Resolved Caveats Prior to WSG Release 4.4
The following caveats were resolved in WSG Release 4.3.3:
- CSCuq33231 — WSG fail to pick correct private key with two certificates with same SN
Description: IPsec SA creation fails in WSG with certificates.
WSG IPsec SA fails to pick correct private key when WSG has two certificates with the same subject name, but signed by two different rootCAs.
- CSCup74321 — SAMI wsg crashes due to health monitor failure
Description: Card might crash and reload itself with HM Datapath failure event.
The crash info file will be collected at LCP core: directory
Different packet type takes different processing time in the Lookup leading to packet reaching late to Resequencer ME. In case if the specific sequence number packet does reach the resequencer before it's buffers is filled up completely, it can cause the resequencer's threads to hang, leading to WSG crash due to HM failure. Resequencer ME is not robust enough to handle such situations.
- CSCtr31717 — To collect ixp core in case of PPC-IXP HM failures
Description: Whenever HM failure occurs, Core dumps are not being collected for the IXPs in the crash-info tar of LCP.
When “exception ixp <no>” is not present in the LCP configuration, core dumps are not being collected.
Workaround: Configure “exception ixp <no>” in the LCP
The following caveat was resolved in WSG Release 4.3.2:
- CSCuo78663 — DNS option support for DHCPv4
Description: WSG is not able to retrieve DNS server IP from DHCPv4 server.
While IPSec tunnel creation, FAP expects DNS IP from WSG. However, WSG is not able to retrieve DNS server IP from DHCPv4 server.
The following caveat was resolved in WSG Release 4.3.1:
- CSCuo64958 — WSG: Authentication failure seen due to certificate cache issue.
Description: When the AP has two different certs with the same subject name and tries to create two different tunnel with WSG, Authentication failure is seen.
The following caveats were resolved in WSG Release 4.3.0:
- CSCtc98394 — WSG S2S profile with overlapping traffic selectors : traffic path issue
Description: Packet drops in traffic of Site to Site tunnels with overlapping addresses in traffic selectors.
This condition occurs when overlapping traffic selector addresses are present on WSG configuration.
- CSCtu90531 — LCP: On Sysmgr crash, multiple cores are created in /var/tmp directory
Description: Session to LCP from SUP may not work at times showing the following message:
Error: context name (id:0) cannot be determined.
If the sysmgr cores in LCP, without this DDTS fix, core will not be copied to dir core: In LCP and sysmgr, core will not result in SAMI reload. Also, sysmgr will keep generating core files in /var/tmp directory leading to /var/tmp getting full.
- CSCum18161 — Address-pool config not getting activated after removing DHCP config
Description: Removed the DHCPv6 configs, de-activated and also removed from the profile, however, new address-pool config fails with the cause “Remove DHCP server configuration before adding address pools”.
When the DHCPv6 config is removed and the profile de-activated, configure the address-pool config and activate the profile. Profile should get activated.
- CSCun35470 — Not able to remove local address pool config on deactivating the profile
Description: Address pool configs cannot be removed even after de-activating the profile.
This condition is seen when an address pool is configured with an active profile. WSG wont allow un-configuring address pool when the profile is in active state.
- CSCun04001 — Removing validation for IP/IPv6 addresses to allow graceful upgrade
Description: WSG blocks user from configuring 0.0.0.0 as access-permit IP address
This condition occurs when user tries to configure 0.0.0.0 as access permit under any profile.
- CSCtj29848 — SME crash on LCP while trying to collect coredump
Description: During the unexpected reload of any of the SAMI processors possibly due to a software defect, the SAMI LCP attempts to collect debug information that will help determine the cause of the unexpected reload. On rare occasions, the LCP itself can undergo an unexpected reload during such information collection with the following error message:
%SAMI-2-SAMI_SYSLOG_CRIT: SAMI <CmdArg>slot<noCmdArg>/0: %SAMI-2-443001: System experienced fatal failure.Service name:sme(<CmdArg>pid<noCmdArg>) crashed, could not save last core,mv command failed, code 256,reloading system
- CSCuc65113 — LCP Sysmgr Crash Due To Proc Mem Info Corruption
Description: Core Dump File includes Proc Mem Info Details. LCP Sysmgr crashes due to Proc Memory Info Corruption.
The following caveats were resolved in WSG Release 4.2:
- CSCtz76617 — ipsec proc stuck 99% after "clear cry ips sa" then setup 16k tunnels
Description: In this scenario there are 16k and 8 k IPv6 tunnels on different profiles and VRF. When WSG initiated P2 re-keys fail due to TS lookup failure on any of the profile. The active WSG IpSec process hangs after 99% completion, after execution of clear cry ips sa – command. Then it again initiates the set-up of 16 k IPv6-VRF tunnels for both profiles. It also requires to load both the active as well as stand-by WSG for recovery.
