Cisco IOS Release 12.0(25)SX2

These release notes provide information about Cisco IOS software Release 12.0(25)SX2 for the Cisco 10000 series Internet router. These release notes are updated as needed to describe new features, memory requirements, hardware support, software platform deferrals, and changes to the microcode and related documents.

Cisco IOS Release 12.0(25)SX2 is based on Cisco IOS Release 12.0(25)S. The Cisco 10000 Internet router supports a subset of the new features in Cisco IOS Release 12.0(25)S. For more information, see the "New Features—Cisco IOS Release 12.0(25)S" section. This section lists the features supported on the Cisco 10000 Internet router.

To view the release notes for the following Cisco IOS software releases, go to the following URLs:

Cisco Security Advisory

Cisco routers and switches that are running Cisco IOS software and that are configured to process Internet Protocol Version 4 (IPv4) packets are vulnerable to a Denial of Service (DoS) attack. A rare sequence of crafted IPv4 packets sent directly to the device might cause the input interface to stop processing traffic when the input queue is full. No authentication is required to process the inbound packet. Processing of IPv4 packets is enabled by default. Devices that are running only IP Version 6 (IPv6) are not affected. A workaround is available.

System Requirements

This release requires that you have the performance routing engine (PRE), part number ESR-PRE1 installed in the Cisco 10000 series Internet router chassis. To verify which PRE is installed in the router, use the show version command.

Memory Requirements

Upgrading to a New Software Release

Upgrading from Earlier Cisco IOS Releases

Upgrading from Cisco IOS Release 12.(14)SL or from Earlier Releases Based on Cisco IOS Release 12.0(x)SL

Feature Set by Router	Image Name	Flash Memory	DRAM Memory	Runs From
Internet Router	c10k-p10-mz	40 MB	512 MB	RAM
Service Provider/ Secured Shell 3DES	c10k-k4p10-mz	40 MB	512 MB	RAM

If you are upgrading your software from Cisco IOS Release 12.0(14)SL or from earlier releases based on Cisco IOS Release 12.0(x)SL to Cisco IOS Release 12.0(25)SX2, save your current configuration file. If you decide to reinstall Cisco IOS Release 12.0(14)SL or an earlier release, you must also reinstall the configuration file associated with that release because some Border Gateway Protocol (BGP) configuration file entries in Cisco IOS Release 12.0(25)SX2 are not compatible with Cisco IOS Release 12.0(14)SL or earlier releases.

Upgrading Software on Redundant PREs

The procedure included in the "Upgrading Software on Redundant PREs" section instructs you to tell the Cisco 10000 router the location in which the new boot image resides. Be sure to specify c10k-p10-mz instead of the c10k-p6-mz image name indicated in the documentation.

New Features—Cisco IOS Release 12.0(25)SX2

Cisco IOS Release 12.0(25)SX2 contains no new features, but includes all of the new features introduced in Cisco IOS Release 12.0(25)SX1 and Cisco IOS Release 12.0(25)SX, which is based on Cisco IOS Release 12.0(25)S.

New Features—Cisco IOS Release 12.0(25)SX1

Cisco IOS Release 12.0(25)SX1 provides the following performance enhancements, but contains no new features.

This release improves the performance of the VTMS Link Utilization feature. The default queue size is based on link bandwidth instead of queue bandwidth as in previous releases.

The QA Error Recovery feature enables the router to recover quickly from problems known as QAERRORs, which can be caused by hardware or software issues. When a QAERROR occurs, the router might stop responding while it tries to recover from the problem. QA error recovery reduces the router down time to as little as one second. Previously, a fully loaded router might be down for up to five minutes (300 seconds).

The QA error recovery feature is enabled by default. To disable the feature, issue the following command:

When QA error recovery is successful, the router displays a console message indicating success. In addition, the show controllers cbus command indicates the number of QAERROR recoveries.

The following sample console messages show an occurrence of a QAERROR and the router's recovery from the error. The router might display additional messages during error recovery (which can help service technicians diagnose the cause of the problem).

