|
|
Table Of Contents
Resolved Caveats—Cisco IOS Release 12.1(26)E1
Open Caveats—Cisco IOS Release 12.1(26)E
Resolved Caveats—Cisco IOS Release 12.1(26)E
Resolved Caveats—Cisco IOS Release 12.1(23)E1
Resolved Caveats—Cisco IOS Release 12.1(23)E
Resolved Caveats—Cisco IOS Release 12.1(22)E
Resolved Caveats—Cisco IOS Release 12.1(20)EB
Resolved Caveats—Cisco IOS Release 12.1(20)E
Resolved Caveats—Cisco IOS Release 12.1(19)E2
Resolved Caveats—Cisco IOS Release 12.1(19)E
Resolved Caveats—Cisco IOS Release 12.1(14)EB1
Resolved Caveats—Cisco IOS Release 12.1(14)EB
Resolved Caveats—Cisco IOS Release 12.1(14)E1
Resolved Caveats—Cisco IOS Release 12.1(13)EB1
Resolved Caveats—Cisco IOS Release 12.1(13)E1
Resolved Caveats—Cisco IOS Release 12.1(12c)EY
Resolved Caveats—Cisco IOS Release 12.1(12c)E1
Resolved Caveats—Cisco IOS Release 12.1(12c)E
Resolved Caveats—Cisco IOS Release 12.1(11b)E1
Resolved Caveats—Cisco IOS Release 12.1(11b)E
Resolved Caveats—Cisco IOS Release 12.1(10)EY
Resolved Caveats—Cisco IOS Release 12.1(10)E
Resolved Caveats—Cisco IOS Release 12.1(7a)EY1
Resolved Caveats—Cisco IOS Release 12.1(7a)EY
Resolved Caveats—Cisco IOS Release 12.1(6)EY
Resolved Caveats—Cisco IOS Release 12.1(5)EY1
Obtaining Technical Assistance
Obtaining Additional Publications and Information
Release Notes for the Catalyst 8510 and the LightStream 1010 Switch for Cisco IOS Release 12.1(26)E1, Part 2: Caveats
April 12, 2005
Catalyst 8510 and LightStream 1010 Switch for Cisco IOS Release 12.1(26)E1
Text Part Number: OL-7462-01 Rev. B1
This document lists severity 1 and 2 caveats and select severity 3 caveats for Cisco IOS Release 12.1(5a)EY, up to and including Release 12.1(26)E1. Caveats describe unexpected behavior or defects in Cisco IOS software releases for the Catalyst 8510 and the LightStream 1010 switch. Severity 1 caveats are the most serious caveats; severity 2 caveats are less serious.
To improve this document, we would appreciate your comments. If you are reading Cisco product documentation on the World Wide Web, you can submit comments electronically at http://www.cisco.com/feedback/ or you can contact caveats-doc@cisco.com.
For more information, see the "Documentation Feedback" section.
Note
This Cisco IOS Release 12.1(26)E1 is the last release supporting the Catalyst 8510 CSR platform.
Note
How to Use This Document
This document describes open and resolved severity 1 and 2 caveats and select severity 3 caveats:
•
•
Within the sections the caveats are sorted by technology in alphabetical order. For example, AppleTalk caveats are listed separately from, and before, IP caveats. The caveats are also sorted alphanumerically by caveat number.
If You Need More Information
Cisco documentation and additional literature are available on Cisco.com.
For more information on caveats and features in Cisco IOS Release 12.1 T, see the following sources:
•
•
•
•
Note
Resolved Caveats—Cisco IOS Release 12.1(26)E1
Cisco IOS Release 12.1(26)E1 is a rebuild release for Cisco IOS Release 12.1(26)E. The caveats in this section are resolved in Cisco IOS Release 12.1(26)E1 but may be open in previous Cisco IOS releases.
•
Symptom: Bridge-groups may put a OSPF neighbor in the INIT state. With OSPF neighborship established when you add the bridge-group (in this case vlan-bridge), the neighborship is put into the INIT state. This also applies with DEC and IBM.
Workaround: None
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
Open Caveats—Cisco IOS Release 12.1(26)E
This section describes possibly unexpected behavior by Cisco IOS Release 12.1(26)E1. All the caveats listed in this section are open in Cisco IOS Release 12.1(26)E1. This section describes severity 1 and 2 caveats and select severity 3 caveats.
•
Symptom: Static programming of bridge MAC entries does not work. If you configure the brdging entry on the ATM router module (ARM) subinterface, the ifindex value is programmed instead of the outgoing VC value and the traffic to this destination MAC is dropped.
Workaround: None.
•
Symptom: The number of point-to-multipoint Soft-PVC connections on the destination switch displayed by the output of the show atm state command might display conflicting results with the output of show atm vc conn-type soft cast p2mp command. The show atm vc conn-type soft cast p2mp command displays the correct status of the point-to-multipoint Soft-PVC connections on the switch.
Workaround: None.
•
Symptom: Input and output packet counters do not increment when jumbo frames pass through the interface.
Note
Workaround: None.
•
Symptom: When the following command is entered the LightStream 1010 switch crashes:
LS1010(config)# no atm oam intercept end-to-endWorkaround: None.
•
Symptom: On a Catalyst 8510 MSR switch connected to a third party switch over an IMA connection with only one active link a synchronization error might occur on the third party switch.
This problem does not appear on connections between Cisco equipment, if there are at least two links in the IMA group, or if the E1/T1 link is not an IMA connection. This is caused by delayed ICP cells on the Cisco side causing the synchronization error.
Workaround: Use two or more active links in the IMA group or use a single link without the IMA configuration.
•
Symptom: When the switch tries to flood a PTSP (PNNI Topology State Packet), whose size is greater than 4096 bytes, the switch reloads due to memory corruption. This problem usually occurs a when large number of ATM prefixes are being advertised by a PNNI node.
This problem occurs only when the PTSP being flooded is greater than 4096 bytes.
Workaround: None.
•
Symptom: When reloading the image on a LightStream 1010 ATM switch running Cisco IOS Release 12.0(28)W5(30), you might see the following error message during bootup:
%LANE-3-LANE_ERROR: lecs finder: finderGetIlmiClientId: ilmi_register_clientfailed00:00:06: %SYS-3-LOGGER_FLUSHING: System pausing to ensure console debuggingoutput.%LANE-3-LECS_ERROR: registerLECSwithILMI-Process= "Init", ipl= 2, pid= 2-Traceback= 606891B4 6069D690 606A1AF0 6067A190 600B341C 600B34D0 600292E8 600294AC 6009950C600994F800:00:06: %SYS-3-LOGGER_FLUSHING: System pausing to ensure console debugging output.%LANE-3-LES_ERROR: lsv_setup_lsv_ilmiWorkaround: None.
•
Symptom: ILMI registration might fail on Cisco switches and routers connected to Lucent products.
For example, entering the show atm ilmi-status could display the following:
Switch# show atm ilmi-statusInterface : ATMX/Y Interface Type : Private UNI (User-side)ILMI VCC : (0, 16) ILMI Keepalive : Enabled/Up (5 Sec 4 Retries)ILMI State: UpAndNormalPeer IP Addr: 0.0.0.0 Peer IF Name:Peer MaxVPIbits: 8 Peer MaxVCIbits: 14ILMI PVC is UP, but address registration failed
Note
Workaround: Reload the switch or router.
•
Symptom: Debugs remain enabled for removed interface modules.
1. If you use the debug atm sig-all command, the debugs are enabled for an interface. If that interface module is removed from the chassis, the show debug command output continues to show that "sig-all" debugs are enabled for the removed interface module.
2. If you use the deb atm sig-all command, the debugs are enabled for all interfaces and if an interface module is removed from the chassis, the show debug command output continues to show that "sig-all" debugs are enabled for the removed interface modules.
This is only a display issue. There is no impact on functionality.
Workaround: None.
•
Symptom: When connecting the IMA interface module from a Catalyst 8510 MSR or LightStream 1010 ATM switch to a Nortel Passport 15000, the IMA interface does not come up.
Workaround: None.
•
Symptom: On the LightStream 1010 switch, a PNNI PVC link on an NNI interface might flap after the link stabilizes and the ATM PNNI VC component does not come back up.
Workaround: "Bounce" the PNNI process using the no atm router pnni and atm router pnni configuration commands to disable and enable the PNNI processes.