- CSCtn16495 — Bad result when snmp getnext queries two/more OIDs from ipAddressTable
Description: This issue is observed when a single SNMP getnext request tries to query two objects from the ipAddress Table. The OID of the second result is incorrect in most cases. This issue is observed only when there are more than two queries in a single getnext request.
Workaround: Whenever the SNMP getnext is used, the request should be split into single OID queries.
The following caveats were resolved in WSG Release 4.0.3:
- CSCsy93899—Small Number of IPSec Tunnels are Deleted After a Phase-2 Re-key
After a phase-2 re-key, a small number of IPSec tunnels (approx. 10-20) may be deleted.
This has been seen with large number of tunnels (8500 tunnels on each PPC) established at a high rate and the lifetime was set to a short value in an engineering environment.
- CSCud46630—Deleting a root certificate does not remove it from the WSG database
Description: After removing a root certificate from the WSG configuration, the removal appears to be successful. However, the root certificate is not deleted from the WSG database.
– Attempting to remove a root certificate while crypto profiles are active.
– Attempting to update an existing root certificate while crypto profiles are active.
Workaround: Deactivate all crypto profiles when deleting or modifying root certificates.
- CSCtx84326—Removal of BGP related config off WSG may result in abnormal SAMI reload
Description: With a BGP related configuration for the WSG Reverse Route Injection (RRI) feature, the removal of the BGP configuration off the WSG may result in an abnormal SAMI reload.
Workaround: Block the BGP neighbors from sending any routes to the WSG. Remove the BGP neighbor configurations one by one before removing the BGP configuration.
- CSCty03287—WSG returns incorrect values for Enhanced-Ipsec-Flow SNMP MIB objects
Description: This occurs if a SNMP getnext is the first operation performed on the objects after the tunnel is established.
Workaround: Do not perform getnext immediately after establishing the tunnel. If the getnext operation is the first one performed, the returned values will be correct after the tunnel has been established for at least 15 minutes.
- CSCtx87552—BGP peer session stuck in “Clearing” state
Description: This occurs after connectivity is lost with the BGP neighbor for more than 3 minutes.
Workaround: Remove and re-add the BGP neighbor configuration.
- CSCts72607—Tunnels torn down after copy start run
Description: Normally, the “copy start run” command is used at the beginning of setup. In a case where the user used this command after the tunnels were created, we observed all of the tunnels were torn down (e.g. the start and running configurations were the same). This bug was filed to find a way to avoid it.
- CSCts80965—SNMP walk on some global stats does not show correct value
Description: The values returned by snmpwalk on ceipSecGlobalStats and some cikeGlobalStats objects are not accumulated across all PPCs.
- CSCth84463—HA: snmpwalk on CISCO-ENHANCED-IPSEC-FLOW-MIB stops abruptly on switchover
Snmpwalk on CISCO-ENHANCED-IPSEC-FLOW-MIB stops.
The HA switchover occurs during the snmpwalk.
Workaround: Re-run the snmpwalk after the switchover is complete. The required statistics are not available immediately after the switchover.
- CSCua56545—Crypto debugs trigger process restart depending on configured timezone
Description: Output from crypto debugs is displayed incorrectly. SAMI resets after enabling crypto debugs and debug messages are displayed. WSG is configured with a timezone consisting of at least four characters.
Workaround: Ensure that the configured timezone is less than four characters.
The following caveats were resolved in WSG Release 3.0:
- CSCtg36835—Assertion on Attempting ssh-compliant INITIALIZE
The CMP initialize command returns error when executed.
This occurs when the access method (as indicated in the URL) to the CA server is TCP.
Workaround: Use the HTTP access method (http://...) in the CMP initialize command to communicate with the CA server.
- CSCtg65867—snmpd on Secondary PPC Gets Stuck
sh run in entity-all fails on one or another secondary PPC. snmpd does not respond to configuration request and times out with SAPS-->28 error.
This condition occurs when you execute snmpwalk on UDP-MIB in continuos loop with sleep 200 secs in between two successive iterations. In entity-all mode execute the show running-config command. snmpd on one or more secondary PPCs timeouts with SAPS-->28 error.
Workaround: On the bash shell of the secondary that got stuck, issue killall -9 snmpd command. This causes snmpd to re-spawn again.
- CSCth53865—HA: WSG Deletes Tunnels After Switchover
The WSG deletes tunnels after an HA switchover.
This conditions rarely occurs when there are 100,000 remote-access tunnels established. With 100,000 tunnels established, 12 were deleted.
