Table of Contents
Release Notes for Cisco IOS Release 11.2
July 10, 2000
Text Part Number 78-3648-24
 |
Note You can find the most current Cisco IOS documentation on Cisco Connection Online (CCO). These electronic documents may contain updates and modifications made after the hard-copy documents were printed. |
These release notes describe the features and caveats for Cisco IOS Release 11.2, up to and including Release 11.2(23). They include all routing and access server features.
Cisco IOS Release 11.2(13) and all subsequent 11.2 releases are deemed "Generally Deployable." (For Cisco RSP7000/7500 images, 11.2(13a) is the "Generally Deployable" release number.) Cisco believes Release 11.2 is suitable for deployment anywhere in the network where the features and functionality of the release are required.
These release notes contain the following sections:
This section describes the system requirements for Release 11.2 and includes the following sections:
In Cisco IOS Release 11.2, feature sets have been updated to make it easier to select the exact feature sets you need. Feature set names are simplified and are more consistent across Cisco hardware platforms. In addition, you can add options to the standard feature set offerings. These options provide additional features and value, based on the hardware platform selected. Cisco also continues to offer specialized feature sets for key applications.
Table 1 provides a matrix of the new feature set organization and shows which feature sets are available on the various hardware platforms. These feature sets only apply to Cisco IOS Release 11.2.
An explanation of the table entries follows:
Cisco IOS images with strong encryption (including, but not limited to 56-bit DES) are subject to U.S. Government export controls, and have a limited distribution. Images to be installed outside the U.S. require an export license. Customer orders may be denied or subject to delay due to U.S. Government regulations. Contact your sales representative or distributor for more information, or send e-mail to export@cisco.com.
|
Note Release 11.2 introduces new feature-set image names for several feature sets that were available in earlier releases. For example, the prefix "igs-" has been replaced with "c2500-." Image names have been changed to facilitate identifying the platform on which the image runs. See the section "New and Changed Information" for more information. |
Table 1: Cisco IOS Release 11.2 Feature Set Matrix
| Feature Set
| Hardware Platform
|
|---|
Cisco 1000
Series
| Cisco 2500 Series and AS5100
| Cisco 4000 Series
| Cisco 7000 Series1, 2
| Cisco 7200 Series1
| Cisco 7500 Series1
| Cisco AS5200
|
|---|
| Standard Feature Sets
|
|
|
|
|
|
|
|
|---|
IP
| Basic
| Basic, Plus, and
Encryption
| Basic, Plus, and
Encryption
| Basic
| Basic
| Basic and
Encryption
| Basic and
Plus
|
Desktop (IP/IPX/AppleTalk/DEC)
| -
| Basic, Plus, and
Encryption
| Basic, Plus, and
Encryption
| Basic
| Basic
| Basic and
Encryption
| Basic and
Plus
|
Enterprise
| -
| Basic, Plus, and
Encryption
| Basic, Plus, and
Encryption
| Basic
| Basic
| Basic and
Encryption
| Basic and
Plus
|
Enterprise and APPN
| -
| Plus and
Encryption
| Plus and
Encryption
| Basic
| Basic
| Basic and
Encryption
| -
|
IP/IPX/IBM and APPN
| -
| Basic
| Basic
| -
| -
| -
| -
|
Desktop/IBM and APPN
| -
| -
| -
| Basic
| Basic
| Basic
| -
|
| Cisco 1000 Series Only Feature Sets
|
|
|
|
|
|
|
|
IP/IPX
| Basic
| -
| -
| -
| -
| -
| -
|
IP/AppleTalk
| Basic
| -
| -
| -
| -
| -
| -
|
IP/IPX/AppleTalk
| Basic, Plus, and
Encryption
| -
| -
| -
| -
| -
| -
|
IP/OSPF/PIM
| Basic
| -
| -
| -
| -
| -
| -
|
IP/Async
| Basic
| -
| -
| -
| -
| -
| -
|
IP/IPX/Async
| Basic
| -
| -
| -
| -
| -
| -
|
| Special Applications
|
| -
| -
| -
| -
| -
| -
|
Layer 3 Bridging
| -
| -
| -
| -
| Basic
| -
| -
|
CFRAD
| -
| Basic
| -
| -
| -
| -
| -
|
LANFRAD
| -
| Basic
| -
| -
| -
| -
| -
|
ISDN
| -
| Basic
| -
| -
| -
| -
| -
|
Remote Access Server
| -
| Basic
| -
| -
| -
| -
| -
|
Cisco IOS Release 11.2 supports the following Cisco hardware platforms:
Table 2 and Table 3 summarize the LAN interfaces supported on each platform.
Table 4 and Table 5 summarize the WAN data rates and interfaces supported on each platform.
Table 2: LAN Interfaces Supported by Router Platforms, Part 1
| Interface
| Cisco 7500 Series
| Cisco 7200 Series
| Cisco 7000 Series
| Cisco 4000 Series
| Cisco 3000 Series1
| Cisco 2500 Series
|
|---|
Ethernet (AUI)
| Yes
| Yes
| Yes
| Yes
| Yes
| Yes
|
Ethernet (10BaseT)
| Yes
| Yes
| Yes
| Yes
| No
| Yes (2505, 2507, 2516, 2518, 2520, 2522, and 2524 only)
|
Ethernet (10BaseFL)
| Yes
| Yes
| Yes
| No
| No
| No
|
Fast Ethernet (100BaseTX)
| Yes
| Yes
| Yes
| No
| No
| No
|
Fast Ethernet (100BaseFX)
| Yes
| Yes
| Yes
| No
| No
| No
|
4-Mbps Token Ring
| Yes
| Yes
| Yes
| Yes
| Yes
| Yes
|
16-Mbps Token Ring
| Yes
| Yes
| Yes
| Yes
| Yes
| Yes
|
FDDI DAS
| Yes
| Yes
| Yes
| Yes
| No
| No
|
FDDI SAS
| Yes
| No
| Yes
| Yes
| No
| No
|
FDDI multimode
| Yes
| Yes
| Yes
| Yes (DAS/
SAS)
| No
| No
|
FDDI single-mode
| Yes
| Yes
| Yes
| Yes
| No
| No
|
ATM Interface
| Yes
| No
| Yes
| Yes
| No
| No
|
Channel Interface
| Yes
| No
| Yes
| No
| No
| No
|
Second-Generation Channel Interface 2
| Yes
| No
| Yes
| No
| No
| No
|
Parallel Channel Adapter (Bus and Tag)
| Yes
| No
| Yes
| No
| No
| No
|
ESCON Channel Adapter (ECA)
| Yes
| No
| Yes
| No
| No
| No
|
Versatile Interface
| Yes
| No
| Yes
| No
| No
| No
|
Second-Generation Versatile Interface 2
| Yes
| No
| Yes
| No
| No
| No
|
MultiChannel Interface (Channelized E1/T1)
| Yes
| No
| Yes
| Yes
| No
| No
|
Packet-Over-SONET OC-3 Interface2
| Yes
| No
| Yes
| Yes
| No
| No
|
Synchronous Serial
| Yes
| Yes
| Yes
| Yes
| Yes
| Yes
|
1Except the Cisco 3202.
2In the Cisco 7000 series routers (Cisco 7000 and Cisco 7010), these interfaces require a Cisco 7000 with RP/SP or RP/SSP, or the 7000 Series Route Switch Processor (RSP7000) and the 7000 Series Chassis Interface (RSP7000CI). The RSP7000 and RSP7000CI are required for Cisco 7000 series routers with a VIP2.
|
Table 3: LAN Interfaces Supported by Router Platforms, Part 2
| Interface
| Cisco 1003/ 1004
| Cisco 1005
| Cisco 1000 LAN Extender
| Access-
Pro PC Card
| AS5100
| AS5200
|
|---|
Ethernet (AUI)
| No
| No
| Yes
| No
| Yes
| Yes
|
Ethernet (10BaseT)
| Yes
| Yes
| Yes
| Yes
| No
| No
|
Ethernet (10BaseFL)
| No
| No
| No
| No
| No
| No
|
Fast Ethernet (100BaseTX)
| No
| No
| No
| No
| No
| No
|
Fast Ethernet (100BaseFX)
| No
| No
| No
| No
| No
| No
|
4-Mbps Token Ring
| No
| No
| No
| Yes
| No
| No
|
16-Mbps Token Ring
| No
| No
| No
| Yes
| No
| No
|
FDDI DAS
| No
| No
| No
| No
| No
| No
|
FDDI SAS
| No
| No
| No
| No
| No
| No
|
FDDI multimode
| No
| No
| No
| No
| No
| No
|
FDDI single-mode
| No
| No
| No
| No
| No
| No
|
ATM Interface
| No
| No
| No
| No
| No
| No
|
Channel Interface
| No
| No
| No
| No
| No
| No
|
Second-Generation Channel Interface
| No
| No
| No
| No
| No
| No
|
Parallel Channel Adapter (Bus and Tag)
| No
| No
| No
| No
| No
| No
|
ESCON Channel Adapter (ECA)
| No
| No
| No
| No
| No
| No
|
Versatile Interface
| No
| No
| No
| No
| No
| No
|
Second-Generation Versatile Interface
| No
| No
| No
| No
| No
| No
|
MultiChannel Interface (Channelized E1/T1)
| No
| No
| No
| No
| No
| Yes
|
Packet-Over-SONET OC-3 Interface
| No
| No
| No
| No
| No
| No
|
Synchronous Serial
| No
| No
| No
| No
| Yes
| No
|
Table 4: WAN Data Rates and Interfaces Supported by Router Platforms, Part 1
|
| Cisco 7500 Series
| Cisco 7200 Series
| Cisco 7000 Series
| Cisco 4000 Series
| Cisco 3000 Series1
| Cisco 2500 Series
|
|---|
| Data Rate
|
|
|
|
|
|
|
48/56/64 kbps
| Yes
| Yes
| Yes
| Yes
| Yes
| Yes
|
1.544/2.048 Mbps
| Yes
| Yes
| Yes
| Yes
| Yes
| Yes
|
34/45/52 Mbps
| Yes
| Yes
| Yes
| No
| No
| No
|
| Interface
|
|
|
|
|
|
|
EIA/TIA-232
| Yes
| Yes
| Yes
| Yes
| Yes
| Yes
|
X.21
| Yes
| Yes
| Yes
| Yes
| Yes
| Yes
|
V.35
| Yes
| Yes
| Yes
| Yes
| Yes
| Yes
|
EIA/TIA-449
| Yes
| Yes
| Yes
| Yes
| Yes
| Yes
|
EIA-530
| Yes
| Yes
| Yes
| Yes
| Yes
| Yes
|
EIA/TIA-613 (HSSI)
| Yes
| No
| Yes
| No
| No
| No
|
ISDN BRI
| No
| No
| No
| Yes
| Yes
| Yes
|
ISDN PRI
| Yes
| No
| Yes
| Yes
| No
| No
|
E1-G.703/G.704
| Yes
| No
| Yes
| Yes
| No
| No
|
Table 5: WAN Data Rates and Interfaces Supported by Router Platforms, Part 2
|
| Cisco 1003/
1004
| Cisco 1005
| Cisco 1000 LAN Extender
| Access-Pro PC Card
| AS5100
| AS5200
|
|---|
| Data Rate
|
|
|
|
|
|
|
48/56/64 kbps
| Yes
| Yes
| Yes
| Yes
| Yes
| Yes
|
1.544/2.048 Mbps
| No
| Yes
| Yes
| Yes
| Yes
| Yes
|
34/45/52 Mbps
| No
| No
| No
| No
| No
| No
|
| Interface
|
|
|
|
|
|
|
EIA/TIA-232
| No
| Yes
| No
| Yes
| Yes
| Yes
|
X.21
| No
| Yes
| Yes
| Yes
| Yes
| Yes
|
V.35
| No
| Yes
| Yes
| Yes
| Yes
| Yes
|
EIA/TIA-449
| No
| Yes
| No
| Yes
| Yes
| Yes
|
EIA-530
| No
| Yes
| No
| Yes
| Yes
| Yes
|
EIA/TIA-613 (HSSI)
| No
| No
| No
| No
| No
| No
|
ISDN BRI
| Yes
| Yes
| No
| Yes
| No
| No
|
ISDN PRI
| No
| No
| No
| No
| No
| Yes
|
E1-G.703/G.704
| No
| No
| No
| No
| No
| Yes
|
To determine the version of Cisco IOS software currently running on your Cisco network device, log in to the device and enter the show version EXEC command:
router> show version
Cisco Internetwork Operating System Software
IOS (tm) 11.2(23) Software (C2500-D-L), Version 11.2(23), RELEASE SOFTWARE
Additional command output lines include more information, such as processor revision numbers, memory amounts, hardware IDs, and partition information.
If you are upgrading to Cisco IOS Release 11.2 from an earlier Cisco IOS software release, you should save your current configuration file before installing Release 11.2 software on your router.
For general information about upgrading to a new software release, see the product bulletin Cisco IOS Upgrade Ordering Instructions on CCO at:
Software Center> Cisco IOS Software> Product Bulletins> Software> General System Software Bulletins
Table 6 lists the current microcode versions for the Cisco 7000 series. Table 7 lists the current microcode versions for the Cisco 7500 series. Note that for the Cisco 7000 and Cisco 7500 series, microcode software images are bundled with the system software image---with the exception of the Channel Interface Processor (CIP) microcode (all system software images) and Versatile Interface Processor (VIP) microcode (certain system software images). Bundling eliminates the need to store separate microcode images. When the router starts, the system software unpacks the microcode software bundle and loads the proper software on all the interface processor boards. Versatile Interface Processor (VIP and VIP2) microcode is bundled into all Cisco 7500 series feature sets listed in Table 11.
|
Note For the Cisco 7000 series, all boards must use the Level 10 (or greater) microcode that is bundled (except CIP) with the system image. |
Table 6: Bundled Microcode Versions, by Release, for the Cisco 7000 Series
|
| Processor or Module1
|
|---|
| Cisco IOS Release
| AIP
| EIP
| FEIP
| FIP
| FSIP
| HIP
| MIP
| SP
| SSP
| TRIP
| VIP2
|
Minimum Version Required
| 10.15
| 10.1
| 10.4
| 10.2
| 10.18
| 10.2
| 12.0
| 11.15
| 11.15
| 10.3
| 22.20
|
11.2(1)
| 10.15
| 10.1
| 10.4
| 10.2
| 10.18
| 10.2
| 12.0
| 11.15
| 11.15
| 10.3
| 22.20
|
11.2(2)
| 10.15
| 10.1
| 10.4
| 10.2
| 10.18
| 10.2
| 12.0
| 11.15
| 11.15
| 10.3
| 22.20
|
11.2(3)
| 10.17
| 10.1
| 10.4
| 10.2
| 10.18
| 10.2
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(4)
| 10.17
| 10.1
| 10.4
| 10.2
| 10.19
| 10.2
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(5)
| 10.18
| 10.1
| 10.5
| 10.2
| 10.19
| 10.2
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(6)
| 10.19
| 10.1
| 10.6
| 10.2
| 10.19
| 10.2
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(7)
| 10.20
| 10.1
| 10.6
| 10.2
| 10.19
| 10.2
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(8)
| 10.20
| 10.1
| 10.6
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(9)
| 10.20
| 10.1
| 10.7
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(10)
| 10.22
| 10.1
| 10.7
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(11)
| 10.22
| 10.1
| 10.7
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(12)
| 10.23
| 10.1
| 10.7
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(13)
| 10.23
| 10.1
| 10.7
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(14)
| 10.23
| 10.1
| 10.7
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(15)
| 10.25
| 10.1
| 10.7
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(16)
| 10.25
| 10.1
| 10.7
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(17)
| 10.25
| 10.2
| 10.7
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(18)
| 10.25
| 10.2
| 10.9
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(19)
| 10.25
| 10.2
| 10.9
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(20)
| 10.25
| 10.2
| 10.10
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(21)
| 10.25
| 10.2
| 10.10
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(22)
| 10.25
| 10.2
| 10.10
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
11.2(23)
| 10.25
| 10.10
| 10.10
| 10.2
| 10.19
| 10.3
| 12.2
| 11.15
| 11.15
| 10.4
| 22.20
|
1AIP (ATM Interface Processor), EIP (Ethernet Interface Processor), FEIP (Fast Ethernet Interface Processor), FIP (FDDI Interface Processor), FSIP (Fast Serial Interface Processor), HIP (HSSI Interface Processor), MIP (MultiChannel Interface Processor), SP (Switch Processor), SSP (Silicon Switch Processor), TRIP (Token Ring Interface Processor), VIP (Versatile Interface Processor).
2VIP microcode resides within the Cisco IOS software; it is not "bundled" in.
|
Table 7: Bundled RSP Microcode Versions, by Release, for the Cisco 7500 Series
|
| Processor or Module1
|
|
|
|---|
| Cisco IOS Release
| AIP
| EIP
| FEIP
| FIP
| FSIP
| HIP
| MIP
| POSIP
| RSP22
| TRIP
| VIP2
| VIP22
| VIP2C2,3
|
|---|
Minimum Version Required
| 20.8
| 20.2
| 20.3
| 20.1
| 20.4
| 20.0
| 22.0
| 20.0
| 20.0
| 20.0
| 22.20
| 22.20
| 22.20
|
11.2(1)
| 20.8
| 20.2
| 20.3
| 20.1
| 20.4
| 20.0
| 22.0
| 20.0
| 20.0
| 20.0
| 22.20
| 22.20
| ---
|
11.2(2)
| 20.8
| 20.2
| 20.3
| 20.1
| 20.4
| 20.0
| 22.0
| 20.0
| 20.0
| 20.0
| 22.20
| 22.20
| 22.20
|
11.2(3)
| 20.10
| 20.2
| 20.3
| 20.1
| 20.4
| 20.0
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(4)
| 20.10
| 20.2
| 20.3
| 20.1
| 20.6
| 20.0
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(5)
| 20.12
| 20.3
| 20.4
| 20.1
| 20.6
| 20.0
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(6)
| 20.12
| 20.3
| 20.5
| 20.1
| 20.6
| 20.0
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(7)
| 20.13
| 20.3
| 20.5
| 20.1
| 20.6
| 20.0
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(8)
| 20.13
| 20.3
| 20.5
| 20.1
| 20.8
| 20.1
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(9)
| 20.13
| 20.3
| 20.6
| 20.1
| 20.8
| 20.1
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(10)
| 20.15
| 20.3
| 20.6
| 20.1
| 20.8
| 20.1
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(11)
| 20.15
| 20.3
| 20.6
| 20.1
| 20.8
| 20.1
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(12)
| 20.16
| 20.3
| 20.6
| 20.1
| 20.8
| 20.1
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(13)
| 20.16
| 20.3
| 20.6
| 20.1
| 20.9
| 20.1
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(14)
| 20.16
| 20.3
| 20.6
| 20.1
| 20.9
| 20.1
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(15)
| 20.18
| 20.3
| 20.6
| 20.4
| 20.9
| 20.2
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(16)
| 20.18
| 20.3
| 20.6
| 20.4
| 20.9
| 20.2
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(17)
| 20.18
| 20.6
| 20.6
| 20.4
| 20.9
| 20.2
| 22.2
| 20.0
| 20.0
| 20.1
| 22.20
| 22.20
| 22.20
|
11.2(18)
| 20.18
| 20.6
| 20.6
| 20.4
| 20.9
| 20.2
| 22.2
| 20.0
| 20.0
| 20.2
| 22.20
| 22.20
| 22.20
|
11.2(19)
| 20.18
| 20.6
| 20.8
| 20.4
| 20.9
| 20.2
| 22.2
| 20.0
| 20.0
| 20.2
| 22.20
| 22.20
| 22.20
|
11.2(20)
| 20.18
| 20.6
| 20.8
| 20.4
| 20.9
| 20.2
| 22.2
| 20.0
| 20.0
| 20.2
| 22.20
| 22.20
| 22.20
|
11.2(21)
| 20.18
| 20.6
| 20.8
| 20.4
| 20.9
| 20.2
| 22.2
| 20.0
| 20.0
| 20.2
| 22.20
| 22.20
| 22.20
|
11.2(22)
| 20.18
| 20.6
| 20.8
| 20.4
| 20.9
| 20.2
| 22.2
| 20.0
| 20.0
| 20.2
| 22.20
| 22.20
| 22.20
|
11.2(23)
| 20.18
| 20.6
| 20.8
| 20.4
| 20.9
| 20.2
| 22.2
| 20.0
| n/a
| 20.2
| 22.20
| 22.20
| 22.20
|
1AIP (ATM Interface Processor), EIP (Ethernet Interface Processor), FEIP (Fast Ethernet Interface Processor), FIP (FDDI Interface Processor), FSIP (Fast Serial Interface Processor), HIP (HSSI Interface Processor), MIP (MultiChannel Interface Processor),POSIP (Packet over SONET OC-3 Interface Processor), RSP2 (Route Switch Processor), TRIP (Token Ring Interface Processor), VIP (Versatile Interface Processor), VIP2 (Second-Generation Versatile Interface Processor),VIP2C (Second-Generation Versatile Interface Processor---Encrypted).
2RSP2, VIP, VIP2, and VIP2C microcode reside within the Cisco IOS software; they are not "bundled" in.
3VIP2C was introduced in Release 11.2(2).
|
Beginning with Cisco IOS Release 11.1, the CIP microcode is no longer bundled with the Cisco IOS software image. You must have Flash memory installed on the Route Processor (RP) card and 8 MB RAM installed on your CIP card to use the IBM channel attach features in Cisco IOS Release 11.1 and later. See the "Important Notes" section for more information about CIP microcode.
The following sections describe each revision of microcode for the
AIP Microcode Version 10.16
AIP Microcode Version 10.16 fixes the following:
- AIP Microcode Version 20.8 may cause the AIP card to lock into a state where it transmits corrupted packets, causing a debug ATM error showing "ATM(ATM9/0.1): VC(1) Bad SAP..." at the receive side of the ATM VC. The transmission of data is usually affected in one direction only. The problem may occur when the input traffic exceeds the average rate configured on the ATM VC, when the bandwidth of the incoming interfaces exceeds the average rate on the outgoing VC or SVC.
- A workaround is either to downgrade the AIP microcode to aip20-6 or to upgrade the AIP microcode to rsp_aip205-5, or aip20-9 when available. A short-term workaround is clear interface atm 5/0 on the transmit side.
- The same problem applies for aip10-15 on RP-based platforms. [CSCdi67812]
- ATM traffic is lost during an online insertion or removal (OIR) event of an RSP4 card. [CSCdi66076]
AIP Microcode Version 10.17
AIP Microcode Version 10.17 fixes the following:
- Online insertion and removal (OIR) causes ATM to fail in Cisco 7507 routers. [CSCdi75659]
- The AIP sometimes hangs. [CSCdi60941]
- The AIP microcode does not support configurable LBO settings. [CSCdi72800]
- The AIP sometimes fails to set up a DS3 scramble. [CSCdi57924]
AIP Microcode Version 10.18
AIP Microcode Version 10.18 fixes the following:
- The VPI/VCI hash lookup in AIP is not optimal. [CSCdi69673]
AIP Microcode Version 10.19
AIP Microcode Version 10.19 fixes the following:
- LANE should support 9K MTU for Ethernet ELANs. [CSCdj06005]
AIP Microcode Version 10.20
AIP Microcode Version 10.20 fixes the following:
- The AIP does not show packets dropped due to traffic shaping. [CSCdi72246]
AIP Microcode Version 10.21
AIP Microcode Version 10.21 fixes the following:
- %AIP-3-AIPREJCMD with error code 0x8000 + %SYS-3-CPUHOG [CSCdj20667]
AIP Microcode Version 10.22
AIP Microcode Version 10.22 fixes the following:
- OIR of any card with AIP in box causes problems. [CSCdj37259]
AIP Microcode Version 10.23
AIP Microcode Version 10.23 fixes the following:
- AIP forwards giants to RSP causing RSP crash at rsp_free_memd_pak. [CSCdj59745]
AIP Microcode Version 10.24
AIP Microcode Version 10.24 fixes the following:
- mroute-cache corruption in AIP. [CSCdj82421]
AIP Microcode Version 10.25
AIP Microcode Version 10.25 fixes the following:
- AIP applies incorrect physical format on BookTree 8222 framer chip. [CSCdj90325]
FEIP Microcode Version 10.5
FEIP Microcode Version 10.5 fixes the following:
- The FEIP MII interface fails to reset if there is OIR of another card in the router. [CSCdi82350]
- There is a failure of both ping and telnet to HSRP virtual addresses on FastEthernet. [CSCdi92485]
FEIP Microcode Version 10.6
FEIP Microcode Version 10.6 fixes the following:
- Under unusual circumstances the cBus restarts. This seems to happen because there is a bit set that requires a response within 20 ms. It appears that under high stress conditions the cBus is unable to respond appropriately, causing a restart. [CSCdi92811]
- A Cisco 7500 series router may resign its active HSRP status when configured on an FEIP if no other router is on the segment. The workaround is to turn off HSRP. [CSCdi93012]
FEIP Microcode Version 10.7
FEIP Microcode Version 10.7 fixes the following:
- Enabling FEIP in RP/SP 7000 causes the error message "CBUS-3-INITERR with Error (8021)." [CSCdj14743]
FEIP Microcode Version 10.9
FEIP Microcode Version 10.9 fixes the following:
- On a Cisco 7200 series router, the Fast Ethernet interface stays up even when there are no media-independent interface (MII) transceivers or keepalives. Under normal conditions, If the no keepalive or keepalive 0 command is configured on Fast Ethernet, the line stays up when the MII is removed or the cable is disconnected. However, if the interface is then reconfigured with the keepalive non-zero value command while the physical media stays down, the link still indicates that it is up. The workaround is to issue the shut command followed by the no shut command, or issue the clear interface command.[CSCdk66019]
FEIP Microcode Version 10.10
Modification
FEIP Microcode Version 10.10 fixes the following:
- The CX-FEIP-2FX is not recognized by IOS Release 11.2(19). [CSCdm78673]
FSIP Microcode Version 10.19
FSIP Microcode Version 10.19 fixes the following:
- Transmitter-Delay does not work in DTE/DCE mode. [CSCdi72431]
MIP Microcode Version 12.1
MIP Microcode Version 12.1 fixes the following:
- A channelized T1 remote interface loop might report failure. [CSCdi76327]
MIP Microcode Version 12.2
MIP Microcode Version 12.2 fixes the following:
- The MIP loopback remote command causes IPs to crash. [CSCdi69074]
- MIP framing changes from Super Frame (SF) to Extended Superframe (ESF) after a microcode reload. [CSCdi71556]
- MIP channel creation may cause output stuck on others. [CSCdi74075]
TRIP Microcode Version 10.4
TRIP Microcode Version 10.4 fixes the following:
- A SpyGlass problem causes the command queue to the Spyglass to overflow. The symptom of this problem is a "trucheck" at location 0x925 in trip10-3.
AIP Microcode Version 20.9
AIP Microcode Version 20.9 fixes the following:
- AIP Microcode Version 20.8 may cause the AIP card to lock into a state where it transmits corrupted packets, causing a debug ATM error showing "ATM(ATM9/0.1): VC(1) Bad SAP...." at the receive side of the ATM VC. The transmission of data is usually affected in one direction only. The problem may occur when the input traffic exceeds the average rate configured on the ATM VC, when the bandwidth of the incoming interfaces exceeds the average rate on the outgoing VC or SVC.
- A workaround is either to downgrade the AIP microcode to aip20-6 or to upgrade the AIP microcode to rsp_aip205-5, or aip20-9 when available. A short-term workaround is clear interface atm 5/0 on the transmit side.
- The same problem applies for aip10-15 on RP-based platforms. [CSCdi67812]
- ATM traffic is lost during an online insertion or removal (OIR) event of an RSP4 card. [CSCdi66076]
AIP Microcode Version 20.10
AIP Microcode Version 20.10 fixes the following:
- Online insertion and removal (OIR) causes ATM to fail in Cisco 7507 routers. [CSCdi75659]
- The AIP sometimes hangs. [CSCdi60941]
- The AIP microcode does not support configurable LBO settings. [CSCdi72800]
- The AIP sometimes fails to set up a DS3 scramble. [CSCdi57924]
AIP Microcode Version 20.11
AIP Microcode Version 20.11 fixes the following:
- VPI/VCI hash lookup in AIP is not optimal. [CSCdi69673]
AIP Microcode Version 20.12
AIP Microcode Version 20.12 fixes the following:
- LANE should support 9K MTU for Ethernet ELANs. [CSCdj06005]
AIP Microcode Version 20.13
AIP Microcode Version 20.13 fixes the following:
- The AIP does not show packets dropped due to traffic shaping. [CSCdi72246]
AIP Microcode Version 20.14
AIP Microcode Version 20.14 fixes the following:
- %AIP-3-AIPREJCMD with error code 0x8000 + %SYS-3-CPUHOG [CSCdj20667]
AIP Microcode Version 20.15
AIP Microcode Version 20.15 fixes the following:
- OIR of any card with AIP in box causes problems. [CSCdj37259]
AIP Microcode Version 20.16
AIP Microcode Version 20.16 fixes the following:
- AIP forwards giants to RSP causing RSP crash at rsp_free_memd_pak. [CSCdj59745]
AIP Microcode Version 20.17
AIP Microcode Version 20.17 fixes the following:
- mroute-cache corruption in AIP. [CSCdj82421]
AIP Microcode Version 20.18
AIP Microcode Version 20.18 fixes the following:
- AIP applies incorrect physical format on BookTree 8222 framer chip. [CSCdj90325]
EIP Microcode Version 20.3
EIP Microcode Version 20.3 fixes the following:
- A bad R4600 processor causes router crashes with errors such as XBUFHDR errors, INVRTN errors, and GETBUF errors. [CSCdi75404]
EIP Microcode Version 20.4
EIP Microcode Version 20.4 fixes the following:
- Renumbered EIP microcode with code change to fix problem with interfaces changing between up and down state. Fix committed into 11.1CA release only. [CSCdk36767]
EIP Microcode Version 20.5
EIP Microcode Version 20.5 fixes the following:
- Renumbered rsp_eip20-5 after commenting some debug code. Fixes problem with interfaces changing between up and down state in all releases (11.1/11.2/12.0). [CSCdk36767]
Modification
EIP Microcode Version 20.6 fixes the following:
- fixed problem with corrupted frame being seen on RSP Ethernet under heavy load. [CSCdk34545]
FEIP Microcode Version 20.4
FEIP Microcode Version 20.4 fixes the following:
- The FEIP MII interface fails to reset if there is OIR of another card in the router. [CSCdi82350]
- There is a failure of both ping and telnet to HSRP virtual addresses on FastEthernet. [CSCdi92485]
FEIP Microcode Version 20.5
FEIP Microcode Version 20.5 fixes the following:
- Under unusual circumstances the cBus restarts. This seems to happen because there is a bit set that requires a response within 20 ms. It appears that under high stress conditions the cBus is unable to respond appropriately, causing a restart. [CSCdi92811]
- A Cisco 7500 router may resign its active HSRP status when configured on an FEIP if no other router is on the segment. The workaround is to turn off HSRP. [CSCdi93012]
FEIP Microcode Version 20.6
FEIP Microcode Version 20.6 fixes the following:
- Enabling FEIP in RP/SP 7000 causes the error message "CBUS-3-INITERR with Error (8021)." [CSCdj14743]
FEIP Microcode Version 20.7
FEIP Microcode Version 20.7 fixes the following:
- Routers with FEIP-FX are unable to detect TX fiber loss. [CSCdk03855]
- Versatile Interface Processor (VIP) PA-FE-FX will not drop the link light when a port shutdown breaks the ether channel. [CSCdk20683]
FEIP Microcode Version 20.8
FEIP Microcode Version 20.8 fixes the following:
- Fast Ethernet interface stays up even when there is no MII transceiver present and no keepalives. [CSCdk66019]
FSIP Microcode Version 20.6
FSIP Microcode Version 20.6 fixes the following:
- Transmitter-Delay does not work. [CSCdi72431]
FSIP Microcode Version 20.7
FSIP Microcode Version 20.7 fixes the following:
- %CBUS-3-CMDTIMEOUT error message causes FSIP to vanish. [CSCdj00013]
FSIP Microcode Version 20.8
FSIP Microcode Version 20.8 fixes the following:
- %RSP-3-IP_PANIC error message causes interface resets and buffer misses. [CSCdi78086]
FSIP Microcode Version 20.9
FSIP Microcode Version 20.9 fixes the following:
- OIR of any card causes serial interface to see overruns. [CSCdj03407]
MIP Microcode Version 22.1
MIP Microcode Version 22.1 fixes the following:
- A channelized T1 remote interface loop could report failure. [CSCdi76327]
MIP Microcode Version 22.2
MIP Microcode Version 22.2 fixes the following:
- The MIP loopback remote command causes IPs to crash. [CSCdi69074]
- MIP framing changes from Super Frame (SF) to Extended Superframe (ESF) after a microcode reload. [CSCdi71556]
- MIP channel creation may cause output stuck on others. [CSCdi74075]
TRIP Microcode Version 20.1
TRIP Microcode Version 20.1 fixes the following:
- A SpyGlass problem causes the command queue to the Spyglass to overflow. The symptom of this problem is a "ctrucheck" at location 0x925 in trip10-3.
- The DMA engine appears to "clock in" the memd address an extra time or increment the memd address an extra time. The obvious symptom is an "800E" (output stuck).
- With transmit frames, the prototype Access Control byte is invalid (bit 0x10 is set).
TRIP Microcode Version 20.2
TRIP Microcode Version 20.2 fixes the following:
- Online insertion and removal (OIR) of any card in a router that has TRIP microcode causes problems. [CSCdi75287]
This section describes platform-specific information and includes the following sections:
Release 11.2 introduces new feature-set image names for several feature sets that were available in earlier releases. For example, the prefix "igs-" has been replaced with "c2500-." Image names have been changed to facilitate identifying the platform on which the image runs. New prefixes are shown in Table 8.
The contents of feature sets for some platforms has changed in Release 11.2. Table 9 lists image names in Release 11.1 that have been replaced by new sets in Release 11.2. If you normally use an image from Release 11.1 or earlier that is not available in Release 11.2, use the equivalent image shown in Table 9. New images contain as many features as earlier ones, and include new features for Release 11.2.
Table 9: Image Name Mapping from Release 11.1 to Release 11.2
| Image Name in Release 11.1 or Earlier
| Image Name in Release 11.2
|
|---|
| Cisco 1005
|
|
c1005-bnxy-mz
| c1005-bny-mz
|
c1005-bxy-mz
| c1005-by-mz
|
c1005-nxy-mz
| c1005-ny-mz
|
c1005-xy-mz
| c1005-y-mz
|
c1005-xy2-mz
| c1005-y2-mz
|
| Cisco 2500 Series
|
|
igs-ainr-l
| c2500-ainr-l
|
igs-aj-l
| c2500-ajs-l
|
igs-c-l
| c2500-c-l
|
igs-d-l
| c2500-d-l
|
igs-dr-l
| c2500-ds-l
|
igs-f-l
| c2500-f-l
|
igs-fin-l
| c2500-fin-l
|
igs-g-l
| c2500-g-l
|
igs-i-l
| c2500-i-l
|
igs-im-l
| c2500-is-l
|
igs-imn-l
| c2500-ds-l
|
igs-imnr-l
| c2500-ds-l
|
igs-imr-l
| c2500-is-l
|
igs-in-l
| c2500-d-l
|
igs-ir-l
| c2500-is-l
|
igs-inr-l
| c2500-ds-l
|
igs-jm-l
| c2500-js-l
|
igs-j-l
| c2500-j-l
|
| Cisco AS5200
|
|
as5200-iz-l
| c5200-is-l
|
as5200-dz-l
| c5200-ds-l
|
as5200-jmz-l
| c5200-js-l
|
| Cisco 4000 Series
|
|
xx-ainr-mz
| c4000-ainr-mz
|
xx-aj-mz
| c4000-ajs-mz
|
xx-d-mz
| c4000-d-mz
|
xx-dr-mz
| c4000-ds-mz
|
xx-i-mz
| c4000-is-mz
|
xx-in-mz
| c4000-d-mz
|
xx-inr-mz
| c4000-ds-mz
|
xx-ir-mz
| c4000-is-mz
|
xx-j-mz
| c4000-j-mz
|
| Cisco 4500 Series
|
|
c4500-aj-mz
| c4500-ajs-mz
|
c4500-dr-mz
| c4500-ds-mz
|
c4500-ir-mz
| c4500-is-mz
|
c4500-in-mz
| c4500-d-mz
|
c4500-inr-mz
| c4500-ds-mz
|
| Cisco 7000 Series
|
|
gs7-aj-mz
| c7000-aj-mz
|
gs7-ajv-mz
| c7000-ajv-mz
|
gs7-jv-mz
| c7000-jv-mz
|
gs7-j-mz
| c7000-j-mz
|
| Cisco 7200 Series
|
|
c7200-aj-mz
| c7200-ajs-mz
|
c7200-dr-mz
| c7200-ds-mz
|
c7200-j-mz
| c7200-js-mz
|
| Cisco 7500 Series and Cisco 7000 with RSP7000
|
|
rsp-aj-mz
| rsp-ajsv-mz
|
rsp-j-mz
| rsp-jsv-mz
|
rsp-ajv-mz
| rsp-ajsv-mz
|
rsp-jv-mz
| rsp-jsv-mz
|
Beginning with Cisco IOS Release 10.3, some software image sizes exceed 4 MB and, when compressed, exceed 2 MB. Also, some systems now require more than 1 MB of main system memory for data structure tables.
For Cisco routers to take advantage of the Release 11.2 features, you must upgrade the code or main system memory as listed in Table 10. Some platforms have specific chip or architecture requirements that affect what can be upgraded and in what increments.
|
Note For the Cisco 7000 and Cisco 7010 routers to recognize Flash memory cards, 11.0 boot ROMs (or later) are required. |
Table 10: Release 11.2 Memory Recommendations
| Router
| Minimum Recommended Code Memory
| Recommended Main Memory
| Release 11.2 Runs from
|
|---|
| Cisco 1003 and Cisco 1004 ISDN Routers1
|
|
|
|
|
IP Set
| 2/4 MB optional Flash
| 8 MB RAM2
|
| RAM
|
IP Plus3 Set
| 2/4 MB optional Flash
| 8 MB RAM
|
| RAM
|
IP Plus 40 Set
| 2/4 MB optional Flash
| 8 MB RAM
|
| RAM
|
IP Plus 56 Set
| 2/4 MB optional Flash
| 8 MB RAM
|
| RAM
|
IP/IPX Set
| 2/4 MB optional Flash
| 8 MB RAM
|
| RAM
|
IP/AT Set
| 2/4 MB optional Flash
| 8 MB RAM
|
| RAM
|
IP/IPX/AT Set
| 2/4 MB optional Flash
| 8 MB RAM
|
| RAM
|
IP/IPX/AT Plus Set
| 4 MB Flash4
| 8 MB RAM
|
| RAM
|
IP/IPX/AT Plus 40 Set
| 4 MB Flash4
| 8 MB RAM
|
| RAM
|
IP/IPX/AT Plus 56 Set
| 4 MB Flash4
| 8 MB RAM
|
| RAM
|
| Cisco 1005 Router1
|
|
|
|
|
IP Set
| 2/4 MB optional Flash
| 8 MB RAM2
|
| RAM
|
IP Plus5 Set
| 4 MB Flash4
| 8 MB RAM
|
| RAM
|
IP Plus 40 Set
| 4 MB Flash4
| 8 MB RAM
|
| RAM
|
IP Plus 56 Set
| 4 MB Flash4
| 8 MB RAM
|
| RAM
|
IP/IPX Set
| 2/4 MB optional Flash
| 8 MB RAM
|
| RAM
|
IP/AT Set
| 2/4 MB optional Flash
| 8 MB RAM2
|
| RAM
|
IP/IPX/AT Set
| 2/4 MB optional Flash
| 8 MB RAM
|
| RAM
|
IP/IPX/AT Plus Set
| 4 MB Flash4
| 8 MB RAM
|
| RAM
|
IP/IPX/AT Plus 40 Set
| 4 MB Flash4
| 8 MB RAM
|
| RAM
|
IP/IPX/AT Plus 56 Set
| 4 MB Flash4
| 8 MB RAM
|
| RAM
|
IP/OSPF/PIM Set
| 2/4 MB optional Flash
| 8 MB RAM
|
| RAM
|
IP/Async Set
| 2/4 MB optional Flash
| 8 MB RAM2
|
| RAM
|
IP/IPX/Async Set
| 2/4 MB optional Flash
| 8 MB RAM
|
| RAM
|
| Cisco 2500 Series
|
|
|
|
|
IP Set
| 8 MB Flash
| 4 MB RAM6
|
| Flash
|
IP Plus7 Set
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
IP Plus 40 Set
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
IP Plus 56 Set
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
IP/IPX/IBM/APPN Set
| 8 MB Flash
| 8 MB RAM
|
| Flash
|
IP/IPX/AT/DEC Set
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
IP/IPX/AT/DEC Plus Set
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
IP/IPX/AT/DEC Plus 40 Set
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
IP/IPX/AT/DEC Plus 56 Set
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
Enterprise Set
| 8 MB Flash
| 6 MB RAM
|
| Flash
|
Enterprise Plus Set
| 8 MB Flash
| 6 MB RAM
|
| Flash
|
Enterprise Plus 40 Set
| 16 MB Flash
| 6 MB RAM
|
| Flash
|
Enterprise Plus 56 Set
| 16 MB Flash
| 6 MB RAM
|
| Flash
|
Enterprise/APPN Plus Set
| 16 MB Flash
| 8 MB RAM
|
| Flash
|
Enterprise/APPN Plus 40 Set
| 16 MB Flash
| 8 MB RAM
|
| Flash
|
Enterprise/APPN Plus 56 Set
| 16 MB Flash
| 8 MB RAM
|
| Flash
|
Cisco Frame Relay Access Device (CFRAD) Set
| 4 MB Flash
| 4 MB RAM6
|
| Flash
|
Remote Access Server
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
ISDN Set
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
LAN FRAD Set
| 4 MB Flash
| 4 MB RAM
|
| Flash
|
OSPF LANFRAD Set8
| 4 MB Flash
| 4 MB RAM
|
| Flash
|
| Cisco 2501 - Cisco 2508
|
|
|
|
|
IP Set
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
| Cisco 2509 - Cisco 2512
|
|
|
|
|
IP Set
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
Remote Access Server
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
| Cisco 2513 - Cisco 2519
|
|
|
|
|
IP Set
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
| Cisco 2522 - Cisco 2523
|
|
|
|
|
IP Set
| 8 MB Flash
| 4 MB RAM
|
| Flash
|
Cisco Frame Relay Access Device (CFRAD) Set
| 4 MB Flash
| 4 MB RAM
|
| Flash
|
| Cisco 2524 - Cisco 2525
|
|
|
|
|
LAN FRAD Set
| 4 MB Flash
| 4 MB RAM
|
| Flash
|
| Cisco AS51009
|
|
|
|
|
IP Set
| 8 MB Flash per card
| 6 MB RAM per card
|
| Flash
|
IP/IPX/AT/DEC Set
| 8 MB Flash
| 6 MB RAM
|
| Flash
|
Remote Access Server
| 8 MB Flash
| 6 MB RAM
|
| Flash
|
Enterprise Set
| 8 MB Flash
| 6 MB RAM
|
| Flash
|
| Cisco AS5200
|
|
|
|
|
IP Set
| 8 MB Flash
| 8 MB RAM
|
| Flash
|
IP Plus10 Set
| 8 MB Flash
| 8 MB RAM
|
| Flash
|
Desktop Set
| 8 MB Flash
| 8 MB RAM
|
| Flash
|
Desktop Plus Set
| 8 MB Flash
| 8 MB RAM
|
| Flash
|
Enterprise Set
| 8 MB Flash
| 8 MB RAM
|
| Flash
|
Enterprise Plus Set
| 8 MB Flash
| 8 MB RAM
|
| Flash
|
Cisco 3101,
Cisco 3102,
Cisco 3103
| 8 MB Flash
| 6 MB RAM
|
| Flash
|
8 MB Flash
| 16 MB RAM
|
| RAM
|
Cisco 3104,
Cisco 3204
| 8 MB Flash
| 6 MB RAM
|
| Flash
|
8 MB Flash
| 6 MB RAM11
|
| RAM12
|
| Cisco 4000/4000-M
|
| Cisco 4000
| Cisco 4000-M
|
|
IP Set
| 4 MB Flash
| 16 MB RAM
| 8 MB RAM
| RAM
|
IP Plus13 Set
| 4 MB Flash
| 16 MB RAM
| 8 MB RAM
| RAM
|
IP Plus 40 Set
| 4 MB Flash
| 16 MB RAM
| 8 MB RAM
| RAM
|
IP Plus 56 Set
| 4 MB Flash
| 16 MB RAM
| 8 MB RAM
| RAM
|
IP/IPX/AT/DEC Set
| 4 MB Flash
| 16 MB RAM
| 8 MB RAM
| RAM
|
IP/IPX/AT/DEC Plus Set
| 4 MB Flash
| 16 MB RAM
| 16 MB RAM
| RAM
|
IP/IPX/AT/DEC Plus 40 Set
| 4 MB Flash
| 16 MB RAM
| 16 MB RAM
| RAM
|
IP/IPX/AT/DEC Plus 56 Set
| 4 MB Flash
| 16 MB RAM
| 16 MB RAM
| RAM
|
IP/IPX/IBM/APPN Set
| 4 MB Flash
| 32 MB RAM
| 32 MB RAM
| RAM
|
Enterprise Set
| 4 MB Flash
| 16 MB RAM
| 16 MB RAM
| RAM
|
Enterprise Plus Set
| 8 MB Flash
| 16 MB RAM
| 16 MB RAM
| RAM
|
Enterprise Plus 40 Set
| 8 MB Flash
| 16 MB RAM
| 16 MB RAM
| RAM
|
Enterprise Plus 56 Set
| 8 MB Flash
| 16 MB RAM
| 16 MB RAM
| RAM
|
Enterprise/APPN Plus Set
| 8 MB Flash
| 32 MB RAM
| 32 MB RAM
| RAM
|
Enterprise/APPN Plus 40 Set
| 8 MB Flash
| 32 MB RAM
| 32 MB RAM
| RAM
|
Enterprise/APPN Plus 56 Set
| 8 MB Flash
| 32 MB RAM
| 32 MB RAM
| RAM
|
| Cisco 4500/4500-M
|
| Cisco 4500
| Cisco 4500-M
|
|
IP Set
| 4 MB Flash
| 32 MB RAM
| 16 MB RAM14
| RAM
|
IP Plus15 Set
| 4 MB Flash
| 32 MB RAM
| 16 MB RAM
| RAM
|
IP Plus 40 Set
| 4 MB Flash
| 32 MB RAM
| 16 MB RAM
| RAM
|
IP Plus 56 Set
| 4 MB Flash
| 32 MB RAM
| 32 MB RAM
| RAM
|
IP/IPX/AT/DEC Set
| 4 MB Flash
| 32 MB RAM
| 16 MB RAM
| RAM
|
IP/IPX/AT/DEC Plus Set
| 4 MB Flash
| 32 MB RAM
| 16 MB RAM
| RAM
|
IP/IPX/AT/DEC Plus 40 Set
| 4 MB Flash
| 32 MB RAM
| 16 MB RAM
| RAM
|
IP/IPX/AT/DEC Plus 56 Set
| 4 MB Flash
| 32 MB RAM
| 16 MB RAM
| RAM
|
IP/IPX/IBM/APPN Set
| 8 MB Flash
| 32 MB RAM
| 32 MB RAM
| RAM
|
Enterprise Set
| 8 MB Flash
| 32 MB RAM
| 16 MB RAM
| RAM
|
Enterprise Plus Set
| 8 MB Flash
| 32 MB RAM
| 16 MB RAM
| RAM
|
Enterprise Plus 40 Set
| 8 MB Flash
| 32 MB RAM
| 16 MB RAM
| RAM
|
Enterprise Plus 56 Set
| 8 MB Flash
| 32 MB RAM
| 16 MB RAM
| RAM
|
Enterprise/APPN Plus Set
| 8 MB Flash
| 32 MB RAM
| 32 MB RAM
| RAM
|
Enterprise/APPN Plus 40 Set
| 8 MB Flash
| 32 MB RAM
| 32 MB RAM
| RAM
|
Enterprise/APPN Plus 56 Set
| 8 MB Flash
| 32 MB RAM
| 32 MB RAM
| RAM
|
| Cisco 4700/4700-M
|
|
|
|
|
IP Set
| 4 MB Flash
| 16 MB RAM
|
| RAM
|
IP Plus15 Set
| 4 MB Flash
| 16 MB RAM
|
| RAM
|
IP Plus 40 Set
| 4 MB Flash
| 16 MB RAM
|
| RAM
|
IP Plus 56 Set
| 4 MB Flash
| 32 MB RAM
|
| RAM
|
IP//IPX/AT/DEC Set
| 4 MB Flash
| 16 MB RAM
|
| RAM
|
IP//IPX/AT/DEC Plus Set
| 4 MB Flash
| 16 MB RAM
|
| RAM
|
IP//IPX/AT/DEC Plus 40 Set
| 4 MB Flash
| 16 MB RAM
|
| RAM
|
IP//IPX/AT/DEC Plus 56 Set
| 4 MB Flash
| 16 MB RAM
|
| RAM
|
IP/IPX/IBM/APPN Set
| 8 MB Flash
| 32 MB RAM
|
| RAM
|
Enterprise Set
| 8 MB Flash
| 16 MB RAM
|
| RAM
|
Enterprise Plus Set
| 8 MB Flash
| 16 MB RAM
|
| RAM
|
Enterprise Plus 40 Set
| 8 MB Flash
| 16 MB RAM
|
| RAM
|
Enterprise Plus 56 Set
| 8 MB Flash
| 16 MB RAM
|
| RAM
|
Enterprise/APPN Plus Set
| 8 MB Flash
| 32 MB RAM
|
| RAM
|
Enterprise/APPN Plus 40 Set
| 8 MB Flash
| 32 MB RAM
|
| RAM
|
Enterprise/APPN Plus 56 Set
| 8 MB Flash
| 32 MB RAM
|
| RAM
|
Cisco 700016,
Cisco 7010
|
|
|
|
|
IP Set
| 8 MB Flash
| 16 MB RAM
|
| RAM
|
IP/Basic VIP Set
| 8 MB Flash
| 16 MB RAM
|
| RAM
|
Desktop/IBM Set
| 8 MB Flash
| 16 MB RAM
|
| RAM
|
Desktop/IBM/Basic VIP Set
| 8 MB Flash
| 16 MB RAM
|
| RAM
|
Desktop/IBM/APPN Set
| 8 MB Flash
| 16 MB RAM
|
| RAM
|
Desktop/IBM/APPN/
Basic VIP Set
| 8 MB Flash
| 16 MB RAM
|
| RAM
|
Enterprise Set
| 8 MB Flash memory card
| 16 MB RAM
|
| RAM
|
Enterprise/Basic VIP Set
| 8 MB Flash
| 16 MB RAM
|
| RAM
|
Enterprise/APPN Set
| 8 MB Flash
| 16 MB RAM
|
| RAM
|
Enterprise/APPN/Basic VIP Set
| 8 MB Flash
| 16 MB RAM
|
| RAM
|
| Source-Route Switch
| 4 MB Flash
| 16 MB RAM
|
| RAM
|
| Cisco 7200 Series
|
|
|
|
|
IP Set
| 4/8/16/20 MB Flash memory card
| 16 MB RAM
|
| Flash
|
Desktop/IBM/APPN Set
| 8/16/20 MB Flash memory card
| 24 MB RAM
|
| Flash
|
Enterprise Set
| 8/16/20 MB Flash memory card
| 16 MB RAM
|
| Flash
|
Enterprise/APPN Set
| 8/16/20 MB Flash memory card
| 24 MB RAM
|
| Flash
|
Desktop/IBM Set
| 4/8/16/20 MB Flash memory card
| 16 MB RAM
|
| Flash
|
Network Layer 3 Switching Set
| 8/16/20 MB Flash memory card
| 16 MB RAM
|
| Flash
|
| Cisco 7500 Series and Cisco 7000 with RSP700017
|
| Cisco 7513 only
| All Others
|
|
IP Set
| 8/16/20 MB Flash memory card
| 32 MB RAM
| 32 MB RAM
| RAM
|
IP/Encryption 40 Set
| 8/16/20 MB Flash memory card
| 32 MB RAM
| 32 MB RAM
| RAM
|
IP/Encryption 56 Set
| 8/16/20 MB Flash memory card
| 32 MB RAM
| 32 MB RAM
| RAM
|
Desktop/IBM Set
| 8/16/20 MB Flash memory card
| 32 MB RAM
| 32 MB RAM
| RAM
|
Desktop/IBM/APPN Set
| 16/20 MB Flash memory card
| 32 MB RAM
| 32 MB RAM
| RAM
|
Desktop/IBM/
Encryption 40 Set
| 8/16/20 MB Flash memory card
| 32 MB RAM
| 32 MB RAM
| RAM
|
Desktop/IBM/
Encryption 56 Set
| 8/16/20 MB Flash memory card
| 32 MB RAM
| 32 MB RAM
| RAM
|
Enterprise Set8/
| 8/16/20 MB Flash memory card
| 32 MB RAM
| 32 MB RAM
| RAM
|
Enterprise/Encryption 40 Set
| 8/16/20 MB Flash memory card
| 32 MB RAM
| 32 MB RAM
| RAM
|
Enterprise/Encryption 56 Set
| 8/16/20 MB Flash memory card
| 32 MB RAM
| 32 MB RAM
| RAM
|
Enterprise/APPN Set
| 8/16/20 MB Flash memory card
| 32 MB RAM
| 32 MB RAM
| RAM
|
Enterprise/APPN/
Encryption 40 Set
| 8/16/20 MB Flash memory card
| 32 MB RAM
| 32 MB RAM
| RAM
|
Enterprise/APPN/
Encryption 56 Set
| 8/16/20 MB Flash memory card
| 32 MB RAM
| 32 MB RAM
| RAM
|
1If you need to upgrade the main memory for your Cisco 1003, Cisco 1004, or Cisco 1005 router, be sure to order the upgrade specific to your router.
2Only 4 MB DRAM is recommended for releases 11.2(1) through 11.2(6).
3Plus for the Cisco 1003 and Cisco 1004 includes OSPF, PIM, SMRP, NLSP, ATIP, AppleTalk AURP, RSVP, and NAT.
4Only 2 MB Flash is recommended for releases 11.2(1) through 11.2(6).
5Plus for the Cisco 1005 includes OSPF, PIM, NLSP, SMRP, AppleTalk IP, AppleTalk AURP, Frame Relay SVC, RSVP, and NAT.
6For Cisco 2509 through Cisco 2512 access servers, and the Cisco 2522 and Cisco 2523 routers, 4 MB DRAM is the minimum recommended.
7Plus for the Cisco 2500 Series includes NAT, RMON, and IBM (if IBM is not already included).
8The OSPF LANFRAD feature set is available in Release 11.2(4) and later.
9Memory recommendations listed are per card. Each AS5100 supports up to three cards, so that the maximum memory needed for any AS5100 is three times the listed number.
10Plus for the Cisco AS5200 includes protocol translation, V.120, RMON, Managed Modems, and IBM (if IBM is not already included).
11The memory recommendation for the Enterprise feature set is 16 MB.
12The Enterprise feature set must be uncompressed to run from RAM on the Cisco 3104 and Cisco 3204.
13Plus for the Cisco 4000 and Cisco 4000-M includes NAT and IBM (if IBM is not already included).
14The Cisco 4500 requires 16 MB DRAM when two NP-CT1 or two NP-CE1 Network Processor Modules are installed in the chassis.
15Plus for the Cisco 4500, Cisco 4500-M, Cisco 4700, and Cisco 4700-M includes NAT, ISL, LANE, and IBM (if IBM is not already included).
16Except the Cisco 7000 with RSP7000. For a Cisco 7000 with an RSP7000 card, refer to the memory recommendations for Cisco 7500 series platforms.
17All feature sets for the Cisco 7500 Series and Cisco 7000 with RSP7000 include VIP support.
|
The Cisco IOS software is available in different feature sets depending upon the platform. Table 11 lists the feature sets for the Cisco 7500 and Cisco 7000 series. Table 12 lists the feature sets for the Cisco 7200 series. Table 13 lists the optional feature set licenses for the Cisco 7000, Cisco 7200, and Cisco 7500 series. Table 14 lists the feature sets for the Cisco 2500 series, Cisco 4000, Cisco 4500, and Cisco 4700 series. Table 15 lists platform-specific feature sets for the Cisco 2500 series and Cisco AS5100. Table 16 lists the feature sets for the Cisco AS5200. Table 17 lists the software for the Cisco 1003 and Cisco 1004 ISDN routers and the Cisco 1005 router. Table 18 lists platform-specific software for the Cisco 1005 router.
The tables use the following conventions to identify features:
- Yes: the feature is offered in the basic feature set
- ---: the feature is not offered in the feature set
- Plus: the feature is offered only in the Plus feature sets, not in the basic feature set
- Encrypt: for the Cisco 7500 series, the feature is offered only in the encryption feature sets (Encryption 40, Plus 40, Encryption 56, or Plus 56), not in the basic feature set
|
Note Encryption is not available on the Cisco AS5200, Cisco 7000 series, and Cisco 7200 series platforms.
Some Cisco platforms incorporate plus features into their basic feature sets. |
Table 11: Cisco 7000 Series and Cisco 7500 Series Software Feature Sets
|
| Feature Set
|
|---|
| Feature
| IP Routing
| Desktop/IBM1
| Enterprise1
|
|---|
| LAN Support
|
|
|
|
Apollo Domain
| ---
| ---
| Yes
|
AppleTalk 1 and 22
| ---
| Yes
| Yes
|
Banyan VINES
| ---
| ---
| Yes
|
Concurrent routing and bridging (CRB)3
| Yes
| Yes
| Yes
|
DECnet IV
| ---
| Yes
| Yes
|
DECnet V
| ---
| ---
| Yes
|
GRE
| Yes
| Yes
| Yes
|
Integrated routing and bridging (IRB)4
| Yes
| Yes
| Yes
|
IP
| Yes
| Yes
| Yes
|
LAN extension host
| Yes
| Yes
| Yes
|
Multiring
| Yes
| Yes
| Yes
|
Novell IPX5
| ---
| Yes
| Yes
|
OSI
| ---
| ---
| Yes
|
Transparent and translational bridging
| Yes
| Yes
| Yes
|
VLANs (ISL6 and IEEE 802.10)
| Yes
| Yes
| Yes
|
XNS
| ---
| ---
| Yes
|
| WAN Services
|
|
|
|
ATM LAN emulation: DECnet routing, XNS routing, and Banyan VINES support
| Yes
| Yes
| Yes
|
ATM LAN emulation: Hot Standby Router Protocol (HSRP) and
Simple Server Redundancy Protocol (SSRP)
| Yes
| Yes
| Yes
|
ATM: Rate queues for SVC per subinterface
| Yes
| Yes
| Yes
|
ATM: UNI 3.1 signaling for ATM
| Yes
| Yes
| Yes
|
Combinet Packet Protocol (CPP)
| Yes
| Yes
| Yes
|
Dialer profiles
| Yes
| Yes
| Yes
|
Half bridge/half router for CPP and PPP
| Yes
| Yes
| Yes
|
HDLC
| Yes
| Yes
| Yes
|
IPXWAN 2.0
| ---
| Yes
| Yes
|
ISDN7
| Yes
| Yes
| Yes
|
Multichassis Multilink PPP (MMP)
| ---
| ---
| Yes
|
NetBEUI over PPP
| Yes (7000 series only)
| Yes (7000 series only)
| Yes
|
PPP8
| Yes
| Yes
| Yes
|
Virtual Private Dial-up Network (VPDN)
| Yes
| Yes
| Yes
|
| WAN Optimization
|
|
|
|
Bandwidth-on-demand
| Yes
| Yes
| Yes
|
Custom and priority queueing9
| Yes
| Yes
| Yes
|
Dial backup
| Yes
| Yes
| Yes
|
Dial-on-demand
| Yes
| Yes
| Yes
|
Header10, link and payload compression11
| Yes
| Yes
| Yes
|
Named IP Access Control List
| Yes
| Yes
| Yes
|
NetFlow Switching (NFS)12
| Yes
| Yes
| Yes
|
Snapshot routing
| Yes
| Yes
| Yes
|
Weighted fair queueing9
| Yes
| Yes
| Yes
|
| IP Routing
|
|
|
|
Enhanced IGRP
| Yes
| Yes
| Yes
|
Enhanced IGRP Optimizations
| Yes
| Yes
| Yes
|
ES-IS
| ---
| ---
| Yes
|
IGRP
| Yes
| Yes
| Yes
|
IS-IS
| ---
| ---
| Yes
|
Named IP Access Control List13
| Yes
| Yes
| Yes
|
NHRP
| Yes
| Yes
| Yes
|
Network Address Translation (NAT)14
| Yes
| Yes
| Yes
|
On Demand Routing (ODR)
| Yes
| Yes
| Yes
|
OSPF
| Yes
| Yes
| Yes
|
OSPF Not-So-Stubby-Areas (NSSA)
| Yes
| Yes
| Yes
|
OSPF On Demand Circuit (RFC 1793)
| Yes
| Yes
| Yes
|
PIM
| Yes
| Yes
| Yes
|
Policy-based routing
| Yes
| Yes
| Yes
|
RIP
| Yes
| Yes
| Yes
|
RIP Version 2
| Yes
| Yes
| Yes
|
| Other Routing
|
|
|
|
AURP
| ---
| Yes
| Yes
|
IPX RIP
| ---
| Yes
| Yes
|
NLSP
| ---
| Yes
| Yes
|
RTMP
| ---
| Yes
| Yes
|
SMRP
| ---
| Yes
| Yes
|
SRTP
| ---
| ---
| Yes
|
| Multimedia and Quality of Service
|
|
|
|
Generic traffic shaping
| Yes
| Yes
| Yes
|
Random Early Detection (RED)
| Yes
| Yes
| Yes
|
Resource Reservation Protocol (RSVP)
| Yes
| Yes
| Yes
|
| Management
|
|
|
|
AutoInstall
| Yes
| Yes
| Yes
|
Automatic modem configuration
| Yes
| Yes
| Yes
|
HTTP Server
| Yes
| Yes
| Yes
|
RMON events and alarms
| Yes
| Yes
| Yes
|
SNMP
| Yes
| Yes
| Yes
|
Telnet
| Yes
| Yes
| Yes
|
| Security
|
|
|
|
Access lists
| Yes
| Yes
| Yes
|
Access security
| Yes
| Yes
| Yes
|
Extended access lists
| Yes
| Yes
| Yes
|
Kerberized login
| ---
| ---
| Yes
|
Kerberos V client support
| ---
| ---
| Yes
|
Lock and Key
| Yes
| Yes
| Yes
|
MD5 routing authentication
| Yes
| Yes
| Yes
|
Router authentication and network layer encryption (40-bit or export controlled 56-bit DES)15
| Encrypt
| Encrypt
| Encrypt
|
RADIUS
| Yes
| Yes
| Yes
|
TACACS+16
| Yes
| Yes
| Yes
|
| IBM Support
|
|
|
|
APPN (optional)1
| ---
| Yes
| Yes
|
BAN for SNA Frame Relay support
| ---
| Yes
| Yes
|
Caching and filtering
| ---
| Yes
| Yes
|
DLSW+17, 18
| ---
| Yes
| Yes
|
Downstream PU concentration (DSPU)
| ---
| Yes
| Yes
|
Frame Relay SNA support (RFC 1490)
| ---
| Yes
| Yes
|
Native Client Interface Architecture (NCIA) Server
| ---
| Yes
| Yes
|
NetView Native Service Point
| ---
| Yes
| Yes
|
QLLC
| ---
| Yes
| Yes
|
Response Time Reporter (RTR)
| ---
| Yes
| Yes
|
SDLC integration
| ---
| Yes
| Yes
|
SDLC transport (STUN)
| ---
| Yes
| Yes
|
SDLC-to-LAN conversion (SDLLC)
| ---
| Yes
| Yes
|
SNA and NetBIOS WAN optimization via local acknowledgment
| ---
| Yes
| Yes
|
SRB/RSRB19
| ---
| Yes
| Yes
|
SRT
| ---
| Yes
| Yes
|
TG/COS
| ---
| ---
| Yes
|
TN3270 Server (CIP only)
| ---
| Yes
| Yes
|
| VIP and HSA
|
|
|
|
VIP and HSA20
| Yes
| Yes
| Yes
|
VIP221
| Yes
| Yes
| Yes
|
1Desktop/IBM and Enterprise are available with APPN in a separate feature set. In Cisco IOS Release 11.2, APPN includes APPN Central Registration (CRR) and APPN over DLSw+.
