Downloads |
Table Of Contents
Release Notes for the Cisco 10000 Series Router for Cisco IOS Release 12.3(7)XI7
Route Processor Redundancy Mode
Before You Upgrade the Cisco IOS Software
Upgrading to a New Software Release
New Features—Cisco IOS Release 12.3(7)XI7
IEEE 802.1Q-in-Q VLAN Tag Termination
Per Session Queuing and Shaping for PPPoEoVLAN Using RADIUS
Binding a Service to Broadcast Interface
Controlling the Rate of Logging Messages
Half-Duplex Virtual Routing and Forwarding over Route Bridge Encapsulation
IEEE 802.1Q-in-Q VLAN Tag Termination
Per Session Queuing and Shaping for PPPoE VLAN Using RADIUS
PRE Network Management Ethernet Port
Radius Proxy Enhancements for CHAP
Range Command for Bind Statements
Redundant Uplinks to the Same Service
Support for Classifying Hosts Based on IP Address
Suppression of Unused Accounting Records
Testing Performance of High-Speed Interfaces
Configuring the aaa new-model Command
Enhancing Scalability of Per-User Configurations
Setting VRF and IP Unnumbered Interface Configurations in User Profiles
Setting VRF and IP Unnumbered Interface Configuration in a Virtual Interface Template
Redefining User Profiles to Use the ip:vrf-id and ip:ip-unnumbered VSAs
PPPoA Sessions with IP QoS Static Routes
AAA Authentication on the NME Port
Caveats for Cisco IOS Release 12.3(7)XI7
Open Caveats—Cisco IOS Release 12.3(7)XI7
Resolved Caveats—Cisco IOS Release 12.3(7)XI7
Cisco Product Security Overview
Reporting Security Problems in Cisco Products
Obtaining Technical Assistance
Cisco Technical Support & Documentation Website
Definitions of Service Request Severity
Obtaining Additional Publications and Information
Release Notes for the Cisco 10000 Series Router for Cisco IOS Release 12.3(7)XI7
August, 2007
Cisco IOS Release 12.3(7)XI7
OL-5057-08
These release notes provide information about Cisco IOS Release 12.3(7)XI7, which provides broadband aggregation, leased-line, and MPLS features for the Cisco 10000 series router.
For a list of the software caveats that apply to Cisco IOS Release 12.3(7)XI7, see the "Caveats for Cisco IOS Release 12.3(7)XI7" section and Caveats for Cisco IOS Release 12.3T. The caveats document is updated for every maintenance release and is located on Cisco.com.
These release notes are updated as needed to describe new features, memory requirements, hardware support, software platform deferrals, and changes to the microcode and related documents.
Cisco recommends that you view the field notices for this release to see if your software or hardware platforms are affected. If you have an account on Cisco.com, you can find field notices at http://www.cisco.com/warp/public/tech_tips/index/fn.html. If you do not have a Cisco.com login account, you can find field notices at http://www.cisco.com/warp/public/tech_tips/index/fn.htm
Cisco IOS Release 12.3(7)XI7 is based on the following releases:
•
Cisco IOS Release 12.2(16)BX
•
•
To review the release notes for Cisco IOS Release 12.2(16)BX, go to the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/aggr/10000/10krn/122bx/index.htm
To review the release notes for Cisco IOS Release 12.3, go to the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123relnt/xprn123/index.htm.
Contents
These release notes describe the following topics:
•
•
•
•
•
System Requirements
Cisco IOS Release 12.3(7)XI7 requires that you have the performance routing engine (PRE), Part Number ESR-PRE2 installed in the Cisco 10000 series router chassis. To verify which PRE is installed in the router, use the show version command.
Route Processor Redundancy Mode
The Cisco 10000 series router supports route processor redundancy (RPR) mode or RPR+ mode to provide fault resistance and to ensure high availability. In RPR mode, one supervisor engine is active and operational while the second supervisor engine is in standby mode waiting for the active supervisor to fail so that it can take over and maintain the operation of the router. In RPR+ mode, the standby supervisor engine is fully initialized and configured, which shortens the time needed to switch over to the standby supervisor.
When you are upgrading or downgrading the Cisco IOS software, the RPR mode used on the Cisco 10000 series router depends upon the Cisco IOS software currently running on the Cisco 10000 series router and the Cisco IOS software to which you want to upgrade or downgrade.
Table 1 lists the RPR modes used when upgrading or downgrading Cisco IOS software. For example, when upgrading to Cisco IOS Release 12.3(7)XI7 from Release 12.2(16)BX, the router uses RPR mode instead of RPR+ mode. When downgrading to Cisco IOS Release 12.2(16)BX from Cisco IOS Release 12.3(7)XI7, the router uses RPR mode.
Table 1 RPR Modes for Cisco IOS Software Releases
12.2(16)BX
RPR+
RPR
12.3(7)XI7
RPR
RPR+
Before You Upgrade the Cisco IOS Software
Before you upgrade (or downgrade) the Cisco IOS software running on the Cisco 10000 series router, save the running configuration file. In RPR mode, the router synchronizes only the startup configuration.
Upgrading to a New Software Release
For specific information about upgrading your Cisco 10000 series router to a new software release, refer to the Cisco 10000 Series Router Performance Routing Engine Installation.
http://www.cisco.com/univercd/cc/td/doc/product/aggr/10000/hdwr/3971pr.htm
For general information about upgrading to a new software release, refer to the product bulletin Cisco IOS Upgrade Ordering Instructions.
For additional information about ordering Cisco IOS software, refer to the Cisco IOS Software Releases.