•
Symptom: If configuring RFC1483 bridging on the ATM router module, when certain RFC 1483 bridging PVC cable connections are unplugged the Catalyst 8510MSR CPU utilization will become very high. This could last a few hours until you shutdown the corresponding bridge-group subinterface on the ATM router module. Only shutting down the physical ATM port will not help.
Workaround: Shutdown the corresponding bridging group subinterface on ATM router module.
•
Symptom: The enhanced ATM router module subinterface counters do not get updated.
Workaround: None.
•
Symptom: When reloading the switch the following error message appears after a varying number of SVCs are set up.
00:20:42: %ATMCORE-3-INTERNAL_ERROR: atmCore_connCheckSpot: exhausted vpi/vciWorkaround: None
•
Symptom: PNNI and SSCOP signaling does not come back up on the Catalyst 8510 MSR OC48 interfaces after a power loss and restart.
Workaround: None.
•
Symptom: LDP session does not go down when you shut the enhanced ATM router module interface. When tag-switching is configured on a Fast Ethernet interface and the controlling ATM router module is either not configured or shutdown, TDP will come up but the tag packets received on the Fast Ethernet interface will be dropped because there is no controlling ATM router module to process the packets.
Workaround: Make sure the Fast Ethernet interface is linked to an active controlling ATM router module.
•
Symptom: A tag switching traceback might appear when an interface is shut.
Workaround: None.
•
Symptom: When a circuit emulation service (CES) circuit that is carrying traffic is removed, no warning message is shown.
Workaround: None.
•
Symptom: PNNI goes to down state on all interfaces, and all adjacency is lost.
Workaround: None.
•
Symptom: The Soft-VC permanent virtual connection (PVC) status is indicated as ACTIVE only when the Soft VC is established, and its connection state is UP. If the Soft VC is not connected, the source end of the Soft VC indicates the PVC status as INACTIVE instead of ACTIVE, and the destination end of the Soft VC does not exist, and therefore indicates the PVC status as DELETED.
Workaround: None.
•
Symptom: Single bit errors have been observed on CES circuits originating on the same interface module if two other circuits always carry non-spec-conform AAL1 SNP for SN=0. Only this very high number of SNP errors in 1/8 of all AAL1 cells causes the issue. Multiple SNP corrections that could be seen in production networks are handled correctly without data-loss or corruption.
This is an interoperability issue with a Lucent PSAX 2300.
Workaround: None.
•
Symptom: The Catalyst 8510 MSR switch may ignore certain commands from the NVRAM after a reboot. This appears most often on switches with dual route processors.
Workaround: Create a connection traffic index and use that number for the set up of the PVC.
•
Symptom: If the ASP or 8515MSRP installed in a Catalyst 5500 chassis is OIR removed an installed OC12 Single Mode Intermediate Reach module (WAI-OC12-1SS=) continues to send carrier on the OC-12 interface. This causes the interface of the ATM device connected to this interface to display an up/up state even though the interface is reporting constant errors.
This affects all Cisco IOS versions for the Catalyst 8510 MSR and LightStream 1010.
Note
Workaround: None.
•
Symptom: After performing consecutive OIRs of three traffic-shaping carrier modules (TSCAMs) in a chassis more than 20 times, memory allocation fails. Because the TSCAMs require 2 MB of contiguous memory, this failure might occur on a system with severely fragmented memory.
Workaround: Do not perform a large number of consecutive OIRs on the TSCAM and do not perform an OIR on a module that has a large number of VCs.
•
Symptom: After a reload, the switch router's memory might be corrupted. This occurs after the following error messages are displayed:
TLB (store) exception occurred on ...dcl-dram-excep: A3420019, dcl-memd-excep: 60C10100, dcl-io-excep: 012C1580"TLB (load or instruction fetch) exception occurred on 00/05/03 10:38:16 ...dcl-dram-excep: A3420019, dcl-memd-excep: 60C10100, dcl-io-excep: 012C15"," *** Unknown External Interrupt *** Stacked Cause = 0x0, StacWorkaround: None.
•
Symptom: There is a noise problem with the CES PAM hardware version one.
Workaround: None.
•
A ROMMON configuration might not work properly.
Symptom: A ROMMON configuration might not work properly on a slot after performing an OIR on the interface module in that slot.
Workaround: Reload the switch router.
•
Symptom: On the LightStream 1010 switch when you try to use the atm rmon collect interface command you receive the following error:
ATM-RMON Error: Entry not foundWorkaround: None.
•
Symptom: Interoperability with the switch can cause cell loss on the Catalyst 6015 or the Catalyst 6260 if an E1 IMA group consists of either 1 or 3 active links.
Workaround: None.
•
Symptom: The Catalyst 8510 MSR does not auto boot if the first file in the bootflash is not an executable file (for example, the running-configuration or crashinfo files).
Workaround: Delete any non-executable file from the bootflash that appears before the first bootable image.
•
Symptom: The following operations will result in a CPU HOG and a CPU HOG error message:
–
–
This will not affect the future operation of the TSCAM.
Workaround: Though this CPU HOG should not have any adverse impact on the network, it is recommended that any online insertion or removal of TSCAMs or Port Adapter Modules in the subcard 0 position of the TSCAM are scheduled appropriately.
•
Symptom: While sending traffic with super CAM (for example, the OC48 combo super CAM or OC12 super CAM) and enabling the online diags, then performing an OIR of the super CAM. If you use shutdown and no shutdown commands on one of the interfaces you might see the following error message:
ALIGN-3-READEXCEPTION messages.Workaround: None.
•
Symptom: The subinterfaces of an ATM router module (ATM router module or Enhanced ATM router module) may appear to receive the INARP packets even though the main interface is shut down. The upper layer finally discards the packet based on the state of the interface. There is no impact to any functionality.
Workaround: None.
•
Symptom: Per-VC drop counters are not consistent. This applies only to non-packet discard connections. The inconsistencies are between the three per-VC statistics: total RX cell drops, RX UPC violations, and RX clp0 q full drops. The total of RX UPC violations and RX Clp0 q full drops exceeds the total RX cell drops count. However, the total RX cell drops is accurate.
Workaround: None.
•
Symptom: Multicast stats shows an incorrect rate in kbps.
Workaround: None.
•
Symptom: A LightStream 1010 configured for MPLS might not correctly increment counters on outgoing TVCs, although the data is being correctly sent out of the TVC.
Workaround: None.
•
Symptom: OAM F5 loopback cells are not passing across 25-Mbps port adapter interfaces.
Workaround: Configure the global configuration command no atm oam intercept end-to-end on the switch.
•
Symptom: The PNNI on-demand routing algorithm ignores longer equal cost paths.
Workaround: None.
•
Symptom: The show ncdp path root command might not display any information when you access the switch through the Ethernet port.
Workaround: Access the switch using the console port.
•
Symptom: A T1 CES interface does not send out a remote alarm indication (RAI) in the reverse direction upon detecting an alarm indication signal (AIS).
Workaround: None.
•
Symptom: Reset button does not work correctly, and switch does not reload.
Workaround: None.
•
Symptom: The command show atm resources displays the number of cells in the UBR queue in an MSC and it increases continuously. The increase happens very slowly.
This occurs when traffic is sent through a Catalyst 8510 MSR at line rate. Increasing the threshold group per VC queue size does not eliminate the problem.
Workaround: None.
•
Symptom: The CES ABCD bits are not user configurable when a fault occurs.
Workaround: None.
•
Symptom: EIGRP routes stop might be advertised out of an interface when there doesn't appear to be any interface problems.
Workaround: Enter the shutdown command followed by the no shutdown command on the effected interface.
•
Symptom: Power-on diagnostics will display an NVRAM-Config failure following the second power-cycle after you use the write erase command if the write memory command has not been used between power-cycles.
This failure will occur only if you use the write erase command and the power-on diagnostics runs twice without the write memory command being used.
Note
Workaround: After using the write erase command, use the write memory command before power cycling the switch.
•
Symptom: When loading a software image version 11.3 or later on a switch router with a software image version 11.2 or earlier, LEC and other LANE components might fail to come up if they are configured using an ATM address whose first 19 bytes are the same as the active ATM address of the switch.
The ATM address of the switch along with the first 128 values for its selector byte should be reserved for use by PNNI. Starting with the 11.3 software version, PNNI supports hierarchy and registers an ATM address for all PNNI nodes using the switch ATM address with various selector byte values.
