cc/td/doc/product/software/ios120/relnote
hometocprevnextglossaryfeedbacksearchhelp
PDF

Table of Contents

Release Notes for Cisco uBR7200 Series
for Cisco IOS Release 12.0 T

Release Notes for Cisco uBR7200 Series
for Cisco IOS Release 12.0 T

September 7, 1999

These release notes for the Cisco uBR7200 series universal broadband routers support Cisco IOS Release 12.0 T, up to and including Release 12.0(5)T1. These release notes are updated as needed to describe memory requirements, new features, new hardware support, software platform deferrals, changes to the microcode or modem code and related documents.

For a list of the software caveats that apply to Release 12.0(5)T1, see the Caveats for Cisco IOS Release 12.0 T  document that accompanies these release notes. The caveats document is updated for every maintenance release and is located on Cisco Connection Online (CCO)  and the Documentation CD-ROM. For more information, refer to the "Caveats" section of these release notes.

Use these release notes with the Cross-Platform Release Notes for Cisco IOS Release 12.0  located on CCO  and the Documentation CD-ROM.  

Contents

These release notes describe the following topics:

Introduction

The Cisco uBR7200 series universal broadband routers---the Cisco uBR7223 and the Cisco uBR7246---are based on the Data Over Cable Service Interface Specification (DOCSIS) standards. Each is designed to be installed at a cable operator's headend facility or distribution hub and to function as the cable modem termination system (CMTS) for subscriber-end devices such as Cisco uBR904 and Cisco uBR924 cable access routers and other DOCSIS-based cable modems.

Cisco uBR7200 series universal broadband routers allow two-way transmission of digital data and Voice over IP (VoIP) traffic over a hybrid fiber coaxial (HFC) network. For cable plants not fully upgraded to support two-way cable transmission, the routers support DOCSIS-compliant telco-return in which the cable modem's return path to the CMTS is via a dial-up telephone line connection instead of an upstream channel over the coaxial cable.

Cisco uBR7200 series universal broadband routers support IP routing with a wide variety of protocols and any combination of Ethernet, Fast Ethernet, serial, High-Speed Serial Interface (HSSI), and Asynchronous Transfer Mode (ATM) media.

Cisco uBR7246 Universal Broadband Router

The Cisco uBR7246 features an I/O controller, up to two network interface port adapters, up to four cable modem line cards, a network processing engine, and up to two removable power supplies. (The two power supplies in the Cisco uBR7246 provide load-sharing and redundancy capabilities.) The Cisco uBR7246 provides two Personal Computer Memory Card International Association (PCMCIA) slots that allow for software upgrades through the use of Flash memory cards.


Note  The Cisco uBR7246 has earned DOCSIS certification from CableLabs.

Cisco uBR7223 Universal Broadband Router

Based on the Cisco uBR7246, the Cisco uBR7223 features an I/O controller, one network interface port adapter, up to two cable modem line cards, a network processing engine, and a removable power supply. (The Cisco uBR7223 does not feature load-sharing and redundant power supply capability like the Cisco uBR7246.) The Cisco uBR7223 provides two Personal Computer Memory Card International Association (PCMCIA) slots that allow for software upgrades through the use of Flash memory cards.

The Cisco uBR7223 is a cost-effective, scalable interface between subscriber cable modems and the backbone data network, and is designed specifically for small- to medium-sized network installations.

Early Deployment Releases

These release notes describe the Cisco uBR7200 series routers for Cisco IOS Release 12.0(5)T1. Release 12. 0 T is an early deployment (ED) series of releases based on Release 12.0; early deployment releases announce fixes to software caveats and support for new Cisco hardware and software. Early deployment releases of the Cisco uBR7200 series routers are shown in Table 1.


Table 1: Early Deployment Releases for the Cisco uBR7200 Series
ED Release Maintenance Release Additional Software Features Additional Hardware Features Availability

Release 11.3 NA

11

None

None

Now

Release 11.3 T

11

None

None

Now

Release 12.0 XI

(4)XI2

  • Encrypted Baseline Privacy Key Exchange

  • Multiple ISDN Switch Types

  • Named Method Lists for AAA Authorization and Accounting, and Automated Double Authentication

  • Quality of Service Enhancements

  • RADIUS Authentication with Vendor-Proprietary Attributes

  • Spectrum Management Enhancements

  • Upstream Traffic Shaping

  • Telco Return

  • MC11 Cable Modem Card

  • MC16B Cable Modem Card

Now

Release 12.0 T

(5)T1

  • Release 12.0(4)XI features

  • Downstream Rate Shaping with ToS Bits

  • Enhanced RADIUS support

  • Inter-Switch Link (ISL) Support for non-cable interfaces

  • Integrated TOD Server

  • Multiple SID Support

  • MC16C Cable Modem Card

  • Multichannel DS1/PRI Port Adapter

  • Multichannel E1/PRI Port Adapter

Now

System Requirements

This section describes the system requirements for Release 12.0 T:

Memory Requirements

Table 1 displays the memory requirements of the Cisco IOS feature sets for the Cisco uBR7200 series routers for Release 12.0 T. Cisco uBR7200 series universal broadband routers are available with a 16- or 20-MB Flash memory card.


Table 2: Memory Requirements for the Cisco uBR7200 Series Universal Broadband Routers
Feature Set Image Name Required
Flash
Memory
Required
DRAM
Memory
Runs
From
Feature
History

IP routing with IS-IS, and BGP (no bridging, no NAT)

ubr7200-p-mz

16 MB Flash

64 MB DRAM

RAM

Added in Release 11.3(1)T and 12.0(1)T

IP routing with IS-IS, BGP, and export-controlled baseline privacy (no bridging, no NAT)

ubr7200-klp-mz

16 MB Flash

64 MB DRAM

RAM

Encryption image added in Release 11.3(6)NA and 12.0(3)T

IP routing and bridging with NAT and Inter-Switch Link (ISL)

ubr7200-is-mz

16 MB Flash

64 MB DRAM

RAM

Added in Release 11.3(1)T and 12.0(1)T

IP routing and bridging with NAT, Inter-Switch Link (ISL), and export-controlled baseline privacy

ubr7200-ik1s-mz

16 MB Flash

64 MB DRAM

RAM

Added in Release 12.0(4)XI2 and 12.0(5)T1

IP routing and bridging with NAT, ISL, and DOCSIS telco return

ubr7200-ist-mz

16 MB Flash

64 MB DRAM

RAM

Added in Release 12.0(4)XI2 and 12.0(5)T1

IP routing and bridging with NAT, ISL, export-controlled baseline privacy, and DOCSIS telco return

ubr7200-ik1st-mz

16 MB Flash

64 MB DRAM

RAM

Added in Release 12.0(4)XI2 and 12.0(5)T1

The image subset legend for Table 1 is as follows:

System Interoperability

This section clarifies the operation of certain features in the Cisco uBR7200 series routers.

DOCSIS configuration files can contain multiple Classes of Service (CoS) to support voice. The first CoS is used for data (and voice if no other CoS is defined), and a second CoS can be defined for voice use. However, if the Cisco uBR7200 series router is supporting a network containing both DOCSIS 1.0 and 1.1 cable modems, multiple CoS cannot be used because the DOCSIS 1.0 cable modems do not support the fragmentation of request messages. When both voice and data are transmitted in this network environment, the voice and data traffic are mixed, and the voice traffic is transmitted on a best-effort basis. This may cause some delay and jitter in the voice calls, resulting in poorer voice quality and throughput in the VoIP network.

Hardware Supported

Cisco IOS Release 12.0(5)T1 supports the following Cisco uBR7200 series universal broadband routers.

Cable Modem Cards

Release 12.0(5)T1 also supports the available MC11, MC14, and MC16 cable modem line cards:

For more information on new hardware features in Release 12.0(5)T1, see the "New and Changed Information" section.