The following example shows QA error recovery information in show controllers cbus command output:

New Features—Cisco IOS Release 12.0(25)SX

Cisco IOS Release 12.0(25)SX introduces support on the Cisco 10000 series Internet router for the following features:

The Policy-Map Scaling feature increases the system-wide number of quality of service (QoS) policy maps that you can configure. In Cisco IOS Release 12.0(25)SX, the Cisco 10000 Internet router supports up to 4,096 policy maps. Each policy-map command counts as one policy map. The policy-map command syntax is unchanged. The maximum number of classes that you can configure in a policy is 32 classes.

The Percent-Based Policing feature enables you to specify the police rate as a percentage of the bandwidth of the network interface on which policing is applied. To specify the police rate as a percentage, use the percent percent option of the police command:

The percent argument is a value from 1 to 100 and is required when you use the percent keyword.

When you use a percent-based police command within a nested policy, the police percent is based on the policy's topmost, class-default, shape rate. Otherwise, the police percent is based on the bandwidth of the network interface on which the police command is applied.

The Random Early Detection (RED) with Queue-Limit feature expands your ability to customize the size of a RED queue. In Cisco IOS Release 12.0(25)SX, you can simultaneously use the queue-limit and random-detect commands in the same class of a policy.

The Enhanced RED Statistics feature maintains RED drop statistics for each IP precedence or differentiated services code point (DSCP) value.

Note In releases earlier than Cisco 12.0(25)SX, RED drop counts were maintained only for each class.

The 3-Level Policies feature increases the hierarchical levels of a nested QoS policy from two to three levels. A 3-level policy is typically used to define the transmission capacity of a virtual circuit in the top level, class-based queuing at the middle level, and marking or metering in the bottom level.

The service-policy command configured inside a policy map is used to define a hierarchical policy. The syntax of the command is unchanged. You can use the service-policy command in the top and middle levels of a 3-level policy.

The Virtual Circuit (VC) Oversubscription feature enables service providers to improve network utilization of otherwise underutilized shared networks by leveraging statistical multiplexing on ATM, Frame Relay, and IEEE 802.1Q networks. Instead of supporting only unconditional reservation of network bandwidth to VCs, the Cisco 10000 router offers VC oversubscription to statistically guarantee bandwidth to VCs.

To configure VC oversubscription for Frame Relay and IEEE 802.1Q, use the service-policy command. You can optionally use the service-policy class configuration command, creating a nested policy to manage traffic within a virtual circuit. For this reason, the term Nested Policy-Map Oversubscription is sometimes used to refer to VC Oversubscription.

To enable oversubscription of ATM VCs, you must configure the following interface configuration command in service-internal mode:

Note You do not need to use the service-policy command to specify the ATM VC oversubscription, because a variable bit rate (VBR) ATM VC uses sustained cell rate (SCR) to define the VC's average transmission rate.

The External Border Gateway Protocol (EBGP) Label Distribution feature enables you to configure a carrier supporting carrier network that uses BGP to distribute routes and MPLS labels between the provider edge (PE) and customer edge (CE) routers of a backbone carrier and a customer carrier. The backbone carrier offers BGP and MPLS VPN services. The customer carrier can be one of the following:

For information on how to use BGP to distribute MPLS labels and routes for both types of customer carrier, refer to the MPLS VPN Carrier Supporting Carrier—IPv4 BGP Label Distribution, Release 12.0(21)ST feature module and the Inter-Autonomous Systems for MPLS VPNs, Release 12.1(5)T feature module.

New Features—Cisco IOS Release 12.0(25)S

The following is a brief list of the new features in Cisco IOS Release 12.0(25)S on which Cisco IOS Release 12.0(25)SX is based. Only new features that are supported by the Cisco 10000 router are listed here. New features for other platforms (such as the Cisco 12000 series Internet router) are not listed.