New Features—Cisco IOS Release 12.3(7)XI7
The following new features and improvements are supported on the Cisco 10000 series router in Cisco IOS Release 12.3(7)XI7.
•
•
For information about new features supported on the Cisco 10000 series router in other releases, see the appropriate Release Notes at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/aggr/10000/10krn/index.htm
DBS Extensions
The Dynamic Bandwidth Selection (DBS) Extensions for VC Weight and Watermarks feature extends the capacity of the DBS feature to enable you to dynamically change the existing VC weight and watermark values applied to a session without tearing down the VC and then recreating it. This eliminates the need to configure each subscriber's VC statically, using the modular QoS command line interface (MQC). As a result, you can save configuration time, reduce the size and complexity of the router's configuration file, and reduce the time required for router initialization after planned or unplanned outages.
For more information about this new feature, see the Cisco 10000 Series Router Quality of Service Configuration Guide at the following URL:
/en/US/docs/routers/10000/10008/configuration/guides/qos/qoscf.html
IEEE 802.1Q-in-Q VLAN Tag Termination
Cisco IOS Release 12.3(7)XI7 adds support for IP over Q-in-Q (IPoQ-in-Q). IPoQ-in-Q supports IP packets that are double-tagged for Q-in-Q VLAN tag termination. IPoQ-in-Q 802.1Q is an extension to 802.1Q. A Q-in-Q frame looks like a VLAN 802.1Q frame, only it has two 802.1Q tags instead of one.
IEEE 802.1Q-in-Q VLAN Tag Termination simply adds another layer of IEEE 802.1Q to the 802.1Q tagged packets that enter the network. The purpose is to expand the VLAN space by tagging the tagged packets, thus producing a "double-tagged" frame. Encapsulating IEEE 802.1Q VLAN tags within 802.1Q enables service providers to use a single VLAN to support customers who have multiple VLANs. The IEEE 802.1Q-in-Q VLAN Tag Termination feature on the subinterface level preserves VLAN IDs and keeps traffic in different customer VLANs segregated.
For more information about this new feature, see the document at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123limit/123x/123xi7/gt_qinq.htm
L2TP Domain Screening
The Layer 2 Tunnel Protocol (L2TP) Domain Screening feature provides a flexible mechanism for controlling session access to an L2TP tunnel. This feature provides the ability to modify the domain portion of the username seamlessly when a subscriber enters into a virtual private network (VPN) service. The L2TP Domain Screening feature allows per-user L2TP tunnel setup by combining the following two features:
•
•
These two commands work together in the L2TP Domain Screening feature to make sure that the appropriate domain has been screened before access is allowed to an L2TP tunnel for the user session.
For more information about this new feature, see the document at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123limit/123x/123xi7/12tpdmsc.htm
Per Session Queuing and Shaping for PPPoEoVLAN Using RADIUS
Per session Queuing and Shaping for PPP over Ethernet (PPPoE) over Virtual LANs (VLANs) using RADIUS enables you to shape PPPoE over VLAN sessions to a user-specified rate. The router shapes the sum of all of the traffic to the PPPoE session so that the subscriber's connection to the DSLAM does not become congested. Queuing-related functionality provides different levels of service to the various applications that execute over the PPPoE session.
For more information about this new feature, see the Cisco 10000 Series Router Quality of Service Configuration Guide available at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/aggr/10000/swconfig/cfggdes/qoscf/index.htm
VRF-Aware VPDN Tunnels
Release 12.3(7)XI7 implements the Virtual Routing and Forwarding-Aware (VRF-Aware) Virtual Private Dial Network (VPDN) Tunnels feature on the Cisco 10000 series router. The VRF-Aware VPDN Tunnels feature enhances the support of VPDN tunnels by allowing VPDN tunnels to start outside the Multiprotocol Label Switching (MPLS) VPN and terminate within the MPLS VPN. For example, this feature allows you to use a VRF address from a customer VRF as the destination address.
On the Cisco 10000 series router, VRF-aware VPDN tunnels can only be configured on the LAC and Multihop node. The Cisco 10000 series router requires tunnels to arrive in the global routing table, not in a VRF. However tunnels may start (LAC) or re-originate (via multihop) in a VRF. If the Cisco 10000 series router is acting as the L2TP Network Server (LNS) (which is terminating the tunnel that arrives in a VRF), the VRF-Aware VPDN Tunnels feature cannot be applied because the Cisco 10000 series router requires tunnels to arrive in the global routing table.
The ability to use VRF addresses for destination and source addresses matches current network design. For instance, Internet service providers (ISPs) support VRF and have one VRF routing table per customer. The VRF-Aware VPDN Tunnels features allows for the creation of VPDN tunnels that use the customer VRF address as the tunnel endpoint.
For more information about this new feature, see the document at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123limit/123x/123xi7/gt_qinq.htm
Limitations and Restrictions
This section describes limitations and restrictions for the following areas. Be sure to review the following limitations and restrictions before using the features in Cisco IOS Release 12.3(7)XI7:
•
•
•
•
•
•
•
•
•
•
•
•
Binding a Service to Broadcast Interface
Not supported.
Complete ID
Not supported.
Controlling the Rate of Logging Messages
It is important that you limit the rate that system messages are logged by the Cisco 10000 series router. This helps to avoid a situation in which the router becomes unstable and the CPU is overloaded. To control the output of messages from the system, use the logging rate-limit command.
We recommend that you configure the logging rate-limit command as follows. This limits the rate of all messages to the console to 10 per second, except for messages with critical priority (level 3) or greater.