Port Adapter Cards

Table 3 lists and describes the port adapters supported by Cisco uBR7200 series routers in Cisco IOS Release 12.0(5)T1:


Table 3: Supported Interfaces on the Cisco uBR7200 Series Universal Broadband Routers
Interface, Network Module, or Data Rate Product Number1 Description Platforms Supported In2
ATM

PA-A1-OC3MM

1-port ATM OC-3c/STM-1 multimode port adapter

Cisco uBR7200 series routers

11.3(8)NA and later 11.3 NA releases, 12.0(3)T and later 12.0 T releases

PA-A1-OC3SMI

1-port ATM OC-3c/STM-1 single-mode intermediate reach port adapter

Cisco uBR7200 series routers

11.3(8)NA and later 11.3 NA releases, 12.0(3)T and later 12.0 T releases

PA-A2-4E1XC-E3ATM

5-port ATM CES3 (4 E1 120-ohm CBR4 ports and 1 E3 ATM port) port adapter

Cisco uBR7246 only

12.0(3)T and later 12.0 T releases

PA-A2-4E1XC-OC3SM

5-port ATM CES3 (4 E1 120-ohm CBR4 ports and 1 OC-3 ATM single-mode port) port adapter

Cisco uBR7246 only

12.0(3)T and later 12.0 T releases

PA-A2-4T1C-OC3SM

5-port ATM CES3 (4 T1 CBR4 ports and 1 OC-3 ATM single-mode port) port adapter

Cisco uBR7246 only

12.0(3)T and later 12.0 T releases

PA-A2-4T1C-T3ATM

5-port ATM CES3 (4 T1 CBR4 ports and 1 T3 ATM port) port adapter

Cisco uBR7246 only

12.0(3)T and later 12.0 T releases

PA-A3-E3

1-port ATM, PCI-based E3 port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-A3-OC3MM

1-port OC-3c/STM-1 multimode port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-A3-OC3SMI

1-port OC-3c/STM-1 single-mode, intermediate reach port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-A3-OC3SML

1-port OC-3c/STM-1 single-mode, long reach port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-A3-T3

1-port ATM, PCI-based DS3 port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

Ethernet

PA-4E

4-port Ethernet 10BaseT port adapter

Cisco uBR7200 series routers

11.3(8)NA and later 11.3 NA releases, 12.0(3)T and later 12.0 T releases

PA-8E

8-port Ethernet 10BaseT port adapter

Cisco uBR7200 series routers

11.3(8)NA and later 11.3 NA releases, 12.0(3)T and later 12.0 T releases

PA-FE-FX

1-port 100BaseFX Fast Ethernet port adapter

Cisco uBR7200 series routers

11.3(8)NA and later 11.3 NA releases, 12.0(3)T and later 12.0 T releases

PA-FE-TX

1-port 100BaseTX Fast Ethernet port adapter

Cisco uBR7200 series routers

11.3(8)NA and later 11.3 NA releases, 12.0(3)T and later 12.0 T releases

High-Speed Serial Interfaces (HSSI)

PA-H

1-port HSSI port adapter

Cisco uBR7200 series routers

11.3(8)NA and later 11.3 NA releases, 12.0(3)T and later 12.0 T releases

PA-2H

2-port HSSI port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

Packet-Over-
SONET (POS)

PA-POS-OC3MM

1-port POS OC3 multimode port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-POS-OC3SMI

1-port OC3 single-mode, intermediate reach port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-POS-OC3SML

1-port POS OC-3 single-mode, long reach port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

Serial

PA-2E3

2-port E3 serial port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-2T3

2-port T3 serial port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-4E1G-120

4-port balanced (120-ohm) E1-G.703/G.704 synchronous serial port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-4E1G-75

4-port unbalanced (75-ohm) E1-G.703/G.704 synchronous serial port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-4T+

4-port synchronous serial port adapter

Cisco uBR7200 series routers

11.3(8)NA and later 11.3 NA releases, 12.0(3)T and later 12.0 T releases

PA-8T-232

8-port EIA/TIA-232 synchronous serial port adapter

Cisco uBR7200 series routers

11.3(8)NA and later 11.3 NA releases, 12.0(3)T and later 12.0 T releases

PA-8T-V35

8-port V.35 synchronous serial port adapter

Cisco uBR7200 series routers

11.3(8)NA and later 11.3 NA releases, 12.0(3)T and later 12.0 T releases

PA-8T-X21

8-port X.21 synchronous serial port adapter

Cisco uBR7200 series routers

11.3(8)NA and later 11.3 NA releases, 12.0(3)T and later 12.0 T releases

PA-E3

1-port E3 serial port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-MC-E3

1 multichannel E3, medium-speed serial interface

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-MC-T3

1 multichannel T3 interface with BNC connectors

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-T3

1-port T3 serial port adapter

Cisco uBR7200 series routers

12.0(3)T and later 12.0 T releases

PA-MC-4T1

1 multichannel DS1/PRI with 4 T1 interfaces (RJ-48C connectors)

Cisco uBR7200 series routers

12.0(5)T and later 12.0 T releases

PA-MC-8T1

1 multichannel DS1/PRI with 8 T1 interfaces (RJ-48C connectors)

Cisco uBR7200 series routers

12.0(5)T and later 12.0 T releases

PA-8DSX-1

1 multichannel DS1/PRI with DS1 DSU functionality and DS0 channel support

Cisco uBR7200 series routers

12.0(5)T and later 12.0 T releases

PA-MC-8E1/120

1 multichannel E1/PRI with 8 E1 interfaces (RJ-48C connectors)

Cisco uBR7200 series routers

12.0(5)T and later 12.0 T releases

1Refer to the Documentation CD-ROM or http://www.cisco.com, http://www-china.cisco.com, or http://www-europe.cisco.com for the most current list of supported port adapters.
2The number in the "In" column indicates the Cisco IOS release when the interface was first introduced. If a cell in this column is empty, the interface was included in the initial base release.
3CES = circuit emulation services.
4
CBR = constant bit rate.

Determining the Version of Your Software Release

To determine the version of Cisco IOS software currently running on the Cisco uBR7200 series universal broadband router, log in to the router and enter the show version EXEC command. The IOS version number is indicated on the second line as indicated in the sample output shown below:

router> show version
Cisco Internetwork Operating System Software 
IOS (tm) ubr7200 Software (ubr7200-p-mz), Version 12.0(5)T1, RELEASE SOFTWARE
 

The output includes additional information such as processor revision numbers, memory amounts, hardware IDs, and partition information.

Upgrading to a New Software Release

For information on upgrading to a new software release, see the Cisco IOS Software Release  12.0  T Upgrade Paths and Packaging Simplification product bulletin located on CCO at:

Service & Support: Product Bulletins: Software

Under Cisco IOS 12.0, click Cisco IOS Software Release 12.0 T Upgrade Paths (#819: 01/99).


Note The Cisco IOS Software Release 12.0 T Upgrade Paths and Packaging Simplification can also be found at this URL: http://www.cisco.com/warp/public/732/120/819_pp.htm. You must have an account on CCO to access this URL.

Feature Set Tables

Cisco IOS software is packaged in software images consisting of feature sets---depending on the platform. Each feature set contains a specific set of Cisco IOS features.

Caution
Cisco IOS images with strong encryption (including, but not limited to, 56-bit data encryption feature sets) are subject to United States government export controls and limited distribution. Images to be installed outside the United States require an export license. Customer orders may be denied or subject to delay because of United States government regulations. Contact your sales representative or distributor for more information, or send an e-mail to export@cisco.com.

Table 4 lists the features and feature sets supported by the Cisco uBR7200 series in Cisco IOS Release 12.0 T and uses the following conventions:


Note This feature set table only contains a selected list of features. This table is not cumulative---nor does it list all the features in each image.


Table 4: Feature List by Feature Sets for the Cisco uBR7200 Series Universal Broadband Routers
Feature Feature Set
In1 DOCSIS Two-way DOCSIS Two-way with Baseline Privacy DOCSIS Two-way, IP Plus DOCSIS Two-way, IP Plus, Telco Return DOCSIS Two-way, IP Plus with BPI DOCSIS Two-way, IP Plus, Telco Return with BPI
Internet
DRP Server Agent

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Telco-Return

(4)XI2
(5)T1

No

No

No

Yes

No

Yes

IP Routing
Easy IP (Phase 1)

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Hot Standby Router Protocol (HSRP) over ISL in Virtual LAN Configurations

(3)

No

No

Yes

Yes

Yes

Yes

IP Type of Service and Precedence for GRE Tunnels

(4)

Yes

Yes

Yes

Yes

Yes

Yes

IP Enhanced IGRP Route Authentication

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Per-Modem Filters

(4)XI2
(5)T1

Yes

Yes

Yes

Yes

Yes

Yes

Management
Cisco Call History MIB Command Line Interface

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Cisco IOS Internationalization

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Entity MIB, Phase 1

(3)

Yes

Yes

Yes

Yes

Yes

Yes

MIB Enhancements

(5)NA

Yes

Yes

Yes

Yes

Yes

Yes

SNMPv2C

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Spectrum Management Enhancements
Virtual Profiles

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Multimedia

IP Multicast Load Splitting across Equal-Cost Paths

(3)

Yes

Yes

Yes

Yes

Yes

Yes

IP Multicast over ATM Point-to-Multipoint Virtual Circuits

(3)