Workaround: If LANE components fail to come up because their ATM addresses conflict with the reserved ATM addresses for PNNI, reconfigure the LANE components using different addresses. It is recommended that LANE applications use the addresses shown by the show lane default-atm-addresses command, which eliminates this problem.
•
Symptom: A non-zero generic flow control (GFC) field is not reset to zero when passing through the switch router.
When cells with a non-zero GFC field are received on a PVC, they are switched on the exit port without changing the GFC field. The switch should reset to zero all GFC bits from cells received with non-zero GFC at the user network interface (UNI).
Workaround: None.
•
Symptom: Funnel VCs can jeopardize quality of service (QoS) for services.
The current multipoint-to-point funnel implementation can compromise the QoS guarantees of other connections (guaranteed services) when the application that created the funnel SVC malfunctions. For example, if the application were to transmit traffic on more than one leg of the funnel SVC simultaneously, the rate scheduler on the output interface oversubscribes and, potentially, affects the peak cell rate (PCR), sustained cell rate (SCR), and maximum cell rate (MCR) guarantees for other VCs on the interface.
Workaround: None.
•
Symptom: While setting up a large number of calls, the system generates the following error message:
%SYS-3-CPUHOG: Task ran for 5852 msec (0/0), process = Exec, PC = 6008DBB4Workaround: None.
•
Symptom: IP host-routing does not disable when specified.
Workaround: Enable and disable IP routing and then save the configuration to NVRAM.
•
Symptom: The ATM switch does not currently support maxvc-number negotiation through ILMI.
Workaround: None.
•
Symptom: When memory is almost or completely exhausted and a soft PVC goes down, it might not come back up, leaving it in a releasing or inactive state.
Workaround: None.
•
Symptom: Cell loss might occur while hot swapping a power supply.
Workaround: None.
•
Symptom: SNMP support of the ciscoAtmIfPhysEntryData table and LED information is not available on the 25-MB port adapter.
Workaround: None.
•
Symptom: ATM RMON data collection is not supported on subinterfaces or tunnels. The atm rmon collect command is accepted on hardware interfaces only; it is ignored on subinterfaces. SNMP and NVGEN support (via PortSelTable) is not possible until the interface's MIB (RFC 1573) entries are added for tunnel subinterfaces. ATM RMON counters for a hardware interface do not include any of the traffic through tunnels configured on the interface.
Workaround: None.
•
Symptom: The call attempt counters for PortSelectGroups might not count the outgoing calls on its NNI interfaces because of switch crankback attempts. This might result in a discrepancy between the call attempt counters shown on PortSelectGroups representing the interface on which the call came in and the counters shown on the PortSelectGroups representing the interface over which an attempt was made to forward the call. This problem might occur when a call fails.
Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(26)E
Cisco IOS Release 12.1(26)E is a rebuild release for Cisco IOS Release 12.1(23)E1. The caveats in this section are resolved in Cisco IOS Release 12.1(26)E but may be open in previous Cisco IOS releases.
•
Symptom: Unicast reverse path forwarding (uRPF) does not drop packets that are malformed or that have forged (spoofed) addresses of hardware-switched packets on the Catalyst 8540 or Catalyst 8510 switches running Cisco IOS Release 12.1(23)E. For example, if the switch is configured to perform unicast reverse path forwarding using the ip verify unicast source reachable-via rx command or the ip verify unicast reverse-path command and the switch is running Cisco IOS Release 12.1(23)E, those hardware-switched packets might be forwarded.
Workaround: None.
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
•
A Cisco device running Cisco IOS and enabled for the Border Gateway Protocol (BGP) is vulnerable to a Denial of Service (DoS) attack from a malformed BGP packet. Only devices with the command `bgp log-neighbor-changes' configured are vulnerable. The BGP protocol is not enabled by default, and must be configured in order to accept traffic from an explicitly defined peer. Unless the malicious traffic appears to be sourced from a configured, trusted peer, it would be difficult to inject a malformed packet.
If a misformed packet is received and queued up on the interface, this bug may also be triggered by other means which are not considered remotely exploitable such as the use of the command `show ip bgp neighbors' or running the command `debug ip bgp <neighbor> updates' for a configured bgp neighbor.
Cisco has made free software available to address this problem.
For more details, please refer to this advisory, available at http://www.cisco.com/warp/public/707/cisco-sa-20050126-bgp.shtml
•
Symptom: The ATM interface on a router connected to a Catalyst 8510 MSR is shut down, but the ATM interface on the Catalyst 8510 MSR continues to stay up. The expected result would be the "down" state. This occurs if a C85MS-8T1-IMA interface module in the Catalyst 8510 MSR is running Cisco IOS Release 12.1(19)E and the ATM interfaces are configured as part of an IMA group.
Workaround: None.
•
A document that describes how the Internet Control Message Protocol (ICMP) could be used to perform a number of Denial of Service (DoS) attacks against the Transmission Control Protocol (TCP) has been made publicly available. This document has been published through the Internet Engineering Task Force (IETF) Internet Draft process, and is entitled "ICMP Attacks Against TCP" (draft-gont-tcpm-icmp-attacks-03.txt).
These attacks, which only affect sessions terminating or originating on a device itself, can be of three types:
1. Attacks that use ICMP "hard" error messages
2. Attacks that use ICMP "fragmentation needed and Don't Fragment (DF) bit set" messages, also known as Path Maximum Transmission Unit Discovery (PMTUD) attacks
3. Attacks that use ICMP "source quench" messagesSuccessful attacks may cause connection resets or reduction of throughput in existing connections, depending on the attack type.
Multiple Cisco products are affected by the attacks described in this Internet draft.
Cisco has made free software available to address these vulnerabilities. In some cases there are workarounds available to mitigate the effects of the vulnerability.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20050412-icmp.shtml.
The disclosure of these vulnerabilities is being coordinated by the National Infrastructure Security Coordination Centre (NISCC), based in the United Kingdom. NISCC is working with multiple vendors whose products are potentially affected. Its posting can be found at: http://www.niscc.gov.uk/niscc/docs/re-20050412-00303.pdf?lang=en.
•
Symptom: Using the show switch fabric command to request information about the different interfaces connected to the chassis does not reflect all of the different interface connections. Only the 155-Mbps interfaces appear in the display.
Workaround: None.
•
Symptom: On the Catalyst 8500 switch, a PNNI PVC link on an NNI interface might flap after the link stabilizes and the ATM PNNI VC component does not come back up.
Workaround: Bounce the PNNI process using the no atm router pnni and atm router pnni configuration commands to disable and enable the PNNI processes.
•
Symptom: Packets are switched out on native VLANs leading to routing by the CPU (with BVI). This occurs on EPIF-based interface modules when untagged packets coming in on the dot1q native VLAN are not processed by the microcode. Instead, they are given to the CPU, and the CPU performs the processing. This causes high CPU utilization if untagged packets are received at a high rate on the native VLAN subinterfaces.
Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(23)E1
Cisco IOS Release 12.1(23)E1 is a rebuild release for Cisco IOS Release 12.1(23)E. The caveats in this section are resolved in Cisco IOS Release 12.1(23)E1 but may be open in previous Cisco IOS releases.
•
Symptom: TCP connections may be vulnerable to spoofed ICMP packets. A spoofed ICMP packet may cause the TCP connection to use a very low segment size for 10 minutes at a time.
Conditions: This symptom is observed when TCP connections are configured for PMTU discovery. Note that PMTU discovery is disabled by default on a router.
Workaround: Disable PMTU discovery.
Resolved Caveats—Cisco IOS Release 12.1(23)E
Cisco IOS Release 12.1(23)E is a rebuild release for Cisco IOS Release 12.1(22)E. The caveats in this section are resolved in Cisco IOS Release 12.1(23)E but may be open in previous Cisco IOS releases.
•
Symptom: If the switch at one end of a VP tunnel uses Cisco IOS Release 12.0(13)W5(19c) and the switch at the other end of the tunnel uses Cisco IOS Release 12.0(16)W05(21), there could be interoperability issues causing call establishment failures.
Workaround: None.
•
Symptom: A Catalyst 8510 MSR switch DS-3 interface configured with "clock source loop-timed" changes to "admin shut" state if the switch is reloaded due to the following OIR test failure.
"ONLINEDIAG-5-OIR_TEST_FAIL: PHY Loop back test failed"Workaround: Enter the no shutdown command on the DS-3 interface.