Router(config)# logging rate-limit console all 10 except criticalFor more information, refer to the logging rate-limit command in the Cisco IOS Configuration Fundamentals and Network Management Command Reference, Release 12.3.
DBS Extensions
You must configure the AV pairs for both the high and low watermarks. Configuring only one of the AV pairs results in the watermark not being configured.
The router does not support RADIUS Pull for automatically provisioned VCs and virtual path (VP) tunnels.
DNS Fault Tolerance
Not supported.
DNS Redirection
Not supported.
Frame Relay
The following limitations apply to the Cisco 10000 series router implementation of Frame Relay:
•
•
Half-Duplex Virtual Routing and Forwarding over Route Bridge Encapsulation
HDVRF over RBE is not supported.
IEEE 802.1Q-in-Q VLAN Tag Termination
PPPoEoQ-in-Q supports a maximum of 32,000 sessions per interface.
•
•
•
Layer 2 Ethernet over MPLS (EoMPLS) tunneling using the xconnect command on PPPoEoQ-in-Q and IPoQ-in-Q subinterfaces is not supported.
L2TP Dialout
Is not supported. SSG attempts to set up the tunnel, but does not set up the VRF for tunnel services. Therefore, traffic is not forwarded to the tunnel.
PDSN Interworking
Not supported.
Per Session Queuing and Shaping for PPPoE VLAN Using RADIUS
•
•
•
•
•
–
–
•
•
Note
•
PRE Network Management Ethernet Port
Ensure that the Fast Ethernet, Network Management Ethernet (NME) port on the PRE is configured for auto-negotiation mode, which is the system default. Duplex mode can cause problems, such as flapping. If the port is experiencing such problems and has been configured for duplex mode, use the no half-duplex or no full-duplex command to disable duplex mode.
PTA MD
The Service Selection Gateway (SSG) PTA-MD is a form of Layer 2 switching. In the SSG implementation the host's PPP session is terminated by the access provider, but it may be logically associated with a particular service. Packets to and from the host are not routed normally but switched to and from the network to which the host is associated. This functionality is provided by designating the network side interfaces as being associated with a service. The control plane will then bind a host with a particular service based on service selection. This feature has evolved such that VRFs are used to ensure a host's packets are forwarded to and from the interface associated with the service to which they are bound.
If a network side interface is designated as being associated with a service it is then bound to a VRF. Likewise if a host subscribes to that same service it is also bound to that same VRF.
Packets to and from the host and to and from the network side interface are routed within the same VRF. Therefore packets to and from the host will always traverse the service they have subscribed to first, regardless of the ultimate destination or original source.
A host can not be connected to multiple services that are in different VRFs simultaneously.
Radius Proxy Enhancements for CHAP
Not supported.
Range Command for Bind Statements
To configure a non-PPP user as an SSG user, bind the interface as downlink or uplink by using the SSG direction command in subinterface configuration mode. The command syntax is:
ssg direction {uplink | downlink}
For example:
Router(config)# interface atm 5/0/1.15
Router(config-subif)# ssg direction downlink
Router(config-subif)# interface atm 5/0/1.16
Router(config-subif)# ssg direction uplink
Note
When you bind an interface to a direction, traffic is routed through SSG features and processing. If you do not bind an interface to a direction, the interface is a transparent passthrough interface and traffic is routed through normal Cisco IOS features processing.
Redundant Uplinks to the Same Service
Not supported.
Scalability
If you configure create on demand PVCs (individual and within a range) and PPP sessions, RP CPU utilization can be extremely high when bringing up and tearing down sessions and PVCs. This is only a concern when the configuration contains approximately 30,000 PPP sessions, and additional services such as Dynamic Bandwidth Selection (DBS), ACLs, and service policies are enabled .
Note
To reduce the RP CPU usage for PPPoA sessions, reduce the number of configured PVCs in a single subinterface. To reduce the RP CPU usage for PPPoEoA sessions, use the call admission control call admission limit command.
Service level ACLs
Service ACLs cannot be applied to a connection. The connection will remain active, but the ACLs will have no effect.
SSG Auto Logoff
Use only one method of SSG auto logoff at a time: ARP ping or ICMP ping. ARP ping works only on hosts that have a MAC address.
SSG EAP Transparency
Not supported.
SSG GRE
You cannot configure GRE tunneling type interface as an SSG uplink interface.
SSG IOS NAT
Network address translation (NAT) functionality is not supported. This means that the router does not support concurrent access to multiple services for which the services, not the access provider, must assign the user's IP address.
SSG L2TP
Neither SSG acting as a PPP client proxy with LAC nor PPP session in L2TP getting SSG processing is supported.
SSG Prepaid
The SSG Prepaid feature has the following restrictions:
· Quotas are measured in seconds. You cannot change the unit of measure.
· The Cisco 10000 series router supports only time-based SSG Prepaid for a service connection.
Support for Classifying Hosts Based on IP Address
Not supported.
Suppression of Unused Accounting Records
Not supported.
Testing Performance of High-Speed Interfaces
Cisco IOS software running on the Cisco 10000 series router has multiple queues for all classes of traffic over high-speed interfaces. The software selects a queue based on the source and destination address for the packet. This ensures that a traffic flow always uses the same queue and the packets are transmitted in proper order.
When the Cisco 10000 series router is installed in a real network, the high-speed interfaces work efficiently to spread traffic flow equally over the queues. However, using single traffic streams in a laboratory environment may result in less-than-expected performance.