2Includes AppleTalk load balancing.
3Concurrent routing and bridging feature only applies to transparent bridging, not source-route bridging (SRB).
4IRB is not supported on the Cisco 7000 series. On the 7500 series, IRB supports IP, IPX, and AppleTalk; it is supported for transparent bridging, but not for SRB; it is supported on all media-type interfaces except X.25 and ISDN bridged interfaces; and IRB and concurrent routing and bridging (CRB) cannot operate at the same time.
5The Novell IPX feature includes display SAP by name, IPX Access Control List violation logging, and plain-English IPX access lists.
6Note that the only IPX encapsulation supported in ISL is 802.3.
7ISDN support includes calling line identification (ANI), X.25 over the B channel, ISDN subaddressing, and applicable WAN optimization features. Asynchronous ISDN Access (V.120) is only supported in the Enterprise feature set.
8PPP includes support for LAN protocols supported by the feature set, address negotiation, PAP and CHAP authentication, and PPP compression.
9Custom and priority queueing is not currently supported on SMIP or MIP cards.
10IPX header compression (RFC 1553) is available in the feature sets that support IPX.
11X.25 and Frame Relay payload compression.
12NFS is supported on the Cisco 7500 series and Cisco 7000 series with a Route Switch Processor (RSP) only. NFS supports IP over all interfaces with optimal performance on Ethernet, FDDI, and HDLC.
13Named IP Access Control List can only be used by packet and route filters, it is not backward-compatible with earlier Cisco IOS releases, and is not supported with Distributed Fast Switching.
14On the Cisco 7000, NAT is supported with the RSP option only.
15 For more details on the new data encryption options, see the beginning of the section "Supported Feature Sets for 11.2," Encryption is not supported on the Cisco 7000.
16TACACS+ Single Connection and TACACS+ SENDAUTH enhancements are supported.
17DLSw+ over TCP/IP is supported.
18Cisco IOS Release 11.2 introduces several DLSw+ enhancements. See the section ""IBM Functionality"" in the ""New Features in Release 11.2(1)"" section for more details.
19SRB/RSRB is fast switched. This enhancement is on by default, but can be disabled.
20HSA support requires Cisco IOS Release 11.1(2) or later releases and is available on the Cisco 7500 series only.
21VIP2 support requires Cisco IOS Release 11.1(5) or later releases, and the RSP7000 for the Cisco 7000 series.
|
Table 12: Cisco 7200 Series Software Feature Sets
|
| Feature Set
|
|---|
| Feature
| Network Layer 3 Switching
|
IP Routing
|
Desktop/IBM1
|
Enterprise1
|
|---|
| LAN Support
|
|
|
|
|
Apollo Domain
| ---
| ---
| ---
| Yes
|
AppleTalk 1 and 22
| ---
| ---
| Yes
| Yes
|
Banyan VINES
| ---
| ---
| ---
| Yes
|
Concurrent routing and bridging (CRB)3
| Yes
| Yes
| Yes
| Yes
|
DECnet IV
| ---
| ---
| Yes
| Yes
|
DECnet V
| ---
| ---
| ---
| Yes
|
GRE
| ---
| Yes
| Yes
| Yes
|
Integrated routing and bridging (IRB)4
| ---
| ---
| ---
| ---
|
IP
| Yes
| Yes
| Yes
| Yes
|
LAN extension host
| Yes
| Yes
| Yes
| Yes
|
Multiring
| Yes
| Yes
| Yes
| Yes
|
Novell IPX5
| Yes
| ---
| Yes
| Yes
|
OSI
| ---
| ---
| ---
| Yes
|
Transparent and translational bridging
| Yes
| Yes
| Yes
| Yes
|
VLANs (ISL6 and IEEE 802.10)
| Yes
| Yes
| Yes
| Yes
|
XNS
| ---
| ---
| ---
| Yes
|
| WAN Services
|
|
|
|
|
Combinet Packet Protocol (CPP)
| Yes
| Yes
| Yes
| Yes
|
Dialer profiles
| Yes
| Yes
| Yes
| Yes
|
Half bridge/half router for CPP and PPP
| Yes
| Yes
| Yes
| Yes
|
HDLC
| Yes
| Yes
| Yes
| Yes
|
IPXWAN 2.0
| Yes
| ---
| Yes
| Yes
|
ISDN7
| ---
| Yes
| Yes
| Yes
|
Multichassis Multilink PPP (MMP)
| ---
| Yes
| Yes
| Yes
|
NetBEUI over PPP
| ---
| ---
| ---
| Yes
|
PPP8
| ---
| Yes
| Yes
| Yes
|
Virtual Private Dial-up Network (VPDN)
| ---
| Yes
| Yes
| Yes
|
| WAN Optimization
|
|
|
|
|
Bandwidth-on-demand
| ---
| Yes
| Yes
| Yes
|
Custom and priority queueing
| ---
| Yes
| Yes
| Yes
|
Dial backup
| ---
| Yes
| Yes
| Yes
|
Dial-on-demand
| ---
| Yes
| Yes
| Yes
|
Header9, link and payload compression10
| ---
| Yes
| Yes
| Yes
|
NetFlow Switching (NFS)11
| ---
| Yes
| Yes
| Yes
|
Snapshot routing
| Yes
| Yes
| Yes
| Yes
|
Weighted fair queueing
| ---
| Yes
| Yes
| Yes
|
| IP Routing
|
|
|
|
|
Enhanced IGRP
| Yes
| Yes
| Yes
| Yes
|
Enhanced IGRP Optimizations
| Yes
| Yes
| Yes
| Yes
|
ES-IS
| ---
| ---
| ---
| Yes
|
IGRP
| Yes
| Yes
| Yes
| Yes
|
IS-IS
| ---
| ---
| ---
| Yes
|
Named IP Access Control List12
| ---
| Yes
| Yes
| Yes
|
Network Address Translation (NAT)
| Yes
| Yes
| Yes
| Yes
|
NHRP
| Yes
| Yes
| Yes
| Yes
|
On Demand Routing (ODR)
| Yes
| Yes
| Yes
| Yes
|
OSPF
| Yes
| Yes
| Yes
| Yes
|
OSPF Not-So-Stubby-Areas (NSSA)
| Yes
| Yes
| Yes
| Yes
|
OSPF On Demand Circuit (RFC 1793)
| Yes
| Yes
| Yes
| Yes
|
PIM
| Yes
| Yes
| Yes
| Yes
|
Policy-based routing
| Yes
| Yes
| Yes
| Yes
|
RIP
| Yes
| Yes
| Yes
| Yes
|
RIP Version 2
| Yes
| Yes
| Yes
| Yes
|
| Other Routing
|
|
|
|
|
AURP
| ---
| ---
| Yes
| Yes
|
IPX RIP
| Yes
| ---
| Yes
| Yes
|
NLSP
| Yes
| ---
| Yes
| Yes
|
RTMP
| Yes
| Yes
| Yes
| Yes
|
SMRP
| ---
| ---
| Yes
| Yes
|
SRTP
| ---
| ---
| ---
| Yes
|
| Multimedia and Quality of Service
|
|
|
|
|
Generic traffic shaping
| Yes
| Yes
| Yes
| Yes
|
Random Early Detection (RED)
| Yes
| Yes
| Yes
| Yes
|
Resource Reservation Protocol (RSVP)
| Yes
| Yes
| Yes
| Yes
|
| Management
|
|
|
|
|
AutoInstall
| Yes
| Yes
| Yes
| Yes
|
HTTP Server
| Yes
| Yes
| Yes
| Yes
|
RMON events and alarms
| Yes
| Yes
| Yes
| Yes
|
SNMP
| Yes
| Yes
| Yes
| Yes
|
Telnet
| Yes
| Yes
| Yes
| Yes
|
| Security
|
|
|
|
|
Access lists
| Yes
| Yes
| Yes
| Yes
|
Access security
| Yes
| Yes
| Yes
| Yes
|
Extended access lists
| Yes
| Yes
| Yes
| Yes
|
Kerberized login
| ---
| ---
| ---
| Yes
|
Kerberos V client support
| ---
| ---
| ---
| Yes
|
Lock and key
| Yes
| Yes
| Yes
| Yes
|
MD5 routing authentication
| Yes
| Yes
| Yes
| Yes
|
RADIUS
| Yes
| Yes
| Yes
| Yes
|
TACACS+13
| Yes
| Yes
| Yes
| Yes
|
| IBM Support
|
|
|
|
|
APPN (optional)1
| ---
| ---
| Yes
| Yes
|
BAN for SNA Frame Relay support
| ---
| ---
| Yes
| ---
|
Caching and filtering
| ---
| ---
| Yes
| Yes
|
DLSw+14, 15
| ---
| ---
| Yes
| Yes
|
Downstream PU concentration (DSPU)
| ---
| ---
| Yes
| Yes
|
Frame Relay SNA support (RFC 1490)
| ---
| ---
| Yes
| Yes
|
Native Client Interface Architecture (NCIA) Server
| ---
| ---
| Yes
| Yes
|
NetView Native Service Point
| ---
| ---
| Yes
| Yes
|
Response Time Reporter (RTR)
| ---
| ---
| Yes
| Yes
|
QLLC
| ---
| ---
| Yes
| Yes
|
SDLC integration
| ---
| ---
| Yes
| Yes
|
SDLC transport (STUN)
| ---
| ---
| Yes
| Yes
|
SDLC-to-LAN conversion (SDLLC)
| ---
| ---
| Yes
| Yes
|
SNA and NetBIOS WAN optimization
via local acknowledgment
| ---
| ---
| Yes
| Yes
|
SRB/RSRB16
| Yes
| ---
| Yes
| Yes
|
SRT
| Yes
| ---
| Yes
| Yes
|
TG/COS
| ---
| ---
| ---
| Yes
|
1Desktop/IBM and Enterprise are available with APPN in a separate feature set. Use the product numbers that specify APPN. APPN includes APPN Central Registration (CRR) and APPN over DLSw+.
2Includes AppleTalk load balancing.
3Concurrent routing and bridging feature only applies to transparent bridging, not source-route bridging (SRB).
4Releases 11.2(1) through 11.2(3) do not support IRB. In a later maintenance release: IRB supports IP, IPX, and AppleTalk; it is supported for transparent bridging, but not for SRB; it is supported on all media-type interfaces except X.25 and ISDN bridged interfaces; and IRB and concurrent routing and bridging (CRB) cannot operate at the same time.
5The Novell IPX feature includes display SAP by name, IPX Access Control List violation logging, and plain-English IPX access lists.
6Note that the only IPX encapsulation supported in ISL is 802.3.
7ISDN support includes calling line identification (ANI), X.25 over the B channel, ISDN subaddressing, and applicable WAN optimization features. Asynchronous ISDN Access (V.120) is only supported in the Enterprise feature set.
8PPP includes support for LAN protocols supported by the feature set, address negotiation, PAP and CHAP authentication, and PPP compression.
9IPX header compression (RFC 1553) is available in the feature sets that support IPX.
10X.25 and Frame Relay payload compression.
11NFS supports IP over all interfaces with optimal performance on Ethernet, FDDI, and HDLC.
12This feature can only be used by packet and route filters, it is not backward-compatible with earlier Cisco IOS releases, and is not supported with Distributed Fast Switching.
13TACACS+ Single Connection and TACACS+ SENDAUTH enhancements are supported.
14DLSw+ over TCP/IP is supported.
15Cisco IOS Release 11.2 introduces several DLSw+ enhancements. See the section ""IBM Functionality"" in the ""New Features in Release 11.2(1)"" section for more details.
16SRB/RSRB is fast switched. This enhancement is on by default, but can be disabled.
|
Table 13: Optional Feature Set Licenses---Cisco 7000 Series,
Cisco 7200 Series, and Cisco 7500 Series
Cisco 7000 Series, Cisco 7200 Series, and Cisco 7500 Series
Optional Feature Set Licenses
|
| WAN Packet Protocols
|
ATM DXI
|
Frame Relay
|
Frame Relay switching
|
Frame Relay SVC support (DTE)
|
Frame Relay traffic shaping
|
SMDS over ATM
|
X.25
|
X.25 switching
|
| Interdomain Routing1
|
BGP
|
BGP42
|
EGP for Internet scale routing
|
| VIP/VIP2 support3
|
Included automatically with VIP order
|
| CIP Support3, 4
|
SNA support
|
TCP/IP offload
|
| NetFlow Switching5
|
NetFlow Switching software
|
1Interdomain routing is automatically included with all Cisco 7000 series RPs with 16-MB RAM. However, this option is appropriate for all other Cisco 7000, 7200, and 7500 series system processors.
2BGP4 includes soft configuration, multipath support, and prefix filtering with inbound route maps.
3Cisco 7000 and 7500 series only.
4CIP orders must include one or both of the licenses.
5Cisco 7200 series only.
|
Table 14: Cisco 2500 Series, Cisco 4000, Cisco 4500, and Cisco 4700 Software Feature Sets
|
| Feature Set
|
|---|
| Feature
| IP Routing
| IP/IPX/IBM/APPN1
| Desktop
(IP/IPX/AppleTalk/DEC)
| Enterprise2
|
|---|
| LAN Support
|
|
|
|
|
Apollo Domain
| ---
| ---
| ---
| Yes
|
AppleTalk 1 and 23
| ---
| ---
| Yes
| Yes
|
Banyan VINES
| ---
| ---
| ---
| Yes
|
Concurrent routing and bridging (CRB)
| Yes
| Yes
| Yes
| Yes
|
DECnet IV
| ---
| ---
| Yes
| Yes
|
DECnet V
| ---
| ---
| ---
| Yes
|
GRE
| Yes
| Yes
| Yes
| Yes
|
Integrated routing and bridging (IRB)4
| Yes
| Yes
| Yes
| Yes
|
IP
| Yes
| Yes
| Yes
| Yes
|
LAN extension host
| Yes
| Yes
| Yes
| Yes
|
Multiring
| Yes
| Yes
| Yes
| Yes
|
Novell IPX5
| ---
| Yes
| Yes
| Yes
|
OSI
| ---
| ---
| ---
| Yes
|
Source-route bridging6
| ---
| ---
| ---
| ---
|
Transparent and translational bridging
| Yes
| Yes
| Yes
| Yes
|
VLANs (ISL7 and IEEE 802.10) (Cisco 4500 only)
| Plus
| ---
| Plus
| Plus
|
XNS
| ---
| ---
| ---
| Yes
|
| WAN Services
|
|
|
|
|
ATM LAN emulation: DECnet routing, XNS routing, and Banyan VINES support (Cisco 4500 and 4700 only)8
| ---
| ---
| Plus
| Plus
|
ATM LAN emulation: Hot Standby Router Protocol (HSRP) and
Simple Server Redundancy Protocol (SSRP)
(Cisco 4500 and 4700 only)
| Plus
| ---
| Plus
| Plus
|
ATM: Rate queues for SVC per subinterface (Cisco 4000, 4500, and 4700 only)
| Plus
| ---
| Plus
| Plus
|
ATM: UNI 3.1 signaling for ATM
(Cisco 4500 and 4700 only)
| Plus
| ---
| Plus
| Plus
|
Combinet Packet Protocol (CPP)
| Yes
| Yes
| Yes
| Yes
|
Dialer profiles
| Yes
| Yes
| Yes
| Yes
|
Frame Relay
| Yes
| Yes
| Yes
| Yes
|
Frame Relay SVC Support (DTE)
| ---
| ---
| ---
| Yes
|
Frame Relay traffic shaping
| Yes
| Yes
| Yes
| Yes
|
Half bridge/half router for CPP and PPP
| Yes
| Yes
| Yes
| Yes
|
HDLC
| Yes
| Yes
| Yes
| Yes
|
IPXWAN 2.0
| ---
| Yes
| Yes
| Yes
|
ISDN9
| Yes
| Yes
| Yes
| Yes
|
Multichassis Multilink PPP (MMP)
| ---
| ---
| ---
| Yes
|
NetBEUI over PPP
| ---
| ---
| ---
| Yes
|
PPP10
| Yes
| Yes
| Yes
| Yes
|
SMDS
| Yes
| Yes
| Yes
| Yes
|
Switched 56
| Yes
| Yes
| Yes
| Yes
|
Virtual Private Dial-up Network (VPDN)
| Plus
| ---
| Plus
| Yes
|
X.2511
| Yes
| Yes
| Yes
| Yes
|
| WAN Optimization
|
|
|
|
|
Bandwidth-on-demand
| Yes
| Yes
| Yes
| Yes
|
Custom and priority queueing
| Yes
| Yes
| Yes
| Yes
|
Dial backup
| Yes
| Yes
| Yes
| Yes
|
Dial-on-demand
| Yes
| Yes
| Yes
| Yes
|
Header12, link and payload compression
| Yes
| Yes
| Yes
| Yes
|
Snapshot routing
| Yes
| Yes
| Yes
| Yes
|
Weighted fair queueing
| Yes
| Yes
| Yes
| Yes
|
| IP Routing
|
|
|
|
|
BGP
| Yes
| Yes
| Yes
| Yes
|
BGP413
| Yes
| Yes
| Yes
| Yes
|
EGP
| Yes
| Yes
| Yes
| Yes
|
Enhanced IGRP
| Yes
| Yes
| Yes
| Yes
|
Enhanced IGRP Optimizations
| Yes
| Yes
| Yes
| Yes
|
ES-IS
| ---
| ---
| ---
| Yes
|
IGRP
| Yes
| Yes
| Yes
| Yes
|
IS-IS
| ---
| ---
| ---
| Yes
|
Named IP Access Control List
| Yes
| Yes
| Yes
| Yes
|
Network Address Translation (NAT)
| Plus
| ---
| Plus
| Plus
|
NHRP
| Yes
| Yes
| Yes
| Yes
|
On Demand Routing (ODR)
| Yes
| Yes
| Yes
| Yes
|
OSPF
| Yes
| Yes
| Yes
| Yes
|
OSPF Not-So-Stubby-Areas (NSSA)
| Yes
| Yes
| Yes
| Yes
|
OSPF On Demand Circuit (RFC 1793)
| Yes
| Yes
| Yes
| Yes
|
PIM
| Yes
| Yes
| Yes
| Yes
|
Policy-based routing
| Yes
| Yes
| Yes
| Yes
|
RIP
| Yes
| Yes
| Yes
| Yes
|
RIP Version 2
| Yes
| Yes
| Yes
| Yes
|
| Other Routing
|
|
|
|
|
AURP
| ---
| ---
| Yes
| Yes
|
IPX RIP
| ---
| Yes
| Yes
| Yes
|
NLSP
| ---
| Yes
| Yes
| Yes
|
RTMP
| ---
| ---
| Yes
| Yes
|
SMRP
| ---
| ---
| Yes
| Yes
|
SRTP
| ---
| ---
| ---
| Yes
|
| Multimedia and Quality of Service
|
|
|
|
|
Generic traffic shaping
| Yes
| Yes
| Yes
| Yes
|
Random Early Detection (RED)14
| Yes
| Yes
| Yes
| Yes
|
Resource Reservation Protocol (RSVP)14
| Yes
| Yes
| Yes
| Yes
|
| Management
|
|
|
|
|
AutoInstall
| Yes
| Yes
| Yes
| Yes
|
Automatic modem configuration
| Yes
| Yes
| Yes
| Yes
|
HTTP Server
| Yes
| Yes
| Yes
| Yes
|
RMON events and alarms15
| Yes
| Yes
| Yes
| Yes
|
RMON full (Cisco 2500 only)
| Plus
| Plus
| Plus
| Plus
|
SNMP
| Yes
| Yes
| Yes
| Yes
|
Telnet
| Yes
| Yes
| Yes
| Yes
|
| Security
|
|
|
|
|
Access lists
| Yes
| Yes
| Yes
| Yes
|
Access security
| Yes
| Yes
| Yes
| Yes
|
Extended access lists
| Yes
| Yes
| Yes
| Yes
|
Kerberized login
| ---
| ---
| ---
| Yes
|
Kerberos V client support
| ---
| ---
| ---
| Yes
|
Lock and key
| Yes
| Yes
| Yes
| Yes
|
MAC security for hubs16
| Yes
| Yes
| Yes
| Yes
|
MD5 routing authentication
| Yes
| Yes
| Yes
| Yes
|
Router authentication and network layer encryption (40-bit or export controlled 56-bit DES)17
| Encrypt
| ---
| Encrypt
| Encrypt
|
RADIUS
| Yes
| Yes
| Yes
| Yes
|
TACACS+18
| Yes
| Yes
| Yes
| Yes
|
| IBM Support (Optional)
|
|
|
|
|
APPN (optional)2
| ---
| Yes
| ---
| Yes
|
BAN for SNA Frame Relay support
| Plus
| Yes
| Plus
| Yes
|
Bisync
| Plus
| Yes
| Plus
| Yes
|
Caching and filtering
| Plus
| Yes
| Plus
| Yes
|
DLSw+ 19
| Plus
| Yes
| Plus
| Yes
|
Downstream PU concentration (DSPU)
| Plus
| Yes
| Plus
| Yes
|
Frame Relay SNA support (RFC 1490)
| Plus
| Yes
| Plus
| Yes
|
Native Client Interface Architecture (NCIA) Server
| Plus
| Yes
| Plus
| Yes
|
NetView Native Service Point
| Plus
| Yes
| Plus
| Yes
|
QLLC
| Plus
| Yes
| Plus
| Yes
|
Response Time Reporter (RTR)
| Plus
| Yes
| Plus
| Yes
|
SDLC integration
| Plus
| Yes
| Plus
| Yes
|
SDLC transport (STUN)
| Plus
| Yes
| Plus
| Yes
|
SDLC-to-LAN conversion (SDLLC)
| Plus
| Yes
| Plus
| Yes
|
SNA and NetBIOS WAN optimization
via local acknowledgment
| Plus
| Yes
| Plus
| Yes
|
SRB/RSRB20
| Plus
| Yes
| Plus
| Yes
|
SRT
| Plus
| Yes
| Plus
| Yes
|
TG/COS
| ---
| ---
| ---
| Yes
|
TN3270
| ---
| ---
| ---
| Yes
|
| Protocol Translation
|
|
|
|
|
LAT
| ---
| ---
| ---
| Yes
|
Rlogin
| ---
| ---
| ---
| Yes
|
| Remote Node21
|
|
|
|
|
ARAP 1.0/2.022
| ---
| ---
| Yes
| Yes
|
Asynchronous master interfaces
| Yes
| Yes
| Yes
| Yes
|
ATCP
| ---
| ---
| Yes
| Yes
|
CPPP
| Yes
| Yes
| Yes
| Yes
|
CSLIP
| Yes
| Yes
| Yes
| Yes
|
DHCP
| Yes
| Yes
| Yes
| Yes
|
IP pooling
| Yes
| Yes
| Yes
| Yes
|
IPX and ARAP on virtual async interfaces
| ---
| ---
| ---
| Yes
|
IPXCP12
| ---
| Yes
| Yes
| Yes
|
MacIP
| ---
| ---
| Yes
| Yes
|
NASI
| ---
| Yes
| Yes
| Yes
|
PPP
| Yes
| Yes
| Yes
| Yes
|
SLIP
| Yes
| Yes
| Yes
| Yes
|
| Terminal Services21
|
|
|
|
|
LAT23
| ---
| ---
| ---
| Yes
|
Rlogin
| Yes
| Yes
| Yes
| Yes
|
Telnet
| Yes
| Yes
| Yes
| Yes
|
TN3270
| ---
| ---
| ---
| Yes
|
X.25 PAD
| Yes
| Yes
| Yes
| Yes
|
Xremote
| ---
| ---
| ---
| Yes
|
1This feature set has no additional options. It offers a low-end APPN solution for this set of hardware platforms. This feature set is not available for AccessPro PC cards.
2Enterprise is available with APPN in a separate feature set. APPN includes APPN Central Registration (CRR) and APPN over DLSw+. APPN is not available on the AccessPro PC Card.
3Includes AppleTalk load balancing.
4IRB supports IP, IPX, and AppleTalk; it is supported for transparent bridging, but not for SRB; it is supported on all media-type interfaces except X.25 and ISDN bridged interfaces; and IRB and concurrent routing and bridging (CRB) cannot operate at the same time.
5The Novell IPX feature includes display SAP by name, IPX Access Control List violation logging, and plain-English IPX access lists.
6Translational bridging is fast switched by default but can be disabled.
7Note that the only IPX encapsulation supported in ISL is 802.3.
8ATM LAN emulation for Banyan VINES is only supported in Enterprise. The Desktop feature set supports DECnet only.
9ISDN support includes calling line identification (ANI), X.25 over the B channel, ISDN subaddressing, and applicable WAN optimization features.
10PPP includes support for LAN protocols supported by the feature set, address negotiation, PAP and CHAP authentication, Multilink PPP, and PPP compression.
11X.25 includes X.25 switching.
12IPX header compression (RFC 1553) is available in the feature sets that support IPX.
13BGP4 includes soft configuration, multipath support, and prefix filtering with inbound route maps.
14RED and RSVP are supported in IP/IPX/IBM/APPN for the Cisco 4000, 4500, and 4700 only.
15The RMON events and alarms groups are supported on all interfaces. Full RMON support is available with the Plus feature sets.
16MAC security for hubs is applicable to the following Cisco 2500 series Ethernet hub models: Cisco 2505, Cisco 2507, Cisco 2516, and Cisco 2518.
17For more details, see the description of the new data encryption options in the see the beginning of the section ""Supported Feature Sets for 11.2,".
18TACACS+ Single Connection and TACACS+ SENDAUTH enhancements are supported.
19Cisco IOS Release 11.2 introduces several DLSw+ enhancements available in the Plus, Plus 40, and Plus 56 feature sets.
20SRB/RSRB is fast switched. This enhancement is on by default, but can be disabled.
21Supported on access severs (with limited support on router auxiliary ports).
22The Cisco 4000, Cisco 4500, and Cisco 4700 products do not support ARAP 1.0/2.0.
23Use of LAT requires terminal license (FR-L8-10.X= for an 8-user license or FR-L16-10.X= for a 16-user license).
|
Table 15: Platform-Specific Cisco 2500 Series and AS5100 Access Server Software Feature Sets
|
| Feature Set
|
|---|
| Feature
| ISDN
| CFRAD
| LAN FRAD
| OSPF LANFRAD1
| Remote Access Server
|
|---|
| Platforms Supported
|
|
|
|
|
|
Cisco 2500 series routers: models 2501, 2502, 2505, 2507, 2509-2515, 2524
| ---
| ---
| ---
| ---
| ---
|
Cisco 2503I, Cisco 2504I
| Yes
| ---
| ---
| ---
| ---
|
Cisco 2501CF, Cisco 2502CF,
Cisco 2520CF-2523CF
| ---
| Yes
| ---
| ---
| ---
|
Cisco 2501LF, Cisco 2502LF,
Cisco 2520LF-2523LF
| ---
| ---
| Yes
| Yes
| ---
|
Cisco 2509-2512,
Cisco AS5100
| ---
| ---
| ---
| ---
| Yes
|
| LAN Support
|
|
|
|
|
|
AppleTalk 1 and 22
| Yes
| ---
| ---
| ---
| Yes
|
Concurrent routing and bridging (CRB)
| ---
| ---
| ---
| ---
| ---
|
DECnet IV
| ---
| ---
| ---
| ---
| ---
|
GRE
| Yes
| ---
| Yes
| Yes
| Yes
|
Integrated routing and bridging (IRB)3
| Yes
| Yes
| Yes
| Yes
| Yes
|
IP
| Yes
| Yes
| Yes
| Yes
| Yes
|
Multiring
| Yes
| ---
| Yes
| Yes
| Yes
|
Novell IPX4
| Yes
| ---
| Yes
| Yes
| Yes
|
Source-route bridging
| ---
| Yes
| Yes
| Yes
| ---
|
Transparent bridging
| ---
| Yes
| Yes
| Yes
| Yes
|
Transparent and translational bridging5
| Yes
| Yes
| Yes
| Yes
| Yes
|
| WAN Services
|
|
|
|
|
|
Combinet Packet Protocol (CPP)
| Yes
| Yes
| Yes
| Yes
| Yes
|
Dialer profiles
| Yes
| Yes
| Yes
| Yes
| Yes
|
Frame Relay
| ---
| Yes
| Yes
| Yes
| Yes
|
Frame Relay traffic shaping
| Yes
| Yes
| Yes
| Yes
| Yes
|
Half bridge/half router for CPP and PPP
| Yes
| Yes
| Yes
| Yes
| Yes
|
HDLC
| ---
| ---
| ---
| ---
| Yes
|
IPXWAN 2.0
| ---
| ---
| Yes
| Yes
| Yes
|
ISDN6
| Yes
| ---
| ---
| ---
| ---
|
Multichassis Multilink PPP (MMP)
| ---
| ---
| ---
| ---
| Yes
|
NetBEUI over PPP
| ---
| ---
| ---
| ---
| Yes
|
PPP7
| Yes
| Yes
| Yes
| Yes
| Yes
|
SMDS
| ---
| ---
| ---
| ---
| ---
|
Switched 56
| ---
| ---
| ---
| ---
| Yes
|
Virtual Private Dial-up Network (VPDN)
| ---
| ---
| ---
| ---
| Yes
|
X.258
| ---
| ---
| ---
| ---
| Yes
|
| WAN Optimization
|
|
|
|
|
|
Bandwidth-on-demand9
| Yes
| ---
| ---
| ---
| Yes
|
Custom and priority queueing
| Yes
| Yes
| Yes
| Yes
| Yes
|
Dial backup
| Yes
| ---
| ---
| ---
| Yes
|
Dial-on-demand
| Yes
| ---
| ---
| ---
| Yes
|
Header10, link and payload compression11
| ---
| Yes
| Yes
| Yes
| Yes
|
Header11 and link compression
| Yes
| ---
| ---
| ---
| ---
|
Snapshot routing
| Yes
| ---
| ---
| ---
| Yes
|
Weighted fair queueing
| Yes
| Yes
| Yes
| Yes
| Yes
|
| IP Routing
|
|
|
|
|
|
BGP
| Yes
| ---
| ---
| ---
| ---
|
BGP412
| Yes
| Yes
| ---
| ---
| ---
|
EGP
| Yes
| ---
| ---
| ---
| ---
|
Enhanced IGRP
| Yes
| Yes
| Yes
| Yes13
| Yes
|
Enhanced IGRP Optimizations
| Yes
| Yes
| Yes
| Yes13
| Yes
|
IGRP
| Yes
| Yes
| Yes
| Yes
| Yes
|
NHRP
| Yes
| ---
| ---
| ---
| ---
|
On Demand Routing (ODR)
| Yes
| Yes
| Yes
| Yes
| Yes
|
OSPF
| Yes
| Yes
| ---
| Yes
| ---
|
OSPF Not-So-Stubby-Areas (NSSA)
| Yes
| Yes
| ---
| Yes
| ---
|
OSPF On Demand Circuit (RFC 1793)
| Yes
| Yes
| ---
| Yes
| ---
|
PIM
| Yes
| ---
| ---
| ---
| Yes
|
Policy-based routing
| Yes
| ---
| ---
| ---
| Yes
|
RIP
| Yes
| Yes
| Yes
| Yes
| Yes
|
RIP Version 2
| Yes
| Yes
| Yes
| Yes
| Yes
|
| Other Routing
|
|
|
|
|
|
AURP
| Yes
| ---
| ---
| ---
| Yes
|
IPX RIP
| Yes
| ---
| Yes
| Yes
| Yes
|
NLSP
| ---
| ---
| ---
| ---
| ---
|
RTMP
| Yes
| ---
| ---
| ---
| Yes
|
| Multimedia and Quality of Service
|
|
|
|
|
|
Generic traffic shaping
| Yes
| Yes
| Yes
| Yes
| Yes
|
Random Early Detection (RED)
| Yes
| Yes
| Yes
| Yes
| Yes
|
Resource Reservation Protocol (RSVP)
| Yes
| Yes
| Yes
| Yes
| Yes
|
| Management
|
|
|
|
|
|
AutoInstall
| ---
| Yes
| Yes
| Yes
| Yes
|
Automatic modem configuration
| ---
| ---
| ---
| ---
| Yes
|
HTTP Server
| Yes
| Yes
| Yes
| Yes
| Yes
|
RMON events and alarms14
| Yes
| Yes
| Yes
| Yes
| Yes
|
SNMP
| Yes
| Yes
| Yes
| Yes
| Yes
|
Telnet
| Yes
| Yes
| Yes
| Yes
| Yes
|
| Security
|
|
|
|
|
|
Access lists
| Yes
| Yes
| Yes
| Yes
| Yes
|
Access security
| Yes
| Yes
| Yes
| Yes
| Yes
|
Extended access lists
| Yes
| Yes
| Yes
| Yes
| Yes
|
Kerberos V client support
| Yes
| Yes
| Yes
| Yes
| Yes
|
Lock and Key
| Yes
| Yes
| Yes
| Yes
| Yes
|
MAC security for hubs15
| ---
| ---
| ---
| ---
| ---
|
MD5 routing authentication
| Yes
| Yes
| Yes
| Yes
| Yes
|
RADIUS
| ---
| ---
| ---
| ---
| Yes
|
TACACS+16
| Yes
| Yes
| Yes
| Yes
| Yes
|
| IBM Support (Optional)
|
|
|
|
|
|
BAN for SNA Frame Relay support
| ---
| Yes
| Yes
| Yes
| ---
|
Bisync
| ---
| Yes
| Yes
| Yes
| ---
|
Caching and filtering
| ---
| Yes
| Yes
| Yes
| ---
|
DLSw+17
| ---
| Yes
| Yes
| Yes
| ---
|
Frame Relay SNA support (RFC 1490)
| ---
| Yes
| Yes
| Yes
| ---
|
Native Client Interface Architecture (NICA) Server
| ---
| ---
| ---
| ---
| ---
|
NetView Native Service Point
| ---
| Yes
| Yes
| Yes
| ---
|
Polled async (ADT, ADPLEX)
| ---
| Yes
| Yes
| Yes
| ---
|
QLLC
| ---
| Yes
| Yes
| Yes
| ---
|
DLSw (RFC 1795)
| ---
| Yes
| Yes
| Yes
| ---
|
RSRB
| ---
| Yes
| ---
| ---
| ---
|
SDLC integration
| ---
| Yes
| Yes
| Yes
| ---
|
SDLC transport (STUN)
| ---
| Yes
| Yes
| Yes
| ---
|
SDLC-to-LAN conversion (SDLLC)
| ---
| Yes
| Yes
| Yes
| ---
|
SNA and NetBIOS WAN optimization
via local acknowledgment
| ---
| Yes
| Yes
| Yes
| ---
|
SRB/RSRB18
| ---
| ---
| Yes
| Yes
| ---
|
SRT
| ---
| ---
| Yes
| Yes
| ---
|
| Protocol Translation
|
|
|
|
|
|
LAT
| ---
| ---
| ---
| ---
| Yes
|
PPP
| ---
| ---
| ---
| ---
| Yes
|
Rlogin
| ---
| ---
| ---
| ---
| Yes
|
Telnet
| ---
| ---
| ---
| ---
| Yes
|
TN3270
| ---
| ---
| ---
| ---
| Yes
|
X.25
| ---
| ---
| ---
| ---
| Yes
|
| Remote Node19
|
|
|
|
|
|
ARAP 1.0/2.020
| ---
| ---
| ---
| ---
| Yes
|
Asynchronous master interfaces
| ---
| ---
| ---
| ---
| Yes
|
ATCP
| ---
| ---
| ---
| ---
| Yes
|
CPPP
| ---
| ---
| ---
| ---
| Yes
|
CSLIP
| ---
| ---
| ---
| ---
| Yes
|
DHCP
| ---
| ---
| ---
| ---
| Yes
|
IP pooling
| ---
| ---
| ---
| ---
| Yes
|
IPX and ARAP on virtual async interfaces
| ---
| ---
| ---
| ---
| Yes
|
IPXCP21
| ---
| ---
| ---
| ---
| Yes
|
MacIP
| ---
| ---
| ---
| ---
| Yes
|
PPP
| ---
| ---
| ---
| ---
| Yes
|
SLIP
| ---
| ---
| ---
| ---
| Yes
|
| Terminal Services19
|
|
|
|
|
|
LAT22
| ---
| ---
| ---
| ---
| Yes
|
Rlogin
| ---
| ---
| ---
| ---
| Yes
|
Telnet
| ---
| ---
| ---
| ---
| Yes
|
TN3270
| ---
| ---
| ---
| ---
| Yes
|
X.25 PAD
| ---
| ---
| ---
| ---
| Yes
|
Xremote
| ---
| ---
| ---
| ---
| Yes
|
1The OSPF LANFRAD feature set is available in Release 11.2(4) and later. This feature set is not available in Release 11.2 F.
2Includes AppleTalk load balancing.
3IRB supports IP, IPX, and AppleTalk; it is supported for transparent bridging, but not for SRB; it is supported on all media-type interfaces except X.25 and ISDN bridged interfaces; and IRB and concurrent routing and bridging (CRB) cannot operate at the same time.
4The Novell IPX feature includes display SAP by name, IPX Access Control List violation logging, and plain-English IPX access lists.
5Translational bridging is fast switched, but this can be disabled.
6ISDN support includes calling line identification (ANI), X.25 over the B channel, ISDN subaddressing, and applicable WAN optimization features.
7PPP includes support for LAN protocols supported by the feature set, address negotiation, PAP and CHAP authentication, PPP compression, and Multilink PPP.
8X.25 includes X.25 switching.
9Bandwidth-on-demand means two B channels calls to the same destination.
10IPX header compression (RFC 1553) is available in the feature sets that support IPX.
11X.25 and Frame Relay payload compression.
12BGP4 includes soft configuration, multipath support, and prefix filtering with inbound route maps.
13Enhanced IGRP in the OSPF LANFRAD feature set is only available in Release 11.2(4). Cisco does not support this functionality in any releases of the OSPF LANFRAD feature set, and this feature is subject to removal without notice.
14RMON events and alarms is supported on all interfaces.
15Applicable to the following Cisco 2500 series Ethernet hub models: Cisco 2505, Cisco 2507, Cisco 2516, and Cisco 2518.
16TACACS+ Single Connection and TACACS+ SENDAUTH enhancements are supported.
17Cisco IOS Release 11.2 introduces several DLSw+ enhancements available in the Plus, Plus 40, and Plus 56 feature sets. See the section
""IBM Functionality"" in the ""New Features in Release 11.2(1)"" section for more details.
18SRB/RSRB is fast switched. This enhancement is on by default, but can be disabled.
19Remote node and terminal services supported on access servers (with limited support on router auxiliary ports).
20The Cisco 4000 series products do not support ARAP 1.0/2.0.
21IPX header compression (RFC 1553) is available in the feature sets that support IPX.
22Use of LAT requires terminal license (FR-L8-10.X= or FR-L16-10.X=).
|
Table 16: Cisco AS5200 Access Server Software Feature Sets
|
| Feature Set
|
|---|
| Feature
| IP Routing
| Desktop
(IP/IPX/AppleTalk/DEC)
| Enterprise1
|
|---|
| LAN Support
|
|
|
|
Apollo Domain
| ---
| ---
| Yes
|
AppleTalk 1 and 22
| ---
| Yes
| Yes
|
Banyan VINES
| ---
| ---
| Yes
|
Concurrent routing and bridging (CRB)
| Yes
| Yes
| Yes
|
DECnet IV
| ---
| Yes
| Yes
|
DECnet V
| ---
| ---
| Yes
|
GRE
| Yes
| Yes
| Yes
|
Integrated routing and bridging (IRB)3
| Yes
| Yes
| Yes
|
IP
| Yes
| Yes
| Yes
|
LAN extension host
| Yes
| Yes
| Yes
|
Multiring
| Yes
| Yes
| Yes
|
Novell IPX4
| ---
| Yes
| Yes
|
OSI
| ---
| ---
| Yes
|
Source-route bridging (SRB)
| ---
| ---
| Yes
|
Transparent and translational bridging
| Yes
| Yes
| Yes
|
XNS
| ---
| ---
| Yes
|
| WAN Services
|
|
|
|
ATM LAN emulation: Rate queues for SVC per subinterface
| ---
| ---
| Yes
|
Combinet Packet Protocol (CPP)
| Yes
| Yes
| Yes
|
Dialer profiles
| Yes
| Yes
| Yes
|
Frame Relay
| Yes
| Yes
| Yes
|
Frame Relay SVC Support (DTE)
| ---
| ---
| Yes
|
Frame Relay traffic shaping
| Yes
| Yes
| Yes
|
Half bridge/half router for CPP and PPP
| Yes
| Yes
| Yes
|
HDLC
| Yes
| Yes
| Yes
|
IPXWAN 2.0
| ---
| Yes
| Yes
|
ISDN5
| Yes
| Yes
| Yes
|
Multichassis Multilink PPP (MMP)
| ---
| ---
| Yes
|
NetBEUI over PPP
| ---
| ---
| Yes
|
PPP6
| Yes
| Yes
| Yes
|
SMDS
| Yes
| Yes
| Yes
|
Switched 56
| Yes
| Yes
| Yes
|
Virtual Private Dial-up Network (VPDN)
| Plus
| Plus
| Yes
|
X.257
| Yes
| Yes
| Yes
|
| WAN Optimization
|
|
|
|
Bandwidth-on-demand
| Yes
| Yes
| Yes
|
Custom and priority queueing
| Yes
| Yes
| Yes
|
Dial backup
| Yes
| Yes
| Yes
|
Dial-on-demand
| Yes
| Yes
| Yes
|
Header8, link and payload compression9
| Yes
| Yes
| Yes
|
Snapshot routing
| Yes
| Yes
| Yes
|
Weighted fair queueing
| Yes
| Yes
| Yes
|
| IP Routing
|
|
|
|
BGP
| Yes
| Yes
| Yes
|
BGP410
| Yes
| Yes
| Yes
|
EGP
| Yes
| Yes
| Yes
|
Enhanced IGRP
| Yes
| Yes
| Yes
|
Enhanced IGRP Optimizations
| Yes
| Yes
| Yes
|
ES-IS
| ---
| ---
| Yes
|
IGRP
| Yes
| Yes
| Yes
|
IS-IS
| ---
| ---
| Yes
|
Named IP Access Control List
| Yes
| Yes
| Yes
|
Network Address Translation (NAT)
| Plus
| Plus
| Plus
|
NHRP
| Yes
| Yes
| Yes
|
On Demand Routing (ODR)
| Yes
| Yes
| Yes
|
OSPF
| Yes
| Yes
| Yes
|
OSPF Not-So-Stubby-Areas (NSSA)
| Yes
| Yes
| Yes
|
OSPF On Demand Circuit (RFC 1793)
| Yes
| Yes
| Yes
|
PIM
| Yes
| Yes
| Yes
|
Policy-based routing
| Yes
| Yes
| Yes
|
RIP
| Yes
| Yes
| Yes
|
RIP Version 2
| Yes
| Yes
| Yes
|
| Other Routing
|
|
|
|
AURP
| ---
| Yes
| Yes
|
IPX RIP
| ---
| Yes
| Yes
|
NLSP
| ---
| Yes
| Yes
|
RTMP
| ---
| Yes
| Yes
|
SMRP
| ---
| Yes
| Yes
|
SRTP
| ---
| ---
| Yes
|
| Multimedia and Quality of Service
|
|
|
|
Generic traffic shaping
| Yes
| Yes
| Yes
|
Random Early Detection (RED)
| Yes
| Yes
| Yes
|
Resource Reservation Protocol (RSVP)
| Yes
| Yes
| Yes
|
| Management
|
|
|
|
|
| Yes
| Yes
| Yes
|
- Automatic modem configuration
| Yes
| Yes
| Yes
|
|
| Yes
| Yes
| Yes
|
|
| Plus
| Plus
| Plus
|
|
| Yes
| Yes
| Yes
|
|
| Plus
| Plus
| Plus
|
|
| Yes
| Yes
| Yes
|
|
| Yes
| Yes
| Yes
|
| Security
|
|
|
|
Access lists
| Yes
| Yes
| Yes
|
Access security
| Yes
| Yes
| Yes
|
Extended access lists
| Yes
| Yes
| Yes
|
Kerberized login
| ---
| ---
| Yes
|
Kerberos V client support
| ---
| ---
| Yes
|
Lock and key
| Yes
| Yes
| Yes
|
MAC security for hubs
| Yes
| Yes
| Yes
|
MD5 routing authentication
| Yes
| Yes
| Yes
|
RADIUS
| Yes
| Yes
| Yes
|
TACACS+12
| Yes
| Yes
| Yes
|
| IBM Support (Optional)
|
|
|
|
APPN (optional)2
| ---
| ---
| ---
|
BAN for SNA Frame Relay support
| Plus
| Plus
| Yes
|
Bisync
| Plus
| Plus
| Yes
|
Caching and filtering
| Plus
| Plus
| Yes
|
DLSw+ 13
| Plus
| Plus
| Yes
|
Downstream PU concentration (DSPU)
| Plus
| Plus
| Yes
|
Frame Relay SNA support (RFC 1490)
| Plus
| Plus
| Yes
|
Native Client Interface Architecture (NCIA) Server
| Plus
| Plus
| Yes
|
NetView Native Service Point
| Plus
| Plus
| Yes
|
QLLC
| Plus
| Plus
| Yes
|
Response Time Reporter (RTR)
| Plus
| Plus
| Yes
|
SDLC integration
| Plus
| Plus
| Yes
|
DLSw (RFC 1795)
| Plus
| Plus
| Yes
|
SDLC transport (STUN)
| Plus
| Plus
| Yes
|
SDLC-to-LAN conversion (SDLLC)
| Plus
| Plus
| Yes
|
SNA and NetBIOS WAN optimization
via local acknowledgment
| Plus
| Plus
| Yes
|
SRB/RSRB14
| Plus
| Plus
| Yes
|
SRT
| Plus
| Plus
| Yes
|
TG/COS
| ---
| ---
| Yes
|
TN3270
| ---
| ---
| Yes
|
| Protocol Translation
|
|
|
|
LAT
| ---
| ---
| Yes
|
Rlogin
| ---
| ---
| Yes
|
| Remote Node15
|
|
|
|
ARAP 1.0/2.0
| ---
| Yes
| Yes
|
Asynchronous master interfaces
| Yes
| Yes
| Yes
|
ATCP
| ---
| Yes
| Yes
|
CPPP
| Yes
| Yes
| Yes
|
CSLIP
| Yes
| Yes
| Yes
|
DHCP
| Yes
| Yes
| Yes
|
IP pooling
| Yes
| Yes
| Yes
|
IPX and ARAP on virtual async interfaces
| ---
| ---
| Yes
|
IPXCP
| ---
| Yes
| Yes
|
MacIP
| ---
| Yes
| Yes
|
NASI
| ---
| ---
| ---
|
SLIP
| Yes
| Yes
| Yes
|
| Terminal Services15
|
|
|
|
LAT16
| ---
| ---
| Yes
|
Rlogin
| Yes
| Yes
| Yes
|
Telnet
| Yes
| Yes
| Yes
|
TN3270
| ---
| ---
| Yes
|
X.25 PAD
| Yes
| Yes
| Yes
|
Xremote
| ---
| ---
| Yes
|
1Enterprise is available with APPN in a separate feature set. APPN includes APPN Central Registration (CRR) and APPN over DLSw+.
2Includes AppleTalk load balancing.
3IRB supports IP, IPX, and AppleTalk; it is supported for transparent bridging, but not for SRB; it is supported on all media-type interfaces except X.25 and ISDN bridged interfaces; and IRB and concurrent routing and bridging (CRB) cannot operate at the same time.
4The Novell IPX feature includes display SAP by name, IPX Access Control List violation logging, and plain-English IPX access lists.
5ISDN support includes calling line identification (ANI), X.25 over the B channel, ISDN subaddressing, and applicable WAN optimization features.
6PPP includes support for LAN protocols supported by the feature set, address negotiation, PAP and CHAP authentication, and PPP compression, and Multilink PPP.
7X.25 includes X.25 switching.
8IPX header compression (RFC 1553) is available in the feature sets that support IPX.
9X.25 and Frame Relay payload compression are supported.
10BGP4 includes soft configuration, multipath support, and prefix filtering with inbound route maps.
11The RMON events and alarms groups are supported on all interfaces. Full RMON support is available with the Plus feature sets.
12TACACS+ Single Connection and TACACS+ SENDAUTH enhancements are supported.
13Cisco IOS Release 11.2 introduces several DLSw+ enhancements available in the Plus, Plus 40, and Plus 56 feature sets. See the section ""IBM Functionality"" in the ""New Features in Release 11.2(1)"" section for more details.
14SRB/RSRB is fast switched. This enhancement is on by default, but can be disabled.
15Supported on access severs (with limited support on router auxiliary ports).
16Use of LAT requires terminal license (FR-L8-10.X= for an 8-user license or FR-L16-10.X= for a 16-user license).
|
Table 17: Cisco 1003, Cisco 1004, and Cisco 1005 Routers Software Feature Sets
|
| Feature Set1
|
|---|
| Feature
| IP Routing2
| IP/IPX Routing2
| IP/AppleTalk Routing2
| IP/IPX/AppleTalk Routing
|
|---|
| LAN Support
|
|
|
|
|
AppleTalk 1 and 21
| ---
| ---
| Yes
| Yes
|
GRE
| Yes
| Yes
| Yes
| Yes
|
Integrated routing and bridging (IRB)2
| Yes
| Yes
| Yes
| Yes
|
IP
| Yes
| Yes
| Yes
| Yes
|
Novell IPX3
| ---
| Yes
| ---
| Yes
|
Transparent and translational bridging4
| Yes
| Yes
| Yes
| Yes
|
| WAN Services5
|
|
|
|
|
Dialer profiles
| Yes
| Yes
| Yes
| Yes
|
Frame Relay (Cisco 1005 only)
| Yes
| Yes
| Yes
| Yes
|
Frame Relay SVC Support (DTE) (Cisco 1005 only)
| Plus
| Plus
| Plus
| Plus
|
Frame Relay traffic shaping
(Cisco 1005 only)
| Yes
| Yes
| Yes
| Yes
|
HDLC
| Yes
| Yes
| Yes
| Yes
|
ISDN (Cisco 1003 and Cisco 1004)6
| Yes
| Yes
| Yes
| Yes
|
PPP
| Yes
| Yes
| Yes
| Yes
|
SLIP (Cisco 1005 only)
| Yes
| Yes
| ---
| ---
|
SMDS (Cisco 1005 only)
| Yes
| Yes
| Yes
| Yes
|
Switched 56 (Cisco 1005 only)
| Yes
| Yes
| Yes
| Yes
|
Virtual Private Dial-up Network (VPDN)
| ---
| ---
| ---
| Plus
|
X.25
| Yes
| Yes
| Yes
| Yes
|
| WAN Optimization
|
|
|
|
|
Bandwidth-on-demand
(Cisco 1003 and Cisco 1004)
| Yes
| Yes
| Yes
| Yes
|
Custom and priority queueing
| Yes
| Yes
| Yes
| Yes
|
Dial backup
| Yes
| Yes
| Yes
| Yes
|
Dial-on-demand7
| Yes
| Yes
| Yes
| Yes
|
Header8 and link compression9
(Cisco 1003 and Cisco 1004)
| Yes
| Yes
| Yes
| Yes
|
Payload compression (Cisco 1005 only)
| Yes
| Yes
| Yes
| Yes
|
Snapshot routing10
| Yes
| Yes
| Yes
| Yes
|
Weighted fair queueing
| Yes
| Yes
| Yes
| Yes
|
| IP Routing
|
|
|
|
|
Enhanced IGRP
| Yes
| Yes
| Yes
| Yes
|
Enhanced IGRP Optimizations
| Yes
| Yes
| Yes
| Yes
|
IGRP
| Yes
| Yes
| Yes
| Yes
|
Network Address Translation Table (NAT)
| Plus
| Plus
| Plus
| Plus
|
On Demand Routing (ODR)
| Yes
| Yes
| Yes
| Yes
|
OSPF
| Plus
| Plus
| Plus
| Plus
|
OSPF Not-So-Stubby-Areas (NSSA)
| Plus
| Plus
| Plus
| Plus
|
OSPF On Demand Circuit (RFC 1793)
| Plus
| Plus
| Plus
| Plus
|
PIM
| Plus
| Plus
| Plus
| Plus
|
RIP
| Yes
| Yes
| Yes
| Yes
|
RIP Version 2
| Yes
| Yes
| Yes
| Yes
|
| Other Routing
|
|
|
|
|
AURP
| ---
| ---
| Plus
| Plus
|
IPX RIP
| ---
| Yes
| ---
| Yes
|
NLSP
| Plus
| Plus
| Plus
| Plus
|
SMRP
| Plus
| Plus
| Plus
| Plus
|
RTMP
| ---
| ---
| Yes
| Yes
|
| Multimedia and Quality of Service
|
|
|
|
|
Random Early Detection (RED)
| Plus
| Plus
| Plus
| Plus
|
Resource Reservation Protocol (RSVP)
| Plus
| Plus
| Plus
| Plus
|
| Management
|
|
|
|
|
ClickStart
| Yes
| Yes
| Yes
| Yes
|
HTTP Server
| Yes
| Yes
| Yes
| Yes
|
SNMP
| Yes
| Yes
| Yes
| Yes
|
Telnet
| Yes
| Yes
| Yes
| Yes
|
| Security
|
|
|
|
|
Access lists
| Yes
| Yes
| Yes
| Yes
|
Access security
| Yes
| Yes
| Yes
| Yes
|
Extended access lists
| Yes
| Yes
| Yes
| Yes
|
Lock and key
| Yes
| Yes
| Yes
| Yes
|
Router authentication and network layer encryption (40-bit or export controlled 56-bit DES)
| Encrypt
| Encrypt
| Encrypt
| Encrypt
|
TACACS+11
| Yes
| Yes
| Yes
| Yes
|
1Includes AppleTalk load balancing.
2IRB supports IP, IPX, and AppleTalk; it is supported for transparent bridging, but not for SRB; it is supported on all media-type interfaces except X.25 and ISDN bridged interfaces; and IRB and concurrent routing and bridging (CRB) cannot operate at the same time.
3The Novell IPX feature includes display SAP by name, IPX Access Control List violation logging, and plain-English IPX access lists.
4Transparent and translational bridging is fast switched. This enhancement is on by default, but can be disabled.
5Cisco 1005 "WAN Services" offers three feature set options: Option 1 includes HDLC, PPP, SDMS, and Frame Relay, but not X.25, and is available on all feature sets; Option 2 includes X.25 only, and is available with the IP/IPX, IP/AppleTalk, and IP/IPX/AppleTalk feature sets; and Option 3 includes Async, PPP, and SLIP and is available with the IP, IP/IPX features sets.
6ISDN support includes calling line identification (CLI/ANI), ISDN subaddressing, and applicable WAN optimization features.
7Dial-on-demand is available for the Cisco 1005 with "WAN Services" Option only. See footnote 5. above.
8IPX header compression (RFC 1553) is available in the feature sets that support IPX.
9X.25 and Frame Relay payload compression. Payload compression is available for the Cisco 1005.
10Snapshot routing is not included for the Cisco 1005.
11TACACS+ Single Connection and TACACS+ SENDAUTH enhancements are supported.
|
Table 18: Cisco 1005 Platform-Specific Software Feature Sets
|
| Feature Set
|
|---|
| Feature
| IP/OSPF/PIM Routing1
| IP/Async1
| IP/IPX/Async1
|
|---|
| LAN Support
|
|
|
|
AppleTalk 1 and 2
| ---
| ---
| ---
|
GRE
| Yes
| Yes
| Yes
|
Integrated routing and bridging (IRB)2
| Yes
| Yes
| Yes
|
IP
| Yes
| Yes
| Yes
|
Novell IPX3
| ---
| ---
| Yes
|
Transparent and translational bridging4
| Yes
| Yes
| Yes
|
| WAN Services5
|
|
|
|
Async
| ---
| Yes
| Yes
|
Dialer profiles
| Yes
| Yes
| Yes
|
Frame Relay
| Yes
| ---
| ---
|
Frame Relay traffic shaping
| Yes
| ---
| ---
|
HDLC
| Yes
| ---
| ---
|
PPP6
| Yes
| Yes
| Yes
|
SLIP
| ---
| Yes
| Yes
|
SMDS
| Yes
| ---
| ---
|
Switched 56
| Yes
| ---
| ---
|
Virtual Private Dial-up Network (VPDN)
| ---
| ---
| ---
|
X.257
| Yes
| ---
| ---
|
| WAN Optimization
|
|
|
|
Custom and priority queueing
| Yes
| Yes
| Yes
|
Dial-on-demand8
| Yes
| Yes
| Yes
|
Header9, link and payload compression 10
| Yes
| Yes
| Yes
|
Snapshot routing11
| Yes
| Yes
| Yes
|
Weighted fair queueing
| Yes
| Yes
| Yes
|
| IP Routing
|
|
|
|
Enhanced IGRP
| Yes
| Yes
| Yes
|
Enhanced IGRP Optimizations
| Yes
| Yes
| Yes
|
IGRP
| Yes
| Yes
| Yes
|
On Demand Routing (ODR)
| Yes
| Yes
| Yes
|
OSPF
| Yes
| ---
| ---
|
OSPF Not-So-Stubby-Areas (NSSA)
| Yes
| ---
| ---
|
OSPF On Demand Circuit (RFC 1793)
| Yes
| ---
| ---
|
PIM
| Yes
| ---
| ---
|
RIP
| Yes
| Yes
| Yes
|
RIP Version 2
| Yes
| Yes
| Yes
|
| Other Routing
|
|
|
|
IPX RIP
| ---
| ---
| Yes
|
| Management
|
|
|
|
ClickStart
| Yes
| Yes
| Yes
|
HTTP Server
| Yes
| Yes
| Yes
|
SNMP
| Yes
| Yes
| Yes
|
Telnet
| Yes
| Yes
| Yes
|
| Security
|
|
|
|
Access lists
| Yes
| Yes
| Yes
|
Access security
| Yes
| Yes
| Yes
|
Extended access lists
| Yes
| Yes
| Yes
|
Kerberos V client support
| ---
| ---
| ---
|
Lock and key
| Yes
| Yes
| Yes
|
TACACS+12
| Yes
| Yes
| Yes
|
1These feature sets are not available with the Plus, Plus 40, or Plus 56 feature set options in Cisco IOS Release 11.2.
2IRB supports IP, IPX, and AppleTalk; it is supported for transparent bridging, but not for SRB; it is supported on all media-type interfaces except X.25 and ISDN bridged interfaces; and IRB and concurrent routing and bridging (CRB) cannot operate at the same time.
3The Novell IPX feature includes display SAP by name, IPX Access Control List violation logging, and plain-English IPX access lists.
4Transparent and translational bridging is fast switched. This enhancement is on by default, but can be disabled.
5Cisco 1005 "WAN Services" offers three feature set options: Option 1 includes HDLC, PPP, SDMS, and Frame Relay, but not X.25, and is available on all feature sets; Option 2 includes X.25 only, and is available with the IP/IPX, IP/AppleTalk, and IP/IPX/AppleTalk feature sets; and Option 3 includes async, PPP, and SLIP and is available with the IP, IP/IPX features sets.
6PPP includes support for LAN protocols supported by the feature set, address negotiation, PAP and CHAP authentication, Multilink PPP, and PPP compression.
7X.25 is available for the Cisco 1005 only and is available by itself in "WAN Services" Option 2 for the following feature sets: IP/IPX, IP/AppleTalk, and IP/IPX/AppleTalk.
8Dial-on-demand is available for the Cisco 1005 with "WAN Services" Option only. See footnote 5.above.
9IPX header compression (RFC 1553) is available in the feature sets that support IPX.
10X.25 and Frame Relay payload compression.
11Snapshot routing is not included for the Cisco 1005.
12TACACS+ Single Connection and TACACS+ SENDAUTH enhancements are supported.
|
This section describes new and changed information and includes the following sections:
A new feature set, OSPF LANFRAD, is available in Release 11.2(4) for Cisco 2500 series platforms. Table 15 shows the features available in this new feature set. Table 10 shows the memory recommendations for this new feature set. No new functionality is contained in this feature set. This feature set is not available in Release 11.2 F.