Introduced on the Cisco 10000 router in Cisco IOS Release 12.0(23)SX, the Link Fragmentation and Interleaving (LFI) feature reduces delay and jitter on slower-speed links by breaking up large datagrams and interleaving low-delay traffic packets (such as voice) with the smaller packets resulting from the fragmented datagram. The feature supports Frame Relay (FRF.12) end-to-end and Multilink PPP (MLPPP).

Introduced on the Cisco 10000 router in Cisco IOS Release 12.0(23)SX, the single rate 3-Color Marker feature meters an IP packet stream and marks its packets different colors, based on the Committed Information Rate (CIR) and two associated burst sizes: Committed Burst Size (CBS) and Excess Burst Size (EBS). This feature is useful, for example, for ingress policing of a service, where service eligibility is determined only by the burst's length, and not its peak rate.

The Multicast for Multiprotocol Label-Switching (MPLS)/Virtual Private Network (VPN) feature enables service providers to offer multicast services over their MPLS core network. This feature was introduced on the Cisco 10000 router in Cisco IOS Release 12.0(23)SX.

This feature enables you to limit the number of routes that can be redistributed into the Open Shortest Path First (OSPF) protocol. The feature helps to eliminate the potential for flooding that might occur when a large number of routes are accidentally redistributed into OSPF.

This feature enables you to limit the number of routes that can be redistributed into the Intermediate System-to-Intermediate System (IS-IS) protocol. This feature helps to eliminate the potential for flooding that might occur when a large number of routes are accidentally redistributed into IS-IS.

This feature enables you to slow down the rate at which the Open Shortest Path First (OSPF) protocol sends Link State Advertisement (LSA) updates during periods of network instability. This feature uses a back-off algorithm to perform the LSA throttling.

Limitations and Restrictions

The following limitations and restrictions apply to the Cisco 10000 router 3-Level Policies feature:

•

A top-level policy must specify only the class named class-default with only the shape command specified before the service-policy command attaches an inner policy.

•

In an inner policy, to attach a service-policy command to a class's bottommost policy, do not configure the police and set commands for the class. Classes without a service-policy command configured are not restricted from using the police and set commands.

•

In a bottommost policy, configure only the police and set commands for a class.

•

Define each bottommost class map to match only those packets that also match its parent class map. For example, the union of the set of packets of a bottommost class and that of its parent class must be equal to the set of packets that match the parent class.

•

The nested-policy shape rate is reserved for nested-policy traffic only. Excess bandwidth is not used for other traffic.

Note

The actual shape rate applied to nested-policy traffic might differ from that specified in the policy. For example, a specified shape rate of 10.5 Mbps might be mapped to 11 Mbps. Use the command show policy-map interface to determine the actual shape rate.

Ensure that the Fast Ethernet NME port on the PRE is configured for auto-negotiation mode, which is the system default. Duplex mode can cause problems, such as flapping. If the port is experiencing such problems and has been configured for duplex mode, use the no half-duplex or no full-duplex command to disable duplex mode.

It is important that you limit the rate that system messages are logged by the Cisco 10000 router. This helps to avoid a situation in which the router becomes unstable and the CPU is overloaded. To control the output of messages from the system, use the logging rate-limit command.

Cisco recommends that you configure the logging rate-limit command as follows. This limits the rate of all messages to the console to 10 per second, except for messages with critical priority (level 3) or greater.

For more information, refer to the logging rate-limit command in the Cisco IOS Configuration Fundamentals and Network Management Command Reference, Release 12.3.

The following limitations apply to the Cisco 10000 router implementation of Frame Relay:

Cisco IOS software running on the Cisco 10000 series Internet router has multiple queues for all classes of traffic over high-speed interfaces. The software selects a queue based on the source and destination address for the packet. This ensures that a traffic flow always uses the same queue and the packets are transmitted in proper order.

When the Cisco 10000 series Internet router is installed in a real network, the high-speed interfaces work efficiently to spread traffic flow equally over the queues. However, using single traffic streams in a laboratory environment may result in less-than-expected performance.