Therefore, to ensure accurate test results, you should test the throughput of the Gigabit Ethernet, Packet over SONET (POS), or ATM uplink with multiple source or destination addresses.
Tip
Unique Session ID
Not supported.
VRF-Aware VPDN Tunnels
The Virtual Routing and Forwarding (VRF)-Aware VPDN Tunnels feature can only be used with Layer 2 Tunnel Protocol (L2TP) on the L2TP Access Concentrator (LAC). The reason is that the Cisco 10000 series router can only initiate tunnels in a VRF; it cannot terminate tunnels that arrive in a VRF. Therefore, this feature does not apply to the Cisco 10000 series router when the router is acting as the L2TP Network Server (LNS) because the Cisco 10000 series router, as the LNS, cannot terminate tunnels that arrive in a VRF.
For the multihop configuration, the ingress tunnel also needs to arrive in the global routing table, but the tunnel can be switched out into a VRF towards the final LNS destination.
Important Notes
This section provides important information about the following topics:
•
•
Configuring the aaa new-model Command
The aaa new-model command is disabled by default on the Cisco 10000 series router. In previous releases, the default configuration did not appear in the running configuration file. However, in Cisco IOS Release 12.3(7)XI1 or later releases, the running configuration file now includes the no aaa new-model command. This is an intentional change in behavior for this command and is the first step in a three-step process to change the default configuration to aaa new-model.
Note
For example, when you enter the show running-config command, no aaa new-model appears in the configuration if either of the following conditions previously occurred:
•
•
Enhancing Scalability of Per-User Configurations
To enhance scalability of per-user configurations without changing the router configuration, use the ip:vrf-id VSA and ip:ip-unnumbered RADIUS attributes. These per-user vendor specific attributes (VSAs) are used to map sessions to VRFs and IP unnumbered interfaces. The VSAs apply to virtual access subinterfaces and are processed during PPP authorization.
In releases earlier than Cisco IOS Release 12.2(16)BX1, the lcp:interface-config RADIUS attribute is used to map sessions to VRFs. This per-user VSA applies to any type of interface configuration, including virtual access interfaces. Valid values of this VSA are essentially any valid Cisco IOS interface command; however, not all Cisco IOS commands are supported on virtual access subinterfaces. To accommodate the requirements of the lcp:interface-config VSA, the per-user authorization process forces the Cisco 10000 series router to create full virtual access interfaces, which consume more memory and are less scalable.
In Cisco IOS Release 12.2(16)BX1 and later releases, the ip:vrf-id is used to map sessions to VRFs. Any profile that uses the ip:vrf-id VSA must also use the ip:ip-unnumbered VSA to install IP configurations on the virtual access interface that is to be created. PPP that is used on a virtual access interface to be created requires the ip:ip-unnumbered VSA. An Internet Protocol Control Protocol (IPCP) session is not established if IP is not configured on the interface. You must configure either the ip address command or the ip unnumbered command on the interface so that these configurations are present on the virtual access interface that is to be created. However, specifying the ip address and ip unnumbered commands on a virtual template interface is not required because any pre-existing IP configurations are removed when the ip:ip-vrf VSA is installed on the virtual access interface. Therefore, any profile that uses the ip:vrf-id VSA must also use the ip:ip-unnumbered VSA to install IP configurations on the virtual access interface that is to be created.
These per-user VSAs can be applied to virtual access subinterfaces; therefore, the per-user authorization process does not require the creation of full virtual access interfaces, which improves scalability.
Setting VRF and IP Unnumbered Interface Configurations in User Profiles
Although the Cisco 10000 series router continues to support the lcp:interface-config VSA, the ip:vrf-id and ip:ip-unnumbered VSAs provide another way to set the VRF and IP unnumbered interface configurations in user profiles. The ip:vrf-id and ip:ip-unnumbered VSAs have the following syntax:
Cisco:Cisco-AVpair = "ip:vrf-id=vrf-name"Cisco:Cisco-AVpair = "ip:ip-unnumbered=interface-name"Specify only one ip:vrf-id and one ip:ip-unnumbered value in a user profile. However, if the profile configuration includes multiple values, the Cisco 10000 series router applies the value of the last VSA received, and creates a virtual access subinterface. If the profile includes the lcp:interface-config VSA, the router always applies the value of the lcp:interface-config VSA, and creates a full virtual access interface.
Whenever you specify a VRF in a user profile, but you do not configure the VRF on the Cisco 10000 series router, in Cisco IOS Release 12.2(15)BX, the router accepted the profile. However, in Cisco IOS Release 12.2(16)BX1 and later releases, the router rejects the profile.
Setting VRF and IP Unnumbered Interface Configuration in a Virtual Interface Template
You can specify one VSA value in the user profile on RADIUS and another value locally in the virtual template interface. The Cisco 10000 series router clones the template and then applies the values configured in the profiles it receives from RADIUS, resulting in the removal of any IP configurations when the router applies the profile values.
Redefining User Profiles to Use the ip:vrf-id and ip:ip-unnumbered VSAs
The requirement of a full virtual access interface when using the lcp:interface-config VSA in user profiles can result in scalability issues, such as increased memory consumption. This is especially true when the Cisco 10000 series router attempts to apply a large number of per-user profiles that include the lcp:interface-config VSA. Therefore, when updating your user profiles, we recommend that you redefine the lcp:interface-config VSA to the scalable ip:vrf-id and ip:ip-unnumbered VSAs.
Example 1 shows how to redefine the VRF named newyork using the ip:vrf-id VSA.