- CSCth86683—snmpwalk, snmpget Misses Data From Secondary Periodically
SNMP walk may periodically fail to poll MIB instances/elements on secondary WSGs.
SNMP walk fails to poll data from secondary WSG/PPC periodically. This situation occurs when CPU utilization on primary WSG increases considerably. However, the CPU utilization on secondary WSG always remain normal. High CPU utilization situation remains for very brief time period. The whole issue is not observed on tunnels established on primary WSG.
- CSCti00586—HA: StandbyWSG Cannot Recover From Failed SA Import
In the rare instance where a tunnel is not fully imported on the standby card, the standby cannot recover the tunnel from this issue.
To see if the standby card has a tunnel in this state, issue the show crypto isakmp summary command and show crypto ha db info command. This will show if a tunnel count mismatch has occurred.
Workaround: Reboot the standby card to force a new sync of the tunnels.
- CSCti06262—HA: snmpd Process Crashed on Active/SAMI Module
Observed SNMP crashinfo on SUP related to primary WSG/PPC3.
This condition occurred when we configured an SNMP related configuration on primary WSG/PPC. Leave these commands configured on the primary WSG for overnight tests. You may observe SNMP crashinfo files (on SUP disk0) due to SNMP process crash and re-initialization.
- CSCtd27881—Site-to-Site IKEv2 Phase 2 Rekey Does Not Happen For All Child SAs
WSG Initiated IKEv2 Phase 2 rekey happens only for one child SA.
IKE SA with multiple child IPSec SAs, with Phase 2 rekeys initiated by WSG (client Phase 2 rekey lifetime > the Phase 2 lifetime configured on WSG).
Workaround: Initiate rekeys from the client side (configure client Phase 2 rekey lifetime < WSG Phase 2 lifetime).
- CSCtd82379—Source Port Field is Not Updated Under show crypto ipsec sa remote-ip Display
The UDP source port is not correctly displayed using the show crypto ipsec sa remote-ip command.
This problem occurs under the following conditions:
– IPSec tunnel is established via a device performing PAT.
– A condition triggers a source port change (for example, a timeout).
Workaround: Use the show crypto isakmp sa command to display the UDP source port.
- CSCtd87234—ipsecpm Process Failed With auto-initiate and rsa-sig authentication
The ipsecpm process failed after tunnel failure with auto-initiate.
The ipsecpm failure is observed with the following conditions:
– authentication rsa-sig
– IKE ID for the remote peer does not match the DN, and Certificate does not include a subjectALtName extension.
Workaround: Configure the remote peer to use DN as the ID.
- CSCte17787—Authentication failed sometimes with more than one trustpoint configured
Authentication sometimes fails when there is more than one trust point configured.
If you have two trust points configured, two entries of get certificate request in IKE_SA_INIT all point to the certificate in the first trust point.
Workaround: One trust point works.
The following caveat was resolved in WSG Release 2.2.2:
- CSCtr15452—Tunnel creation fails, "No Certificate Found Anywhere" is logged on WSG
Description: IPSec tunnel establishment fails when certificate based authentication is used. The messages "Certificate Path Construction Failed" or "No Certificate Found Anywhere" appear in the WSG event log. This symptom occurs when the certificates in use have an entry for "CAIssuers" in the AIA extension.
Workaround: Use certificates that do not use “CAIssuers” in the AIA extension.
The following caveats were resolved in WSG Release 2.2.1:
- CSCtq87296—WSG sends DHCP release prematurely under certain conditions
Description: The WSG sends DHCP release prematurely under certain conditions:
1. Access Point reboot on an existing IPSec tunnel.
2. The reboot cycle occurs before the WSG can delete the IPSec tunnel via dead-peer-detection.
The WSG sends the DHCP release when the old tunnel is deleted.
Workaround: The client IP address is re-assigned via DHCP when the IKE SA is rekeyed, provided
the address is still available. Otherwise, the tunnel is torn down, requiring re-establishment by the Access Point.
- CSCtq89837—WSG allows tunnels to be established with remote peer ID not matching the ID in the remote peer certificate
Description: WSG allows tunnels to be established with remote peer ID not matching the ID in the remote peer certificate. This issue is seen in 2.X images.
The following caveats were resolved in WSG Release 1.2:
- CSCta55527—show crypto isakmp summary IKE Error Counters do not Increment Though SA's Deleted
Description: Some tunnels are deleted by WSG. The corresponding IKE error counters do not show any errors.
This happens in multiple circumstances:
1. Immediately after a large number of tunnel creation (For example, when creating tunnels at 90 tunnels per second).
2. If the client does not respond to the INFORMATIONAL messages (and probably the IKE timeout happens).
- CSCtb18406—Snmpwalk Returned 0 For All Tunnel Instance Statistics
Description: The snmpwalk utility returns zero values for all instance statistics (per tunnel in/out packets and octets) for the cisco-enhanced-ipsec-flow-mib table.
