Release Notes for Cisco IOS Release 15.0SY for Supervisor Engine 2T-10GE

---

---

---

---

Supervisor Engine 2T-10GE

---

Note For information about DRAM requirements on all supervisor engines, see this publication:

http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/qa_c67_457347.html

 

 

Features

• One of these policy feature cards:

– Policy Feature Card 4XL (PFC4XL).

– Policy Feature Card 4 (PFC4).

See the “Policy Feature Cards” section.

• Supports 2-Tbps switch fabric connectivity.
• 2-GB DRAM.
• Internal 1-GB bootflash (bootdisk:).
• One external slot:

– disk0:

– For CompactFlash Type II flash PC cards sold by Cisco Systems, Inc., for use in Supervisor Engine 2T-10GE.

• Console ports:

– EIA/TIA-232 (RS-232) port

– USB port

• Ports 1, 2, and 3:

– QoS architecture: 2q4t / 1p3q4t

– Ports 1, 2, and 3: Gigabit Ethernet SFP (fiber or 1000 Mbps RJ-45)

• Ports 4 and 5:

– Support for 10-Gigabit Ethernet X2 tranceivers

– QoS architecture:

• With ports 1, 2, and 3 enabled: 2q4t / 1p3q4t

• With ports 1, 2, and 3 disabled: 8q4t / 1p7q4t

• One port group: ports 1 through 5

---

Note See the Supervisor Engine 2T-10GE Connectivity Management Processor Configuration Guide for information about the 10/100/1000 Mbps RJ-45 port.

• Connectivity Management Processor (CMP)—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/cmp_configuration/guide/sup2T_10GEcmp.html

Supervisor Engine 2T-10GE Restrictions

• The 1-Gigabit Ethernet ports and the 10-Gigabit Ethernet ports have the same QoS port architecture (2q4t / 1p3q4t) unless you disable the 1-Gigabit Ethernet ports with the platform qos 10g-only global configuration command. With the 1-Gigabit Ethernet ports disabled, the QoS port architecture of the 10-Gigabit Ethernet ports is 8q4t / 1p7q4t.
• In RPR redundancy mode, the ports on a Supervisor Engine 2T-10GE in standby mode are disabled.

Policy Feature Cards

• Policy Feature Card Guidelines and Restrictions
• Policy Feature Card 4XL
• Policy Feature Card 4

Policy Feature Card Guidelines and Restrictions

• The PFC4 supports a theoretical maximum of 131,072 (128K) MAC addresses with 118,000 (115.2K) MAC addresses as the recommended maximum.
• The PFC4 partitions the hardware FIB table to route IPv4 unicast, IPv4 multicast, MPLS, and IPv6 unicast and multicast traffic in hardware. Traffic for routes that do not have entries in the hardware FIB table are processed by the route processor in software.

The defaults for XL mode are:

– IPv4 unicast and MPLS: 512,000 routes

– IPv4 multicast and IPv6 unicast and multicast: 256,000 routes

The defaults for Non-XL mode are:

– IPv4 unicast and MPLS: 192,000 routes

– IPv4 multicast and IPv6 unicast and multicast: 32,000 routes

---

Note The size of the global internet routing table plus any local routes might exceed the non-XL mode default partition sizes.

These are the theoretical maximum numbers of routes for the supported protocols (the maximums are not supported simultaneously):

– XL mode :

• IPv4 and MPLS: Up to 1,007,000 routes

• IPv4 multicast and IPv6 unicast and multicast: Up to 503,000 routes

– Non-XL mode :

• IPv4 and MPLS: Up to 239,000 routes

• IPv4 multicast and IPv6 unicast and multicast: Up to 119,000 routes

Enter the platform cef maximum-routes command to repartition the hardware FIB table. IPv4 unicast and MPLS require one hardware FIB table entry per route. IPv4 multicast and IPv6 unicast and multicast require two hardware FIB table entries per route. Changing the partition for one protocol makes corresponding changes in the partitions of the other protocols. You must enter the reload command to put configuration changes made with the platform cef maximum-routes command into effect.

---

Note With a non-XL-mode system, if your requirements cannot be met by repartitioning the hardware FIB table, upgrade components as necessary to operate in XL mode.

• You cannot use one type of PFC on one supervisor engine and a different type on the other supervisor engine for redundancy. You must use identical policy feature cards for redundancy.
• PFC4—These restrictions apply to a configuration with a PFC4 and these DFCs:

– PFC4 and DFC4—No restrictions (PFC4 mode).

– PFC4 and DFC4XL—The PFC4 restricts DFC4XL functionality: the DFC4XL functions as a DFC4 (PFC4 mode).

• PFC4XL—These restrictions apply to a configuration with a PFC4XL and these DFCs:

– PFC4XL and DFC4—PFC4XL functionality is restricted by the DFC4: after a reload with a DFC4-equipped module installed, the PFC4XL functions as a PFC4 (PFC4 mode).

– PFC4XL and DFC4XL—No restrictions (PFC4XL mode).

• Switching modules that you install after bootup that are equipped with a DFC that imposes a more restricted PFC mode than the current PFC mode remain powered down.
• You must reboot to use a switching module equipped with a DFC that imposes a more restricted PFC mode than the current PFC mode.
• Enter the show platform hardware pfc mode command to display the PFC mode.
• FIB TCAM exception may be thrown in case of a route churn where TCAM utilization is more than 80% of the total utilization. This limitation is applicable to DFC TCAM on XL line cards. If FIB TCAM exception is thrown for a transit route for IPv4 or IPv6 or MPLS traffic, the route does not get installed in FIB and connectivity gets affected. This can result in elevated CPU usage due to software switching.

Policy Feature Card 4XL

 

Policy Feature Card 4

 

Distributed and Centralized Forwarding Cards

• Distributed Forwarding Card 4XL
• Distributed Forwarding Card 4
• Centralized Forwarding Card (WS-F6700-CFC)

---

Note ● See the “Policy Feature Cards” section for Policy Feature Cards (PFC) and Distributed Forwarding Card (DFC) restrictions.

• The DFC4 uses memory that is installed on the switching module.
• For more information about the DFCs, see these documents:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/hardware/Config_Notes/OL_24918.html

http://www.cisco.com/en/US/prod/collateral/modules/ps2797/ps11878/data_sheet_c78-648214.html

 

Distributed Forwarding Card 4XL

 

Distributed Forwarding Card 4

 

Centralized Forwarding Card (WS-F6700-CFC)

 

40-Gigabit Ethernet Switching Modules

WS-X6904-40G-2T 4-Port 40-Gigabit Ethernet Switching Module

 

• WS-X6904-40G-2T and WS-X6904-40G-2TXL are the orderable product IDs.
• The front panel is labeled WS-X6904-40G.
• Cisco IOS software commands display WS-X6904-40G with either WS-F6K-DFC4-E or WS-F6K-DFC4-EXL.
• Has hardware abstraction layer (HAL) support.
• QoS port architecture (Rx/Tx): 1p7q4t/1p7q4t
• Dual switch-fabric connections:

– Fabric Channel #1: Ports 1 and 2 or 5 through 12

– Fabric Channel #2: Ports 3 and 4 or 13 through 20

• Number of ports: 4 or 16
  Number of port groups: 2
  Port per port group:
  –Ports 1 and 2 or 5 through 12
  –Ports 3 and 4 or 13 through 20
• dCEF2T.
• In a 3-slot chassis, supported only with WS-C6503-E hardware revision 1.3 or higher.
• Upgrade to Release15.0(1)SY1 or later before installing WS-X6904-40G (see the “EFSU Compatibility” section).
• Each bay can support a CFP transceiver (supports one 40 Gigabit Ethernet port) or a FourX adapter (supports four 10 Gigabit Ethernet SFP+ transceivers).
• WS-X6904-40G supported modes (default mode is oversubscribed):

– 40 Gigabit Ethernet oversubscribed mode:
—Four 40 Gigabit Ethernet ports
—Ports 1 through 4

– 10 Gigabit Ethernet oversubscribed mode:
—Sixteen 10 Gigabit Ethernet ports
—Ports 5 through 20

– Mixed 10/40 Gigabit Ethernet oversubscribed mode:

—Left bays:

–Either two 40 Gigabit Ethernet ports (1 and 2)

–Or eight 10 Gigabit Ethernet ports (5 through 12)

—Right bays:

–Either two 40 Gigabit Ethernet ports (3 and 4)

–Or eight 10 Gigabit Ethernet ports (13 through 20)

– Performance mode:

—Configurable per module or per bay:

—Supported in the top left bay and top right bay.