Yes

Yes

Yes

Yes

Yes

Yes

IP Multicast over Token Ring LANs

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Stub IP Multicast Routing

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Quality of Service
Downstream QoS Handling

(5)NA

Yes

Yes

Yes

Yes

Yes

Yes

Downstream Traffic Shaping

(9)NA1
(4)XI2
(5)T1

Yes

Yes

Yes

Yes

Yes

Yes

Upstream Traffic Shaping

(9)NA1
(4)XI2
(5)T1

Yes

Yes

Yes

Yes

Yes

Yes

Improved Upstream QoS

(5)NA

Yes

Yes

Yes

Yes

Yes

Yes

QoS Configuration

(5)NA

Yes

Yes

Yes

Yes

Yes

Yes

QoS Profile Enforcement

(9)NA1

Yes

Yes

Yes

Yes

Yes

Yes

Read/Create Implementation of QoS

(5)NA

No

Yes

Yes

Yes

Yes

Yes

RTP Header Compression

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Multiple SID Support

(4)XI2
(5)T1

Yes

Yes

Yes

Yes

Yes

Yes

Security
Automated Double Authentication

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Cable Modem and Multicast Authentication using RADIUS

(5)NA

No

Yes

No

No

Yes

Yes

Encrypted Baseline Privacy Key Exchange

(5)NA

No

Yes

No

No

Yes

Yes

HTTP Security

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Named Method Lists for AAA Authorization & Accounting

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Per-Modem and Per-Host Access List Support

(8)NA

Yes

Yes

Yes

Yes

Yes

Yes

Per-User Configuration

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Reflexive Access Lists

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Vendor-Proprietary RADIUS Attributes

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Switching
Fast-Switched Policy Routing

(3)

Yes

Yes

Yes
Yes
Yes
Yes
WAN Optimization

PAD Subaddressing

(3)

Yes

Yes

Yes

Yes

Yes

Yes

WAN Services
Bandwidth Allocation Control Protocol (BACP)

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Enhanced Local Management Interface (ELMI)

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Frame Relay Enhancements

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Frame Relay MIB Extensions

(3)

Yes

Yes

Yes

Yes

Yes

Yes

Frame Relay Router ForeSight

(3)

Yes

Yes

Yes

Yes

Yes

Yes

ISDN Advice of Charge

 

Yes

Yes

Yes

Yes

Yes

Yes

ISDN Caller ID Callback

 

Yes

Yes

Yes

Yes

Yes

Yes

ISDN Multiple Switch Type

 

Yes

Yes

Yes

Yes

Yes

Yes

ISDN NFAS

 

Yes

Yes

Yes

Yes

Yes

Yes

LANE Per-subinterface Debug Messages

 

No

No

No

No

No

No

Layer 2 Forwarding---Fast Switching

 

No

No

No

No

No

No

Leased-Line ISDN at 128 kbps

 

No

No

No

No

No

No

MPPC

 

Yes

Yes

Yes

Yes

Yes

Yes

Multilink PPP Interleaving and Fair-Queuing Support

 

No

No

No

No

No

No

National ISDN Switch Types for BRI and PRI

(3)

Yes

Yes

Yes

Yes

Yes

Yes

PPP over ATM

 

No

No

No

No

No

No

Telnet Extensions for Dialout

 

No

No

No

No

No

No

VPDN MIB and Syslog Facility

(3)

Yes

Yes

Yes

Yes

Yes

Yes

VPDN Tunnel Lookup Based on Dialed Number Information

 

No

No

No

No

No

No

X.25 Enhancements

 

Yes

Yes

Yes

Yes

Yes

Yes

X.25 on ISDN

 

No

No

No

No

No

No

X.25 Switching between PVCs and SVCs

(3)

Yes

Yes

Yes

Yes

Yes

Yes

X.28 Emulation

 

No

No

No

No

No

No

1This column indicates the maintenance release in which the feature was introduced. For example, (3) means a feature is introduced in 12.0(3)T, and (6)NA means a feature was introduced in 11.3(6)NA. If this cell in this column is empty, this feature was introduced in the base release.

Optional feature set licenses for the Cisco uBR7200 series universal broadband routers are as follows:

New and Changed Information

The following sections list the new hardware and software features supported by the Cisco uBR7200 series routers for Cisco IOS Release 12.0 T.

New Hardware Features in Release 12.0(5)T

The following new hardware features are supported by the Cisco uBR7200 series routers in Cisco IOS Release 12.0(5)T.

Cable Modem Card (MC16C)

The software for the MC16C cable modem card is a driver running on the Cisco uBR7200 series universal broadband routers. Using a Protocol Control Information (PCI) interface, the universal broadband router line card software interacts with the MC16C cable modem card. Data is passed back and forth, as Direct Memory Access (DMA) transfers, from the Cisco uBR7200's memory to the MC16C cable modem card.

Additionally, the MC16C cable modem card supports universal broadband router line card management and control with the MC16C MIB, Media Access Control (MAC) control software and logical link management software based on DOCSIS standards, and minimized security.

For more information, refer to the Update to the Cisco uBR7200 Series Cable Modem Card Installation and Configuration for the MC16C EFT Card publication.

Multichannel DS1/PRI Port Adapter

The multichannel DS1/PRI port adapter (PA-MC-4T1 and PA-MC-8T1 versions) is a single-wide module that integrates channel service unit (CSU) functionality, data service unit (DSU) functionality, and DS0 channel support into Cisco uBR7200 series routers. The PA-8DSX-1 version integrates DS1 data service unit (DSU) functionality and DS0 channel support into the Cisco uBR7200 series routers.

The multichannel DS1/PRI port adapter provides four or eight independent T1 (100-ohm) connections via RJ-48C connectors. Each multichannel DS1/PRI port adapter can provide up to 128 separate full-duplex HDLC DS0, fractional, or full T1 channels.

Multichannel E1/PRI Port Adapter

The multichannel E1/PRI port adapter (PA-MC-8E1/120) is a single-wide module that integrates data service unit (DSU) functionality and E1 channel support into Cisco uBR7200 series routers. The multichannel E1/PRI port adapter provides eight independent E1 (120-ohm) connections via RJ-48C connectors. Each multichannel E1/PRI port adapter can provide up to 128 separate full-duplex HDLC channelized E1, fractional E1, full E1, or unframed E1 interfaces.

New Software Features in Release 12.0(5)T

The following new software features are supported by the Cisco uBR7200 series routers in Cisco IOS Release 12.0(5)T.

Basic Wiretap Support

This feature provides support for a basic wiretap facility for VoIP calls, as required by the United States Federal Communications Assistance for Law Enforcement Act (CALEA). The wiretap facility is based on the MAC address of the cable modem so it can be used for either data or digitized voice connections.

This feature is controlled by the new interface command, cable intercept, which requires a MAC address, an IP address, and a UDP port number as its parameters. When activated, the Cisco uBR7200 series router examines each packet for the desired MAC address; when a matching MAC address is found (for either the origination or destination endpoint), a copy of the packet is encapsulated into a UDP packet which is then sent to the server at the specified IP address and port.

Cisco IOS Firewall

Cisco uBR7200 series routers support the Cisco IOS Firewall feature, which is available in selected Cisco IOS Release 12.0(5)T and higher images. The Cisco IOS Firewall feature set offers Network Address Translation (NAT), which is designed to prevent unauthorized, external access to your internal network and to block attacks on your network while at the same time allowing authorized users to access network resources. This feature is described in detail in the Cisco IOS Firewall Feature Set feature module, available on the Documentation CD-ROM and CCO.

Downstream Rate Shaping with Type of Service (TOS) Bits

Cisco uBR7200 series routers support downstream data rate shaping on a per modem basis. The TOS bits in the IP packet header can be set to specify that packet's class of service, allowing packets for certain traffic flows (such as VoIP) to be given precedence over packets for other flows such as data.

Downstream rate shaping with TOS bits allows you to configure multiple data rates for a given modem. Also, by specifying a maximum data rate for a particular TOS, you can override the common maximum downstream data rate. Packets that contain TOS bytes that have not been configured for downstream data rates continue to use the common data rate limits.

Inter-Switch Link Support for Non-Cable Interfaces

Cisco uBR7200 series routers support the Inter-Switch Link (ISL) feature, a Cisco protocol for interconnecting multiple routers and switches. The ISL protocol maintains VLAN information as traffic passes between routers and switches.

Quality of Service Configuration and Profile Enforcement

The Cisco uBR7200 series routers support Quality of Service (QoS) as defined by the DOCSIS 1.0 specification. Service class profiles can be configured through the command-line interface to support the QoS profile number, traffic priority, maximum upstream bandwidth, guaranteed upstream bandwidth, maximum downstream bandwidth, maximum transmit burst length, baseline privacy enable/disable, and Type of Service (ToS) overwrite byte.