Example 1 Redefining VRF Configurations
Change:Cisco:Cisco-Avpair = "lcp:interface-config=ip vrf forwarding newyork"To:Cisco:Cisco-Avpair = "ip:vrf-id=newyork"Example 2 shows how to redefine the Loopback 0 interface using the ip:ip-unnumbered VSA.
Example 2 Redefining IP Unnumbered Interfaces
Change:Cisco:Cisco-Avpair = "lcp:interface-config=ip unnumbered Loopback 0"To:Cisco:Cisco-Avpair = "ip:ip-unnumbered=Loopback 0"Inserting a New Line Card
Unlike other Cisco routers, if you insert a new or different line card into a Cisco 10000 series router chassis slot that previously had a line card installed, the line card initially reports that it is administratively up.
Provisioning for Scaling
The following configuration parameters enhance scalability on the Cisco 10000 series router:
•
•
To configure the Cisco 10000 series router for high scalability, be sure to configure the configuration parameters as described in the sections that follow.
For more information, refer to the Cisco 10000 Series Broadband Aggregation, Leased-Line, and MPLS Configuration Guide.
PPPoA Sessions with IP QoS Static Routes
To scale to 32,000 PPPoA sessions with IP QoS enabled, you must limit the number of IP QoS static routes to 4,000 unidirectional QoS static routes.
AAA Authentication on the NME Port
If you use AAA authentication on the NME port, set both the in and out interface hold queues to 4096; for example:
Router(config)# int fa 0/0/0Router(config-if)# hold-queue 4096 inRouter(config-if)# hold-queue 4096 outCall Admission Control
We recommend that you set the Call Admission Control (CAC) to a maximum of 95; for example:
Router(config)# call admission limit 95Caveats for Cisco IOS Release 12.3(7)XI7
Caveats describe unexpected behavior in Cisco IOS software releases. Severity 1 caveats are the most serious caveats; severity 2 caveats are less serious. Severity 3 caveats are moderate caveats, and only select severity 3 caveats are included in the caveats document.
This section contains open and resolved caveats for the current Cisco IOS maintenance release.
All caveats in Cisco IOS Release 12.3 and Cisco IOS Release 12.3 T that apply to the Cisco 10000 series are also in Cisco IOS Release 12.3(7)XI7.
For information on caveats in Cisco IOS Release 12.3, see Caveats for Cisco IOS Release 12.3 .
For information on caveats in Cisco IOS Release 12.3 T, see Caveats for Cisco IOS Release 12.3 T, which lists severity 1 and 2 caveats and select severity 3 caveats and is located on Cisco.com.
Note
The Dictionary of Internetworking Terms and Acronyms contains definitions of acronyms that are not defined in this document.
Open Caveats—Cisco IOS Release 12.3(7)XI7
This section describes caveats that are open in Cisco IOS Release 12.3(7)XI7.
•
High impact commands or commands used in high scaling environments impact scaling by increasing CPU cycles, increasing boot time, and decreasing control plane run-time efficiency.
There are no known workarounds.
•
Performance counters under the VT1.5, T3, VT2 controllers for DS1/E1 not getting updated/displayed correctly.
There are no known workarounds.
•
When Single router-APS (SR-APS) is configured on 1-Port Channelized OC12/STM-4 line cards. If an APS switchover is executed, the controller state in the show aps command output shows as SignalFail.
There are no known workarounds.
•
When scaling over 3000 serial interfaces, line rate traffic may not be achieved. This problem occurs when thousands of serial interfaces (PPP or HDLC) are used on the port and line rate traffic is sent through all interfaces.
There are no known workarounds.
•
When you remove Automatic Protection System (APS) and then re-activate it, traffic convergence after an APS switchover takes longer than 2 seconds.
There are no known workarounds.
•
A T1 interface may flap on the near end and the remote end.
There are no known workarounds.
•
When you enter the redundancy force-failover main-cpu privileged EXEC command on a router that is configured with two Performance Routing Engines (PREs), an automatic protection system (APS) switchover occurs on OC-12 Packet-over-SONET (POS) line cards, which is incorrect behavior.
This problem occurs when APS is configured on OC-12 POS line cards in two different Cisco 10000 series routers that are connected back-to-back and you enter the following sequence of commands:
1. Enter the aps force pos slot/subslot/port from working interface configuration command on both routers.
2. Enter the show aps EXEC command. The output displays the active channels for both routers.
3. Enter the redundancy force-failover main-cpu privileged EXEC command on one of the routers, causing an APS switchover to occur on this router.
There are no known workarounds. However, when problem occurs, there is no loss of data.
•
When Automatic Protection Switching (APS) is enabled, if you issue the hw-module reset command on the primary APS slot, no change is observed because the router does not switch to the secondary APS slot. This problem occurs when the hw-module reset command is issued.
There are no known workarounds.
•
The router can generate wrong or misleading sub-pool or global pool flooding messages when up or down thresholds for MPLS TE resource availability (bandwidth) are crossed. The configured thresholds for MPLS TE resource availability are crossed when defining bandwidth on the MPLS tunnel interface reserved on the physical interface/subinterface.
There are no known workarounds.
•
On Cisco 10000 series routers running in PPP Termination and Aggregation mode, PPPoEoA sessions using bandwidth queues drop packets if a priority queue is also configured in the policy map. When there is traffic sent to priority queue, all other queues can drop packets below line rate if the traffic consists of small packets.
There are no known workarounds.