—Any of these combinations:

–40 Gigabit Ethernet port 1 (top left bay) and port 3 (top right bay)

–10 Gigabit Ethernet ports 5 through 9 (top left bay) and ports 13 through 16 (top right bay)

–Top left bay: 40 Gigabit Ethernet port 1 or 10 Gigabit Ethernet ports 5 through 9
Top right bay: 40 Gigabit Ethernet port 3 or 10 Gigabit Ethernet ports 13 through 16

– 40 Gigabit Ethernet performance mode, 10 Gigabit Ethernet oversubscribed mode:

—Either of these combinations:

–Top left bay: 40 Gigabit Ethernet port 1
Right bays: eight 10 Gigabit Ethernet ports (13 through 20)

–Left bays: eight 10 Gigabit Ethernet ports (5 through 13)
Top right bay: 40 Gigabit Ethernet port 3

– 40 Gigabit Ethernet oversubscribed mode, 10 Gigabit Ethernet performance mode:

—Either of these combinations:

–Top left bay: four 10 Gigabit Ethernet ports (5 through 9)
Right bays: two 40 Gigabit Ethernet ports (3 and 4)

–Left bays: two 40 Gigabit Ethernet ports (1 and 2)
Top right bay: four 10 Gigabit Ethernet ports (13 through 16)

• For more information about WS-X6904-40G, see these publications:

40 Gigabit Ethernet on Cisco Catalyst 6500 Series Switches: How It Works
Note: Some features described in the whitepaper will be supported in future releases.

40 Gigabit Ethernet Interface Module for Cisco Catalyst 6500 Series Switches Data Sheet

10-Gigabit Ethernet Switching Modules

• WS-X6908-10GE 8-Port 10-Gigabit Ethernet X2 Switching Module
• WS-X6816-10T-2T, WS-X6716-10T 16-Port 10-Gigabit Ethernet Copper Switching Module
• WS-X6816-10G-2T, WS-X6716-10GE 16-Port 10-Gigabit Ethernet X2 Switching Module
• WS-X6704-10GE 4-Port 10-Gigabit Ethernet XENPAK Switching Module

WS-X6908-10GE 8-Port 10-Gigabit Ethernet X2 Switching Module

 

• WS-X6908-10G and WS-X6908-10G-XL are the orderable product IDs.
• The front panel is labeled WS-X6908-10GE.
• Cisco IOS software commands display WS-X6908-10GE with either WS-F6K-DFC4-E or WS-F6K-DFC4-EXL.
• dCEF2T
• QoS port architecture (Rx/Tx): 8q4t/1p7q4t
• Dual switch-fabric connections
  Fabric Channel #1: Ports 2, 3, 6, 8
  Fabric Channel #2: Ports 1, 4, 5, 7
• Number of ports: 8
  Number of port groups: 8
  Port ranges per port group: 1 port in each group
• In a 3-slot chassis, supported only with WS-C6503-E hardware revision 1.3 or higher.

WS-X6816-10T-2T, WS-X6716-10T 16-Port 10-Gigabit Ethernet Copper Switching Module

 

• The orderable product IDs are:

– WS-X6816-10T-2TXL

– WS-X6816-10T-2T

– WS-X6716-10T-3CXL

– WS-X6716-10T-3C

• The front panel is labeled WS-X6716-10T.
• Cisco IOS software commands display WS-X6716-10T with either WS-F6K-DFC4-E or WS-F6K-DFC4-EXL.
• dCEF720
• QoS port architecture (Rx/Tx):

– Oversubscription mode : 1p7q2t/1p7q4t

– Performance mode: 8q4t/1p7q4t

• Dual switch-fabric connections
  Fabric Channel #1: ports 1–8
  Fabric Channel #2: ports 9–16
• Number of ports: 16
  Number of port groups: 4
  Port ranges per port group: 1–4, 5–8, 9–12, 13–16
• When not configured in oversubscription mode, supported in virtual switch links.
• To configure port oversubscription, use the hw-module slot command.

WS-X6816-10G-2T, WS-X6716-10GE 16-Port 10-Gigabit Ethernet X2 Switching Module

 

• The orderable product IDs are:

– WS-X6816-10G-2TXL

– WS-X6816-10G-2T

– WS-X6716-10G-3CXL

– WS-X6716-10G-3C

• The front panel is labeled WS-X6716-10GE.
• Cisco IOS software commands display WS-X6716-10GE with either WS-F6K-DFC4-E or WS-F6K-DFC4-EXL.
• dCEF720
• QoS port architecture (Rx/Tx):

– Oversubscription mode : 1p7q2t/1p7q4t

– Performance mode: 8q4t/1p7q4t

• Dual switch-fabric connections
  Fabric Channel #1: ports 1–8
  Fabric Channel #2: ports 9–16
• Number of ports: 16
  Number of port groups: 4
  Port ranges per port group: 1–4, 5–8, 9–12, 13–16
• When not configured in oversubscription mode, supported in virtual switch links.
• To configure port oversubscription, use the hw-module slot command.

WS-X6704-10GE 4-Port 10-Gigabit Ethernet XENPAK Switching Module

 

• Unless equipped with a WS-F6700-CFC, must be upgraded with WS-F6K-DFC4-AXL or WS-F6K-DFC4-A.
• dCEF720 with a DFC or CEF720 with a WS-F6700-CFC.
• Requires 512-MB DRAM with a WS-F6700-CFC ( CSCtk82279). See this publication:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/hardware/Config_Notes/78_12409.html

• QoS port architecture (Rx/Tx): 8q8t/1p7q8t
• Dual switch-fabric connections:
  Fabric Channel #1: Ports 3 and 4
  Fabric Channel #2: Ports 1 and 2
• Number of ports: 4
  Number of port groups: 4
  Port ranges per port group: 1 port in each group
• WS-X6704-10G is the orderable product ID.
• The front panel is labeled WS-X6704-10GE.
• Cisco IOS software commands display WS-X6704-10GE with either WS-F6K-DFC4-A or WS-F6K-DFC4-AXL.
• On WS-X6704-10GE ports, STP BPDUs are not exempt from Traffic Storm Control multicast suppression. Do not configure multicast suppression on STP-protected WS-X6704-10GE ports that interconnect network devices. ( CSCsg86315)