QoS Profile Enforcement allows CMTS operators to control the QoS to eliminate any interference from improper local-rate limiting implemented on the cable modem. The CMTS provisions a registering cable modem with a default DOCSIS 1.0 service class assigned by the operator, overriding any service class that previously existed on the modem. This service class has no upstream or downstream rate limits so that the CMTS can do traffic shaping based on the QoS profile enforced by the operator.

As part of this support, Cisco uBR7200 series universal broadband routers support multiple service classes per cable modem by providing multiple QoS service identifiers (SIDs). This allows the Cisco uBR7200 series cable modem termination system (CMTS) to dynamically allocate and delete service flows for voice and fax transmissions.

The following commands are available on Cisco uBR7200 series universal broadband routers to update the quality of service (QoS) table:


Note The following features are new to the 12.0 T release train, but were first introduced in Cisco IOS Release 12.0(4)XI2.

Telco Return

The telco return feature provides DOCSIS-based software support for telephone return in a cable-routed system. With telco return, the subscriber's return path to the CMTS is via a dial-up telephone line connection instead of an upstream channel over the coaxial cable.

Multiple SID Support

Cisco uBR7200 series universal broadband routers now support multiple service classes per cable modem by providing multipleQoS service identifiers (SIDs). This allows the Cisco uBR7200 series cable modem termination system (CMTS) to dynamically allocate and delete service flows for voice and fax transmissions.

Integrated TOD Server

Cisco uBR7200 series routers are now able to respond to RFC 868 time-of-day (TOD) queries from cable modems during the registration process.

Additional or Changed Show Commands

The Cisco uBR7200 series universal broadband routers contain the following additional or changed show commands:

Cable Modem and Multicast Authentication Using RADIUS

As an enhancement to baseline privacy, Cisco uBR7200 series universal broadband routers can be configured for cable modem and multicast authentication using the Remote Authentication Dial-In User Server (RADIUS) protocol, an access server authentication, authorization, and accounting protocol originally developed by Livingston, Inc. This release also introduces support for additional vendor-proprietary RADIUS attributes.

When a cable modem comes online or when a JOIN request is sent through a multicast data stream, the Cisco uBR7200 series universal broadband routers send relevant information to RADIUS servers for cable modem/host authentication. This feature can be configured on a per-interface basis.

An Internet Engineering Task Force (IETF) draft standard, RFC 2138, defines the RADIUS protocol. RFC 2139 defines the corresponding RADIUS accounting protocol. Additional RFC drafts define vendor-proprietary attributes and MIBs that can be used with an SNMP manager.

Automated Double Authentication

The Automated Double Authentication  feature enhances the existing double authentication feature. Previously, with the existing double authentication feature, a second level of user authentication is achieved when the user telnets to the network access server or router and enters a username and password. Now, with automated double authentication, the user does not have to Telnet anywhere but instead responds to a dialog box that requests a username and password or PIN.

Burst Profile Configuration

For each modulation/burst profile configuration, Cisco uBR7200 series routers will support burst profile number, burst profile interval usage code, burst type, preamble length and unique word length, differential encoding enable/disable, FEC correctable bytes value, FEC code word length, scrambler seed value, maximum burst size, guard time size, last code word shortened/lengthened, and scrambler enable/disable.

DHCP Client ID/Remote ID Options

This feature---also known as the Customer Premises Equipment (CPE) Limitation---allows Cisco uBR7200 series routers to report and limit the number of CPEs that can use the cable modem to access the cable network.

DHCP Relay Subscriber ID Insertion

Cisco uBR7200 series routers allow insertion of DHCP relay-agent option fields using the global command [no] ip dhcp relay information option.

Downstream Quality of Service Handling Compliant to DOCSIS Requirements

Cisco IOS Release 11.3(5)NA handles downstream quality of service in compliance with DOCSIS requirements for Cisco uBR7200 series universal broadband routers. Cisco uBR7200 series routers control access to the shared time-slotted DOCSIS upstream cable channel used by the cable modems remotely.

The downstream port outputs 64- and 256-QAM modulated carriers conforming to the ITU-T J.83 Annex A or Annex B standards for transmission of MPEG digital television. The downstream port outputs a 44.00 MHz intermediate frequency (IF) carrier, which is upconverted to an assigned radio frequency (RF). Data destined for subscribers is broadcast on a standard cable television channel. The carrier bandwidth is 6 MHz with raw speeds of 30.34 Mbps and 42.88 Mbps.

Encrypted Baseline Privacy Key Exchange

Baseline privacy extensions permit the encryption of data transferred between the cable modem and the Cisco uBR7200 universal broadband router. The key management protocol defined by baseline privacy allows Cisco uBR7200 routers to provide two types of keys to cable modems. The Key Exchange Key (KEK) decrypts the Traffic Exchange Keys (TEK). The TEK is the key used to encrypt and decrypt data packets.


Note For Cisco Systems to be able to provide non-export-controlled images, the standard image (ubr7200-p-mz) will no longer support baseline privacy. New images explicitly identified as encryption images (ubr7200-k1p-mz, ubr7200-ik1s-mz, and ubr7200-ik1st-mz) will support baseline privacy.

Improved and Extended Command-Line Interface

Extensive command-line interface enhancements include user configuration using the command-line interface, SNMP, and HTTP. All methods will provide essentially the same set of configuration objects.

Improved MAC Scheduler

The MAC scheduler in the Cisco uBR7200 series universal broadband routers handles computation of optimal number of initial ranging opportunities per second and initial ranging backoff window, optimal date request backoff window, and data request slots per second.

Improved Parameter Configuration

Cisco uBR7200 series routers contain algorithms that control the rate of the contention slots and a common algorithm for varied parameter configuration for cable modems within each of the upstream contention subchannels.

Improved Upstream Quality of Service

Cisco uBR7200 series routers have an improved upstream quality of service. The upstream port receives time-division multiplexed data bursts. Cisco uBR7200 series routers support QPSK and 16-QAM modulation at carrier bandwidths of 0.2, 0.4, 0.8, 1.6, and 3.2 MHz with raw speeds of 0.32, 0.64, 1.28, 2.56, and 5.12 Mbps when using QPSK. A single downstream supports up to six upstreams. Each upstream has its own set of Upstream Channel Descriptor (UCD) and Upstream Bandwidth Allocation (MAP) messages, which control the frequency, modem transmission parameters, and timing of messages sent toward the Cisco uBR7200 series router.

MIB Enhancements

Both the Management Interface Base (MIB) and command-line interface provide the same set of configuration options in the Cisco uBR7200 series universal broadband routers. Additionally, the Radio Frequency (RF) Interface MIB has changed to improve the object support for traps and to add the following QoS and service class support:

Microsoft Point-to-Point Compression (MPPC)

Microsoft Point-to-Point Compression (MPPC)  is a scheme used to compress Point-to-Point Protocol (PPP) packets between Cisco and Microsoft client devices. The MPPC algorithm is designed to optimize bandwidth utilization to support multiple simultaneous connections. The MPPC algorithm uses a Lempel-Ziv (LZ)-based algorithm with a continuous history buffer called a dictionary.

Named Method Lists for AAA Authorization and Accounting

In earlier Cisco IOS releases, only named authentication method lists were supported under Cisco's Authentication, Authorization, and Accounting (AAA) network security services. AAA has now been extended to support both authorization and accounting named method lists. Named Method Lists for AAA Authorization and Accounting function the same way as those for authentication; they allow you to define different methods for authorization and accounting and apply those methods on a per-interface or per-line basis.

Multiple ISDN Switch Types

The Multiple ISDN Switch Types  feature allows you to configure more than one ISDN switch type per router. An ISDN switch type can be applied on a per-interface basis, thus extending the existing global isdn switch-type command to the interface level. This allows Basic Rate Interfaces (BRI) and Primary Rate Interfaces (PRI) to run simultaneously on platforms that support both interface types.

National ISDN Switch Types for BRI and PRI

National ISDN Switch Types for Basic Rate and Primary Rate Interfaces  introduces changes to ISDN switch types for PRIs and BRIs as follows:

Per-Modem Filters

This feature---also known as Per Modem and Per Host Access Lists---allows Cisco uBR7200 series universal broadband routers to filter incoming packets from individual hosts or cable modems based on the source MAC or IP address. This allows access lists to be specified on a per-interface or a per-direction basis.

Spectrum Management Enhancements

The following spectrum management enhancements are available in the Cisco uBR7200 series universal broadband routers:

Upstream and Downstream Traffic Shaping

This feature was first introduced in Cisco IOS Release 11.3(9)NA1.