Therefore, to ensure accurate test results, you should test the throughput of the gigabit Ethernet, Packet over SONET (POS), or ATM uplink with multiple source or destination addresses.

Tip

To determine if traffic is being properly distributed, use the show hardware pxf cpu queue command.

Open Caveats—Cisco IOS Release 12.0(25)SX2

Table 1 Open Caveats in Cisco IOS Release 12.0(25)SX2
Caveat	Description
CSCea42432	(Duplicate of CSCea52307) If you delete a service policy from an ATM interface, a traceback message or error message may appear. Workaround: None.
CSCea74742	Policing conformed packets might be less than expected when the normal burst size is set to less than two times the packet size. Workaround: Change the normal burst size to a value larger than 2 times the police frame size.
CSCea93642	When a large number of policy maps are configured on the Cisco 10000 router, it could take more time than expected before all the policy maps activate. Before an interface's policy map activates, the traffic on the interface receives default treatment. The router compiles a super access control list (ACL) for each policy map configured. On an average, the compilation of one super ACL takes approximately one-half second. When a large number of policy maps are configured, the router requires more time to compile all of the super ACLs. Workaround: Wait approximately 0.65 seconds for each policy-map to become operational. For more than one policy map, wait (N * 0.65) seconds for all the policy maps to become operational (where N is the number of policy maps).
CSCeb02953	When traffic is sent through an ATM subinterface to which a QoS service policy is attached, the packet count of the output queue obtained by using the show policy-map interface command does not match the packet output count obtained by using the show interface atm-subinterface command. Workaround: To obtain the correct packet output count, use the show policy-map interface command. Do not use the show interface atm-subinterface command to obtain packet output counts for ATM subinterfaces.
CSCeb27728	When microcode is reloading and traffic is running over the interface, the interface output packet and byte counters display incorrect values. Workaround: Clear the counters.
CSCeb38728	Under extremely rare circumstances, when you remove a 3-level policy map attached to 4,000 VLAN interfaces, the Cisco 10000 router stops responding. Workaround: None.
CSCeb62137	When weighted random early detection (WRED) is enabled and traffic on the interfaces is overloaded, a one-time parallel express forwarding (PXF) buffer leak occurs for a very small fraction of the total number of available buffers. This does not have a visible effect on the operation of the Cisco 10000 router. Workaround: None.
CSCec16481	A Cisco device running Internetwork Operating System (IOS) and enabled for the Open Shortest Path First (OSPF) Protocol is vulnerable to a Denial of Service (DoS) attack from a malformed OSPF packet. The OSPF protocol is not enabled by default. The vulnerability is only present in IOS release trains based on 12.0S, 12.2, and 12.3. Releases based on 12.0, 12.1 mainlines and all IOS images prior to 12.0 are not affected. Refer to the Security Advisory for a complete list of affected release trains. Workaround: Further details and the workarounds to mitigate the effects are explained in the Security Advisory which is available at the following URL: http://www.cisco.com/warp/public/707/cisco-sa-20040818-ospf.shtml.

Resolved Caveats—Cisco IOS Release 12.0(25)SX2

This section describes caveats that were fixed in Cisco IOS Release 12.0(25)SX2.

For information about caveats fixed in other Cisco IOS releases, refer to the appropriate Release Note document at the following URL:

(Duplicate of CSCea34851) If you delete an ATM PVC bundle, the router no longer displays the following error and traceback message (the hex values in your message may differ):

The Cisco 10000 router no longer experiences memory fragmentation when a large number (for example, 274,000) of static routes are configured.

(Duplicate of CSCea72960, CSCeb65647) The output rate is now correct when the Cisco 10000 router applies the policy-map on ATM and Frame Relay interfaces.

When two simultaneous terminal sessions displayed or updated the QoS configuration, the Cisco 10000 router sometimes reloaded. This occurred when one terminal session executes the show policy-map interface command and was suspended in the more state, and the other session attempted to update or remove a service policy. This has been fixed.