Gigabit Ethernet Switching Modules

• WS-X6848-SFP-2T, WS-X6748-SFP 48-Port Gigabit Ethernet SFP Switching Module
• WS-X6824-SFP-2T, WS-X6724-SFP 24-Port Gigabit Ethernet SFP Switching Module

WS-X6848-SFP-2T, WS-X6748-SFP 48-Port Gigabit Ethernet SFP Switching Module

 

• dCEF720 with a DFC or CEF720 with a WS-F6700-CFC.
• Unless equipped with a WS-F6700-CFC, WS-X6748-SFP must be upgraded with WS-F6K-DFC4-AXL or WS-F6K-DFC4-A.
• QoS architecture: 2q8t/1p3q8t
• Dual switch-fabric connections
  Fabric Channel #1: Ports 2, 4, 6, 8, 10, 12,
  14, 16, 18, 20, 22, 24, 26, 28, 30, 32, 34,
  36, 38, 40, 42, 44, 46, 48
  Fabric Channel #2: Ports 1, 3, 5, 7, 9, 11,
  13, 15, 17, 19, 21, 23, 25, 27, 29, 31, 33,
  35, 37, 39, 41, 43, 45, 47
• Number of ports: 48
  Number of port groups: 4
  Port ranges per port group:
  1, 3, 5, 7, 9, 11, 13, 15, 17, 19, 21, 23
  2, 4, 6, 8, 10, 12, 14, 16, 18, 20, 22, 24
  25, 27, 29, 31, 33, 35, 37, 39, 41, 43, 45, 47
  26, 28, 30, 32, 34, 36, 38, 40, 42, 44, 46, 48
• On WS-X6848-SFP-2T and WS-X6748-SFP ports, STP BPDUs are not exempt from Traffic Storm Control multicast suppression. Do not configure multicast suppression on STP-protected WS-X6848-SFP-2T or WS-X6748-SFP ports that interconnect network devices.

WS-X6824-SFP-2T, WS-X6724-SFP 24-Port Gigabit Ethernet SFP Switching Module

 

• dCEF720 with a DFC or CEF720 with a WS-F6700-CFC.
• Unless equipped with a WS-F6700-CFC, WS-X6724-SFP must be upgraded with WS-F6K-DFC4-AXL or WS-F6K-DFC4-A.
• QoS architecture: 2q8t/1p3q8t
• Number of ports: 24
  Number of port groups: 2
  Port ranges per port group: 1–12, 13–24
• On WS-X6824-SFP-2T and WS-X6724-SFP ports, STP BPDUs are not exempt from Traffic Storm Control multicast suppression. Do not configure multicast suppression on STP-protected WS-X6824-SFP-2T or WS-X6724-SFP ports that interconnect network devices.

10/100/1000 Ethernet Switching Modules

These sections descibe the supported 10/100/1000 Ethernet switching modules:

• WS-X6848-TX-2T, WS-X6748-GE-TX
• WS-X6148E-GE-45AT
• WS-X6148A-GE-TX, WS-X6148A-GE-45AF

WS-X6848-TX-2T, WS-X6748-GE-TX

 

• dCEF720 with a DFC or CEF720 with a WS-F6700-CFC.
• Unless equipped with a WS-F6700-CFC, WS-X6748-GE-TX must be upgraded with WS-F6K-DFC4-AXL or WS-F6K-DFC4-A.
• QoS architecture: 2q8t/1p3q8t
• Dual switch-fabric connections
  Fabric Channel #1: Ports 25–48
  Fabric Channel #2: Ports 1–24
• Number of ports: 48
  Number of port groups: 4
  Port ranges per port group: 1–12, 13–24, 25–36, 37–48
• On WS-X6848-TX-2T and WS-X6748-GE-TX ports, STP BPDUs are not exempt from Traffic Storm Control multicast suppression. Do not configure multicast suppression on STP-protected WS-X6848-TX-2T or WS-X6748-GE-TX ports that interconnect network devices.

WS-X6148E-GE-45AT

 

• RJ-45
• WS-X6148E-GE-45AT with WS-F6K-48-AT supports up to 48 ports of Class 4 PoE+ (30.0W).
• QoS port architecture (Rx/Tx): 1q2t/1p3q8t
• Number of ports: 48
  Number of port groups: 6
  Port ranges per port group: 1–8, 9–16, 17–24, 25–32, 33–40, 41–48
• The aggregate bandwidth of each set of 8 ports (1–8, 9–16, 17–24, 25–32, 33–40, and 41–48) is 1 Gbps.
• Not supported in virtual switch mode.
• Does not support traffic storm control.

WS-X6148A-GE-TX, WS-X6148A-GE-45AF

 

• RJ-45
• WS-X6148A-GE-TX supports WS-F6K-GE48-AF or WS-F6K-48-AF
• WS-X6148A-GE-45AF has WS-F6K-GE48-AF or WS-F6K-48-AF
• With WS-F6K-GE48-AF, supports up to 45 ports of ePoE (16.8W).
• QoS port architecture (Rx/Tx): 1q2t/1p3q8t
• Number of ports: 48
  Number of port groups: 6
  Port ranges per port group: 1–8, 9–16, 17–24, 25–32, 33–40, 41–48
• The aggregate bandwidth of each port group is 1 Gbps.
• Not supported in virtual switch mode.
• Does not support traffic storm control.

100MB Ethernet Switching Modules

WS-X6148-FE-SFP

 

• Requires Fast Ethernet SFPs
• QoS port architecture (Rx/Tx): 1p1q4t/1p3q8t
• Number of ports: 48
  Number of port groups: 3
  Port ranges per port group: 1–16, 17–32, and 33–48
• Not supported in virtual switch mode.
• Does not support traffic storm control.

10/100MB Ethernet Switching Modules

• WS-X6148A-RJ-45, WS-X6148A-45AF
• WS-X6196-RJ-21, WS-X6196-21AF

WS-X6148A-RJ-45, WS-X6148A-45AF

 

• 5.3-MB per-port packet buffers
• QoS port architecture (Rx/Tx): 1p1q4t/1p3q8t
• WS-X6148A-RJ-45 supports WS-F6K-GE48-AF or WS-F6K-48-AF
• WS-X6148A-45AF has WS-F6K-GE48-AF or WS-F6K-48-AF
• Number of ports: 48
  Number of port groups: 6
  Port ranges per port group: 1–8, 9–16, 17–24, 25–32, 33–40, 41–48
• Not supported in virtual switch mode.

WS-X6196-RJ-21, WS-X6196-21AF

 

• Not supported in VSS mode.
• Upgrade to Release15.0(1)SY1 or later before installing WS-X6196-21AF (see the “EFSU Compatibility” section).
• QoS port architecture (Rx/Tx): 1p1q0t/1p3q1t
• WS-X6196-RJ-21 supports WS-F6K-FE48X2-AF
• WS-X6196-21AF has WS-F6K-FE48X2-AF

Power over Ethernet Daughtercards

 

Transceivers

• CFP Modules
• X2 Modules
• 10 GE SFP+ Modules
• XENPAKs
• Small Form-Factor Pluggable (SFP) Modules

CFP Modules

 

X2 Modules

---

Note ● WS-X6716-10GE does not support X2 modules that are labeled with a number that ends with -01. (This restriction does not apply to X2-10GB-LRM.)