Previously, whenever a cable modem was found to be exceeding its configured peak upstream rate, the Cisco uBR7200 series router would adopt a stricter policing approach and drop the bandwidth requests from that cable modem until it could be allowed to send more data upstream.

Using the cable upstream <port number> rate-limit token-bucket shaping command, the Cisco uBR7200 series CMTS can perform upstream rate shaping by buffering the grants for rate-exceeded modems. This grant buffering at the CMTS avoids TCP-related timeouts and retransmits, thus enabling the CMTS to enforce the peak upstream rate for the cable modem without degrading overall TCP throughput.

When the shaping option for upstream rate limiting is not enabled, the CMTS upstream-rate-policing code drops bandwidth requests from cable modems that are found to have exceeded their configured peak upstream rate (using different local drop policies). The effect of bandwidth requests being dropped is degraded throughput performance of window-based protocols (like TCP) for these rate-exceeded modems because of the timeouts and retransmits that follow.

Downstream Frequency Override

This feature allows Cisco uBR7200 series routers to change the downstream frequency for any or all cable modems, overriding the DOCSIS configuration file settings.

Upstream Address Verification

This feature prevents the spoofing of IP addresses by verifying the IP address against the cable modem's MAC address. The cable source-verify [ dhcp ] cable interface command specifies that DHCP leasequeries are sent to verify any unknown source IP address found in upstream data packets. This feature requires a DHCP server which supports the new LEASEQUERY message type.

Service Assurance Agent

The Service Assurance (SA) Agent is both an enhancement to and a new name for the Response Time Reporter (RTR) feature that was introduced in Cisco IOS Release 11.2. This feature allows you to monitor network performance by measuring key Service Level Agreement metrics such as response time, network resources, availability, jitter, connect time, packet loss, and application performance.

With Cisco IOS Release 12.0(5)T1, the SA Agent provides new capabilities that enable you to:

New Hardware Feature in Release 12.0(4)T

There are no new hardware features supported by the Cisco uBR7200 series universal broadband routers in Cisco IOS Release 12.0(4)T.

New Software Features in Release 12.0(4)T

The following new software features are supported by the Cisco uBR7200 series universal broadband routers in Cisco IOS Release 12.0(4)T.

Parse Bookmarks

The Parse Bookmarks feature quickly processes consecutive similar commands, such as access-lists and prefix-lists---up to five times faster than usual. Parse bookmarks reduce boot and load time for large configurations with many similar consecutive commands. This feature is an enhancement to the parsing algorithm; therefore, no configuration changes are needed.

Cable Modem and Host Subnet Addressing

This feature allows Cisco uBR7200 series routers to modify the giaddr field of DHCP DISCOVER packets, based on whether the source is a cable modem or a host. Cable modem and host subnet addressing can be enabled on a per-interface basis uding the [no] cable dhcp-giaddr [policy | primary] command.

Downstream Channel ID

This feature allows all cable modems in a hybrid fiber/coax (HFC) network to have unique downstream channel IDs.

New Hardware Features in Release 12.0(3)T

The following new hardware feature is supported by the Cisco uBR7200 series routers in Cisco IOS Release 12.0(3)T.

Cable Modem Card (MC16B)

The MC16B Cable Modem Card is available for the Cisco  uBR7200. The software for the MC16B card is a driver running on the Cisco uBR700. Using a PCI interface, the universal broadband router cable modem card software interacts with the MC16B card. Data is passed back and forth, as direct memory access (DMA) transfers, from the Cisco uBR7200 memory to the MC16B card.

Additionally, the MC16B card supports universal broadband router line card management and control with the MC16 MIB, MAC control software and logical link management software based on DOCSIS standards, and minimized security.

For more information, refer to the Update to the Cisco uBR7200 Series Cable Modem Card Installation and Configuration for the MC16B EFT Card publication.

New Software Features in Release 12.0(3)T

The following new software features are supported by the Cisco uBR7200 series routers in Cisco IOS Release 12.0(3)T.

Cisco IOS SNMP v3

Cisco IOS Simple Network Management Protocol version 3 (SNMPv3)  addresses issues related to the large scale deployment of SNMP for configuration, accounting and fault management. Currently SNMP is predominantly used for monitoring and performance management. The primary goal of SNMPv3 is to define a secure version of the SNMP protocol. SNMPv3 also facilitates remote configuration of the SNMP entities which make remote administration of SNMP entities a simple task. SNMPv3 builds on top of SNMPv1 and SNMPv2 to provide a secure environment for the management of systems and networks.

SNMPv3 provides an identification strategy for SNMP devices to facilitate communication only between known SNMP strategy. Each SNMP device has an identifier called the SNMP EngineID which is a copy of SNMP. Each SNMP message contains an SNMP EngineID. SNMP communication is possible only if an SNMP entity knows the identity of its peer SNMP device.

SNMPv3 also contains a security model or security strategy that exists between an SNMP user and the SNMP group to which the user belongs. A security model may define the security policy within an administrative domain or a intranet. The SNMPv3 protocol consists of the specification for the User based Security Model (USM).

Definition of security goals where the goals of message authentication service includes the following protection strategies:

They are:

Cisco uBR7246 Universal Broadband Router Feature Enhancements

Enhancements to the Cisco uBR7246 universal broadband router  extend and improve the command line interface (CLI). The CLI supports burst profile, quality of service (QoS), improved parameter configuration, the MC11 modem card, and the MC16 modem card. Downstream QoS handling is compliant with Multimedia Cable Network System (DOCSIS) requirements, and upstream QoS handling and Spectrum Management have been improved.

The Cisco uBR7246 universal broadband router supports multicast authentication via RADIUS, and security has been enhanced for baseline privacy (including DOCSIS Data Over Cable System Interface Specification (DOCSIS) compliance). Also, the Cisco uBR7246 now supports Dynamic Host Configuration Protocol (DHCP) Relay Subscriber ID Insertion.

These feature enhancements are supported on the Cisco uBR7246 cable router only.

NetFlow Policy Routing

IP policy routing  now works with Cisco Express Forwarding (CEF), Distributed CEF (DCEF), NetFlow, and NetFlow with flow acceleration. IP policy routing was formerly supported only in fast-switching and process-switching. Now that policy routing is integrated into CEF, your can deploy policy routing on a wide-scale and on high-speed interfaces.

Process MIB

The addition of the CISCO-PROCESS-MIB and changes to the CISCO-MEMORY-POOL-MIB will allow you to retrieve more CPU and memory statistics.

No New Features in Release 12.0(2)T

There are no new features supported by the Cisco uBR7200 series in Cisco IOS Release 12.0(2)T.

New Hardware Features in Release 12.0(1)T

The following new hardware features are supported by the Cisco uBR7200 series universal broadband router in Cisco IOS Release 12.0(1)T.

Cisco uBR7246 Universal Broadband Router

The Cisco uBR7246 features an I/O controller, up to two network interface port adapters, up to four cable modem cards, a network processing engine, and up to two power supplies. (Two power supplies in the Cisco uBR7246 provides load-sharing and redundancy capabilities.)

Cisco uBR7223 Universal Broadband Router

Based on the Cisco uBR7246, the Cisco uBR7223 features an I/O controller, a network interface port adapter, up to two cable modem cards, a network processing engine, and a removable power supply. (The Cisco uBR7223 does not feature load-sharing and redundant power supply capability like the Cisco uBR7246.)

New Software Features in Release 12.0(1)T

The following new software features are supported by the Cisco uBR7200 series universal broadband router in Cisco IOS Release 12.0(1)T.

ATM PVC Trap Support for ATM Subinterfaces

The ATM PVC Trap Support for ATM Subinterfaces  feature implements RFC2233 (MIB-II) for ATM subinterfaces, which are ATM subinterfaces will now be visible in the ifTable and are accessible to NMS. There are two entities in the ifTable corresponding to each subinterface: an atmSubif entity and an aal5 entity. The atmSubif entity corresponds to the "atm" layer and the aal5 entity corresponds to the AAL5 layer. The MIB variables supported are per RFC1695.

With this feature, you can send out Traps when a PVC leaves the UP state. Currently there is no mechanism for the Management station to be aware of a failing PVC. With this feature, a Management station is notified of a failing PVC by a trap, then the Management station can poll the agent for more information. This MIB is an extract from the draft "draft-ietf-atommib-atm2-11.txt" (Section 9). Generation of PVC Traps is dampened by a "Notification interval" in order to prevent trap storms. In effect no traps are sent until the interval lapses. The two tables provide information on the failures, such as the number of currently failing PVCs, timestamp of failure, total number of PVC failures on the interface, Notifical interval value, and the trap enable flag.