•
Symptom: The getmany utility program displays the wrong instances of the "ifStackTable".
Workaround: None.
•
Symptom: The SNMP "get" request on the "ifSpeed" object of the IF-MIB returns the wrong value for the IMA group interface.
There is no other functionality impact.
Workaround: None.
•
Symptom: After creating a CES hard PVC on the Catalyst 8510 MSR, if the circuit is deleted the corresponding VPI/VCI on the ATM port and the ATM psuedo port are sometimes not deleted.
If a CES hard PVC with the same ATM VPI/VCI is configured again, configuration fails with the following message.
"%connection creation fails: vpi/vci has been used by other connections"Workaround: None.
•
Symptom: Soft PVC call setup might fail going through third-party ATM switches. These third-party ATM switches might use Extended QoS Information Element (0xEC) with "Acceptable Backward Peak-to-Peak Cell Delay Variation Identifier" without the corresponding cumulative forward and/or backward peak-to-peak CDV.
Workaround: None.
•
Symptom: On an interface module with a soft VC configured, if an interface is shut down or if the interface module is removed from the chassis, the following cause code appears in the "debug atm sig-all" display of subsequent soft-VC requests:
cause = normal call clearing, location = UserThis cause code is not correct. The "Resource Unavailable class definitions" cause code should appear.
Workaround: None.
•
Symptom: Connectivity problems might occur across STM-4 interfaces after upgrading the switch from Cisco IOS Release 12.0(1a)W5(5b) to 12.0(24)W5(26b). This upgrade might cause all PVCs having a leg on an STM-4 interface to begin experiencing connectivity problems.
Workaround: None.
•
Symptom: A LightStream 1010 ATM switch might crash and display "0x602D5E58:usecdelay(0x602d5e10)".
Workaround: None.
•
Symptom: The Catalyst 8510 MSR might experience a memory leak on Pool Manager and Frame Relay LMI
Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(22)E
Cisco IOS Release 12.1(22)E is a rebuild release for Cisco IOS Release 12.1(20)E. The caveats in this section are resolved in Cisco IOS Release 12.1(22)E but may be open in previous Cisco IOS releases.
•
Symptom: The wrong payload pattern in idle cells might be transmitted from DS-3 and E3 interfaces.
As per recommendation I.361 (of the ITU-T), the payload pattern of the idle cell is "01101010" or "0x6A". But in DS-3 and E3 interfaces of the Catalyst 8510 MSR, Catalyst 8510 MSR, and LightStream1010 ATM switches, the payload pattern of the idle cell is set to "00000000" or "0x00". This is incorrect as per the ITU-T specification.
Some interoperability issues with other devices might appear if those devices expect only the "0x6A" pattern.
Workaround: None.
•
Symptom: Using the show vc command displays garbage data for TVC(I) type interfaces with multiple leaves. Data for TVC(O) type interfaces with multiple leaves are displayed correctly.
Note
Workaround: Use the show atm vc command instead of the show vc command.
•
Symptom: If you configure more than sixteen static MAC entries on the Catalyst 8510 MSR or Catalyst 8510 CSR, the device might generate error messages indicating that it cannot chunk_malloc.
The errors might look similar to the following:
*Dec 9 13:59:28: Can't chunk_malloc*Dec 9 13:59:28: Can't chunk_malloc*Dec 9 13:59:28: Can't chunk_mallocWorkaround: None.
•
Symptom: IP routes through route processor interface (ATM0) are not programmed in EPIF based Ethernet interface modules.
Workaround: None.
•
Symptom: Debugs remain enabled for removed interfaces.
1. If you use the debug atm sig-all command, the debugs are enabled for an interface. If that interface module is removed from the chassis, the show debug command output continues to show that "sig-all" debugs are enabled for the removed interface.
2. If you use the deb atm sig-all command, the debugs are enabled for all interfaces and if an interface module is removed from the chassis, the show debug command output continues to show that "sig-all" debugs are enabled for the removed interface module.
This is only a display issue. There is no impact on functionality.
Workaround: None.
•
Symptom: A Catalyst 8510 MSR or Catalyst 8510 CSR running Cisco IOS Release 12.1(19)E continuously crashes when booting and trying to bring up its interfaces. This only happens if ISL/dot1Q are configured. This problem is not seen if trunking is not configured.
Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(20)EB
Cisco IOS Release 12.1(20)EB is a rebuild release for Cisco IOS Release 12.1(19)EB. The caveats in this section are resolved in Cisco IOS Release 12.1(20)EB but may be open in previous Cisco IOS releases.
•
Symptom: A Catalyst 8510 MSR or Catalyst 8510 CSR running Cisco IOS Release 12.1(19)E continuously crashes when booting and trying to bring up its interfaces. This only happens if ISL/dot1Q are configured. This problem is not seen if trunking is not configured.
Workaround: None.
•
Symptom: A Catalyst 8510 CSR might log the following messages when running Cisco IOS Release 12.0(20)W5(26):
Jan 9 160611 EST %ALIGN-3-CORRECT Alignment correction made at0x603954BC reading 0x6200E625Jan 9 160611 EST %ALIGN-3-TRACE -Traceback= 603954BC 6036BD246036BB58 60076ABC 6005C948 6005CA80 6005CDCC 6007C4E4
Note
Workaround: Downgrade to Cisco IOS Release 12.0(20)W5(24a) or earlier.
•
Symptom: The Catalyst 8510 MSR switch may ignore certain commands from the NVRAM after a reboot. This appears most often on switches with dual route processors.
Workaround: Create a connection traffic index and use that number for the set up of the PVC.
Resolved Caveats—Cisco IOS Release 12.1(20)E
Cisco IOS Release 12.1(20)E is a rebuild release for Cisco IOS Release 12.1(19)EB. The caveats in this section are resolved in Cisco IOS Release 12.1(20)EB but may be open in previous Cisco IOS releases.
•
Symptom: Interface up/down events occur even when the carrier delay is configured.
Carrier delay support for DS3 and E3 interfaces on the LightStream 1010 and the Catalyst 8500 MSR is required.
Note
Workaround: None.
•
Symptom: A Catalyst 8510 MSR or CSR running Cisco IOS Release 12.1(19)E continuously crashes when booting and trying to bring up its interfaces. This only happens if ISL/dot1Q is configured. This problem is not seen if trunking is not configured.
Workaround: None.
•
Symptom: The clear counters command used with an OC-48 ATM interface module installed does not reset the FEBE counters in the show controllers command display. See the following example:
Switch# show controllers atm11/0/0...LINEAIS = 0 RDI = 0 FEBE = 2393 BIP(B2) = 0PATHAIS = 0 RDI = 0 FEBE = 228 BIP(B3) = 0LOP = 0Switch# clear countersClear "show interface" counters on all interfaces [confirm] YSwitch# show controllers atm11/0/0...LINEAIS = 0 RDI = 0 FEBE = 2393 BIP(B2) = 0PATHAIS = 0 RDI = 0 FEBE = 228 BIP(B3) = 0LOP = 0Workaround: Reload the Cisco IOS image on the switch and do not OIR the OC-48 interface module.
•
Symptom: When establishing soft-VP between switches, if a VP number is used by the previous switch and if that switch sends an error stating that "VPI" is already used, then the switch receiving that error should use a different VPI number during its next retry attempt. For example
Switch-1 (1/0/0)-------(1/0/0) Switch-2 (1/1/1)---------(1/1/1) Switch-3 (1/1/0)1. Assume a soft-VP call is getting initiated by Switch-1.
2. Assume that the node ID of Switch-3 is higher than Switch-2.
3. Assume that the Switch-2 ATM1/1/1 interface has a PVP configured with VPI 4 (ATM PVP 4).
In this scenario, when a call is initiated by Switch-1, it is forwarded by Switch-2 to Switch-3. Because the node ID of Switch-3 is higher than Switch-2, Switch-3 requests a VP number. If the request is for VPI 4 on Switch-3's ATM1/1/1, it will reach Switch-2's ATM1/1/1. Because there was a PVP configured on Switch-2's ATM1/1/1 interface with PVP 4, it is rejected stating that VPI is "unavailable". This error is sent to both Switch-1 and Switch-3. So, during the next attempt when Switch-3 requests a VPI number, it should request a different VPI number from 4.
Workaround: None.