Workaround: Use the snmpget utility to see valid statistics for each specific instance.
- CSCtb30242—Syslogd crashinfo File Created After SAMI Reset
Description: Crashinfo files for syslogd are created and saved to the SUP. No other problems are observed with syslog after the SAMI comes up. The files are saved to the SUP after the SAMI is reset. This could occur after upgrading the software image (a reset is required to complete the upgrade), or simply resetting the SAMI.
- CSCub92784—Allow CA root certificates to be added without profile activation
Description: Adding new trustpoint (i.e. root) certificates to the WSG configuration requires deactivation of all crypto profiles. Additional root certificates are required when tunnels are already established.
- CSCua97225—Unable to configure multiple TS in remote access profiles
Description: Multiple access-permit statements cannot be configured in remote access crypto profiles.
- CSCub75654—Multiple TS information is not displayed under show crypto ipsec sa
Description: The show crypto ipsec sa command does not display all of the traffic selector information. Only the first traffic selector data is displayed. Occurs when:
– Remote access crypto profile configuration on WSG.
– Remote access tunnels are established using multiple traffic selectors.
- CSCub43861—Configuring the remote secret requires profile deactivation
Description: Attempting to configure the remote secret results in the message, “Configuration failed in ipsecpm.” Occurs when the user attempts to configure the remote secret parameter while a crypto profile is active.
Workaround: Deactivate all profiles prior to configuring the remote secret.
- CSCty02108—Wrong next-hop mac-address on standby
Description: Traffic lost on a particular WSG or the show arp command displays the wrong MAC address. Occurs when HSRP WSG active/standby is configured.
Workaround: Reload the WSG exhibiting this problem.
- CSCtz71369—asciiPending SAP->611 wipes out WSG config
Description: WSG has no configuration after a reboot. The startup configuration is corrupted. Occurs after these steps:
– An error condition such as SAP->611 is encountered which prints an error message into the running configuration when it is displayed using the show running-configuration command.
– User saves the running configuration.
– A WSG reboot occurs.
Workaround: If an error message is displayed during the execution of the show running-configuration command, do not save the running configuration.
- CSCub32115—Standby WSG usurps the primary MAC address
Description: The standby WSG will sporadically usurp the MAC address of the active WSG and announce itself causing ARP resolution to fail. This issue can also cause a failure to pass traffic on newly added routes. This issue is seen intermittently in a redundant HA setup when there is no traffic for a period longer than 5 minutes.
Workaround: Configure mac mac-address table timeout to 4 hours on the appropriate VLAN. Adding new routes requires a WSG reload to take effect.
- CSCtz92610—WSG is dropping all traffic in IXP due to wrong HA bit
Description: ESP packets are dropped on the WSG. This issue occurs when the VLAN currently configured on a PPC was previously configured on a lower numbered PCC, and the SAMI was not reset since that last configuration change. The information pertaining to the previously configured VLAN is not removed from memory when the configuration changes.
Workaround: Reload the SAMI.
- CSCuc45124—Traffic fails on tunnel after IPSec SA rekey on a neighboring PPC
Description: Traffic fails on an IPSec tunnel. The tunnel does not pass traffic until a subsequent IPSec SA (phase-2) rekey occurs on the same tunnel.
– Remote access tunnels are terminated on WSG.
– Tunnels are terminated on two adjacent PPCs (e.g. 3 and 4, or 7 and 8).
– Multiple traffic selectors are configured or negotiated for the tunnels terminating on the higher numbered PPC.
– A phase-2 rekey occurs on a tunnel terminating on the higher numbered PPC. This triggers the traffic loss on a tunnel terminating on the lower numbered PPC.
Workaround: If remote-access tunnels with multiple traffic selectors are needed, do not terminate tunnels on an adjacent, lower numbered PPC.
- CSCub82872—WSG infra should send the appropriate msg when tearing the PPC VLAN down
Description: Traffic does not pass through the WSG even though the IPSec tunnel is successfully established. This issue has been observed after configuration changes to VLAN interfaces on different WSG instances (i.e. PPCs) on the same SAMI. Typically, the VLANs are reused but moved to interfaces on different WSG instances.
Workaround: Reload the SAMI.
- CSCsq81533—System Manager (core-server) crash - incorrect reloading system syslog
Description: The following message may appear in the system log. However, the system does not reload:
Jun 9 2008 00:53:01: %ACE-2-443001: System experienced fatal failure.Service name:System Manager (core-server)(30822) has terminated on receiving signal 11,reloading system
This process is not supposed to initiate a system reset. It is spawned upon demand and will be re-created as necessary.