• All X2 modules shipped since WS-X6716-10GE became available provide EMI compliance with WS-X6816-10G and WS-X6716-10G.
• Some X2 modules shipped before WS-X6716-10GE became available might not provide EMI compliance with WS-X6816-10G and WS-X6716-10G. See the information listed for each type of X2 module in the following table.
• For information about X2 modules, see the Cisco 10GBASE X2 Modules data sheet:

http://www.cisco.com/en/US/prod/collateral/modules/ps5455/ps6574/product_data_sheet0900aecd801f92aa.html

 

 

10 GE SFP+ Modules

 

XENPAKs

---

Note ● For information about DWDM XENPAKs, see the Cisco 10GBase DWDM XENPAK Modules data sheet:

http://www.cisco.com/en/US/prod/collateral/modules/ps5455/ps6576/product_data_sheet0900aecd801f9333.html

• For information about other XENPAKs, see the Cisco 10GBASE XENPAK Modules data sheet:

http://www.cisco.com/en/US/prod/collateral/modules/ps2797/ps5138/product_data_sheet09186a008007cd00_ps5251_Products_Data_Sheet.html

 

 

Small Form-Factor Pluggable (SFP) Modules

These sections describe SFPs:

• Gigabit Ethernet SFPs
• Fast Ethernet SFPs

Gigabit Ethernet SFPs

---

Note ● For information about coarse wavelength-division multiplexing (CWDM) SFPs, see the Cisco CWDM GBIC and SFP Solutions data sheet:

http://www.cisco.com/en/US/prod/collateral/modules/ps5455/ps6575/product_data_sheet09186a00801a557c_ps4999_Products_Data_Sheet.html

• For information about DWDM SFPs, see the Cisco CWDM GBIC and SFP Solutions data sheet:

http://www.cisco.com/en/US/prod/collateral/modules/ps5455/ps6576/product_data_sheet0900aecd80582763.html

• See the “Unsupported Hardware” section for information about unsupported DWDM-SFPs.
• For information about other SFPs, see the Cisco SFP Optics For Gigabit Ethernet Applications data sheet:

http://www.cisco.com/en/US/prod/collateral/modules/ps5455/ps6577/product_data_sheet0900aecd8033f885.html

 

 

Fast Ethernet SFPs

---

Note ● The WS-X6148-FE-SFP supports Fast Ethernet SFPs.

• For information about Fast Ethernet SFPs, see the Cisco 100BASE-X SFP For Fast Ethernet SFP Ports data sheet:

http://www.cisco.com/en/US/prod/collateral/modules/ps5455/ps6578/product_data_sheet0900aecd801f931c.html

 

 

---

Note GLC-GE-100FX Fast Ethernet SFPs are not supported.

Service Modules

---

Note ● For service modules that run their own software, see the service module software release notes for information about the minimum required service module software version.

• With SPAN configured to include a port-channel interface to support a service module, be aware of CSCth03423 and CSCsx46323.
• EtherChannel configuration can impact some service modules. In particular, distributed EtherChannels (DECs) can interfere with service module traffic. See this field notice for more information:

http://www.cisco.com/en/US/ts/fn/610/fn61935.html

 

• Application Control Engine (ACE) Module
• ASA Services Module
• Firewall Services Module (FWSM)
• Network Analysis Modules (NAMs)
• Wireless Services Modules (WiSMs)

Application Control Engine (ACE) Module

 

ASA Services Module

 

Firewall Services Module (FWSM)

 

Network Analysis Modules (NAMs)

 

Wireless Services Modules (WiSMs)

 

Power Supplies

• WS-C6504-E Power Supplies
• WS-C6503-E Power Supplies
• All Other Power Supplies

WS-C6504-E Power Supplies

 

WS-C6503-E Power Supplies

 

All Other Power Supplies

---

Note The power supplies in this section are not supported in these chassis:

• Catalyst 6503-E
• Catalyst 6504-E

 

 

Chassis

• 13-Slot Chassis
• 9-Slot Chassis
• 6-Slot Chassis
• 4-Slot Chassis
• 3-Slot Chassis

---

Note Chassis with 64 MAC addresses automatically enable the Extended System ID feature, which is enabled with the spanning-tree extend system-id command. You cannot disable the extended-system ID in chassis that support 64 MAC addresses. The Extended System ID feature might already be enabled in your network, because it is required to support both extended-range VLANs and any chassis with 64 MAC addresses. Enabling the extended system ID feature for the first time updates the bridge IDs of all active STP instances, which might change the spanning tree topology.

13-Slot Chassis

 

9-Slot Chassis

 

6-Slot Chassis

 

4-Slot Chassis

 

3-Slot Chassis

 

Release 15.0(1)SY10

None.

Release 15.0(1)SY9

None.

Release 15.0(1)SY8

None.

Release 15.0(1)SY7a

None.

Release 15.0(1)SY7

None.

Release 15.0(1)SY6

None.

Release 15.0(1)SY5

None.

Release 15.0(1)SY4

• CLI associated with the Services SPA Carrier (SSC) and IPsec SPA ( CSCty04467)

Old Behavior: Release 12.2(50)SY and rebuilds, Release 15.0(1)SY and rebuilds, and Release 15.1(1)SY and later releases do not support the Services SPA Carrier (SSC) and IPsec SPA, but the associated CLI is present and can cause problems if entered.

New Behavior: The CLI associated with the Services SPA Carrier (SSC) and IPsec SPA is not present.

Release 15.0(1)SY3

• BGP Processing of the Removal of Private AS Numbers from AS Path

Old Behavior: When the neighbor remove-private-as command is configured and a route-map without a continue clause is configured, the processing order is:

1. neighbor remove-private-as processing

2. set as-path prepend or set as-path prepend last-as

If the route-map contains a continue clause, the processing order is reversed.

New Behavior: When the neighbor remove-private-as command is configured and a route-map is configured (whether it has a continue clause or not), the processing order is always:

1. neighbor remove-private-as processing

2. set as-path prepend or set as-path prepend last-as

• Switching mode restrictions for 1-Gigabit Ethernet ports are changed.

Old Behavior: You must shut down 1-Gigabit Ethernet ports before you enter the platform qos 10g-only command.

New Behavior: You must shut down 1-Gigabit Ethernet ports and ensure that no trust state and the default class of service (CoS) are configured before you enter the platform qos 10g-only command.

Release 15.0(1)SY2

• Changes to the no form of the exec-timeout command

Old Behavior: When using the no form of the exec-timeout command, the EXEC command interpreter is reconfigured to wait for user input for the configuration default period of 10 min 0 sec.

New Behavior: The no form of the exec-timeout command configures a wait period of 0 min 0 sec before timeout.

Additional Information:

http://www.cisco.com/en/US/docs/ios-xml/ios/fundamentals/command/D_through_E.html#GUID-76805E6F-9E89-4457-A9DC-5944C8FE5419

• Output changes for the show module command

Old Behavior: For WS-SVC-NAM3-6G-K9, the show module command displays “Trifecta NAM Module”. For WS-SVC-WISM2, the show module command displays “WiSM Jian Service Module”.

New Behavior: For WS-SVC-NAM3-6G-K9, the show module command displays “Network Analysis Module 3”. For WS-SVC-WISM2, the show module command displays “WiSM 2 WLAN Service Module”.

• WS-X6904-40G-2T requirement for the bandwidth command

Old Behavior: On WS-X6904-40G-2T ports, the bandwidth command is required if you configure any nondefault values for any other queueing commands on the port, but the CLI does not enforce the requirnment.

New Behavior: On WS-X6904-40G-2T ports, the CLI enforces the requirement for the bandwidth command if you configure any nondefault values for any other queueing commands on the port.

• Unsupported energywise management configuration mode command

Old Behavior: The unsupported energywise management configuration mode command was present in the CLI.