•
Symptom: Problems occur in CISCO-ATM-IF-PHYS-MIB implementation:
1. ciscoAtmIfPhysLineFebeErrors returns Path FEBE errors instead of Line FEBE errors.
2. ciscoAtmIfPhysPathFebeErrors returns Line FEBE errors instead of Path FEBE errors.
This only happens with OC-3/STM-1 or OC-12/STM-4 interfaces.
Workaround: Poll ciscoAtmIfPhysLineFebeErrors when you need Path FEBE errors and poll ciscoAtmIfPhysPathFebeErrors when you need Line FEBE errors.
•
Symptom: POD (Parallel Optical Device) fails with ATMDIAG_UNEXPECTED_PIF_INTERRUPT_ERROR. POD errors might occur in some LightStream 1010 switches. These errors occurred on ports that were up and working. This problem appears to be a false error reported by POD.
Workaround: None.
•
Symptom: Same problem as DDTS CSCdx58649 except the fix was not committed to the LightStream 1010 image.
Workaround: None.
•
Symptom: On a Catalyst 8500 MSR or LightStream 1010 switch with a DS3 interface, the interface goes down after only 7ms of AIS and then comes back up. For example, the following message appears:
%LINK-5-CHANGED: Interface ATM1/0/0, changed state to going downApproximately three seconds later, the next message appears:
%LINK-3-UPDOWN: Interface ATM1/0/0, changed state to up
Note
Workaround: None.
•
Symptom: Interoperability problem between LightStream 1010 and Compaq Server with ATM NIC if you pull out the optical fiber connection and reconnect it. If you do so, ILMI keeps restarting, and never stabilizes. You can use the shutdown command on the interface, then disconnect and reconnect the fiber optic connection and use the no shutdown command on the ATM interface to eliminate the problem. These commands cause ILMI to restart correctly.
Note
Workaround: Follow these steps:
1. Reboot the server.
2. Use the shutdown and no shutdown commands on the des ATM-Switch-Interfaces.
3. Restart of the ATM-NIC (only the NIC interface).
4. Bind the TCP-Stack.•
Symptom: The ATM router module interface shut downs when entering the epc portstuck-manual-reload command with IP traffic. This only occurs when running the epc portstuck-manual-reload command several times.
Workaround: None.
•
Symptom: After configuring an IPX network between a Catalyst 8510 MSR and a Catalyst 8510 MSR, and a Catalyst 7500, old buffers detected messages being displayed on the Catalyst 8510 MSR. This occurs with an ATM interface and a Fast Ethernet interface. The Encap is 11 (Novell-Ether). This does not impact any functionality.
Workaround: None.
•
Symptom: While executing a series of shutdown/no shutdown commands on the ATM router module interface with a large number of CLIP clients (more than 32), the following error message appears on the console:
00:58:16: %SYS-3-MGDTIMER: Uninitialized timer, timer stop, timer = 644B0550.-Process= "ATM ARP INPUT", ipl= 0, pid= 30-Traceback= 600CE1BC 600CF2A4 60792B0C 60796850 60797744 600BBA64 600BBA50shutEnter hex value: 600CE1BC 600CF2A4 60792B0C 60796850 60797744 600BBA64 600BBA500x600CE1BC:mgd_timer_complain_uninit(0x600ce190)+0x2c0x600CF2A4:mgd_timer_stop(0x600cf26c)+0x380x60792B0C:atm_arp_stampvc(0x60792ad4)+0x380x60796850:atm_inarp_rcvdreq(0x6079620c)+0x6440x60797744:atm_arp_process(0x60796f30)+0x8140x600BBA64:r4k_process_dispatch(0x600bba50)+0x140x600BBA50:r4k_process_dispatch(0x600bba50)+0x0This does not impact functionality. Enter the shutdown command, followed by the no shutdown command to recover.
Workaround: None.
•
Symptom: Under certain conditions, the Catalyst 8510 does not have a certain MAC address in the CAM table. This leads to flooding of L2 traffic for a short time, until the MAC addresses are learned.
Workaround: Issue a clear br gr command.
•
Symptom: CPU hog by OIR handler.
Workaround: None.
•
Symptom: The ILMI status of shaped and hierarchical tunnel subinterfaces that are down (not shutdown) appear stuck in the Restarting state after a shutdown/no shutdown command sequence.
Workaround: None.
•
Symptom: The switch might have spurious memory access tags after configuring and unconfiguring tag switching on different ATM interfaces. This is not known to impact tag switching functionality on the switch. The following message might appear on the console:
*** gd03_tag_stress: Mon Jan 31 08:35:12 2000 949336512 comment Spuriousmemory accesses on gd03_r55_11: count = 1 ****** gd03_tag_stress: Mon Jan 31 08:35:12 2000 949336512 comment 1C1 0x60254C28 0x60236140 0x6009868C 0x60098678Workaround: None.
•
Symptom: IMA group fails to come up intermittently, especially after reload and on E1 IMA links.
Workaround: Go to one of the IMA interfaces and give the following command:
Switch(config-if)# fwmon "altrap 00 ff 00 ff 00 ff"If the group still remains down, it indicates a persisting alarm on the line. The line configuration has to be checked to clear the problem.
•
Symptom: The 25-Mbps ATM interface module installed in a LightStream 1010 ATM switch always displays an input rate of 25 Mbps, even if the connected ATM end-station is not sending any data.
Workaround: None.
•
Symptom: The following message appears on the neighbor ATM switch after using the reload command:
%SYS-3-CPUHOG: Task ran for 3984 msec (24/11), process = Net BackgroundWorkaround: None.
•
Symptom: On a switch router configured with 32 MB RAM, IPC traffic between the port adapter driver and the firmware can experience a transient failure when the port adapter firmware crashes under heavy traffic conditions. The port adapter recovers from this transient failure if it is reset after waiting for about 2 minutes.
This IPC failure, which is due to an unexpected firmware crash under a heavy load, does not occur on a system configured with 64MB of RAM.
Workaround: None.
•
Symptom: Tag switching and Tag Discovery Protocol (TDP) memory fragmentation. While running tag switching with a very large number of destinations, continuous toggling of VC Merge (which forces all the TDP sessions to restart) on the switch for a very long period of time (for example, overnight) causes memory fragmentation in the TDP process.
Workaround: None.
•
Symptom: ILMI does not come up upon reload of VP-MUX (VUNI).
ILMI on the tunnel interface, which is connected to the far end peer device through a VP-MUX switch and virtual UNI, is occasionally unable to come up and stay in state of "WaitDevType" after reloading the VP-MUX switch. This situation can be cleared by shutting down the tunnel interface, disabling ILMI followed by a no shutdown command on the tunnel interface. After the interface settles down, ILMI on the tunnel can then be reenabled by shutting down the interface, entering the atm ilmi-enable command and also the atm auto-configuration command, if desired. Reenable the tunnel interface with a no shutdown command.
Workaround: None.
•
Symptom: When you set the ROM monitor environment variable boot to a nonexistent file (using the Cisco IOS command boot system flash) and the configuration register is set to 0x2102 (autoboot), the switch hangs during the subsequent reload command issued by the software.
Workaround: Power-cycle the switch; a break character is sent to the switch to force it to the ROM monitor prompt. You can then manually reboot the switch.
•
Symptom: The granularity provided by the FC-PFQ feature card scheduling hardware does not allow an exact match of all requested cell rates. To satisfy the traffic contract guarantee, the next higher available scheduling value is used. A shaped VP tunnel is used frequently to pass data to a WAN VP trunk, and limits the traffic transmission to the scheduled rate. This can cause cells to be dropped in the WAN. It might be better to do any dropping prior to multiplexing onto the VP, so that a packet discard can be performed. Packet discard cannot be performed on the VP trunk.
Workaround: None.
•
Symptom: Open shortest path first (OSPF) does not recognize more than four parallel interfaces. This might cause some tag switching VCs (TVCs) to not get switched to other interfaces if a tunnel carrying the TVCs is shut down.
Workaround: Enter a clear ip route command on the switch on the interface that was shut, or a clear ip route command on all the switches to bring everything back up. If the clear ip route command does not bring everything back up, enter a shutdown/no shutdown command sequence on the UNI interfaces of the switch that had the closed physical interface.