•
When scaling to 12,000 Frame Relay DLCI interfaces, line rate traffic may not be achieved. This problem occurs when thousands of Frame Relay DLCIs are used on the port and line rate traffic is sent through all interfaces.
There are no known workarounds.
•
The RIP routing protocol does not function properly over VLAN interfaces with IP unnumbered.
There are no known workarounds.
•
ATM VP tunnel of 10Mb does not shape the traffic to the exact speed. There are violated cells on a connected ATM switch witch is policing the traffic.
Workaround: Lowering configured speed to 9999Kbps will ensure the tunnel speed.
•
When sending 64 byte packets through 300 serial interfaces or more, line rate traffic may not be achieved. This problem occurs with 64 byte packets and a large number of interfaces.
There are no known workarounds.
•
Cisco 7301 router takes too long to boot up.. About 4-5 minutes.
There are no known workarounds.
•
Call setup rate slower is for a particular configuration running on Cisco Release 12.3(6)TX image compared with Cisco Release 12.2(16)BX. If the mtu command is added to the virtual template for sessions, the command processing for the command takes significantly longer on Cisco Release 12.3(6)TX image as compared to Cisco Release 12.3(16)BX image.
Workaround: Remove the mtu command from the virtual template configuration.
•
Outgoing traffic is above VP speed on an 8-port E3/D3 ATM line card. For this problem to occur, the total SCR value of all VBR-nrt VCs in a VP is above 80 percent of the VPs PCR value but still smaller than the total VP bandwidth (PCR). All the VCs should be overdriven by outgoing traffic.
There are no known workarounds.
•
Traffic convergence after the removal of APS on line card 1-Port Channelized OC12, was greater than 2 sec.
There are no known workarounds.
•
The CLI error "IP address is already defined as an interface" appears when the address is not used anywhere in the running configuration. The error occurs when the IP address was used by a serial interface and the interface was removed or unconfigured from the system.
Workaround: Use the no ip address command before removing a serial interface or use a different IP address (if possible).
•
When using thousands of QoS queues with WRED configured in each queue, a traceback message can appear when you execute the microcode reload pxf command. The traceback message appears only when thousands of PXF queues are configured with random-detect enabled and the microcode reload pxf command is issued.
There are no known workarounds.
•
When SSG ARP auto logoff feature is configured, certain users may not get logged off with the feature. User logging off using SESM or other means do not get affected.
Workaround: Configure ICMP ping logoff. Upgrade the code to the appropriate version.
•
Exec process shows high CPU usage. This is caused by the dir all command, probably due to the attempted accesses to the secondary's PCMCIA slots.
There are no known workarounds. The router continues to function, but the console is unusable for a short while (10-30 seconds). Alternatively, use the command: dir device command only for known good device names.
•
The input service policy does not match traffic as shown by the show policy-map interface command if there is no action associated for that class.
Workaround: Use the set or police command to define a policy action.
•
When you apply the following example configuration to an output interface that is MPLS enabled, and send traffic from the CPU of the local router (ping other routers or hosts), the traffic is not policed by the policy map.
Policy Map exp2cosClass exp0set cos 1Class exp1police 104000 5000 150800 conform-action transmit exceed-action drop violate-action dropClass exp2This problem only affects the traffic from the router CPU, and does not affect traffic passing through the router.
There are no known workarounds.
•
When you apply a policy map to a tunnel interface on a router configured with a PRE2 processor, a traceback message appears. This problem occurs when the policy map is applied to a tunnel interface.
There are no known workarounds.
•
When you configure 2,000 PPP interfaces, traffic does not reach 99 percent of the line rate after performing 4 HA RPR switchovers. The traffic rates keep fluctuating.
There are no known workarounds.
•
A traceback message appears when you unconfigure the spoke PE router configured for half-duplex VRF over PPPoE. This problem occurs with 32,000 PPPoE sessions and 40 spoke VRFs, therefore, scaling to high values.
There are no known workarounds.
•
A traceback message appears when you unconfigure the hub PE router configured for half-duplex VRF. This problem occurs with 32,000 sessions therefore, scaling to high values.
There are no known workarounds.
•
When 2 time-based ACLs are configured to deny traffic at the same time and are applied to different interfaces, one of the ACLs fails to work properly.
There are no known workarounds.
•
Excessive CPU utilization is detected for 5 minutes after unconfiguring half-duplex VRF with a large number of PPPoE user sessions. This problem occurs with 32,000 PPPoE sessions therefore, scaling to high values.
There are no known workarounds.
•
The system allows non-nested queuing policy maps to be applied using the frame-relay map-class command on Frame Relay main interfaces and subinterfaces; it should not allow such policy maps to be configured.
There are no known workarounds.
•
The Automation Protection Switching (APS) active state does not stay with the lowest active odd port after a PRE switchover.
There are no known workarounds.
•
The secondary port does not go to a working state during a signal degrade of the primary port using threshold SON ERR RAT 1e-6.
Workaround: Set the BIP threshold to 6; do not set the BIP threshold to 7.
•
When configuring MPLS Layer 3 VPN, the PXF CEF/FIB table can hold up to 4,085 VRFs, although it is designed to hold 4,095 VRFs. If more than 4,085 VRFs are configured, 10 of those VRFs do not have an entry in the PXF CEF/FIB table, so traffic is not forwarded in those 10 VRFs.
There are no known workarounds.
•
After you issue the clear ip bgp * command, a Cisco 10000 series router takes longer than 30 minutes to achieve convergence. eBGP sessions between PE and CE routers can go up and down multiple times, and the IGP routing protocol and LDP session can also go down and up again.