When you attempted to delete an existing permanent virtual circuit (PVC) or a permanent virtual path (PVP) after a Route Processor Redundancy Plus (RPR+) switchover occurred, the delete operation failed and the PVC remained in the active state. As a result, you could not recreate the PVC or PVP, but you could create a new PVC or PVP. This has been fixed.

After upgrading to Cisco IOS Release 12.0(25)SX, the Cisco 10000 router no longer sends syslog messages to the server. This has been fixed.

When you started up the Cisco 10000 router for the first time, all of the ports were up instead of being in administrative shutdown mode. This activated all of the alarms and the only way to terminate the alarms was to manually shut down the interfaces. This has been fixed.

Previously, the Cisco 10000 router did not correctly mark inbound QoS with multicast packets. When the router classified a QoS with multicast packet, it ignored the precedence or DSCP bit and misclassified the packet. This has been fixed.

If you executed the ping command immediately after you attached a QoS policy map to an ATM interface, the router's PXF engine failed. This occurred when you applied QoS policy maps to the input and output Gigabit Ethernet interfaces of an MPLS provider edge (PE) router. This has been fixed.

The Cisco IOS software no longer fails when you copy configuration and deconfiguration files to the Cisco 10000 router for a 1-port OC-12 ATM line card with automatic protection switching (APS) configured.

Unusually high rates of multicast control traffic can cause the Cisco 10000 router to be delayed in responding to console input or, in the worst case, to stop responding altogether.

Obtaining Documentation

Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems.

Cisco.com

You can access the most current Cisco documentation on the World Wide Web at this URL:

Documentation CD-ROM

Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which may have shipped with your product. The Documentation CD-ROM is updated monthly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual subscription.

Registered Cisco.com users can order the Documentation CD-ROM (product number DOC-CONDOCCD=) through the online Subscription Store:

Ordering Documentation

•

Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Networking Products MarketPlace:

•

Registered Cisco.com users can order the Documentation CD-ROM (Customer Order Number DOC-CONDOCCD=) through the online Subscription Store:

•

Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, U.S.A.) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387).

Documentation Feedback

You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click Feedback at the top of the page.

Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883

Obtaining Technical Assistance

Cisco provides Cisco.com, which includes the Cisco Technical Assistance Center (TAC) Website, as a starting point for all technical assistance. Customers and partners can obtain online documentation, troubleshooting tips, and sample configurations from the Cisco TAC website. Cisco.com registered users have complete access to the technical support resources on the Cisco TAC website, including TAC tools and utilities.

Cisco.com

Cisco.com offers a suite of interactive, networked services that let you access Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world. Cisco.com provides a broad range of features and services to help you with these tasks:

To obtain customized information and service, you can self-register on Cisco.com at this URL:

Technical Assistance Center

The Cisco TAC is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two levels of support are available: the Cisco TAC website and the Cisco TAC Escalation Center. The avenue of support that you choose depends on the priority of the problem and the conditions stated in service contracts, when applicable.

•

Priority level 4 (P4)—You need information or assistance concerning Cisco product capabilities, product installation, or basic product configuration.

•

Priority level 3 (P3)—Your network performance is degraded. Network functionality is noticeably impaired, but most business operations continue.

•

Priority level 2 (P2)—Your production network is severely degraded, affecting significant aspects of business operations. No workaround is available.

•

Priority level 1 (P1)—Your production network is down, and a critical impact to business operations will occur if service is not restored quickly. No workaround is available.

Cisco TAC Website

You can use the Cisco TAC website to resolve P3 and P4 issues yourself, saving cost and time. The site provides around-the-clock access to online tools, knowledge bases, and software:

All customers, partners, and resellers who have a valid Cisco service contract have complete access to the technical support resources on the Cisco TAC website. Some services on the Cisco TAC website require a Cisco.com login ID and password. If you have a valid service contract but do not have a login ID or password, go to this URL to register:

If you are a Cisco.com registered user, and you cannot resolve your technical issues by using the Cisco TAC website, you can open a case online at this URL:

If you have Internet access, we recommend that you open P3 and P4 cases through the Cisco TAC website so that you can describe the situation in your own words and attach any necessary files.