Previously, maintenance releases of major Cisco IOS software releases were used to deliver additional new features. Beginning with Cisco IOS Release 11.2, Cisco Systems provides as many as three software release "trains" based on a single version of Cisco IOS software. Maintenance releases of the Major train software deliver fixes to software defects only, thus providing the most stable software for your network, for the features you need. In addition to the Major train, there are up to two Early Deployment (ED) trains. One ED train delivers both fixes to software defects and support for new Cisco platforms. The other ED train delivers fixes to software defects, new platform support, and new cross-platform functionality. Software releases from the ED trains typically lag the maintenance releases of the Major train by a few weeks.
 |
Caution When determining whether to deploy software from the Major or Early Deployment release train, you should weigh the importance you place on maximizing product capability versus maximizing operational stability. Regardless of the train you choose, an early release of software should always be tried in a test network before being deployed in a production network. |
The following software enhancements have been added to Release 11.2. These features are available in all software trains of Release 11.2. Separate documentation that is available with each release of the ED software trains describes the additional functionality that is available in ED software releases.
This section is divided into the following subjects:
This section describes routing protocol features that are new in the initial release of Cisco IOS Release 11.2.
IP Protocol and Feature Enhancements
The following new IP protocol software features are available:
- On Demand Routing---On Demand Routing (ODR) is a mechanism that provides minimum-overhead IP routing for stub sites. The overhead of a general dynamic routing protocol is avoided, without incurring the configuration and management overhead of using static routing.
- A stub router is the peripheral router in a hub-and-spoke network topology. Stub routers commonly have a WAN connection to the hub router and a small number of LAN network segments (stub networks) that are connected directly to the stub router. To provide full connectivity, the hub routers can be statically configured to know that a particular stub network is reachable via a specified access router. However, if there are multiple hub routers, many stub networks, or asynchronous connections between hubs and spokes, the overhead required to statically configure knowledge of the stub networks on the hub routers becomes too great.
- ODR simplifies installation of IP stub networks in which the hub routers dynamically maintain routes to the stub networks. This is accomplished without requiring the configuration of an IP routing protocol at the stub routers. With ODR, the stub advertises IP prefixes corresponding to the IP networks that are configured on its directly connected interfaces. Because ODR advertises IP prefixes, rather than IP network numbers, ODR is able to carry Variable Length Subnet Mask (VLSM) information.
- Once ODR is enabled on a hub router, the router begins installing stub network routes in the IP forwarding table. The hub router can also be configured to redistribute these routes into any configured dynamic IP routing protocols. IP does not need to be configured on the stub router. With ODR, a router is automatically considered to be a stub when no IP routing protocols have been configured on it.
- The routing protocol that ODR generates is propagated between routers using Cisco Discovery Protocol (CDP). Thus, ODR is partially controlled by the configuration of CDP. Specifically,
- If CDP is disabled, the propagation of ODR routing information will cease.
- By default, CDP sends updates every 60 seconds. This update interval may not be frequent enough to provide fast reconvergence of IP routers on the hub router side of the network. A faster reconvergence rate may be necessary if the stub connects to several hub routers via asynchronous interfaces (such as modem lines).
- ODR may not work well with dial-on-demand routing (DDR) interfaces, as CDP packets will not cause a DDR connection to be made.
- It is recommended that IP filtering be used to limit the network prefixes that the hub router will permit to be learned dynamically through ODR. If the interface has multiple logical IP networks configured (via the IP secondary command), only the primary IP network is advertised through ODR.
Open Shortest Path First (OSPF) Enhancements
The following features have been added to Cisco's OSPF software:
- OSPF On-Demand Circuit---OSPF On-Demand Circuit is an enhancement to the OSPF protocol, as described in RFC 1793, that allows efficient operation over demand circuits such as ISDN, X.25 SVCs, and dial-up lines. Previously, the period nature of OSPF routing traffic mandated that the underlying data-link connection needed to be open constantly, resulting in unwanted usage charges. With this feature, OSPF Hellos and the refresh of OSPF routing information is suppressed for on-demand circuits (and reachability is presumed), allowing the underlying data-link connections to be closed when not carrying application traffic.
- The feature allows the consolidation on a single routing protocol and the benefits of the OSPF routing protocol across the entire network, without incurring excess connection costs.
- If the router is part of a point-to-point topology, only one end of the demand circuit needs to be configured for OSPF On-Demand Circuit operation. In point-to-multipoint topologies, all appropriate routers must be configured with OSPF On-Demand Circuit. All routers in an area must support this feature---that is, be running Cisco IOS Software Release 11.2 or greater.
- OSPF Not-So-Stubby Areas (NSSA)---As part of the OSPF protocol's support for scalable, hierarchical routing, peripheral portions of the network can be defined as "stub" areas, so that they do not receive and process external OSPF advertisements. Stub areas are generally defined for low end routers with limited memory and CPU, that have low-speed connections, and are in a default route configuration.
- OSPF Not-So-Stubby-Areas (NSSA) defines a more flexible, hybrid method, whereby stub areas can import external OSPF routes in a limited fashion, so that OSPF can be extended across the stub to backbone connection.
- NSSA enables OSPF to be extended across a stub area to backbone area connection to become logically part of the same network.
Border Gateway Protocol version 4 (BGP4) Enhancements
The following features have been added to Cisco's BGP4 software:
- BGP4 Soft Configuration---BGP4 soft configuration allows BGP4 policies to be configured and activated without clearing the BGP session, hence without invalidating the forwarding cache. This enables policy reconfiguration without causing short-term interruptions to traffic being forwarded in the network.
- BGP4 Multipath Support--- BGP4 Multipath Support provides BGP load balancing between multiple Exterior BGP (EBGP) sessions. If there are multiple EBGP sessions between the local autonomous system (AS) and the neighboring AS, multipath support allows BGP to load balance among these sessions. Depending on the switching mode, per packet or per destination load balancing is performed.
- BGP4 Multipath Support can support up to six paths.
- BGP4 Prefix Filtering with Inbound Route Maps---This feature allows prefix-based matching support to the inbound neighbor route map. This feature allows an inbound route map to be used to enforce prefix-based policies.
Network Address Translation
Network Address Translation (NAT) provides a mechanism for a privately addressed network to access registered networks, such as the Internet, without requiring a registered subnet address. This eliminates the need for host renumbering and allows the same IP address range to be used in multiple intranets.
With NAT, the privately addressed network (designated as "inside") continues to use its existing private or obsolete addresses. These addresses are converted into legal addresses before packets are forwarded onto the registered network (designated as "outside"). The translation function is compatible with standard routing; the feature is required only on the router connecting the inside network to the outside domain.
Translations can be static or dynamic in nature. A static address translation establishes a one-to-one mapping between the inside network and the outside domain. Dynamic address translations are defined by describing the local addresses to be translated and the pool of addresses from which to allocate outside addresses. Allocation is done in numeric order and multiple pools of contiguous address blocks can be defined.
NAT:
- Eliminates readdressing overhead. NAT eliminates the need to readdress all hosts that require external access, saving time and money.
- Conserves addresses through application port-level multiplexing. With NAT, internal hosts can share a single registered IP address for all external communications. In this type of configuration, relatively few external addresses are required to support many internal hosts, thus conserving IP addresses.
- Protects network security. Because private networks do not advertise their addresses or internal topology, they remain reasonably secure when used in conjunction with NAT to gain controlled external access.
Because the addressing scheme on the inside network may conflict with registered addresses already assigned within the Internet, NAT can support a separate address pool for overlapping networks and translate as appropriate.
Applications that use raw IP addresses as a part of their protocol exchanges are incompatible with NAT. Typically, these are less common applications that do not use fully qualified domain names.
Named IP Access Control List
The Named IP Access Control List (ACL) feature gives network managers the option of using names for their access control lists. Named IP ACL function similarly to their numbered counter-parts, except that they use names instead of numbers.
This feature also includes a new configuration mode, which supports addition and deletion of single lines in a multiline access control list.
This feature eliminates some of the confusion associated with maintaining long access control lists. Meaningful names can be assigned, making it easier to remember which service is controlled by which access control list. Moreover, this feature removes the limit of 100 extended and 99 standard access control lists, so that additional IP access control lists can be configured.
The new configuration feature allows a network manager to edit access control lists, rather than re-creating the entire list.
Currently, only packet and route filters can use Named IP ACL. Also, named IP ACLs are not backward-compatible with earlier releases of Cisco IOS software.
Named IP ACLs are not currently supported with Distributed Fast Switching.
Multimedia and Quality of Service
The following features have been added to Cisco's multimedia and quality of service software:
- Resource Reservation Protocol---Resource Reservation Protocol (RSVP) enables applications to dynamically reserve necessary network resources from end-to-end for different classes of service. An application, which acts as a receiver for a traffic stream, initiates a request for reservation of resources (bandwidth) from the network, based on the application's required quality of service. The first RSVP-enabled router that receives the request informs the requesting host whether the requested resources are available or not. The request is forwarded to the next router, towards the sender of the traffic stream. If the reservations are successful, an end-to-end pipeline of resources is available for the application to obtain the required quality of service. RSVP enables applications with real-time traffic needs, such as multimedia applications, to coexist with bursty applications on the same network. RSVP works with both unicast and multicast applications.
- RSVP requires both a network implementation and a client implementation. Applications need to be RSVP-enabled to take advantage of RSVP functionality. Currently, Precept provides an implementation of RSVP for Windows-based PCs. Companies such as Sun and Silicon Graphics have demonstrated RSVP on their platforms. Several application developers are planning to take advantage of RSVP in their applications.
- Random Early Detection---Random Early Detection (RED) helps eliminate network congestion during peak traffic loads. RED uses the characteristics of a robust transport protocol (TCP) to reduce transmission volume at the source when traffic volume threatens to overload a router's buffer resources. RED is designed to relieve congestion on TCP/IP networks.
- RED is enabled on a per-interface basis. It "throttles back" lower-priority traffic first, allowing higher-priority traffic (as designated by an RSVP reservation or the IP precedence value) to continue unabated.
- RED works with RSVP to maintain end-to-end quality of service during peak traffic loads. Congestion is avoided by selectively dropping traffic during peak load periods. This is performed in a manner designed to damp out waves of sessions going through TCP slow start.
- Existing networks can be upgraded to better handle RSVP and priority traffic. Additionally, RED can be used in existing networks to manage congestion more effectively on higher-speed links where fair queueing is expensive.
- Exercise caution when enabling RED on interfaces that support multiprotocol traffic (in addition to TCP/IP), such as IPX or AppleTalk. RED is not designed for use with these protocols and could have deleterious affects.
- RED is a queueing technique; it cannot be used on the same interface as other queueing techniques, such as Standard queueing, Custom queueing, Priority queueing, or Fair queueing.
- Generic Traffic Shaping---Generic Traffic Shaping (also called Interface Independent Traffic Shaping) helps reduce the flow of outbound traffic from a router interface into a backbone transport network when congestion is detected in the downstream portions of the backbone transport network or in a downstream router. Unlike the Traffic Shaping over Frame Relay features which are specifically designed to work on interfaces to Frame Relay networks, Generic Traffic Shaping works on interfaces to a variety of Layer 2 data-link technologies (including Frame Relay, SMDS, Ethernet, etc.)
- Topologies that have high-speed links feeding into lower-speed links---such as a central site to a remote or branch sites---often experience bottlenecks at the remote end because of the speed mismatch. Generic Traffic Shaping helps eliminate the bottleneck situation by throttling back traffic volume at the source end.
- Routers can be configured to transmit at a lower bit rate than the interface bit rate. Service providers or large enterprises can use the feature to partition, for example, T1 or T3 links into smaller channels to match service ordered by customers.
- Generic Traffic Shaping implements a Weighted Fair queueing (WFQ) on an interface or subinterface to allow the desired level of traffic flow. The feature consumes router memory and CPU resources, so it must be used judiciously to regulate critical traffic flows while not degrading overall router performance.
Multiprotocol Routing
The following enhancement has been made to Cisco's multiprotocol routing:
- Enhanced IGRP Optimizations---With the wide-scale deployment of Enhanced Interior Gateway Routing Protocol (Enhanced IGRP) in increasingly large and complex customer networks, Cisco has been able to continuously monitor and refine Enhanced IGRP operation, integrating several key optimizations. Optimizations have been made in the allocation of bandwidth, use of processor and memory resources, and mechanisms for maintaining information about peer routers, as described below.
- Intelligent Bandwidth Control: In network congestion scenarios, packet loss, especially the dropping of routing protocol messages, adversely affects convergence time and overall stability. To prevent this problem, Enhanced IGRP now takes into consideration the available bandwidth (at a granularity of per subinterface/virtual circuit if appropriate) when determining the rate at which it will transmit updates. Interfaces can also be configured to use a certain (maximum) percentage of the bandwidth, so that even during routing topology computations, a defined portion of the link capacity remains available for data traffic.
- Improved Processor and Memory Utilization: Enhanced IGRP derives the distributed routing tables from topology databases that are exchanged between peer routers. This CPU computation has now been made significantly more efficient as has the protocol's queueing algorithm, resulting in improved memory utilization. The combination of these factors further increases Enhanced IGRP's suitability for deployment, particularly on low-end routers.
- Implicit Protocol Acknowledgments: Enhanced IGRP running within a router maintains state and reachability information about other neighboring routers. This mechanism has been modified so that it no longer requires explicit notifications to be exchanged but rather will accept any traffic originating from a peer as a valid indication that the router is operational. This provides greater resilience under extreme load.
- IPX Service Advertisement Interleaving: Large IPX environments are typically characterized by many Service Advertisements, which can saturate lower-speed links at the expense of routing protocol messages. Enhanced IGRP now employs an interleaving technique to ensure that both traffic types receive sufficient bandwidth in large IPX networks.
- These enhancements are particularly applicable in networking environments having many low-speed links (typically in hub-and-spoke topologies); in Non-Broadcast-Multiple-Access (NBMA) wide-area networks such as Frame Relay, ATM, or X.25 backbones; and in highly redundant, dense router-router peering configurations. It should be noted that the basic Enhanced IGRP routing algorithm that exhibits very fast convergence and guaranteed loop-free paths has not changed, so there are no backwards compatibility issues with earlier versions of Cisco IOS software.
Switching Features
The following feature has been added to Cisco's switching software:
- Integrated Routing and Bridging---Integrated routing and bridging (IRB) delivers the functionality to extend VLANs and Layer 2 bridged domains across the groups of interfaces on Cisco IOS software-based routers and interconnect them to the routed domains within the same router.
- The ability to route and bridge the same protocol on multiple independent sets of interfaces of the same Cisco IOS software-based router makes it possible to route between these routed and the bridged domains within that router. IRB provides a scalable mechanism for integration of Layer 2 and Layer 3 domains within the same device.
- Integrated routing and bridging provides:
- Scalable, efficient integration of Layer 2 and Layer 3 domains: The IRB functionality allows you to extend the bridge domains or VLANs across routers while maintaining the ability to interconnect them to the routed domains through the same router.
- Layer 3 address conservation: You can extend the bridge domains and the VLAN environments across the routers to conserve the Layer 3 address space and still use the same router to interconnect the VLANs and bridged domains to the routed domain.
- Flexible network reconfiguration: Network administrators gain the flexibility of being able to extend the bridge domain across the router's interfaces to provide temporary solution for moves, adds, and changes. This can be useful during migration from a bridged environment to a routed environment, or when making address changes on a scheduled basis.
- Note that:
- Currently, IRB supports three protocols: IP, IPX, and AppleTalk, in both fast switching and process switching modes.
- IRB is not supported on ciscoBus bus platforms (the AGS+ and Cisco 7000 series).
- IRB is supported for transparent bridging, but not for source-route bridging.
- IRB is supported on all media-type interfaces except X.25 and ISDN bridged interfaces.
- IRB and concurrent routing and bridging (CRB) cannot operate at the same time.
This section describes the desktop protocol features that are new in the initial release of Cisco IOS Release 11.2.
AppleTalk Features
The following feature has been added to Cisco's AppleTalk software:
- AppleTalk Load Balancing---This feature allows AppleTalk data traffic to be distributed more evenly across redundant links in a network.
- AppleTalk load balancing can reduce network costs by allowing more efficient use of network resources. Network reliability is improved because the chance that network paths between nodes will become overloaded is reduced. For convenience, load balancing is provided for networks using native AppleTalk routing protocols such as Routing Table Maintenance Protocol (RTMP) and Enhanced IGRP.
- AppleTalk load balancing operates with process and fast switching.
Novell Features
The following features have been added to Cisco's Novell software:
- Display SAP by Name---This feature allows network managers to display Service Advertisement Protocol (SAP) entries that match a particular server name or other specific value. The current command that displays IPX servers has been extended to allow the use of any regular expression (including supported special characters) for matching against the router's SAP table.
- IPX Access Control List Violation Logging---With this feature, routers can use existing router logging facilities to log IPX access control list (ACL) violations whenever a packet matches a particular access-list entry. The first packet to match an entry is logged immediately; updates are sent at approximately 5-minute intervals.
- This feature allows logging of:
- Source and destination addresses
- Source and destination socket numbers
- Protocol (or packet) type (for example, IPX, SPX, or NCP)
- Action taken (permit/deny)
- Matching packets and logging-enabled ACLs are sent at the process level. Router logging facilities use the IP protocol.
- Plain English IPX Access List---Through the use of this feature, the most common protocol and socket numbers used in IPX extended ACLs can be specified by either name or number instead of numbers, as required previously.
- Protocol types supported include RIP, SAP, NCP, and NetBIOS. Supported socket types include Novell Diagnostics Packet Enhanced IGRP, and NLSP.
- Plain English IPX Access Lists greatly reduce the complexity and increase the readability of IPX extended access control lists, reducing network management expense by making it easier to build and analyze the access control mechanisms used in IPX networks.
This section describes the wide-area networking features that are new in the initial release of Cisco IOS Release 11.2.
ISDN/DDR Enhancements
The following features have been added to Cisco's ISDN and DDR software:
- Multichassis Multilink PPP (MMP)---Multichassis Multilink Point-to-Point Protocol (MMP) extends Multilink PPP (MLP) by providing a mechanism to aggregate B-channels transparently across multiple routers or access servers. MMP defines the methodology for sharing individual links in a MLP bundle across multiple, independent platforms. The primary application for MMP is the ISDN dial-up pool; however, it can also be used in a mixed technology environment.
- MMP is based on the concept of a stackgroup---a group of routers or access servers that operate as a group when receiving MLP calls. Any member of the stackgroup can answer any call into the single access number applied to all WAN interfaces. Typically, the access number corresponds to a telco hunt group.
- Cross-platform aggregation is performed via tunneling between members of a stackgroup using the Level 2 Forwarding (L2F) protocol, a draft IETF standard.
- MMP is flexible and scalable. Because the L2F protocol is IP-based, members of a stackgroup can be connected over many types of LAN or WAN media. Stackgroup size can be increased by increasing the bandwidth available to the L2F protocol---for example, by moving from shared to switched Ethernet.
- With Multichassis Multilink PPP:
- New devices can be added to the dial-up pool at any time.
- The load for reassembly and resequencing can be shared across all devices in the stackgroup. MMP is less CPU-intensive than MLP.
- MMP provides an interoperable multivendor solution since it does not require any special software capabilities at the remote sites. The only remote requirement is support for industry standard MLP (RFC 1717).
- Universal access servers such as the Cisco 5200 should not be combined with ISDN-only access servers such as the Cisco 4000 series router in a MMP stackgroup. Because calls are allocated by the central office in an arbitrary manner, it is possible that this scenario could lead to an analog call being delivered to a digital-only access server.
|
Note This feature is documented in the PPP for wide-area networking chapters of the Wide-Area Networking Configuration Guide and the Wide-Area Networking Command Reference. |
- Virtual Private Dial-up Network--- Virtual Private Dial-up Network (VPDN) allows users from multiple disparate domains to gain secure access to their corporate home gateways via public networks or the Internet. This functionality is based on the Layer 2 Forwarding (L2F) specification which Cisco has proposed as an industry standard to the Internet Engineering Task Force (IETF).
- Service providers who wish to offer private dial-up network services can use VPDN to provide a single telephone number for all their client organizations. A customer can use dial-up access to a local point of presence where the access server identifies the customer by PPP user name. The PPP username is also used to establish a home gateway destination. Once the home gateway is identified, the access server builds a secure tunnel across the service provider's backbone to the customer's home gateway. The PPP session is also transported to this home gateway, where local security measures can ensure the person is allowed access to the network behind the home gateway.
- Of special interest to service providers is VPDN's independence of WAN technology. Since L2F is TCP/IP-based, it can be used over any type of service provider backbone network.
|
Note This feature is documented in the PPP for wide-area networking chapters of the Wide-Area Networking Configuration Guide and the Wide-Area Networking Command Reference. |
- Dialer Profiles---Dialer profiles allow the user to separate the network layer, encapsulation, and dialer parameters portion of the configuration from that of the interface used to place or receive calls.
- Dialer profile extends the flexibility of current dial-up configurations. For example, on a single ISDN PRI or PRI rotary group it is now possible to allocate separate profiles for different classes of user. These profiles may define normal DDR usage or backup usage.
- Each dialer profile uses an Interface Descriptor Block (IDB) distinct from the IDB of the physical interface used to place or receive calls. When a call is established, both IDBs are bound together so that traffic can flow. As a result, dialer profiles use more IDBs than normal DDR.
- This initial release of dialer profiles does not support Frame Relay, X.25, or LAPB encapsulation on DDR links or Snapshot Routing capabilities.
- Combinet Packet Protocol (CPP) Support---Combinet Packet Protocol (CPP) is a proprietary encapsulation used by legacy Combinet products for data transport. CPP also defines a methodology for performing compression and load sharing across ISDN links. The Cisco IOS software implementation of CPP supports both compression and load sharing using this proprietary encapsulation.
- A large installed base of early Combinet product users cannot upgrade to later software releases that support interoperability standards such as PPP. With CPP support, these users can integrate their existing product base into new Cisco IOS-based internetworks.
- CPP does not provide many of the functions available in Cisco's implementation of the PPP standards. These functions include address negotiation and support for protocols like AppleTalk. Where possible, Cisco recommends that customers migrate to software that supports PPP.
- Half Bridge/Half Router for Combinet Packet Protocol (CPP) and PPP---Half bridge/half router allows low-end, simply configured bridge devices to bridge either PPP or Combinet Packet Protocol (CPP) encapsulated data to a Cisco IOS core network router. Half bridge/half router is designed for networks that have small remote Ethernet segments, each with a single PPP- or CPP-compatible bridging device connected to a core network. The serial or ISDN interface on the core network router appears as a virtual Ethernet port to the network. Layer 3 data packets transported across this type of link are first encapsulated within an Ethernet encapsulation. A PPP or CPP bridging header is then added. This facility allows bridged traffic arriving at the core device to be routed from that point on.
- This feature is process switched.
Frame Relay Enhancements
The following features have been added to Cisco's Frame Relay software:
- Frame Relay SVC Support (DTE)---Currently, access to Frame Relay networks is through private leased lines at speeds ranging from 56 kbps to 45 Mbps. Bandwidth within the Frame Relay network is permanently committed to providing permanent virtual circuits (PVCs) between the endpoints. Switched virtual circuits (SVCs) allow access through a Frame Relay network by setting up a path to the destination endpoints only when the need arises. This is similar to X.25 SVCs, which allow connections to be set up and torn down based upon data traffic requirements. Although SVCs entail overhead for setting up and tearing down links, the VC is only established when data must be transferred, so the number of VCs is proportional to the number of actual conversations between sites rather than the number of sites.
- Frame Relay SVCs offer cost savings via usage-based pricing instead of fixed pricing for a PVC connection, dynamic modification of network topologies with any-to-any connectivity, dynamic network bandwidth allocation or bandwidth-on-demand for large data transfers such as FTP traffic, backup for PVC backbones, and conservation of resources in private networks.
- To use Frame Relay SVCs, Frame Relay SVC must be supported by the Frame Relay switches used in the network. Also, a Physical Local Loop Connection, such as a leased or dedicated line, must exist between the router (DTE) and the local Frame Relay switch.
- Traffic Shaping over Frame Relay
|
Note Traffic shaping over Frame Relay is not available in Release 11.2(1). This feature will be available in a subsequent maintenance release of Release 11.2. Refer to software caveat CSCdi60734. |
- The Frame Relay protocol defines several parameters that are useful for managing network traffic congestion. These include Committed Information Rate (CIR), Forward/Backward Explicit Congestion Notification (FECN/BECN), and Discard Eligibility (DE) bit. Cisco already provides support for FECN for DECnet and OSI, BECN for SNA traffic using direct LLC2 encapsulation via RFC 1490, and DE bit support. The Frame Relay Traffic Shaping feature builds upon this support by providing the following three capabilities:
- Rate Enforcement on a per virtual circuit (VC) basis: A peak rate can be configured to limit outbound traffic to either the CIR or some other defined value such as the Excess Information Rate (EIR).
- Generalized BECN support on a per VC basis: The router can monitor BECNs and throttle traffic based upon BECN marked packet feedback from the Frame Relay network.
- Priority/Custom/First In, First Out queueing (PQ/CQ/FIFO) support at the VC level: This allows for finer granularity in the prioritization and queueing of traffic, providing more control over the traffic flow on an individual VC.
- Frame Relay Traffic Shaping:
- Eliminates bottlenecks in Frame Relay network topologies with high-speed connections at the central site, and low-speed connections at the branch sites. Rate Enforcement can be used to limit the rate at which data is sent on the VC at the central site.
- Provides a mechanism for sharing media by multiple VCs. Rate Enforcement allows the transmission speed used by the router to be controlled by criteria other than line speed, such as the CIR or EIR. The Rate Enforcement feature can also be used to pre-allocate bandwidth to each VC, creating a Virtual Time Division Multiplexing network.
- Dynamically throttles traffic, based on information contained in BECN-tagged packets received from the network. With BECN based throttling, packets are held in the router's buffers to reduce the data flow from the router into the Frame Relay network. The throttling is done on a per VC basis and the transmission rate is adjusted based on the number of BECN-tagged packets received.
- Defines queueing at the VC or subinterface level. Custom queueing with the Per VC queueing and Rate Enforcement capabilities enable Frame Relay VCs to be configured to carry multiple traffic types (such as IP, SNA and IPX), with bandwidth guaranteed for each traffic type.
- The three capabilities of the Traffic Shaping for Frame Relay feature require the router to buffer packets to control traffic flow and compute data rate tables. Because of this router memory and CPU utilization, these features must be used judiciously to regulate critical traffic flows while not degrading overall Frame Relay performance.
The following features have been added to Cisco's Asynchronous Transfer Mode (ATM) software:
- Simple Server Redundancy Protocol (SSRP) for LAN Emulation---The Simple Server Redundancy Protocol (SSRP) provides stand-by redundancy for the following services used by clients in an ATM LAN Emulation (LANE) network: LAN Emulation Configuration Server (LECS), LAN Emulation Server (LES), and Broadcast-and-Unknown Server (BUS). As many as 16 LECSs can be defined for LightStream 1010 switches whereas LS100 switches support only four LECSs. Additionally, LECS addresses can be defined in ILMI on a per-port basis in the LightStream 1010.
- LAN Emulation uses one LES/BUS per emulated LAN and one LECS per multiple emulated LANs. These service components represent single points of failure for each emulated LAN. SSRP removes these single points of failure, providing network managers the redundancy they need for campus ATM backbones with LAN Emulation without adding administrative overhead. A completely redundant, dual-homed ATM backbone can be built without any failure points when SSRP is combined with Hot Standby Router Protocol (HSRP), the dual-phy LANE card for the Catalyst 5000, and support for Spanning Tree on a per VLAN-basis.
- Full implementation of SSRP requires Cisco platforms. Currently, LECS and LES/BUS are available on the Cisco 7000 series, Cisco 7500 series, Cisco 4000 series routers, and the Catalyst 5000. Any LAN Emulation Client (LEC), such as an ATM adapter from one of Cisco's interoperability partners, can take advantage of the LES/BUS redundancy without additional capability. To fully implement LECS redundancy, a LEC must also:
- Provide complete support for ILMI, allowing multiple server ATM addresses to be given to a client.
- Try to contact the next LECS from that list, should the previous LECS not respond during initialization.
- The Catalyst 5000 LAN Emulation module will support SSRP when configured to run the LECS and LES/BUS in LS1010 software Release 3.1.
- Non-Cisco LECs that can only communicate to the well-known LECS address can also take advantage of SSRP, provided:
- They do not bypass the configuration phase, which is optional in the LANE 1.0 specification
- When LAN Emulation clients (LECs) lose BUS connections, they should go back to the configuration phase.
- Hot Standby Router Protocol (HSRP) support for LAN Emulation---If there is more than one router connected to an emulated LAN, Cisco's Hot Stand-by Router Protocol (HSRP) allows one of those routers to monitor the status of the other and take over the functions of that router should it fail or become unavailable.
- HSRP provides inter-ELAN (or inter-VLAN) routing redundancy. HSRP over LANE is transparent to hosts expecting to always to be able to reach their default gateway (router). Without HSRP, IP hosts would need to be configured with RIP to recover from a failure of its default gateway. This method can result in a 10-minute delay before the host can use its second default gateway. A completely redundant, dual-homed ATM backbone can be built without any failure points when HSRP is combined with Simple Server Redundancy Protocol (SSRP), the dual-phy LANE card for the Catalyst 5000, and support for Spanning Tree on a per VLAN-basis.
- HSRP is a unique protocol developed by Cisco and used only by Cisco IOS software-based routers. HSRP over LAN Emulation is available in Cisco devices that support ATM interfaces such as the Cisco 7000 series, Cisco 7500 series, and Cisco 4000 series routers.
- Additional Protocol Routing Support for LAN Emulation---This feature adds the ability to route DECnet, Banyan VINES, and XNS from a subinterface on an ATM router port running LAN Emulation client to any other subinterface on an ATM router port running LAN Emulation client or any other router port. Support for DECnet routing between VLANs for ATM LAN Emulation requires DECnet Phase IV.
- When DECnet routing is configured, there is a one-time reset of the interface so that the MAC address of the interface can reflect the DECnet Phase IV MAC address conventions. If SSRP is also configured, there is a switchover to the secondary LECS and back as a result of configuring DECnet.
- UNI 3.1 Signaling Support---The full breadth of UNI signaling protocol support is available. The ATM Forum submitted the UNI 3.0 signaling specification to the ITU, which subsequently made changes to the SSCOP encapsulation used to make signaling reliable. UNI 3.1 was published later by the ATM Forum to align with the ITU, otherwise there is no difference in functionality between UNI 3.0, currently supported on all Cisco ATM platforms, and UNI 3.1.
- Rate Queues for SVCs per subinterface---In previous releases, SVCs which do not use static maps could not participate in traffic shaping---they were assigned to a rate queue at the interface line rate. In Release 11.2, all SVCs on an interface for which explicit traffic-shaping parameters have not been specified can be assigned a set of traffic-shaping parameters via a map-class tied to the interface. These parameters can, for example, be assigned to SVCs used to run RFC 1577 Classical IP over ATM.
|
Note The interface-level traffic shaping parameters are not applied to SVCs used for LAN Emulation (LANE). These SVCs continue to be unshaped. |
- AToM MIB Support---This provides support for the AToM Management Information Base (MIB), described in IETF RFC 1695, which defines configuration information as well as error and cell-level counters. Release 11.2 provides a standard AToM MIB instrumentation for many of the counters already provided in the router's ATM interfaces.
- AToM MIB instrumentation is used by network management applications, such as Cisco's AtmDirector, to perform topology auto-discovery and status checking.
Core Enhancements
The following feature has been added to the Cisco 7000 series, Cisco 7200 series, and Cisco 7500 series routers:
- NetFlow Switching---NetFlow Switching is a new software switching mechanism that allows Cisco routers to combine high-performance network-layer switching with the application of network services. To achieve this high performance, NetFlow Switching identifies traffic flows between internetwork endpoints and then, on a connection-oriented basis, switches packets in these streams at the same time that it applies relevant services. By identifying flows using both network-layer and transport-layer information, NetFlow Switching allows Cisco IOS services to be applied on a per-user, per-application basis.
- With NetFlow Switching, network users can extend their use of existing Cisco IOS services, such as security access lists or the collection of traffic statistics, without paying the performance penalty usually associated with such processing-intensive functions. This increase in performance allows these services to be used in more places within the network and on a larger scale. Extending network security is increasingly important as networks need to support access from remote users and across public Internet services. Detailed information on traffic flows helps network managers to grow their networks in the most cost-effective way.
- NetFlow Switching provides increased performance for the application of existing Cisco IOS services such as security access lists and accounting. Previously, system performance could be affected by as much as 30 percent for each service invoked. With NetFlow Switching, system switching performance can be maintained within 10 to 15 percent of optimum levels for all supported services. As with any connection-oriented technique, the performance of NetFlow Switching is affected by the total number of active flows.
- Cisco's initial implementation of NetFlow Switching supports Internet Protocol (IP) traffic over all interface types and provides optimal performance with Ethernet, Fiber Distributed Data Interface (FDDI), and High-Level Data Link Control (HDLC) serial interfaces.
- NetFlow Switching is supported on the Cisco 7500 series and Cisco 7000 series routers with a Route Switch Processor (RSP). On these routers, NetFlow Switching can operate on the master RSP or on a distributed basis on individual Versatile Interface Processors (VIPs).
This section describes the IBM network software features and support that are new in the initial release of Cisco IOS Release 11.2.
The following new IBM software features are available:
- Native Client Interface Architecture (NCIA) Server---The Native Client Interface Architecture (NCIA) server, introduced by Cisco Systems for access of IBM SNA applications over routed internetworks, has been enhanced to be more flexible and scalable. The NCIA Client, implemented in the client workstation, encapsulates the full SNA stack inside TCP/IP packets. These packets are sent to the NCIA Server implemented in Cisco IOS software. The NCIA Server de-encapsulates the TCP/IP packet and sends the LLC data to the host processor via RSRB or DLSw+.
- The NCIA Server supports SNA and NetBIOS sessions over a variety of LAN and WAN connections, including dial-up connections. The NCIA architecture supports clients with full SNA stacks---providing all advanced SNA capabilities, unlike some split-stack solutions.
- NCIA Server enhancements provide:
- Simplified client configuration: It is no longer necessary to predefine ring numbers, and the NCIA Server supports optional dynamic assignment of MAC addresses. There is no Logical Link Control, type 2 (LLC2), at the client. The client is configured as an end station, not a router peer.
- Scalability: The limit is based on the number of LLC connections in the central site router rather than RSRB peer connections.
- Note that each client is a full SNA PU with one or more LUs. As such, each device requires one LLC connection at the central site router. The Cisco 4700 currently supports 3000-4000 LLC connections.
- TN3270 Server---The TN3270 Server is a new feature of the Channel Interface Processor (CIP) of the Cisco 7000 family of routers. The TN3270 Server allows TN3270 and TN3270E clients access to IBM and IBM-compatible mainframes without the limitations of existing alternatives. It off-loads 100 percent of the TCP/IP and TN3270 cycles from the mainframe, and offers a robust, scalable and dynamic implementation that meets the stringent requirements of the Data Center.
- The TN3270 Server on the CIP supports up to 8000 concurrent sessions on a CIP and up to 16000 concurrent sessions on a CIP2 card. The TN3270 Server offers the following advanced capabilities:
- Load Balancing and Redundancy: Provides effective utilization of CIP resources and more consistent response times.
- End-to-End Session Visibility: Provides enhanced management of resources.
- SNA Session Switching: The SNA Session Switch enables cross-domain traffic to bypass the owning VTAM.
- TN3270E Support: In combination with a TN3270E client, provides advanced SNA management and SNA functionality, including printer support.
- Dynamic Definition of Dependent LUs: Provides simplified configuration and network definition at the router and in VTAM.
- Dynamic Allocation of LUs: Removes the need to pool LU resources while supporting multiple SNA model types.
- TN3270 Server requires 32 MB of CIP DRAM to support up to 4000 sessions, 64 MB to support 8000 sessions, and 128 MB to support 16000 sessions. TN3270 Server can run concurrently with any of the other CIP applications (IP Datagram, TCP/IP Off-load, or CSNA), but operation of any of these features will affect the total number of sessions supported due to contention for CIP processor cycles.
- Fast Switched Source-Route Translational Bridging (SR/TLB)---With Cisco IOS Software Release 11.2, SR/TLB is fast switched. No queueing is done and resource utilization is low. This enhancement is on by default, but can be disabled. It is supported across all router platforms except the Cisco 7200. For the Cisco 7200, fast switching is only supported in Release 11.2 P.
- Fast Switched SR/TLB improves performance on all platforms by a factor of at least 2; for the Cisco 4500 and Cisco 4700, by a factor of 3. It is ideal for IBM environments (for example, where low-cost Ethernet adapters are being installed on campus, but Token Ring connectivity to a FEP is still required) and for campus environments with a mix of Token Ring and Ethernet LANs and/or switches that rely on the Cisco IOS software for translational bridging.
- Response Time Reporter---The Response Time Reporter (RTR) feature allows you to monitor network performance, network resources, and applications by measuring response times and availability. RTR statistics can be used to perform troubleshooting, problem notifications and pre-problem analysis. RTR offers enhanced functionality over a similar IBM product, NetView Performance Monitor.
- RTR enables the following functions to be performed:
- Troubleshoot problems by checking the time delays between devices (such as a router and a MVS host) and the time delays on the path from the source device to the destination device at the protocol level.
- Send SNMP traps and/or SNA Alerts/Resolutions when one of the following has occurred: a user-configured threshold is exceeded, a connection is lost and reestablished, or a timeout occurs and clears. Thresholds can also be used to trigger additional collection of time delay statistics.
- Perform pre-problem analysis by scheduling the RTR and collecting the results as history and accumulated statistics. The statistics can be used to model and predict future network topologies.
- The RTR feature is currently available only with feature sets that include IBM support. A CiscoWorks Blue network management application will be available to support the RTR feature. Both the CiscoWorks Blue network management application and the router use the Cisco Round Trip Time Monitor (RTTMON) MIB. This MIB is also available with Release 11.2.
The following features have been added to Cisco's APPN software:
- APPN Central Resource Registration---APPN Central Resource Registration (CRR) support allows a Cisco IOS software-based router acting as a network node (NN) to register the resources of end nodes (ENs) to the Central Directory Service (CDS) on Advanced Communication Facility/Virtual Telecommunication Access Method (ACF/VTAM). A Cisco IOS NN will now register resource names with a VTAN CDS as soon as it establishes connectivity with it. Prior to this enhancement, the router acting as a NN could not register EN resources. ACF/VTAM could, however, query the router to find these resources.
- The CDS reduces broadcast traffic in the network. Without an active CDS on ACF/VTAM, the NN must send a broadcast message to the network to locate nonlocal resources required for a session. With an active CDS, the NN sends a single request directly to the CDS for the location of the resource. A network broadcast is used only if the resource has not registered with the CDS.
- ACF/VTAM must be configured as a CDS. The Cisco IOS NN learns of the capability when network topology is exchanged. To most effectively use the CDS, ENs should register the resources with the NN. Depending on the EN implementation, registration may occur automatically, may require configuration on the EN, or may not be a function of the EN.
- APPN DLUR MIB---The existing APPN Management Information Base (MIB) does not contain information about Dependent Logical Units (DLUs) accessing the APPN network through the DLU Requester (DLUR) function in the Cisco IOS NN. A standard MIB for DLUR has been defined by the APPN Implementers Workshop (AIW), the standards body for APPN, and is implemented in this release of the Cisco IOS software.
- With the APPN DLUR MIB, users have access to information collected about the DLUR function in the Cisco IOS NN and the DLUs attached to it for more complete network management information.
The following features have been added to Cisco's DLSw+ software. These features had previously been available with Remote Source-Route Bridging (RSRB). To provide these features for DLSw+, the Cisco IOS software uses a component known as Virtual Data Link Control (VDLC) that allows one software component to use another software component as a data link.
- LAN Network Manager (LNM) over DLSw+---LAN Network Manager (LNM) over DLSw+ allows DLSw+ to be used in Token Ring networks that are managed via IBM's LNM software.
- With this feature, LNM can be used to manage Token Ring LANs, Control Access Units (CAUs), and Token Ring attached devices over a DLSw+ network. All management functions continue to operate as they would in an RSRB network or source-route bridged network.
- Native Service Point (NSP) over DLSw+---Native Service Point (NSP) over DLSw+ allows Cisco's NSP feature to be used in conjunction with DLSw+ in the same router.
- With this feature, NSP can be configured in remote routers, and DLSw+ can provide the path for the remote service point PU to communicate with NetView. This allows full management visibility of resources from a NetView 390 console, while concurrently offering the value-added features of DLSw+ in an SNA network.
- Down Stream Physical Unit (DSPU) over DLSw+---Down Stream Physical Unit (DSPU) over DLSw+ allows Cisco's DSPU feature to operate in conjunction with DLSw+ in the same router. DLSw+ can be used either upstream (towards the mainframe) or downstream (away from the mainframe) of DSPU.
- DSPU concentration consolidates the appearance of up to 255 physical units into a single PU appearance to VTAM, minimizing memory and cycles in central site resources (VTAM, NCP, and routers) and speeding network startup. Used in conjunction with DLSw+, network availability and scalability can be maximized.
- Advanced Peer-to-Peer Networking (APPN) over DLSw+---Advanced Peer-to-Peer Networking (APPN) over DLSw+ allows Cisco's APPN feature to be used in conjunction with DLSw+ in the same router.
- With this feature, DLSw+ can be used as a low-cost way to access an APPN backbone or APPN in the data center. In addition, DLSw+ can be used as a transport for APPN, providing nondisruptive recovery from failures and high speed intermediate routing. In this case, the DLSw+ network appears as a connection network to the APPN network nodes (NNs).
- Source-Route Bridging (SRB) over FDDI to DLSw+---This feature allows access to DLSw+ over source-route bridged FDDI LANs. In the past, the supported local DLCs were only Token Ring, Ethernet, or SDLC. With this extension, Token Ring-attached devices can access a DLSw+ router using source-route bridging over an FDDI backbone. At the remote site, the device can be attached over Token Ring, Ethernet, SDLC, or FDDI. This is useful either in environments with Token Ring switches that use FDDI as a campus backbone or in environments with Cisco 7000 and Cisco 7500 series routers providing SRB over an FDDI backbone.
- This feature allows SRB over FDDI to provide the highest speed access between campus resources, while concurrently allowing DLSw+ for access to remote resources.
- Currently, SRB over FDDI is supported by the Cisco 7000 and Cisco 7500 series platforms only.
This section describes the security features that are new in the initial release of Cisco IOS Release 11.2.
New Features
- Router Authentication and Network-Layer Encryption---This feature provides a mechanism for secure data transmission. It consists of two components:
- Router Authentication: Prior to passing encrypted traffic, two routers perform a one-time, two-way authentication by exchanging Digital Signature Standard (DSS) public keys. The hash signatures of these keys are compared to authenticate the routers.
- Network-Layer Encryption: For IP payload encryption, the routers use Diffie-Hellman key exchange to securely generate a DES 40- or 56-bit session key. New session keys are generated on a configurable basis. Encryption policy is set by crypto-maps that use extended IP Access Lists to define which network, subnet, host, or protocol pairs are to be encrypted between routers.
- This feature can be used to build multiprotocol Virtual Private Networks (VPNs), using encrypted Generic Routing Encapsulation (GRE) tunnels. It can also be used to deploy secure telecommuting services, Intranet privacy, and virtual collaborative or community-of-interest networks.
- All components of this feature are subject to U.S. Department of Commerce export regulations. Encryption is currently IP only, though it does support multiprotocol GRE tunnels. This feature is most appropriately deployed in a relatively small number of routers, with a logically flat or star-shaped encryption topology. Load-sharing of the encryption/decryption function is not supported. Without a Certification Authority (CA), the one-time authentication effort increases exponentially with the number of routers. Router authentication requires the network administrator to compare the hashes produced by the routers, once during initial configuration. This version of encryption is not IPSEC compliant.
- Kerberos V Client Support---This feature provides full support of Kerberos V client authentication, including credential forwarding.
- Systems with existing Kerberos V infrastructures can use their Key Distribution Centers (KDCs) to authenticate end-users for network or router access.
- This is a client implementation, not a Kerberos KDC. Kerberos is generally considered a legacy security service and is most beneficial in networks already using Kerberos.
TACACS+ Enhancements
The following features have been added to Cisco's TACACS+ software:
- TACACS+ Single Connection---Single Connection is an enhancement to the network access server that increases the number of transactions per second supported. Prior to this enhancement, separate TCP connections would be opened and closed for each of the TACACS+ services: authentication, authorization, and accounting. This became a bottleneck for improving throughput on authentication services for large networks.
- Single Connection is an optimization whereby the network access server maintains a single TCP connection to one or more TACACS+ daemons. The connection is maintained in an open state for as long as possible, instead of being opened and closed each time a session is negotiated. It is expected that Single Connection will yield performance improvements on a suitably constructed daemon.
- Currently, only the CiscoSecure daemon V1.0.1 supports Single Connection. The network access server must be explicitly configured to support a Single Connection daemon. Configuring Single Connection for a daemon that does not support this feature will generate errors when TACACS+ is used.
- TACACS+ SENDAUTH Function---SENDAUTH is a TACACS+ protocol change to increase security. SENDAUTH supersedes SENDPASS. SENDAUTH and SENDPASS are documented in Version 1.63 of the TACACS+ protocol specification, which is available from CCO or via anonymous FTP from ftp-eng.cisco.com.
- The network access server can support both SENDAUTH and SENDPASS simultaneously. It detects if the daemon is able to support SENDAUTH and, if not, will use SENDPASS instead. This negotiation is virtually transparent to the user, with the exception that the down-rev daemon may log the initial SENDAUTH packet as unrecognized.
- SENDAUTH functionality requires support from the daemon, as well as the network access server.
This section describes the network management features that are new in the initial release of Cisco IOS Release 11.2.
New Features
- HTTP Server---The Cisco 7200 series introduces an HTML management tool. This tool allows customers to navigate through the command line interface via Web-like hot links. It also displays a logical view of the hardware configuration. Customers can point and click on interfaces to check status or to modify the configuration. Because the tool resides in Flash memory, Web pages can be customized to add frequently used hot links, for example, or to add a company logo.
- ClickStart---ClickStart is a powerful Web-based software solution that enables users to install a Cisco router in minutes. ClickStart enables Cisco 1000 series ISDN access routers to be accessed by any Web browser on any desktop platform including MS Windows, Windows 95, Windows NT, UNIX and MacOS. The easy-to-use Web-based interface guides users through the router installation process. By completing an initial setup form, a user can easily configure the router and bring up the ISDN network connection. The router is then manageable from a central location, so that fine-tuning and upgrades can be performed remotely.
The following MIB support has been added:
- See the ""APPN Enhancements"" section for details.
- See the ""ATM Enhancements"" section for details.
- See the ""New Features"" subsection in the ""IBM Functionality"" section for details.
- Cisco IP Encryption MIB
- Cisco Modem Management MIB
- Cisco SYSLOG MIB
- Cisco TN3270 Server MIB
- SNA NAU
- Cisco Memory Pool
This section describes warnings and cautions about using the Cisco IOS Release 11.2 software. It discusses the following topics:
Traffic shaping over Frame Relay is not available in Release 11.2(1). This feature will be available in a subsequent maintenance release of Release 11.2. Refer to software defect ID CSCdi60734.
The LAN extension interface does not function correctly in Release 11.2(1). The behavior is that the LAN extension NCP negotiates and sets the LAN extension interface state to "up" and the show controller lex number command displays the message "No inventory message received from LAN Extender." Turning on the LAN extension RCMD debugging shows that every remote command is being rejected with the message "LEX-RCMD: encapsulation failure." There is no workaround. This problem is being tracked as bug ID CSCdi66478.
The commands lane auto-config-atm-address, lane fixed-config-atm-address, and lane config-atm-address have been changed. Previously, the effect of these commands depended on whether they were used on a major interface or on a subinterface. In Release 11.2(1) and later releases, an optional keyword config indicates that the command causes the configuration server to listen on the designated address. If the keyword is not used, the command causes the other LANE clients and servers on the interface to use the designated address to locate the configuration server. Refer to the Wide-Area Networking Command Reference publication for more information about these commands.
CIP microcode is now available as a separate image, unbundled from the Cisco IOS image. CIP microcode (for the CIP or Second-Generation CIP [CIP2] card) resides only in router Flash memory as multiple files. The router loads a "kernel" to the CIP (based upon hardware revision), and the CIP selectively loads and relocates the software it requires from the router's Flash memory. The CIP image is available on pre-loaded Flash memory cards, on floppy diskette, or via FTP from Cisco. Every version of Cisco IOS Release 11.2 has a corresponding version of CIP microcode. Refer to the Channel Interface Processor (CIP) Microcode Release Note and Microcode Upgrade Requirements publication (Document Number 78-4715-xx) for information about the recommended pairs of Cisco IOS Release 11.2 and CIP microcode.
Consider the following before using Cisco IOS Release 11.2 and CIP microcode:
- If you have a router with Release 11.2 and a Release 11.2 CIP image on a Flash memory card, no action is required. The CIP microcode will load automatically upon booting the router.
- If you have an existing router with Release 11.2 in Flash memory or ROM and a pre-11.1 Flash memory card, either:
- Replace the Flash memory card with a Release 11.2 pre-loaded Flash memory card, or
- Boot the router with Release 11.2 software (CIP load will fail), then copy the Release 11.2 CIP image to the Flash memory card, and reboot the router.
When the CIP image is copied to an existing Flash memory card, the existing flash copy commands are used, just as before. If a CIP image other than the default for the release is being used, then the microcode cip flash configuration command must be issued.
The show microcode command has been expanded to display the default CIP image name for the Cisco IOS release.
|
Note The router must already be running Cisco IOS Release 11.2 before performing a copy of the CIP image to Flash memory because the CIP image must be "exploded" from the single image file on the TFTP server to multiple files in Flash memory. This capability was first available in Release 11.1. |
There are a number of ways to determine what is loaded on each CIP:
- The CIP MIB has been enhanced to show the segments loaded on each CIP and their version and compilation information.
- The show controller cbus command has been expanded to include segments loaded and their version and compilation information.
Multiple CIP cards of different hardware revisions can run in the same router.
To successfully use the HSA feature, you should take note of the following:
- The HSA feature available on the Cisco 7500 series routers requires a ROM monitor upgrade to ROM monitor version 11.1(2), or later.
- For spare RSP2 cards to function with HSA, they must also be upgraded. Spare Flash cards require Release 11.1(4) or higher boot or system images.
- HSA installation requires that both RSP2s have the same amount of DRAM (32 MB minimum each RSP2).
To netboot from Ethernet or Fast Ethernet ports on a VIP, the system must contain version 11.1 boot ROMs. If the system contains version 11.0 boot ROMs, you can work around this requirement by using the boot bootldr device:filename global configuration command to load a bootstrap image from Flash memory.
This feature supports forwarding of source-route bridged traffic between Token Ring and FDDI interfaces on the Cisco 7000, Cisco 7010, and Cisco 7500 series routers. Previously, the only way to transport SNA and NetBIOS over FDDI was with remote source-route bridging (RSRB), which is either fast switched (direct or Fast-Sequence Transport (FST) encapsulation) or process-switched (TCP encapsulation). With SRB over FDDI, traffic can be autonomously switched, greatly improving performance for SRB traffic that uses FDDI as a backbone. This feature eliminates the need for RSRB peer definitions to connect Token Ring networks over the FDDI backbone.
|
Note SRB over FDDI does not support RSRB traffic forwarded to RSRB peers. Routers that have connections to local Token Ring networks as well as RSRB connections to remote networks cannot use this feature. The workaround is to move the RSRB connections to routers that are not connected to the FDDI backbone. |
The Token Ring interface is reset whenever IPX routing is enabled on that interface.
Cisco 7000 series ATM Interface Processor (AIP) cards that support E3, DS3, or Transport Asynchronous Transmitter/Receiver Interface (TAXI) connections and that were shipped after February 22, 1995, require Cisco IOS Release 10.0(9), 10.2(5), 10.3(1), or later.
You must use the Release 9.14 rxboot image for Cisco 4000 routers because the Release 11.0 rxboot image is too large to fit in the ROMs. (Note that rxboot image size is not a problem for Cisco 4500 routers.) However, because the Release 9.14 rxboot image does not recognize new network processor modules, such as the Multiport Basic Rate Interface (MBRI), its use causes two problems:
- You cannot boot from a network server over BRI lines. Instead, you can boot either from a network server over other media or use the copy tftp flash command to copy images over BRI or other media to Flash memory. If you use the copy tftp flash command over a BRI interface, you must be running the full system image.
- If you use the rxboot image on a Cisco 4000 router that is already configured, the following error messages are displayed, with one pair of messages for each BRI interface configured:
Bad interface specification
No interface specified - IP address
Bad interface specification
No interface specified - IP address
Note the following information regarding the LAN Emulation (LANE) feature in Cisco IOS Release 11.2:
- LANE is available for use with Cisco 4500, 4700, 7000, and 7500 series routers connected to either an LS100 or LS1010 switch. LANE requires at least version 3.1(2) of the LS100 software, which requires a CPU upgrade if you are currently running software prior to version 2.5.
- The LS2020 cannot be used for LANE because it does not support UNI 3.0 and point-to-multipoint SVCs.
- Routing of IP, IPX, AppleTalk, DECnet, VINES, and XNS is supported.
- HSRP is supported.
- LANE does not support CLNS or LANE over PVCs.
- AppleTalk Phase 1 cannot be routed to AppleTalk Phase 2 via LANE.
Our implementation of AppleTalk does not forward packets with local-source and destination network addresses. This behavior does not conform to the definition of AppleTalk in Apple Computer's Inside AppleTalk publication. However, this behavior is designed to prevent any possible corruption of the AppleTalk Address Resolution Protocol (AARP) table in any AppleTalk node that is performing MAC-address gleaning.
Certain products containing the Texas Instruments TMS380C26 Token Ring controller do not support SRT. SRT is the concurrent operation of SRB and transparent bridging on the same interface. The affected products, shipped between March 30, 1994, and January 16, 1995, are the Cisco 4000 NP-1R, Cisco 4000 NP-2R, Cisco 2502, Cisco 2504, Cisco 2510, Cisco 2512, Cisco 2513, and Cisco 2515.
Units shipped before March 30, 1994, or after January 16, 1995, are not affected. They use the Texas Instruments TMS380C16 Token Ring controller, which supports SRT.
SRT support is necessary in two situations. In one, Token Ring networks are configured to SRB protocols such as SNA and NetBIOS, and they transparently bridge other protocols, such as IPX. In the other situation, SNA or NetBIOS uses SRB and Windows NT is configured to use NetBIOS over IP. Certain other configuration alternatives do not require SRT (contact the Technical Assistance Center for more information).
As of Release 10.3(1), SRB in the following Cisco IOS features sets is no longer supported: IP, IP/IPX, and Desktop. To use SRB, you need one of the following feature sets: IP/IBM base, IP/IPX/IBM base, IP/IPX/IBM/APPN, Desktop/IBM base, Enterprise, or Enterprise/APPN. In most non-IBM Token Ring environments, the multiring feature in IP, IP/IPX, and Desktop eliminates the need for IP/IBM base, IP/IPX/IBM base, IP/IPX/IBM/APPN, Desktop/IBM base, Enterprise, or Enterprise/APPN.
Cisco IOS software releases 11.2(7) and 11.2(7)P were deferred due to two severe defects. It was determined that these caveats were significant enough to merit a software rebuild. The rebuild includes the caveat fixes and is renumbered to 11.2(7a).
These defects are bugs CSCdj24132 and CSCdj21944 and are described as follows:
- A router crashes every time it receives an ISDN Q.931 DISCONNECT message. This problem only affects net3 switch types.
- A router may also crash if the clear interface bri command is issued. This problem only affects net3, vn2/vn3, and ts013 switch types. [CSCdj24132]
- A memory allocation error occurs after a large number of modem calls are placed to an AS5200 configured for PRI ISDN. After the AS5200 starts to generate a number of these memory allocation error messages, calls cannot be answered.
- The following are indicators that may be used to determine if the AS5200 is encountering this problem:
- When the AS5200 runs out of memory, MALLOC Failure messages similar to the one shown will be displayed:
%SYS-2-MALLOCFAIL: Memory allocation of 1056 bytes failed from 0x2214E776, pool Processor, alignment 0
-Process= "Net Periodic", ipl= 0, pid= 34
-Traceback= 2214D3E0 2214E542 2214E77E 2214BEC6 2214C12A 22159466 2215E86E 22140BDE 2213B688 2213B6E0
- If there is no ISDN process in the output from the show process command, and you start to see "%SYS-2-MALLOCFAIL" error messages, then the memory leak was caused by this bug.
- If there are more than 46 entries marked "Active" in the output from the show isdn history command, then the memory leak was caused by this bug.
- [CSCdj21944]
Release 11.2(7a) and all subsequent releases of Cisco IOS software include the fix for these caveats.
Prior to Cisco IOS Release 11.1(13) and 11.2(8), the atm multipoint-signaling command was used on the main interface and affected all subinterfaces. For Release 11.1(13), 11.2(8) and later releases, explicit configuration on each subinterface is required to obtain the same functionality. Refer to bug CSCdj20944, which is described as follows:
- The atm multipoint-signaling interface command is currently only available on the main ATM interface. The effect is that signaling behavior (point-to-point or point-to-multipoint) for all clients on all subinterfaces is determined by the command on the main interface.
- Clients on different subinterfaces can have different behavior. Specifically 1577 requires point-to-point, and PIM allows point-to-multipoint. The command should be on a per subinterface basis.
- Users will have to enable the atm multipoint-signaling command on all subinterfaces that require it. Previously, they only needed to enable it on the main interface.
Cisco IOS software Releases 11.2(10) and 11.2(10)P were deferred due to two severe defects. It was determined that these caveats were significant enough to merit a software rebuild. The rebuild includes the caveat fixes and is renumbered to 11.2(10a).
These defects are bugs CSCdj58676 and CSCdj60533 and are described as follows:
- With Enhanced IGRP routing configured, redistribution of the following type of routes into the Enhanced IGRP process will not work correctly:
- A directly connected route
- A static route with the next hop set to an interface
- A static route with the next hop set to a dynamically learned route
- The nature of the defect is that it will only occur after a dynamic event. If redistribution is manually configured, EIGRP will initially reflect correct information in the topology table. However, after any sort of dynamic event the topology table becomes invalid and routing updates sent are inaccurate. [CSCdj58676]
|
Note The code changes committed by CSCdj58676 resolved some issues but created the symptoms reported in CSCdj65737. The code changes for CSCdj58676 were only committed to releases 11.2(10a), 11.2(10a)BC and 11.2(10a)P, therefore they are the only ones affected by CSCdj65737. See the "Release 11.2(11) Reintroduces Caveat CSCdj28874" section for more information related to CSCdj58676 and CSCdj65737. |
- The ARP lookup routine may suspend, causing unexpected behaviors for IP protocols. For example, if the OSPF routing process is traversing a list of neighbors to send LSA packets and the ARP routine is called, the ARP routine suspension could cause a system reset. [CSCdj60533]
CSCdj65737 was introduced by code changes associated with CSCdj58676. The issue is that routes are not being redistributed into Enhanced IGRP from other routing protocols if both protocols are routing for the same major network.
The code changes for CSCdj58676 were only applied to 11.2(10a), 11.2(10a)BC and 11.2(10a)P releases, therefore, those releases are the only ones impacted by CSCdj65737. The fix to CSCdj65737 will be to back out the code changes committed by CSCdj58676 and CSCdj28874. That change will have the effect of reintroducing the behavior reported by CSCdj28874, which is described as follows:
- When a network is included in the Enhanced IGRP routing process because it is specified with the network x.x.x.x command and that same network is redistributed into Enhanced IGRP via the redistribute connected command, there will be two entries for the network in the Enhanced IGRP topology table.
- If the interface connecting that network goes down, only one of the two entries will be removed from the topology table. The entry learned via redistribution will remain in the topology table and be advertised, even though it is no longer valid. [CSCdj28874]
The code back-outs of CSCdj65737 and reintroduction of CSCdj28874 will appear in the following releases:
- 11.2: 11.2(11), 11.2(11)BC, 11.2(11)P
- 11.1: 11.1(16), 11.1(16)AA, 11.1(16)CA, 11.1(16)IA
All defect resolution information pertaining to CSCdj58676 is superseded by the details relating to CSCdj65737.
The symptoms of CSCdj28874 may be avoided by not using the redistributed connected command and instead specifying the individual networks to be redistributed into Enhanced IGRP.
Cisco is conducting an internal review of the build and distribution processes associated with its 40-bit IOS cryptographic products. So that we may provide you with seamless access to IOS 40-bit encryption capability, Cisco will provide access to the most current 40-bit encryption images, beginning with 11.2 (12), 11.2(12)P, and 11.3(2). The following 40-bit encryption images will be indefinitely unavailable: 11.2(1) - 11.2(11.2), 11.2(2)P - 11.2(11.1)P, 11.2(1)F - 11.2(4)F, 11.3(1).
This review is not related to any new or previously unreported bugs. The information gathered in the review will be used to implement new automated development, and order processing applications.
Cisco IOS software Release 11.2(12) was deferred due to two severe defects. It was determined that this caveat was significant enough to merit a software rebuild. The rebuild includes the caveat fix and is renumbered to 11.2(12a).
The defect is caveat CSCdj52309 and is described as follows:
- A catastrophic problem has been identified that affects all Cisco 7500 series and Catalyst 5000 RSM users. The problem occurs when using packet tunneling in combination with certain timing conditions, packet sizes, and buffer-usages. Affected images are being deferred and special images are being built.
- Tunneling is being used as an abbreviation in this context to refer to a specific fast-switch to process-level code path traversed by translational bridging (TLB), source route bridging (SRB), and remote source route bridging (RSRB).
- When the packet tunneling logic on RSP or RSM-equipped systems causes datagrams to be copied from SRAM to DRAM, an arithmetic error results in more bytes being copied than is remembered for cleanup processing. Reuses of the tunneling logic, in certain rare combinations of timing, packet-sizes, and buffer-usages, may result in those unaccounted bytes causing several anomalous system behaviors including packet errors.