These problems occur under the following conditions:
1. 4,095 VRFs are configured on a router
2. 500 eBGP sessions are established between the router (PE) and CE routers
3. 540 VRF routes per VRF in the 500 VRFs that are running eBGP between PE and CE routers
4. 40 VRF routes per VRF in the rest of 3595 VRFThere are no known workarounds.
•
When you apply a nested policy map using the bandwidth command in the child policy map to a POS OC-48 interface, PXF stops responding. This problem occurs when you allocate a small amount of bandwidth, and it only occurs on POS OC-48 interfaces.
Workaround: Allocate more bandwidth in the child policy map.
•
Policing under a created queue, when attached at an MLP interface, accounts for only 2 bytes of the L2 header, so that policing is done at a higher rate than configured. This can cause a problem with priority queue CBWFQ functionality because the priority queue is configured with policing and its dequeue rate can be higher than intended.
Workaround: Do not configure policing under a created queue.
•
When broadband PTA is configured with 114,000 queues, executing the microcode reload pxf command causes the ATM interface to display a big number of total output drops.
Workaround: Clear the counters.
•
If the you change the amount of intercepted streams from 8 to 2 streams, the wrong amount of packets is intercepted. This occurs in Lawful Interception scenarios.
There are no known workarounds.
•
This problem occurs when almost all the system resources (VCCI) are in use, after an OIR (slot reset) is issued, and in the OC-3 ATM line card. The reason it occurs in the OC-3 ATM line card is that it happens in an ATM line card with multiple ports. The symptom is that all the sessions in the same port stop passing traffic after OIR.
There are no known workarounds.
•
A low-bandwidth class can be allocated more than its share of bandwidth at the expense of a high-bandwidth class. This problem occurs when the ratio of the configured bandwidths between two data classes is high (8:1 or higher) and when there is a priority class that receives traffic at (at least) 20 percent of the line rate. The traffic that is received by the data classes should be in the ratio of the configured bandwidths.
There are no known workarounds.
•
When using multiple intercepts in Lawful Intercept mode, the MIB information is not completely cleared after intercepts are cleared from SNMP. This problem occurs when 35 or more streams are intercepted at the same time.
Workaround: Use Cisco IOS to delete the stream that was not deleted by SNMP.
•
The show activity line card debug command shows the VC configuration from the perspective of the line card, but the autovc information is not shown. Also, after you delete or create an auto-VC, the counter is inaccurate.
There are no known workarounds.
•
With 40 or more intercept streams in Lawful Intercept mode, the LI engine fails to intercept correctly for UDP traffic. This problem occurs when 40 or more streams are intercepted at the same time.
There are no known workarounds.
•
When intercepting streams at 5 Mbps or above in Lawful Intercept, the router CPU runs at about 78 percent of capacity. This problem occurs when 35 or more streams are intercepted at the same time.
There are no known workarounds.
•
A Cisco 10000 series router with PPPoA VCs can, under abnormal conditions (such as a denial-of-service attack involving the sending of PPPoA data packets before the PPPoA session is up), experience heavy RP CPU use. The router with PPPoA VCs can forward PPPoA data packets for non-existent sessions.
This problem occurs when PPPoA data traffic is sent before the session reaches the PTA forwarded state. A normal PPPoA client does not send traffic before the session is up.
Workaround: Configure RPF on all ATM subinterfaces containing PPPoA sessions. The subinterface should have an RPF check in addition to using an RPF check in the virtual template. Configuring RPF on the subinterface forces all PPPoA data traffic to be dropped by the PXF before the session reaches the PTA forward state.
•
When the 1-port channelized OC-12 line card uses SDH framing, the Path Trace Buffer is unstable for au3 mode. This problem occurs only with SDH framing; the Path Trace Buffer is stable with SONET framing.
There are no known workarounds.
•
When the 1-port channelized OC-12 line card uses SDH framing, the J1 Path trace message is not received. This problem occurs only with SDH framing. The J1 Path Trace message is received when SONET framing is used.
There are no known workarounds.
•
A loss of frame (LOF) alarm appears for a T1 when framinga Super Frame (SF) that is configured on both ends. This problem occurs when you configure T1 1 framing sf under AU-3 on a 1 port channelized OC-12 line card.
There are no known workarounds.
•
The show policy-map interface command output does not display the Layer 2 frame size correctly. The actual output policing rate is 6.6 percent higher than the configured policing rate on gigabit Ethernet and POS OC-48 interfaces. The problem occurs when a police command is configured in a policy map, and the policy map is applied to a gigabit Ethernet or POS OC-48 interface as an output policy map.
Workaround: Use shaping instead of policing.
•
You cannot configure t1 1 framing esf and t1 loopback remote at the same time on a 1-port channelized OC-12 line card. This problem occurs when you configure t1 1 framing esf under an AU-4 on a 1-port channelized OC-12 line card.
Workaround: Configure t1 1 framing esf without the loopback configured for the T1.
•
The set cos command in an output policy map applied to a VLAN subinterface does not work if the outgoing traffic is MPLS packets (with MPLS labels). The problem occurs when outgoing traffic is MPLS packets.
There are no known workarounds.
•
When scaling Frame Relay DLCIs on routers running Cisco IOS Release 12.3(7)XI, traceback messages can appear on the console when bringing up the high number of DLCIs. This problem occurs when there are more than 3,000 DLCIs on the interface.
There are no known workarounds.
•
On a router running Cisco 12.3(7)XI, if the LAC tries to redirect a call to the bid-winning LNS and fails after three attempts, a new RADIUS disconnect cause code with the value as 608 is not being sent to RADIUS by the LAC.