New Behavior: The unsupported energywise management configuration mode command is not present in the CLI.

New Hardware Features in Release 15.0(1)SY10

None.

New Software Features in Release 15.0(1)SY10

None.

New Hardware Features in Release 15.0(1)SY9

None.

New Software Features in Release 15.0(1)SY9

None.

New Hardware Features in Release 15.0(1)SY8

None.

New Software Features in Release 15.0(1)SY8

None.

New Hardware Features in Release 15.0(1)SY7a

None.

New Software Features in Release 15.0(1)SY7a

None.

New Hardware Features in Release 15.0(1)SY7

None.

New Software Features in Release 15.0(1)SY7

None.

New Hardware Features in Release 15.0(1)SY6

None.

New Software Features in Release 15.0(1)SY6

None.

New Hardware Features in Release 15.0(1)SY5

None.

New Software Features in Release 15.0(1)SY5

• IP Access List Entry - Persistent Sequence Numbering Across Reloads—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_acl/configuration/12-2sx/sec-acl-seq-num-persistent.html

New Hardware Features in Release 15.0(1)SY4

None.

New Software Features in Release 15.0(1)SY4

None.

New Hardware Features in Release 15.0(1)SY3

None.

New Software Features in Release 15.0(1)SY3

• DHCPv6 - Relay chaining for Prefix Delegation—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/ipaddr_dhcp/configuration/15-sy/dhcp-relay-agent.html

New Hardware Features in Release 15.0(1)SY2

None.

New Software Features in Release 15.0(1)SY2

None.

New Hardware Features in Release 15.0(1)SY1

• 4-Port 40-Gigabit Ethernet Switching Module (WS-X6904-40G-2T; Cisco SFP-10G-LR)
• 96-port 10/100TX RJ-21 Ethernet Switching Module (WS-X6196-RJ-21, WS-X6196-21AF)
• ASA services module (WS-SVC-ASA-SM1-K9)
• Network Analysis Module 3 (WS-SVC-NAM3-6G-K9)
• Cisco 7609-S chassis (CISCO7609-S)

---

Note Upgrade to Release15.0(1)SY1 or later before installing any of these modules (see the “EFSU Compatibility” section).

New Software Features in Release 15.0(1)SY1

• BFD - Static Route Support—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_bfd/configuration/15-sy/irb-bi-fwd-det.html

• BFD - VRF Support—See this publication:

http://www.cisco.com/en/US/docs/ios/iproute_bfd/configuration/guide/irb_bfd.html

• Cisco TrustSec L3 Identity Port Mapping—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/trustsec/configuration/guide/ident-conn_config.html#Manually_Configuring_IP-Address-to-SGT_Mapping

• Cisco TrustSec Subnet to SGT Mapping—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/trustsec/configuration/guide/ident-conn_config.html#Manually_Configuring_IP-Address-to-SGT_Mapping

• Cisco TrustSec VLAN to SGT Mapping—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/trustsec/configuration/guide/ident-conn_config.html#Manually_Configuring_IP-Address-to-SGT_Mapping

• Classification TCAM banks allocation—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/15.0SY/configuration/guide/qos_restrictions.html#General_Guidelines

• EIGRP IPv6 VRF-Lite—See this publication:

http://www.cisco.com/en/US/docs/ios/iproute_eigrp/configuration/guide/ire_cfg_eigrp.html

• Energywise Phase - 2—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/energywise/phase2/ios/configuration/guide/ew_v2.html

• Enhanced IPv6 Neighbor Discovery Cache Management—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/12-2sx/ip6-addrg-bsc-con.html

• EVN EIGRP—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-confg.html
http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-overview.html

• EVN OSPF—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-confg.html
http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-overview.html

• EVN - Route Replication—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-shared-svcs.html

• EVN Traceroute—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-shared-svcs.html

• EVN VNET trunk—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-15-sy-book.html

• Fast UDLD—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/15.0SY/configuration/guide/udld.html#Fast_UDLD

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/15.0SY/configuration/guide/udld.html#Configuring_Fast_UDLD

• Flexible NetFlow: 32 bit AS Number Support—With Release 15.0(1)SY1 and later releases, Flexible NetFlow supports 32-bit autonomous system (AS) numbers. Flexible NetFlow can capture and export 32-bit numbers as well as 16-bit numbers. If you specify the 4-octet keyword in the collect routing or match routing command, you configure the 32-bit autonomous system number as a nonkey or key field; otherwise, you configure the 16-bit version. If you configure both a 32-bit version and a 16-bit version within a record, only the 32-bit version applies. The 32-bit AS numbers have a different v9 export type than that used for 16-bit AS numbers. Your collector and analysis infrastructure should be able to process values for 32-bit AS numbers.

The following commands have been added in this release to support this feature:

For more information on export types, see the NetFlow Layer 2 and Security Monitoring Exports document:

http://www.cisco.com/en/US/docs/ios/netflow/configuration/guide/nf_lay2_sec_mon_exp.html

---

Note With Release 15.0(1)SY1 and later releases, Flexible Netflow is supported in the IP base image.

• IPv6 Route Health Injection (IPv6 RHI) on ACE-30—Release 15.0(1)SY1 and later releases provide support on the switch for the IPv6 RHI feature implemented on the ACE30-MOD-K9.
• IPv6 Routing: OSPF for IPv6 (OSPFv3) Authentication Support with IPsec—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/15-2mt/ip6-ospf.html

• IPV6 VACL (Vlan Access Control List)—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/15.0SY/configuration/guide/vlan_acls.html#IPV6_VACL_(Vlan_Access_Control_List)

• mVPN with L3VPN over mGRE—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/15.0SY/configuration/guide/ipv4_multicast_vpn.html#Information_About_mVPN_with_L3VPN_over_mGRE

• OSPF SNMP ifIndex Value for Interface ID—See this publication:

http://www.cisco.com/en/US/docs/ios/iproute_ospf/configuration/guide/iro_snmp_ifindex.html

• OSPFv3 IPSec ESP Encryption and Authentication—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/15-2mt/ip6-ospf.html

• Static Route Support for BFD over IPv6—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/15-2mt/ip6-bfd.html

• Sup2T NVRAM Battery Monitor GOLD test—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/15.0SY/configuration/guide/diagnostic_tests.html#TestNVRAMBatteryMonitor

• TrustSec SGACL Feature Support on IP Base k9 Images—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/trustsec/release/notes/rn_cts_crossplat.html

• Virtual Network trunk—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-overview.html

http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-confg.html

http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-shared-svcs.html

• vrf-aware traceroute with vrf name—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/evn/configuration/15-sy/evn-mgt-ts.html

• VRF-lite aware NAT for non-overlapping ip addresses:

---

Note NAT VRF-lite is supported only with nonoverlapping IP addresses.

The following is an example of the supported configuration:

---

Note ● This feature is not supported if there are overlaping IP address ranges among the VRF-lite domains. Support for this feature is limited to VRF-lite configurations with non-overlapping IP addresses.

• This feature has limited support based on the provided sample configuration.