- This software defect is exposed to all RSP and RSM images in the following Cisco IOS software releases: 11.2, 11.2P, 11.2BC, 11.3, 11.3T.
- Solution: To eliminate the problems mentioned in the preceding section, we strongly recommend that you download and install one of the following Cisco IOS software release updates: 11.2(12a), 11.2(12a)P, 11.3(2a), 11.3(2a)T.
- Workarounds: There are two possible workarounds. CSCdj33812 provides a configuration command to avoid the software defect. This workaround is available in the following Cisco IOS Releases: 11.2(11.5), 11.2(11.5)P, 11.2(11.5)BC, 11.3(2.1), and 11.3(2.1)T. If you are using an earlier release, use the second workaround.
|
Note The two workarounds will drop performance down to process switching levels. |
- CSCdj33812 incorporated a configurable command that will be stored in NVRAM.
- Configure with the memory cache-policy io uncached command to workaround CSCdj52309. To determine what memory cache policies are currently configured on your router, use the show rsp command.
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#memory cache-policy io uncached
Router(config)#end
Router#show rsp
Throttle count 0, DCL timer count 0
active 0, configured 1
netint usec 4000, netint mask usec 200
DCL spurious 0
Caching Strategies:
Processor private memory: write-back
Kernel memory view: uncached
IO (packet) memory: uncached
Buffer header memory: uncached
- To restore the MEMD caching policy to the original write-through policy, issue the memory cache-policy io write-through command.
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#memory cache-policy io write-through
Router(config)#end
Router#show rsp
Throttle count 0, DCL timer count 0
active 0, configured 1
netint usec 4000, netint mask usec 200
DCL spurious 0
Caching Strategies:
Processor private memory: write-back
Kernel memory view: write-back
IO (packet) memory: write-through
Buffer header memory: uncached
- If operating with images that do not have the CSCdj33812 support use the test rsp cache memd-fastswitch uncache command.
- The above command will need to be entered after every reload.
- Other considerations: Cisco IOS Releases 10.3, 11.0, and 11.1 Major and ED releases are not exposed to CSCdj52309. Though these releases share the same arithmetic problem, the tunneling software is different, and there is no known or predicted combination of timing, packet-sizes, and buffer-usages that results in the same or different anomalous behaviors associated with Cisco IOS Releases 11.2, 11.2P, 11.2BC, 11.3, and 11.3P. Cisco is using CSCdj52309 to repair the arithmetic problem in Releases 10.3, 11.0, and 11.1; however, no special images are being created because the anomalous behaviors are not present in those releases.
- [CSCdj52309]
Release 11.2(12a) and all subsequent releases of Cisco IOS software include the fix for this caveat.
The solution for software defect CSCdj31419 was improperly integrated in Release 11.2. CSCdj94374 resolves this issue and completes the integration for CSCdj31419. CSCdj94374 applies to Release 11.2 only. In all other releases, CSCdj31419 was correctly integrated.
This caveat applies to all RSP images, (RSP7000/7500), running Cisco IOS Release 11.2(10.4) - 11.2(13). Cisco strongly recommends that you download and install Cisco IOS software Release 11.2(13a) if you are affected by this caveat.
After the release of Cisco IOS Release 11.2(15) and 11.2(15) P, a serious defect (caveat CSCdk33475) was identified that impacts Enhanced IGRP for Cisco IOS Releases 11.2(14.1) through 11.2(15.2) and Releases 11.2(14.1) P through 11.2(15.2) P. It was determined that this defect was significant enough to merit a software rebuild. The rebuild includes the caveat fix and is renumbered to 11.2(15a) and 11.2(15a) P.
Caveat CSCdk33475 causes a router to fail after the command show ip eigrp events is issued. While this show command is not required for normal operation, it is used often enough by TAC personnel and customers to cause major havoc to customers who are running images with this defect.
Release 11.2(15a) and 11.2(15a) P and all subsequent releases of Cisco IOS software, including Release 11.2(16) and 11.2(16) P, include the fix for this caveat.
Beginning with Cisco IOS Release 11.2(15) and 11.2(15) P, all subsequent 11.2 and 11.2 P releases switch to Long-Cycle Maintenance Releases. A new 11.2 and 11.2 P maintenance release is scheduled to be available every thirteen weeks during the Long-Cycle Maintenance Release period. Interim builds will be available approximately every two weeks.
This section describes possibly unexpected behavior by Release 11.2(23) and 11.2(23)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(23) and 11.2(23)P.
- With authentication, authorization, and accounting (AAA) enabled, there is a 30 second delay in contacting a particular application. This situation does not seem to occur with AAA turned off. There is no workaround.
- A Cisco 4700 series router reloads with a bus error when binary synchronous communication (BSC) receives a frame through Block Serial Tunneling (BSTUN) while in the process of transmitting a frame on the BSC line. The router exhibits the following stack trace:
Enter hex value: 0x606C23F4 0x606C23F4:bsc_discard_tx_pak(0x606c23a8)+0x4c Enter hex value: 0x606C2F80 0x606C2F80:pass_to_frame_sequencer(0x606c2e34)+0x14c Enter hex value: 0x606C327C 0x606C327C:bsc_frame_tx(0x606c30a8)+0x1d4 Enter hex value: 0x606C3394 0x606C3394:bsc_pass_lcb_network_handler(0x606c3364)+0x30 Enter hex value: 0x606D6F88 0x606D6F88:lcb_event_exec_protocol(0x606d6f0c)+0x7c Enter hex value: 0x606D706C 0x606D706C:lcb_event_background(0x606d6fc0)+0xac Enter hex value: 0x60224F48 0x60224F48:r4k_process_dispatch(0x60224f34)+0x14 Enter hex value: 0x60224F34 0x60224F34:r4k_process_dispatch(0x60224f34)+0x0 Enter hex value:
- There is no workaround.
- A FDDI driver might interact incorrectly with OSPF during an online insertion and removal (OIR), which might cause shortest path first (SPF) recalculations. This situation occurs when OSPF is running on an FDDI interface that is not being inserted or removed. There is no workaround.
- Enhanced Interior Gateway Routing Protocol (EIGRP) does not trigger the selection of a new route when one of the equal or less desirable paths is removed from the routing table. The route disappears, but no new route is selected from the topology table. There is no workaround.
- A Cisco 7200 series router might reload with a bus error at rsvp_dump_object. There is no workaround.
- The output from the show version command on a Route Switch Processor (RSP) router with a high system availability (HSA) configuration fails to differentiate between a reload caused by a power cycle on the router and a reload initiated by a user. The router identifies both situations with the following text string:
- System restarted by reload
- In addition, if the reload failure is caused by the failure of the master RSP so that the router reloads using the former slave RSP, then the cause of the failure from the master RSP is not visible unless you look at the output of the show stacks command. There is no workaround.
- You cannot end a crypto key exchange session when you use Telnet to log in to a Cisco router.
- Workaround: Enter the show tcp bri command followed by the clear tcp {tcb values} command.
- Under rare conditions, a Cisco 2500 series router that is running Cisco IOS Release 11.2 might reload while encrypting data. There is no workaround.
- A Cisco 7500 series Route Switch Processor (RSP) that is running Cisco IOS image rsp-jsv-mz.112-18 might reload with a segV exception error while performing encryption processing. There is no workaround.
- C7500 running 11.2(18) experiences the following error when attempting to remove HSRP configuration commands from Fast Ethernet interface:
- System restarted by error - a SegV exception, PC 0x60290734
- A Cisco 4500 series router might experience memory corruption and reload with a bus error at PC 0x601CFE8C. There is no workaround.
- A Cisco 4000 series router that is running Cisco IOS Release 11.2(21) might lose input/output (I/O) memory 10 hours after a reload and exhibit the following error message:
%SYS-2-MALLOCFAIL: Memory allocation of 756 bytes failed from 0 xC475C, pool I/O, alignment 0 -Process= "Exec", ipl= 6, pid= 33 -Traceback= E1900 E2630 C4764 C492A C4C66 57399C 70430 70A1C 80F46 8141A A92BE %SYS-2-MALLOCFAIL: Memory allocation of 756 bytes failed from 0 xC475C, pool I/O, alignment 0 -Process= "Exec", ipl= 6, pid= 33 -Traceback= E1900 E2630 C4764 C492A C4C66 57399C 70430 70A1C 70FF8 810BE 8141A A 92BE %SYS-2-MALLOCFAIL: Memory allocation of 756 bytes failed from 0 xC475C, pool I/O, alignment 0 -Process= "Exec", ipl= 6, pid= 33 -Traceback= E1900 E2630 C4764 C492A C4C66 57399C 70430 70A1C 70FF8 810BE 8141A A 92BE %SYS-2-MALLOCFAIL: Memory allocation of 756 bytes failed from 0 xC475C, pool I/O, alignment 0 -Process= "TACACS+", ipl= 6, pid= 39 -Traceback= E1900 E2630 C4764 C492A C4C66 11E0FE 11E2FE 2E0B6E 2E0CFE 2E0E02 2E0 EFA
- There is no workaround.
- A Cisco 4500 series router that is running Cisco IOS release 11.2(22) might exhibit the following error messages when you use encryption:
%ALIGN-3-SPURIOUS: Spurious memory access made at = 0x608268CC reading 0x1E
- There is no workaround.
- A Cisco 7500 series router that is running encryption in Cisco IOS Release 11.2 might experience spurious access and a software-forced reload after displaying the following log messages:
Crypto engine 4: sign message using crypto engine: %SYS-2-NOBLOCK: idle with blocking disabled -Process= "Crypto SM"
- There is no workaround.
- Internetwork Packet Exchange (IPX) connectivity problems between FDDI and other interfaces (such as serial and Fast Ethernet) might occur when you upgrade a Cisco router from Cisco IOS Release 10.3 to Cisco IOS Release 11.2. The console from a client on a FDDI ring cannot connect to servers on either local or remote Ethernet segments and cannot browse the Netscape Directory Server (NDS) server object for those servers. There is no workaround.
- If a Cisco router that is running Cisco IOS Release 11.2 and performing inter-emulated LAN (ELAN) routing receives an Address Resolution Protocol (ARP) on the wrong interface (for example, a source IP address belonging to a subnet on another subinterface), the router will update its ARP table with this incorrect information. Connectivity to that IP address in the correct subnet is then lost until that IP address sends out an ARP on the correct subinterface. There is no workaround.
- If a subinterface is configured with an encapsulation that is different from the encapsulation defined under the main interface, bridging fails, but routing functions properly. This situation might occur with Cisco routers running Cisco IOS Release 11.0, Cisco IOS Release 11.1, Cisco IOS Release 11.2, and Cisco IOS Release 11.3.
- Workaround: Define the same encapsulation for the main interface as you use for the subinterface.
- A Cisco router might experience Frame Relay instability and exhibit the following error message:
%SCHED-3-PAGEZERO: Low memory modified by FR LMI (0xF4 = 0x4AC74AFC). -Traceback= 317B982 34C1444
- There is no workaround.
- A Cisco router might reload and exhibit the following error message:
System was restarted by error - Software forced crash, PC 0x31843A0[_crashdump (0x303f300+0x144ff6)+0xaa] Image text-base: 0x0303F300 [__start(0x303f300+0x0)+0x0], data-base: 0x00001000 FP: 0xA10C0, RA: 0x3172AF2[_validblock(0x303f300+0x133550)+0x2a2] FP: 0xA10E4, RA: 0x3174034[_validate_memory(0x303f300+0x134ce2)+0x52] FP: 0xA1114, RA: 0x3174A5C[_checkheaps(0x303f300+0x13572e)+0x2e] FP: 0xA112C, RA: 0x3174B82[_checkheaps_process(0x303f300+0x1357f4)+0x8e] FP: 0xA1148, RA: 0x3187FCE[_process_hari_kari(0x303f300+0x148cce)+0x0]
- There is no workaround.
- A Cisco 7000 series router with a Route Processor 1 (RP1) that is running Cisco IOS Release 11.2(21) reloads about once a day with a bus error in a_teardown_lec. There is no workaround.
- A Cisco 7000 series router with a Route Processor 1 (RP1) that is running Cisco IOS Release 11.2(22a) reloads about once a day with a bus error in lec_process_messages. There is no workaround.
- A Cisco 7000 series route processor (RP) that is running Cisco IOS 11.2(21) might display the following messages after reloading with a bus error at PC 0x31B84C, address 0xDEADBEFB:
System was restarted by bus error at PC 0x31B84C, address 0xDEADBEFB 7000 Software (C7000-P-M), Version 11.2(21), RELEASE SOFTWARE (fc1) Compiled Wed 15-Dec-99 23:50 by ccai (current version) Image text-base: 0x00001000, data-base: 0x00548714
Stack trace from system failure: FP: 0x866690, RA: 0x3139B4 FP: 0x8666A4, RA: 0x3140C8 FP: 0x8666EC, RA: 0x17504E FP: 0x866724, RA: 0x152262 FP: 0x866740, RA: 0x1523CE FP: 0x866750, RA: 0x17B102
- There is no workaround.
This section describes possibly unexpected behavior by Release 11.2(22) and 11.2(22)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(22) and 11.2(22)P. For additional caveats applicable to Release 11.2(22) and 11.2(22)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Release 11.2(23) and 11.2(23)P.
- A defect in multiple versions of Cisco IOS software will cause a Cisco router or switch to stop and reload if the IOS HTTP service is enabled and an attempt is made to browse to http://<router-ip>%%. This defect can be exploited to produce a denial of service (DoS) attack. This defect has been discussed on public mailing lists and should be considered public information.
- The vulnerability, identified as Cisco bug ID CSCdr36952, affects virtually all mainstream Cisco routers and switches running Cisco IOS Release 11.1 through Release 12.1, inclusive. The vulnerability has been corrected and Cisco is making fixed versions available to replace all affected IOS releases. Customers are urged to upgrade to releases that are not vulnerable to this defect as shown in detail below.
- Workaround: Nullify the vulnerability by disabling the IOS HTTP server, by preventing access to the port in use by the HTTP server on the affected router or switch, or by applying an access-class option to the service itself. The IOS HTTP server is not enabled by default except on a small number of router models in specific circumstances.
- Please see http://www.cisco.com/warp/public/707/ioshttpserver-pub.shtml for the latest complete version of this security advisory.
- If Token Ring is the endpoint of an encrypted tunnel, extra packets are generated. The symptoms of this condition are a high CPU load (mainly taken by the Crypto Engine) and false addresses when you enable the debug tunnel command.
- Workaround: Use the tunnel sequence-datagrams interface command on both endpoints of the tunnel.
- The Critical Bkgnd process might consume all the available memory on a Cisco 7200 series router that is running Cisco IOS Release 11.1(20)CA. There is no workaround.
This section describes possibly unexpected behavior by Release 11.2(21) and 11.2(21)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(21) and 11.2(21)P. For additional caveats applicable to Release 11.2(21) and 11.2(21)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Release 11.2(22) and 11.2(22)P.
- An Advanced Peer-to-Peer Networking (APPN) router might experience a memory leak if you save the routing information field during link activation. There is no workaround.
- A Cisco router that is running Advanced Peer-to-Peer Networking (APPN) might reload after the operator enters the show appn dlur-pu host-pu command. There is no workaround.
- A Cisco 7200 series router with a PA-4R port adapter might accept a packet that has an invalid frame check sequence (FCS) and pass it on to remote source-route bridging (RSRB). This situation does not occur in the PA-4R-DTR port adapter. There is no workaround.
- A Cisco 3600 series router that is running Cisco IOS Release 11.2(9) might encounter a situation in which multiple inside hosts are translated into the same global address when dynamic address translation is used. There is no workaround.
- After a link flap, the summary route might not appear in the routing table even though it appears in the OSPF topology table.
- Workaround: Restart the OSPF process, or reload the router.
- Under rare conditions, a Cisco 7000 series router that is running Cisco IOS Release 11.2(18) might corrupt Connectionless Network Service (CLNS) packets that are received on an ATM interface. This condition occurs only when packets are fast-switched.
- Workaround: Disable fast switching for CLNS packets.
- The Dynamic Host Configuration Protocol (DHCP) proxy allows the same IP address to belong to two users on different ports that have the same user name.
- Workaround: Ensure that all users have unique user names.
- Cisco Lock and Key idle timers will not be reset when there are packets that match the dynamic access control lists (ACLs) created by Lock and Key. There is no workaround.
- When configured to provide access control, the Kerberos client on Cisco products will fail all authentications when the expiration of the credential falls between January and February of a leap year.
- Workaround: Choose an alternate form of authentication such as TACACS+ or RADIUS.
- A Cisco 4700 series router that is running Cisco IOS Release 11.2 or a Cisco 3600 series or 7200 series router that is running Cisco IOS Release 12.0 might experience alignment errors that result in extremely high CPU utilization during business errors. This condition occurs when Frame Relay traffic shaping is configured with priority queueing or custom queueing with a classification based on TCP/User Datagram Protocol (UDP) port numbers or IP fragmentation. There is no workaround.
This section describes possibly unexpected behavior by Release 11.2(20) and 11.2(20)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(20) and 11.2(20)P. For additional caveats applicable to Release 11.2(20) and 11.2(20)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Release 11.2(21) and 11.2(21)P.
- During a rare timing window when the multiple downstream devices are simultaneously deactivated, the Advanced Peer-to-Peer Networking (APPN) router might cause the TP that processes the encapsulated messages received on the conloser DLUR/Dependent LU Server (DLUS) pipe session to pause indefinitely. Once the TP is paused, the DLUR may have some DLUR-PUs and DLUR-LUs that appear to be in a permanently stopped state. The corresponding virtual telecommunications access method (VTAM) resources remain in PDACP or PUSB1 states.
- Workound: Restart the APPN subsystem on the router.
- A Cisco 4500 router might experience memory alignment errors in Advanced Peer-to-Peer Networking (APPN). There is no workaround.
- A Cisco 4700 router that is configured for data-link switching (DLSw) with Dependent LU Requester (DLUR) and Advanced Peer-to-Peer Networking (APPN) might reload after you issue the show version command because of an SegV exception. There is no workaround.
- An Advanced Peer-to-Peer Networking/Dependent LU Requester (APPN/DLUR) router might reload with the following stacktrace:
RA: 0x60703538[h(0x6070345c)+0xdc]
RA: 0x607038E0[fsm_receive_router (0x607035b0)+0x330]
RA: 0x606E285C[upchuck(0x606e2654)+0x208]
RA: 0x606E2348[rcv_cls_msg(0x606e2080)+0x2c8]
RA: 0x606E1ED8[dlcdx_process_messages(0x606e1eb8)+0x20]
RA: 0x607027D0[xxxpcasm(0x60702440)+0x390]
- There is no workaround.
- If both a primary Dependent LU Server (DLUS) and a backup DLUS are configured on an Advanced Peer-to-Peer Networking/Dependent LU Requester (APPN/DLUR) router, the router might unnecessarily time out an allocate to one DLUS after having to time out an allocate to the other DLUS. When this situation occurs, you will receive an "allocate has an invalid rcb 0. Restart TP." message.
- Workaround: Enter the prefer-active-dlus configuration command with the "no retries" operand. If you have prefer-active-dlus coded on the APPN control point with no retries, only the currently active DLUS will be retried. This is a temporary workaround.
- A Cisco router might reload if you enter the show ip bgp command and the clear ip bgp {*} command simultaneously. There is no workaround.
- A Versatile Interface Processor (VIP) card might not respond to a request from an RSP board for a DBUS transaction. The RSP will reset the VIP interface and perform a CBUS complex restart to reallocate MEMD.
- Workaround: Get in and out of the if-console for all the VIPs in the box.
- A Cisco 7507 router with an ATM Interface Processor (AIP) installed might reload with the following error and not come back up unless the AIP is removed:
%DBUS-3-CXBUSERR: Slot 1, CBus Error
%RSP-3-ERROR: CyBus0 error 10 %RSP-3-ERROR: command/address mismatch %RSP-3-ERROR: bus command write 4bytes (0xE)
%RSP-3-ERROR: address offset (bits 3:1) 4
%RSP-3-ERROR: virtual address (bits 23:17) 000000
- There is no workaround.
This section describes possibly unexpected behavior by Release 11.2(19) and 11.2(19)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(19) and 11.2(19)P. For additional caveats applicable to Release 11.2(19) and 11.2(19)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Release 11.2(20) and 11.2(20)P.
- A Cisco 4700 series router might reload every few days.
- Workaround: Determine the right buffer size before you zero out the buffer.
- A Cisco 7500 series router might erroneously detect output stuck conditions, causing interfaces to reset or to perform cbus restarts. This condition might cause all IPs in the router to reset. There is no workaround.
- Some Cisco 4500 series routers and Cisco 4700 series routers with a 2-Port Token Ring network processor module (NP-2R) might hang once a week (no matter the revision level of the motherboard), and display the following message:
%SYS-2-INPUTQ: INPUTQ set, but no IDB
- Workaround: Issue the lnm disable command to temporarily correct the problem.
- A Cisco router that is defined as Advanced Peer-to-Peer Networking (APPN) might run out of memory due to an unnecessary lfsid table expansion for some Dependent Logical Unit Requester (DLUR) links to downstream physical units (PU) 2.0s. This problem can occur after DLUR takeover or if the Dependent Logical Unit Requester-physical unit (DLUR-PU) has previously received a "dactpu not final use" message from the Dependent Logical Unit Server (DLUS). There is no workaround.
- The data-link connection identifier (DLCI) in a Cisco 4700 series router might fail, and the Advanced Peer-to-Peer Network (APPN) link does not restart even though the router is configured to retry indefinitely. This situation can occur when the Cisco 4700 series router is defined as an APPN NN and connects with an APPN link across Frame Relay RFC 1490 to an IBN NN950 that is configured as an NN. You must restart the link manually. There is no workaround.
- No Systems Network Architecture (SNA) traffic passes between a server and a Cisco network node (NN) router when the NN uses data-link switching (DLSw) flow control to prevent further SNA traffic by the server. There is no workaround.
- A Dependent Logical Unit Requester physical unit (DLUR-PU) might appear stuck in a "stopping" state while waiting for a deactivate physical unit (DACTPU) request from the Dependent Logical Unit Server (DLUS). In this situation, the DLUS has already cleaned up this PU, and the PU is in a connectable state on virtual telecommunications access method (VTAM). The DLUR cannot clean up this PU until it receives the DACTPU request. This software change allows DLUR-PUs that have waited for this DACTPU for more than 2 minutes to issue another REQDACTPU request to the DLUS. If the DLUS has already cleaned this PU, it will respond negatively to the REQDACTPU. This negative response will initiate the cleanup of this PU by the DLUR. There is no workaround.
- An Advanced Peer-to-Peer Networking (APPN) network node router might not allocate the conwinner session of its dual control point-to-control point session with an adjacent end node. The conloser session is set up correctly, but the conwinner session fails with sense 80140003 if you enter the debug appn ss command.
- Workaround: This situation results if you change an adjacent network node to and end node. Cycle the link for the end node that you changed.
- A Cisco router that is defined as Advanced Peer-to-Peer Networking (APPN) and is running Cisco IOS Release 11.2 might reload after continuously looping in nns_olu_cdinit_reply_processing and exhibit the following error message:
abort crashdump process_handle_watchdog signal_receive process_forced_here nns_olu_cdinit_reply_processing.
- There is no workaround.
- A Cisco 3600 series router might not respond to an Address Resolution Protocol (ARP) request if an input bridge filter is applied to the bridge interface.
- Workaround: Delete the input access lists on the bridge interface.
- If you use a Fast Ethernet Interface Processor (FEIP) on a Cisco 7000 series router that is running Cisco IOS Release 11.2(19), the FEIP will not function properly. There is no workaround.
- If you are redistributing Open Shortest Path First (OSPF) routes into any other routing protocol, the redistributed routes do not include not-so-stubby area (NSSA) external routes. There is no workaround.
- A bus error reload might occur if an Internet Group Management Protocol (IGMP) entry is deleted when you run the show ip igmp group command. There is no workaround.
- Domain Name System (DNS) replies that pass from "inside" to "outside" by way of Network Address Translation (NAT) might not be correctly translated. There is no workaround.
- Two Cisco 7500 series routers connected to multiple Ethernet interfaces with Ethernet Interface Processors (EIPs) that are running Hot Standby Router Protocol (HSRP) might take several minutes to determine the active and standby routers after a router reloads. During this period of instability the CPU load on the router approaches 100percent.
- Workaround: Replace the EIP interface processors with Versatile Interface Processors (VIPs) and Ethernet port adapters. A secondary workaround would be to reduce the number of HSRP groups, or to increase the HSRP hello and hold time. Cisco recommends that you have no more than 24 HSRP EIP interfaces. VIPs have been approved for 80 HSRP interfaces.
- Under rare circumstances, a Cisco Route Switch Processor (RSP) might pause indefinitely when configured with a Versatile Interface Processor (VIP) card if you enter the show crypto engine connections active slot command. There is no workaround.
- Fair queueing might cause spurious accesses, or might cause a Cisco router to reload or pause indefinitely.
- Workaround: Configure first on first out (FIFO) queueing instead of fair queueing.
- Smart Modular and Sharp Flash cards used to store diagnostics and IOS software images might report unrecoverable write errors across the Cisco 7200 series router, 7500 series router, and Gigabit Switch Router (GSR) platforms. Other platforms might also be affected. Affected Flash cards use a new Sharp (LH28F016SCT) chipset. The original Smart Modular and Intel Flash cards are not affected. There is no workaround.
- If a router that is running Cisco Encryption Technology (CET) has multiple connection setup attempts happening at once, some attempts might time out prematurely or not set up properly. There is no workaround.
- Users who are running images that contain the fix for CSCdm37466 will see the following rate limited error message:
%LINK-2-INTVULN: In critical region with interrupt level=1, ...
- The router should continue to function normally. There is no workaround.
- Cisco routers that are running Internetwork Packet Exchange (IPX) and Enhanced Interior Gateway Routing Protocol (EIGRP) with Cisco IOS Release 11.2 or later might reload when there is a high frequency of interface up/down transitions, especially with dial-up interfaces.
- Workaround: Disable the IPX EIGRP.
- A Cisco router with over 180 data-link connection identifiers (DLCIs) might not boot properly because of excessive console log messages related to the startup of Frame Relay permanent virtual circuits (PVCs). There is no workaround.
- A Cisco 2500 series router might reload and display the following stack trace:
_pak_dequeue _fr_vcq_reset _fr_vcq_queue_setup _fr_vcq_queue_add _fr_shape_setup _fr_idb_config_shape _fr_traffic_mapclass_parse _registry_listro_host.
- There is no workaround.
- A serial interface that uses dialer interface for backup and a BRI that belongs to a methis dialer group might experience problems with ISDN calls not disconnecting. If the serial interface goes down, a BRI interface comes up as expected. When the primary serial line recovers, the "backup interface dialer" returns to standby mode after the specified disable delay but the ISDN call is not disconnected. This problem occurs with Cisco IOS Release 11.2(19) but not with Cisco IOS Release 11.2(18). There is no workaround.
- If you make a Telnet connection to a reverse XRemote port on a Cisco IOS device, and no password is answered in response to the prompt presented, the IOS device might begin an infinite loop in which it prints repeated error messages to the Telnet client. The loop continues until the client disconnects the session.
- Workaround: Set the 'exec-timeout' of the line to 0. This action disables the exec timeout, which interrupts the loop.
This section describes possibly unexpected behavior by Release 11.2(18) and 11.2(18)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(18) and 11.2(18)P. For additional caveats applicable to Release 11.2(18) and 11.2(18)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in release 11.2(19) and 11.2(19)P.
- When a Simple Network Management Protocol (SNMP) walk to find a Cisco Discovery Protocol (CDP) neighbor is performed, an alignment error will occur if the CDP neighbor entry does not have a Layer 3 address such as an IP address.
- Currently generic traffic shaping and Frame Relay traffic shaping are not supported with Optimum/CEF switching modes. Therefore, these switching modes must be disabled to make traffic shaping work over the interface.
- IPX EIGRP topology and routing tables do not show entries for routes that are showing on IPX EIGRP neighbors. The affected router shows it is receiving updates when the debug ipx eigrp command is used. However, the entries are never added to the topology table.
- You cannot enter a write network command when you use the TFTP-source interface.
- A bus error occasionally occurs when using the show running-config command.
- The dlsw icanreach sap command is an implicit deny to all SAPs not listed. When implemented it checks DSAP in both directions. It should check DSAP inbound and SSAP outbound.
- A DLUR router may reload with the following stack trace.
RA: 0x6070294C[mu_processor(0x60702630)+0x31c]
RA: 0x60702F84[remote_path_control(0x60702e50)+0x134]
RA: 0x607044D0[pc_mainline(0x60703d60)+0x770]
RA: 0x606FF3B8[xxxpcasm(0x606ff000)+0x3b8]
- A crash occurs in a APPN (Advanced Peer-to-Peer Networking) router with SegV exception. The stack trace is:
0x606C30CC:process_purged_ips(0x606c3060)+0x6c
0x606C3024:hsp04(0x606c2dd0)+0x254
0x606C2DAC:hsp00(0x606c2d80)+0x2c
- If a BIND arrives at a Cisco NN/DLUR and is destined for a SLU beneath that DLUR, and the PLU name is not qualified, the BIND is rejected with sense code 0x0835001B. The 1B in the sense code is the offset into the BIND of the PLU name field.
- APPN/DLUR experiences corruption when the total number of PUs and LUs approaches 8000. This problem occurs after one of the spurious memory accesses listed in the DDTS description. Failures that can result include:
- Corrupt CVx'60' on DLUR-DLUS flows
- SESSEND failures from DLUR with sense code 0x1014023D
- PUs and LUs becoming stuck in 'Stopping' state
- In a DLSw environment with a large number of unpaced SNA frames (frames using DSPU with many LUs defined), high CLS congestion can result in a ZWO being sent followed by an RWO without waiting for an FCA response. This causes the circuit to hang at Cw:0. The circuit must be cleared to restore communications.
cowboyneal# show dlsw circuits detail sap-value
Index local addr(lsap) remote addr(dsap) state
855638203 4034.0935.d100(F4) 4034.1001.0000(04) CONNECTED
PCEP: 22DEAC UCEP: 2417E0
Port:VDLC3935 peer 10.144.128.1(2065)
Flow-Control-Tx CW:21, Permitted:35; Rx CW:0, Granted:13; Op: Incr Congestion: Low(02), Flow Op: Half: 6/2 Reset 2/0
RIF = --no rif--
- A router crashed from a bus error at PC _lnm_add_entry. This is probably because it received a frame on its Token Ring interface that pertains to LNM, and also has its RIF length greater than 7 hops.
- The workaround maybe to use the no lnm rem command.
- A Cisco 7500 series router with RSP Software (RSP-DW-M) running Cisco IOS Release 11.2(17)P was restarted by an Illegal Opcode exception, PC 0x60AE87E4. The stack decode pointed to tcpdriver and stun_background.
- Cisco 7500 series routers may display spurious memory access messages. If the output of show align command decodes to "s4t_rx_interrupt", this caveat may apply.
- The bridge filter does not filter out all the MAC addresses it is supposed to.
- Some types of incorrectly formed DNS packets may cause the system to reload.
- On a Cisco 2600 series router running the c2600-is-mz_113-3a_T1 image and the NAT protocol, NAT works until the translation table times out. The only workaround is to reload the router every 24 hours.
- Cisco IOS NAT socket translation only works for connections initiated from outside to inside. Without sockets, translation works on the IP address; however, with a socket, translation does not work.
- When configuring an X.25 line as a passive interface for open shortest path first (OSPF), it might stay in OSPF down state after a line flap, even though the line protocol is up. You can check the OSPF state using the show ip ospf interface command. As a result, this line's network number will not be advertised by OSPF. A workaround is not to make this interface passive for OSPF.
- ICMP redirects can overwhelm process switching. The workaround is to use the clear ip redirect or reload the router.
- ARP to a Cisco 2500 series router running Cisco IOS Release 11.2(17) or 12.0(3.7) fails on the serial interface when bridging is enabled and the router is reloaded. This problem was seen on the following topology:
- ----Ethernet----Cisco 2500 series router---serial interface---Cisco 2500 series router---Ethernet---
- The workaround is to remove and reenter the IP address on the serial interface.
- Some IP fragments may be incorrectly filtered out by access lists.
- If two Cisco 7500 series routers are connected to many Ethernet interfaces with EIP interface processors and are running HSRP on many of these interfaces, the HSRP configuration may take an excessively long time (several minutes) to determine the active and standby routers after a router reloads. During this period of instability, the CPU load on the router approaches 100 percent.
- The workaround is to replace the EIP interface processors with VIP interface processors and Ethernet port adapters.
- Less effective workaround are to reduce the number of HSRP groups or to increase the HSRP hello and hold time.
- We recommend that you to have no more than 24 HSRP EIP interfaces or 80 HSRP VIP interfaces running simultaneously.
- Encryption may cease to work after some time (depending on whether CET or IPSec is being used and how long the key timeouts are). The symptoms include a lack of debugs from one of the crypto modules, as well as an interruption of the flow of encrypted data.
- A Cisco 3620 router configured for encryption over asynchronous dialup may crash when the crypto-map is removed from the dialer interface.
- Under stress conditions (if the ESA is bringing up a large number of crypto sessions simultaneously), the router may either enter a race condition or wedge the crypto initiation messages in the input-queue of the interface performing encryption.
- A VIP interface needs to use a crypto map with a name that is not a subset of other crypto maps. For example, crypto map "testtag1," "testtag10," and "testtag100" are all treated as the same crypto map.
- On rare occasions a network may be unreachable even though it is active in the RIP table and displayed in output from the show ipx route command. This condition is seen when all (or most) routes are learned through a specific interface and that interface or its neighbor goes down long enough for the majority of the route to reach the holddown time (4 minutes). If the neighbor/routes then come back up before the route is removed from the table, there is a rare chance that some of the routes may be active but unreachable.
- Symptoms of this condition are a "uses" counter (on the show ipx route detailed command) of zero even though devices are trying to reach this network. If services are associated with this network, the services associated with it will time out of the service table and SAP entries received for these services will be reject with a "no network found," which can be seen by enabling the debug ipx sap event command.
- The workaround is either to clear the specific route entry using the clear ipx route command or clear the entire route table using the clear ipx route * command.
- Under certain conditions, IPX-EIGRP is leaking memory via "IPX USV" and "IPX SAP PH." This leak happens on slow or congested WAN links with large numbers of IPX services (SAPs) being advertised where IPX-EIGRP neighbors are flapping. These conditions are evident by the constant short "Uptime" and constant non-zero "Q Cnt" in output from the show ipx eigrp neighbors command.
- The workarounds are to increase the interface bandwidth (using the bandwidth command) and/or increase the EIGRP bandwidth for that interface (using the ipx bandwidth-percent eigrp command). By default, EIGRP gets the maximum of fifty percent of the interface bandwidth.
- In Cisco IOS Release 11.2, if SAP passive update is configured on an interface, the services learned on that interface never age out of the table. In Cisco IOS Release 11.3 and later, this also occurs for networks learned on RIP passive interfaces.
- A bus error crash occurs at null pointer (0x0) with a message "System restarted by bus error at PC 0x27BD0060, address 0x0." Replacing the hardware did not solve the issue.
- This problem happens under rare unknown conditions when multiple Telnet sessions are run from the router.
- This crash occurred on a Cisco 7500 series routers running Cisco IOS Release 11.1 (20)CA and 11.2(17)P. The only workaround is to not run Telnet sessions from the router.
- If the number of UDP echo requests from different source/port pairs causes the router to activate more than a certain number of UDP echo daemons, the remaining UDP echoes will not be replied to. There is no known workaround.
- If RCP is configured on the routers and is used on hosts and routers separated by a firewall (with strict access controls lists, such as allowing only loopback addresses), the RCP sessions fail when multiple interfaces are used on the router and a second interface, other than the primary interface, is configured for RCP sessions (using the ip rcmd source-interface command). The workaround is to not use "loopback" or secondary IP addresses for the RCMD source-interface. Use only the primary (default) interface.
- DDR using the dialer dtr command does not reset DTR to a down state after an unsuccessful call attempt. (Unsuccessful in this case means that DDR is triggered, DTR is raised, but the modem/TA attached to the serial port never connects so that DCD does not come up.)
- This can be verified by viewing output of the show dialer command to ensure that the dialer state is idle and the show interface serial command to check the state of DTR.
- This problem does not occur in Cisco IOS Release 11.1.
This section describes possibly unexpected behavior by Release 11.2(17) and 11.2(17)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(17) and 11.2(17)P. For additional caveats applicable to Release 11.2(17) and 11.2(17)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in release 11.2(18) and 11.2(18)P.
- The Cisco AS5200 router when configured for a PRI group, sometimes hangs during boot (and only during boot) if one or both T1/E1 interfaces receive excessive "short frame" errors (also known a "runts") from the lines. An unprovisioned PRI line, or incorrectly provisioned PRI line, could be one case where this problem might occur. A workaround is to either disconnect the faulty T1/E1 line, or to configure loopback on the affected T1/E1 controller. [CSCdk80119]
- A Cisco 1005 router running IOS Release 11.3(17) reports the following errors:
%ETHERNET-1-TXERR: Ethernet0: Fatal transmit error. Restarting... %QUICC-5-COLL: Unit 0, excessive collisions. Retry limit 15 exceeded
- All router hardware was tested, but the errors continued. [CSCdk11908]
- Memory leak occurs in IP SNMP when views with wildcarded OIDs are used. The workaround is to either not use wildcarded OIDs with IOS Release 11.1 or 11.2, or upgrade to an IOS image with this bug fix. [CSCdk40202]
- The writeNet object completes the TFTP transfer of the configuration file to a TFTP server before relinquishing the CPU. This becomes a problem when the TFTP server is unresponsive, resulting in timeouts. The workarounds are to either use the CISCO-CONFIG-COPY-MIB to initiate the transfer (this starts the transfer and then relinquishes the CPU); or poll for the status of the transfer and see how long it took by looking at other objects in the CISCO-CONFIG-COPY-MIB. [CSCdk72569]
- If a router is active for more than 25 days, or if an interface stays idle for more than 25 days, a router can experience excessive drops after WRED is configured on that interface. The workaround is to enter the shut and no shut commands. [CSCdm10290]
- A router running APPN may reload with the following stack trace:
- [Mfree+0x14] [destroy_cp_status+0x24] [newdss00+0xf8] [CSCdk00974]
- Cross-domain session drops might occur when you configure the stun-tg command on Cisco routers to connect two FEPs. When the session drop happens, the router might report the following error:
%SYS-2-BADSHARE: Bad refcount in datagram_done may be reported by the router
- There is no workaround. [CSCdk30352]
- A Cisco router running DLSw with FST/Direct/LLC2(Lite) encapsulations could crash. The workaround for this is to use DLSw with TCP encapsulation. [CSCdk77166]
- The APPN router may leak memory when receiving "wildcard" replies to a broadcast search. The show appn stat command will consistently indicate an increasing "outstanding locates" value with an increasing "broadcast locates sent" value:
Broadcast locates rcvd/sent 9499/1395
Directed/Broadcast locate negative replies 3/152
Outstanding locates 1213
- [CSCdk78105]
- The downstream physical unit (DSPU) does not allow any new DSPU connections. The following messages appear in the router log:
%DSPU-3-LSConnInFailedNoMem: Connect in from remote address 00104b0a60e0 failed; insufficient memory.
%DSPU-3-LSConnInFailedNoMem: Connect in from remote address 00105a00e326 failed; insufficient memory.
- [CSCdk86081]
- The APPN router may have problems when establishing control point-to-control point (CP-to-CP) sessions during an unusually heavy load. The network node may display the following message repeatedly if attempting to establish several hundred CP-to-CP sessions with adjacent end nodes at the same time.
Jan 25 12:51:18: %APPN-7-APPNETERROR: TP(RCA) - Proto error: rcv_and_wait with NETA.ENCP1 rc=F, 0
- [CSCdk88194]
- An APPN router may reload with the following backtrace:
0xRA:0x60757578:Qdeq(0x6075756c)+0xc 0xRA:0x606FBA6C:hs_deleter(0x606fb930)+0x13c 0xRA:0x606FC038:mu_processor(0x606fbe40)+0x1f8 0xRA:0x606FC77C:remote_path_control(0x606fc650)+0x12c 0xRA:0x606FDC04:pc_mainline(0x606fd500)+0x704 0xRA:0x606F8D70:xxxpcasm(0x606f89d0)+0x3a0
- [CSCdk93916]
- An APPN router may reload with the following stacktrace. (The router used excessive CPU memory when multiple (over 100) end nodes registered resources to this network node simultaneously.)
RA: 0x601C89D4[abort(0x601c89cc)+0x8] RA: 0x601C7354[crashdump(0x601c728c)+0xc8] RA: 0x607375F0[Eattach(0x60737588)+0x68] RA: 0x60739DCC[Pcreate(0x60739cd4)+0xf8] RA: 0x60648720[amp610(0x606486c0)+0x60] RA: 0x6064789C[amp500(0x60647510)+0x38c] RA: 0x60645AD0[amp00(0x60645790)+0x340]
- [CSCdm05337]
- If you experience an outage and notice the following, you may have a problem: (The fix is awaiting integration.)
Router# show version
Cisco Internetwork Operating System Software IOS (tm) 7000 Software (C7000-JS-M), Version 11.2(12), RELEASE SOFTWARE (fc1) Copyright (c) 1986-1998 by cisco Systems, Inc. Compiled Mon 23-Feb-98 16:48 by tlane Image text-base: 0x00001000, data-base: 0x008EAC78
ROM: System Bootstrap, Version 11.1(15), SOFTWARE ROM: 7000 Software (C7000-P-M), Version 11.2(12), RELEASE SOFTWARE (fc1)
FAIRFAX uptime is 1 hour, 8 minutes System restarted by bus error at PC 0x17978E, address 0xEF4321CD ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
- [CSCdj66544]
- Under normal conditions, If the no keepalive or keepalive 0 command is configured on Fast Ethernet, the line stays up when the media-independent interface (MII) is removed or the cable is disconnected. However, if the interface is then reconfigured with the keepalive non-zero value command while the physical media stays down, the link still indicates that it is up. The workaround is to issue the shut command followed by the no shut command, or issue the clear interface command. [CSCdk66019]
- IP access lists permit IP fragments. There is no workaround. [CSCdi84140]
- A router may not install a route into the routing table, even if the routing bit is set on the OSPF external link sharing adapter (LSA) and the ASBR is reachable. A workaround is to issue the command clear ip route *, which will force the installation of the external route. Alternatively, issuing the command clear ip ospf redist at the router that originates the external route will trigger external route installation. [CSCdj88650]
- Slow memory leak is seen in BGP router when running IOS Release 11.2(14)P. [CSCdk34549]
- A Cisco 7000 series router failed after it was upgraded to Cisco IOS Release 11.2(15) from Release 11.0(17). The system restarted by error:
Software forced crash, PC 0x175808
- [CSCdk40576]
- The privileged level command clear access-template does not work. [CSCdk60659]
- The IP EIGRP generates updates and causes high CPU utilization if more equal cost paths than maximum paths are available. This behavior has been introduced by CSCdk14241. [CSCdk73832]
- If it has already done so, the Route Processor (RP) does not send data to the DR, although the DR still sends registers after it has timed out. [CSCdk78764]
- When the prune-timers in the OIL list are not identical, the mroute will still go to a forwarding status even when there is no listener. There is no workaround. [CSCdk78845]
- This bug was introduced by CSCdk34549 and only IOS Release 11.1(23.1)CC is affected. A crash may occur when both inbound route-map and inbound distribute-list/prefix-list filtering for a peer exist. There is no workaround. [CSCdk79642]
- Some routes may not be propagated by EIGRP through redundant paths. [CSCdk80809]
- NAT does not translate the embedded IP address in the ftp port command after transfer of a file with a large filename. The workaround is to close the FTP session and open a new one. [CSCdk82872]
- The following console error messages appear during periods of high serial line use:
%SYS-3-CPUHOG: Task ran for 2672 msec (87/71), Process = IP Input
- [CSCdk26388]
- Point-to-point protocol (PPP) peer neighbor routes from an unnumbered link might remain in the topology table when the link is down or changed to numbered, causing network instability. The workaround is to remove the EIGRP process and reconfigure it, or reload the router. [CSCdk49790]
- Selective Packet Discard (SPD) can erroneously discard "hello" packets from some routing protocols, such as OSPF, EIGRP, and HSRP. When a router is processing a lot of other packets at process level, the lost routing protocol packets can cause route and HSRP "flapping", leading to intermittent data packet loss. [CSCdm05440]
- CPU utilization is too high due to the number of NAT (network address translation) entries in the NAT table. There is no workaround. [CSCdm05636]
- A memory leak occurs as soon as ISIS and ISO-IGRP are redistributed into each other, resulting in the router hanging and needing to be powered off and on to get it working again. [CSCdk17145]
- A Cisco 7200 series router configured to route IP packets over ISDN with encryption only works in process-switch mode. [CSCdj82823]
- Packets are decrypted when received from input interface (in a crypto spoke and hub configuration) and then encrypted again before they are forwarded to the output interface. The fix should be committed into the next IOS release. [CSCdk58181]
- Using the RSP platform with ESA installed, crypto sessions might stop encrypting data, while the access lists continue to see matches. A show crypto engine connections slot command shows an unidentified interface, instead of the physical interface through which the packets should be going. The workaround is to remove the crypto map from the interface, and then remove the corresponding sequence number from the crypto map. Re-create the sequence into the map (using the same configuration commands) and apply it back to the interface. [CSCdk65092]
- A Route Switch Processor (RSP)-based router running IOS Release 11.2(15a)P stops passing IP traffic through two FDDI port adapters encrypted and decrypted on the VIP2-40. A microcode reload fixes the problem temporarily. The VIP then hangs and doesn't receive or send packets. [CSCdk69415]
- The ESA crypto engine of a Cisco 7507 router with a VIP2 installed might be limited to 25 connections. In this situation, new connections are established after key exchange, but no encryption and traffic flow take place. There is no workaround. [CSCdk69456]
- An encryption session might not set up properly if the access-list command applied to a crypto map includes deny statements before permit statements. The workaround is to remove deny statements from the access-list commands. A result of this workaround is that more packets may match the encryption policy than originally configured. [CSCdk77654]
- The fix for CSCdk77654 requires ACLs attached to crypto maps to include Internet Control Message Protocol (ICMP), even if ICMP packets are not intended to be encrypted. Note that ICMP is matched when the IP protocol is specified in the ACL. [CSCdk84552]
- If an interface is administratively down with an IPX network configured and you add that network to the IPX EIGRP router, that network (route) gets propagated through EIGRP even though that interface is down. The route does not go away. The workaround is to remove the network (route) from EIGRP, and issue the no shut command followed by the shut command; or remove the network from within the IPX EIGRP router by issuing the ipx router eigrp and no network commands. [CSCdk86872]
- Heavily loaded routers may experience a crash in the ISDN code. This has been observed with IOS Releases 11.2 and 11.2 P. No workaround is possible except running at a low load. [CSCdj79686]
- After dialer profiles are configured, the dialer profile displays a "Call Pending" message, and then shows a "Shutdown" state as follows:
Dialer1 - dialer type = DIALER PROFILE
Idle timer (120 secs), Fast idle timer (20 secs)
Wait for carrier (30 secs), Re-enable (15 secs)
Dialer state is shutdown
- The workaround is to configure a new profile and/or reload. [CSCdk58971]
- Calling Address Extension facility should not be included in the call connected/call accepted message [CSCdk66288]
- A status message showing "endpointRef" is not processed in the multipoint state table. This could result in releasing a multipoint virtual circuit. There is no workaround. [CSCdk70026]
- Sequence errors occur when you attempt to compress a packet with CCP with the PAK_PRIORITY bit set, resulting in compression dictionary resets. This only occurs during congestion on the PPP output queue. With extreme congestion, packets may be dropped from the output queue, if it is full when a PRIORITY packet is added. The workaround is to avoid compressing these packets, increase the size of the output queue, or obtain additional bandwidth. [CSCdk72458]
- With Release 11.2(17.3)P installed on an RSP-based platform, all incoming calls fail. The router receives the incoming call, reserves a CCB but fails to send a response to the ISDN switch. After T303 the switch sends another call setup message with the same result in the router. After 15 calls all CCBs and B-channels are hung. There is no workaround. [CSCdm15182]
This section describes possibly unexpected behavior by Release 11.2(16) and 11.2(16)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(16) and 11.2(16)P. For additional caveats applicable to Release 11.2(16) and 11.2(16)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Release 11.2(17) and 11.2(17)P.
- Cisco 1003 routers sharing an S-bus do not respond to IDCKREQ. Even though the router debug shows that the router is responding to IDCKREQ from the ISDN switch, these replies seem to get lost in the collision and are never seen by the ISDN switch. [CSCdj78490]
- SNMP CPUHOG processing GetNext IfEntry on ATM subinterfaces cause LANE clients to be dropped. This problem is found in Cisco IOS releases 11.2(13)P and 11.2(12)P. In both cases, subinterfaces that were not numbered sequentially were the problem. A partial workaround for is to issue the no snmp-server sparse-table command, which lessen the frequency of the occurrence. This problem is closely related to CSCdj92220. Use that fix to lessen this one's severity. [CSCdk08376]
- When configuring traffic-shape groups under interfaces, the second traffic-shape group will not show in the running-configuration or startup-configuration commands if options are not added to the command as the first statement. [CSCdk09806]
- When an IPC slave (SRSP, VIP, VIP-based line card) is removed from the router using OIR, Cisco IOS releases 11.1CA, 11.1CC, 11.2, and 11.2P do not properly remove the corresponding IPC ports. This may lead to output drops in the show ipc stat command and invalid ports in the show ipc ports command. [CSCdk15336]
- Routers become unresponsive when querying RTR history and the history table is empty. [CSCdk36156]
- Outbound access lists may not be applied correctly when traffic is switched using distributed fast switching (DFS) to a logical subinterface of a physical output interface. For more information, see: http://www.cisco.com/warp/public/770/iosdfsacl-pub.shtml. [CSCdk43862]
- SRAM parity errors were occurring while reading range registers beyond 2 MB in MEMD. The Route Switch Processor (RSP) range registers have been set correctly to enforce a 2 MB limit on MEMD access. [CSCdk64322]
- A Cisco AS5200 may restart during an EXEC login because of the following bus error:
System was restarted by bus error at PC 0x22453682, address 0xD0D0D0D
- [CSCdk33946]
- The router is accepting all privilege-level commands but is unable to save them to NVRAM configuration. NVRAM produces
SYS-2-MALLOCFAIL error messages with tracebacks. A show running-config command following the issue of the show frame-relay pvc command may cause Cisco IOS software to crash. [CSCdk67009]
- If DLSw is configured to use TCP as the transport, a TCP packet coming from the peer can get stuck in the router's TCP buffers if any of these conditions also apply:
- There are no keepalives between the peers (like in an ISDN connection)
- There is not heavy traffic between the peers using the DLSw pipe
- A packet coming from the peer is 1 to 3 bytes in excess of the MSS (Maximum Segment Size) of the receiver.
- In this case, the receiving TCP does not give the assembled packet to DLSw until another packet comes down the pipe. A workaround could be to adjust the MAXDATA (MAX PIU) of the end node to the value of (MSS-16) bytes (considering 16 bytes of DLSw header) in case of SNA. [CSCdk36264]
- The input queue on Token Ring interfaces may wedge and not accept additional packets. The workaround is to increase the interfaces input queue (for example, issue the command hold-queue 200 in) or reload the router. [CSCdk36470]
- APPN auto Activate-on-Demand works only once in Cisco IOS 11.2 Releases and not at all in Cisco IOS 11.3 Releases. [CSCdk39734]
- APPN routers running Cisco IOS Release 11.3 or greater receive invalid output from the show appn stat command. APPN routers running Cisco IOS Release 11.2 receive invalid output in the "Outstanding Locates" field of the show appn stat command. This misinformation can hamper network problem determination. [CSCdk48037]
- The APPN router may reload with a bus error after displaying the following "Mfreeing bad storage" message. No backtrace may be displayed. This problem occurs only when displaying an Mfree error message:
Oct 1 09:52:03 11.32.8.1 53142: Oct 1 09:52:19.118: %APPN-0-APPNEMERG: Mfreeing bad storage, addr = 610D1898, header = 00000000, 00000080, 606B1F38, 60743610
System was restarted by bus error at PC 0x31300068, address 0x0 [CSCdk50300]
- When running a downstream physical unit (DSPU), certain downstream connections may fail to become active. The workaround to activate the clients is to clear the logical unit on the host with the status of PBIND. Once this is cleared, the session will come up. [CSCdk53603]
- An APPN router may reload with a SegV exception in psp00 after the following message is displayed in a rare race condition:
%APPN-6-APPNSENDMSG: APPN Allocate 613D1F8C to NETA.MVS1 timed out for TP "001.
System was restarted by error - a SegV exception, PC 0x606AE270 [CSCdk54077]
- If ACTLU is sent to the end station for a LOCADDR not yet defined, it will send -ve response, and the logical unit (LU) will stay connected. When the LU is added to the end station and VTAM sends ACTLU again, the DLUR router does not forward ACTLU to the end station. The VTAM displays the LU as PACTL, and the router display shows it is starting. [CSCdk54680]
- The APPN router enlarges its LFSID table from a small to large model if more than 12 SIDLS are active for a specific SIDH. The large LFSID table requires much more memory. This caveat increases the number of entries in the small LFSID table to the maximum number of SIDLS that fit into this table. This requires no additional memory per link, but increases the number of SIDLS supported in the small LFSID table. Thus, in customer networks that typically support 17 LUs/PU, the APPN router may use significantly less memory. [CSCdk54687]
- The APPN router may reload with the following stack trace during a rare race condition:
System was restarted by error - a SegV exception,
PC 0x60744AE0 Stack trace from system failure: B_free_bfr_cell(0x60744950)+0x190
in_use_to_free(0x60743a08)+0x5c Bfree_Fixed_or_Varying_buffers(0x607456d0)+0x118
Bfree(0x60741170)+0xa4 free_buffer(0x6069ec30)+0x10 ptp102(0x606b2ce0)+0x15c ptp176(0x606b4b30)+0x34 ptp16(0x606b4850)+0x21c
- [CSCdk56117]
- The APPN router may reload with the following stack trace:
System restarted by error - a SegV exception,
PC 0x0 at 16:02:18 UTC Mon Oct 26 1998
#0 0x0 in ??
#1 0x606ae4ac in psp01a
#2 0x606ae2e4 in psp00
- [CSCdk58180]
- The asynchronous balance mode (ABM) bit is not set while transmitting datalink switching (DLSw) peers during XID exchange. [CSCdk68763]
- The APPN builds fail due to outdated compiler in the `dlurdepends' make file. All APPN images are affected. [CSCdk69202]
- A DLSw router using priority peers may crash when the TCP peer connections fail under heavy load conditions. [CSCdk69510]
- Token Ring comes up as full duplex when directly attached to a switch. When you attach a low-end router such as a Cisco 2500 or any of the Cisco 4000 series directly to a switch configured for autosense, the switch will detect the port as being full duplex, but the low-end routers only support half duplex. The Token Ring interface on the router will show that everything is up, but only broadcast traffic will be able to pass through. The switch shows line errors incrementing at a very high rate. A ping issued from the router to a local device on the ring with the switch will fail. The workaround is to manually set the switch to half-duplex.[CSCdk10225]
- After booting the Cisco IOS releases 11.1(18.1)CA and 11.1(18)CA with bridging enabled on the ATM interface (AIP), the Cisco 7513 router with RSP4 continuously reboots with a bus error. It also causes the router at the other end of the PVC to reload with a software forced crash. The workaround is to remove bridging from the ATM interface.
System was restarted by error - a Software forced crash, PC 0x601ABE14
GS Software (RSP-JV-M), Version 11.1(18.1)CA,
EARLY DEPLOYMENT MAINTENANCE INTERIM SOFTWARE
Compiled Tue 07-Apr-98 04:58 by richardd
Image text-base: 0x60010900, data-base: 0x60A64000
Stack trace from system failure:
FP: 0x60F61620, RA: 0x601ABE14
FP: 0x60F61620, RA: 0x601A9CA0
FP: 0x60F61638, RA: 0x60130EAC
FP: 0x60F61660, RA: 0x601320F0
FP: 0x60F61698, RA: 0x6011AC98
FP: 0x60F616B8, RA: 0x6011ECC0
FP: 0x60F616F8, RA: 0x6011B048
FP: 0x60F61710, RA: 0x6013A7F8
- [CSCdk18176]
- Ethernet interface processor (EIP) interfaces on a Cisco 7500 series router running Release 11.2(13) changes between up and down state. A typical shut command, then no shut command does not bring them back. You must either do a reload of the system, or a microcode reload to stabilize the box to normalize the status. [CSCdk36767]
- When transparent bridging is configured, the Token Ring protocol state may keep going up and down. There is no workaround. [CSCdk60152]
- A router configured with a policy route map on a BRI interface may not forward packets to the next hop as specified in the set ip next-hop command. For policy routing to fail, the command ip policy route-map name must be configured on a BRI interface, and the destination must exist in the ip cache table of the policy router. A workaround is to issue the clear ip cache command, or remove fast switching by issuing the no ip route-cache command. [CSCdk12537]
- When using LAN with both active and standby networks on different ports, the standby router will do a proxy ARP reply even though it is not active. This is because the active router may not reply if the next hop is through the LAN. When the standby router replies, it puts the virtual MAC address in both the ARP field and MAC layer field. If the active and standby routers are on different ports on a switch, the switch learns the virtual MAC address from both of them, thus corrupting its MAC layer cache. The workaround is to disable proxy ARP. [CSCdk14556]
- DNS NS records that have glue records translated have the TTL set to 0, but the TTL of the NS record is not set to 0. Thus the DNS server will have an NS record for a DNS zone but no glue records. The next time the DNS server contacts the remote DNS server, it will fail because it has a cached NS record but no IP address to reach it. This is not fixed in all cases, See CSCdk61629 for further fixes. [CSCdk24050]
- NetBIOS over TCP/IP port 139 is not being translated. [CSCdk26313]
- DNS NS records that have glue records translated have the TTL set to 0, but the TTL of the NS record is not set to 0. Thus the DNS server will have an NS record for a DNS zone but no glue records. The next time the DNS server contacts the remote DNS server, it will fail because it has a cached NS record but no IP address to reach it. [CSCdk61629]
- If the ip pim send-rp-announce command is configured when a router runs out of memory, the router may crash. The workaround is to disable this command when it seems that the router is running out of memory. [CSCdk63163]
- Multicast assert does not prune the interface when using IOS Release 11.2(15.3)P. The interface will continue forwarding after the expiry timer, and never send or receive an assert again. [CSCdk6347]
- A Cisco router running Release 11.1(12) crashes at hi_delete, hi_open and lattcp. [CSCdj38034]
- Printing with LAT/TCP translation may produce incorrect printout. [CSCdk57205]
- With VIP20, crypto keys cannot be generated. Keys can only be generated on the RSP or the VIP40, but the router should not hang. [CSCdj81683]
- When there are no routers on one end, with attempted encryptions on the other (phantom) side, a number of problems occur in the connection setup code. [CSCdk23751]
- If two encryption access lists are different but each has the same IP address as the lowest numbered IP address in the ACL sources, and the same lowest numbered IP address in the ACL destinations, they will be erroneously treated as the same encryption session. This will result in only one of the two encryption sessions being used at any one time. The one encryption session that is active may not work reliably. [CSCdk33027]
- Redundant ARP servers are not implementing a backoff mechanism. When the link between the redundant ATM ARP servers breaks, they continue to try to contact each other in an effort to repopulate the ARP cache. Because of excessive signalling, the CPU load on the routers and ATM switches rapidly overloads. The workaround is to use only one ARP server or put them on very stable links. [CSCdk40947]
- Cisco 7000 series and 7500 series routers running Cisco IOS Release 11.2(15) and using an ATM (AIP) connection to a LightStream 1010 with RFC1483 SVC configuration may crash. This seems to be due to memory corruption caused by the UNI3.1 SSCOP retransmission path when ATM signalling to the LightStream 1010 is lost. The workaround is to configure UNI3.0 on ATM interfaces. [CSCdk50505]
- Packets coming in on a tunnel interface from a Token Ring interface on Cisco 2500 or Cisco 4000 routers are duplicating. The workaround is to disable fast switching on the outgoing interface for the decapsulated packet. [CSCdk53083]
- High CPU utilization, intermittent latency and alignment errors occur during booting. There is no workaround, but disabling fast switching helps with latency. [CSCdk64869]
- Excessive SAP requests use excessive memory leading to the router sometimes getting memory allocation failures. If IPX EIGRP is configured, refer to CSCdk44590 also. [CSCdj88812]
- When using IPX-Enhanced IGRP incremental SAP updates (RSUP), the server tables between two or more Enhanced IGRP neighbors may clash. The problem may occur when as few as three dozen servers go away at the same time, while the routes to those servers remain in the routing table and if there are multiple Enhanced IGRP neighbors or paths to a neighbor. The "down" flash update for some of the recently downed servers is not being sent out to all interfaces, so some devices remove the servers and others do not. A workaround is to clear the IPX Enhanced IGRP neighbors on the unit with these servers remaining in the table. [CSCdk13645]
- The router gradually loses memory when running IPX Enhanced IGRP with ipx sap-incremental commands configured on its interface(s). The memory leak occurs when SAP general requests are received on the IPX interfaces with ipx sap-incremental configured. By default, ipx sap-incremental is enabled on non-LAN interfaces that are configured for IPX-Enhanced IGRP. It is most evident after issuing the show process memory command and seeing the growth in the "Holding" memory by the "IPX SAP In" process:
PID TTY Allocated Freed Holding Getbufs Retbufs Process
44 0 14265416 201472 8360984 21924 0 IPX SAP In
- Also, memory is being allocated to large number of "IPX SAP PH", "IPX NDB PH", and "IPX USV" as shown by the command show memory summary. A workaround is to issue the command no ipx sap-incremental eigrp from the IPX interfaces. [CSCdk44590]
- Issuing the debug ip tcp packet command may cause the router to crash following the issuing of either the show running-config or write terminal commands. [CSCdk45442]
- TCP applications using a TCP driver API, such as DLSw or STUN, will use a TCP maximum segment size (MSS) of 1450, if MSS exchanged during the connection is smaller than 1450. To override this behavior and use the MSS exchanged during connection time, the hidden command ip tcp tcpdriver default-mss can be issued. [CSCdk65973]
- An ISDN switch expects that the router sends a CONNECT message (or a similar message) within four seconds after receiving an incoming SETUP. This is timer T303. In some cases, when working with dialer profiles, the router is not able to send the message within T303. This results in a situation where the ISDN switch sends several SETUPs with the same call reference, and the router never answers these incoming call SETUPs. [CSCdk02552]
- The PPP negotiation debug command shows attempts to output LCP confreqs on the D channel. This can cause a valid PPP session, which has already completed LCP and opened IPCP, to be disconnected. [CSCdk06216]
- An LEC running on a Cisco router with Releases IOS 11.2 and 11.1 can go up/down while interoperating with a Bay Networks switch. [CSCdk54181]
- A router running DLSw with Ethernet end stations attached, may lose its connection because of sequence number problems on frames sent by the router. This causes the end station to send a FRMR. [CSCdk55183]
- A router may crash when an APPN link over an FDDI port is activated on an existing inactive node. [CSCdk57176]
This section describes possibly unexpected behavior by Releases 11.2(15) and 11.2(15)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(15) and 11.2(15)P. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(15) and 11.2(15)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Releases 11.2(16) and 11.2(16)P.