•
Symptom: If there are multiple parallel paths to the same destination on a switch router with a FC-PFQ feature card installed, the tag switching VCs (TVCs) should be load balanced on a per network prefix basis over these parallel paths (up to a maximum of 4 parallel paths) instead of being VC merged. Load balancing does not happen in some cases and the TVCs might be VC merge and go out of the switch as a single VC.
Workaround: None.
•
Symptom: On a switch router equipped with an FC-PFQ, the maximum number of cells available for use is 64,511. The number of cells in the switch fabric is 65,535.
Workaround: None.
•
Symptom: The cell count reported on a snooped interface is twice the actual number of cells transmitted.
Workaround: None.
•
Symptom: When one of the installed power supplies is powered OFF, and you are copying an image to bootflash, a power supply failure message appears.
Workaround: None.
•
Symptom: A LECS, using Cisco IOS Version 11.2(X), expects all LESs to establish an individual control VC to the LECS in order to validate clients.
If different emulated Local Area Networks (ELANs), using Cisco IOS Release 11.1(X), are configured on multiple subinterfaces of the same physical interface, then all LESs multiplex the control messages (which validate the clients) into a single VC.
For example, see the following LES router configuration:
atm1/0.1 sysa_70k_31_a1.1_LAN sysa_70k_31_a1.1_LANatm1/0.2 sysa_70k_31_a1.2_LAN sysa_70k_31_a1.2_LANatm1/0.3 sysa_70k_31_a1.3_LAN sysa_70k_31_a1.3_LANatm1/0.4 sysa_70k_31_a1.4_LAN sysa_70k_31_a1.4_LANThis configuration of an LECS sends the following warning messages to the console stating that an LES of one ELAN is attempting to obtain information about another ELAN:
%LANE-4-LECS_WARNING: interface ATM2/0/0: elan 'sysa_70k_31_a1.4_LAN' LES asking for elan'sysa_70k_31_a1.1_LAN'%LANE-4-LECS_WARNING: interface ATM2/0/0: elan 'sysa_70k_31_a1.4_LAN' LES asking for elan'sysa_70k_31_a1.2_LAN'%LANE-4-LECS_WARNING: interface ATM2/0/0: elan 'sysa_70k_31_a1.4_LAN' LES asking for elan'sysa_70k_31_a1.3_LAN'The clients are still allowed to join the ELAN. Disregard the warning messages.
Workaround: None.
•
Symptom: When a large number of LANE clients come up and down constantly over extended periods of time, the system can run out of AAL5 buffers and the following message appears:
%AAL5-3-INTERNAL_ERROR: No more big aal5 pktsIn most cases, the system continues to function normally, but occasionally the system denies additional calls from end systems.
Workaround: Toggle the interface to reinitialize all connections and restore normal operation.
•
Symptom: Under very heavy traffic conditions the switch might experience temporary queue cell failures. This should clear after the traffic congestion clears.
Workaround: None.
•
Symptom: When more than 1000 SVCs are active on an interface and the shutdown command is entered, all SVCs on that interface are released and the following message appears:
%SYS-3-CPUHOGThis message indicates that the release process runs for a long time before returning control to the kernel, which can then schedule other tasks. This process does not affect normal operation of the switch.
Workaround: None.
•
Symptom: Remote defect identification (RDI) cells sent by an end point in response to alarm indication signal (AIS) cells generated at an intermediate switch with a fault condition on an interface are not propagated beyond the intermediate switch. The intermediate switch removes the connection leg entries for both interfaces participating in the connection when a fault is discovered on one of the interfaces, even though the other interface might still be up. As a result, the RDI cells are dropped at the intermediate switch.
Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(19)E2
Cisco IOS Release 12.1(19)E2 is a rebuild release for Cisco IOS Release 12.1(19)E. The caveats in this section are resolved in Cisco IOS Release 12.1(19)E2 but may be open in previous Cisco IOS releases.
•
Symptom: If your switch is running Cisco IOS Release 12.1(7a)EY and you perform an OIR of a CES interface module, this might cause the route processor to crash.
Workaround: None.
•
Symptom: Whenever you attempt to update the Access Control List (ACL) attached to the management interface (Ethernet2/0/0) on the LightStream 1010 ATM switch the following error message appears:
ACL is not supportedACL functionality on the interface is not affected.
Workaround: None.
•
Symptom: The "ifindex persistent" feature support was added beginning with Cisco IOS Release 12.1(13)E.
The SNMP ifIndex persistence feature provides an interface index (ifIndex) value that is retained and used when the switch reboots. The ifIndex value is a unique identifying number associated with a physical or logical interface.
For additional information reference, Configuring SNMP IfIndex Persistence.
Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(19)E
Cisco IOS Release 12.1(19)E is a rebuild release for Cisco IOS Release 12.1(14)E1. The caveats in this section are resolved in Cisco IOS Release 12.1(19)E but may be open in previous Cisco IOS releases.
•
Symptom: The Frame Relay retry-interval is shown twice in the running configuration. This means the configured Frame Relay Soft VCs are not preserved after an image reload or a route processor switchover.
Workaround: None.
•
Symptom: PNNI routing fails from one access device to a complex-peer in some branches. For example, in the following network example, calls from the Ls1010 switch to an interface on the Catalyst 8540 switch are not set up.
But, calls from the Catalyst 8540 switch to the Ls1010 switch are set up correctly. If the Catalyst 8540.2 switch is configured as a simple single-level hierarchy the calls originated from either switch to the other switch are set up without any problems.
Workaround: Configure the complex node (Catalyst 8540.2 switch) as a simple hierarchy.
•
Symptom: The switch crashes when you run the no tag-switching mtu command.
Workaround: None.
•
Symptom: The following issues could be seen on the simultaneous execution of certain PNNI CLIs.
The switch reloads when:
–
–
–
–
The following issues are also seen:
–
–
–
–
Workaround: None.
•
Symptom: On a Catalyst 8510 MSR if an OC-3 interface is overbooked and configured with PVCs that consume more than 599 Mbps of bandwidth, during bootup, these PVCs are lost from the running configuration.
The following error message appears during bootup for every PVC that is rejected.
%connection creation fails: specified traffic/resource parameters are invalidWorkaround: Configure the PVCs that were lost once the switch boots up.
•
Symptom: If a marker cell has been queued for a leaf and at the same time a new party is attempting to be installed, the add party fails and the following error message is seen:
00:04:26: ATMSIG: CONNECTION MANAGER/CAC Xconn install resultCONN_INSTALL_RESULT_HW_FAIL00:05:30: %ATMSIG-3-FAILXCONN: Xconnect failed, xconn fail-Traceback= 607B910C 607BB960 607C6950 607B3538 607B3640 600D2FAC 600D2F9800:05:30: ATMSIG(1/0/3:0 0,79 - 0045/25): (vcnum:0) XConnected failed To00:05:30: ATMSIG(1/1/0:0 0,945 - 0220/25): (vcnum:0)00:05:30: ATMSIG: CONNECTION MANAGER/CAC Xconn install requestPort A - (1/0/3) : 0 vpi = 0; vci = 79Port B - (1/1/0) : 0 vpi = 0; vci = 945; new vpi = 0; new vci = 945 existing vpi/vci for leg B00:05:30: ATMSIG: CONNECTION MANAGER/CAC Xconn install resultCONN_INSTALL_RESULT_HW_FAILWorkaround: The point-to-multipoint Soft-PVC party will come up because of the Soft-PVC retry.
•
Symptom: Subinterfaces of route processor and ATM router module ports are not registered with SNMP ifTable.
Workaround: None.
•
Symptom: On a LightStream 1010 switch with an E1interface connection, Detailed Device Report shows "slot number : N/A" but should display the actual interface slot number.
Workaround: None.
•
Symptom: Soft PVC does not come up.
If a Soft PVC originates from a Catalyst 8510 MSR or LightStream 1010 ATM switch is directly connected to an Alcatel switch, the Soft PVC never comes up. If the call originated from the Alcatel side, the Soft PVC comes up with no problem.