 

• VSS VSL Multicast Fast Redirect—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/15.0SY/configuration/guide/virtual_switching_systems.html#VSS_VSL_Multicast_Fast_Redirect

New Hardware Features in Release 15.0(1)SY

• Application Control Engine (ACE) module (ACE30-MOD-K9)
• Wireless Services Module 2 (WiSM2):

– WS-SVC-WISM2-1-K9—Wireless Services Module 2 with 100 AP Support License

– WS-SVC-WISM2-3-K9—Wireless Services Module 2 with 300 AP Support License

– WS-SVC-WISM2-5-K9—Wireless Services Module 2 with 500 AP Support License

These hardware products are also supported in Release 12.2SY:

• Supervisor Engine 2T-10GE with PFC4XL (VS-S2T-10G-XL)
• Supervisor Engine 2T-10GE with PFC4 (VS-S2T-10G)
• Policy Feature Card 4XL (PFC4XL; VS-F6K-PFC4XL)
• Policy Feature Card 4 (PFC4; VS-F6K-PFC4)
• Distributed Forwarding Card 4XL (DFC4XL: WS-F6K-DFC4-EXL and WS-F6K-DFC4-AXL)
• Distributed Forwarding Card 4 (DFC4: WS-F6K-DFC4-E and WS-F6K-DFC4-A)
• 8-port 10-Gigabit Ethernet X2 module:

– WS-X6908-10G-XL (has WS-F6K-DFC4-EXL)

– WS-X6908-10G (has WS-F6K-DFC4-E)

---

Note ● Release 15.0(1)SY supports the hardware listed in the “Supported Hardware” section.

• Some switching modules previously supported with a DFC3 can be ordered with a DFC4:

– WS-X6816-10T-2T, WS-X6716-10T 16-Port 10-Gigabit Ethernet Copper Switching Module

– WS-X6816-10G-2T, WS-X6716-10GE 16-Port 10-Gigabit Ethernet X2 Switching Module

– WS-X6848-SFP-2T, WS-X6748-SFP 48-Port Gigabit Ethernet SFP Switching Module

– WS-X6848-TX-2T, WS-X6748-GE-TX

 

New Software Features in Release 15.0(1)SY

---

Note Release 15.0(1)SY and later releases Advanced Enterprise images support FIPS encryption.

• Enter the fips global configuration mode command to enable FIPS encryption.
• Enter the no fips global configuration mode command to disable FIPS encryption.
• Enter the show fips command to display the enable state of FIPS encryption.
• In VSS mode, you cannot configure the FIPS encryption mode without VSL encryption. To avoid a system shutdown, enable VSL encryption before you enable FIPS encryption mode. ( CSCts96040, CSCtx58304)

You can support management connections with FIPS encryption.

• For SSH with FIPS encryption:

– Use SSHv2

– Use the AES or TDES encryption algorithms

• For SSL/TLS with FIPS encryption:

– Use TLSv1.0 or SSLv3.1 or later versions

– Use the AES or TDES encryption algorithms

 

• Airdam requirement message for NEBS compliance—The software displays messages if the hardware configuration of the switch is changed in a way that might impact NEBS compliance.
• BFD IPv6 Encaps Support—See this publication:

http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-bfd.html

• BGP Event Based VPN Import—See this publication:

http://www.cisco.com/en/US/docs/ios/iproute_bgp/configuration/guide/irg_event_vpn_import.html

• BGP Neighbor Policy—See this publication:

http://www.cisco.com/en/US/docs/ios/iproute_bgp/configuration/guide/irg_basic_net.html

• BGP Per Neighbor SOO Configuration—See this publication:

http://www.cisco.com/en/US/docs/ios/iproute_bgp/configuration/guide/irg_neighbor_soo.html

• BGP RT changes without PE-CE neighbor impact—See this publication:

http://www.cisco.com/en/US/docs/ios/iproute_bgp/configuration/guide/irg_event_vpn_import.html

• eFSU (Enhanced Fast Software Upgrade)—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/issu_efsu.html

• Enabling OSPFv2 on an Interface Using the ip ospf area Command—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-imode-ospfv2.html

• Flexible NetFlow: ISSU / SSO Support—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/fnetflow/configuration/15-sy/support-issu-sso-xe.html

• GOLD Support for MediaNet 2.2—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/15.0SY/configuration/guide/diagnostic_tests.html#TestMediaLoopback

• HSRP: Global IPv6 Address—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/12-2sx/ip6-fhrp.html

• IGMPv3 Host Stack—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/ipmulti_igmp/configuration/15-sy/imc_customizing_igmp.html

• IP Multicast Load Splitting - Equal Cost Multipath (ECMP) using S, G and Next-hop—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/ipmulti_optim/configuration/15-sy/imc_load_splt_ecmp.html

• IP-RIP Delay Start—See this publication:

http://www.cisco.com/en/US/docs/ios/iproute_rip/command/reference/irr_rip.html#ip_rip_initial-delay

• IPv6: NSF & Graceful Restart for MP-BGP IPv6 Address Family—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/12-2sy/ip6-mptcl-bgp.html

• IS-IS Support for an IS-IS Instance per VRF for IP—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_isis/configuration/15-sy/irs-instance-vrf.html

• ISSU - IPv4 Multicast—See this publication:

http://www.cisco.com/en/US/docs/ios/ipmulti/configuration/guide/imc_high_availability.html

• ISSU - IPv6 Multicast—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/12-2sy/ip6-multicast.html

• ISSU - MPLS VPN 6VPE & 6PE ISSU support—See this publication:

http://www.cisco.com/en/US/docs/ios/mpls/configuration/guide/mp_6vpe_6pe_issu_sso.html

• MediaTrace 1.0—See this publication:

http://www.cisco.com/en/US/docs/ios/media_monitoring/configuration/guide/mm_mediatrace.html

• MPLS VPN - Inter-AS Option AB—See this publication:

http://www.cisco.com/en/US/docs/ios/mpls/configuration/guide/mp_vpn_ias_optab.html

• MPLS VPN InterAS AB+—See this publication:

http://www.cisco.com/en/US/docs/ios/mpls/configuration/guide/mp_vpn_ias_optab.html

• MPLS VPN over mGRE—See this publication:

http://www.cisco.com/en/US/docs/ios/interface/configuration/guide/ir_mplsvpnomgre.html

---

Note In releases earlier than Release 15.0(1)SY1, the MPLS VPN over mGRE feature does not support multicast traffic (CSCto95014).

• MVPN - Data MDT Enhancements—Multicast distribution tree (MDT) groups were selected at random when the traffic passed the threshold and there was a limit of 255 MDTs before they were reused. The MVPN - Data MDT Enhancements feature provides the ability to deterministically map the groups from inside the VPN routing and forwarding (S,G) entry to particular data MDT groups, through an access control list (ACL). The user can now map a set of VPN routing and forwarding (S,G) to a data MDT group in one of the following ways:

– 1:1 mapping (1 permit in ACL)

– Many to 1 mapping (many permits in ACL)

– Many to many mapping (multiple permits in ACL and a nonzero mask data MDT)

Because the total number of configurable data MDTs is 1024, the user can use this maximum number of mappings in any of the described combinations.