CLI String Search

The Command Line Interface (CLI) String Search  feature allows you to search or filter any show or more command's output. This is useful when you need to sort though large amounts of output, or if you want to exclude output that you do not need to see. CLI String Search also allows for searching and filtering at --More-- paging prompts.

With the search function, you can begin unfiltered output at the first line that contains a regular expression you specify. You can specify a maximum of one filter per command to either include or exclude output lines that contain the specified regular expression.

A regular expression is any word, phrase, number, etc. that appears in show or more command output.

Important Notes

The following sections contain important notes about Cisco IOS Release 12.0 T and can apply to Cisco uBR7200 series universal broadband routers.

Cisco IOS Syslog Failure

Certain versions of Cisco IOS software can fail when they receive invalid User Datagram Protocol (UDP) packets sent to their syslog ports (port 514). At least one commonly used Internet scanning tool generates packets that cause such problems. This fact has been published on public Internet mailing lists, which are widely read both by security professionals and by security crackers. This information should be considered in the public domain.

Attackers can cause Cisco IOS devices to repeatedly fail and reload, resulting in a completely disabled Cisco IOS device that needs to be reconfigured by its administrator. Some Cisco IOS devices can hang instead of failing when attacked. These devices do not recover until they are manually restarted by reset or power cycling. An administrator must visit the device to restart it, even if the attacker is no longer actively sending any traffic. Some devices have failed without providing stack traces; some devices indicate that they were "restarted by power-on," even when that was not the case.

Assume that any potential attacker knows the existence of this problem and the ways to exploit it. An attacker can use tools available to the public on the Internet and does not need to write any software to exploit the vulnerability. Minimal skill is required and no special equipment is required.

Despite Cisco specifically inviting such reports, Cisco has received no actual reports of malicious exploitation of this problem.

This vulnerability notice was posted on Cisco's World Wide Web site:

http://www.cisco.com/warp/public/770/iossyslog-pub.shtml

This information was also sent to the following e-mail and USENET news recipients:

Affected Devices and Software Versions

Table 5 describes hardware and software that are affected by this problem. Affected versions include Releases 11.3 AA, 11.3 DB, and all 12.0 versions (including 12.0 mainline, 12.0 S, 12.0 T, and any other regular released version whose number starts with 12.0), up to the repaired releases listed in Table 5. Cisco is correcting the problem in certain special releases, will correct it in future maintenance and interim releases, and intends to provide fixes for all affected IOS variants. See Table 5, Affected and Repaired Software Versions for details.

No particular configuration is needed to make a Cisco IOS device vulnerable. It is possible to filter out attack traffic by using access lists. See the "Workarounds" section for techniques. However, except at Internet firewalls, the appropriate filters are not common in customer configurations. Carefully evaluate your configuration before assuming that any filtering you have protects you against this attack.

The most commonly used or asked-about products are listed below. If you are unsure whether your device is running Cisco IOS software, log in to the device and enter the show version command. Cisco IOS software will identify itself simply as "IOS" or "Internetwork Operating System Software." Other Cisco devices do not have the show version command and identify themselves differently in their output. The most common Cisco devices that run Cisco IOS software include the following:

Affected software versions, which are relatively new, are not necessarily available on every device listed above. If you are not running Cisco IOS software, you are not affected by this problem.

The following Cisco devices are not affected:

This vulnerability has been assigned Cisco bug ID CSCdk77426.

Solution

Cisco offers free software updates to correct this vulnerability for all affected customers---regardless of their contract status. However, because this vulnerability information has been disseminated by third parties, Cisco has released this notice before updates are available for all software versions. Table 5 gives Cisco's projected fix dates.

Make sure that your hardware has adequate RAM to support the new software before installing it. The amount of RAM is seldom a problem when you upgrade within a major release, for example, from 11.2[11]P to 11.2[17]P, but it is often a factor when you upgrade between major releases, for example, from 11.2 P to 11.3 T.

Because fixes will be available for all affected releases, this vulnerability will rarely, if ever, require you to upgrade to a new major release. Cisco recommends that you carefully plan for any upgrade between major releases. Make certain no known bugs will prevent the new software from working properly in your environment.

Further upgrade planning assistance is available on Cisco's World Wide Web site at:

http://www.cisco.com

If you have service contracts, you can obtain new software through your regular update channels (generally through Cisco's World Wide Web site). You can upgrade to any software release, but you must remain within the boundaries of the feature sets you have purchased.

If you do not have service contracts, you can upgrade to only obtain the bug fixes; free upgrades are restricted to the minimum upgrade required to resolve the defects. You can only upgrade to the software described in one row of Table 5---except when no upgrade within the same row is available in a timely manner.

Obtain updates by contacting one of the following Cisco Technical Assistance Centers (TACs):

Give the URL of this notice (http://www.cisco.com/warp/public/770/iossyslog-pub.shtml) as evidence for a free update. Customers with no contracts must request for free updates through the TAC. For software updates, please do not contact either "psirt@cisco.com" or "security-alert@cisco.com.

Workarounds

You can work around this vulnerability by preventing any affected Cisco IOS device from receiving or processing UDP datagrams addressed to port 514. You can do this by either using packet filtering on surrounding devices, or by using input access list filtering on the affected IOS device itself.

If you use an input access list, apply it to all interfaces to which attackers can send datagrams. Interfaces include not only physical LAN and WAN interfaces but also virtual subinterfaces of those physical interfaces---as well as virtual interfaces and interface templates corresponding to GRE, L2TP, L2F, and other tunneling protocols.

The input access list must block traffic destined for UDP port 514 at any of the Cisco IOS device's own IP addresses---as well as at any broadcast or multicast addresses on which the Cisco IOS device may be listening. Be sure to block both old-style "all-zeros" broadcasts and new-style "all-ones" broadcasts. It is not necessary to block traffic being forwarded to other hosts---only traffic actually addressed to the Cisco IOS device.

No single input access list works in all configurations. Be sure you know the effect of your access list in your specific configuration before activating it.

The following example shows a possible access list for a three-interface router, along with the configuration commands needed to apply the list. The example assumes input filtering is not needed---other than as a workaround for this problem:

! Deny all multicasts, and all unspecified-net broadcasts, to port 514
access-list 101 deny udp any 224.0.0.0 31.255.255.255 eq 514
! Deny old-style unspecified-net broadcasts
access-list 101 deny udp any host 0.0.0.0 eq 514
! Deny network-specific broadcasts. This example assumes that all of
! the local interfaces are on the class B network 172.16.0.0, subnetted
! everywhere with mask 255.255.255.0. This will differ from network
! to network. Note that we block both new-style and old-style broadcasts.
access-list 101 deny udp any 172.16.0.255 0.0.255.0 eq 514
access-list 101 deny udp any 172.16.0.0   0.0.255.0 eq 514
! Deny packets sent to the addresses of our own network interfaces.
access-list 101 deny udp any host 172.16.1.1 eq 514
access-list 101 deny udp any host 172.16.2.1 eq 514
access-list 101 deny udp any host 172.16.3.3 eq 514
! Permit all other traffic (default would be to deny)
access-list 101 permit ip any any
 
! Apply the access list to the input side of each interface
interface ethernet 0
ip address 172.16.1.1 255.255.255.0
ip access-group 101 in
 
interface ethernet 2
ip address 172.16.2.1 255.255.255.0
ip access-group 101 in
 
interface ethernet 3
ip address 172.16.3.3 255.255.255.0
ip access-group 101 in
 

Listing all possible addresses---especially all possible broadcast addresses---to which attack packets can be sent is complicated. If you do not need to forward any legitimate syslog traffic received on an interface, you can block all syslog traffic arriving on that interface. Remember that blocking will affect traffic routed through the Cisco IOS device---as well as traffic destined to the device. If the IOS device is expected to forward syslog packets, you will have to filter in detail. Because input access lists impact system performance, install them with caution---especially on systems running very near their capacity.

Software Versions and Fixes

Many Cisco software images have been or will be specially reissued to correct this vulnerability. For example, regular released Cisco IOS version 12.0(2) is vulnerable, as are interim versions 12.0(2.1) to 12.0(2.3). The first fixed interim version of Release12.0 mainline software is Release12.0(2.4). However, a special release, 12.0(2a), contains only the fix for this vulnerability and does not include any other bug fixes from later 12.0 interim releases.

If you are running Release 12.0(2) and want to fix this problem without risking possible instability presented by installing the 12.0(2.4) interim release, you can upgrade to Release 12.0(2a). Release 12.0(2a) is a "code branch" from the Release 12.0(2) base, which will merge back into the Release 12.0 mainline at Release 12.0(2.4).