Note
For example:
At UNI ATM interface:
atm soft-vc 1 455 dest-add xx.348f.8001.bbfc.0000.0ba0.6f10.4080.210a.2a01.00 1 455 rx-cttr 1 tx-cttr 1The Alcatel switch is directly connected, ATM NNI and PNNI are up and adjacency is up:
show atm pnni neighbor---Neighbor Name: unknown, Node number: 40Neighbor Node Id: 88:160:xx.348F8001BBFC00000BA06F10.408021810A00.00Neighboring Peer State: FullLink Selection For CBR : minimize blocking of future callsLink Selection For VBR-RT : minimize blocking of future callsLink Selection For VBR-NRT: minimize blocking of future callsLink Selection For ABR : balance loadLink Selection For UBR : balance loadPort Remote Port Id Hello stateATM12/0/3 1281000 2way_in (Flood Port)---Switch# show atm routeP I 40 0 UP 0 39.348f.8001.bbfc.0000.0ba0.6f10/104---But, if the show atm pnni dtl node 40 ubr command is used:
*Apr 10 23:11:21.218: PNNI: UBR route request from ATM_OWNER_UNKNOWN*Apr 10 23:11:21.218: PNNI: To node 88:160:xx.348F8001BBFC00000BA06F10.408021810A00.00*Apr 10 23:11:21.218: PNNI: selected target node 40*Apr 10 23:11:21.218: priority: 2 (40 0) pnni-remote-internal*Apr 10 23:11:21.218: PNNI: Compute On-Demand Route Based On Admin Weight*Apr 10 23:11:21.218: PNNI: Failed To Find An On-Demand Route,Code: PNNI_RESOURCE_UNAVAILABLE*Apr 10 23:11:21.218: PNNI: No Route To88:160:xx.348F8001BBFC00000BA06F10.408021810A00.00*Apr 10 23:11:21.218: PNNI: Send Source Route ReplyTo Requestor: Code PNNI_RESOURCE_UNAVAILABLE---When the call is initiated from the LightSteam 1010 switch, nothing comes to the Alcatel switch. At the same time, when the call is initiated from the Alcatel switch, the Soft PVC comes up:
Switch# show atm vc interface atm 9/1/1Interface VPI VCI Type X-Interface X-VPI X-VCI Encap StatusATM9/1/1 0 5 PVC ATM13/0/0 0 72 QSAAL UPATM9/1/1 0 16 PVC ATM13/0/0 0 40 ILMI UP>>Alcatel Init <<<<ATM9/1/1 0 400 SoftVC ATM12/0/3 0 227 UP>> LS1010 Init <<<<ATM9/1/1 1 455 SoftVC NOT CONNECTEDWorkaround: None.
•
Symptom: A memory leak occurs in the ATMSIG processes. This is observed using the show processes memory command. The ATMSIG processes hold increasing amounts of memory and free memory is decreasing.
Note
Workaround: None. The switch must be rebooted to recover.
•
Symptom: On a LightStream 1010 switch running Cisco IOS Release 120-24.W5.26b, might crash because of a system restarted by a bus error at PC 0x6063F9C8, address 0xD0D0D15.
Workaround: None.
•
Symptom: If you use the show version command on a LightStream 1010 switch with a faulty Flash PC card, the following error message might appear:
%SYS-3-CPUHOG: Task ran for 3708 msec (343/19), process = Virtual Exec, PC = %600AB140.-Traceback= 600AB148 60038620 60038D1C 60038734 600384D8 60038D1C 60038734 6044C190 6005809C 60057DDC 6004BF74Workaround: Use a different Flash PC card.
•
Symptom: An ATM router module interface with a PVC configured might experience a port stuck condition.
Workaround: None.
•
Symptom: On the CES module interface, the status reads UP/UP and the status of PVC to that interface is UP in even though there is no physical connection at that port.
Workaround: Perform shutdown and no shutdown on the interface to clear the erroneous status.
•
Symptom: In the LightStream 1010 switch, on the output of a show ethernet command display, the "lost carrier" count will follow the collision counter. This is a counter error only and does not actually indicate a lost carrier and does not impact the operation of the Ethernet interface.
Workaround: None.
•
Symptom: When a LightStream 1010 ATM switch has its image saved in bootflash and the config-register is configured to 0x2101, the system stays in ROMMON mode after a crash.
If the config-register is set to 0x2102, the switch crashes a second time by bus error while trying to open slot 0. The switch then recovers and boots the bootflash image.
Workaround: Set the MONRC command in the ROM monitor, which overrides any BOOT SYSTEM command from the configuration, as follows:
rommon 1>MONRC="boot bootflash:"rommon 2>syncrommon 3>reset•
Symptom: When you try to connect Racal-Datacomm CSUs together using ports on the same CES interface module, timing problems might prevent the CSUs from starting up.
Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(14)EB1
Cisco IOS Release 12.1(14)EB1 is a rebuild release for Cisco IOS Release 12.1(14)EB. The caveats in this section are resolved in Cisco IOS Release 12.1(14)EB1 but may be open in previous Cisco IOS releases.
Resolved Caveats—Cisco IOS Release 12.1(14)EB
Cisco IOS Release 12.1(14)EB is a rebuild release for Cisco IOS Release 12.1(13)EB1. The caveats in this section are resolved in Cisco IOS Release 12.1(14)EB but may be open in previous Cisco IOS releases.
•
Symptom: If a Frame Relay-Frame Relay PVC is deleted through SNMP Resource Management the information is incorrect in the show frame-relay interface resource serial card/subcard/port:chn_grp_# command display.
This allows for creation of more VCs than the physical bandwidth available.
Workaround: Delete and recreate the channel group.
•
Symptom: The Catalyst 8510 MSR might display following error messages:
xpif_read_media_type: Null ds structure for Port-channel1xpif_read_media_type: Null ds structure for Port-channel1Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(14)E1
Cisco IOS Release 12.1(14)E1 is a rebuild release for Cisco IOS Release 12.1(13)EB1. The caveats in this section are resolved in Cisco IOS Release 12.1(14)E1 but may be open in previous Cisco IOS releases.
Resolved Caveats—Cisco IOS Release 12.1(13)EB1
Cisco IOS Release 12.1(13)EB1 is a rebuild release for Cisco IOS Release 12.1(13)E1. The caveats in this section are resolved in Cisco IOS Release 12.1(13)EB1 but may be open in previous Cisco IOS releases.
•
Symptom: The CBR interface module sends a "remote alarm" to the peer interface if the line flaps continuously. This causes the peer interface to change to "yellow alarm" state.
Workaround: Enter the shutdown and no shutdown commands on the CBR interface.
•
Symptom: Packets received with a destination multicast MAC address and destination unicast IP address, are forwarded to the Route Processor and then forwarded back out on the VLAN where the packets were received.
Workaround: None.
•
Symptom: Signaling is reset on other interfaces of the device that are not connected to the peer switch being reloaded.
Workaround: None.
•
Symptom: On interface ATM0, while breaking the packet into cells, when the MTU size configuration is checked it is checked for the cross-connect ATM interface and not for interface ATM0 itself. This means if the size of the packet exceeds the configured MTU on the cross-connect ATM interface, the following error is displayed:
%LINK-4-TOOBIG: Interface ATM1/1/3, Output packet size of 2008 bytes too bigWorkaround: There are two possible workarounds for this condition: either change the MTU size on both ATM interfaces back to the default using the command no mtu in interface configuration mode, or change the MTU configuration on interface atm 0 to match the MTU configuration on the cross-connect interface using the mtu # interface configuration command.
•
Symptom: After a LAN emulation client (LEC) goes down, a router that has an enhanced ATM port adapter (PA-A3) may not be able to register a network service access point (NSAP) address with an Integrated Local Management Interface (ILMI). Several messages that are similar to the following may be logged in the log file:
%LANE-3-NOREGILMI: ATM1/1/0.7 LEC cannot register39.000000000000000000000022.000163728428.07 with ILMI%LANE-3-NOREGILMI: ATM1/1/0.6 LEC cannot register39.000000000000000000000022.000163728428.06 with ILMIThis symptom is observed on a Cisco router that has a PA-A3 port adapter and that is running Cisco IOS Release 12.2(10a). This symptom is observed after the software is upgraded from Cisco IOS Release 12.2(8)T4.
Workaround: Reload the router.
•
Symptom: The IMA interface module does not generate a syslog message when the link goes down.
Workaround: None.
•
Symptom: The command network-clock-select priority system disappears from the running configuration after a switch reload.
After entering the command in global configuration mode, the switch parser adds the keyword "clock" at the end of the line and that causes the reload to skip the command when parsing the configuration file.
Workaround: None.
•
Symptom: When using version UNI 4.0, during SVC call set ups, a Catalyst 8500 MSR switch in the "Call Received" state does not send a connect-ack upon reception of a connect. This causes the SVC to be released.