• NSF/SSO - IPv6 Multicast—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/12-2sy/ip6-multicast.html

• OSPF - Demand Circuit disable—See this publication:

http://www.cisco.com/en/US/docs/ios/iproute_ospf/configuration/guide/iro_cfg.html

• OSPF Graceful Shutdown—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-ttl.html

• OSPF support for NSSA RFC 3101—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-cfg.html

• OSPF TTL Security Check—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-ttl.html

• OSPFv2 Local RIB—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-local-rib.html

• OSPFv3 BFD—See this publication:

http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-bfd.html

• OSPFv3 Fast Convergence - LSA and SPF throttling—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/15-2mt/ip6-ospf.html

• OSPFv3 Graceful Restart—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/15-2mt/ip6-ospf.html

• Parser concurrency and locking Improvements—See this publication:

http://www.cisco.com/en/US/docs/ios/fundamentals/configuration/guide/cf_config-lock.html

• Performance Monitor (Phase 1)—See this publication:

http://www.cisco.com/en/US/docs/ios/media_monitoring/configuration/guide/mm_pasv_mon.html

• RSVP - Previous Hop Overwrite—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/qos_rsvp/configuration/15-0sy/rsvp_prvs_hop_overwrt.html

• RSVP for flexible BW interface—See this publication:

http://www.cisco.com/en/US/docs/ios/qos/configuration/guide/config_rsvp.html

• RSVP Over DMVPN—See this publication:

http://www.cisco.com/en/US/docs/ios/qos/configuration/guide/config_rsvp.html

• RSVP Support for Ingress Call Admission Control—See this publication:

http://www.cisco.com/en/US/docs/ios/qos/configuration/guide/config_rsvp.html

• RSVP-VRF Lite Admission Control—See this publication:

http://www.cisco.com/en/US/docs/ios-xml/ios/qos_rsvp/configuration/15-0sy/rsvp_vrf_lite_adm_ctrl.html

• Service Advertisement Framework (SAF)—See this publication:

http://www.cisco.com/en/US/docs/ios/saf/configuration/guide/saf_cg.html

• SSO - MPLS VPN 6VPE & 6PE SSO support—See this publication:

http://www.cisco.com/en/US/docs/ios/mpls/configuration/guide/mp_6vpe_6pe_issu_sso.html

• VPLS integrated routing and bridging on cat6500—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/15.0SY/configuration/guide/vpls.html#VPLS_Integrated_Routing_and_Bridging

• VSL Encryption—See this publication:

http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/15.0SY/configuration/guide/virtual_switching_systems.html#Configuring_VSL_Encryption

---

Note In VSS mode, you cannot configure the FIPS encryption mode without VSL encryption. To avoid a system shutdown, enable VSL encryption before you enable FIPS encryption mode.

Software Features from Earlier Releases

Use Cisco Feature Navigator to display supported features that were introduced in earlier releases.

---

---

---

---

---

---

---

Identifier	Component	Description
CSCvi28828	nat	Dynamic Nat preferred over Static Nat with Route maps, For overlapping IP addresses.
CSCtr15373	cat6000-acl	Standby crashes when copy config from tftp to running-config
CSCts70036	cat6000-acl	With mld snooping,no egress traff seen on v6 vacl vlan after reload/sso.
CSCub95435	cat6000-env	Sup2T can't deliver 100% throughput on certain 67xx/68xx line cards
CSCsh58964	cat6000-fabric	BFD node down is detected by OIR
CSCub86977	cat6000-l2-infra	c4hd1: Config sync seen with +encapsulation dot1Q 100
CSCsv98626	cat6000-l2-mcast	Ear8 MVR interaction with IGMP snooping: when IGMPSN is disabled
CSCta03980	cat6000-l2-mcast	PIMSN:No multicast data flood with IGMPSN disable & PIMSN enabled
CSCta83272	cat6000-l2-mcast	IGMP snooping not supported over VPLS ckt.
CSCth16692	cat6000-l2-mcast	IGMPSN report suppression failed to redir MIXED mode same group joins
CSCtl86457	cat6000-l2-mcast	RL for IP Multicast Control frames doesn't work properly
CSCto92033	cat6000-l2-mcast	Multicast data frames blackholed if RTR-GRD is ON and Snooping is OFF
CSCtd18777	cat6000-mcast	NAT config punt Multicast frames to Process Switching
CSCtf59230	cat6000-mcast	Earl8 performance impact on Bidir-PIM routing cases
CSCtg58715	cat6000-mcast	"show mac addr static vlan" CLI does not display mcast entries
CSCtg91060	cat6000-mcast	IPV6 PING not working on SVI when MLD Snooping is turned ON
CSCti43981	cat6000-mcast	HW BiDir mroutes not restored after temporarily losing the RP path
CSCti97217	cat6000-mcast	Traffic forwarding to incorrect fabric channel after PO shu/no shut
CSCto75104	cat6000-mcast	Mcast Traffic blkholing upon VSS DA when all VSL links are on DFC
CSCtr05033	cat6000-mpls	Caveats for MPLS VPN over mGRE
CSCtq43621	cat6000-rommon	fc2 image:Verification FAILED err seen on bootup whn cs_fips disable_dev
CSCtj16159	cat6000-svc	standby reboots twice and comes up in rpr due to config sync fail
CSCtw91029	cts	clear cts role-based counters does not give expected results
CSCth50799	pim	Multicast traffic slow convergence with 20k-30k mroute entries

Open Caveats in Release 15.0SY

 

Identifier	Component	Description
CSCui79597	cat6000-hw-fwding	Lif entry is not getting updated on minitrunk port
CSCtr29528	cat6000-hw-fwding	NO_ROUTE RL fails due to OAL
CSCts43808	cat6000-l2-infra	TB seen on config replace and subinterface po on vnet trunk down.
CSCtt33433	cat6000-l2-mcast	(S,G) MAC with missing ports blocks egress traffic with PIM snooping
CSCtu03447	cat6000-ltl	Mem leak @ ltl_set_sw_status_cb with MEC,VSL,rxvr ports on same linecard
CSCtu31096	cat6000-span	Unexpected mcast traffic copied to SPAN destination port in MVPN setup
CSCtu37676	cat6000-svc	On FWSM insertion, standby sup may crash or active report not enough mem
CSCtx93042	cat6000-svc	MA1B:ASA-SM/ACE/FWSM VLANs not getting removed on VSS setup from SUP
CSCua96981	cat6000-svc	Some module may reset after SSO in a heavy loaded chassis
CSCuq76713	os-logging	Crash is seen on adding "loggin ip " and "loggin host ip"
CSCtx92952	cat6000-svc	SUP crash when issuing show upgrade fpd file ftp/tftp cmd
CSCty14223	cat6000-svc	Trifecta project name seen in show module output of NAM3
CSCtx28226	cat6k-vs-infra	"redundancy reload peer" leads to dual-active with mcast traffic
CSCtx15860	cts	Continues t/b message in id_get when ip prefixes run out of space
CSCts59702	cts	CTS dot1x link not up between CTS capable and CTS aware cards in E8
CSCts96040	cts	VSL configuration check before reloading a VSS switch with FIPS
CSCtl50549	itasca-sup	CNMA1: ACE RHI Routes are withdrawn after doing an SSO
CSCte37338	ospf	Error messages are thrown when creating virtual link.
CSCty05150	ospf	OSPF default summary route withdrawn after SSO switchover on ABR
CSCts16791	vrfinfra	cnma1b: vnet cli present when vnetcore to switchport and then to routed
CSCty37233	vrfinfra	VNET:stby crash @swidb_if_index_assign after swover with vrf vnet subif

 

Caveats Resolved in Release 15.0(1)SY10

• CSCuq24202 —Resolved in 15.0(1)SY10

Symptom: A vulnerability in the TCL script interpreter of Cisco IOS Software might allow an authenticated, local attacker to escalate its privileges from those of a non-privileged user to a privileged (level 15) user, allowing a non-privileged user to execute privileged commands.

The vulnerability is caused due to an error on resetting VTY privileges after running a TCL script. An attacker could exploit this vulnerability by establishing a session to an affected device immediately after a TCL script has been run.

