8235-G2 |
17.18.1a |
17.18(1.5r).s1.cp |
Not applicable |
| C8231-E-G2 |
17.18.1a |
17.18(1.12r).s1.cp |
Not applicable |
| C8235-E-G2 |
17.18.1a |
17.18(1.12r).s1.cp |
Not applicable |
● Hardware Installation Guide for Cisco 8200 Series Secure routers
● Cisco 8000 Series Secure Routers Licensing
● Cisco 8200 Series Secure Routers Software Configuration Guide
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2025 Cisco Systems, Inc. All rights reserved.