- When the startup and private config are synchronized to the slave RSP, a check to ensure that the private config exists was overlooked. [CSCdj89186]
- In a RSP system it is possible to get a software forced failure due to redzone corruption if the following is configured on the router:
- HSA and large configurations, or configuration compression and large configurations, or all three, and the configuration file is the size of "boot buffersize" in the configuration (boot buffersize defaults to approximately 126K bytes).
- A workaround for this problem is to make the "boot buffersize" in the config larger.We suggest 100K bytes larger than the configuration to allow room for configuration changes. [CSCdk14608]
- If the total size of a Frame Relay compressed packet grows in the output queue, a buffer in an internal data structure can be misqueued and cause the router to fail. [CSCdk22991]
- When the router is running low on memory and a write mem or config net command is issued, then there is a chance the NVRAM may be corrupted and the router reboot.
- This problem can be avoided by first checking to see if there is enough memory to write the configuration. [CSCdk32125]
- Split horizon is not supported on all point-to-point type interfaces. [CSCdj91606]
- An APPN port may get stuck in the "stopping" state. [CSCdj82659]
- Under certain circumstances, an APPN router fails when accessing a NULL transmission header pointer in a message unit. [CSCdj89816]
- A Cisco 7513 router configured as a downstream physical unit (DSPU) for remote source-route bridging refuses new connections. The workaround is to remove all DSPU commands and reconfigure them. [CSCdj93572]
- Show bsc command causes router to fail. When control units are being removed by the router based on host or end device activity, issuing the show bsc command on the router causes it to fail. Show bsc accesses a linked list of control unit blocks to print information. While it is blocked for printing, some other process removes a control unit from the linked list, causing the show bsc routine to access a invalid memory location. [CSCdk12302]
- When running under a stress scenario, especially when links and sessions are being deactivated, a router running APPN may force a reload with lrp114() in the backtrace. [CSCdk18977]
- When using NetView 3.1 or greater, the DLUR router may display the following message repeatedly when a run command is issued to a DLUR router configured with NSP over DLUR. The workaround is to not use NSP over DLUR.
%APPN-7-APPNETERROR: MSP04-bAuUEcKTSepupA TRIED TO SEND TO THIS NODE FOR bAuUEcKcbDe
%APPN-7-APPNETERROR: MSP08-MDS_MU RCVD WITH ERROR
%APPN-7-APPNETERROR: 008B13100038131119810801E2C1F5D5C5E30902D4D3E5F0F5F0C1060323F0F1
%APPN-7-APPNETERROR: F516820801E2C1F5D5C5E30602E3E2C4E5060323F0F1F4059000800000331549
%APPN-7-APPNETERROR: 16010A01E2C1F5D5C5E340400A02C3D5D4F0F14040400A0423F0F1F540404040
%APPN-7-APPNETERROR: 0F020000001200620602083B3200E9001C1212001880610C060A50C3D6D5E2D6
%APPN-7-APPNETERROR: D3C5400831E2C840E5C5D9
%APPN-7-APPNETERROR: MSP08-SENSE_CODE=0x8A80009
%APPN-7-APPNETERROR: MSP08: SENSE_DATA= 0x8A80009
%APPN-7-MSALERT: Alert CPMS002 issued with sense code 0x8A80009 by XXXMSP04
- [CSCdk19424]
- A DLSw backup peer is not reconnected to its backup peer after a link failure, if the primary peer is still unreachable. [CSCdk21561]
- With thousands of CLS sessions, an inordinate amount of CPU is consumed. [CSCdk24769]
- While running DLSw with FST encapsulation, router might give the following error message along with traceback:
%SYS-2-INPUTQ: INPUTQ set, but no IDB, ptr=ADDD9C
-Traceback= 148D3A 572A 4DF4 110064 17DAA2 17B0DA 14CC 10005B4 10047DA
- There is no workaround for this. [CSCdk25935]
- Under certain conditions when establishing DLSW TCP peers the router may suffer a system restart. Currently no workaround exists. [CSCdk26442]
- DLUR router may reload or issue a spurious memory access in ndr_utils_fqpcid_from_header(). The problem is typically hit during heavy DLUR/DLUS pipe traffic followed by a pipe termination. [CSCdk26563]
- A router may reload if the Token Ring interface has SRB configured. This can happen if a router with SRB configured receives a frame for LNM with a RIF length greater than 7 hops. A workaround is to issue the command no lnm rem. All platforms are affected. [CSCdk30604]
- Under heavy load from APPN file transfer packets can be queued between APPN and DLSW (using VDLC). Flow control from DLSw is not propagated correctly back to APPN. The resulting queue within CLS renders prioritization of APPN COS through DLSw irrelevant. [CSCdk34540]
- The DLUR router may not be able to reestablish the DLUR/DLUS pipe sessions after the following "APPN Allocate timed out" message is displayed:
%APPN-6-APPNSENDMSG: APPN Allocate 60E8BA14 to timed out for TP
%APPN-6-APPNSENDMSG: Ended DLUR connection with DLUS NETA.CPAC
%APPN-7-MSALERT: Alert LU62004 issued with sense code 0x10010000 by XXXSMPUN
%APPN-6-APPNSENDMSG: Starting DLUR connection with DLUS NETA.MVS2
%APPN-6-APPNSENDMSG: Starting DLUR connection with DLUS NETA.CPAC
%APPN-6-APPNSENDMSG: Connection attempt failed to DLUS NETA.CPAC
%APPN-6-APPNSENDMSG: Starting DLUR connection with DLUS NETA.CPAC
- [CSCdk39176]
- When running bisync on a branch router connected to an NCR5085 cash machine, under unusual conditions, if a corrupted acknowledgment is received from the ATM XA machine, you may see the input queue on the serial interface connected to the ATM machine get into a wedged state. If the serial interface is in this state, the show interface display will show the value of "input queue" to be 75/75. A workaround to get the interface working again is to shut down the interface and bring it back up. An additional work around to schedule the shut/no shut is to increase the interface input hold queue size by issuing the command hold-queue 150 in under the bisync interface. [CSCdk41218]
- When switched PUs are activated and inactivated on the CMC host and this activity causes the DLUR-DLUS pipe to be taken down, it is possible for the DLUS-DLUR pipe to get hung in a pending inactive or pending active state. This is caused by an internal race condition in the ordering of deactivation messages as they reach the APPN DLUR component. [CSCdk44386]
- The SMF was not updated on FDDI due to the fact the all software IDBs are not referred to during the SMF update process in the driver. This resulted in BPDUs not reaching the remote station, thereby making both stations the root(s) of the spanning tree. [CSCdj95431]
- Transparently bridging IP over FDDI may fail. [CSCdk04111]
- AppleTalk doesn't come up on 2E-FDX interface. The problem occurs only on the 2E-FDX interface. There is no work around. [CSCdk15786]
- Priority and Custom Queueing do not work on the following platform interfaces, for all releases of IOS:
- 3600: PRI/cT1, PRI/cE1, mBRI
4500: PRI/cT1, PRI/cE1
5200: T1/PRI, E1/PRI 5300: T1/PRI, E1/PRI
7200: mBRI
- There is no workaround for this. Packets on these interfaces are transmitted using FIFO queueing. [CSCdk16630]
- A Cisco 7505 router does not reply to IP ARP packet on the 802.10 InterVLAN Bridge network. [CSCdk22012]
- A router will become very busy and seem to fail because the Token Ring does not filter forwarded DECnet multicast frames when permanent bridging entry and DECnet are configured. There is no workaround. [CSCdk27418]
- For a Cisco 7000 router running Cisco IOS Release 11.1(15)/11.2(8), CPU utilization stays at 87 percent due to the IP-RT background process. This problem occurs when a static route is configured for a down or non-existent interface. A workaround is to remove the static route. [CSCdj54602]
- Under certain topology, a multicast packet originated from a router may start a PIM Register loop between the DR and the RP. The loop would stop when the time-to-live count in the IP header reaches zero.
- There is no workaround. [CSCdk12033]
- A Cisco 7513 router running Cisco IOS Release 11.1/11.2 may advertise an OSPF route for an interface that is in the state "interface up, line protocol down" upon boot up of the router.
- The following conditions must exist to encounter this problem:
- 1. The router boots.
- 2. The interface must be in a state "interface up, line protocol down" when the router boots.
- 3. The interface is included under the OSPF process with the command network ip_address mask area area_id
- A workaround is to configure a different IP address on the interface, remove the IP address and then reassign the original IP address to the interface. Issuing the shutdown and no shutdown commands does not correct the problem. [CSCdk12915]
- Enhanced IGRP does not trigger the selection of a new route, when one of the less good or equal paths, is removed from the RT. The route disappears but no new route is selected from the topology table. [CSCdk14241]
- A router running Cisco IOS Release 11.2(14) and later configured for OSPF may not install an external route into the routing table even when the forwarding address in the external LSA is reachable.
- Workaround is to use a floating static or issue a clear ip route * command on the router that lost the OSPF external route(s). Alternatively, a clear ip ospf redistribution command can be issued on the ASBR. [CSCdk17979]
- A router configured with ip igmp static-group may remove the command when an IGMP V1 client answers IGMP queries and subsequently quits answering IGMP queries.
- There is no workaround. [CSCdk18477]
- DVMRP prunes received over a point-to-point link other than a tunnel, are silently ignored when they are sent to a unicast address. Workaround is to build a tunnel with the DVMRP neighbor. [CSCdk29300]
- Issuing a show ip eigrp event, a show ipx eigrp event, a show appletalk eigrp event, or enabling Enhanced IGRP event logging for IP, IPX, or AppleTalk may cause the following platforms to reload with a bus error or segv: 1000, 2500, 2600, 3800, 4000, 5200, and 7000 (RP/SP). Other platforms, including the Cisco 3600, 4500, 4700, 5300, 7000 (RSP), 7200, 7500, 8500, and RSM may display the record of a spurious memory access.
- The Enhanced IGRP event log is invalid on all platforms.
- The workaround to this problem is not to display the event log or enable Enhanced IGRP event-logging. Additionally, the event log can be disabled by issuing one of the following configuration commands:
- For IP: router eigrp as eigrp event-log-size 0
- For IPX: ipx router eigrp as event-log-size 0
- For AppleTalk: appletalk eigrp event-log-size 0 [CSCdk33475]
- There are rare cases of network NSAP numbering that when ISO-IGRP removes redistribution dummy adjacencies, the adjacency table is corrupted. [CSCdj91837]
- If IS-IS routing for IP is configured then unconfigured multiple times, the router may reload when an IP address is removed from an interface. [CSCdk26766]
- On all platforms which do not use the old MCI controller, fast-switching of CLNS traffic with non-zero N-Selector does not work. [CSCdk36270]
- APPN over ISDN fails to start the link station; a workaround is to use APPN over RSRB. [CSCdk10208]
- The problem is caused by an invalid I-frame with unsolicited f-bit. LLC2 would drop the frame but pick up the new sequence number N(R). Retransmission according to the new sequence number would result in packet content out of sequence, and APPN session would fail. [CSCdk13959]
- The packets dropped by the VIP2 encryption engine is not included in the drop list and not sent back to RSP to display to the user. [CSCdj25738]
- Encryption does not work properly over a PA-2CE1 or PA-2CT1 port adapter, when installed on a VIP2 card. [CSCdj85798]
- Encrypted TCP sessions are pausing when passing over an MPP bundle as soon as two or more members in the bundle become active. This behavior can only be observed when building a TCP session between hosts on the LAN interface of two routers connected via encrypted MPP. The workaround is to turn off fast-switching on the LANs. [CSCdj91142]
- When an ESA card is talking to a s/w based encryption algorithm, the commands in the router with the ESA card will not take effect immediately. This appears to affect changes in command as well. A workaround for this is to reload the VIP microcode, reload all the microcode, or reload the router. [CSCdk06004]
- A VIP Token Ring Interface does not encrypt/decrypt IP packets containing a routing information field (RIF), even though the initial encryption connection setup with the remote router is successful.
- Encryption/decryption for Token Ring ip packets without a RIF continues to function normally. [CSCdk18888]
- After 32767 encryption connection setup attempts, encryption connection setups may not complete. The workaround is to reload the router. [CSCdk34968]
- If an interface is configured for both nat outside and encryption, all incoming packets targeted at the router are forced to the encryption engine, regardless of whether or not they are (or should be) encrypted. All non-encrypted packets are then dropped by the encryption engine. [CSCdk39728]
- When trying to use secondary Novell encapsulations on a BVI interface, only packets with the primary encapsulation are accepted. The debug ipx packet command shows us that packets from a station that uses one of the secondary encapsulations are received but marked as bad packets and dropped. [CSCdk18456]
- Fast switching of IPX and IP packets from Async PPP to Tunnels does not work.
- A workaround is to disable IPX fast switching on tunnel interfaces with the no ipx route-cache command. Disable IP fast-switching on tunnel interfaces with the no ip route-cache command. [CSCdk21562]
- It is possible for a system to encounter problems when an online insertion and removal (OIR) occurs. One of the symptoms of this problem is for the VIP CPU load to remain near 99 percent. This problem occurs because the VIP continues to transmit packets to the removed interface using distributed fast switching. Only a system reload or micro reload would clear the problem. [CSCdj35436]
- Dialer backup interface may attempt to dialout when bridging even when in standby mode. [CSCdj84834]
- When a the serial port of a Cisco router is connected via an X.24 cable (a modified X.21 cable with the control lines strapped so that layer 1 stays up at all times), PPP fails to restart when the router or its peer is reloaded. The workaround is to use the shutdown command, followed by the no shutdown command on the serial interface. [CSCdj87834]
- A race condition existing in the current SSCOP code can sometimes lead to a system failure. The workaround is to disable the SSCOP quick polling scheme. [CSCdj93988]
- Trying to pass PPP packet that is larger than 1524 bytes through a serial interface that has its MTU set larger than 1524, results in a "LINK-3-TOOBIG" error message.
- The reason for the failure is the maximum encapsulation size has been statically set to 1524 for PPP packets and the error will occur when the packet is larger than the set size.
- A workaround is to configure the interface to have an MTU of less than 1524 bytes (1500 is the preferred size). This will allow the interface MTU to control the fragmentation of the packets to be less than the 1524 bytes allowed size. [CSCdk01289]
- The input queue counter on an ATM interface may become negative. The workaround is to specify process switching. [CSCdk01302]
- Packets received on an interface that has ppp reliable-link configured may be incorrectly fast-switched, resulting in the packets not being acknowledged, and causing the interface to stop forwarding traffic. The only workaround is to disable fast switching on all interfaces. [CSCdk02869]
- The router may fail while using the BRI for semi-permanent connections. [CSCdk19800]
- Memory for crash context is freed when a VIP is pulled but an interface condition prevents it from being reallocated if a card is later inserted. [CSCdk35821]
This section describes possibly unexpected behavior by Releases 11.2(14) and 11.2(14)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(14) and 11.2(14)P. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(14) and 11.2(14)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Releases 11.2(15) and 11.2(15)P.
- Cisco AS5300 T1 controllers show signal loss in some cases and will not recover. This caveat is more likely to happen when the T1 line has lots of errors. When the caveat is seen, a "!!! Firmware is not running!!!" message is displayed on the console if the debug dsx1 command is configured. To recover from this state, reboot the AS5300. [CSCdj86924]
- In certain cases, the number of packets shown in the IP flow cache packet size distribution does not match the number shown in the cache statistics. [CSCdi71766]
- When VINES/SRTP is configured with more then 1500 Vines routes running Cisco IOS Releases 11.2(6) or 11.2(8)P and later you may receive the following error message:
%SYS-2-GETBUF: Bad getbuffer, bytes= 18192
-Process= "VINES Router", ipl= 0, pid= 44
-Traceback= 6014EFA4 60422FA8 60424528 60412184 604119D8 60411E8C 6016C7A8 60164
- To resolve this problem, configure VINES to use RTP. [CSCdj80039]
- Transmission of Frame Relay LMI Status Enquiry packets can be delayed in the router by other routing or control packets, then appear on the wire out of order. This can cause some instability of the Frame Relay circuit during the time the Status Enquiries are delayed by the other packets. The instability is seen as the Frame Relay PVC being declared Inactive at the remote end and then Active again about one minute later. The Frame Relay switch at the local end will report LMI Timeouts and Sequence Number Mismatches.
- It is also possible for this problem to occur on HDLC serial lines and cause instability because of HDLC keepalive packets being delayed.
- This problem has occurred only when very large IPX SAP updates are sent over a slow-speed circuit. The size of updates necessary to cause this problem on a 56 kbps circuit is around 3000 SAPs. The problem is more likely to occur when there is data traffic near the line capacity on the circuit.
- Other routing or control packets such as OSPF Link State Advertisements (LSAs) or NLSP Link State Packets (LSPs) can also cause the same effect during a period of severe routing instability in a large network with many Frame Relay subinterfaces. The effect is less likely to be seen when Weighted Fair queueing is used on the serial interface rather than First In First Out (FIFO) queueing. Many other possible causes of instability of Frame Relay or serial circuits and the manifestation of this particular caveat in operating networks is unlikely.
- If very large IPX SAP updates cause the problem, the workaround is to configure an ipx output-sap-delay and ipx output-rip-delay that is greater than the propagation delay of a SAP packet across the circuit. A delay of 110 ms is sufficient for a 56K circuit. The possibility of seeing this caveat with very large IPX SAP updates was introduced by CSCdj18092. [CSCdj91667]
- A router may display this recurring message on its console:
- %APPN-7-MSALERT: Alert LU62004 issued with sense code 0x812000D by XXXSMPUN
- This sense code indicates that APPN is running out of buffers and therefore unable to allocate new sessions. One solution is not to reserve the unbind buffers in advance, during the BIND time. [CSCdj87034]
- STUN peers may try to open a peer at the same time. This problem only occurs when tunneling Computer channel extenders. Potentially, it could happen with other similar devices if they both simultaneously send at startup time. [CSCdj90520]
- It is not possible to link locally on a router attached to Token Ring segments with an LNM station when an additional DLSw peer is configured.
- Only the segment where the LNM is directly connected is linkable. [CSCdj93242]
- Session initiation requests may become queued network-wide with the current adaptive BIND pacing implementation. This queueing can occur when network traffic loads are low, but a single end station has withheld a BIND pacing request. This enhancement ensures that the router withholds a BIND pacing request only when the router is truly congested.
- There are no router messages identifying that this problem has occurred. The primary LU sending the BIND will typically have a session status of "pending BIND response," whereas the secondary LU will not have received the BIND. [CSCdj93613]
- An APPN router may reload during an intermittent race condition of activating a CP-CP session and cleaning it up. One of the following backtraces may be displayed:
60685F58[pspost+0x1f8]
60687718[ptp06a+0x218]
60684388[psp01b+0x48]
606838F0[psp00+0x150]
- or
#0 memcmp
#1 0x606af860 in ptp06a
#2 0x606ac668 in psp01b
#3 0x606abc00 in psp00
- [CSCdk00603]
- A customer encountered a problem when running QLLC/DLSw local after finishing maintenance on the FEP.
- After bringing up the Token Ring on the FEP and activating the software Major node, about 10 percent of the PUs did not reestablish sessions with the host.
- VTAM shows those PUs as active in session. Issuing the show dlsw local-circuit command also shows the corresponding VMACs as being connected, yet an X.25 trace shows that these PUs are stuck in XIDs. [CSCdk01275]
- Cisco 2523 routers running Cisco IOS Release 11.1(18.1) and later will not pass non-activation XIDs when configured for XID pass-through. The impact is not serious unless you require PU 2.1s to remain active while VTAM is down. [CSCdk01631]
- When buffers are under heavy use, the APPN subsystem can enter Bconstrained mode too early and reject new session requests when there is still adequate buffer memory to continue processing requests. [CSCdk01686]
- If a dependent-PU/LU device sends an init-self, and the resulting bind has a Userver-changed PLU-name to the name originally specified in the init-self. Some devices check the PLU-name in the bind, and reject it if different than the one specified in the init-self. [CSCdk02330]
- A memory leak is caused by unsuccessful route calculations, eventually causing the router to fail. [CSCdk02504]
- The xxxtps27 timeout may not always free the request_cp_capabilities TP. This TP may time out if the adjacent node does not respond to the control point capabilities within a specified time. A TP timeout was added to prevent this TP from waiting indefinitely on the adjacent node. In some cases this timeout may not work and the request_cp_capabilities TP will not process new control point capability requests. When this problem occurs, the following messages will be displayed:
- %APPN-7-APPNETERROR: APPN TP xxxtps27 timed out on send of verb 11 -- Deactivating CP-CP CGID: 147125
- %APPN-7-APPNETERROR: Deactivating CP-CP with sense 8120010, no adjacent node found, ConW: 147125, ConL: 0
- [CSCdk03979]
- CP-to-CP sessions may be deactivated because of a chaining error on the APPN router. [CSCdk04100]
- The -r parameter for the APPN ping command is broken. Issuing the command with this parameter will cause the box to stop responding to network control traffic, and new sessions will be unable to start. A router reload will be required. [CSCdk05802]
- The APPN/DLUR router may reject an LU-LU session bind if the session was previously terminated by the router because of a protocol error. [CSCdk05823]
- An APPN router should attempt to activate the conwinner CP-CP session more than three times. If the CP-CP session cannot be activated (for reasons such as insufficient resources or a non-responsive adjacent node), then the router should attempt this CP-CP session activation after the situation has had a chance to recover. [CSCdk06411]
- The maximum memory access for APPN has been adjusted as the maximum memory capacity of Cisco routers increased to 256M. With this fix, APPN subsystem can use the full 256M of main memory of the router. [CSCdk08186]
- Because byte 1 of the FID2 header is reserved, the router does not set (or clear it). If this value is set to 0xC0, an attached Tandem host issues unbind 0831.
- An intermediate APPN NN (not running DLUR) will not properly preserve the pacing values from the upstream in the adaptively paced bind. Later when this bind is converted to fixed pacing by a downstream node, the proper fixed pacing values will no longer be there. [CSCdk09759]
- A regression caused by CSCdj87034 causes sessions to have a single DLUR DLUS pipe. [CSCdk10696]
- An APPN router may display a single conloser CP-CP session. This session cannot be deactivated by issuing the appn stop cp-cp command. As a workaround, stop the APPN link to clear this problem. [CSCdk10830]
- LLC2 sessions may be torn down when RSRB peer receivers accept out of sequence FST packets. [CSCdk11138]
- When locates are broadcast into the network, APPN makes more copies than necessary of the search_data control block. In a typical APPN network, when there are hundreds of locates at the same time, a memory spike cause the box to run out of memory and fail. [CSCdk11143]
- DLSw running in a border peer environment may impact other fast-switched traffic through the router. A DLSw router (as either a border or member peer) creates a temporary peer structure to store reachability information. While creating or deleting this temporary peer information, the router doesn't fast-switch packets. [CSCdk12609]
- The DLUR router will wait indefinitely for a bind response to the bind request for its half of the DLUR/DLUS pipe (until the link is disconnected). It will not retry this DLUR connection until the response is received. [CSCdk12990]
- If any OIR event (such as a board being removed or installed) occurs while FEIP is busy transferring data, system service may be disrupted by an internal FEIP hardware bug. You may see a Cybus or MEMD error when the problem occurs. [CSCdj89682]
- When IRB is enabled in a Frame Relay network using point-to-point subinterfaces, and the subinterfaces are part of a bridged network to remote sites, MAC level broadcast packets are not forwarded between the subinterfaces. [CSCdj91372]
- While receiving bridged input from a virtual device on a Cisco 7500 router with FDDI interface(s) in the bridge group, the software may attempt to send an interface processor command to the virtual device, thereby causing the router to fail. [CSCdk00164]
- When a router is configured with a mixture of compressed and uncompressed Frame Relay interfaces, subinterfaces, or DLCIs, some packets are inappropriately compressed. The symptoms vary widely; in some cases NLSP neighbors will flap, and in other cases LMI messages may be misdelivered. [CSCdk05157]
- Some packets that are near a link's MTU size could be erroneously rejected. This caveat applies to HDLC, Frame Relay, and LAPB stac-compressed links, and has slightly different symptoms on each of these encapsulations. [CSCdk12078]
- Under unusual circumstances, a router configured for Enhanced IGRP may lose routes from the routing table. Examination of the Enhanced IGRP topology entry for the lost route reveals the feasible distance as infinity (4294967295), even though the metric for that route is good.
- The loss of the route is caused by sporadic line congestion (packet drops) and/or SIA events on the same link as the neighbor. On very rare occasions, this can result in a lost acknowledge packet and a retransmission of the reply packet. For the failure to occur, the retransmitted reply must have a valid metric.
- A known workaround is to issue the clear ip route * command. [CSCdj73617]
- A Cisco 7206 router may fail if configured for Enhanced IGRP in a fully redundant configuration. The workaround is to make some of the interfaces passive. [CSCdj81611]
- A (*,G) entry with 0.0.0.0 as the RP needs to install the RP information when a new RP is learned. [CSCdk03894]
- Occasionally, a NAT-translated packet in the fast path will get dropped, if it needs to be process-switched because of an incorrect IP header checksum. [CSCdk07875]
- When a PIM Dense Mode router forwards to a directly attached member and the member leaves the group, the router does not trigger a prune towards the upstream neighbor on a LAN. [CSCdk10293]
- On a Cisco 7200 series router, if NAT is configured on a non fast-switching interface, a packet translated by NAT in the fast path may generate alignment error messages if it is bumped for process switching. [CSCdk14834]
- When IGMP/PIM is enabled on BVI interface, the functions snmpwalk, igmpMIB, and pimMIB fall into an infinite loop. There is no workaround. [CSCdk15809]
- If an external route is known to IS-IS by multiple optimal paths and one or more backup paths, the backup path information may be lost temporarily. When this happens, the route may appear to be unreachable for a period of time.
- This loss can occur when the external route is known from the backup path, then becomes known from multiple optimal paths at about the same time, followed later by the loss of the optimal paths. The problem disappears when an SPF is run for any reason.
- A workaround is to force an immediate SPF on the router (for example, by issuing the shut and no shut commands on a loopback interface running ISIS). Note that this can be done on any router in the same area. [CSCdk05616]
- A Cisco router may poll a remote station during an outstanding poll request. The poll response may be for a previous poll, causing an internal counter to be adjusted incorrectly, and causing the router to reject valid frames. [CSCdk05957]
- Frames retransmitted by an APPN router using RSRB are truncated. [CSCdk07546]
- When running NAT and encryption, FTP fails, but Telnet and ping works. Apparently the TCP checksum is not calculated correctly. Removing NAT or encryption resolves the problem. [CSCdk03906]
- On-line insertion or removal (OIR) of an interface processor in an RSP based Cisco 7000 or 7500 router may result in multiple interfaces dropping very large numbers of incoming packets. This problem may be seen on interfaces of other boards, as well as the interfaces on the board that was inserted or removed. The problem manifests itself by a large and increasing number of packets reported in the "ignore" counter in the output of the show interfaces command. Communication through these interfaces will be severely impacted. This problem is most likely to occur in routers that have many active interfaces, and some interfaces with moderate to high traffic load. The problem is rare in routers that have few active interfaces and lightly loaded interfaces. The workaround is to reload the controller microcode using the microcode reload configuration command after the OIR event or power down the router to remove and insert cards. [CSCdk07259]
- TCP uncompress code may discard a bad frame without releasing the packet memory associated with it. This can cause a memory leak and interfaces may become wedged if the number of bad frames received reaches the input queue limit. [CSCdj77906]
- A router may fail in the RSH path if a user tries to open an RSH connection to a Protocol Translation address on the router. Incoming RSH connections to a PT address is not supported, but if a connection is opened to the address, there is no known workaround to avoid the failure. [CSCdk01735]
- Occasionally, the STUN/DLSw input interface may get wedged because of flow control in TCP. [CSCdk07263]
- When mroute-cache is configured, multicast packets cannot go through a tunnel routed by LANE. The problem is caused by the AIP microcode failing to pad LANE packets. [CSCdj82421]
- A Cisco 4000 family router with an ATM interface running Cisco IOS Release 11.2(11) through 11.2(14) may encounter performance problems. [CSCdk02170]
- Initializing a BRI call using a second dialer map while Layer 2 was down left the router in a state unable to make future calls until the router was reloaded. [CSCdk03996]
- The router attempts to display "unknown sub-interface type 0x2" when Frame Relay subinterfaces are configured on a Frame Relay Network-to-Network Interface (NNI). This display may cause either a system reload or a kernel error message like "SYS-2-NOBLOCK messages." [CSCdk05107]
- Unsolicited drop parties/releases are sent on multipoint SVCs. In a LANE environment this might lead to random LEC failures. The root cause for this problem has been identified and fixed. [CSCdk06968]
- The SSCOP quick polling scheme, which was made the default scheme in the router images, can sometimes result in SSCOP resets. This quick polling can reorder the poll PDUs sent from the router thereby leading to sequencing errors. [CSCdk08643]
This section describes possibly unexpected behavior by Releases 11.2(13) and 11.2(13)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(13) and 11.2(13)P. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(13) and 11.2(13)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Releases 11.2(14) and 11.2(14)P.
- Under unknown circumstances, an AS5200 PRI D channel may get stuck in the state "TEI_ASSIGNED" rather than "MULTIPLE FRAME ESTABLISHED" which is the normal operating condition. This state is shown by the show isdn status command.
- The workaround at this time is to reload the router. Issuing the shut and no shut commands on the affected interface does not help. [CSCdj41613]
- The console/virtual-terminal exec on Cisco 7500 HSA systems may become unresponsive with configurations larger than 1M and the global configuration command service compress-config. The console can lock up upon issuing write memory or copy running-config commands, and the configuration NVRAM can become corrupted and inaccessible. Other vtys and packet forwarding and routing operations will continue to operate while the console or Telnet exec is nonresponsive. Cisco 7500 HSA software has been fixed to support configurations up to about 1M; earlier releases supported configurations up to about 128K.
- If the configuration size is larger than about 1.3M with newer software, or 126K with earlier software, and the console locks up, the configuration NVRAM will be corrupted and inaccessible. The router will be useless upon reboot and must be manually recovered as follows:
- 1) Send EIA/TIA-232 (RS-232) break to the console of both master and slave.
- 2) Issue the ROM monitor confreg command on master and slave to ignore system configuration.
- 3) Issue the ROM monitor reset command on master and slave to boot a slave-capable image.
- 4) On the master console, copy a good configuration file from Flash memory or TFTP into running-config.
- 5) Turn off the 0x40 bit in the configuration register by issuing the show version EXEC command and the config-register global configuration command.
- 6) Issue the reload command to reload the master.
- A workaround is to store the configuration in Flash memory. For example, issue the following commands:
- 1) copy running-config slot0:config
- 2) boot config slot0:config
- 3) service compress-config
- 4) boot buffersize number, where number is at least three times the configuration size in bytes
- 5) write memory
- The write memory command will now work slowly; that is, 10 minutes elapsed time for each 128K block of configuration text. [CSCdj63926]
- System reload due to bus error. Stack indicates TACACS+. [CSCdj80726]
- If a router is configured with DECnet, and an SNMP GET is attempted on any part of the dnAreaTable or the dnHostTable of the OLD-CISCO-DECNET-MIB, the router will stop working.
- This caveat is limited to the SNMP MIB implementation, and has no affect on managing or configuring DECnet by using the command line interface. [CSCdj91757]
- A router configured for APPN may fail due to a bus error at PC 0x902FA6 (asm_mainline). The stack trace may not show the routines called prior to the failure. In that case, the router needs to be set up for a core dump
- There is currently no known workaround [CSCdj77914]
- The APPN router may hang its request_cp_capabilities CP if it does not receive a bind response from the adjacent node within a certain time. When this occurs, no new conwinner CP to CP sessions may be established by this router. This results in only single conloser CP to CP sessions established between this router and adjacent nodes. [CSCdj85208]
- A DLUR router may withhold ACTLU responses from downstream PUs, preventing VTAM from sending ACTPUs. Downstream PUs may not become active. [CSCdj88063]
- During race conditions when, there is a DLUR pipe failure in combination with downstream PUs disconnecting, APPN/DLUR may leak buffers. [CSCdj92327]
- The APPN router may reload due to a spurious memory access in recreate_small_fid2_mu. The following messages are displayed on the router console before the reload:
%APPN-7-APPNETERROR: Insufficient available buffer supply
%ALIGN-3-SPURIOUS: Spurious memory access made at 0x606F5A4C reading 0x50
- The show stack command displays the following backtrace:
#0 0x606F5A4C in recreate_small_fid2_mu
#1 0x606fdbd4 in transfer_to_dynamic_and_send
#2 0x606fce90 in sc_process_mu
#3 0x606f6900 in e
#4 0x606f6ed8 in fsm_receive_router
#5 0x606d6b20 in upchuck
#6 0x606d6664 in rcv_cls_msg
#7 0x606d6208 in dlcdx_process_messages
#8 0x606f5e18 in xxxpcasm
- [CSCdj92488]
- Under certain circumstances, it is possible for the DLSw current window (CW) to grow and exceed either the configured max-pacing value or the default value (50). This behavior is likely to be seen only in environments that have large data transfers with large pacing windows at the higher layers, such as SNA LU 6.2, APPC, APPN, and Cross-Domain (INN/SNI) environments. The growth of the DLSw current window (and therefore the granted/permitted packets) is not in itself a problem to DLSw. However, the queueing that may arise could cause performance problems in other areas of the network. In the worst situation, the router may run out of memory.
- A workaround is to recycle the link session (LLC2) which frees all memory and resets the pacing window. [CSCdj93178]
- APPN/DLUR local APPC sessions (CP-CP sessions and DLUR/DLUS sessions) may fail after the session is terminated and reestablished. A message BGETA04 - Invalid pool will be issued when this occurs. [CSCdj93863]
- An APPN router may reload with the following stacktrace during a rare race condition in link activation:
601BEC84[abort+0x8]
601BD644[crashdump+0xc8]
6072198C[Pexit+0x88]
6071D25C[xQ_Mget+0x20]
60722A1C[PQenq+0x8c]
6063C234[fsm_action+0x5a4]
6063B81C[fsm_ls+0x12c]
60646EF8[cs_process_lsa_ips+0x3e8]
60648428[xxxcss00+0xa48]
- [CSCdj94050]
- The new 2E version 2 PCI local bus delivers hardware and software to replace the existing 2E NIMs (due to EOL components) based on the existing 6E NIM PCI local bus interface design. The new 2E version 2 will also provide two additional features that includes 10BaseT full duplex and auto-sensing between 10BaseT and AUI physical interface. The new 2E version 2 FDX will run only on Cisco 4500/4700 class routers and not the older Cisco 4000.
- Note also that since this is a new NIM, you will also need to download the corresponding IOS RXBOOT image to boot flash if you want to be able to net boot with this new NIM type. [CSCdj61831]
- Cisco 7206 routers with an FDDI and an ATM port adapter (using LANE) interface may fail (no connectivity at all) when configured with trans-bridging between these interfaces. [CSCdj87212]
- If the interface on the router flaps or a new interface has been brought up, this will cause the downstream router that is connected to this router to reread its routing entry, thus resetting the timer on the routing table and also resetting the default route. The default route will be gone until the next time the router recalculates it default route, which is about one minute. [CSCdj70939]
- Intermittently, an FDDI Forward/Dense entry is not added to the outgoing interface list (olist) of a Source-Group (SG) routing table. The end result is that the FDDI interface does not forward mpackets as it should until the clear ip mroute command is issued. This problem may occur when multiple Cisco 7513 routers run Release 11.1(16)CA with FDDI, Fast Ethernet, and Ethernet interfaces. [CSCdj92400]
- The router could fail when bad packets, whose datagramsize is smaller than the IP total length carried in the IP header, are received by the router and also classified for encryption. The fix for this problem is to add sanity check for the packets passed to the encryption engine for encryption. [CSCdj88434]
- The solution for CSCdj31419 was improperly integrated into Cisco IOS Release 11.2(12.1). CSCdj94374 corrects this issue and completes the integration for CSCdj31419.
- CSCdj94374 applies to Release11.2 only. In all other releases where the fix for CSCdj31419 was applied, the fix was correctly integrated.
- In some cases, due to CSCdj94374, the system may experience an unexpected reload. [CSCdj94374]
- When using telnet into any router interface and the telnet session is set to be encrypted, some packets are dropped. Therefore, the telnet session experiences unnecessary retransmission. [CSCdj94381]
- If your configuration contains a Kerberos SRVTAB, generating a configuration (using the write or show running config commands) will cause a memory leak. Running the show kerberos creds command will also cause a memory leak. [CSCdj94861]
- When removing the command ipx router nlsp from configuration of a router, the command does not come out of the configuration file.
- As a workaround, reload the router and the statement will be removed from configuration file (unless already written to configuration memory). If already written to memory, you must reboot with an image without the command, update the configuration, then write the updated configuration to memory. [CSCdj89734]
- Outgoing calls (call IDs from 0x8000 to 0xffff) are not properly released in some cases. The call ID assigned to a new outgoing call is not being checked against outstanding calls and is incorrectly being assigned when a call already exists with that call ID. The result is that the incorrect call is released when a call with the duplicate call ID is disconnected. [CSCdj33387]
- When loading a configuration at boot up, from flash memory, or from the network, a router will fail if the configuration contains the following commands:
- lane fixed-config-atm-address
lane auto-config-atm-address
- A message of the following form will be generated:
%LANE-4-LECS_WARN: ATM1/0: can't register
47.00790000000000000 0000000.00A03E000001.00 with signalling
(duplicate address ?)
- As a workaround, use only a single LECS address configuration or do not enable logging timestamps if multiple LECS addresses are required. [CSCdj83816]
- Older Windows PPP implementations such as Windows 3.1 with the Shiva stack (including Internet Explorer and Netscape Navigator Personal Edition) may fail to negotiate LCP successfully on IOS systems running a release of IOS with CSCdj63179 applied. The symptom is that the Windows client gives up trying to establish the PPP session after 6 LCP Config Requests have been sent by it. Windows then disconnects the call.
- Another aspect of the problem is that the overall setup time for an asynchronous PPP connection can take 15 seconds or more, regardless of the PPP client. That is a very long time.
- On releases of IOS with CSCdj63179 applied, the first Config Ack sent to the Windows client will be framed incorrectly, and it will arrive at the Windows client with a bad frame check sequence (FCS). This forces the Windows client to send another Config Request. If the Windows client has already sent 6 Config Requests then it will give up and disconnect the call.
- This is not normally a problem for Windows 95 since its Config Requests are spaced 3 seconds apart. In Windows 3.1 Shiva based stacks the Config Requests are spaced about 1.5 seconds apart, so it will give up on LCP negotiations much faster.
- Note that though this has only been observed with older Windows PPP implementations, the problem may occur with any PPP client that chooses to be aggressive in its LCP negotiation and has a short LCP negotiation timeout period.
- A workaround to this problem that works in most circumstances is to disable the carrier delay imposed on the interface by issuing the (hidden) interface level command carrier-delay 0
- Another possible workaround is to use async mode dedicated instead of using the autoselect function.
- Note that these problems only apply to asynchronous PPP, not synchronous PPP. [CSCdj88079]
- If the maximum number of virtual access interfaces have been allocated, should any one of them go down it is not be possible to allocate another virtual access interface.
- The following message is generated when this condition occurs:
Max # of virtual access interfaces 300 are allocated
- There is no workaround. [CSCdj92816]
- Processor memory parity errors are not being reported correctly on the VIP2 (10/15/20/40/50) product family.
- When running an image that has CSCdj93505 integrated into it, crash output for VIP2 products with a signal value of 20 indicates that a cache parity error condition was detected:
%VIP2 R5K-1-MSG: slot3 System Reload called from 0x..., context=0x...
%VIP2 R5K-1-MSG: slot3 System exception: sig=20, code=0x..., context=0x...
- When this value (sig=20) is present, the contents of the VIP crashinfo file are required for proper analysis.
- When running an image that does not have CSCdj93505 integrated into it, the parity error may manifest in different ways. CSCdj20187 documents one such example. [CSCdj93505]
This section describes possibly unexpected behavior by Releases 11.2(12) and 11.2(12)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(12) and 11.2(12)P. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(12) and 11.2(12)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Releases 11.2(13) and 11.2(13)P.
- The show stacks command fails to report the correct version of code running at the time of the last reload. This problem occurs when the Flash release of the Cisco IOS software does not match the running version of code.
- When upgrading the ROM monitor with this fix, the startup configuration in NVRAM will be lost. Therefore, save the startup configuration before the ROM monitor upgrade and then restore it later. [CSCdi74380]
- Issue: A catastrophic problem has been identified that affects all Cisco 7500 and Catalyst 5000 RSM users. The problem occurs when using packet tunneling in combination with certain timing conditions, packet sizes, and buffer-usages. Affected images are being deferred and special images are being built.
- Tunneling is being used as an abbreviation in this context to refer to a specific fast-switch to process-level code path traversed by translational bridging, source-route bridging (SRB), and remote source-route bridging (RSRB).
- When the packet tunneling logic on RSP or RSM-equipped systems causes datagrams to be copied from SRAM to DRAM, an arithmetic error results in more bytes being copied than is remembered for cleanup processing. Reuses of the tunneling logic, in certain rare combinations of timing, packet sizes, and buffer usages, may result in those unaccounted bytes causing several anomalous system behaviors including packet errors.
- This software defect is exposed to all RSP and RSM images in the following Cisco IOS software releases: 11.2, 11.2 P, 11.2 BC, 11.3, 11.3 T.
- Solution: To eliminate the problems mentioned in the preceding section, we strongly recommend that you download and install one of the following Cisco IOS software release updates:
- 11.2(12a), 11.2(12a)P, 11.3(2a), 11.3(2a)T
- Workarounds: There are two possible workarounds. CSCdj33812 provides a configuration command to avoid the software defect. This workaround is available in the following Cisco IOS Releases: 11.2(11.5), 11.2(11.5)P, 11.2(11.5)BC, 11.3(2.1), and 11.3(2.1)T. If you are using an earlier release, use the second workaround.
|
Note The two workarounds will drop performance down to process switching levels. |
- Workaround 1: CSCdj33812 incorporated a configurable command that will be stored in NVRAM.
- Configure with the memory cache-policy io uncached command to workaround CSCdj52309. To determine what memory cache policies are currently configured on your router, use the show rsp command.
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#memory cache-policy io uncached
Router(config)#end
Router#show rsp
Throttle count 0, DCL timer count 0
active 0, configured 1
netint usec 4000, netint mask usec 200
DCL spurious 0
Caching Strategies:
Processor private memory: write-back
Kernel memory view: uncached
IO (packet) memory: uncached
Buffer header memory: uncached
- To restore the MEMD caching policy to the original write-through policy, issue the memory cache-policy io write-through command.
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#memory cache-policy io write-through
Router(config)#end
Router#show rsp
Throttle count 0, DCL timer count 0
active 0, configured 1
netint usec 4000, netint mask usec 200
DCL spurious 0
Caching Strategies:
Processor private memory: write-back
Kernel memory view: write-back
IO (packet) memory: write-through
Buffer header memory: uncached
- Workaround 2: If operating with images that do not have the CSCdj33812 support use the following command:
Router# test rsp cache memd-fastswitch uncache
|
Note The above command will need to be entered after every reload. |
- Other considerations: Cisco IOS Releases 10.3, 11.0, and 11.1 Major and ED releases are not exposed to CSCdj52309. Though these releases share the same arithmetic problem, the tunneling software is different, and there is no known or predicted combination of timing, packet sizes, and buffer usages that result in the same or different anomalous behaviors associated with the Cisco IOS Releases 11.2, 11.2 P, 11.2 BC, 11.3 and 11.3 P. Cisco is using CSCdj52309 to repair the arithmetic problem in 10.3, 11.0, and 11.1 releases; however, no special images are being created because the anomalous behaviors are not present in those releases. [CSCdj52309]
- The c3620-i-mz and c3640-i-mz Release 11.2(9)P images may have problems when they are copied to new (previously unused) Intel 4 MB SIMMs the first time. [CSCdj59820]
- The console/virtual-terminal exec on Cisco 7500 HSA systems may become unresponsive with configurations larger than 1M and the global configuration command service compress-config. The console can lock up upon issuing write memory or copy running-config commands, and the configuration NVRAM can become corrupted and inaccessible. Other vtys and packet forwarding and routing operations will continue to operate while the console or Telnet exec is nonresponsive. Cisco 7500 HSA software has been fixed to support configurations up to about 1M; earlier releases supported configurations up to about 128K.
- If the configuration size is larger than about 1.3M with newer software, or 126K with earlier software, and the console locks up, the configuration NVRAM will be corrupted and inaccessible. The router will be useless upon reboot and must be manually recovered as follows:
- 1) Send EIA/TIA-232 (RS-232) break to the console of both master and slave.
- 2) Issue the ROM monitor confreg command on master and slave to ignore system configuration.
- 3) Issue the ROM monitor reset command on master and slave to boot a slave-capable image.
- 4) On the master console, copy a good configuration file from Flash memory or TFTP into running-config.
- 5) Turn off the 0x40 bit in the configuration register by issuing the show version EXEC command and the config-register global configuration command.
- 6) Issue the reload command to reload the master.
- A workaround is to store the configuration in Flash memory. For example, issue the following commands:
- 1) copy running-config slot0:config
- 2) boot config slot0:config
- 3) service compress-config
- 4) boot buffersize number, where number is at least three times the configuration size in bytes
- 5) write memory
- The write memory command will now work slowly; that is, 10 minutes elapsed time for each 128K block of configuration text. [CSCdj63926]
- There is a problem with Weighted Fair Queueing (WFQ) and Weighted Random Early Detection (WRED) where packets are not classified to the correct conversation or precedence. The problem occurs only for IP Netflow and optimum switching, and only on the Cisco 7200 platform.
- The workaround for this problem is to disable optimum switching (in IOS feature sets identified by -p-) and enable Netflow switching. [CSCdj74094]
- Address information is missing from AAA network stop records. For TACACS+, this attribute is the "addr" attribute. For Radius, the attribute is Framed-IP-Address. [CSCdj80206]
- A corrupt buffer header is causing Cisco 7500 series routers running Cisco IOS Release 11.1.(15.05)CA to restart with a bus error. [CSCdj80564]
- While accounting packets, RADIUS fails to check the packet authenticator, thus potentially accepting a bogus reply from an infiltrator.
- Since we previously did not check the accounting-reply authenticator, and there are some daemons out there (for example, livingston-1.16) which do this calculation wrong, some customers may see accounting packets rejected, or resent until they are dropped. The RADIUS daemon will have stored the accounting data, but Cisco IOS software drops the acknowledgment. This can be ignored, but it is suggested that customers upgrade to a daemon that calculates the authenticator properly (for livingston-1.16 customers, they should get the livingston-2.0 daemon, which is still free from Livingston's website).
- Another side-effect of this caveat with a broken daemon is that multiple accounting records are sent to the daemon, which the daemon acknowledges, but are thought to have been either lost or hijacked because of the broken authenticator. The result may be multiple identical accounting records for the same connection or login. [CSCdj82294]
- Memory leaks may be observed in routers running LNM especially at a burst. The command no lnm rem may be an acceptable workaround. [CSCdj66894]
- When a router is configured for SDLC encapsulation and its role is set to primary, it may incorrectly send an FRMR; only the secondary may send an FRMR. As a workaround, you can use the frmr-disable interface configuration option to prevent the sending of FRMR as a primary or secondary. [CSCdj66967]
- To address the problem of a DLUR pipe going down and reestablishing on the non-network owning CMC, the prefer-active-dlus command is being enhanced to include a retry parameter. The number of retries will be adjusted to a sufficiently high number to allow for those times when the network owning CMC is busy. An alert will be provided for each retry attempt. [CSCdj71104]
- With Cisco IOS Release 11.2(9) and later, a host DSPU configured via RSRB will continuously go active and inactive at about 30-second intervals. [CSCdj78867]
- BSC contention with older Cisco 2780 devices may experience some problems at startup. Some frames will cross the tunnel and start a session but the device never comes up fully. If the commands debug bsc event and debug bsc packet are issued, the output will show that the router is discarding all received frames on that interface. Look back through the history to the last success frame received on that interface. If a line similar to the following appears after the data is sent there will be a problem:
BSC: Serial0: FS-FSM event: LINK UP old_state: SEC . new_state: IDLE.
- The LINK-UP event will reset the bisync FSM and further frames will be halted. There is no workaround. The Cisco IOS image must be upgraded. [CSCdj80073]
- When a router is configured for DLSw/QLLC and the first SNA XID is from the LAN through the router to X.25, then the router sets the ABM bit in the SNA XID to 1 (byte 19, bit 1). This is not supported by all QLLC devices. [CSCdj81191]
- An upstream APPN node queued all binds destined for an intermediate APPN router because of a BIND pacing. The downstream router did not respond with an IPM (pacing response) to the upstream node. The pacing window was not released by the downstream router because the BIND buffer had been lost after waiting on a send_q to a downstream node that had not responded to a pacing request, and then the link to that node was terminated. Cleanup of the downstream node's link freed the BIND in an inappropriate way. [CSCdj81746]
- A router running RSRB might crash when a badly formed LNM packet is received.
- A workaround for this is to disable LNM on the router by issuing the command lnm disable. [CSCdj82340]
- APPN/DLUR: A router reload can occur when DLUR processes a flow on the DLUS/DLUR connect, which must be responded to negatively because the PU has disconnected. This is a regression defect introduced by CSCdj59639. [CSCdj84659]
- It is now possible to modify the CPSVRMGR mode in Cisco IOS Release 11.2(13). In previous releases it was impossible to do so.
- A new default mode was also added to APPN, the QPCSUPP mode, which is used for AS/400 5250 emulation. Now you will no longer have to explicitly code the QPCSUPP mode when connecting to LEN level devices that use the QPCSUPP mode. [CSCdj85300]
- While bringing up the peer connections, a router running DLSw may give an error message similar to the following:
%SYS-2-BADSHARE: Bad refcount in datagram_done, ptr=610ADD8C, count=0
- There is no workaround for this. [CSCdj86552]
- The APPN NN was enhanced to timeout locate searches that were pending for more than 9 minutes. If another node was not responding to locates, a significant amount of memory could be allocated to the NN while it waited for responses to the outstanding locates. This could result in memory shortages in some cases. [CSCdj87903]
- Under certain circumstances, an APPN router will crash while accessing a NULL transmission header pointer in a message unit. [CSCdj89816]
- Overruns or drops may be seen on serial interfaces on an FSIP on a Cisco 7500 series router. The commands shutdown, no shutdown, and clear interface will not clear this condition.
- The workaround is to do a command that will cause a "cbus complex" restart, for example, configure the MTU size to a different value and then change it back to your proper configuration. In the following example assume that the MTU was set by default to 1500:
router(config)# interface s 1/0
router(config-if)# mtu 8000
router(config-if)#! the previous command causes a cbus complex restart
router(config-if)# mtu 1500
router(config-if)#! change back to proper value
- [CSCdj03047]
- Under certain circumstances, rebooting a Cisco 2524 may cause the router to pause indefinitely with a T1 connected to a Fractional T1 module. The workaround is to unplug the T1 prior to the reload or change the T1 framing setting from sf to esf at both ends (including the Central Office and the Cisco 2524 router). [CSCdj22485]
- An IPX client cannot communicate with the IPX server through a Cisco 3600 Token Ring interface if both source-route bridging (with multiring configured on the peer Cisco router) and transparent bridging are enabled on the Token Ring interface.
- The problem occurs because the Cisco 3600 drops broadcast packets at its Token Ring interface.
- This problem applies also to the Token Ring port adapter for the VIP or the Cisco 7200 series router.
- The fix to this problem has been committed into Releases 11.2 and 11.3. Because Release 11.1 has been in restricted maintenance phase since September 1997, the fix will not be committed to Release 11.1. [CSCdj78572]
- When connecting FSIPs back to back using the DCE/DTC method, where one router acts as DCE to provide the clock, you may see overruns or underruns with older FSIP hardware. The parser allows configuring the clock up to 8 Mbps. Older FSIP hardware has a maximum throughput of 6.132 Mbps; therefore, underruns/overruns can be seen if traffic exceeds that threshold.
- The workaround is to configure the clock at 4 Mbps, or upgrade to the PA-4T+ or PA-8T+. [CSCdj79497]
- Cisco 7200 series routers configured with ISL on the C7200-I/O-FE Fast Ethernet port fail to transmit ISL encapsulated packets. There is no problem with native (non-ISL) packets going out on the same interface. This problem does not occur on the PA-FE-TX and PA-FE-FX, or while running Cisco IOS Release 11.3(1) or 11.3(1)T.
- As a workaround, use the PA-FE-TX or PA-FE-FX interfaces for ISL traffic or use Releases 11.3(1) or 11.3(1)T. [CSCdj79992]
- The output of the debug ip routing command indicates that the route to 0.0.0.0 is removed and reinstalled into the routing table with the same metric. [CSCdj06220]
- If two routing protocols with mutual redistribution cause a routing loop, it is possible that the loop will remain even after updates have been filtered. The problem usually occurs after a clear ip route * command is issued after applying the filters. If the routes are allowed to age out the normal way, the problem does not occur. If OSPF is running, the workaround is to issue the clear ip ospf redistribution command. [CSCdj38397]
- Issuing the clear ip route command will cause dynamic routes to be lost from the routing table. The only known workaround is to clear the interface and reinitiate the connection. [CSCdj59706]
- The command distribute-list in does not filter static/summary (Null0) routes; distribute-list out works fine. [CSCdj62406]
- NAT fails to translate the payload of NetBIOS packets when fast switching.
- A workaround is to disable fast switching on NAT interfaces. [CSCdj74725]
- If a multicast boundary is configured on the interface that Auto-RP randomly selects to join the Auto-RP discover group, then the router will not create an IP Multicast Routing Table entry with the local flag (L) set, and the router will not be able to build an Auto-RP map.
- The workaround is to issue the shut command, followed by the no shut command on that interface. [CSCdj81176]
- With inbound route-map/distribute-list/sof-reconfig, some prefixes may be incorrectly denied. [CSCdj83777]
- Enhanced IGRP redistribution between different access servers is broken when the interface flaps. This is a regression from the fix for CSCdj62406 [CSCdj85316]
- DECnet Discard routes cause cached cluster alias and real entries to point to the wrong interface. [CSCdj73031]
- Timers are not cleaned up properly in LLC2. This may result in crashes when RSRB local acknowledgment is used under a high load. [CSCdj42474]
- When, for example, due to a network error, a group of LLC2 sessions becomes disconnected, the router may under certain circumstances not clean up the LLC2 control blocks properly.
- When this happens, end systems associated with this control block, DMAC SMAC DSAP SSAP, cannot reconnect the LLC2 session.
- To workaround this caveat, either change one of the addresses of the SAPS or reload the router. [CSCdj69274]
- Under rare circumstances, the AS5200 may issue the message "%SYS-3-BADMAGIC: Corrupt block at 20000000 (magic xxxxxxxx), and crash with a software forced crash. There is no workaround at this time. [CSCdj22429]
- Under rare conditions, the Route Switch Processor in a Cisco 7500 series router may attempt to access a de-referenced system pointer. This may cause an unexpected system reload. [CSCdj31419]
- The CAM entry for the HSRP MAC address does not get updated on a Cisco Catalyst 5000 router (C5000) when the router is connected to another C5000 via ATM/LANE, and the active HSRP router moves from the local C5000 to the remote C5000. The problem occurs only when the routers are connected to the C5000's by non-ATM media. When the active HSRP router moves, the stale CAM entry causes packets being sent to the HSRP address to be lost.
- The only workaround is to issue the command clear cam dynamic on the Cisco Catalyst 5000 router after the HSRP address moves. [CSCdj58719]
- Router drops fragments of non-encrypted traffic passing through it if the encrypting extended access-lists have specific source/destination port numbers.
- Encrypted traffic is not affected. [CSCdj77678]
- Incoming calls from an Adtran TA with Multilink enabled may cause output packets to be wedged on the cisco MBRI interface during PPP negotiation. The debug command will indicate no incoming PPP CONFREQ's from the Adtran side. The show interface will indicate something similar to:
Output queue 22/40, 0 drops; input queue 0/75, 0 drops
- where 22 represents the number of wedged packets. The only workaround is to reload the router. This is only applicable to MBRI interfaces. [CSCdj85220]
- If the command ipx sap-passive is issued on an interface, the router does not answer general SAP queries for all servers on that interface. [CSCdj83449]
- Very rarely, a router will reload with an arithmetic exception. This problem is observed in a context where a high usage of TCP encapsulation is configured, like DLSw or BGP. [CSCdj60905]
- Intermittently, an ATM interface transmitter will hang, causing the interface to automatically reset after a timeout of 3 seconds. [CSCdj69024]
- Under some circumstances, clearing an interface associated with a VPDN or PPP multichassis multilink connection may cause the router to crash.
- This problem was introduced in releases 11.2(10.4) and 11.3(1.1). [CSCdj73210]
- Configuring a Cisco 1003 router running Cisco IOS Release 11.2(11) for a switch type AT&T 5ESS with SPIDs may crash the router. [CSCdj73634]
- When using ARA version 3.0, a Cisco router allocates an AppleTalk node address of 0 and PPP negotiation fails. [CSCdj77846]
- When using NBF, you should be able to filter broadcasts (LLC1 frames) on the dial-up line (ISDN or asynchronous) in order to avoid flooding the latter with useless information (data destined for stations on the LAN media and not the dialup station itself). [CSCdj78979]
- VIP2 crashes on a Cisco 7513 with RSP2. The port adapters on the VIP, for example, PA-HSSI, PA-FDDI, or VIP2 POSIP do not recover. The interface on the port adapters go into administrative down state. Issue the no shut command to recover. [CSCdj79565]
- A Cisco 3600 running Cisco IOS Release 11.2(11) (and connected to an ISDN BRI interface with PPP and NetBIOS configured) does not remove the NBF dialer map entry when WIN95 disconnects the ISDN line. Because of this, a PC connected to the ISDN line cannot use different CHAP usernames for users sharing the PC. [CSCdj79634] [CSCdj81194]
- Under some circumstances, a remote user dialing into a Cisco AS5200 via NetBEUI can cause the Cisco AS5200 to reload. A workaround is to disable NetBEUI on the client, or remove the netbios nbf commands from the router. [CSCdj80506]
- Some incoming PPP connections fail. A reliable workaround is to turn on debug ppp negotiation. [CSCdj81106]
- Some PPP implementations erroneously send PPP packets that exceed the negotiated Maximum Receive Unit. If these packets are also larger than 1500 bytes (which all RFC 1661 compliant implementations are capable of receiving), Cisco IOS software with the CSCdi92482 patch applied will silently discard them. This is the correct behavior according to the RFC.
- It may be possible to work around the problem by using the mtu command to select a smaller MTU/MRU value for the interface, but this will only work if the remote peer agrees to negotiate the smaller value. Another workaround is to downgrade to a release of software that does not contain the CSCdi92482 patch.
- To verify the problem, issue the debug ppp error command and search for a debug message of the following form:
Se6/0/0:23 PPP: Packet too large, size = 1509, maxsize = 4, protocol = 0x003D
- [CSCdj82427]
- Under certain conditions, when using CHAP authentication, the router may reload unexpectedly. [CSCdj83495]
- Following a CyBus error on an RSP, the following messages may be present:
%SYS-3-INVMEMINT: Invalid memory action (malloc) at interrupt level
-Traceback= 6014B948 6014BEDC 6020BEB0 6020BFB0 60207048 60217C0C 6021A53C 6020BC20 601C0454 601C054C 601C0CBC 601BF650
%SYS-2-MALLOCFAIL: Memory allocation of 352 bytes failed from 0x6014BED4, pool Processor, alignment 0
-Process= "<interrupt level>", ipl= 6
-Traceback= 6014A2D8 6014BB64 6014BEDC 6020BEB0 6020BFB0 60207048 60217C0C 6021A53C 6020BC20 601C0454 601C054C 601C0CBC 601BF650
- These messages may repeat, and the RSP may also hang as a result. An image with CSCdj85257 integrated in will resolve these secondary problems and the RSP will recover normally. CSCdj85257 will not resolve the original CyBus error, however. [CSCdj85257]
- If L2F does not use tunnel authentication, packets will be sourced with an incorrect L2F header length. [CSCdj85534]
- A router will not properly handle the combination of packet-by-packet compression on a Frame Relay PVC where traffic shaping is active. [CSCdj85988]
- It is possible that L2F on the home gateway may enqueue a packet to PPP from an incorrect input interface such as an ethernet instead of the virtual interface. This only can occur when the virtual interface input queue is congested. [CSCdj87752]
This section describes possibly unexpected behavior by Releases 11.2(11) and 11.2(11)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(11) and 11.2(11)P. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(11) and 11.2(11)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Releases 11.2(12) and 11.2(12)P.
- A Catalyst 5000 RSM with only 16 MB of RAM may experience a system reload at initialization if running the -jsv image. The workaround is to add more memory. [CSCdj63501]
- Under heavy interrupt load, driver instrumentation gets hit repeatedly while processes are accessing the instrumentation variables (for example, last output time). These hits cause a number of problems, including stuck output and incorrect user displays. There is no workaround. [CSCdj15583]
- A recovery mechanism for misaligned 64-bit accesses has been added. This new functionality is similar to the current misaligned handler for shorter misaligned accesses. [CSCdj20738]
- On a Cisco RSP7000 or 7500 series router, optimum switching appears to negatively interfere with Frame Relay switching. An IP route cache is created and connectivity between sites is lost. The behavior appears to be sporadic. [CSCdj26122]
- A new configuration command now exists for RSP routers to control caching policies for memory regions. A user can now configure MEMD to be accessed uncached by issuing the memory cache-policy io uncached configuration command.