Special releases, like 12.0(2a), are one-time spot fixes, and they will not be maintained. Thus, the upgrade path from Release 12.0(2a) is to Release 12.0(3).

Table 5 specifies information about affected and repaired software versions.


Note All dates within this table are subject to change.


Table 5: Affected and Repaired Software Versions
Cisco IOS Major Release Description Special Fix1 First Fixed Interim Release2 Fixed Maintenance Release3
Unaffected Releases

11.2 and earlier---all variants

Unaffected early releases (no syslog server)

Unaffected

Unaffected

Unaffected

11.3, 11.3  T, 11.3 DA, 11.3 MA, 11.3 NA, 11.3 WA, 11.3(2)XA

11.3 releases without syslog servers

Unaffected

Unaffected

Unaffected

Releases based on 11.3

11.3 AA

11.3 early deployment for AS58xx

11.3(7)AA2, 8-JAN-19994

11.3(7.2)AA

11.3(8)AA, 15-FEB-1999

11.3 DB

11.3 for Cisco NRP routing blade in Cisco 6400 xDSL DSLAM

 

 

11.3(7)DB2, 18-JAN-1999

Releases based on 12.0

12.0

12.0 Mainline

12.0(2a), 8-JAN-1999

12.0(2.4)

12.0(3), 1-FEB-1999

12.0 T

12.0 new technology early deployment

12.0(2a)T1, 11-JAN-1999

12.0(2.4)T

12.0(3)T, 15-FEB-1999

12.0 S

ISP support; 7200, RSP, GSR

 

12.0(2.3)S, 27-DEC-1998

12.0(2)S5, 18-JAN-1999

12.0 DB

12.0 for Cisco 6400 universal access concentrator node switch processor (lab use)

 

 

12.0(2)DB, 18-JAN-1999

12.0(1)W

12.0 for Catalyst 8500 and LS1010

12.0(1)W5(5a) and 12.0(1a)W5(5b) (LS1010 platform only)

12.0(1)W5(5.15)

12.0(1)W5(6) (platform support for Catalyst 8540M will be in 12.0(1)W5(7))

12.0(0.6)W5

One-time early deployment for CH-OC12 module in Catalyst 8500 series switches.

Unaffected; one-time release

Unaffected

Unaffected; general upgrade path is via 12.0(1)W5 releases.

12.0(1)XA3

Short-life release; merged to 12/0T at 12.0(2)T

Obsolete

Merged

Upgrade to 12.0(2a)T1 and/or to 12.0(3)T.

12.0(1)XB

Short-life release for Cisco 800 series; merged to 12.0 T and 12.0 (3)T

12.0(1)XB1

Merged

Upgrade to 12.0(3)T.

12.0(2)XC

Short-life release for new features in Cisco 2600, Cisco 3600, ubr7200, ubr900 series; merged to 12.0 T at 12.0(3)T.

12.0(2)XC1, 7-JAN-1999

Merged

Upgrade to 12.0(3)T

12.0(2)XD

Short-life release for ISDN voice features; merged to 12.0 T at 12.0(3)T.

12.0(2)XD1, 18-JAN-1999

Merged

Upgrade to 12.0(3)T

12.0(1)XE

Short-life release

12.0(2)XE, 18-JAN-1999

Merged

Upgrade to 12.0(3)T

1A special fix is a one-time release that provides the most stable immediate upgrade path.
2Interim releases are tested less rigorously than regular, maintenance releases; interim releases may contain serious bugs.
3Fixed maintenance releases are on a long-term upgrade path. Other long-term upgrade paths also exist.
4All dates in this table are estimates, subject to change.
5This entry is not a misprint. The 12.0(2.3)S interim release is available before the 12.0(2)S regular release in which the vulnerability is fixed.

Deprecated MIBs

Old Cisco Management Information Bases (MIBs) will be replaced in a future release. OLD-CISCO-* MIBS are currently migrated into more scalable MIBs, without affecting existing Cisco IOS products or NMS applications. You can update from deprecated MIBs to the replacement MIBs as shown in Table 6.


Table 6: Deprecated and Replacement MIBs
Deprecated MIB Replacement

OLD-CISCO-APPLETALK-MIB

RFC1243-MIB

OLD-CISCO-CHASSIS-MIB

ENTITY-MIB

OLD-CISCO-CPUK-MIB

In Development

OLD-CISCO-DECNET-MIB

 

OLD-CISCO-ENV-MIB

CISCO-ENVMON-MIB

OLD-CISCO-FLASH-MIB

CISCO-FLASH-MIB

OLD-CISCO-INTERFACES-MIB

IF-MIB CISCO-QUEUE-MIB

OLD-CISCO-IP-MIB

 

OLD-CISCO-MEMORY-MIB

CISCO-MEMORY-POOL-MIB

OLD-CISCO-NOVELL-MIB

NOVELL-IPX-MIB

OLD-CISCO-SYS-MIB

(Compilation of other OLD* MIBS)

OLD-CISCO-SYSTEM-MIB

CISCO-CONFIG-COPY-MIB

OLD-CISCO-TCP-MIB

CISCO-TCP-MIB

OLD-CISCO-TS-MIB

 

OLD-CISCO-VINES-MIB

CISCO-VINES-MIB

OLD-CISCO-XNS-MIB

 

Caveats

Caveats describe unexpected behavior in Cisco IOS software releases. Severity 1 caveats are the most serious caveats; severity 2 caveats are less serious.

For information on caveats in Cisco IOS Release 12.0 T, see Caveats for Cisco IOS Release  12.0  T document.

All caveats in Release 12.0 are also in Release 12.0 T.

For information on caveats in Cisco IOS Release 12.0, see Caveats for Cisco IOS Release  12.0  document.


Note If you have an account with CCO, you can use Bug Navigator II to find caveats of any severity for any release. You can reach Bug Navigator II on CCO at: Service & Support: Online Technical Support: Software Bug Toolkit. You can also find Bug Navigator II at http://www.cisco.com/support/bugtools.

Related Documentation

The following sections describe the documentation available for the Cisco uBR7200 series universal broadband routers. These documents consist of hardware and software installation guides, Cisco IOS configuration and command references, system error messages, feature modules, and other documents.

Documentation is available as printed manuals or electronic documents, except for feature modules, which are available online on CCO and the Documentation CD-ROM.

Use these release notes with these documents:

Release-Specific Documents

The following documents are specific to Release 12.0 and are located on CCO and the Documentation CD-ROM:

You can reach the Cross-Platform Release Notes for Cisco IOS Release 12.0 from CCO at:
Service & Support: Documentation Home Page: Cisco IOS Software Configuration: Cisco IOS Release 12.0: Release Notes: Cross Platform Release Notes
You can reach the Cross-Platform Release Notes for Cisco IOS Release 12.0 on the Documentation CD-ROM at:
Cisco Product Documentation: Cisco IOS Software Configuration: Cisco IOS Release 12.0: Release Notes: Cross Platform Release Notes
You can reach these documents from CCO at:
Service & Support: Technical Documents
As a supplement to the caveats listed in "Caveats" in these release notes, see Caveats for Cisco IOS Release 12.0 and Caveats for Cisco IO S Release 12.0 T, which contain caveats applicable to all platforms for all maintenance releases of Release 12.0.
You can reach the caveat document from CCO at:
Service & Support: Documentation Home Page: Cisco IOS Software Configuration: Cisco IOS Release 12.0: Caveats
You can reach the caveat document on the Documentation CD-ROM at:
Cisco Product Documentation: Cisco IOS Software Configuration: Cisco IOS 12.0: Caveats

Platform-Specific Documents

These documents are available for the Cisco uBR7200 series universal broadband routers and on CCO and the Documentation CD-ROM.

You can reach Cisco uBR7200 series documentation on CCO at:

Service & Support: Documentation Home Page: Broadband/Cable Solutions: Cisco uBR7200 Series Universal Broadband Routers

You can reach Cisco uBR7200 series documentation on the Documentation CD-ROM at:

Broadband/Cable Solutions: Cisco uBR7200 Series Universal Broadband Routers

Feature Modules

Feature modules describe new features supported by Release 12.0 T and are updates to the Cisco IOS documentation set. A feature module consists of a brief overview of the feature, benefits, configuration tasks, and a command reference. As updates, the features modules are available online only. Feature module information is incorporated in the next printing of the Cisco IOS documentation set.