Conditions: This behavior is timing dependent because the attacker needs to log-in to the device immediately after the TCL script finishes execution.

Workaround: None

PSIRT Evaluation:

The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 6.6/5.5:

http://tools.cisco.com/security/center/cvssCalculator.x?vector=AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:U/RC:C&version=2.0

CVE ID CVE-2015-4185 has been assigned to document this issue. Additional information on Cisco's security vulnerability policy can be found at the following URL:

http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html

• CSCuv71155 —Resolved in 15.0(1)SY10

Symptom: For dynamic ACL, the l4op programmed for user1 will change if an attempt is made to program user2 without any LOU.

Conditions: User1 has been programmed which is issuing an LOU register.

Workaround: None

Caveats Resolved in Release 15.0(1)SY9

• CSCur70505 —Resolved in 15.0(1)SY9

Symptom: A 6500 reloads after negotiating an IPSec tunnel with ASR9000.

Conditions: The 6500 needs to run 12.2(33)SXJ8 and the IPsec engine must be a WS-SSC-600 WS-IPSEC-3 combination.

This crash does not happen with 7600-SSC-400 IPSEC-2 combination.

Workaround: None

More Info: A vulnerability in the IKE subsystem of Cisco WS-IPSEC-3 service module could allow an authenticated, remote attacker to cause a reload of the Catalyst switch. The vulnerability is due to insufficient bounds checks on a specific message during the establishment of an IPSEC tunnel. An attacker could exploit this vulnerability by successfully establishing an IKE session and sending the offending packet during subsequent negotiations. An exploit could allow the attacker to cause a denial of service by forcibly reloading the switch.

PSIRT Evaluation:

The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 4.9/4.9:

http://tools.cisco.com/security/center/cvssCalculator.x?vector=AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:U/RC:C&version=2.0

CVE ID CVE-2015-0771 has been assigned to document this issue. Additional information on Cisco's security vulnerability policy can be found at the following URL:

http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html

• CSCuu18788 —Resolved in 15.0(1)SY9

Symptom: An error similar to the following may be observed in the syslogs of a Cisco IOS device:

*May 4 13:40:46.760: %DATACORRUPTION-1-DATAINCONSISTENCY: copy error, -PC= :200CD000+1502CF4

-Traceback= 1#e06f72c62c6bef347348f23bdccc4b7f :200CD000+30D51C0 :200CD000+30D5588 :200CD000+3103724 :200CD000+6F2FD4C :200CD000+1502CF4 :200CD000+15033E0 :200CD000+446FF08 :200CD000+446E0B0 :200CD000+443DA40 :200CD000+442D158 :200CD000+445C0F8

No functional impact is observed.

Conditions: This is currently believed to affect all released versions of IOS code which support the CISCO-ENTITY-EXT-MIB.

This may occur when polling the ceExtSysBootImageList object in CISCO-ENTITY-EXT-MIB. This object returns a semicolon-separated list of boot statements on the device, similar to the following:

CISCO-ENTITY-EXT-MIB::ceExtSysBootImageList.5000 = STRING: "flash bootflash:cat4500e-universalk9.SPA.03.04.05.SG.151-2.SG5.bin;flash bootflash:cat4500e-universalk9.SPA.03.04.02.SG.151-2.SG2.bin"

The DATACORRUPTION error will occur under a specific corner case, where the total length of one or more complete boot variables (counted starting after the 'boot system' token) is less than 255 bytes, BUT when semicolons are added (one per boot statement) meets or exceeds this number.

Consider the following example:

boot system bootflash:this_is_a_128_character_long_boot_statement_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

boot system bootflash:this_is_a_125_character_long_boot_statement_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy

128 + 125 + 2 semicolons = 255 characters (bytes)

If another boot statement is added after this, the DATACORRUPTION error will be seen and the SNMP query will return invalid data.

Workaround: Reduce the quantity/length of configured boot variables.

More Info: This is not known to have any functional impact outside of the (potentially alarming) error message. The error will only be printed once, but subsequent occurrences of this condition can be seen via the 'show data-corruption' command.

• CSCum94811 —Resolved in 15.0(1)SY9

Symptom: A vulnerability in the TCP input module of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak and eventual reload of the affected device.

Conditions: The vulnerability is due to improper handling of certain crafted packet sequences used in establishing a TCP three-way handshake. An attacker could exploit this

vulnerability by sending a crafted sequence of TCP packets while establishing a thee-way handshake. A successful exploit could allow the attacker to cause a

memory leak and eventual reload of the affected device.

Workaround: None

More Info: Cisco has released free software updates that address this vulnerability. This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150325-tcpleak

---

Note The March 25, 2015, Cisco IOS Software Security Advisory bundled publication includes seven Cisco Security Advisories. The advisories address vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Individual publication links are in Cisco Event Response: Semiannual Cisco IOS Software Security Advisory Bundled Publication at the following link:
http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_mar15.html

• CSCuo04400 —Resolved in 15.0(1)SY9

Symptom: Box can crash.

Conditions: Crash on receiving a malformed packet via codenomican tool.

Workaround: None.

More Info: None

• CSCus19794 —Resolved in 15.0(1)SY9

Symptom: Cisco IOS and IOS-XE IPv6 FHS Send Denial of Service Vulnerability.

Workaround: None

More Info: None

 

Identifier	Component	Description
CSCuo11314	cat6000-l2	6500: Memory leak @parser_get_block
CSCth26920	tcl-bleeding	TCL: ungraceful exit from tclsh can leave the Tcl Server running
CSCuf85318	cat6000-env	temperature crossed threshold #1(=0C) on a Ringar and powers down

Caveats Resolved in Release 15.0(1)SY8

 

Identifier	Component	Description
CSCty30788	cat6000-acl	NF record not accounting phy input intf after enabling DAI
CSCuh43325	cat6000-env	Sup 720 switchover causes incorrect show power output
CSCup90562	cat6000-firmware	ws-x6904 module sets CFI to 1 and causes drops downstream
CSCun65772	cat6000-firmware	Cat6500 VSS crash due to watchdog timeout, process = slcp process
CSCuq13843	cat6000-hw-fwding	Sup2T LIF missprogramming when port-channel is configured
CSCuj54021	cat6000-ipc	Crash seen in icc_mcast_request
CSCuo11314	cat6000-l2	6500: Memory leak @parser_get_block
CSCty01365	cat6000-netflow	Supervisor 2T or Line Card Resets due to Netflow Interrupt
CSCuh94242	cat6000-qos	Agg. policer with 'platform qos police distributed' drops all traffic
CSCuj96561	cat6000-svc	wism redundancy-vlan and wism service-vlan must reject vlans in trunk
CSCun63132	ethernet-lldp	Single LLDP frame w/bad TLV hangs switch - power cycle required
CSCuo84660	ifs	copy command yields DATACORRPUTION error
CSCup93882	ipc	Crash @ ipc_compare_seats - IPC table entry freed up when seat is alive
CSCtw74339	ipc	IPC errors (RPC timeouts) were observed while polling cempMemPoolEntry.
CSCtx78552	ipc	"CR10K API Stat" causing leak in middle buffer on 5x20 LC
CSCti18397	mem	Active RP crashed by stby due to missed keepalive
CSCuq09245	os-logging	Crash is seen on adding "loggin ip " and "loggin host ip"
CSCuo24560	sea-log	I/O memory leak with active SUP due to issues with standby SUP
CSCuj23802	tcp	SUP2T crash while cleaning up a Telnet connection