- This method is better than having to enter the test rsp cache memd uncached EXEC command every time the router is booted.
- This configuration command can be used as a workaround for problems like CSCdj52309 and CSCdj70296.
- To restore the MEMD caching policy to the original write-through policy, issue the memory cache-policy io write-through command. To determine what memory cache policies are currently configured on your router, use the show rsp command. [CSCdj33812]
- The tacacs-server directed-request restricted command now applies to authentication, authorization, and accounting. When this command is configured and the user tries to log in with a username, like <username>@<servername> (for example, johndoe@cisco), the only server tried is the server listed after the @ symbol. [CSCdj37496]
- After a user sends a break command to the console, the continue command does not work; it does not restart the running Cisco IOS software. Instead the system will crash again and drop to the ROMMON prompt. The break command also does not work properly. It may hang, and the ROMMON command stack will report the wrong backtrace.
- This bug affects all platforms with MIPS R4700 and R4600 chips, including all RSP-based platforms. [CSCdj58608]
- When polling the ciscoFlash Partition Table on a router running 11.2(9)P and 11.2(10)P the router's CPU utilization will go to 99 percent. Both CiscoView and the Cisco Resource Manager's Software Image Manager poll the ciscoFlashPartionTable, causing this behavior. [CSCdj60284]
- The patch added in CSCdi37706 and incorporated into Cisco IOS Releases 11.2(8.1), 11.2(8.1)P, 11.3(0.2), and 11.2(8.1)BC was intended to correct a cosmetic problem with command authorization.
- Instead, it exposed a bug in older implementations of the developers kit TACACS+ daemon (freeware) and will cause certain command authorizations to fail.
- All freeware daemon versions prior to version 3.0.13 are subject to this problem including the ACE Safeword Security Server daemon. CiscoSecure daemons are not affected. [CSCdj66657]
- When running Cisco IOS Release 11.2(11) with Kerberos authentication, the main memory will decrease. The Access Server will run slow, but it will not crash. The access server will need to be reloaded to reset the memory. There is no work around yet. An alternate IOS image is not an option for this access server. [CSCdj76071]
- A router may restart unexpectedly with SegV exception, PC 0x0, when the router is configured for DLSw. [CSCdj16559]
- A router configured for DLSw has a buffer leak in the middle and big buffers. Eventually, the router runs out of I/O memory.
- The problem is related to the way DLSw backup peers are configured. This problem will only occur if the local router is configured with backup peer commands and the remote router also has a configured peer and is not promiscuous.
- The workaround is to remove the DLSw backup peer configuration. [CSCdj21664]
- When establishing a DLSw session, the circuit priority field in the SSP header of the CUR_cs, ICR_cs, and/or REACH_ACK SSP frames may be set to a reserved value (5, 6, or 7). While this value will not cause problems when sent to a Cisco router peer, it may cause interoperability problems when peering to another vendor's equipment. This problem may manifest itself as an inability to start the circuit. [CSCdj22482]
- When the target DLCI, on an interface with one or more DLCIs, goes down, FRAS fails to go into backup mode. The backup will not be invoked until the interface changes to the down state. [CSCdj22613]
- A crash could occur for STUN DIRECT over Frame Relay if data continues to be received after a STUN peer was deconfigured, or the encapsulation is changed from STUN. [CSCdj48350]
- When using APPN ISR over an RSRB port over FDDI, a Cisco 7200 series router may start sending frames with the non-bitswapped address of the target device.
- To work around this problem, configure a MAC address on the target device that is always the same whether it is canonical or non-canonical (for example, 4242.6666.ffff). [CSCdj48606]
- In a rare timing situation, an APPN/DLUR router may reload due to a bus error/segV exception at ndr_sndtp_encap_mu. [CSCdj59639]
- If an RSRB session is disconnected by the local LAN side at exactly the same time as a data message is received from a remote host, a situation can occur that will lead to a crash in llc_get_oqueue_status().
- There is no workaround. [CSCdj62026]
- When source-route translational bridging is used, LLC sessions initiated from the transparent domain results in the source route's largest frame being incorrectly set to 4472 bytes instead of 1500 bytes. The result is that SNA and NetBIOS sessions may fail if the source-route station sends a frame with a payload that exceeds the maximum allowable size of 1500 bytes for Ethernet media.
- The problem typically occurs when NetBIOS is utilized to allow workstations to communicate between Ethernet and Token Ring. It also occurs when SNA is used.
- The workaround is to disable fast-switching by using the no source-bridge transparent fastswitch command or configuring the end stations to use frames with a payload of less than or equal to 1500 bytes. [CSCdj62385]
- The APPN router may have an excessive amount of processor memory allocated to APPN after experiencing several spikes in APPN processing. The APPN memory manager was optimized to release groups of unused pools back to the operating system. [CSCdj62502]
- Any DLUR installation with over 800 to 1000 downstream PUs may experience a reload with the following backtrace:
[abort(0x601f2c3c)+0x8]
[crashdump(0x601f0b20)+0x94]
[process_handle_watchdog(0x601c2f08)+0xb4]
[signal_receive(0x601b7d58)+0xa8]
[process_forced_here(0x60169424)+0x68]
[locate_node_index(0x607dbcc0)+0x64]
[etext(0x60849e00)+0xcbee04]
- [CSCdj67966]
- DSPU over RSRB with FST encapsulation reloads with a bus error similar to the following, when an upstream or downstream connection is initializing:
System was restarted by bus error at PC 0xCC6B8, address 0xFC4AFC82 4000 Software (C4000-JS-M), Version 11.2(10.3), MAINTENANCE INTERIM SOFTWARE Compiled Mon 01-Dec-97 19:45 by ckralik (current version) Image text-base: 0x00012000, data-base: 0x0076AE64
- The workaround is to use TCP encapsulation for RSRB or to switch to DLSw. [CSCdj68261]
- Some hosts exist that use the unusual behavior of setting the Origin Address Field (OAF) equal to the Destination Address Field (DAF) in traffic on the LU-LU session, instead of setting it to the more usual value of 1. This actually makes it impossible to distinguish whether the LU is dependent or independent, and DSPU has followed the standard SNA convention of assuming that all sessions with OAF greater than 1 were for independent LUs.
- As DSPU only supports dependent LUs, it now assumes that the OAF equal to DAF condition does signify a dependent LU and maps the session accordingly.
- The only workaround is the very restrictive configuration of only using the host LU locaddr 1. [CSCdj69265]
- CIP CSNA does not work with DLSw+. On a router configured with DLSw+ and CIP internal SRB LANs, when the router is loaded, the CIP internal LANs do not get registered to DLSw+ correctly. DLSw+ will not forward frames to the CIP internal LANs. [CSCdj70659]
- An APPN router may reload in rare situations with the following backtrace:
RA: 0x607E1724[find_matching_row(0x607e16ec)+0x38]
RA: 0x607E1B9C[Tfind_next(0x607e1b70)+0x2c]
RA: 0x6071182C[DBfind_next_directory_entry(0x60711814)+0x18]
RA: 0x6070BAD8[CPdelete_men(0x6070ba90)+0x48]
RA: 0x6070BA78[CPupdate_cp_status(0x6070b9c0)+0xb8]
RA: 0x6070B40C[CPmain(0x6070b300)+0x10c]
RA: 0x6070AC2C[newdss00(0x6070ab60)+0xcc]
RA: 0x60183F80[r4k_process_dispatch(0x60183f6c)+0x14]
- [CSCdj70817]
- APPN leaks memory when directory services processing unknown locate replies. [CSCdj70886]
- While configuring FRAS BAN, if there are multiple SDLC interfaces, then each BAN-SDLC interface must have a different BAN-DLCI-MAC address configured. The Cisco IOS software does not support the same BAN-DLCI-MAC address on more than one SDLC interface. This BAN-DLCI-MAC address is configured in the sdlc partner statement and on the fras ban frame-relay Serial0 4000.1111.1111 dlci 35 command. [CSCdj71301]
- In unusual circumstances a memory leak of buffers can occur in DSPU link station handling. This may lead to messages indicating a failure due to lack of memory, such as "%DSPU-3-LSConnInFailedNoMem." This buffer leak can occur only in a short window of time during DSPU link station activation processing and only when the link station fails to activate.
- This buffer leak will never occur for successful link station connections. It will only occur for some unusual types of connection failure that may occur before an XID response has been sent by DSPU back to the connecting link station. Lost memory can only be recovered by reloading the router. [CSCdj75816]
- In an ISL environment with DLSW, where DLSW bridge-group is on one of the ISL VLAN subinterfaces, retransmitted frames from DLSW contain 4 bytes of extra data causing session loss.
- This problem is more severe when the switch port on the trunk between the router and switch is set to auto (negotiation). This causes the switch to default to 100/half while the router is at 100/full, causing collisions, late collisions, and overruns. These collisions and overruns cause retransmissions that trigger the problem.
- Besides trying to avoid the retransmissions, there is no workaround in ISL/DLSW setup. [CSCdj76634]
- The APPN router may crash with the following backtrace while processing a destroy_tg:
RA: 0x606924A4[xxxcss00(0x60691a80)+0xa24]
RA: 0x6016A6D8[r4k_process_dispatch(0x6016a6c4)+0x14]
RA: 0x6016A6C4[r4k_process_dispatch(0x6016a6c4)+0x0]
- [CSCdj77677]
- A TRIP interface configured for transparent bridging but not configured for source route bridging may silently drop some incoming frames. Specifically, if the interface receives a frame with length less than 120 bytes and the RII bit is set (indicating a source route bridging frame) it may drop the next frame received. This can cause the interface's keepalive processing to fail and can lead to sporadic resets on the interface. [CSCdi88756]
- Under certain conditions, customers may experience a memory leak that would lead to a router reset if the Bridge-group Virtual Interfaces (BVIs) for the new Integrated Routing and Bridging (IRB) feature are not configured correctly.
- To work around this caveat, do not configure BVIs to logical/physical router interfaces that do not exist. [CSCdj02283]
- A Cisco 2520 low-speed port may sometimes ignore group polls. This problem occurs on average once per minute and appears to occur only when the router is configured for half duplex and is using a DTE cable. [CSCdj33392]
- A situation has been found when bridging between LANE and FDDI that a Cisco router is not handling the packets appropriately. [CSCdj51644]
- In rare cases a Cisco 7200 router with a Token Ring port adapter may crash if one of its Token Ring ports attempts to insert itself into the ring and fails due to a ring error. [CSCdj59796]
- When IRB is enabled, the BVI interface may not overwrite the real incoming interface in the arp response, so we install an incomplete arp entry and list "wrong cable" in the debug arp output. [CSCdj68785]
- For a Fast Ethernet interface on Cisco 75xx, 720x, 4x00, or 36xx routers, the regular Fast Ethernet PA media-type config command is missing the RJ45 option; only the MII option is available.
- A workaround is available on most platforms and Cisco IOS images. To configure for RJ45, issue the no media-type mii command. This workaround is not available for the 4x00 platforms. [CSCdj75983]
- In some instances, a configured BGP router ID is not used after the router reloads. Instead, the router uses the highest IP interface address as its router ID, until the clear ip bgp command is executed.
- A workaround is to configure a loopback on the interface whose address is greater than any other address on the router. [CSCdj37962]
- Enhance IGRP may crash when receiving updates in a network that has a major topology change in conjunction with a large Enhanced IGRP topology database. [CSCdj54728]
- Under certain conditions, an LS type 5 is not generated by the ABR in response to a received LS type 7. [CSCdj55301]
- With certain route-map configurations or a soft reconfiguration, the LOCAL_PREF for a path may be set to zero, resulting in the wrong path being selected. [CSCdj55839]
- In a router running Cisco IOS Release 11.2(7a) and later, using OSPF, issue the commands area range A and area range B where B is included in A. Upon reload, the router no longer advertises range B. [CSCdj60048]
- Under rare circumstances a BGP router sends BGP updates with a duplicate community attribute, that triggers the neighbor reset. [CSCdj64103]
- Dynamic redistribution into Enhanced IGRP from another routing protocol fails if the routes being redistributed fall within the same major network as Enhanced IGRP. A temporary workaround is to remove the redistribution statement from the Enhanced IGRP configuration, then re-insert the redistribution statement. [CSCdj65737]
- When an interface is configured to send RIP V1 packets while running RIP V2, the router sends out corrupt packets. V2 packets are not affected. There is no known workaround. [CSCdj69026]
- The router may crash when the clear ip route * command is issued, if RIP is enabled with output delay configured. [CSCdj70535]
- When inbound soft reconfiguration is configured, this caveat may cause BGP attributes to be set incorrectly for received prefixes. [CSCdj73336]
- If there are duplicate externals in an OSPF domain, under certain conditions, there could be a continuous route flap for this network. [CSCdj75857]
- Before a floating static route is installed, a waiting period is observed when the network is down and unreachable. If IPX watchdogs or SPX keepalives arrive during this time, they will be dropped. This may lead to session timeouts. [CSCdj50629]
- A problem occurs when using a floating static route across an ISDN link and IPX Enhanced IGRP is the primary dynamic routing protocol. When the link goes down, the Enhanced IGRP route is installed but after the floating static is configured and the line goes down and then back up there is no route to that network. The Enhanced IGRP route is received but never fully installed because of what seems to be incomplete removal of the floating static route. [CSCdj52947]
- An access server may encounter high CPU utilization when IPX has been enabled on the asynchronous and ISDN interfaces if the IPX network is very large, has a large number of servers, and is unstable. The process that uses the most CPU will be the "IPX SAP OUT" process as shown in the output of the show process cpu command. This high CPU utilization is caused by SAP changes or flashes being sent to a number of lines where SAP updates are unwanted.
- Normal updates were disabled or sent very infrequently but flashes/changes updates are still sent normally. There was no way to disable these flashes without impacting the end clients. Therefore, a new option was added to an existing command.
- In Release 11.2, the command ipx sap-interval value is now ipx sap-interval {value | passive}.
- In Release 11.3, a passive option was added to the existing ipx update command, making it ipx update interval {rip | sap} {value | changes-only | passive}. Release 11.3 will also accept ipx sap-interval {value | passive} but will write out to non-volatile memory in the new form.
- When the passive option is set, both the normal updates are stopped and the flashes/changes updates are stopped. Queries will still be replied to on this interface. The update interval is set to the same interval used in change-only. For SAP the interval is 0 and for RIP the interval is a large value. Any SAP or RIP heard on these interfaces will use that value for aging, effectively taking a very long time to age out. [CSCdj59918]
- Deleting a non-existing IPX accounting-list item can cause a router to reload. Do not attempt to delete an IPX accounting-list item unless it is specifically in the list. [CSCdj79085]
- Under rare circumstances, a router reload may occur while running TCP to X.25 protocol translation. [CSCdj23230]
- TCP sessions terminated on a router may experience increased delays in unstable environments with large RTT, lost packets, and interoperating with TCP stacks with no fast retransmit and no congestion avoidance.
- The normal issues when running TCP in the above environment can be exacerbated by an issue where the router may not buffer out of order datagrams up to the advertised window size.
- This is no known workaround, but this appears to only be a problem in rare situations with sessions to TCP stacks of suboptimal design. [CSCdj68834]
- When running DLSW over TCP on a router under heavy load with the DLSW TCP sessions resetting frequently due to flapping links or configuration changes, the router may reload. [CSCdj72482]
- When a router is enabled for VINES routing and if any VINES command has been issued on any active interface, that interface is considered an active VINES interface and will cause periodic VINES updates to be sent out on that interface. This problem exists even after the VINES commands have been removed (using the no prefix). These invalid updates could cause neighboring VINES routers' routing tables to be invalid.
- As a workaround, if VINES is enabled in the router, issue the no vines metric command on all active interfaces that are connected to a VINES network, or interfaces where an interface VINES command (for example, vines update interval 60) was issued. [CSCdj73582]
- ARP replies are not sent over a PPP multilink interface. As a workaround, you can configure a static ARP on the remote device or disable PPP multilink. [CSCdi88185]
- When using DLCI prioritization on a point-to-point Frame Relay subinterface and one of the DLCIs fail, the subinterface may bounce once or continually bounce during LMI full status reports, depending on whether LMI reports the DLCI as being DELETED or INACTIVE. This behavior is the same for every DLCI defined in the priority-dlci-group.
- During normal behavior, the point-to-point subinterface should go down when the primary DLCI fails. If a secondary DLCI fails, the subinterface stays up, but traffic destined for that DLCI only will fail. [CSCdj11056]
- SSCOP sequence number is a 3-byte field. Because the SSCOP code in Cisco IOS Releases 11.0, 11.1, and 11.2 code does not handle the wraparound elegantly, in some conditions when the sequence number wraparound after exceeding the maximum of 16777215, a large number of buffers are queued and eventually cause the memory leak/starvation on the router. [CSCdj45157]
- You may experience issues with the PRI hanging or busy when all channels are not in use. This is usually accompanied by the following console messages:
ISDN Se9/0/1:23: Error: CCB run away: 0x61D97560:
ISDN Se9/0/1:23: Error: CCB run away: 0x61C494F8:
ISDN Se9/0/1:23: Error: CCB run away: 0x61C494F8:
- The only workaround is to reset the controller manually. Issue the interface commands shutdown followed by no shutdown, or reload the router. [CSCdj48055]
- When the commands ip tcp header-compression and ppp multilink are configured together on the same interface, they can cause the router to crash.
- The workaround is to remove the ip tcp header-compression or ppp multilink command. [CSCdj53093]
- RSP crashes at rsp_fs_free_memd_pack may be caused by an earlier release of AIP microcode in the router that is crashing or in routers that are feeding this router in the same network. [CSCdj59745]
- When configuring map-class frame-relay BC committed-burst-size, the system may encounter a CPU exception with reason "EXEC_ADERR(1200)" and restart.
- There is no workaround; this is an intermittent problem. [CSCdj62139]
- When using Frame Relay SVCs, Cisco IOS software appears not to include the magnitude parameters for Be and Bc on the SVC CONNECT message. It only includes them in the SETUP message. The SVC circuits are on S4/0 for both routers. Without the magnitude parameters, the biggest value Bc and Be can be is approximately 130 Kb. There is no known workaround. [CSCdj63173]
- Some Windows 95 Dial sessions that use script files fail to connect to an asynchronous interface on Cisco access servers. [CSCdj63311]
- A Frame Relay interface configured for ANSI LMI will acknowledge a Cisco LMI update when the router should ignore it. [CSCdj64207]
- The map-class commands frame-relay bc out and frame-relay be out are accepted by the Enterprise image. These parameters are relevant for SVC setup. However, the traffic shaping code does not use them. As a result, the values appear to be unset. This behavior can be avoided by using the commands frame-relay bc number and frame-relay be number. [CSCdj65624]
- The router may reload when using X.25 switching with the x25 route commands specifying substitute-source or substitute-dest keywords (for example, x25 route ^169 substitute-source 104144953 interface serial0). This problem was introduced in 11.2(10.1). [CSCdj67115]
- Frame Relay packets received by a router may not be correctly delivered to higher layers. In some cases these packets may get dropped and in other cases the packet processing may be incorrect. All protocols configured over Frame Relay may encounter problems because of this. There is no known workaround for this problem. [CSCdj67384]
- Configuring a PVC using the frame-relay interface-dlci command on multipoint subinterfaces causes a system reload if the PVC had previously been learned through Inverse ARP. [CSCdj67510]
- The error "%LINK-3-TOOBIG: Interface Lex1, Output packet size of= 1520 bytes too big" occurred on a Cisco 4500 router after upgrading to Cisco IOS Release 11.2(9). [CSCdj69018]
- Any IPX dialup connection using ISDN or any form of PPP multilink will not see a server list if they are using the 32-bit Netware Client or any device requiring an IPX RIP response.
- This is a regression introduced by CSCdi72429.
- As a workaround, use a client that does not require IPX RIP such as the Microsoft Netware Client. [CSCdj70744]
- When all existing AIPs are extracted and hot swapped, SVCs can no longer be established.
- In the case of multiple AIPs, change them one at a time. In the case of only one AIP, insert the new AIP before extracting the existing AIP. [CSCdj71438]
- Sometimes, after issuing a reload command, an asynchronous interface running PPP framing will not come UP/UP automatically. A workaround is to change the line speed or to clear the line or to issue the configuration commands shutdown and the configuration command no shutdown in succession. [CSCdj72909]
- When LANE subinterfaces are part of bridge group, the bridged traffic does not use the data direct VC. [CSCdj72939]
- If the serial interface bounces while running Frame Relay on a Cisco 2500 or 1600 series router with an internal CSU/DSU, the router will stop sending link management. To recover, issue the shutdown command followed by the no shutdown command to bring the port down and back up again. [CSCdj74822]
- NETBIOS_NAME_RECOGNIZED is not forwarded out through the ISDN line. [CSCdj75170]
- When some Cisco routers are reloaded, t the ISDN layer2 will not come up. This has been observed on the 2500 and the 1600 routers mostly. Under these circumstances, it will not be possible to make any ISDN calls. No workaround is possible. [CSCdj76151]
- In Cisco IOS Release 11.2(10a), when frame relay running over ISDN the error message "%FR-3-INCORRECT_INT: Incorrect output (sub)interface, broadcast packet dropped!" is constantly repeated. [CSCdj76590]
This section describes possibly unexpected behavior by Releases 11.2(10) and 11.2(10)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(10) and 11.2(10)P. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(10) and 11.2(10)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Releases 11.2(11) and 11.2(11)P.
- When Frame Relay over ISDN is configured on a LES-typed driver based platform (such as a Cisco 7500, 5200, or 7200 series router), and the input packets are fast-switched (for example, the output interface has fast switch mode enabled), the BRI/PRI interface has an input queue wedge problem. The symptom was that the input queue count was incremented up to the maximum queue length and then began to drop input packets. [CSCdj45631]
- When using ARAP 2.1 on routers running Cisco IOS Release 11.2, the client connects, the authentication negotiates, and then the connection drops with a message indicating that the server called is not a valid remote access server. As a workaround, use Cisco IOS Release 11.1, which works with both ARAP 2.0.1 and 2.1. [CSCdi91670]
- IPTALK is completely broken in Release 11.2 because the llap header is missing in all IPTALK packets. There is no workaround. [CSCdj50179]
- An IPTALK interface will not come up after a reboot if the order of tunnel interface precedes its physical interface (for example, Ethernet or serial). The symptom is that the iptalk command from tunnel interface disappears after reboot. There is no workaround. [CSCdj58363]
- Sometimes a memory leak that consumes I/O memory can be triggered in the pool manager. [CSCdi90521]
- Under extremely heavy CPU interrupt states, a router with FSIP, CT3 or any serial interface may experience the following "output stuck" error message:
%RSP-3-RESTART: interface Serial12/0/0:28, output stuck
- The problem occurs on Cisco routers in the 7000 family using the CT3 or 4/8 port FSIP cards or any serial interface under Cisco IOS Release 11.1(10)CA, 11.1(11), and 11.2. It has been observed only under oversubscribed traffic load.
- As a workaround, configure the interface for FIFO queueing via the no fair-queue command.
- The command transmit-buffers backing-store is on by default when an interface is configured for weighted fair-queueing. If the no fair-queue interface command is used, which changes the queueing strategy to FIFO, then transmit-buffers backing-store is off by default.
- This caveat has been resolved in the following Cisco IOS releases: 11.2(6.2)P 11.1(11.4) 11.1(11)CA 11.1(11.4)IA [CSCdj12815]
- If a map-list is configured, the show running command may cause the router to crash if the "Last configuration change at..." informational string exceeds a total length of 80 characters. [CSCdj13986]
- An EXEC prompt does not appear until the TCP connection for accounting EXEC is sent and acknowledged. Accounting EXEC acts like wait-start, even though start-stop is configured. [CSCdj27123]
- Performing a Telnet from the router with TACACS configured might cause a router to reload with a bus error. The exact cause is still under investigation.
- This problem has been seen only with Cisco IOS Release 11.2 or later. [CSCdj36356]
- A Cisco 7200 or 3600 series router may crash with a bus error when doing protocol translation between X.25 and PPP. The workaround for the problem is to turn on header-compression passive in the translate statement. [CSCdj37556]
- When traffic shaping on the Cisco 7500 series routers, enough traffic may not be switched to achieve the specified traffic level. [CSCdj50861]
- The Cisco 7500 series routers may not correctly allocate the right number of packet memory (memd) buffers to some network interfaces. The problem requires a large number of interfaces whose collective bandwidth is high, but their MTU is smaller than another buffer pool.
- For example, a problem was found with a Cisco 7500 using a large number of Fast Ethernet and/or Ethernet interfaces and one or more FDDI interfaces. The pool of packet memory should have allocated 80 percent of the memory to the Ethernet and Fast Ethernet interfaces, which use an MTU of 1536. Instead it received 20 percent of the memory, and the lone FDDI interface with MTU 4512 got 80 percent of the packet memory.
- The problem occurred with 55 Ethernet, 6 Fast Ethernet, and 1 FDDI network interfaces. The problem did not occur with fewer interfaces, specifically 36 Ethernet, 5 Fast Ethernet, and 1 FDDI interfaces.
- The problem may show up as a high number of input drops on some router interfaces. [CSCdj55428]
- At times, a Cisco 1000 series router sends SNTP queries to the next hop on the route instead of to the address configured in the SNTP server statement in the configuration. [CSCdj56216]
- The input queue may be wedged with IP packets if the exception dump command is configured.
- The following are known workarounds:
- - Increase the input queue to 175. ([75]Original Queue amount+[100] per exception dump x.x.x.x command)
- - Remove the exception dump x.x.x.x command.
- [CSCdj58035]
- When Frame Relay traffic shaping is enabled on a serial interface, disabling and reenabling weighted fair queueing will cause a system restart. [CSCdj58431]
- When a router is highly loaded and traffic-shaping is active on the outgoing interface, it might be possible that LMI control messages get queued in traffic-shaping queues, causing LMI protocol to go down. [CSCdj64221]
- When frame-relay traffic-shaping is enabled and the clear counters command is issued, the system may restart.
- The workaround is to remove and then reenable frame-relay traffic-shaping to clear its counters. [CSCdj65742]
- The APPN router may crash during an SNMP access to the APPN MIB. This problem occurs only after an unused APPN node is garbage-collected. The crash has the following backtrace:
System was restarted by bus error at PC 0x8B5902, address 0x4AFC4AFC PC: process_snmp_trs_tg_inc
0x8B5CAC:_process_ms_data_req_trs(0x8b5aaa)+0x202 0x87E5FE:_xxxtos00(0x87d6b0)+0xf4e 0x180E5C:_process_hari_kari(0x180e5c)+0x0
- [CSCdj36824]
- On RSP-based routers, the pseudo-MAC address assigned to a bridge port on a source-route bridge virtual ring group is incorrectly formatted to Ethernet format during Cisco IOS startup. This MAC address is used to establish a bridge link from IBM LAN Network Manager and can be shown by using the show lnm config EXEC command. [CSCdj38360]
- A downstream LU is unable to get the logo screen from the host even though other LUs on the downstream PU can. The router shows the DSPU state of that LU to be Reset or dsLUStart, while the host shows the state as Active. The LU is recovered by deactivating, then reactivating the LU at the host.
- This state may occur if the downstream LU has previously failed to reply to ACTLU, or if the host has failed to respond to a NOTIFY (available or not available) from DSPU within a timeout period of 20 seconds.
- Recovery requires the host operator to recycle the LU at the host. [CSCdj45783]
- When RSRB with TCP encapsulation is configured with priority peers and some of the priority peers are closed or dead, an explorer packet may continuously try to open the closed or dead priority peer. After several tries, the router may crash with memory corruption. [CSCdj47493]
- Executing a show source command may cause the router to restart unexpectedly if a virtual ring group or remote peer is deconfigured when the source-bridge command output is waiting at the -- more -- prompt.
- The workaround is to not reconfigure virtual rings or remote peers while executing a show source command. [CSCdj49973]
- Normal nonextended unbind (0x3201) was extended with corrupted information, which caused rejection by the host. As far as the host is concerned, the session is still active. A user cannot clean up this session without bringing down the link. [CSCdj50581]
- RIF may be modified incorrectly when multiring and SRB proxy explorer are configured on an interface but the SRB triplet is not configured, as shown in the following example:
interface TokenRing0/0
ip address <ip-address>
multiring ip
source-bridge proxy-explorer
- Note the absence of the source-bridge locRn bn remRn command.
- The source-bridge proxy-explorer statement does not show up in the configuration unless the SRB triplet is configured.
- A workaround for this problem is to configure the no source-bridge proxy-explorer command. [CSCdj51631]
- When running proxy explorer and NetBIOS name caching on a Token Ring interface of a Cisco 7200, alignment errors occur. [CSCdj52522]
- A router may reload when removing configuration of X.25 PVCs for QLLC. [CSCdj57872]
- When an actpu is followed by a dactpu from VTAM and there is no response from the downstream device to either flow, after a disconnect is received from the downstream device, DLUR will send a -rsp(actpu) upstream instead of the proper flow, a +rsp(dactpu). This can cause the PU from the DLUS perspective to hang in the PDACP state. [CSCdj61872]
- It is rare, but possible, for DLUS to send a -rsp(REQDACTPU). When this happens, it indicates that VTAM has already cleaned up the PU in question. When receiving this response, DLUR must clean up the PU in order to keep the PU from being stuck in the "stopping" state. [CSCdj61879]
- When using APPN/DLUR with a large number of LUs (over 1000), a memory spike can occur during the processing of a downstream PU outage. In extreme cases, this memory spike can be large enough to exhaust memory in the APPN/DLUR router, which can cause a reload. [CSCdj61908]
- Session attempts fail with DLUR generating a sense 08060000 in a rare case where the LU name list gets corrupted. This problem is easily identified by the VTAM LU showing active state, while the show appn dlur-lu name display does not show the LU. [CSCdj62172]
- When ip route-cache cbus is configured on an interface, intermittent router crashes could occur because of an incoherent cache entry data structure.
- If this incoherence occurs and does not cause a router crash, it may instead cause cbus switching to be automatically disabled, and the interface resorts to fast switching (or SSE switching if SSE switching were also configured). [CSCdi43526]
- When adding to or removing a subinterface from a Frame Relay interface, all DLCIs are brought down until the Frame Relay switch sends the PVC information again. The whole interface resets when a user tries to add the ip address command. A workaround for part of the problem is to turn off CDP globally or on individual interfaces. In this case, turn off CDP on the serial interface before adding or removing subinterfaces. CSCdj02488 (integrated into Cisco IOS Release 11.1(11) and 11.2(5.1)) fixed the rest of the problem.[CSCdj07291]
- Under certain conditions, packets may stay on the input queue. The condition that caused packets to stay on the input queue has been removed. [CSCdj30087]
- When transparent bridging to a Token Ring interface, the interface can read in a frame it has forwarded onto the Token Ring interface. This will cause the bridge table to be incorrect. This problem affects only the mid-range and low-end platforms. [CSCdj41666]
- A Catalyst 5000 RSM populated with an ATM Port Adapter with LANE client(s) configured can get its ATM interface stuck in a down state if a user creates new VLAN interfaces.
- Symptoms include the following message being displayed to the console:
%CBUS-3-CATMREJCMD: ATM0/0 Teardown VC command failed (error code 0x0008)
- Saving the RSM configuration and reloading its image will clear the error condition. [CSCdj41802]
- Compression for HDLC encapsulated bridging only payload compresses Spanning Protocol packets. Actual bridged packets are forwarded with their payloads uncompressed. Prior to this release, bridged packets may have had their MAC addresses corrupted if STAC compression was enabled with HDLC encapsulation. [CSCdj50894]
- In Cisco 7500 series routers, sh dialer is not working. The workaround is to use sh dialer int serial x/y. [CSCdj51612]
- A Cisco Catalyst 5000 cannot change packet format from SNAP to ARPA. [CSCdj53698]
- With IRB configured on the router, IPX clients cannot log into services on a bridged interface. Removing the IPX routing from the BVI fixes the bridged interface but you lose the routing. At this time, this feature is not supported. [CSCdj54050]
- If you are doing IRB with RFC1483 PVCs, you may see certain IP anomalies, such as ARP resolution not working or ARP resolutions taking place but you cannot ping the neighboring device. [CSCdj54558]
- AppleTalk might fail when packets are bridged through PPP transit. [CSCdj61857]
- A router may crash with a "System restarted by bus error at PC 0x60394488, address 0xD0D0D0D" message when running Cisco IOS 11.1(9) RSP with a heavy load of EIGRP and CSNA traffic. [CSCdj29447]
- If OSPF external routes are summarized using the summary-address command, and the number of external routes being covered by this summary address drops to zero, the external summary will be flushed, but the router originating the summary will not install any matching external or nssa routes that may be present in its database.
- The router can be forced to install the matching route by using the clear ip route * command. [CSCdj32471]
- BOOTP requests being sent to 0.0.0.0 get forwarded to the gateway of last resort when there is one. [CSCdj33809]
- If the summary-address statement is removed on a remote router that advertises summary-address routes on only one path, then the core router sees both equal cost paths. This problem occurs on OSPF with NSSA. [CSCdj38067]
- A Cisco 7513 router running EIGRP reloads with the following message:
"System restarted by error - an arithmetic exception, PC 0x60286234"
- The program counter value points to an EIGRP IOS routine. [CSCdj38361]
- Under some circumstances, the router will crash when removing a static IP route. [CSCdj45152]
- Multicast forwarding stops if fast-switching is turned on on an incoming ATM LANE subinterface. A workaround is to disable fast-switching on that interface by issuing the no ip mroute-cache command. [CSCdj45777]
- If the OSPF summary host route is overwritten by a route from another routing process which has lower administrative distance, it is possible that the OSPF summary host route will not be reinstalled after the latter route is removed. In particular, it only happens if the host route address is also the router ID of some ASBR. [CSCdj49161]
- Entering the no ipx routing command then enabling EIGRP can crash the router. This is a regression of CSCdj54141. [CSCdj53541]
- When one of the routers on a broadcast network has been partitioned in which at least one partition has only one router, OSPF will generate a stub advertisement for this network in the isolated router's router LSA. This stub route will overwrite the normal network route calculated using the network LSA, regardless of the path cost.
- This problem exists in all releases starting with Release 10.3. This will be fixed in 11.1 and newer releases. [CSCdj53804]
- The Proteon router's internal address is advertised as a host route instead of a network in the router's LSA. A host route is represented as a Type 3 link (Stub Network) whose link ID is the host's IP address and whose link data is the mask of all ones (0xffffffff). This host route is advertised into all OSPF areas. [CSCdj56079]
- If you are doing IRB with RFC1483 PVCs, you may see certain IP anomalies such as ARP resolution not working or ARP resolutions taking place but you cannot ping the neighboring device. [CSCdj58194]
- Customer moved the IP multicast tunnels (DVMRP, GRE) from a serial interface to an ATM interface on a Cisco 4700 router. The packets are now process-switched instead of fast-switched, which causes a lot of CPU (IP INPUT).
- When the serial interface is used for incoming packets and the ATM interface for outgoing packets, there is no problem. Incoming packets on the ATM interface and outgoing packets on the serial interface also experience this problem.
- We used several Cisco IOS releases, with always the same effect. It seems that incoming packets are not fast switched. [CSCdj59076]
- SYS-3-CPUHOG error messages occurred after the software was upgraded from Release 11.0 to Release 11.2(8) or 11.2(9). The error messages may occur because the OSPF database refreshes every 30 minutes. This problem occurs with large IP OSPF networks with multiple areas. There is no known workaround. [CSCdj60461]
- The ARP lookup routine may suspend, causing unexpected behaviors for IP protocols. For example; if the OSPF routing process is traversing a list of neighbors to send LSA packets and the ARP routine is called, the ARP routine suspension could cause a system reset. The problem was resolved in Release 11.2(10a). [CSCdj60533]
- OSPF ABR does not generate a summary for some connected networks. This problem occurs when an unnumbered interface is used with OSPF. A summary for a connected network that is put in the same area as the unnumbered interface might not be generated to other areas.
- The workaround is to redistribute the connected network into OSPF to retain connectivity to those networks. [CSCdj60959]
- Dynamic redistribution into EIGRP from another routing protocol fails if the routes being redistributed fall within the same major network as EIGRP. A temporary workaround is to remove the redistribution statement from the EIGRP configuration, then reinsert the redistribution statement. This caveat only affects Releases 11.2(10a), 11.2(10a)BC and 11.2(10a)P. [CSCdj65737]
- Under certain circumstances, a Cisco 7505 router running Release 11.1(13a)CA1 reloads if the netID is changed under the IS-IS routing process. [CSCdj49485]
- If an RSRB session is disconnected by the local LAN side at exactly the same time as a data message is received from a remote host, a situation can occur which will lead to a crash in llc_get_oqueue_status().
- There is no workaround. [CSCdj62026]
- Although a router configured for HSRP on LANE replies correctly with the HSRP MAC address in an ARP reply, all packets issued by the router with a virtual IP address use the BIA MAC address as the source address. This makes it difficult for switches to know the forwarding port. [CSCdj28865]
- Using any of the xns flooding commands may cause the router to reload and issue alignment, bad pool, or buffer warnings. [CSCdj23479]
- With LAPB/Frame Relay encapsulation, you might see "%SYS-3-INVMEMINT: Invalid memory action (malloc) at interrupt level" messages on the console. It is possible (rarely) that an XNS connected route for this interface doesn't get installed in the route table.
- As a workaround, try one of the following:
- Issue the shut and no shut commands on the affected interface.
- Reconfigure the IPX network using the no ipx network command, followed by ipx network. [CSCdj53721]
- There are two problems associated with this caveat:
- Sometimes a connected network does not appear in the routing table just after reload. Issuing the shut and no shut commands should correct the behavior.
- If ipx routing is disabled (using the no ipx routing command), you could see something like a steady memory leak, unexpected router behavior, or a router crash. The only known resolution is to power cycle the router every time you issue the no ipx routing command. [CSCdj54141]
- If some interfaces change state when you disable and re-enable IPX/XNS routing, there is a possibility of loosing the IPX/XNS background process.
- Symptoms could be loss of network connectivity or a slow memory leak until the router cannot allocate any more memory. You need to reload the router to correct this situation. [CSCdj57257]
- With a router running NetBIOS Frames Protocol (NBF) over Token Ring, a device connected via async or ISDN with PPP encapsulation appears to connect successfully but is unable to see other NetBIOS devices in a domain. [CSCdi72429]
- VIP requires but does not have a mechanism to determine the health or status of a VIP card. Specifically, there needs to be a way to show tech-support, alignment, and logging information. The show controllers command should be extended to provide this information: show controllers vip x command where x is the VIP slot number and command is either tech-support, alignment, or logging. [CSCdj17006]
- A Cisco router running Release 11.1(6.1) can experience an input queue wedge on the serial interface. The symptoms are dropped packets on the interface. The only way to clear this problem is to reload or power cycle the router. [CSCdj17547]
- A router may stop making Frame Relay SVC calls after a long time. [CSCdj29722]
- When a dialer profile is in standby mode, backing up a serial interface with the backup interface dialer command still allows incoming calls to this profile. Because the profile is in standby mode, this behavior should not be possible. [CSCdj34108]
- Routers configured for Frame Relay switching will lose a frame-relay route command in the running configuration when the corresponding DLCI has been deleted. To restore the original configuration, execute the copy start run or config memory command or reload the router. [CSCdj43340]
- SSCOP sequence number is a 3-byte field. Because the SSCOP code in Cisco IOS Releases 11.0, 11.1, and 11.2 code does not handle the wraparound elegantly, in some conditions when the sequence number wraparound after exceeding the maximum of 16777215, a large number of buffers are queued and eventually cause the memory leak/starvation on the router. [CSCdj45157]
- Direct broadcast with the physical-broadcast destination MAC address is not forwarded to the helper address over ATM/LANE interface. [CSCdj51378]
- A router crashed with a bus error while running the output for show dialer map. [CSCdj52360]
- When a configuration of two systems has Frame Relay LMI timeouts set differently on DTE and DCE systems, the PVCs could remain active but no data is transferred because one system declared the connection inactive while the other system still thought it was active.
- The workaround is to set the timeout values the same using the lmi-t392dce parameter. [CSCdj53354]
- If LES/BUS is configured on the Catalyst 5000, pulling down one client in the ELAN can affect other clients. This problem happens very rarely. The workaround is to restart the LES/BUS on the Catalyst 5000. [CSCdj54587]
- When a static map is deleted, calls associated with that map are not disconnected. For point-to-point calls, this does not cause any problems. However, for point-to-multipoint ATM calls, the leaf on the multipoint VC will be left in place. If the map to that same NSAP is replaced, a new call is attempted instead of reusing the existing leaf on the existing VC. The result is that an add-party message is delivered to the remote router and is subsequently rejected. The end result is no broadcast connectivity. The workaround is to clear the existing calls when changing the map configuration with a clear int atm interface command. [CSCdj57309]
- Cisco IOS Releases 11.2(1) through 11.2(10) are technically not in compliance with RFC 1990. The RFC requires that the first multilink fragment that is transmitted after adding a second link to a bundle which previously only had one link must be transmitted over the first link in the bundle. Instead, the first fragment is being transmitted over the newly added link. This can result in the peer receiving packets out of sequence.
- There is no known workaround. [CSCdj57498]
- A Cisco 4000 Router reloads when frame-relay traffic-shaping is unconfigured. The only workaround is to destroy the configuration on the router, reload it, and restore the configuration. [CSCdj61097]
- Frame Relay is broken. Most of the protocols on Frame Relay may not work and packets may get dropped or misbehave because parsing of packets is not properly done in some cases. [CSCdj67384]
This section describes possibly unexpected behavior by Releases 11.2(9) and 11.2(9)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(9) and 11.2(9)P. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(9) and 11.2(9)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Releases 11.2(10) and 11.2(10)P.
- In extremely unusual situations the router will display the following error message on a frequent basis:
%SYS-6-STACKLOW: Stack for level CXBus Interfaces running low, 0/1000
- This message may eventually lead to the router hanging. [CSCdi54119]
- A timing conflict between the HTTP server and TACACS+ code can cause the HTTP process to hang when configured to use TACACS+ for authentication. Since the HTTP server uses a tty to handle I/O for the request, these hung processes can tie up all available ttys. [CSCdi84657]
- On Cisco 7000 series routers, in the output of the show interface serial command, the packet input field reports the incorrect number of received packets. The workaround is to enable SSE switching on all MIP interfaces. [CSCdj01844]
- On Single Flash Bank 2500 devices, when the device is running from the image on Flash (RFF), the SNMP operation of copy to Flash using CISCO-FLASH-MIB does not work.
- The work around is to use the command line interface command copy tftp flash. This CLI command invokes the FLH interface and the file is copied successfully to the device. [CSCdj27438]
- When custom or priority queueing is turned off on an interface that does not support fair queueing, the queueing data structures associated with the interface are left in an inconsistent state.
- In particular, the enqueue and the dequeue routines are not reset and this causes the box to crash when the routines are invoked the next time. Once the box is rebooted the inconsistency is cleared. [CSCdj29439]
- RMON alarms will not work properly on a number of MIBs that use internal MIB caching to speed up MIB object value retrieval. The only possible workaround is to set up an SNMP get poll on these objects to force an update to the MIB cache, with a poll period within the alarmInterval time. The following MIBs have this problem:
- APPN-DLUR-MIB
IBM-6611-APPN-MIB
CISCO-CIPCSNA-MIB
CISCO-CIPLAN-MIB
CISCO-CIPTCPIP-MIB
CISCO-SNA-LLC-MIB
SNA-NAU-MIB
CISCO-TN3270SERVER-MIB
OLD-CISCO-IP-MIB
BGP4-MIB
LAN-EMULATION-CLIENT-MIB
RFC1406-MIB
RMON-MIB
IF-MIB
RFC1398-MIB
OLD-CISCO-INTERFACES-MIB
CISCO-PING-MIB
CISCO-QLLC01-MIB [CSCdj34766]
- A memory leak exists in the Flash file system. Using SNMP to poll the ciscoFlashMIB objects, or using the show flash command line interface (CLI) commands can result in non-trivial amounts of memory being allocated and never freed. Repeating these polls or CLI commands will eventually result in the system using up all available memory.
- The ciscoFlashMIB can essentially be disabled (SNMP is prevented from polling this MIB) via use of SNMP views. For example, the SNMP configuration snmp-server community public ro can be changed to the following:
- snmp-server view no-flash internet included
- snmp-server view no-flash ciscoFlashMIB excluded
- snmp-server community public view no-flash ro
- The result is the SNMP polls using the public community string can access objects in the entire MIB space (internet) except for those objects in the ciscoFlashMIB space.
- This will affect any NMS applications that rely on the ciscoFlashMIB objects. [CSCdj35443]
- When issuing the no snmp trap link-status command on an ISDN interface on both the Virtual-Template and the D-channel, the router still sends traps whenever a B-channel changes state. [CSCdj38266]
- After a Cisco AS5200 has been running for 4 to 5 days, it may experience a severe memory leak that requires the router to be rebooted. [CSCdj41164]
- An SNMP Get of an individual instance from the ipNetToMediaTable may fail, even though an SNMP Get-next will successfully retrieve the instance. This is likely to be seen on table entries referring to software interfaces (for example, subinterfaces, loopbacks or tunnels) or hardware interfaces that have been hot-swapped in. There is no known workaround. [CSCdj43639]
- A crash occurred in the Frame Relay packet classifier function called by the WFQ routine. A workaround for this problem is to disable WFQ on the interface with Frame Relay encapsulation. [CSCdj45516]
- When an IBM AS/400 end system is attempting to communicate with an IBM 5494 controller through Cisco 4700 routers, the Token Ring interface on the router uses its Token Ring MAC address as the source address when sending DM command messages to the AS/400. The AS/400 discards these messages because it does not recognize the source address, and it continues to poll the IBM 5494, which causes it to hang. The workaround is to reload the router. [CSCdi87648]
- A small window exists in which it is possible after a transmission group reinitialization that only one CP-CP session is established between the router and a neighboring node. In this case, the contention winner session from the perspective of the router is not activated. Once this occurs, the CP-CP contention winner session will only activate if the APPN subsystem is stopped and started.
- There is no known workaround. [CSCdj25859]
- An APPN router may display the following "Unanticipated CP_STATUS" message when the contention loser CP-CP session goes down and comes back up without the contention winner session being deactivated:
%APPN-6-APPNSENDMSG: Ended DLUR connection with DLUS NETA.SJMVS1
%APPN-7-MSALERT: Alert LU62004 issued with sense code 0x8A00008 by XXXSMPUN
%APPN-6-APPNSENDMSG: Starting DLUR connection with DLUS NETA.SJMVS4
%APPN-7-APPNETERROR: CP_STATUS FSM: Unanticipated CP_STATUS message received
- Each subsequent broadcast locate received by the router causes the following messages to be displayed and about 1920 bytes of APPN memory to be leaked:
%APPN-7-APPNETERROR: MAP_INPUT_SET_TO_ROW: invalid input value=0x80200080
%APPN-7-APPNETERROR: State Error lcb: 60C05CC0 pcid: DA839C70FB1548CB row: 22 col: 0
- This problem occurs when two links are active to the same node and the CP-CP sessions are split between these two links and the link with contention loser is stopped.
- The APPN subsystem should be stopped and restarted to clear this problem. If the CP-CP sessions are between the router and the host, terminating either CP-CP session on the host will also clear this problem. [CSCdj33718]
- There may be intermittent failures when trying to link to bridges over the DLSw remote peers when running LNM over DLSw. The workaround is to reload the router that is directly attached to the LNM device. [CSCdj34112]
- An APPN DLUR router may reload with SegV exception in ndr_sndtp_encap_mu in a timing window where the DLUR supported device disconnects before a request_actpu is sent to the DLUS for that device. [CSCdj37172]
- A DSPU router with an SDLC attached 3174 leaves a terminal hung after a terminal power-reset. Vtam inact/act of LU fixes. A workaround is to remove the DWSPU and connect the 3174 via DLSw. [CSCdj37185]
- APPN enforces the maximum size of a CV10 (product set identifier) on XID to not exceed 60 bytes. Some products include a CV10 that is larger than the 60 byte value. These products will fail XID negotiation with APPN. [CSCdj40144]
- In the event that APPN/DLUR has processed and sent a bind request to a downstream device, and that device has not responded to the bind, issuing a vary, inact command on the host for the LU name that the bind is destined for will not completely clean up the session as it should. [CSCdj40147]
- When a connection is attempted over a port defined with the len-connection operand, APPN can loose 128 bytes of memory for each connection attempt. [CSCdj40190]
- DLSw FST may corrupt the frame header if the riflen is different on both sides. [CSCdj40582]
- Memory leaks occur when APPN TPsend_search is sending locate search requests to adjacent nodes when a link failure occurs. [CSCdj40915]
- When RSRB with TCP encapsulation is configured and remwait/dead peers exist, an explorer packet may continuously try to open the remwait/dead peer. After several tries, the router may crash with memory corruption.
- A workaround is to remove any remwait/dead peer statements. [CSCdj42427]
- A Cisco 3640 router crashes when a UI LLC frame is received on the Token Ring interface. [CSCdj43755]
- An APPN router may crash with a bus error if a race condition is experienced during cleanup processing. The stacktrace shows the crash occurred in Qfind_front while executing a psp00 function. An example stacktrace for this problem is shown below.
System was restarted by bus error at PC 0x3784864, address 0xF0110208 PC 0x3784864[_Qfind_front(0x3040a04+0x743e44)+0x1c] RA: 0x36C1F2E[_queue_find_front(0x3040a04+0x68151c)+0xe] RA: 0x36CC554[_psbmfrm(0x3040a04+0x68bb30)+0x20] RA: 0x36CDAF6[_psp00(0x3040a04+0x68cfd4)+0x11e] RA: 0x314BD78[_process_hari_kari(0x3040a04+0x10b374)+0x0] [CSCdj44198]
- APPN crashed when it received a CV35 without the Termination Procedure Origin Name (TPON) field. [CSCdj44661]
- Configuration of SRB on a second interface yields the following traceback information from LNM:
%LNMC-3-BADCLSIRET: bogus Invalid ret code (0x7007) init_clsi_op_proc, bogus -Traceback= 60791120 6078FE48 6078FDC4 607890E0 6078ED48 60226648 60226634 [CSCdj45268]
- DLUR bind processing may cause stack corruption, resulting in a reload with PC 0x0. This problem is caused by attempting to parse the user data subfields beyond the location where the subfields exist. The reload will only occur if the byte two bytes beyond the end of the user data area is 0x3 or 0x4. This is a very rare occurrence. [CSCdj45676]
- In large APPN network environments over 200 NNs, numerous broadcast searches could happen during initial start up or intermediate links recovery. The memory usage serge may bring down the entire network. [CSCdj45705]
- The message "%APPN-0-APPNEMERG: Mfreeing bad storage, addr = 60BB7188, header = 60BB6B20, 00000218 -Process= "ndrmain", ipl= 0, pid= 62" may be issued when a DLUR served PU disconnects. [CSCdj46783]
- Router will not pass SRB directed frames if the SRB proxy-explorer feature is configured. SRB proxy-explorer is used with NetBIOS name caching. [CSCdj47797]
- Some 68K-based routers, such as the Cisco 7000, Cisco 4000, and Cisco 2500 series routers, may crash while running APPN. This memory corruption may occur after a rare combination of APPN detail displays, followed by a show appn stat display.
- [CSCdj47941]
- When connecting a Canary Fast Ethernet transceiver to the MII connector on VIP port adapters, reload the microcode so that the port will function properly. [CSCdi64606]
- The auto-enable feature for packet-by-packet Frame Relay compression is removed and this form of compression is allowed to be manually enabled. [CSCdi85183]
- Hardware platforms that use Cirrus Logic serial line controllers may experience the following behavior:
- If the system tries to discard output for a line while there is output data in the buffer, the line may become unresponsive to input. This happens most frequently when the user attempts to abort output from a network connection. For example, sending CTL-C on a LAT connection or sending a break character during a PAD connection may cause this symptom.
- The affected platforms are: Cisco 2509 through Cisco 2512, Cisco 2520 through Cisco 2523, Cisco AS5200, the NP-2T16S module for the Cisco 4500 and Cisco 4700, and the NM-4A/S, NM-8A/S, NM-16A, and NM-32A modules for the Cisco 3600. [CSCdj02282]
- In certain cases, a router may bring Layer 1 down without an apparent reason. Hereafter, a new TEI is negotiated with the switch. The latter still keeps all call references belonging to the previous TEI, since no DISCONNECT was seen on L3. [CSCdj11840]
- An SNMP agent was returning erroneous values. Under some conditions, the ifInUcastPkts counter was observed returning decreasing values, which is incorrect. [CSCdj23790]
- PPP compression and custom queueing are incompatible features and may cause the router to crash. To work around this problem, turn off all fancy queueing. [CSCdj25503]
- In X.25 packet-by-packet compression, error checking code is fixed after malloc for decompression history buffer. [CSCdj29139]
- The BREAK sequence may not be received properly on platforms that use the Cirrus Logic asynchronous controllers. This includes the Cisco 2509, 2511, AS5100, and AS5200. You may have to send the BREAK sequence multiple times before it is interpreted correctly. [CSCdj32121]
- dot5StatsTable does not return any value in Cisco IOS Release 11.2 software. [CSCdj32372]
- NFS transmission problems and FDDI excessive claims occur after installing Releases 10.3(9) through 10.3(18), 11.1(9) through 11.1(14), or 11.2(1) through 112(9). This problem is specific to the CX-FIP interface board. [CSCdj38715]
- When IRB is configured with a FDDI interface on a Cisco 4000 series router, some packets will not be forwarded through the FDDI interface. [CSCdj40769]
- An NT client/server sending out multiple ARP requests to the BVI interface of the router causes a loss of connection. The workaround is to enable ARP SNAP arp timeout 120. [CSCdj46855]
- The PA-4R may incorrectly adjust the datagram size of an incoming packet to include extra padding at the end of the packet. This problem only occurs under moderate/heavy traffic load where multiple PA-4R interfaces are consuming many particle buffers. The problem also only occurs on packets with a packet length that is a multiple of 512 bytes, 513 bytes, 514 bytes or 515 bytes. On Cisco 7xxx family VIP PA-4R systems any type of packet may be subject to this corruption. On Cisco 720x family systems with PA-4R, only source route bridging packets are subject to this corruption. The only workaround is to reduce the token ring interface's MTU to 508 bytes or less. [CSCdj48183]
- IP cache is not invalidated for destinations that use the default routes even after the next hop is down. The workaround is to issue the clear ip cache command. [CSCdj26446]
- After the ip default-network statement is issued, the default network route does not get propagated to other routers in the network. There is no known workaround for this problem. [CSCdj28362]
- EIGRP topology entries from the redistribution of connected routes where EIGRP is already running natively may not clear when the interface goes down. [CSCdj28874]
- A router crashes after receiving multicast packets with the illegal source address 0.0.0.0. The workaround is to configure the access list to filter out packets with a source IP address of 0.0.0.0. [CSCdj32995]
- User cannot enter the ip accounting command on a Frame Relay subinterface with this Cisco IOS Release on a Cisco 4500 router. [CSCdj33780]
- When the OSPF interface command ip ospf authentication-key key is configured with key length longer than 19 characters, including any trailing space, then the OSPF internal data will be corrupted. The write terminal command could reload the router.
- The workaround is not to enter a key longer than 19 characters, either encrypted or not.
- The same problem happens with the ip ospf message-digest key-id md5 key command. In this case, the key length should not be longer than 36 characters. [CSCdj37583]
- On a Cisco 4700, RIP cannot handle more than 1800 routes received back to back without inter-frame gap. [CSCdj40042]
- After the aggregate-address summary-only command is configured, issuing the same command without summary-only will not unsuppress the more specifics of the aggregate.
- A workaround is to negate the whole aggregate-address command first. [CSCdj42066]
- ICMP unreachables are wrongly sent out for multicast packets. [CSCdj43447]
- During a ping, each packet took more than 2 seconds to output. With ATM static maps, the wait is not necessary for IP over ATM. [CSCdj47856]
- Entering the no ip gdb rip command twice may crash the router. [CSCdj48291]
- The following message may be erroneously displayed:
%LAT-3-BADDATA: Tty124, Data pointer does not correspond to current packet
- When many LAT sessions are active, and a received data slot starts in the last 14 bytes of a full Ethernet frame, data for that slot is discarded. [CSCdi82343]
- Route stuck in "deletion pending" state after an ipx down command. The only workaround is to disable and reenable IPX routing on the router.
- This could happen if the commands ipx down and no ipx network are given in the same or reverse order, with very little time in between. [CSCdi91755]
- XNS standard access lists may produce incorrect "permit" results on Cisco 4500 series routers. In one case, this caused an XNS RIP packet to bring up BRI/DDR lines every 30 seconds. If similar false "permit" results happen in forwarding filters, supposedly filtered traffic could be permitted through the router instead of denied. [CSCdj25490]
- XNS routes may get deleted on serial interfaces at boot time. The workaround is to issue the shut and no shut commands on the affected interface. [CSCdj25806]
- IPX does not advertise static/floating static routes if they are created before the interface that the routes connected to is up. The workaround is to issue the shut and no shut commands on the interface that the static/floating static routes are connected to. [CSCdj41584]
- Running IPX EIGRP with a maximum path set greater than one, the router may not remove the SAP after the interface is down if it is learned via more than one path. [CSCdj45364]
- If a route goes away via aging (180 seconds) and the default route is known, a cache entry may be installed for the network using the default route path. If the network comes back within the next 60 seconds, a new cache entry pointing to the now valid path may not be installed and the cache will still point to the default route path for the network. A workaround is to issue the clear ipx route and clear ipx cache commands, or run without using the default route. [CSCdj47705]
- A router may restart with a bus error at address 0xD0D0D5D in module tcpdriver_del. [CSCdj26703]
- A router may unexpectedly reload when VINES SRTP routing is configured. The workaround is to remove the vines srtp-enabled command. [CSCdj37888]
- On a 7000 router, the following console messages may be logged:
%AIP-3-AIPREJCMD: Interface ATM3/0, AIP driver rejected Teardown VC command (error code 0x8000)
- Such an error is associated to the AIP not being able to receive packets. It is reproducible only if there are long periods (minutes) where no traffic crosses the ATM interface.
- The workaround is to reload the box or to perform a microcode reload. This does not occur on the Cisco 7500 family (including the RSP7000). [CSCdj20667]
- Under certain conditions, the router may reload during an ISDN call setup with the SPC bit set. This problem only occurs with 1TR6 ISDN switch types. [CSCdj20841]
- While using Distributed Fast Switching, buffer headers can be stranded in the outgoing VIPs transmit queue when that interface has been taken down. This is more likely to occur when a faster interface is switching to a slower one.
- Ignores and drops may increase on the input interface as it fails to obtain a needed buffer header to switch the packet. The rxcurr on the input interface will also remain above rxlow even when traffic is not arriving on the interface.
- The VIP will now continue to drain the transmit queue of the interface even when it is administratively down. This will allow the buffer headers to be returned to the originating local free queue.
- This may cause the number of drops on outbound interface to jump up when the interface is taken down. However, this behavior is normal as the downed interface will drop any packets sent to it when it is not up. [CSCdj21693]
- The Frame Relay LMI Enquiry and Status messages stop being exchanged after a short time of successful communication. The statistics incorrectly report timeouts and message activity. There is no workaround. [CSCdj31567]
- A user has an AS5200 running Cisco IOS 11.2(5)P (Enterprise Plus Feature Set). A LINE FEED (<LF or 0A hex) should be inserted after echoing a <CR to the remote host. This is not working. [CSCdj33431]
- If a BRI port attached to an NI-1 ISDN switch using two SPIDs gets a Layer 1 deactivation and reactivation (typically due to adverse line conditions or temporary disconnection of the cable), that port may not be able to reestablish Layer 2 connectivity on the second TEI and, therefore, not be able to use the second B channel. Issuing the show isdn status command will report TEI_ASSIGNED on one of the TEIs instead of MULTIPLE_FRAME_ESTABLISHED on both. A workaround is to have your service provider configure a single SPID that can control two B channels. [CSCdj41311]
- Using NetBIOS over PPP may result in traceback messages complaining about invalid memory action at interrupt with traceback information appended:
%SYS-3-INVMEMINT: Invalid memory action (free) at interrupt level
- [CSCdj42341]
- This patch prevents the use of an invalid pak-info_start pointer when doing payload compression on RSP platforms, thus avoiding a crash. [CSCdj43332]
- When a PPP connection is disconnected due to a keepalive timeout (for example when the other end of the link is reset), the PPP internal state will be left in a confused state and unable to negotiate with the peer. This will manifest itself as an interface where LCP is Open and IPCP and other NCPs are Closed.
- This defect can be cleared by entering the shut command followed by the no shut command on the interface in question. The defect was discovered in 11.2(8.1) and 11.2(8.1)P. [CSCdj44339]
- A remote DLSw peering router may send a DM response just after the LLC2 connection is established if the router is very busy and the PC station responds immediately to the UA with a RR. The client will need to reestablish the connection. [CSCdj47782]
- A boot image without a subsystem containing IPCP will restart the router. There is no workaround. [CSCdj48085]
- When using the frame-relay map class or frame-relay traffic-rate commands, and when the rate is being reduced in response to BECN, the default lower limit is zero, while the expected default is CIR/2.
- The workaround for this behavior is to define the rate using the CIR/BC/BE parameters. [CSCdj49145]
- The router may unexpectedly restart when configuring an X.25 PVC that is locally switched. [CSCdj49828]
- The show x25 vc command will cause the router to unexpectedly restart if there is a combination of locally switched virtual circuits and other virtual circuits. [CSCdj50405]
This section describes possibly unexpected behavior by Releases 11.2(8) and 11.2(8)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(8) and 11.2(8)P. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(8) and 11.2(8)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Releases 11.2(9) and 11.2(9)P.