You can reach the feature modules on CCO at:

Service & Support: Documentation Home Page: Cisco IOS Software Configuration: Cisco IOS Release 12.0: New Feature Documentation: New Features in Release 12.0 T

You can reach the feature modules on the Documentation CD-ROM at:

Cisco Product Documentation: Cisco IOS Software Configuration: Cisco IOS Release 12.0: New Feature Documentation: New Features in Release 12.0 T

Cisco IOS Software Documentation Set

The Cisco IOS software documentation set consists of the Cisco IOS configuration guides, Cisco IOS command references, and several other supporting documents, which are shipped with your order in electronic form on the Documentation CD-ROM---unless you specifically ordered the printed versions.

Documentation Modules

Each module in the Cisco IOS documentation set consists of two books: a configuration guide and a corresponding command reference. Chapters in a configuration guide describe protocols, configuration tasks, and Cisco IOS software functionality, and contain comprehensive configuration examples. Chapters in a command reference provide complete command syntax information.Use each configuration guide with its corresponding command reference.

On CCO and the Documentation CD-ROM, two master hot-linked documents provide information for the Cisco IOS software documentation set: configuration guides and command references.

You can reach these documents on CCO at:

Service & Support: Documentation Home Page: Cisco IOS Software Configuration: Cisco IOS Release 12.0: Configuration Guides and Command References: Cisco IOS Interface Configuration Guide or Cisco IOS Interface Command Reference

You can reach these documents on the Documentation CD-ROM at:

Cisco Product Documentation: Cisco IOS Software Configuration: Cisco IOS Release 12.0: Configuration Guides and Command References: Cisco IOS Interface Configuration Guide or Cisco IOS Interface Command Reference

Release 12.0 Documentation Set

Table 7 describes the contents of the Cisco IOS Release 12.0 software documentation set, which is available in electronic form, and also in printed form upon request.


Note You can find the most current Cisco IOS documentation on CCO and the Documentation CD-ROM. These electronic documents may contain updates and modifications made after the paper documents were printed.

You can reach the Cisco IOS documentation set on CCO at:

Service & Support: Documentation Home Page: Cisco IOS Software Configuration: Cisco IOS Release 12.0: Configuration Guides and Command References

You can reach the Cisco IOS documentation set on the Documentation CD-ROM at:

Cisco Product Documentation: Cisco IOS Software Configuration: Cisco IOS Release 12.0: Configuration Guides and Command References


Table 7: Cisco IOS Software Documentation Set for Release 12.0
Books Chapter Topics

  • Configuration Fundamentals Configuration Guide

  • Configuration Fundamentals Command Reference

Configuration Fundamentals Overview
Cisco IOS User Interfaces
File Management
System Management

  • Bridging and IBM Networking Configuration Guide

  • Bridging and IBM Networking Command Reference

Transparent Bridging
Source-Route Bridging
Token Ring Inter-Switch Link
Remote Source-Route Bridging
DLSw+
STUN and BSTUN
LLC2 and SDLC
IBM Network Media Translation
DSPU and SNA Service Point
SNA Frame Relay Access Support
APPN
Cisco Database Connection
NCIA Client/Server Topologies
Cisco Mainframe Channel Connection
Airline Product Set

  • Dial Solutions Configuration Guide

  • Dial Solutions Command Reference

Dial-In Port Setup
Dial-In Terminal Services
Dial-on-Demand Routing (DDR)
Dial Backup
Dial-Out Modem Pooling
Large-Scale Dial Solutions
Cost-Control Solutions
ISDN
X.25 over ISDN
VPDN
Dial Business Solutions and Examples

  • Cisco IOS Interface Configuration Guide

  • Cisco IOS Interface Command Reference

Interface Configuration Overview

  • Network Protocols Configuration Guide, Part 1

  • Network Protocols Command Reference, Part 1

IP Addressing
IP Services
IP Routing Protocols

  • Network Protocols Configuration Guide, Part 2

  • Network Protocols Command Reference, Part 2

AppleTalk
Novell IPX

  • Network Protocols Configuration Guide, Part 3

  • Network Protocols Command Reference, Part 3

Apollo Domain
Banyan VINES
DECnet
ISO CLNS
XNS

  • Security Configuration Guide

  • Security Command Reference

AAA Security Services
Security Server Protocols
Traffic Filtering and Firewalls
IP Security and Encryption
Passwords and Privileges
Neighbor Router Authentication
IP Security Options

  • Cisco IOS Switching Services Configuration Guide

  • Cisco IOS Switching Services Command Reference

Switching Paths for IP Networks
Virtual LAN (VLAN) Switching and Routing

  • Wide-Area Networking Configuration Guide

  • Wide-Area Networking Command Reference

ATM
Frame Relay
SMDS
X.25 and LAPB

  • Voice, Video, and Home Applications Configuration Guide

  • Voice, Video, and Home Applications Command Reference

Voice over IP
Voice over Frame Relay
Voice over ATM
Voice over HDLC
Video Support
Universal Broadband Features

  • Quality of Service Solutions Configuration Guide

  • Quality of Service Solutions Command Reference

Classification
Scheduling
Packet Drop
Traffic Shaping
ATM QoS
SNA QoS
Line Protocols

  • Cisco IOS Software Command Summary

  • Dial Solutions Quick Configuration Guide

  • System Error Messages

  • Debug Command Reference

 


Note The Cisco Management Information Base (MIB) User Quick Reference publication is no longer published. For the latest list of MIBs supported by Cisco, see Cisco Network Management Toolkit on Cisco Connection Online. From CCO, click on the following path: Service & Support: Software Center: Network Mgmt Products: Cisco Network Management Toolkit: Cisco MIB.

Service and Support

For service and support for a product purchased from a reseller, contact the reseller, who offers a wide variety of Cisco service and support programs described in "Service and Support" of Cisco Information Packet shipped with your product.


Note If you purchased your product from a reseller, you can access CCO as a guest. CCO is Cisco Systems' primary real-time support channel. Your reseller offers programs that include direct access to CCO services.

For service and support for a product purchased directly from Cisco, use CCO.

Software Configuration Tips on the Cisco Technical Assistance Center Home Page

If you have a CCO login account, you can access the following URL, which contains links and helpful tips on configuring your Cisco products:

http://www.cisco.com/kobayashi/serv_tips.shtml

This URL is subject to change without notice. If it changes, point your web browser to CCO  and click on this path: Products & Technologies: Products: Technical Tips.

The following sections are provided from the Technical Tips page:

Cisco Connection Online

Cisco Connection Online (CCO) is Cisco Systems' primary, real-time support channel. Maintenance customers and partners can self-register on CCO to obtain additional information and services.

Available 24 hours a day, 7 days a week, CCO provides a wealth of standard and value-added services to Cisco's customers and business partners. CCO services include product information, product documentation, software updates, release notes, technical tips, the Bug Navigator, configuration notes, brochures, descriptions of service offerings, and download access to public and authorized files.

CCO serves a wide variety of users through two interfaces that are updated and enhanced simultaneously: a character-based version and a multimedia version that resides on the World Wide Web (WWW). The character-based CCO supports Zmodem, Kermit, Xmodem, FTP, and Internet e-mail, and it is excellent for quick access to information over lower bandwidths. The WWW version of CCO provides richly formatted documents with photographs, figures, graphics, and video, as well as hyperlinks to related information.

You can reach CCO in the following ways:

For a copy of CCO's Frequently Asked Questions (FAQ), contact cco-help@cisco.com. For additional information, contact cco-team@cisco.com.


Note If you are a network administrator and need personal technical assistance with a Cisco product that is under warranty or covered by a maintenance contract, contact Cisco's Technical Assistance Center (TAC) at 800 553-2447, 408 526-7209, or tac@cisco.com. To obtain general information about Cisco Systems, Cisco products, or upgrades, contact 800 553-6387, 408 526-7208, or cs-rep@cisco.com.

Documentation CD-ROM

Cisco documentation and additional literature are available in a CD-ROM package, which package that ships with your product. The Documentation CD-ROM, a member of the Cisco Connection Family, is updated monthly. Therefore, it might be more current than printed documentation. To order additional copies of the Documentation CD-ROM, contact your local sales representative or call customer service. The CD-ROM package is available as a single package or as an annual subscription. You can also access Cisco documentation on the World Wide Web at http://www.cisco.com, http://www-china.cisco.com, or http://www-europe.cisco.com.

If you are reading Cisco product documentation on the World Wide Web, you can submit comments electronically. Click Feedback in the toolbar and select Documentation. After you complete the form, click Submit to send it to Cisco. We appreciate your comments.





hometocprevnextglossaryfeedbacksearchhelp
Posted: Tue Sep 7 00:52:01 PDT 1999
Copyright 1989-1999©Cisco Systems Inc.