There are no known workarounds.
•
When a proxy service profile defined with V and X attributes is configured locally on the router, which is enabled to run SSG, an SSG host cannot activate the service it has been subscribed to.
There are no known workarounds.
•
ALIGN-3 traceback messages are displayed while running regression tests on a channelized OC-12 line card with SONET 768 encapsulation with E1 framing. This problem does not seem to affect the functionality of the card.
There are no known workarounds.
•
In 2-level policy map configurations using a parent shaper, the shaped traffic rate might not be within plus or minus 1 percent of the configured value. This problem occurs with certain parent shaper values and mostly small packet sizes.
There are no known workarounds.
•
Several PIM-related messages appear on the console when you remove, then re-apply a PIM configuration on the interface. This problem occurs when the removal and re-application of the configuration is done in a rapid manner.
There are no known workarounds.
•
When configuring an MLPPP interface on a redundant system, the standby PRE adds the no ip route-cache cef interface command to multilink interfaces. This additional line causes the system to generate the following error when the new standby PRE is reloaded:
May 19 13:20:47.222 EDT: %REDUNDANCY-3-CONFIG_SYNC: Active and Standby bulk configuration out of syncWorkaround: Remove the no ip route-cache cef command from each multilink interface.
•
Actual output and expected output for packet 1 does not match at nibble 8. This packet (packet_no 1, fragment_no : 1) is received in the wrong order. Other packets are also received in the wrong order. This problem occurs with the bootflash:c10k2-p11-mz.v123_7_xi_throttle.040510 image and the test is passed with Feb17 bba image.
There are no known workarounds.
•
MPLS:Traceroute does not show Labels being switched-propagate-ttl ON.
There are no known workarounds.
•
Traffic is not forwarded to an RBE client in a VRF. This problem occurs when an RBE client that does not respond to ARP requests, exists in a MPLS VPN. A static ARP entry for the client must be configured on the access router but the traffic is still not forwarded due to this problem
There are no known workarounds.
•
A 4 percent packet drop is seen for various packet sizes over a 1-port channelized OC-12-SDH interface when running performance/scalability tests.
There are no known workarounds.
•
BERT testing over a clear channel DS3 interface for the 1-port channelized OC-12 line card fails as a result of the DS3 interface, which remains in a down state.
There are no known workarounds.
•
During SNMP polling of the AAA Server MIB, the casDeadCount variable can cause high CPU usage on the router. This problem occurs with a large number of RBE interfaces (16,000) and bi-directional traffic running.
There are no known workarounds.
•
In Lawful Intercept mode a traceback message might appear on the Intercept Access Point (IAP) router when the interface to the mediation router is shut down. This problem occurs when traffic is sent through the IAP and interception is turned on.
There are no known workarounds.
•
If a PRE2 is in the early process of booting up, sometimes the SEND-BREAK character sequence can cause the router to reload instead of gracefully dropping back into ROMMON. This problem occurs when the PRE2 is in the early stages of the boot process and the SEND-BREAK is issued. If the PRE2 is already booted up, this is not an issue.
Workaround: To gracefully drop the PRE2 into ROMMON, if the configuration register is set to accept SEND-BREAK, wait until the PRE2 is fully booted.
•
Priority queue latency can exceed the threshold of 2MTU+6msec. This problem occurs when more than 3 queues are configured on a interface, in addition to the priority queue.
There are no known workarounds.
•
AAA accounting records for a PPPoA session terminated on a Cisco 10000 series router in a PTA fashion shows repeated entries for the Framed-Route attribute (attribute 22).
There are no known workarounds.
•
When a PPPoA session is cleared on the PTA router using the clear pppatm interface ATM X/Y/Z.A command or the clear int virtual-access command, the accounting stop record does not display the Octet and Packet counters. This problem occurs only when the session is cleared on the PTA router. If the user disconnects the session, the counters are displayed correctly.
There are no known workarounds.
•
Sometimes an ALIGN Traceback message displays for broadband PTA queue scaling after issuing a microcode reload PXF command..
There are no known workarounds.
•
During a broadband PTA queue scaling traffic test, one-third of the subinterfaces' policy-map counters displayed a big number after issuing the microcode reload pxf command.
Workaround: Clear counter.
•
When a source sends packets to a destination under the TCP protocol, the destination sends an echo response back to the sender. With the intercepting router configured to intercept "all", those echo packets should also be picked off. This does not occur.
There are no known workarounds.
•
Malloc seen on reload 7300 when CDP is enabled.
Workaround: Disable CDP using no cdp run.
•
The show version command does not display the bootloader image name.
There are no known workarounds.
•
When the ipv6 multicast-routing command is configured on a router with 1000 sub-interfaces.
There are no known workarounds.
•
In the presence of a large number of static routes (16,000- 32,000), line card flap/ router reload/OIR cause high CPU usage for a long period of time.
There are no known workarounds.
•
When clearing a PPPoE session using the clear pppoe all or clear interface virtual-access x.y command, the router displays the following messages:
XCM access error at ../toaster/c10k_rp/c10kds2_qos.c (4888) Jun 23 12:34:12.587: c10k_ttcm_read: Invalid Address 3FC110A4This problem occurs when the ATM interface VC is configured with protocol pppoe and dbs enable (Dynamic Bandwidth Selection).
There are no known workarounds.
•
Attribute 1 User-Name is not included in Stop records from LNS. This problem occurs when the LNS router runs the 12.3(5a)B image.
</