- A reload might occur if the command show modem slot/modem-port is issued when the associated modem is in the autoconfigure mode. Autoconfigure mode is normally a short interval during which the modem is reset and reinitialized by the modem autoconfigure command. [CSCdj17224]
- ATCP may cause AppleTalk to trash memory and reload the router. There is no workaround. [CSCdj23355]
- Connected routes stay in the routing table when a card is disabled and in an analyzed wedged state. There is no workaround. [CSCdj08355]
- The error "System restarted by bus error at invalid address" is caused by intermittent Telnet sessions on a Cisco AS500 platform running Cisco IOS Release 11.1(10)AA.
- This problem occurs because of a race condition when doing DNS name query, and DNS name cache is removed in the middle of the process.
- There is no workaround on the router side. On the DNS server side, configuring DNS TTL to be one minute or longer may work around this problem. However, this workaround may not be acceptable for some applications. [CSCdj16824]
- This bug may be user specific; the following error message occurs when a user's script executes the show start command:
% Non-volatile configuration memory has not been set up
- The user's script is used to change passwords. Current testing indicates that it may be a software checksum error. [CSCdj18107]
- During a boot Flash format, systems with earlier release images will not recognize Intel boot Flash SIMMs 28F004S5 (device code A7), 28F008S5 (device code A6), and 28F016S5 (device code AA).
- To run type A7, A6, or AA boot Flash devices and use images prior to this bug fix, format boot Flash with an image containing this bug fix. Then load an older image onto the newly formatted boot Flash SIMM. [CSCdj20681]
- After extended use, a Cisco AS5200 may begin to report MALLOC failures. The output of the show memory command indicates a possible leak of ppp authentication buffers. [CSCdj22107]
- On RSP-based platforms, the following error may occur, indicating a problem with a hardware enqueue:
%RSP-2-QAERROR: reused or zero link error, write at addr 00C0 (QA) log 2600C040, data 00070000 00000000
- This message may be followed by the following error and a crash:
Unexpected exception, CPU signal 10, PC = 0x601C4658
- This message is caused by a memory access problem in the diagnostic code handling the original QA error. [CSCdj29751]
- The object cmInitialLineConnections in the CISCO-MODEM-MGMT-MIB is supposed to return only non-zero values. The current implementation returns all counter values, including zeroes. This problem is not too serious if only single-valued SNMP retrievals (getone...) of cmInitialLineConnections are performed. In actuality, SNMP retrievals of multiple values (getmany...) are often used. The problem is much more pronounced in the second case. On an AS5200, there are 48 modems and 31 possible modulation speeds. A single issue of the getmany command on cmInitialLineConnections will result in roughly 1500 values being returned, most of which are zeroes and will be ignored. This is inefficient and causes a lot of unnecessary traffic on the network.
- There is no workaround for this caveat. [CSCdj30171]
- A memory leak exists in the Flash filesystem. Using SNMP to poll the ciscoFlashMIB objects, or using the show flash command line interface (CLI) commands can result in non-trivial amounts of memory being allocated and never freed. Repeating these polls or CLI commands will eventually result in the system using up all available memory.
- The ciscoFlashMIB can essentially be disabled (SNMP is prevented from polling this MIB) via use of SNMP views. For example, the SNMP configuration snmp-server community public ro can be changed to the following:
- snmp-server view no-flash internet included
- snmp-server view no-flash ciscoFlashMIB excluded
- snmp-server community public view no-flash ro
- The result is the SNMP polls using the public community string can access objects in the entire MIB space (internet) except for those objects in the ciscoFlashMIB space.
- This will affect any NMS applications that rely on the ciscoFlashMIB objects. [CSCdj35443]
- When inbound PAP authentication is configured to use TACACS+ with a down-rev daemon (for example, Freeware 2.1) the system will leak one TACACS+ packet for every PAP authentication it performs.
- Upgrading to a daemon that understands the latest version of the TACACS+ protocol (version 193) is an effective workaround. [CSCdj36449]
- Enabling DECnet fast switching on inter-area routers will cause DECnet routing to fail. A possible workaround is to disable DECnet fast switching on the Ethernet interface. [CSCdj15855]
- Entering the privilege route-map level x set as-path prepend x command in configure mode may cause the router to reload, even though the number after prepend is not necessary. The workaround is to not enter a number after prepend. [CSCdj37035]
- QLLC/RSRB forwards IEEE XID frames like other XID frames to VTAM. Some devices use IEEE XID frames (format 8, type 1) instead of test frames. [CSCdi86682]
- A memory corruption causes the router to crash when a NetBIOS datagram explorer is received by a Cisco 7200 router. This problem can occur for any non-explorer frame also. There is no workaround for this problem. [CSCdj04944]
- Issuing the show lnm station command may cause the routers to reload, especially when the stations are getting in and out of the ring. [CSCdj09905]
- Attachmate Advanced Function SDLC adapter is limited to 19.2 kbps on a Cisco 3600 asynchronous/synchronous port. Setting the clock rate above 19.2 kbps will eventually cause an abort in an I-Frame which inactivates the PU. The router SNRMs the device, but it does not respond to the UA from the Attachmate SDLC adapter. Issuing the clear interface command or the shut and no shut commands will restart the device.
- Issue a show controller serial command, then look for the "residual indication count." If the counter is at "0," then this caveat is not the problem. If it is a non-zero value, then this caveat may be the problem. [CSCdj17394]
- When SRB and transparent bridging are both configured on two interfaces, Sr frames with an Ethernet type of 0x600 or 0x800 will not be forwarded and do not show up as source errors. This problem first appeared in Cisco IOS Release 11.1(12). [CSCdj18483]
- Continuously issuing the appn ping command causes the router to hang indefinitely. [CSCdj19525]
- The router may reload unexpectedly with a stack trace pointing to llc2_timer. [CSCdj21370]
- On a Cisco 7200 router, duplicate ring entries may be seen in the RIF cache and when using the debug source bridge command. The duplicate ring entries lead to connectivity problems for end systems. [CSCdj21876]
- When RSRB with TCP encapsulation is configured and there are dead peers, an explorer packet may continuously try to open the dead peer. After several tries, the router may crash with memory corruption. The workaround is to remove any dead peer statements. [CSCdj24658]
- When promiscuous or peer-on-demand peers are used and there are more than 100 circuits connected, a memory corruption crash may result when the promiscuous or peer-on-demand peers disconnect. The corruption occurs when circuit cleanup is delayed due to end station delay, LAN network delay, or high router CPU usage. [CSCdj26284]
- An APPN image may restart because of a CPU HOG problem when processing a link failure event by the Directory Service APPN process (xxxdns00). This may occur when a lot of locate requests are pending. There is no known workaround. The router is forced to restart by the system watchdog process (software-forced reload event). [CSCdj26423]
- DLSw local-switching from VDLC to LLC media does not work correctly. [CSCdj28900]
- The timer that controls the daily cleanup of APPN topology and the 5-day rebroadcast of topology resources owned by this APPN node can fail after 45 days. At this time, other nodes where the timer is still functioning properly may age out the topology of the node with the failed timer after 15 days. Thus, after a total of 60 days, APPN routing failures and failed CP-CP sessions may result between APPN network nodes.
- Because other network events (link outages, and so forth) can trigger a node to send a TDU, this problem will not necessarily appear exactly after a 60-day uptime----it may occur much later or not at all. However, any APPN router running in the network for over 60 days is at risk for seeing this problem.
- Stopping and restarting APPN will work around this problem until the next timer wrap, which can be up to 45 days, but may be less depending on the current value of the timer. Reloading the router will reset the timer and avoid the problem for an additional 60 days. [CSCdj29014]
- A router configured for RSRB may crash with a watchdog timeout during low memory conditions and/or continual peer state changes. [CSCdj30381]
- A DLUR router may reject unbind requests from the host if it has not received a bind response from the downstream LU.
- If the downstream device never responds to the outstanding bind, the DLUR router will wait indefinitely and not free the local-form session ID (lfsid). This may cause a situation in which the host tries to reuse a lfsid after it has sent an unbind request, but the DLUR rejects the new bind request because it believes that this lfsid is in use. If the host continuously tries to use this lfsid that the DLUR believes is in use, then no new sessions can be established. This problem occurs only when the downstream device does not respond to a bind request. [CSCdj30386]
- Sometimes the linkstations may get stuck in a XIDSENT state when an APPN linkstation fails and recovery is attempted.
- Caveat CSCdi77040 provides a fix for this problem in the system side. This caveat provides the corresponding fix for APPN. [CSCdj30552]
- DLSw is running between an IBM 6611 and a Cisco 4500 router running Cisco IOS Release 11.0(16). On the IBM 6611 side, the network is Token Ring. On the Cisco 4500 side, there is an Ethernet segment. SNA is working correctly, but some NetBIOS sessions do not connect. [CSCdj31233]
- When using APPN/DLUR with the prefer-active-dlus configuration command specified on the APPN control point, DLUR may not properly connect to a backup DLUS in cases where the primary DLUS is available in the network but has the served PUs varied inactive. [CSCdj31261]
- When using the len-connection configuration command on the APPN port and there are at least 30 XID3 devices connecting in through that port, a rare sequence of events of devices connecting and reconnecting can cause a reload. [CSCdj31264]
- Any device connecting to APPN/DLUR that does not carry a cv0E with a CPname specified on XID (any PU2.0 and some older PU2.1 implementations) causes APPN to fail to release 536 bytes of memory each time the device disconnects and reconnects. Any device connecting on a port with LEN-connection defined also exhibits this behavior.
- When memory is exhausted, the APPN subsystem may stop or the router may reload. [CSCdj33429]
- An APPN router may display the following "Unanticipated CP_STATUS" message when the contention loser CP-CP session goes down and comes back up without the contention winner session being deactivated:
%APPN-6-APPNSENDMSG: Ended DLUR connection with DLUS NETA.SJMVS1
%APPN-7-MSALERT: Alert LU62004 issued with sense code 0x8A00008 by XXXSMPUN
%APPN-6-APPNSENDMSG: Starting DLUR connection with DLUS NETA.SJMVS4
%APPN-7-APPNETERROR: CP_STATUS FSM: Unanticipated CP_STATUS message received
- Each subsequent broadcast locate received by the router causes the following messages to be displayed and about 1920 bytes of APPN memory to be leaked:
%APPN-7-APPNETERROR: MAP_INPUT_SET_TO_ROW: invalid input value=0x80200080
%APPN-7-APPNETERROR: State Error lcb: 60C05CC0 pcid: DA839C70FB1548CB row: 22 col: 0
- This problem occurs when two links are active to the same node and the CP-CP sessions are split between these two links and the link with contention loser is stopped.
- The APPN subsystem should be stopped and restarted to clear this problem. If the CP-CP sessions are between the router and the host, terminating either CP-CP session on the host will also clear this problem. [CSCdj33718]
- When an LLC2 connection is configured to work over ATM LANE for DLSw, the connection succeeds until a retransmission is required, at which time it fails. [CSCdj34873]
- A user is unable to enter an XID option on an interface configured for QLLC and DLSw. [CSCdj35448]
- If the DLUR router received fixed session-level pacing values on the primary stage, it may modify these pacing values before forwarding the bind to the secondary stage. [CSCdj36195]
- The router may reload when reverse-QLLC connections disconnect using QLLC/DLSw+. [CSCdj36613]
- A problem occurs when an LU node specific node attempts to start a session with a set of invalid bind parameters. This results in a locate-find (with the bind in the CDINIT) being sent through the Cisco APPN network to the end VTAM CP. The end VTAM CP rejects the locate-find with a 0835003A sense and sends this back with a control vector CV35 of minimum length of 8 bytes to the originator via the Cisco APPN NN. The APPN NN then rejects the frame with a 08953500 sense and drops the CP-CP session between the Cisco router and VTAM CPs. [CSCdj37479]
- A Cisco 4700 router crashed in ip_input because of a bad packet on the IP input queue. [CSCdi46479]
- Issuing the no channel-group command on a MultiChannel Interface Processor (MIP) causes the router to reload if OSPF is configured. [CSCdi79844]
- On Cisco 2500 series routers, the Token Ring interfaces run FastMac Plus microcode version 1.28, even though the latest microcode version available is 1.61. [CSCdi93243]
- Bridging from a serial interface to a Fast Ethernet interface with ISL encapsulation fails because the serial input queue is not cleaned up. [CSCdj01443]
- When bridging IP and routing AppleTalk, assigning the bridge-group to the LEX interface causes AARP entries to disappear and become no longer resolved. [CSCdj22825]
- When PIM is configured on a Fast Ethernet port adapter on a Cisco 7200, the interface enters promiscuous mode and receives all packets on the LAN, possibly interrupting unicast traffic between other stations on the LAN. [CSCdj28007]
- In X.25 packet by packet compression, error checking code is fixed after malloc for decompression history buffer. [CSCdj29139]
- On an experimental image corresponding to Release 11.1(12.5)CA, when using a point-to-point subinterface on the ATM interface of the CES card of the 7200, the IP connectivity will break if transparent bridging is configured on the subinterface via the bridge-group command. IP connectivity can be restored by unconfiguring transparent bridging.
- The workaround is to do RFC1483 over a PVC using a multipoint subinterface with a map-list defined. Using the map-group command on a multipoint subinterface does not exhibit breakage.
- To determine if you have this bug, enter the show arp command. If there is an entry for the other end of the PVC showing "incomplete" for the MAC address, then you are affected by this caveat. [CSCdj34217]
- Under unusual circumstances, EIGRP may reinitialize multiple peers when a stuck-in-active condition occurs, instead of just the peer through which the route was stuck. [CSCdi83660]
- Under certain circumstances, if the Cisco router received a route with a lower rip2 metric, the router may go to hold down with infinite metric. [CSCdj15295]
- Under certain circumstances, a Cisco router will interpret an IP packet that was broadcasted at the link-layer as an IP directed broadcast. Once the router determines that the original packet was a directed broadcast, it forwards the packet to any other interfaces that belong to the directed broadcast address because Cisco routers forward directed broadcasts by default.
- Though the destination IP address of the original packet appears to be that of a directed broadcast, the router should not forward the packet since it is actually a link-layer broadcast. [CSCdj16052]
- A router may crash after the fifth EIGRP process is configured. CSCdi36031 is a related caveat. [CSCdj17508]
- IP cache is not invalidated for destinations that use the default routes even after the next hop is down. The workaround is to issue the clear ip cache command. [CSCdj26446]
- Major net summarization is incorrectly done if there are two equal cost direct connect interfaces. To work around this problem, issue the clear ip route * command. [CSCdj30971]
- Dense mode interfaces are not always populated in the outgoing interfaces of a multicast route. This problem was introduced by CSCdi25373. [CSCdj32187]
- When doing a trace route from a router to a broadcast network address, NO ICMP TTL Exceeded is sent back by the next hop Cisco router. [CSCdj33761]
- An old incoming interface is not populated in the OIF during RPF transitions. [CSCdj34457]
- CLNS fast switching is not working between PVCs defined on ATM subinterfaces. [CSCdj23817]
- When performing protocol translation from X.25 to LAT, spurious memory accesses may be seen in console messages as well as in the output from the show alignment EXEC command. [CSCdj18470]
- When upgrading from Cisco IOS Release 10.3(7) on a Cisco 4700 router, an IPX EIGRP memory leak may occur when introducing Frame Relay on subinterfaces. The IPX EIGRP is increasing in the same quantity as the free memory is decreasing. [CSCdi62135]
- IPX fast switching might fail over a PRI interface, resulting in IPX client connections not being established over the PRI even though the IPX servers are visible. The workaround is to configure no ipx route-cache on the PRI interface. [CSCdj29133]
- XNS does not learn the new non-canonical format of Token Ring MAC addresses. It retains the old canonical format address for its node address. This would cause routing failure. The workaround is to disable and reenable XNS network on all the Token Ring interfaces. This affects only RSP platforms and when you upgrade an XNS-configured router from a version that has the bug CSCdi48110 to a version that has this bug fixed. [CSCdj29916]
- The ipx nlsp command tag option is not being displayed as an option, making routing between NLSP areas impossible. [CSCdj33746]
- An interface may become wedged with input queue 76/75. This is caused by both syslog and SNMP traps.
- The workaround is to disable both syslog and SNMP traps. The commands to do this are no snmp-server host ip-address and no logging ip-address. [CSCdj27567]
- New TCP connections may become stuck in SYNSENT state when router is low on memory. [CSCdj30008]
- International (8-bit) characters will not echo when using TN3270. [CSCdj22231]
- Issuing the write memory command may cause the system to reload while writing the VINES access list to memory. Issuing the write terminal or show vines access commands may also halt the system. The workaround is to delete the configuration file and reconfigure the system. [CSCdi49737]
- CMNS connections may suffer spurious X.25 resets under traffic load. [CSCdi40875]
- There is a problem that only affects the PPP reliable protocol. No other protocols are affected, such as HDLC. [CSCdi70242]
- A BRI interface with Frame Relay encapsulation configured does not behave correctly. A call stays up for a few seconds, LMI messages are exchanged, and as soon as the DLCI goes from INACTIVE to DELETED, the BRI is physically reset. Therefore, it is impossible to use Frame Relay over ISDN. [CSCdj09661]
- When a router receives a valid Frame Relay Setup message while the local SVC's map-class is not yet properly configured, the router crashes. The crash point and the stack trace may be like one of the following:
Current PC: 0x90F61C[bcopy(0x90f56c)+0xb0] FP: 0xCC65C4[_etext(0x96f3ec)+0x3571d8] RA: 0x5E1EF2[_fr_svc_send_msg_to_nli(0x5e1eca)+0x28] FP: 0xCC65E8[_etext(0x96f3ec)+0x3571fc] RA: 0x5DD98C[_FRU0_Setup(0x5dd8e2)+0xaa] FP: 0xCC6620[_etext(0x96f3ec)+0x357234] RA: 0x5DD894[_svc_process_l3_event(0x5dd786)+0x10e] FP: 0xCC6664[_etext(0x96f3ec)+0x357278] RA: 0x5DA17A[_l3_ie_parse(0x5d9d32)+0x448] FP: 0xCC66A4[_etext(0x96f3ec)+0x3572b8] RA: 0x5D9B84[_l3_ie_parse_process(0x5d9b14)+0x70] FP: 0xCC66C0[_etext(0x96f3ec)+0x3572d4] RA: 0x1CC372[_process_hari_kari(0x1cc372)+0x0]
Current PC: 0x5E1D8E[_fr_svc_call_id_to_nli(0x5e1cf0)+0x9e] FP: 0xCC5CCC[_etext(0x970900)+0x3553cc] RA: 0x5E2176[_fr_svc_send_msg_to_nli(0x5e214e)+0x28] FP: 0xCC5CF0[_etext(0x970900)+0x3553f0] RA: 0x5DDC10[_FRU0_Setup(0x5ddb66)+0xaa] FP: 0xCC5D28[_etext(0x970900)+0x355428] RA: 0x5DDB18[_svc_process_l3_event(0x5dda0a)+0x10e] FP: 0xCC5D6C[_etext(0x970900)+0x35546c] RA: 0x5DA3FE[_l3_ie_parse(0x5d9fb6)+0x448] FP: 0xCC5DAC[_etext(0x970900)+0x3554ac] RA: 0x5D9E08[_l3_ie_parse_process(0x5d9d98)+0x70] FP: 0xCC5DC8[_etext(0x970900)+0x3554c8] RA: 0x1CC3BA[_process_hari_kari(0x1cc3ba)+0x0] [CSCdj13019]
- Packets that are exactly the size of the MAC encapsulation size are not bridged. This means that TEST and XID frames will not be bridged. Instead, they are passed up to the process level, which responds to them. [CSCdj14748]
- The MAC address of an ATM interface in a router, instead of the actual MAC address of an end station connected to a LANE client, is entered in the ARP cache. This problem occurs after several hours. A temporary workaround is to clear the ARP cache of the router.
- Other workarounds include removing bridging from LANE subinterfaces, disabling proxy ARP or correctly configuring the subnet mask of end stations in a LANE environment. [CSCdj19293]
- The output of the show dialer command shows that the "dialer state is call pending" and the dialer could not be used after it received a call from the destination. This caveat may be related to CSCdi80876. [CSCdj19790]
- Upon bootup, OIR, microcode reload, and cbus complex restarts, the router shows CCBTIMEOUT error messages on VIPs that result in a disabled wedged status. This problem occurs with bad port adapters and port adapters in a "not-ready" state. The cause of the problem is when PCI access is tried and the port adapter does not respond, thus resulting in CCBTIMEOUTS. [CSCdj21639]
- When per VC custom or priority queueing is configured prior to the initialization of the VC, the functionality is not correctly initialized and is not activated. [CSCdj28240]
- Use of IPX with very large packet sizes may result in a memory leak when transmitting packets via PPP multilink. [CSCdj29387]
- ATCP negotiation fails when an ARAP 3.0f1c4 client attempts to connect to a Cisco access server. This was found during Beta testing of the ARAP 3.0 software. The actual ARAP protocol works fine; it is only ATCP that is failing. [CSCdj31323]
This section describes possibly unexpected behavior by Releases 11.2(7) and 11.2(7)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(7) and 11.2(7)P. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(7) and 11.2(7)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Releases 11.2(8) and 11.2(8)P.
- A bus error may occur when the asynchronous interfaces on an AS5200 are not configured and there is asynchronous call activity on the unit. [CSCdj14683]
- An AS5200 may sometimes crash with the following stack trace:
0x221FF150:_mai_handle_b2b_connect(0x2202ea38+0x1d069c)+0x7c 0x221FC394:_mai_execute_proc(0x2202ea38+0x1cd908)+0x54 0x221FC492:_mai_queue_handler(0x2202ea38+0x1cda2c)+0x2e 0x221FC530:_mai_maintn_process(0x2202ea38+0x1cda72)+0x86
- [CSCdj20121]
- ATCP and ARAP code will not work with all-router node addresses. NBP lookup to ATCP/ARAP clients may fail. There is no workaround. [CSCdj02390]
- A router may prevent Macintoshs from coming up because of duplicate provisional addresses. A workaround is to issue the clear appletalk arp command. [CSCdj16510]
- A special character in an AppleTalk zone name does not work correctly when using the appletalk static command. If the special character is between:80 and:ff, it will be changed in running-config. This change only occurs when using the appletalk static command. [CSCdj25241]
- When using AAA, it is not possible to duplicate the precise sequence of prompts that dialup users have become accustomed to from using XTACACS. This makes moving from XTACACS to AAA problematic for users who do not wish to rewrite their dial-in scripts. [CSCdi42842]
- This bug is seen only for asynchronous interfaces and may be caused by the following situations:
- 1. The configuration is read after a reload.
- 2. Asynchronous interfaces are configured via Group-Async commands but the snmp-server command is not yet running.
- To work around this problem, do one of the following:
- For scenario 1 above, reread the configuration, or go to the Group-Async interface command line and configure the no snmp trap link-status command again.
- For scenario 2, start the snmp-server command before configuring the no snmp trap link-status command. [CSCdj13769]
- Configuring net/ov on a router that has the tftp-server flash slot0:xxx alias xxxx command configured resulted in a timeout. [CSCdj15425]
- If the write memory command is issued at the same time as the show config command is issued, the router may crash. This problem appears to be the same as caveat CSCdi51059. [CSCdj16985]
- Distributed access lists with a large number of statements may not behave properly when the RSP reloads. A workaround is to execute the microcode reload command. [CSCdj17068]
- Too many accounting records are sent for a Multichassis Multilink PPP connection. [CSCdj17870]
- Control characters in chat-script commands that are specified using backslash-octal representation are not accepted and stored properly. [CSCdj18869]
- An ARAP session attempt causes NAS to reload when running AAA accounting with ARAP. [CSCdj21751]
- An AS5200 may reload if Van-Jacobsen TCP/IP header compression is enabled on the asynchronous interfaces. As a temporary workaround, remove the configuration line ip tcp header-compression. [CSCdj22168]
- The autohangup command does not work if the user uses the rlogin command. Instead of being disconnected at the end of the rlogin session, the user will be presented back with the prompt (or the menu if you are using one).
- A workaround is to use the telnet command in the menu, specifying the rlogin port value (513), which will cause rlogin to be invoked; for example, menu test command 1 telnet myhost 513.
- [CSCdj16600]
- A change to introduce a locking mechanism in the parser is preventing the virtual template interface configuration from being applied when the system is loading. This results in the incorrect application of commands to any virtual access interface which is cloned from the template.
- The workaround is to enter the configuration manually after the system has booted. [CSCdj24440]
- When certain configuration commands are entered, the configuration is locked and the commands cannot be executed. When this happens, the following message appears: "The configuration has been locked for more than 10 seconds. Please try again in a few moments". [CSCdj24585]
- When an LNM queries the router with a report station address, the router answers correctly with a report station address. However, 0.001 seconds later, the router sends a second report station address to the LNM with all zeros in the frame. This causes the LNM to work incorrectly. [CSCdj04559]
- A system was restarted by the error "Software forced crash." The stack trace points to the LAN Manager process.
- The current workaround is to disable LNM. [CSCdj11711]
- Any existing sessions or circuits over the backup peer will be brought down immediately after the primary peer is up. This problem occurs even though the backup peer linger timer has been configured for a higher value. [CSCdj13159]
- Source-routed frames with a destination address of FFFF.FFFF.FFFF will not be forwarded between Token Rings when SRB is configured on the router. Source-routed frames with destination addresses other than an all Fs broadcast address will be forwarded.
- In some application environments, certain 3270 emulators will not direct a test poll to a specific media access control address and will use an all Fs address to create the frame. It is this all Fs frame in an SRB configuration that will not be forwarded by the router. This configuration impacts workstations that are attempting to connect to host devices. The broadcast frame will never leave the local ring.
- Most emulators will use the destination media access control address of the host device to create a frame containing the test poll. With some proprietary implementations, the MAC address of the host device does not have to be known by the end device. [CSCdj13563]
- DLSw searching remote and local behavior was observed in Cisco IOS Release 11.1(11). A workaround is to not allow CUR frames to go from the hub router to the peered (remote) router. [CSCdj16711]
- When running Cisco IOS Release 11.1(11) with BSTUN configured, the router may reload under certain conditions. This problem may be minimized by configuring HOSTTIMEOUT to a large value. However, this will have a significant impact in detecting device outages. [CSCdj16888]
- Cisco DLSw appears to shift the lf bits in the SSP header when peering to other vendors DLSw implementations. This may cause circuits to connect using a (smaller) non-optimal largest frame size or may cause circuits not to be able to connect at all. [CSCdj17372]
- Cisco 2522 routers running Cisco IOS Release 11.0(11) may have problems with the SDLC state machine. When a large amount of data is input into the router from a PU (for example, during a file transfer), the router may poll the next PU without receiving a poll final in a frame and without T1 expiring. The router may also expect data from the PU, even though it did not poll the PU.
- A workaround is to ensure there are no unnecessary PUs configured on a line that is continually sending SNRMs. [CSCdj17630]
- Buffers classified as linktype IBMNM may leak in the LNM process. A workaround is to disable the LNM process. [CSCdj20441]
- The router is unable to link with LAN Network Manager. [CSCdj20748]
- When a directory cache entry exists for a resource and a broadcast search arrives for that same resource name, the intermediate node broadcast processing will delete the valid cache entry that existed previously. This defect will cause excessive locate broadcast traffic. [CSCdj21343]
- If APPN directory services receive a search flow that contains a CV35 (extended sense data CV), which has data beyond the point that Cisco APPN recognizes it, Cisco APPN will reject the located flow in error. [CSCdj21690]
- Using the dlsw ring-list or dlsw port-list configuration commands can cause a SegV exception when executing the show dlsw reachability command. [CSCdj21894]
- A DLSw+ crash will happen when the following occurs:
- DLSw+ router A is connected to peer router C and is also peered to router B but is not yet connected to peer router B. Peer C can reach a specific resource (MAC address or NetBIOS name). Peer A can reach the same resource through a local interface. Therefore, at this point peer A can reach the resource both local and remote via peer C.
- Now, Peer B has dlsw icanreach mac/netbios-name configured. When peer A connects to peer B, peer A will crash when trying to delete the dynamic reachability for the resource and replace it with the reachability learned through capabilities exchange with peer B. [CSCdj22327]
- The DLUR router may get into a tight loop, in which it continuously retries to start the DLUR/DLUS pipe to the same DLUS without waiting the specified retry time. This problem could cause the router to crash or continuously display pipe retry messages without waiting the specified retry time. It may also result in high CPU usage. [CSCdj22330]
- When establishing a DLSw session, the circuit priority field in the SSP header of the CUR_cs, ICR_cs, and/or REACH_ACK SSP frames may be set to a reserved value (5, 6, or 7). While this value will not cause problems when sent to a Cisco router peer, it may cause interoperability problems when peering to another vendor's equipment. This problem may manifest itself as an inability to start the circuit. [CSCdj22482]
- When the first attempt to link a Cisco router with the LAN Network Manager fails, it is not possible to link this bridge again because of a hanging LLC2 session in status ADM. To clear this session, reload the router. [CSCdj23142]
- With APPN/DLUR, caveat CSCdj18360 caused a regression in APPN images, which creates thrashing topology updates (topology war) for any topology with more than one CP-CP session. Cisco recommends that an image containing CSCdj18360 should not be used in an APPN network without also having this fix applied. All APPN images containing CSCdj18360 and not this fix have been deferred as production images. [CSCdj23165]
- Two TRLANE clients configured with the same MAC address can join the same emulated Token Ring LAN. [CSCdj23781]
- Under certain circumstances, the router will fail to create a dynamic link station. The workaround is to restart APPN on the router. This is caused by a small buffer leak that occurs for each actpu processed by DLUR. After some time, enough buffers may be lost as to cause session failures and dynamic link station failures due to insufficient buffers. [CSCdj23782]
- OSPF, EIGRP, and other protocols may not work over FDDI. [CSCdj23804]
- Len-connection mode of operation on an APPN port is designed to allow len-level connectivity between a DLUR and its downstream devices. Independent session activation (LU6.2) through ports with len-connection fails with the message "no route for session." This problem does not affect dependent session activation (LU 0, 1, 2 etc.). [CSCdj24777]
- During certain race conditions, an APPN router may crash with a stacktrace showing psbmfrm. [CSCdj25484]
- An APPN router may crash with the following stack trace:
606CD174[Qfind_front+0x24] 606C7D80[timer_process+0x300] 606C8070[csweotsk+0x1d0]
- A router may hit this problem after displaying several messages when the output buffer was full. If the crash was related to displaying "incomplete definition in configuration" warnings, the workaround is too remove these incomplete definitions. [CSCdj26701]
- In some cases, a Cisco 4000 router running Token Ring NIM and an xx-p-mz image may display the "%SYS-3-SUPNONE: Registry 6 doesn't exist" error message repeatedly on the console after bootup. [CSCdi70834]
- On Cisco 7500 RSP platforms, FSIP serial interfaces may display the following panic messages on the RSP console:
%RSP-3-IP_PANIC: Panic: Serial12/2 800003E8 00000120 0000800D 0000534C
%DBUS-3-CXBUSERR: Slot 12, CBus Error
%RSP-3-RESTART: cbus complex
- If the string "0000800D" is included in the panic message, the problem is related to this bug. The workaround is to load a new image that contains the fix for this bug. [CSCdi78086]
- A Cisco 7500 series router may report spurious errors such as the following:
*Dec 20 06:53:08: %RSP-3-ERROR: CyBus0 error 78
*Dec 20 06:53:08: %RSP-3-ERROR: invalid page map register
*Dec 20 06:53:08: %RSP-3-ERROR: command/address mismatch
*Dec 20 06:53:08: %RSP-3-ERROR: invalid command
*Dec 20 06:53:08: %RSP-3-ERROR: address parity error
*Dec 20 06:53:08: %RSP-3-ERROR: address parity error 23:16 1, 15:8 1, 7:0 1
*Dec 20 06:53:08: %RSP-3-ERROR: bus command invalid (0xF)
*Dec 20 06:53:08: %RSP-3-ERROR: address offset (bits 3:1) 14
*Dec 20 06:53:08: %RSP-3-ERROR: virtual address (bits 23:17) FE0000
*Dec 20 06:53:09: %RSP-3-RESTART: cbus complex
- or
09:53:32.607 EST: %RSP-3-ERROR: MD error 0080008030003000
09:53:32.607 EST: %RSP-3-ERROR: SRAM parity error (bytes 0:7) 0F
09:53:33.363 EST: %RSP-3-RESTART: cbus complex
- CyBus errors similar to the above errors have two known causes. If there are HIPs in the router and on the bus reporting the CyBus error, a race condition may exist with the HIP microcode on an oversubscribed bus. The workaround on dual-CyBus platforms is to move all the HIPs onto a CyBus that is not oversubscribed.
- The errors can also be caused by the failure of a marginal CI arbiter board or an RSP board. As a result of this problem, all interfaces are reset, causing forwarding to be stopped for a few seconds. [CSCdj06566]
- The bridge ID may choose a Cisco random address even for the Ethernet interface that has the MAC address. The behavior mostly happens in the first Ethernet interface. [CSCdj13302]
- The VIP PA-4R was bridging frames that were aborted by the sender. The frame is now dropped when the abort is detected. [CSCdj13409]
- When using a Token Ring Adapter in a Cisco 7200 series router, a very large number of receive errors on the Token Ring interface may cause the router to reload. [CSCdj16191]
- An ARP/RARP packet is dropped on a Cisco 7000 ISL subinterface. [CSCdj17002]
- For high-end systems, the Token Ring SDE interface failed to translate the packet into a token or FDDI native packet. The ping packet will fail. [CSCdj19749]
- The FDDI port adapter versions that support CAM are properly recognized before attempting CAM operations. CSCdi51248 must also include CSCdj23259 to avoid problems with old FDDI hardware. [CSCdj23259]
- When the command ip default-network is removed, the Gateway of last resort is not removed from the routing table. [CSCdi76285]
- Cisco 4500 routers may not correctly policy route when serial subinterfaces are configured and the fast-switching cache is populated. The workaround is to disable fast switching on all interfaces. [CSCdi86063]
- A router may reload if it receives an ARP request frame from a Token Ring interface and the frame has been incorrectly formatted as a Frame Relay ARP. ARP request frames that are correctly formatted for IEEE LAN media will not cause this problem. The only workaround is to remove the station sending the illegal frame from the network. [CSCdj05170]
- A BGP router running experimental code and configured using the soft configuration feature may accept a path with its own autonomous system. [CSCdj11588]
- Type 7 LSAs from a NSSA OSPF area may not be translated to type 5 LSAs in the backbone when crossing a virtual link. [CSCdj12181]
- An ICMP redirect will not be sent if there is a destination IP address entry in the fast cache. An ICMP redirect is only sent when the packet is process switched. [CSCdj16708]
- Using the show ip bgp neighbors command with the route-map deny community command does not work. [CSCdj16922]
- When first configuring IP policy routing on an interface, the requested policy routing will not take effect if the destination IP address is already in the IP route-cache. The workaround is to process the clear ip cache command after configuring IP policy routing. [CSCdj18345]
- The system may reload if AppleTalk is enabled on ATM interfaces. No workaround is available. This caveat is introduced in 11.2(6.2) and the related caveat is CSCdj16317. [CSCdj18531]
- Under certain conditions, the EIGRP variance command may not remove routes that have a higher next hop metric. To resolve the problem, issue the clear ip route command. [CSCdj19634]
- When a router is no longer the DR, it should not keep a sparse-mode interface in its outgoing interface list, even if a connected group member exists on that LAN. The sparse-mode interface should expire unless it is refreshed by a join message from a downstream router. [CSCdj25373]
- When a router running RSVP receives a PATH message containing an ADSPEC, and the ADSPEC has a Guaranteed Service (GS) fragment with zero length, the router ends up copying more bytes than necessary. This results in a modified ADSPEC that contains invalid information; if this ADSPEC is passed on to the next downstream router, the downstream router may crash.
- A workaround is to send an ADSPEC with a non-zero length GS fragment, such as one containing valid GS information. [CSCdj25441]
- Turning on IP routing after assigning IP addresses to the interfaces does not take effect. The workaround is to turn on IP routing and then assign the IP addresses to the interfaces. [CSCdj26052]
- XNS routing over non-LANE ATM interfaces creates a cache entry that is never used and never freed; this may result in memory starvation. A workaround is to disable XNS route cache on the non-LANE ATM interfaces. [CSCdj09666]
- IPX cache corruption occurs when you have two Fast Ethernets in a VIP carrier (one configured for ISL) connecting to a single server with dual NICs (different external numbers, same frame type), and IPX max-paths set to 2. A workaround is to disable fast switching for IPX. [CSCdj17470]
- When LANE is configured on an ATM interface, IPX may be using the wrong encapsulation type (SNAP) rather than the default (NOVELL_ETHER) after the router is reloaded. [CSCdj21874]
- Sometimes a TCP control block structure is mistakenly freed during timeout processing, and the next reference to the structure will cause the router to crash. [CSCdi91097]
- When running the Enterprise release of the Cisco IOS software, the router may not forward UDP broadcasts and UDP unicasts. [CSCdj21684]
- TCP header compression does not work over Point-to-Point Protocol (PPP), ISDN, and asynchronous dialer interfaces. To work around this problem, turn off ip tcp header-compression. Note that non-dialer asynchronous interfaces used for dial-in PPP access are not affected. [CSCdi19199]
- The Frame Relay traffic shaping and per-VC queueing features do not operate correctly. When you configure the frame-relay traffic-shape command, the required initialization does not occur as expected. The result is that the specified rates for transmission are not observed and the defined queueing method is not properly configured. There is currently no workaround. You are therefore advised not to configure this feature. This problem does not affect the interface-independent traffic shaping function. [CSCdi88662]
- After a data-direct VCC is created, the ATM-SIG input holding value increases. After it is cleared by a timeout, the ATM-SIG continues to hold onto memory, causing a memory leak. [CSCdj02779]
- A system may reload when a bundle is disconnected while receiving data. [CSCdj15340]
- When the shutdown and no shutdown commands are issued on a BRI interface while the primary Frame Relay interface is down, the interface comes back in standby mode. This problem also occurs when the router is reloaded with the BRI in a standby mode and the primary is down. [CSCdj16441]
- A broadcast packet is not sent over Frame Relay over an ISDN (BRI or PRI) interface resulting in loss of IP routing. The following error message is generated:
%FR-3-INCORRECT_INT: Incorrect output (sub)interface
- [CSCdj16593]
- A memory allocation error occurs after a large number of modem calls are placed to an AS5200 configured for PRI ISDN. After the AS5200 starts to generate a number of these memory allocation error messages, calls cannot be answered.
- The following are indicators that may be used to determine if the AS5200 is encountering this problem:
- When the AS5200 runs out of memory, MALLOC Failure messages similar to the one shown will be displayed:
%SYS-2-MALLOCFAIL: Memory allocation of 1056 bytes failed from 0x2214E776, pool Processor, alignment 0 -Process= "Net Periodic", ipl= 0, pid= 34 -Traceback= 2214D3E0 2214E542 2214E77E 2214BEC6 2214C12A 22159466 2215E86E 22140BDE 2213B688 2213B6E0
- If there is no ISDN process in the output from the show process command, and you start to see "%SYS-2-MALLOCFAIL" error messages, then the memory leak was caused by this bug.
- If there are more than 46 entries marked "Active" in the output from the show isdn history command, then the memory leak was caused by this bug. [CSCdj21944]
- VIP2 packet bus parity errors are not reported. [CSCdj23431]
- A Cisco access server may not start PPP mode for dialup connections when the line is configured with autoselect ppp. This results in the dialup connection getting dropped.
- To work around this problem, use the async mode dedicated command if no login is required. If a login is required, configure no flush-at-activation, change the q2 register in the modem database, and configure for modem autoconfigure type. [CSCdj25443]
- Routers running with x25 routing enabled on releases after 11.0(14.1), 11.1(10.1), and 11.2(4.4) are susceptible to the router processor pausing indefinitely when malformed connections are made to the X.25-over-TCP (XOT) port. If this occurs the router must be reloaded to recover.
- The following error message can be seen scrolling on the console if the router is in the above state.
%X25-4-VCLOSTSYNC: Interface TCP/PVC, VC 0 TCP connection corrupted
- This message does not seem to occur in a normal XOT switching environment. [CSCdj25846]
- When the primary interface goes down, the secondary interface may not come up if there is a specific backup load configured. This problem does not affect backing up for a subinterface, since the backup load command does not apply. [CSCdj26048]
- Some PC-based PPP clients are not correctly autoselected into PPP mode by the Cisco access servers. This results in numerous drop calls. This problem is usually noticed when an automated dialer is used.
- A workaround is to configure the asynchronous interfaces using the async mode dedicated command. Adding a second or two delay in the automated dialer's script may also fix the problem. [CSCdj26647]
- When per VC custom or priority queueing is configured prior to VC initialization, the functionality is not correctly initialized and is not activated. [CSCdj28240]
This section describes possibly unexpected behavior by Releases 11.2(6) and 11.2(6)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(6) and 11.2(6)P. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(6) and 11.2(6)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Releases 11.2(7) and 11.2(7)P.
- A bus error may occur when the asynchronous interfaces of a Cisco AS5200 are not configured and there is asynchronous call activity on the unit. [CSCdj14683]
- You cannot route AppleTalk with EIGRP on a Cisco 1005. [CSCdj09990]
- Spurious memory access may occur due to uninitialized idb sub-block. There is no workaround. [CSCdj12071]
- A memory leak can occur when an ARAP user fails to connect due to initialization failure. [CSCdj14393]
- AppleTalk may crash on a Cisco 4000 series platform, due to low stack. There is no work around. [CSCdj15680]
- Configuring advanced queueing algorithms on a Cisco 7000 series router caused failures in IP Multicast Fast switching. To workaround this problem, use the no ip mroute-cache or no fair-queue command. [CSCdi65270]
- On a Cisco 2511 system that is configured with multiple TACACS server hosts, when the directed-request servers are down, the router traverses the entire list of configured TACACS servers before determining that TACACS is not available to use for AAA. Because directed TACACS users use a AAA system that is different from what default users use, when both directed TACACS servers are down, user authentication fails. [CSCdi92011]
- When the ntp broadcast client command is enabled, packet buffer leaks may occur unexpectedly. Deconfigure the command if this condition occurs. [CSCdj03162]
- When using compression and traffic shaping over frame relay, the traffic shaping uses uncompressed data volumes to calculate load. [CSCdj04312]
- The command copy tftp flash will fail with a TFTP "timed out" error message if the command is used between two routers running 11.1(10) (or later) and 11.2 respectively. [CSCdj05552]
- The nexthop address in the flow data export record might incorrectly be output as 0.0.0.0. [CSCdj09896]
- If you have an FDDI interface installed on an RSP router, you may see bad input packets on interfaces which are using the same pool of MEMD buffers. There will be up to one input failure per SMT frame input over each FDDI interface.
- A workaround is to execute the command test rsp cache memd-fastswitch uncache each time the router is rebooted. [CSCdj10028]
- The command encapsulation frame-relay cisco erroneously causes fast-switching. The workaround is to use encapsulation frame-relay ietf. [CSCdj11883]
- Sometimes, alignment warnings may appear if you are fastswitching with custom or priority queueing enabled. These warnings signal that extra CPU cycles are necessary to process the packet. Despite the warnings, the packet is still switched correctly. [CSCdj12269]
- Even if the rlogin command has its privilege altered to level 0, it will still be treated as though its privilege level is 1 by AAA command authorization. [CSCdj14206]
- If a Catalyst 3000 on an adjacent network without any protocol address configured sends CDP updates, the command show cdp neighbor detail may reset the router. [CSCdj15708]
- QLLC cannot use X.25 PVCs for DLSw+. The workaround is to use RSRB or to use X.25 SVCs. [CSCdi58735]
- A Cisco 7000 or 7500 series router might erroneously put the Cisco 1000 series product ID in NMVT, instead of the Cisco 7500 or 7000 series product ID. [CSCdi66847]
- Certain interface processors send up a set of logger messages which contain the details of a fatal error condition that has been detected on that card. Under some circumstances, the Cisco IOS software resets the card before all the messages have been retrieved and displayed. This results in a loss of useful information necessary to debug the fatal error that occurred on the interface processor. [CSCdi86708]
- Source-route bridging over FDDI might not pass all frames following the spanning or all-routes explorer frames. A workaround is to run Release 11.1(8)CA1. [CSCdi92160]
- A DLUR router will erroneously tear down the downstream link when it receives a dactpu "not final use" message for the downstream PU. [CSCdi92973]
- When both BNN and BAN sessions are configured on the same SLDC interface, all sessions will come down when the user deconfigures the BAN sessions. This is disruptive to existing BNN sessions. [CSCdj00497]
- The SDLC output queue can get stuck if the sdlc line-speed command is not set or if it is set to an incorrect value. The symptom is that the router stops sending SDLC frames out the serial interface, resulting in SNA session drops. The interface needs to be recycled or reset to clear the condition. The workaround is to configure the sdlc line-speed parameter to be equal to the actual line speed being used. [CSCdj01434]
- The Cisco 2520, 2521, 2522, and 2523 routers may report SDLC abort frames on low-speed ports that do not get reported on the high-speed ports or other platforms. This is because the low-speed ports count all aborts and the high-speed ports and other platforms count only aborts that are longer than 2 bytes. This is cosmetic and does not result in retransmitted frames. There is no performance impact. It is merely an indication that the transmitting device is sending erroneous bits after the trailing flag. These bits are simply ignored. No workaround is necessary. [CSCdj01488]
- A router configured for DSPU may crash with the error "Software forced crash, PC 0x31598BC" if end stations are continually activating and deactivating. [CSCdj02005]
- APPN links over RSRB might not connect if started simultaneously. A workaround is to start only one side of the link or the other. [CSCdj03501]
- In certain cases where the LU gets disconnected, VTAM could get stuck in PALUC state since the DACTLU was not being properly handled. [CSCdj03737]
- When the first connection to an SDLC-attached OS/2 system in a FRAS BNN environment fails, a successful connection can be made only by issuing the shutdown and no shutdown commands on the router's SDLC interface. [CSCdj04321]
- Cisco IOS software improperly ignores IPX SAP packets received from a VIP/4R Token Ring interface, if the SAP packets have a destination MAC address of "all stations broadcast" and a RIF (routing information field). [CSCdj04552]
- When configuration changes are made in a TN3270 server such that a new PU is added that uses a new IP address, very rarely a failure might happen and the following message is displayed:
%CIP3-3-MSG: %MEMD-3-VCNREGISTER: Invalid VCN (65535)specified
- The failing "Invalid VCN number" could be different than 65535.
- Also, you might see the following message if SSP is being used:
%SYS-6-STACKLOW: Stack for process SSE Manager running low...
- The failure continues until the Route Processor is reloaded. There is no known workaround. [CSCdj07773]
- The router crashes when the backup code is invoked and either a no fras backup dlsw or a no fras backup rsrb command is issued. For example, the router crashes when the serial line to the Frame Relay cloud is lost, and backup is configured. [CSCdj08577]
- A buffer leak causes a crash when NSP is used over DLUR. [CSCdj10387]
- NetBIOS sessions might be unable to come up in a busy system. [CSCdj11152]
- Running DLSW and RSRB in the same router with LAN Manager can cause disruption of the LAN Manager on the RSRB connections. [CSCdj11691]
- Using QLLC/DLSw+, QLLC connections fail to be established when non-default SAPs are used. [CSCdj14080]
- In PU4/5 to PU4/5 environments, if both devices send XID NULL at the same time, a DLSw circuit will not connect. [CSCdj14201]
- The Cisco implementation of DLSw appears to shift the lf bits in the SSP header, when peering to other vendors' DLSw implementations. This may cause circuits to connect using a smaller, non-optimal largest frame size, or may cause circuits not to be able to connect at all. [CSCdj17372]
- Under heavy load conditions, it is possible for the keepalive timer to go off and cause resets on the Token Ring interface. [CSCdi88713]
- When the dialer dtr command is configured, the router does not raise the DTR signal. [CSCdi92812]
- A problem occurs when the VIP2 FIFO buffers overflow, causing a write of data to SRAM to silently fail. This failure may cause a number of protocol-related failures, including but not limited to TCP checksum errors and other possible packet data errors. This problem is not limited to any particular network configuration, traffic load or other specific circumstances. [CSCdj08722]
- A problem occurs when the FDDI port adapter experiences a receive ring overrun under heavy traffic load with packet sizes larger than 512 bytes. This may cause a number of protocol-related failures including, but not limited to, TCP checksum errors and other possible packet data errors.
- There is no manual avoidance - all customers using VIP2/FDDI port adapters are strongly encouraged to upgrade to an image containing this bug fix. Refer to Field Alert: VIP2 Cisco Software Release Deferrals for image availability and additional information. [CSCdj09576]
- When the 90-compatible OUI is used on a source-bridge transparent command, the command is accepted and translational bridging operates correctly. A display of the configuration shows the OUI option as "90compat" instead of "90-compatible." If the router is reloaded, an error message is generated pointing to the "c" in "90compat" and the resulting configuration does not have the source-bridge transparent command included. If the command with the 90-compatible OUI is configured again, normal operation is restored. [CSCdj09688]
- On a Cisco 4000 series router, when a serial interface is configured as half-duplex, but the shut and no shut commands are issued for some other serial interface used in full duplex, then the router might become unresponsive. You must power-cycle the router. [CSCdj13056]
- PA-4R Token Ring interfaces will not completely initialize on VIP1 based Cisco 7000 systems. Attempts to initialize an interface with the no shutdown configuration command will cause the interface to go into the "initializing" state indefinitely. TRIP and RSP based VIP2 PA-4R Token Ring interfaces are not affected by this problem. [CSCdj17807]
- Systems running OSPF might experience a software-forced crash. There is no known workaround. [CSCdi81510]
- Internal BGP, which uses confederations, might see an apparent routing loop. This problem has been observed in two routers which are running different Cisco IOS software images. [CSCdj08110]
- If static routes are entered with the ip route command, the routes may be lost from the Enhanced IGRP topology table if they are a subnet of a network that is advertised as unreachable. However, such static routes will continue to show up in the IP routing table. [CSCdj09571]
- An RSP2 might unexpectedly reload. [CSCdj11540]
- In a router with a Simplex interface configuration, IP route cache is invalidated on the RECEIVE interface only. The IP route cache should also be invalidated for the TRANSMIT interface. [CSCdj11960]
- A multicast boundary on an incoming interface does not stop a router from giving packets to its local process, even though these packets cannot be forwarded out any interface due to this boundary. [CSCdj12030]
- The ip nhrp map command on a tunnel interface is incorrectly parsed to add an unnecessary IP mask. The workaround is to always specify the mask, and to reenter the ip nhrp maps command without masks. [CSCdj13220]
- A router will crash if you configure the maximum IRDP advertisement interval and minimum advertisement interval with the same value, as in this example:
interface e1
ip irdp
ip irdp max 10
ip irdp min 10
- The workaround is to specify different values for maximum and minimum advertisement values. [CSCdj14903]
- The system may reload if AppleTalk is enabled on ATM interfaces. No workaround is available. This caveat is introduced in 11.2(6.2) and a related caveat is CSCdj16317. [CSCdj18531]
- Illegal LAT STOP slots may be sent if a line is disconnected immediately after initiating a LAT connection. This is more likely to be seen when using protocol translation. These illegal slots cause the LAT virtual circuit to be disconnected, affecting all connections to the host. [CSCdj09876]
- XNS routing over non-LANE ATM interfaces creates a cache entry which is never used and never freed; this may result in memory starvation. A workaround is to disable XNS route-cache on the non-LANE ATM interfaces. [CSCdj09666]
- The distribute-sap-list command does not work when used to filter SAPs into an IPX routing protocol instance. You can work around this problem by filtering the same SAPs when they get redistributed, using the distribute-sap-list out command. [CSCdj15889]
- IPX cache corruption occurs when you have two Fast Ethernets in a VIP carrier (one configured for ISL) connecting to a single server with dual NICs (different external numbers, same frame type), and IPX max-paths set to 2. A workaround is to disable fast-switching for IPX. [CSCdj17470]
- Systems doing vty-async protocol translation of SLIP or PPP over X.25 may unexpectedly restart when the incoming connection is closed, due to a race condition. This problem was introduced in 11.2(6). [CSCdj15471]
- Cisco devices running small numbers of outgoing Telnet sessions (for example, a Cisco device used as a terminal server) will show unexpectedly high CPU utilizations. This is partly because of the way CPU usage is measured, and is not cause for too much concern. This problem was introduced in 11.2(6). [CSCdj11528]
- A Cisco 4000 series router with MBRI runs out of LIF timer blocks and NLCBs, and the ISDN interface goes up and then down. [CSCdi75469]
- Incoming calls may be blocked when lines are available. This problem starts after the router has been in use for several hours. Issuing a debug q931 command displays the following:
ISDN Se1:23: RX <- SETUP pd =3D 8 callref =3D 0x0338
Bearer Capability i =3D 0x8090A2
Channel ID i =3D 0xA98395
Called Party Number i =3D 0xC1, '2817924'
ISDN Se1:23: Incoming call id =3D 0x137D
ISDN Se1:23: TX - RELEASE_COMP pd =3D 8 callref =3D 0x83
Cause i =3D 0x80AC01 - Requested channel not available
- As a workaround, configuring scheduler interval 2500 has been effective in controlling or eliminating the problem. [CSCdi85735]
- When running over X.25, ISIS should extract the called X.121 address and use it as the SNPA. If the x25 suppress-calling command is configured on the router, ISIS does not seem to find any called address, nor can it find the SNPA. Apparently, the routine that extracts the X.121 address fails if the calling address is not present. [CSCdj00315]
- An asynchronous controller might hang and cause modems to go into a hang state. [CSCdj01441]
- This DDTS duplicates CSCdj02168, CSCdj07119, CSCdj08187 and CSCdi82010. AS5200 platforms might have hung calls; the ISDN data structure causes memory leaks and an inability to either call out or accept incoming calls.
- Other ISDN platforms are affected by this bug are described in CSCdj07119 or CSCdi82010, depending upon their particular ISDN usage characteristics. [CSCdj05355]
- Deleting a subinterface causes the main interface and associated subinterfaces to vanish from the configuration. This happens when the main interface uses Frame Relay encapsulation and is a member of a channel group. A workaround is to recreate the main interface by issuing the interface serial command. [CSCdj05415]
- A router reacts incorrectly to REJ frames. Frames seem to be queued and sent twice. CSCdj08607]
- A router may reload without producing a stack trace, or might otherwise behave unpredictably, when routing an X.25 call that contains 16 bytes of Call User Data. There is no known workaround. [CSCdj10216]
- When static le-ARP entries are configured on an ATM subinterface, a router might crash if there is no LANE client on the sub-interface. [CSCdj10839]
- The number of available B channels is incorrectly incremented by the total number of B channels per interface whenever the controller or the interface is reset. This results in the dialer attempting to place calls incorrectly on resources that are actually in use. [CSCdj11181]
- Low-speed synchronous/asynchronous ports are unable to receive packets bigger than 1500 bytes. The workaround is to set the MTU on both sides of the link to less than 1498. [CSCdj11304]
- NetBIOS NBF over asynchronous interfaces does not seem to work correctly after session initialization. [CSCdj12468]
- A reload might be forced if you issue the command show dialer interface x, where x is a PRI, BRI, or dialer interface configured for multilink PPP. A work around is to use show dialer without the interface option. [CSCdj13446]
- A router sometimes fails to install dynamic dialer maps for inbound asynchronous PPP peers. This failure occurs when the router is configured for both inbound and outbound asynchronous dialing using legacy DDR, and when the remote peer is authenticated in character mode and then launched into packet mode from the router's EXEC mode.
- A workaround for this is to use PPP authentication and configure the autoselect ppp command on the lines. [CSCdj14047]
- When the router receives an incorrectly formed LCP NAK frame, a "software forced crash" might occur. The actual problem is in the peer PPP software, but Cisco IOS software will be enhanced in a future release to handle such frames. [CSCdj15209]
This section describes possibly unexpected behavior by Releases 11.2(5) and 11.2(5)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(5) and 11.2(5)P. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(5) and 11.2(5)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Releases 11.2(6) and 11.2(6)P.
- When using RSP code with HIP, TRIP, or FIP interfaces, and when the MTU is larger than 4096 bytes on TRIP or FIP interfaces or larger than 8192 on HIP interfaces, there is a rare chance that a system error might occur. When this happens, the error message "CYBus error 8" or "CYBus error 10" is displayed. [CSCdi75522]
- Packets might not be switched over a GRE tunnel, if access lists are applied to the input interfaces. After an incoming packet has been encapsulated for a tunnel, the access list check could prevent the packet from being switched. This is caused by the access list checking the new source of the tunnel packet, resulting from the encapsulation, against the interface the packet arrived on. To work around this problem, disable access lists on the input interfaces or add the tunnel source address to the access list. [CSCdi87500]
- For Cisco 7500 series routers with multiple VIPs, if a crypto map is applied to even one interface of any VIP, one or more VIPs will crash. [CSCdi88459]
- A hold-queue length out command will not be accepted if the output interface is configured for fair queueing. Fair queueing is the default queueing mode for low-speed (less than 2Mbps) serial interfaces.
- The hold-queue command is intended to configure the number of output hold queue buffers for FIFO (or FCFS) queueing. It has no meaning in the context of fair queueing. So the (intentional) design was that this command would be ignored when fair queueing was enabled.
- When fair queueing has been configured, you may use the fair-queue command to control the number of output buffers which may be used by fair queueing. [CSCdj01870]
- Telnet sessions may pause for up to 20 seconds at a time. Any keystroke will break the pause. [CSCdj06450]
- An error was introduced by CSCdi75522, but only in Release 11.2. Releases beginning with 11.2(4.5), 11.2(4.5)F and 11.2(4.5)P have this error.
- A symptom of this bug is intermittent dropping of datagrams through a TRIP, FIP, or HIP interface on a Cisco 7500. Another symptom is the console message "CYBus Error 08, invalid page map register." This problem does not apply to VIP interface processors on Cisco 7500 series routers. [CSCdj06955]
- On RSP systems, when maximum-size MTU packets are received by serial interface processors (including the FSIP, HIP, MIP, POSIP, and serial port adapters on VIPs that forward data to the RSP to be routed), up to 8 bytes of data might be written into the next datagram's packet memory. This could result in anomalous system behavior, including software-caused system crashes and dropped datagrams. This problem is never seen on RSP systems that do not have serial interfaces. [CSCdj08573]
- The command ntp broadcast is lost after a reload. [CSCdj09473]
- The output of the show tech-support command displays some potentially sensitive SNMP data, such as the SNMP community strings, SNMP MD5 keys, and SNMP user IDs and passwords. If these data refer to read-write communities or views, they can be used to reconfigure the Cisco IOS software, providing the same level of access to the Cisco IOS software as is available with the enable password. Take care when sending show tech-support command output across insecure channels. For example, remove the community strings, keys, and user IDs and passwords before sending. [CSCdj06881]
- A router crash is caused by the SP microcode on a Cisco 7000 series router, whereby a buffer copy by the SP makes the RP wait too long and it takes a bus error.
- There is precedence for this problem and the fix is to lower the size of the block of data being copied at any one time. [CSCdi77785]
- When running DLSw+/LLC2 over FDDI, on receiving a REJ frame from an FDDI end station, the router sends a corrupted retransmitted I-frame. The last byte of the SMAC is replaced by the DMAC value. [CSCdi91063]
- When an end station caches RIFs that it learns from broadcasts or when there are duplicate MAC addresses on each side of the DLSw cloud, DLSw will local-switch circuits between two local SRB-capable interfaces, thereby degrading SRB performance. [CSCdi91204]
- Source-route bridging over FDDI may not be passing all frames following the spanning or all-routes explorers. This problem occurs in Release 11.1(9) and Release 11.2. A workaround is to run Release 11.1(8)CA1. [CSCdi92160]
- A race condition may occur during session cleanup, which causes the DLUR router to crash or display a "Mfreeing bad storage" message for the "psp00" process. [CSCdj02249]
- Exclusively configuring DLSw+ with the icanreach netbios-name command prevents some applications, including Microsoft Windows applications, from making NetBIOS connections. The workaround is to add an asterisk (*) to the end of the NetBIOS names configured with the icanreach netbios-name command. [CSCdj04936]
- The router crashes when either a no fras backup dlsw or no fras backup rsrb command is issued only when the backup code is invoked, for example, when the serial line to the frame relay cloud is lost, and backup is configured. When the no backup command is used, the cleanup for the backup functions is invoked. The problem is that the backup function removes the lan-cep, instead of the backup-cep. When the lan-cep structure is referenced, the structure is garbage, and the router crashes. No workaround at this point. [CSCdj08577]
- Sometimes when DLSw is required to verify the NetBIOS reachability cache entry, there may be a 1-second delay before a NetBIOS FIND_NAME message is forwarded to the LAN interface. [CSCdj09865]
- The DLUR router may send a corrupt APPC frame to a DLUS if a timing window is hit when accessing multiple DLUSs. This problem may occur if there is both a primary and a backup DLUS configured and at least one PU that cannot get in to the primary DLUS (PU inactive) while other PUs are active with the primary DLUS.
- This problem may cause VTAM to refuse to activate subsequent DLUR/DLUS pipes for all DLUR NNs. "/d net,dlurs" shows the DLUS conwinner state as reset and the conloser as active.
- The workaround to prevent the DLUR router from sending this corrupt frame is to reconfigure the DLUR routers without a backup DLUS coded. [CSCdj10485]
- IPX with integrated routing and bridging (IRB) does not work over serial interfaces if the encapsulation on BVI interface for IPX is 802.2(SAP) and 802.3(Novell-ethernet), encap arap(ethernet_ii) works fine. This problem occurs when a serial interface is configured for bridging, Ethernet interface is configured for IPX routing, and IRB is enabled to transport bridging IPX traffic to routing interface. [CSCdi56417]
- When a router is configured as a RARP server and is also configured for transparent bridging on the same interface, the router does not respond to reverse ARP requests.