Cisco TAC Escalation Center

The Cisco TAC Escalation Center addresses priority level 1 or priority level 2 issues. These classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer automatically opens a case.

To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to this URL:

Before you call, check with your network operations center to determine the level of Cisco support services to which your company is entitled: for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). When you call the center, have your service agreement number and your product serial number available.

Obtaining Additional Publications and Information

Information about Cisco products, technologies, and network solutions is available from various online and printed sources.

•

The Cisco Product Catalog describes the networking products offered by Cisco Systems, as well as ordering and customer support services. Access the Cisco Product Catalog at this URL:

•

Cisco Press publishes a wide range of networking publications. Cisco suggests these titles for new and experienced users: Internetworking Terms and Acronyms Dictionary, Internetworking Technology Handbook, Internetworking Troubleshooting Guide, and the Internetworking Design Guide. For current Cisco Press titles and other information, go to Cisco Press online at this URL:

•

Packet magazine is the Cisco quarterly publication that provides the latest networking trends, technology breakthroughs, and Cisco products and solutions to help industry professionals get the most from their networking investment. Included are networking deployment and troubleshooting tips, configuration examples, customer case studies, tutorials and training, certification information, and links to numerous in-depth online resources. You can access Packet magazine at this URL:

•

iQ Magazine is the Cisco bimonthly publication that delivers the latest information about Internet business strategies for executives. You can access iQ Magazine at this URL:

•

Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL:

•

Training—Cisco offers world-class networking training. Current offerings in network training are listed at this URL:

Table Of Contents

Release Notes for the Cisco 10000 Series Internet Router for Cisco IOS Release 12.0(25)SX2

Contents

Cisco Security Advisory

System Requirements

Memory Requirements

Upgrading to a New Software Release

Upgrading from Earlier Cisco IOS Releases

Upgrading Software on Redundant PREs

New Features—Cisco IOS Release 12.0(25)SX2

New Features—Cisco IOS Release 12.0(25)SX1

New Features—Cisco IOS Release 12.0(25)SX

New Features—Cisco IOS Release 12.0(25)S

Limitations and Restrictions

Open Caveats—Cisco IOS Release 12.0(25)SX2

Resolved Caveats—Cisco IOS Release 12.0(25)SX2

Obtaining Documentation

Cisco.com

Documentation CD-ROM

Ordering Documentation

Documentation Feedback

Obtaining Technical Assistance

Cisco.com

Technical Assistance Center

Cisco TAC Website

Cisco TAC Escalation Center

Obtaining Additional Publications and Information

All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0304R)

Copyright � 2003, Cisco Systems, Inc.
All rights reserved.

Table Of Contents

Release Notes for the Cisco 10000 Series Internet Router for Cisco IOS Release 12.0(25)SX2

Contents

Cisco Security Advisory

System Requirements

Memory Requirements

Upgrading to a New Software Release

Upgrading from Earlier Cisco IOS Releases

Upgrading Software on Redundant PREs

New Features—Cisco IOS Release 12.0(25)SX2

New Features—Cisco IOS Release 12.0(25)SX1

New Features—Cisco IOS Release 12.0(25)SX

New Features—Cisco IOS Release 12.0(25)S

Limitations and Restrictions

Open Caveats—Cisco IOS Release 12.0(25)SX2

Resolved Caveats—Cisco IOS Release 12.0(25)SX2

Obtaining Documentation

Cisco.com

Documentation CD-ROM

Ordering Documentation

Documentation Feedback

Obtaining Technical Assistance

Cisco.com

Technical Assistance Center

Cisco TAC Website

Cisco TAC Escalation Center

Obtaining Additional Publications and Information

All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0304R)

Copyright � 2003, Cisco Systems, Inc.All rights reserved.

Copyright � 2003, Cisco Systems, Inc.
All rights reserved.