- The fix to this problem means that the router box can provide RARP service if configured as a RARP server regardless of its being configured as later 2 bridge only. [CSCdi83480]
- A Cisco 7200 series router configured for HSRP on an Ethernet interface may send duplicate packets out the interface. [CSCdi85866]
- FDDI interfaces might stop accepting multicast packets. [CSCdi92156]
- Packets destined to the HSRP virtual MAC address will not be routed if received on a 802.10 subinterface. [CSCdj01435]
- When configuring IPX routing, a serial interface running BSTUN might be put into a down state and then come back up. Restarting the host session will bring the end-end connection back up. [CSCdj02488]
- Transparent bridging may cause high CPU utilization in Releases 11.1(8) and 11.2. A show align command can be used to confirm whether large "counts" of alignment errors are the source of the problem. The show align command also yields trace information that can be decoded to determine the source of the problem. [CSCdj03267]
- 802.10 encapsulation does not work over serial interface as it should be for Cisco 7500 and Cisco 7000 series routers. [CSCdj04777]
- If a router is running out of memory while running OSPF, OSPF does not check to see if one of its structures has been properly allocated. This may result in a SegV exception, thus causing the router to reload. [CSCdi64972]
- When fast switching is enabled on the system, an incorrect SVC may be created for NHRP path. A workaround is to disable fast switching. [CSCdi75617]
- If type 5 LSA exists, OSPF crashes if all the configured areas are removed by the no area area-id commands. [CSCdi78012]
- The system might reload after a show ip bgp inconsistent-as command is executed. [CSCdi88669]
- A Cisco 4500 router might reload with the following message:
System was restarted by bus error at PC 0x601E4CD0, address 0xD0D0D0D
4500 Software (C4500-P-M), Version 10.3(16), RELEASE SOFTWARE (fc1)
Compiled Thu 24-Oct-96 18:32 by richardd (current version)
Image text-base: 0x600087E0, data-base: 0x60370000
- The stack trace from system failure is as follows:
FP: 0x605D46B8, RA: 0x601E4CD0
FP: 0x605D46D8, RA: 0x601E4D88
FP: 0x605D46F8, RA: 0x601E50EC
FP: 0x605D4710, RA: 0x601C88E0
FP: 0x605D4740, RA: 0x601E4998
FP: 0x605D4760, RA: 0x601E5174
FP: 0x605D4778, RA: 0x60081D04
FP: 0x605D47B8, RA: 0x6006C8A4
- This stack track decodes as follows:
Symbols
nhrp_cache_clear_nei
nhrp_cache_clear_nei
nhrp_cache_delete_subr
nhrp_cache_age_subr
rn_walktree_blocking_list
nhrp_cache_walk
nhrp_cache_age
registry_list
net_oneminute
- [CSCdi90523]
- An extended access list that denies IP traffic and that does not require transport layer information may let fragments go through if the log option is configured. As a workaround, do not configure the log option. [CSCdj00711]
- After major topology changes, it is possible that the OSPF neighbor list is corrupted. The show ip ospf neighbor command might show that OSPF has adjacency with itself. This prevents OSPF from establishing adjacency with other routers on the network. More seriously, this could lead to router crash. [CSCdj01682]
- The router will crash in nhrp_find_nhs when attempting to access a network that is not being served by NHS. [CSCdj03224]
- IGRP is erroneously accepting a majornet route over an interface that is directly connected to a different majornet. [CSCdj03421]
- When the LSA with the host bits is generated, OSPF ABR handles the LSA incorrectly and reports the OSPF-3-DBEXIST error message for type 3 LSAs. [CSCdj08699]
- When a router running NLSP receives an IPX aggregate route, SAPs whose source networks match that aggregate route will be installed into the SAP with a route hop count of 255, making those services unreachable. [CSCdi91209]
- If IPXWAN is configured and the remote router is configured to allow IPXWAN Client mode, the local router will reset the link upon receiving the IPXWAN Timer Request. IPXWAN debugging will show "IPXWAN: Rcv TIMER_REQ reject Router asking for Client mode." The workaround is to disable IXPWAN Client mode negotiation on the remote router. [CSCdi93285]
- When routing IPX packets between Ethernet segments using different IPX encapsulations, a "TOOBIG" traceback might be generated when a maximum size Ethernet packet from one segment is routed to another Ethernet segment with a slightly larger IPX encapsulation size---for example, when going from Ethernet_802.3 (Novell-ether) to Ethernet_802.2 (SAP). No actual Giant packet is sent; the large packet is dropped as part of the traceback warning message. [CSCdj00849]
- On a Cisco 7200 series router running Release 11.1 or 11.2, fast switching IPX traffic to a GRE tunnel can cause unexpected system reload. The workaround is to disable fast switching on the tunnel. [CSCdj01107]
- Connected routes are not redistributed to IPX Enhanced IGRP with the proper metrics. This may cause the remote routers to use a suboptimal route if there are multiple autonomous systems configured and routes are mutually redistributed. [CSCdj04141]
- In an NLSP environment, when a more distant route is replaced by a better route, two routes for the same network might be advertised by RIP. [CSCdj04543]
- A router might reload if the no redistribute eigrp autonomous-system-number command is given under the ipx router eigrp command with a wrong autonomous system number. [CSCdj06394]
- The IPX route table may be incomplete after an interface is shut down and more than one IPX Enhanced IGRP autonomous system is configured. [CSCdj07334]
- The router may reload if NLSP is disabled on an interface. [CSCdj08009]
- The initiation of Telnet or other TCP connection may fail with the error message "%Out of local ports." A workaround is to attempt the connection a second time. [CSCdi60974]
- A TCP packet still in use may accidentally get freed in IP when the packet is going out a Frame Relay interface on which TCP header compression is configured. When this happens, the following messages are logged on console:
Mar 19 08:41:23: %TCP-2-BADREFCNT: Tty0: Bad refcnt for packet 0x608F9C2C during retransmit, 135.135.100.1:1998 to 135.135.105.1:11000, state 4
-Traceback= 601EEB7C 601EEEA4 601F1B68 601F1E4C 6013F140 6013F12C
Mar 19 08:41:50: %X25-4-VCLOSTSYNC: Interface Serial3, VC 82 TCP connection corrupted
Mar 19 08:41:52:
TCP0: extra packet reference for pak 0x60A031D8 found:
Mar 19 08:41:52: %TCP-2-BADQUEUE: Multiple entry for packet 60A031D8
-Process= "TCP Driver", ipl= 0, pid= 26
-Traceback= 601F3384 601F5408 6023CCB4 6023D214 6013F140 6013F12C
Mar 19 08:41:52: pak: 135.135.100.1:1998, 135.135.1.4:11137, seq 1668710213 length 47
Mar 19 08:41:52: TCB: 135.135.100.1:1998, 135.135.1.13:11137, sendnext 1668710220, state 4
- [CSCdj06781]
- On lines running software flow control without modem control, attached devices may get stuck in a flow-controlled state if the Cisco TTY is reset while it is flow-controlling the attached device. [CSCdi60204]
- When using Frame Relay IETF encapsulation, bridging fails for Token Ring-to-serial-to-Token Ring connections. [CSCdi70653]
- The dialer hold-queue command does not queue packets when it is used with dialer profiles. As a workaround, use the legacy DDR configuration, not dialer profiles. [CSCdi84272]
- When using LAN Extender devices on a Cisco 4500, Cisco 4700, Cisco 7200, or Cisco 7500 systems, you may see a SPURIOUS error message. [CSCdi86587]
- A Cisco 4700 might repeat the following error messages:
%SYS-2-INPUTQ: INPUTQ set, but no idb, ptr=60C43314 -Traceback= 60037A78 60039F6C 6003EF98
- There is no workaround. [CSCdi87914]
- If a no shutdown command is entered for a Group Async interface, the router might reload. [CSCdi91037]
- When using AAA accounting, a message similar to the following may be displayed:
%AAAA-3-BADSTR: Bad accounting data: too many attributes
- [CSCdj00190]
- When two routers are connected by an encrypted leased line and an ISDN backup line, if the leased line drops, the ISDN link comes up fine. However, when the leased line comes back up again, the router that placed the ISDN call crashes. [CSCdj00310]
- In some rare occasions, especially when a network management station is frequently polling Frame Relay MIB data (of the frCircuitTable) from a router being reloaded and just trying to come up, a crash might occur. [CSCdj00447]
- When the Cisco router is configured for AAA accounting and it has agreed to authenticate with CHAP, each CHAP Challenge results in an accounting attribute being created. If the peer implements the optional mechanism to repeatedly authenticate the peer with multiple CHAP Challenges, this may eventually result in the "AAAA-3-BADSTR, Too many attributes" message. [CSCdj03234]
- It is possible for the last X.25 fragment to have the M-Bit set improperly when the packet is full, but no additional data is to be sent. [CSCdj03488]
- When IRB is enabled and a BVI interface is configured, traffic through an ATM interface will cause the ATM input queue to wedge, while the BVI input queue will display negative numbers. [CSCdj04025]
- For TS014 (Australia, PRI) switch types, the following might happen: When a clear collision occurs between the CE and the network simultaneously transferring a DISCONNECT message specifying the same call, the call is not properly cleared. Neither side sends the RELEASE message to release the call, and hence the call reference and the associated call control block (CCB). [CSCdj06157]
- When you are modifying the LANE database, if you lose the Telnet session to the router, the database locks up. This is not a bug in the LANE code. A dead Telnet session takes approximately 5 to 8 minutes to be detected from the live side. Once it is detected, the live side cleans up and releases the lock. This is a Telnet feature and has nothing to do with the LANE database. The workaround is to reload the router. [CSCdj06660]
- When the CPU is very busy and running many processes, an attached ATM switch may tear down SSCOP and all SVCs because the SSCOP Poll PDUs sent by the switch are not serviced in time. The workaround is to keep other processes from using too much of the CPU. [CSCdj06928]
This section describes possibly unexpected behavior by Releases 11.2(4), 11.2(4)P, and 11.2(4)F. Unless otherwise noted, these caveats apply to all 11.2, 11.2 P, and 11.2 F releases up to and including 11.2(4), 11.2(4)P, and 11.2(4)F. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(4), 11.2(4)P, and 11.2(4)F, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Releases 11.2(5) and 11.2(5)P.
- Under certain circumstances a Cisco AS5200 might reboot with the following message, visible via the show version EXEC command:
System restarted by bus error at PC <hex number, address <hex number
- The circumstances that might lead to this event are (in the order shown):
- Have active calls on a particular DSX1 (T1/E1) interface.
- Change the DSX1 controller pri-group timeslots configuration for this particular interface. For example, the following sequence:
config terminal
controller t1 0
pri-group timeslots 1-4
- Shutdown the DSX1 controller via the shutdown interface configuration command. [CSCdi88556]
- When you execute the show modem log command on an AS5200 access server, it may crash with a bus error. [CSCdi91563]
- On RSP systems, the router reloads with a SegV error when trying to free a misqueued buffer or a buffer that is an invalid size. The buffer might contain a bad packet passed to it from another router. [CSCdi74039]
- Ethernet interfaces might experience XBUFHDR and INVRTN errors. [CSCdi75404]
- On RSP systems with HIP, TRIP, or FIP interfaces, when the MTU is larger than 4096 bytes on TRIP or FIP interfaces or larger than 8192 on HIP interfaces, there is a rare chance that a system error might occur. When this happens, the message "CYBus error 8" or "CYBus error 10" is displayed. [CSCdi75522]
- The router may reload inadvertently if you respond improperly to extended ping dialog prompts. [CSCdi88443]
- A memory leak occurs whenever TACACS+ is enabled. Memory is released to the EXEC process as seen via the show memory command. The leak appears to have originated in Release 11.0(10) and affects Cisco IOS software released thereafter. [CSCdi89479]
- Under some circumstances, processing an SNMP Get request might result in a message similar to the following being displayed on the console:
%SNMP-3-CPUHOG: Processing Get of lifEntry.75.34
- [CSCdi93084]
- SNMP traps process can consume memory if presented with a large number of traps to deliver. [CSCdj02181]
- Under unknown circumstances, the router might restart due to a Bus Error. [CSCdj02493]
- On CIP cards, it is possible to see the adapter type from the show interface command, but this information and version information are not available from the show controller cbus command. [CSCdi26192]
- In extremely rare circumstances, the router might crash while removing RSRB peers. This might occur only when running an AGS+ and the CSC1R/CSC2R Token Ring boards. [CSCdi39270]
- The following problem has been observed in STUN/local acknowledgment scenarios involving AS/400s: The remote router expects to see an OPCODE called LINK_ESTABLISHED from the host router in order for it to transition the state from USBUSY to CONNECT. While in USBUSY state, the remote router continually sends RNR to the downstream devices. The host router will only send the OPCODE once it sees the first RR/P after a SNRM/UA exchange sequence. With other devices such as a FEP, an I-Frame can be sent prior to the RR/P, which would actually take the remote router state out of USBUSY, but the local acknowledgment states were not corresponding to the actual situation at hand. This problem was partially fixed when CSCdi65599 was fixed. Additional "checking" code was added for exceptional state cases. A workaround is to use a Cisco IOS releases that include the fix for CSCdi65599. [CSCdi61514]
- You may experience connection problems with stations running NetBIOS under very old releases of DOS. The only workaround is to use the latest NetBIOS drivers available for the workstation. An indication that you may be experiencing this problem is that Windows and OS/2 stations can establish sessions properly, but your DOS-based stations cannot. [CSCdi83982]
- In a QLLC environment, connection using a virtual MAC address from a pool of virtual MAC addresses may cause a connection to the wrong resource on the mainframe. [CSCdi86358]
- An invalid packet might be received from the VTAM NN, resulting in the CP-CP session being torn down. [CSCdi87217]
- When using NSP over DLUR, the router may leak small buffers. [CSCdi87320]
- When source-route bridging is enabled on a Cisco 7500 router in a Token Ring environment, if the router receives a packet that is to be routed but that contains a RIF, the router misclassifies the packet, treating it as a source-route bridge packet, which causes it to be discarded. This may cause intermittent failures of routed protocol sessions. There is no known workaround. [CSCdi87321]
- For LU0-LU0 traffic the extended BIND may contain unformatted user data fields. The NN rejects the BIND and hence the session will never start. [CSCdi87365]
- Configuring the output-lsap-list command on the local Token Ring interfaces does not block broadcast traffic from a DLSW peer. The workaround is to use a filter at the DLSW level on either router or to block the traffic with an input-lsap-filter command at the remote peer. [CSCdi88593]
- When running multiple, large file transfers across DLSW using FST, transport sequence errors may occur causing the job to abort. This can be seen using the show dlsw peer command. A sequence error occurs when a numbered FST (IP) packet is received by the DLSw peer and the sequence number does not match what the peer expects. [CSCdi89838]
- The DLUR router may fail to establish new LU-LU sessions after encountering a race condition during session activation and deactivation. Messages similar to the following may be displayed on the router console when attempting to start new sessions. APPN must be stopped and restarted to clear the problem:
IPS ID: 1400 QUEUE: 2 ORIGIN: xxxpcs00 MUTYPE: C5
%APPN-0-APPNEMERG: Assertion failed in ../scm/xxximndr.c at line 158
-Process= "xxxims00", ipl= 0, pid= 58
-Traceback= 606C3488 606879EC 606818C8 606810E4 6067AF90 6019AB08 6019AAF4
- [CSCdi90117]
- PEER INVALID trace messages are displayed on the console. Also, in Releases 11.1 and 11.2, the session on the peer-on-demand does not come up for quite some time. [CSCdi90953]
- A router configured for DSPU may crash with the error "Software forced crash, PC 0x31598BC" if end stations are continually activating and deactivating. [CSCdi91368]
- On Cisco 7000 systems, packets that are fast switched from CIP to FDDI might be dropped by some Layer 2 switches because one additional byte is being added to the FDDI frame. The problem does not occur on RSP systems. A workaround is to use autonomous or process switching. [CSCdi91417]
- The router might crash if you enter the debug source error, debug llc2, or debug local command. [CSCdi92503]
- When running DLSw+ local switching from SDLC/QLLC to Token Ring/Ethernet, if the XID negotiation is delayed or ends abnormally, a memory leak may occur. [CSCdi92511]
- The DLUR router may crash with a "SegV exception" or an "Illegal access to a low address" message because of a DLUR memory corruption problem. This error results from a race condition that usually occurs when DLUR sessions are going up and down. The stack trace after the memory corruption usually indicates Mget_x. [CSCdi92947]
- The show diagnostic command does not display Fast Ethernet Interface Processor port adapter information. [CSCdi33967]
- The Cisco 7500 router in a transparent bridging environment might suffer memory fragmentation such that the largest available memory block is 120k. [CSCdi67513]
- A problem occurs when performing a getnext operation on the dot1dTpFdbTable in the Bridge MIB. A getnext will not retrieve a request of index + 1 and will instead return the lexicographically next index. An example of this behavior follows:
- If the table has the entries with indices of
- 0000.0000.0001 0000.0000.0002 0000.0000.0003 0000.0000.0005
- a getnext of 0000.0000.0002 returns the index 0000.0000.0005 because 0000.0000.0003 is the index requested + 1
- a getnext of 0000.0000.0003 returns the index 0000.0000.0005 because 0000.0000.0005 is greater than the requested index + 1. [CSCdi84559]
- A problem occurs when the router is configured for Integrated Routing and Bridging (IRB). The problem affects all platforms. A bad decision in the forwarding of packets whose destination is not in the bridge table could cause the router to reload. [CSCdi92194]
- IGMP and PIM should support multicast addresses (for example, c000.0004.0000) as configurable options on Token Ring interfaces instead of requiring broadcast address (for example, ffff.ffff.ffff). [CSCdi83845]
- Configuring OSPF NSSA (Not So Stubby Areas) may affect the way routes are redistributed into OSPF. This defect was first observed in Release 11.2(3). [CSCdi88321]
- A prefix that has the "no-export" community string set from an inbound route map is incorrectly advertised to EBGP peers. A workaround is to configure a route map to set "no-export" community on the outbound side of the peering router instead. [CSCdj01351]
- It is possible for memory corruption and memory leaks to occur when PIM packets are sent. [CSCdj02092]
- Under certain timing-related circumstances, the use of per-user routes might cause a router to reload when the interface that caused the routes to be installed goes down. This is because both the IP background process and the per-user code attempt to remove this route. [CSCdj02347]
- If minimum-sized (or sweeping-sized) CLNS pings are performed and the CLNS source and destination addresses are very long, the system may fail. The workaround is to raise the minimum ping size to at least 63 bytes. [CSCdi91040]
- When a device running LANE is configured as a LEC, it does not acknowledge any secondary IPX networks with frame types different from the primary. The debug ipx packet command displays these received packets as "bad pkt." Only packets that arrive with the same IPX frame type as the primary IPX network on the ATM interface of the router are properly accepted. [CSCdi85215]
- In a redundant IPX Enhanced IGRP network running IPX incremental SAP, the router's SAP table SAP information may contain out of date information, such as the socket number if the socket number is changed from its initial advertisement. [CSCdi85953]
- SPX keepalive spoofing will cease to spoof after a router has been up for 24+ days. The debug ipx spx-spoof command shows packets being skipped at the time when they should be spoofed. The only workaround is to reload the router once every three weeks. [CSCdi86079]
- XNS RIP requests for all networks causes normal periodic RIP updates to be delayed or skipped. [CSCdi90419]
- When IPX incremental SAP is running, the router's SAP table may not contain all the SAPs in the network if one of it interfaces goes down and comes back up later. [CSCdi90899]
- When running IPX incremental SAP, the router may not remove all the SAPs that are no longer reachable via this router. [CSCdi90907]
- A Telnet session with a nonzero number of unread input bytes cannot be cleared. [CSCdi88267]
- IP packets with valid TTLs (of varying values) received on a VIP2 serial port adapter or FSIP (both on RSP2 platform) with TCP header compression are intermittently dropped. The router sends an ICMP Time Exceeded message to the source.
- The show ip traffic command indicates that the ICMP Time Exceeded counter increments.
- A workaround is to turn off TCP header compression. [CSCdj01681]
- If you add a VINES static route of equal metric for an alternative path when the vines single-route command is configured, the system may reload. The workaround is to delete the static route or enter a no vines single-route command. [CSCdi92190]
- Under certain circumstances, a group of four serial ports on a Cisco AS5100, Cisco 2509, 2510, 2511, or 2512 router can become unresponsive. Only a reload will solve the problem. [CSCdi58103]
- In certain environments, I/O and processor memory are being consumed by processes in the router, primarily the Critical Background process, and the router runs out of memory after 29 hours of operation. [CSCdi80450]
- When using a 4ESS PRI to place an international call (011), the call might be rejected with the error "cause i = 0x839C - invalid number format." [CSCdi81069]
- Using the command no pri-group while traffic is being passed may result in a bus error. The command may be used safely when no traffic is being passed. [CSCdi82055]
- The dialer hold-queue command does not queue packets when it is used with dialer profiles. As a workaround, use the legacy DDR configuration, instead of dialer profiles. [CSCdi84272]
- Random restarts because of bus errors occur at least two to three times per day. The problem may be in the DDR software. [CSCdi86765]
- When TEST/XID packets are received by a LANE client, the router may crash. There is no workaround for this problem. [CSCdi90868]
- Under heavy call volume, the router may not return memory to the free pool when it is no longer needed. This will eventually result in a low-memory or no-memory condition, which may manifest itself in several different error messages. [CSCdj02481]
This section describes possibly unexpected behavior by Releases 11.2(3), 11.2(3)P, and 11.2(3)F. Unless otherwise noted, these caveats apply to all 11.2, 11.2 P, and 11.2 F releases up to and including 11.2(3), 11.2(3)P, and 11.2(3)F. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(3), 11.2(3)P, and 11.2(3)F, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Releases 11.2(4), 11.2(4)P and 11.2(4)F.
- In a Cisco 5200 running Release 11.2(3.0.3), if a T1 interface is placed into loopback as a result of excessive "runt" (short frame) errors, the Cisco AS5200 will not automatically recover (un-loopback) the T1 after the error condition is corrected, even though console messages may indicate this has occurred.
- It is still possible to manually un-loop the T1 via the no loopback interface configuration command. [CSCdi84028]
- The OOB port of a modem on a Cisco 5200 might become unresponsive. To recover the modem, issue a clear modem slot/port command. [CSCdi85028]
- A router will crash when an incomplete AppleTalk fast switching cache entry is used. This happens when the cache entry is updated with another output interface and within a small timing window. There is no workaround. [CSCdi77772]
- On a Cisco 7000 router, some process stacks can run low on heap space, possibly causing memory corruption under the following conditions: debug messages are enabled, logging is output to a buffer rather than to the console (via the no logging console command), OSPF is the routing protocol in use (router ospf n), routes are redistributed into OSPF from another protocol (for example, via the redistribute rip subnets command), and the OSPF or redistributed networks are in flux (flapping). Under these conditions, logging the debug messages to the console has no adverse effects. [CSCdi68387]
- The IP named access list cannot be configured via HTTP access. The command works manually (via terminal), but there is no option to enter it via the browser page access. [CSCdi79249]
- On a Cisco 7200, PCMCIA Flash card insertion or removal might, under some conditions, cause a system reload with a PCI bus system/parity error. This defect is resolved in Release 11.1(8.1), 11.2(3.1), and later releases. [CSCdi80691]
- Authenticated NTP packets will be ignored. There is no workaround to this problem. [CSCdi82459]
- A router configured with HTTP enabled, AAA enabled, login set to the default of local authentication, and a blank username will enter an infinite loop which will set off the watchdog timer, causing the router to reload. [CSCdi84663]
- Accessing a non-existent interface and then a valid interface using ClickStart may cause the router to crash. [CSCdi87125]
- Cisco 4700 router Token Ring interfaces intermittently fail. You must recycle the router to bring back the interfaces. [CSCdi70398]
- The router crashes when you enter the show lnm station command. This might happen when there are many ring status changes, for example, when stations are added to or removed from the ring. This problem is platform independent. The workaround is to disable LNM. [CSCdi72954]
- APPN alerts are currently only sent over an LU6.2 session. It is a requirement to be able to configure these alerts to be sent over a SSCP-PU NSP session. [CSCdi73663]
- When running DLSw remote or local switching between QLLC/SDLC/VDLC and a Token Ring, if the Token Ring's largest frame (lf) is less than 4472, the circuit will not connect.
- The output of debug dlsw reachability or debug dlsw reachability error indicates an lf mismatch condition detected by DLSw. This condition should not be flagged as an error. The smallest lf across the entire path should be used for the circuit. [CSCdi77805]
- If a configuration session timed out or was dropped while in a command configuration mode, the next attempt to enter that configuration mode might fail, with the following message being displayed:
The TN3270-server feature is currently being configured
- [CSCdi80173]
- A router might reload when more than 125 sessions on the router are using QLLC/DLSw+ conversion. [CSCdi84896]
- When a downstream PU2.0 stops by issuing a REQDISCONT to a DLUR router, the DLUR router may loop continuously, restarting the link to a downstream PU2. In this case, the DLUR router sends a corrupted packet to the host instead of a REQDACTPU. [CSCdi86769]
- Kille packets when bridging on an FDDI interface receive a packet with DSAP and SSAP = 0xaaaa and length less than 21 bytes, can cause havoc. On systems running Release 11.0(9.3) or 11.1(4), the following message is seen:
CBUS-3-INTERR: Interface 6, Error (8011)
- This error occurs because bridging sees "aaaa" and assumes it is SNAP encapsulated. Because SNAP-encapsulated packets have a minimum length of 21, the bridging code subtracts 21 from the original length of the packet (20) when queueing it on the outbound interface. The result is the length of an outbound packet is -1 or 65535 bytes. This causes the SP to become confused and write over low core, causing an 8011 error. [CSCdi65953]
- On Cisco 7000 series and Cisco 7500 series platforms that have FSIPs, transmitter delay does not seem to be working correctly. There is no workaround. The fix for this problem is fixed in Releases 11.2(3.1), 11.1(8.3), 11.2(3.1)F, and 11.2(3.1)P. [CSCdi72431]
- When using FDDI with subinterfaces and Secure Data Exchange (SDE) encapsulation, configuring transparent bridging on a subinterface caused OSPF to die on the complete interface. [CSCdi72969]
- On Cisco 7000 series RP/SP routers, reloading the router after adding new interfaces (IPs) or swapping different IPs in slots (for example, a FIP and a FSIP) might result in losing the configurations for the serial subinterfaces. The interface command encapsulation may also be lost. The serial interface configuration changes back to default state of HDLC.
- You can determine if this defect is affecting your system by checking the output of the show config command. If the affected interface is a serial interface (for example, FSIP or HIP), and the original configuration for the serial interface is displayed, it is this defect.
- A workaround is to EOIR the new card, configure it, and perform write memory prior to reloading. [CSCdi79523]
- When OSPF is configured with the default-information originate router command to generate default information, OSPF is prevented from installing the default information advertised by other OSPF routers. This causes a problem if OSPF does not really generate the default because a certain condition is not satisfied, for example, the gateway of last resort is not set. [CSCdi80474]
- In very obscure cases involving equal-cost backup routes to a failing route, it is possible for Enhanced IGRP to be caught in a "stuck in active" state (self-correcting after several minutes). There is no workaround to this problem. [CSCdi81791]
- OSPF can lose a neighbor periodically over a slow link when the OSPF database is refreshed, which generates many OSPF packets. There is no workaround. [CSCdi82237]
- An error might occur and cause the following messages to appear:
System restarted by error - Zero Divide, PC 0x38EF0C (0x38EF0C:_igmp_report_delay(0x38eec6)+0x46)
- [CSCdi83040]
- When using BGP, prepending autonomous system paths using an incoming route map can cause a memory shortage in the router. The workaround is to use other methods, for example, setting the neighbor weight, to influence path selection. [CSCdi84419]
- A router might advertise a combination of unicast and DVMRP routes in excess of the configured route limit (but no more that two times the limit). The workaround is to configure a lower route limit. [CSCdi85263]
- After removing a static CLNS route, ISO-IGRP prefix routes may be seen to count to infinity around a looped topology. The workaround is to use the command clns router iso-igrp domain to break the loops in the CLNS topology until the routes age out. [CSCdi78048]
- CSCdi78048 introduced a bug that ISO-IGRP will not redistribute the local ISIS route. [CSCdi85861]
- NLSP links may reflect incorrect source network/node addresses in the routing tables. This does not hinder connectivity to other IPX networks when going from a Cisco device to a Cisco device. However, certain non-Cisco routers may not correctly process the incorrect address and NLSP routing might fail. [CSCdi68981]
- Routers configuring for IPX Enhanced IGRP with parallel paths might reload. The workaround is to run IPX RIP. [CSCdi84739]
- The ipx down network-number command might appear unexpectedly in the output of a write terminal command, and this command might be written to nonvolatile memory with the write memory command when the interface is down but you have not issued an ipx down command on that interface. There is no workaround. The unwanted command does not appear when the interface is up. If the unwanted command appears in nonvolatile memory, issue a no ipx down command followed by a write memory command when the interface is up to clear the undesired command from memory. [CSCdi85453]
- IPX does not work in Release 11.2(3.2) because of CSCdi80447, which introduced a broadcast mechanism for clients on the same IPX network separated by WAN links. There is no workaround. [CSCdi85856]
- While performing TCP to X.25 protocol translation, the router might continuously try to negotiate Telnet window-size, causing high CPU utilization. [CSCdi86983]
- A router will reload if TCP tries to repacketize a packet that has an invalid packet reference count. [CSCdi87175]
- TCP data structure gets clobbered if an RST is received while the application is half way through closing the connection. The local TCP will go into an endless loop trying to send the last FIN to its peer. A typical symptom for the problem is that the CPU usage becomes very high, and the application that is doing the close will be stuck in TCP forever. [CSCdi88063]
- TCP gets into an endless ACK war with its peer, if the application on both ends has stopped reading data. A typical symptom is that CPU usage becomes very high on the router. A possible workaround for the problem is to clear the tty/vty line that owns the TCP connection in the ACK war. [CSCdi88065]
- Routers that are connected via extremely slow links that have a large routing table, for example, a table with more than 300 entries, do not receive a full routing update before the reassembly timer expires. The symptom is that routes repeatedly appear and then age out. The workaround is add access lists to eliminate some of the unneeded routes. [CSCdi79355]
- The output hold queue holds all buffers that are being kept in output queue because of traffic shaping. This slows down traffic for other VCs, causing the traffic to traverse the complete queue before it can leave the system. [CSCdi74940]
- Dial-on-demand (DDR) load balancing does not forward packets correctly when the system dials out via the dialer load-threshold command and more than one remote device is connected by either dial-out or dial-in. This problem typically occurs on a PRI with dialer load threshold configured, but may also occur on BRI or multiple DDR interfaces in a dialer rotary group when more than one remote device is connected. As a workaround, remove the dialer load-threshold command. [CSCdi76324]
- IPX fast switching with multiple route paths over multiple ATM/LANE interfaces/subinterfaces may cause random system reloads. The workaround is to use only one ATM/LANE IPX path, set ipx maximum-paths 1, or use ipx per-host-load-share to force only one interface to be used. [CSCdi77259]
- The output of the show version may indicate that the system was restarted because of a bus error at PC 0x2227A8F6, address 0xD0D0D39, when there is no apparent cause for the reload. [CSCdi83848]
This section describes possibly unexpected behavior by Releases 11.2(2) and 11.2(2)P. Unless otherwise noted, these caveats apply to all 11.2 and 11.2 P releases up to and including 11.2(2) and 11.2(2)P. The caveats listed here describe only the serious problems. For additional caveats applicable to Release 11.2(2) and 11.2(2)P, see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in Release 11.2(3) and Release 11.2(3)P.
- AGS+ routers with first generation FDDI cards (CSC-C2FCI) do not support translational bridging, and are no longer supported. They use encapsulated bridging. The second-generation AGS+ FDDI cards (CSC-C2FCIT) support both translational and encapsulated bridging.
- Encapsulated bridging does not work on the Cisco 7500 router. The workaround to bridge between the AGS+ and a Cisco 7500 router is to use CSC-C2FCIT cards in the AGS+ and configure translational bridging.
- The disadvantage of using encapsulated bridging is that it cannot use the hardware bridge filtering capabilities of the CSC-C2FCIT cards, which have a CAM built into them that is used to perform bridge filtering. When encapsulated bridging is used, the main processor must perform all bridge filtering. This means that one busy encapsulated bridging FDDI network can consume the entire bandwidth of the router's main processor, just for bridge filtering. Cisco discourages the use of encapsulated bridging. [CSCdi46862]
- In cases where an accountable task has a duration shorter than the time required to contact the TACACS+ accounting server, the stop record may be discarded without being transmitted to the server. [CSCdi70312]
- A device with RMON enabled may reload if free memory gets too low. [CSCdi74278]
- Timer-related functions, such as NTP and routing update intervals, do not work correctly in Revision D Cisco 4700 routers. Also, Revision E Cisco 4700 routers are recognized by SNMP as "4700" instead of "4700M." [CSCdi75353]
- You may experience router reload after seeing the following message:
%SYS-3-TIMERNEG: Cannot start timer (0x1E4388) with negative offset (-495928).
-Process= "Per-minute Jobs", ipl= 0, pid= 37
-Traceback= 22157D7A 22154320 221A17EA 2215F45C 2213E074
- High CPU utilization may be seen prior to the message and reload event. [CSCdi76126]
- QLLC devices that are connected through a router using QLLC/LLC2 conversion might occasionally experience poor response time. [CSCdi44923]
- In a parallel SDLLC network, the ACTPU RSP is never received by the host. [CSCdi55142]
- Online insertion and removal (OIR) of an IP in a Cisco 7500 series router equipped with a CIP and another IP that has the same size MTU as the CIP can cause the router to crash with a cBus error. [CSCdi59377]
- QLLC DLSw cannot reconnect after a failure. The following assert message is displayed:
%CLS-3-CLSFAIL: CLS: Assertion failed: file "../srt/qllc.c", line 4352 !"QSapAddCepFailed"
- [CSCdi64840]
- On a Cisco 7000 router running an RSP7000 with Release 11.1(6), CIP microcode cannot be read if it has been loaded into bootflash. The workaround is to load the CIP microcode into Flash. [CSCdi72463]
- Data-link switching (DLSw) sometimes cannot handle disconnects being issued by two stations that are in session if the stations have a requirement to reestablish a session in less than 3 seconds. The first disconnect is answered with a UA message but the second is not responded to until the station resends the disconnect message (DISC). After the DISC is resent, a DM message is sent to answer. [CSCdi73204]
- Frames coming from a High-Speed Serial Interface (HSSI) are sometimes dropped. This problem occurs when a Cisco router has remote source-route bridging (RSRB) configured direct over a HSSI interface. The HSSI interface shows that the packets are forwarded on the interface itself, but the packets are not passed to the source-route bridging (SRB) process. The show source command on FHDC-1 shows receive cnt:bytes 0, and the show interface h 5/0 command shows nonzero packets are input. [CSCdi73357]
- When many sessions are created and then torn down over an ISR network, a memory leak might occur in the router. [CSCdi73676]
- DLSw+ backup peers continue to accept new connections after the primary link is restored. This continues until the backup link is torn down when the linger time expires. [CSCdi73864]
- When running APPN over RSRB virtual stations where RSRB local acknowledgment is being used, the secondary station may hang upon sending data. The most common symptom is that only one of the two CP-CP sessions becomes active with the partner node. [CSCdi74906]
- A Cisco 7206 running Release 11.1(6.4) fails to source-route-bridge IP packets (no ip routing). The workaround is to route IP. [CSCdi75477]
- If SNA/DSPU receives a RECFMS frame that contains control vectors and the RECFMS cannot be forwarded to the focal point host for any reason (for instance, the focal point is inactive), the negative response sent by DSPU causes the router to display the BADSHARE error and deactivate the connection. [CSCdi76030]
- If a BIND request is received before the Notify response has arrived, DSPU will reject the BIND request with sense code 0x80050000. [CSCdi76085]
- When two or more FEPs at a central site, each with the same TIC address, are connected to a different Token Ring and a different DLSw peer router, a remote SDLC attached PU2.0 device will not establish a session to the back-up FEP if the first is taken offline. This problem does not affect PU2.1 devices. [CSCdi76575]
- When using DLSw+ to communicate with non-Cisco devices, the Cisco platform might not deal with incoming transport keepalive packets in an appropriate manner. [CSCdi78202]
- When stun remote-peer-keepalive is enabled in a locally acknowledged STUN-over-Frame Relay configuration, STUN peers constantly reset due to incorrect handling of STUN keepalives. [CSCdi78480]
- After SDLC sends 3 XID NULLs upstream to a host and receives no response, SDLC stops sending the XID NULLs and the SDLC device will never connect. This condition can occur if the remote peer connection is down because of a WAN connectivity outage or because the host or server is inactive and does not respond to XIDs. To clear this condition, remove the sdlc address address command from the configuration and then reconfigure this command on the SDLC interface. [CSCdi79498]
- When IP routing is configured on an ISL subinterface, the extra 26-byte ISL header reduces the maximum IP packet size that can be sent over the ISL subinterface from 1500 to 1498 bytes, 2 bytes less than the normal size. This problem is a result of the fix for CSCdi39484. [CSCdi71140]
- Cisco 3000 series routers with MK5025 serial interfaces may halt unexpectedly on system startup. There is no workaround. [CSCdi71715]
- If transparent bridging and an IP address are configured on a VIP FastEthernet or Ethernet interface, duplicate packets may occur on LANs directly connected to the VIP interface. In particular, Unicast DODIP packets between two workstations on a segment on which the VIP2 interface is attached can be incorrectly duplicated by the router. Duplicate packets can also occur when running bridging and any other protocol in this type of configuration.
- In addition, if VIP Ethernet is used with multiple unicast protocols such as HSRP, packet duplication can occur on the LAN segment. These problems can significantly degrade RSP performance. If your configuration is listed here, obtain a maintenance release that corrects this problem. [CSCdi71856]
- Under certain conditions Spanning-Tree Protocol can cause a memory leak. The symptom is small buffers being created but not released. (Created count rises but the Trims count does not in the show buffer. Also, show memory indicates that the memory available is being reduced. [CSCdi72783]
- In Cisco 7500 series routers, the following error message might be displayed while booting the system image from TFTP or Flash memory, or when changing the serial encapsulation (for example, from HDLC to SMDS) or when doing OIR of another card in the chassis:
%CBUS-3-CMDTIMEOUT: Cmd timed out, CCB 0x5800FF50, slot x, cmd code 0
- The show diag x command reports that the board is disabled, wedged. The show version command does not show the card in the specified slot. The write terminal command does not show the configuration for the card in the slot. A possible workaround is to issue a microcode reload command or load a new system image that has the fix for this bug. [CSCdi73130]
- Policy routing on a Cisco 7000 router with silicon-switching enabled does not function correctly. As a workaround, manually disable silicon-switching on each of the interfaces with the no ip route-cache sse command. [CSCdi77492]
- In a Cisco 7206 router, when source-bridge is enabled, the router may stop sending packets on the Token Ring interface. [CSCdi78494]
- ATM (RFC 1483) input queue becomes blocked with queue full 151/150. This causes the PIM process to terminate under certain conditions such as deconfigurng PIM on an interface. [CSCdi72840]
- A problem occurs when a router with a single interface is running OSPF as a broadcast/nonbroadcast network. If the single interface is shut down and is brought back up within a 5-second interval, a race condition is created that causes the router to crash (or spurious access). The crash occurs if you are running Release 11.2. In previous releases, this bug causes spurious access. [CSCdi74044]
- Configuring RSVP over an interface without configuring UDP encapsulation for RSVP can result in memory leaks.
- The workaround is to configure RSVP-UDP encapsulation for all RSVP-enabled interfaces. [CSCdi74212]
- If OSPF demand circuit feature is enabled over interface which is protocol down, the router will crash. [CSCdi74862]
- If an interface is down when it is configured as passive for IS-IS, it will not be advertised in IS-IS link state packets when the interface comes up. The workaround is to unconfigure the interface and then reconfigure it as passive after it is up. [CSCdi76431]
- On Cisco 7200 series routers, IPX fast switching of various encapsulations of IPX including IPX over ISL may produce packets that are ignored by the receiving host. A workaround is to disable IPX fast switching using the no ipx route-cache command. Note that this workaround causes increased router overhead. [CSCdi73231]
- NLSP may reflood LSP fragments unnecessarily, including both changed and unchanged fragments. Typically this is not a problem on LAN circuits. However, this can present bandwidth-related problems on low speed WAN circuits, especially as the size of the network increases.
- The flooding behavior masks a problem where services may be missing from the SAP table until the next full SPF. This is not a problem when all neighbors are Cisco routers, but can be a problem when third-party routers are present on the same link. [CSCdi74487]
- VPDN uses loopback interfaces, but IPX and SPX spoofing are not allowed on loopback interfaces. [CSCdi76227]
- When a Cisco 4500 or Cisco 7000 router is configured to use FTP or RCP to take an exception dump and an exception happens with validblock in the stack trace, the core dump operation fails and a core file cannot be obtained. As a workaround, if validblock is in the stack trace, use TFTP to take the exception dump. This means that the exception dump is limited to 16 MB. This is a known TFTP defect. [CSCdi75757]
- Non-TCP reverse connections to lines may corrupt memory, resulting in a software-forced crash. This problem was introduced starting in Releases 10.3(15.1), 11.0(11.1), and 11.1(6.1). [CSCdi79310]
- VINES broadcast packets are forwarded away from the source. If the immediate router toward the source of a broadcast packet has a neighbor entry but no associated path, the system may halt. This kind of dangling route is rare and is considered to be a timing-related issue. [CSCdi75345]
- The VIP2 might crash with a context dump that shows register $0 = 0xffffffff. The cause register and S registers might also contain 0xffffffff. The register content reflects the fact that the VIP2 is experiencing a fatal CyBus or PCI bus error and the context for the processor has not been fully saved. A workaround that allows viewing of the PCI bus or CyBus error is available on a case-by-case basis by using an undocumented, not fully supported feature of the VIP2. The fix for this problem allows the fatal error to be displayed on the RSP console. [CSCdi66567]
- PRI ISDN calls may be dropped on heavily loaded Cisco 7513 routers with multiple PRIs. The following error is displayed when this occurs: "BRI Error: isdn_fromrouter() msg dequeue NULL." [CSCdi66816]
- Some ISDN PRI NET5 switches may send a Restart message with either an invalid or an unused B channel. The router should answer the Restart message with a Restart Acknowledge message for the valid B channels. If the router does not answer the Restart message, the switch may place the ISDN PRI interface "out-of-service." [CSCdi70399]
- Routers are not able to detect VINES servers on LANE interfaces. [CSCdi72706]
- The smallest Receive block size announced by the router is 64064 instead of 1498 as it is for Ethernet. This results in a negative smallest router blocksize reported by the show decnet interface command, and in routing problems with DEC systems. These routing problems do not appear with Cisco devices used as end nodes. [CSCdi74046]
- Half-bridging of IP on DDR interfaces is broken. The symptom of this problem is that the remote devices on the bridged segment do not receive a valid reply from their ARPs to the router that is configured for IP half-bridging. [CSCdi74185]
- Half-bridging of IP over dialer interfaces associated with Dialer Profile feature is broken. The symptom is the inability of remote devices in the bridged domain to communicate with devices in the routed domain. The communication failure appears to be caused by the dialer interface failing to use a valid MAC address to answer ARP requests. [CSCdi74195]
- After a number of days PRI calls may be dropped and high ISDN CPU utilization may be seen. There may be some discrepancy between show dialer, which indicates free B channels available, and show isdn service, which shows all channels busy. Ultimately, a software-forced crash occurs. [CSCdi75167]
- IPX routing might stop working because the router cannot find any servers. This might happen because the ipx network command is parsed before LANE commands so that, after a reload, the system reports "IPX encapsulation not allowed on ATM." [CSCdi75283]
- When two routers are connected to the same destination, outbound IP fast switching on dialer interfaces does not work on the more recently connected interface. The workaround is to turn off fast switching on the DDR interfaces using the no ip route-cache command. [CSCdi75490]
- At system boot-up time the following message may appear:
%SCHED-2-WATCH: Attempt to enqueue uninitialized watched queue (address 0).
-Process= "interrupt level", ipl= 1, pid= 2
- This message means Frame Relay Inverse ARP packets are received before InARP input queue is initialized.
- This condition is harmless, but if InARP input queue is initialized later, you will not see this message except at the boot-up time. Frame Relay In ARP function will not be affected. [CSCdi75843]
- The negotiation of a PPP Callback option, passing a dial string or E.164 number, will fail due to a defect introduced into Releases 11.2(1.4), 11.1(7.1), 11.2(1.4)P, 11.2(1.4)F, and 11.0(12.1). The negotiation will appear to complete successfully, but the callback will not succeed. The failure can be seen if debug ppp negotiation is set. The callback option will be marked "acked," but there will typically be nonsensical output on the debug line between "allocated" and "acked," for example, "PPP Callback string allocated "acked." There is no workaround for this defect. [CSCdi77739]
This section describes possibly unexpected behavior by Release 11.2(1). Unless otherwise noted, these caveats apply to all 11.2 releases up to and including 11.2(1). For additional caveats applicable to Release 11.2(1), see the caveats sections for newer 11.2 releases. The caveats for newer releases precede this section.
All the caveats listed in this section are resolved in release 11.2(2).
- There has been a request for additional debugging messages for the arap logging command. The requested command is arap logging debug-extensions, which enables seven advanced debugging messages in addition to the traditional ARAP logging messages. [CSCdi68276]
- AppleTalk domains do not operate correctly when configured on subinterfaces. The domain properties will be applied to the main interface rather than its subinterface(s). The workaround is to disable AppleTalk fast switching. [CSCdi69886]
- Multiple simultaneous copy operations to the Flash devices on a Cisco 7500 router (bootflash:, slot0:, and slot1:) will cause the router to crash. This only happens when more than one user is logged in to the router (for example, one at the console, and one via Telnet) and both are trying to perform a copy tftp flash at the same time. This is true even if the two users are trying to write to different devices. [CSCdi50888]
- An RSP router can crash with a "reserved exception" error because of a software error or an error in the microcode for an interface processor. More than one problem can generate a similar error message and stack trace, which can make this problem hard to track down. See also CSCdi58999, CSCdi60952, and CSCdi60921. [CSCdi58658]
- A Cisco 2511 router may reset with the error message "System restarted by bus error at PC 0x30B65F4, address 0xD0D0D29." [CSCdi69068]
- On some devices, SNMP GetNext requests performed on the Cisco Discovery Protocol MIB (CISCO-CDP-MIB) can cause the device to pause for an extended length of time. [CSCdi69892]
- AAA authorization and accounting transactions to the TACACS+ server can be delayed by 9 seconds if the IP address of the TACACS+ server does not exist in the local host table and DNS is not configured on the router.
- To resolve this problem, do at least one of the following:
- Add no ip domain-lookup to the configuration.
- Add the IP address of the TACACS+ server to the local host table.
- Whenever the router needs to establish a connection to your TACACS+ server, it will attempt to look up your server's IP addresses. [CSCdi70032]
- If a new MIP channel group is added after a microcode reload has been performed, the system must be rebooted to ensure correct operation. [CSCdi70909]
- The fix for defect CSCdi51882 causes a problem in standard SunOS/Solaris Telnet servers. If the NAWS option is mistakenly sent, the Telnet server hangs instead of ignoring NAWS. This problem only affects Releases 11.0(10.3) through 11.0(11.3), 11.1(6.1) through 11.1(6.4), and 11.2(0.24) through 11.2(1.2). [CSCdi71067]
- DECnet may fail to work properly when using an area number of 63 for L2 routers. The symptoms are being unable to ping (DECnet) between two area routers, one of which is using area 63.x, and having the show dec command report that the "attached" flag is false even though the show dec route command shows routes to it. The workaround is to use the decnet attach override command to force the router into an attached state. This command is available in Releases 10.2(7.3), 10.3(4.4), 11.0(0.13), and all releases of Release 11.1 and later. [CSCdi69247]
- Under some circumstances, a Cisco AS5200 may run low on memory or may run out of memory after processing more than 11,000 calls. A small amount of memory may be lost under two conditions, only when aaa new-model is configured: when a user hangs up at the "Username:" prompt, or when a user successfully autoselects with the autoselect during-login command configured. [CSCdi67371]
- With Release 11.0 and a direct Escon-attached CIP, the host may "box" the CIP if the router is reloaded without the CIP being varied offline. This problem has not been seen with CIPs connected through a director or if the CIP is taken offline before the router is reloaded. The workaround is to vary the device offline before reloading the router. [CSCdi59440]
- When the PS/2 Link Station Role is configured as Negotiable, the XID(3) Negotiation may not complete. The workaround is to configure the PS/2 Link Station Role as Secondary. [CSCdi60999]
- When running CIP SNA over DLSw, the LLC2 control blocks may not get freed even when the LLC2 session is lost and the DLSw circuit is gone. The workaround is to reload the router. [CSCdi62627]
- The router crashes when NSP is configured and is trying to connect back to the owning host. [CSCdi69231]
- Cisco RSP7000 routers that have mixed non-VIP/VIP interfaces (e.g., TRIP and VIP-4R in the same router) may crash when configuring/unconfiguring SRB. [CSCdi69873]
- A router interface operating in an SDLC secondary role will not respond to TEST P. [CSCdi70562]
- When using DLSw FST, end-user sessions may not switch over to an alternate LAN or peer path after a connectivity failure. [CSCdi70709]
- A defect introduced by the fix for defect CSCdi69231 may cause NSP to stop working. The releases affected are 11.0(11.2), 11.1(6.2), and 11.2(1.1). The following messages may be displayed when NSP stops working: "SNA: Connection to Focal Point SSCP lost" and "SNA: MV_SendVector rc = 8001." [CSCdi72696]
- When you perform buffer changes on a serial interface with SMDS encapsulation, the changes are not recognized after a reload. [CSCdi62516]
- The source-bridge ring-number command allows you to configure a ring-number mismatch. The workaround is to make sure that all bridge devices on a ring use the same ring number. [CSCdi63700]
- The LAN extension interface does not function correctly. The behavior is that the LAN extension NCP negotiates and sets the LAN extension interface state to "up" and the show controller lex number command displays the message "No inventory message received from LAN Extender." Turning on the LAN extension RCMD debugging shows that every remote command is being rejected with the message "LEX-RCMD: encapsulation failure." There is no workaround. [CSCdi66478]
- Small and middle buffers leak when transparent bridging on ATM is enabled. [CSCdi69237]
- When an ARP packet is received from an ATM interface, the router might send out a total of two ARP packets to the Ethernet interface. [CSCdi70533]
- When using the custom-queueing feature in conjunction with payload compression on HDLC or Frame Relay encapsulations, traffic regarded as "low-priority" by custom queueing might be passed uncompressed. This results in lower than expected compression ratios. [CSCdi71367]
- When integrated routing and bridging (IRB) is configured, packets less than 60 bytes in size sourced by the BVI interface and going out an ATM bridged interface become runt Ethernet packets without padding inside the RFC 1483 header. [CSCdi71614]
- IPX Enhanced IGRP updates do not propagate if the MTU size is less than the IPX Enhanced IGRP packet size. [CSCdi65486]
- When a primary active router that has gone down comes back up, it is possible that both routers might forward packets instead of just the primary. [CSCdi70693]
- When virtual link is configured in OSPF, the adjacency over the virtual link will continue to flap if only one of the end points of the virtual link is running an OSPF DC-capable (11.2) image.
- There is no problem if both end points are running OSPF DC-capable images or both end points are running OSPF non-DC-capable images. There is no workaround. [CSCdi71021]
- The system suffers a gradual loss of free memory whenever ip sd listen or ip sdr listen are enabled. [CSCdi72863]
- It is possible for use of the DNS Name Service for alias lookups to cause the router to reload. Lookups of canonical names do not exhibit this problem. [CSCdi73022]
- If SPX spoofing fails to send a keepalive, a traceback message will be display on the system console. [CSCdi69062]
- The IPX interface command no ipx route-cache has no effect on the router if an IPX network is not already configured on the interface. Normally, this command should disable fast switching on the interface as well as all its subinterfaces even though the primary interface has no IPX network configured. [CSCdi69726]
- High-end Cisco routers may send XNS RIP update packets too quickly for older hosts to receive. A new global command xns rip-delay will be added to increase the interframe gap to at least 1 ms between XNS/RIP update packets. [CSCdi70357]
- RSH commands executed to the router without a controlling shell return only the first 1608 bytes of data. [CSCdi69424]
- The system may reload when doing DNS name validation.The fix of defects CSCdi66910 and CSCdi71158 introduced this defect. There is no workaround. [CSCdi70707]
- In certain circumstances, the router might reload if a dialer interface (ISDN/Serial/Async) is used for load-backup or failure-backup along with an IPX routing protocol like RIP/Enhanced IGRP and the primary and the backup interface are active. This is usually noticed immediately after the dialer interface connects. [CSCdi61504]
- The VIP/VIP2 IPC overlaps some TX accumulators and makes those accumulators spurious. Those accumulators are not used until the number of interfaces is more than 20. [CSCdi67842]
- Using ATM PVC and bridging, the number of ARP requests sent out depends on the number of subinterfaces created under the ATM interface. [CSCdi67980]
- A reload may be required when running multilink PPP and dialer profiles. Do not enter the ppp multilink command on an interface that has either dialer pool x or dialer pool-member y configured. [CSCdi69131]
- Under certain circumstances, routers hang while executing show vpdn. [CSCdi70008]
- Using TACACS+ with dialback over a rotary group causes the authorization to fail for the user when the callback script aborts or finishes incorrectly, so failover to another line of the rotary occurs. The call is made, but an internal error occurs when debugging TACACS+. [CSCdi70549]
- Some IPX clients, including Windows 95, change their IPX node number on every connection. This means in a DDR environment it is impossible to create a static dialer map for a dial-in Windows 95 IPX client. The workaround is to create a dynamic dialer map for IPX when a client authenticates and provides its IPX node number. [CSCdi70873]
- ISDN BRI routers may have problems bringing up multiple B-channels to the same destination. The router and PBX may also get into a Layer 3 state mismatch and continuously exchange Layer 3 messages. [CSCdi71333]
The following sections describe the documentation available for Cisco IOS Release 11.2. These documents consist of eight modules, each module consisting of a configuration guide and a command reference. The documentation set also includes five supporting documents.
Documentation is available as printed manuals or electronic documents.
The Cisco IOS software documentation set consists of the Cisco IOS configuration guides, Cisco IOS command references, and several other supporting documents that are shipped with your order in electronic form on the Documentation CD-ROM---unless you specifically ordered printed versions.
Each module in the Cisco IOS documentation set consists of two types of books: a configuration guide and a corresponding command reference. Chapters in a configuration guide describe protocols, configuration tasks, and Cisco IOS software functionality, and contain comprehensive configuration examples. Chapters in a command reference provide complete command syntax information. Use each configuration guide with its corresponding command reference.
The Cisco IOS software documentation set is available on CCO and on the Documentation CD-ROM.
On CCO at:
Technical Documents: Documentation Home Page: Cisco IOS Software Configuration: Cisco IOS Release 11.2: Cisco IOS Release 11.2 Configuration Guides/Command References
On the Documentation CD-ROM at:
Cisco Product Documentation: Cisco IOS Software Configuration: Cisco IOS Release 11.2: Cisco IOS Release 11.2 Configuration Guides/Command References
Table 19 describes the contents of the Cisco IOS Release 11.2 software documentation set, which is available in both electronic and printed form.
|
Note You can find the most current Cisco IOS documentation on CCO and the Documentation CD-ROM. These electronic documents may contain updates and modifications made after the hard-copy documents were printed. |
On CCO at:
Technical Documents: Documentation Home Page: Cisco IOS Software Configuration: Cisco IOS Release 11.2
On the Documentation CD-ROM at:
Cisco Product Documentation: Cisco IOS Software Configuration: Cisco IOS Release 11.2
Table 19: Cisco IOS Software Release 11.2 Documentation Set
| Books
| Chapter Topics
|
|---|
- Configuration Fundamentals Configuration Guide
- Configuration Fundamentals Command Reference
| Access Server and Router Product Overview
User Interface
System Images and Configuration Files
Using ClickStart, AutoInstall, and Setup
Interfaces
System Management
|
- Security Configuration Guide
- Security Command Reference
| Network Access Security
Terminal Access Security
Accounting and Billing
Traffic Filters
Controlling Router Access
Network Data Encryption with Router Authentication
|
- Access Services Configuration Guide
- Access Services Command Reference
| Terminal Lines and Modem Support
Network Connections
AppleTalk Remote Access
SLIP and PPP
XRemote
LAT
Telnet
TN3270
Protocol Translation
Configuring Modem Support and Chat Scripts
X.3 PAD
Regular Expressions
|
- Wide-Area Networking Configuration Guide
- Wide-Area Networking Command Reference
| ATM
Dial-on-Demand Routing (DDR)
Frame Relay
ISDN
LANE
PPP for Wide-Area Networking
SMDS
X.25 and LAPB
|
- Network Protocols Configuration Guide, Part 1
- Network Protocols Command Reference, Part 1
| IP
IP Routing
|
- Network Protocols Configuration Guide, Part 2
- Network Protocols Command Reference, Part 2
| AppleTalk
Novell IPX
|
- Network Protocols Configuration Guide, Part 3
- Network Protocols Command Reference, Part 3
| Apollo Domain
Banyan VINES
DECnet
ISO CLNS
XNS
|
- Bridging and IBM Networking Configuration Guide
- Bridging and IBM Networking Command Reference
| Transparent Bridging
Source-Route Bridging
Remote Source-Route Bridging
DLSw+
STUN and BSTUN
LLC2 and SDLC
IBM Network Media Translation
DSPU and SNA Service Point Support
SNA Frame Relay Access Support
APPN
NCIA Client/Server Topologies
IBM Channel Attach
|
- Cisco IOS Software Command Summary
- Access Services Quick Configuration Guide
- System Error Messages
- Debug Command Reference
- Cisco Management Information Base (MIB) User Quick Reference
|
|
You can access the most current Cisco documentation on the World Wide Web at http://www.cisco.com, http://www-china.cisco.com, or http://www-europe.cisco.com.
Cisco documentation and additional literature are available in a CD-ROM package, which ships with your product. The Documentation CD-ROM is updated monthly. Therefore, it is probably more current than printed documentation. The CD-ROM package is available as a single unit or as an annual subscription.
Registered CCO users can order the Documentation CD-ROM and other Cisco Product documentation through our online Subscription Services at http://www.cisco.com/cgi-bin/subcat/kaojump.cgi.
Nonregistered CCO users can order documentation through a local account representative by calling Cisco's corporate headquarters (California, USA) at 408 526-4000 or, in North America, call 800 553-NETS (6387).
Cisco provides Cisco Connection Online (CCO) as a starting point for all technical assistance. Warranty or maintenance contract customers can use the Technical Assistance Center. All customers can submit technical feedback on Cisco documentation using the web, e-mail, a self-addressed stamped response card included in many printed docs, or by sending mail to Cisco.
Cisco continues to revolutionize how business is done on the Internet. Cisco Connection Online is the foundation of a suite of interactive, networked services that provides immediate, open access to Cisco information and resources at anytime, from anywhere in the world. This highly integrated Internet application is a powerful, easy-to-use tool for doing business with Cisco.
CCO's broad range of features and services helps customers and partners to streamline business processes and improve productivity. Through CCO, you will find information about Cisco and our networking solutions, services, and programs. In addition, you can resolve technical issues with online support services, download and test software packages, and order Cisco learning materials and merchandise. Valuable online skill assessment, training, and certification programs are also available.
Customers and partners can self-register on CCO to obtain additional personalized information and services. Registered users may order products, check on the status of an order and view benefits specific to their relationships with Cisco.
You can access CCO in the following ways:
- WWW: www.cisco.com
- Telnet: cco.cisco.com
- Modem using standard connection rates and the following terminal settings: VT100 emulation; 8 data bits; no parity; and 1 stop bit.
- From North America, call 408 526-8070
- From Europe, call 33 1 64 46 40 82
You can e-mail questions about using CCO to cco-team@cisco.com.
The Cisco Technical Assistance Center (TAC) is available to warranty or maintenance contract customers who need technical assistance with a Cisco product that is under warranty or covered by a maintenance contract.
To display the TAC web site that includes links to technical support information and software upgrades and for requesting TAC support, use www.cisco.com/techsupport.
To contact by e-mail, use one of the following:
| Language
| E-mail Address
|
|---|
English
| tac@cisco.com
|
Hanzi (Chinese)
| chinese-tac@cisco.com
|
Kanji (Japanese)
| japan-tac@cisco.com
|
Hangul (Korean)
| korea-tac@cisco.com
|
Spanish
| tac@cisco.com
|
Thai
| thai-tac@cisco.com
|
In North America, TAC can be reached at 800 553-2447 or 408 526-7209. For other telephone numbers and TAC e-mail addresses worldwide, consult the following web site: http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml.
If you have a CCO login account, you can access the following URL, which contains links and tips on configuring your Cisco products:
http://www.cisco.com/kobayashi/technotes/serv_tips.shtml
This URL is subject to change without notice. If it changes, point your Web browser to CCO and click on this path: Service & Support: Technical Assistance Center: Login: Tools: Technical Tips.
The following sections are provided from the Technical Tips page:
- Tech Tips Quick Search---Provides a web query tool for access to Tech Notes, FAQs, and configuration examples from the Technical Assistance Center.
- Configuration Cookbooks---Contains common configuration examples that demonstrate how to configure various internetworking technologies on Cisco devices.
- Field Notices---Notifies you of any critical issues regarding Cisco products and includes problem descriptions, safety or security issues, and hardware defects.
- Frequently Asked Questions---Describes the most frequently asked technical questions about Cisco hardware and software.
- Hardware---Provides technical tips related to specific hardware platforms.
- Internetworking Features---Lists tips on using Cisco IOS software features and services.
- Sample Configuration---Provides actual configuration examples that are complete with topology and annotations.
- Software Products---Provides technical tips on Cisco ICM Software, Cisco IOS Software Bulletins, Cisco Customer Interaction Suite Software, Cisco TCP/IP Suite 100, General Cisco IOS, Internet/Intranet Appliances and Software, Network Management, Security, and WAN Switching Products and Software.
- Special Collections---Provides Case Studies with practical examples of how to implement Cisco software features, Cisco standard icons, references and RFCs (including standards and acronyms), and security advisories.
If you are reading Cisco product documentation on the World Wide Web, you can submit technical comments electronically. Click Feedback in the toolbar and select Documentation. After you complete the form, click Submit to send it to Cisco.
You can e-mail your comments to bug-doc@cisco.com.
To submit your comments by mail, for your convenience many documents contain a response card behind the front cover. Otherwise, you can mail your comments to the following address:
Cisco Systems, Inc.
Document Resource Connection
170 West Tasman Drive
San Jose, CA 95134-9883
We appreciate and value your comments
.
Posted: Fri Jul 7 10:56:46 PDT 2000
Copyright 1989-2000©Cisco Systems Inc.