Workaround: Use version UNI 3.1
•
Symptom: A Catalyst 8500 MSR running Cisco IOS version 12.0(20)W5(24b) might crash with a bus error in the SNMP code.
Workaround: Disabling polling chassis MIBs might prevent the crash.
•
Symptom: If you disconnect the transmit cable from an E1 CBR interface on a Catalyst 8540, Catalyst 8510, or LightStream 1010 switch, the interface still appears up/up. No indication of error messages appear in the log files.
When the transmit cable is reconnected, it starts to transmit traffic again. However, if the transmit cable is disconnected multiple times, the link does not pass traffic even when the transmit cable is reconnected.
Workaround: Use the shutdown and no shutdown commands on the interface and it returns to normal, or disconnect the receive cable and reconnect it.
•
Symptom: On a Cisco 6400 Node Switch Processor (NSP) running Cisco IOS Release 12.2(2)B and its derivatives, using the atm ping command to test a valid and active VP might fail with the following message:
Jun 20 15:56:17.742: %ATMCORE-3-INTERNAL_ERROR: atmCore_oamRcvPing: No match.The failure occurs when running the ping towards specific destination ATM switches, and is dependent on the format of the loopback cell received from the destination ATM switches. The occurrence of this problem is difficult to predict and depends on the particular ATM switch implementation of the destination switch.
Workaround: None.
•
Symptom: A Cisco 6400 NSP, running Cisco IOS Release 12.1(5)DB or 12.2(2)B, displays the following error message when you use the atm ping interface atm slot/subslot/port VPI VCI end-loopback command and enter the wrong VP/VC combination:
connection doesn't existAny future atm ping commands to any connections (both valid and invalid) always result in the same error message and the ping commands fail. It fails even if the connection is valid, and even if a VP ping is used (for example, no VC number is specified).
You can still use the IP ping command to diagnose the connectivity between the NRP2 (Node Route Processor 2) and NSP.
Workaround: None.
•
Symptom: A Catalyst 8510 MSR configured with an IMA (inverse multiplexing for ATM) bundle might not log link up or down status messages. Only messages displaying clock change are logged. See the following example:
04:23:21: %CLOCKSW: Switching from ATM1/1/1 to ATM1/1/004:24:26: %CLOCKSW: Unswitching from ATM1/1/0 to System04:25:21: %CLOCKSW: Switching from System to ATM1/1/104:26:06: %CLOCKSW: Unswitching from ATM1/1/1 to SystemAs each interface recovers its revertive clocking and the source is recovered, link functionality is restored. Confusion can be created if there are multiple links flapping and only CLOCKSW messages are received without reporting status of the interface.
The correct physical status can be viewed properly with show ima interface and show ima interface atm card/subcard/port max detail to display the status of the interface and counters.
Note
Workaround: None.
•
Symptom: When an IMA interface module is installed in the switch chassis, and if "loopback PIF" is configured on any OC-3 or OC-12 interface, loopback is NOT reflected when queried through SNMP. Loopback is NOT actually being set.
Workaround: None.
•
Symptom: Inverse ARP does not succeed for a Frame Relay PVC terminated on ATM router module.
Workaround: None.
•
Symptom: All MPLS VPN connectivity is broken on Cisco 7500, Cisco 7200, and all common platforms if there is a TCATM link between the two provider edges (PEs) that falls in the IGP path and LSP. The routers are disabled from initiating headend VC request over TCATM link.
Workaround: None.
•
Symptom: When Frame Relay/ATM Network Interworking (FRF.5) is configured on a Catalyst 8540, traffic above the peak information rate is dropped, and the INPUT ERROR counter is incremented, rather than the INPUT DROPS counter.
Workaround: None.
•
Symptom: On the LightStream 1010 switch, very intermittently, a SVC call could be rejected due to a VPI/VCI collision when established the call is through a PVP tunnel.
Workaround: After you reseat the interface module on which the PVP tunnel is configured, the condition will be cleared for some time.
Resolved Caveats—Cisco IOS Release 12.1(13)E1
Cisco IOS Release 12.1(13)E1 is a rebuild release for Cisco IOS Release 12.1(12c)EY. The caveats in this section are resolved in Cisco IOS Release 12.1(13)E1 but may be open in previous Cisco IOS releases.
•
Symptom: An ATM interface might stick in the state "going down" if the PVC is created from the ATM Router Module with VCI "34" on the ATM side. For example, "atm pvc 2 35 pd on interface ATM0/0/0 7 34" causes the line to flap "up" and "down".
Note
Workaround: Recreate the PVC using any VCI other than "34" on the ATM side.
•
Symptom: A Route Processor crash occurs when address registration fails at the switch. Also, an error message is flashed to the console. This problem occurs when traffic is flowing over a Flexwan module and either a hw-module-reset or OIR has occurred.
Workaround: None.
•
Symptom: When a point-to-multipoint SVC connection is set up through a switch (root and leaf are active and cross-connected), and a request is received to add a leaf through another interface, and the allocation of this half-leg fails, the connection structures associated with this half-leg are not cleaned up. This means when the connection is cleared, that failed connection cannot be released.
This ties up bandwidth and VPI and VCI resources for the root half-leg of the connection.
Note
Workaround: None.
•
Symptom: Avaya PBX and Definity PBX interoperability testing.
The following caveats exist for signalled ATM point-to-multipoint (P2MP) connections and the debugging of issues related to them on the Catalyst 8500 ATM switches:
–
–
–
–
Workaround: None.
•
Symptom: Power-on Diagnostics fail on the Catalyst 8510 MSR when Cisco IOS Release 12.1(10)E or higher is loaded in the bootflash.
Workaround: None.
•
Symptom: When the Cisco ATM switch is running UNI 4.0 with a Fore or Marconi switch, it might releasing a call because of unsupported traffic parameters.
This occurs when the Cisco ATM switch is connected to the other vendor equipment and configured to operate with UNI 4.0 version across the link and as a non-negotiated link. If any traffic parameter values are modified the Cisco ATM switch treats this as fatal error and releases the call.
Workaround: Hardcode the UNI version to 3.1
•
Symptom: When using ATM Frame Relay IWF on a Catalyst 8510 MSR running Release 12.0(18)W5(22) or later, the output queue of the pseudo-ATM interface might go to 40/40 and remain there even if no traffic is going through the switch on the ATM-FR circuits.
Note
Workaround: None.
•
Symptom: On the LightStream 1010 switch, the following error message appears if your switch is using Cisco IOS Release 12.0(19)W5(23):
Jan 15 12:34:19.734 CET:%ATMSIG-3-FAILXCONN: Xconnect failed, xconn fail-Traceback= 6054D9CC 6054F8A0 60559AF0 60548BC0 60548CC8 6009938C 60099378Jan 15 12:34:19.738 CET: ATMSIG(0/1/0:0 0,174 - 4887/00): (vcnum:0) XConnected failed ToJan 15 12:34:19.738 CET: ATMSIG(1/0/0:0 0,251 - 93568/00): (vcnum:0)Jan 15 12:34:19.738 CET: ATMSIG: CONNECTION MANAGER/CAC Xconn install requestPort A - (0/1/0) : 0 vpi = 0; vci = 174Port B - (1/0/0) : 0 vpi = 0; vci = 251; new vpi = 0; new vci = 251 existing vpi/vci for leg BJan 15 12:34:19.738 CET: ATMSIG: CONNECTION MANAGER/CAC Xconn install resultCONN_INSTALL_RESULT_HW_FAILIt appears frequently without any other preceding error messages and software/hardware changes on the switch.
Workaround: Upon its first appearance the issue was avoided by reloading the switch.
•
Symptom: Frame relay PVC goes down and remains down after enabling the OAM feature and performing a shut / no shut on the serial interface. However, traffic flow is not affected through the PVC even though it appears down.
Workaround: Disable OAM and shut/no shut the serial interface to force the interface to appear back up.
•
Symptom: The combined installation of TSCAM and a mixed interface module might cause the following mmc_queuecell failure message to appear:
"%AAL5-3-INTERNAL_ERROR: aal5send: mmc_queuecell failed "Workaround: None.
•
Symptom: Configuring different encapsulations on 2-port Gigabit Ethernet subinterfaces clears the existing active configuration when multiple subinterfaces are present on a main interface.
Workaround: All subinterfaces have to be configured with the same encapsulation (either 802.1 Q or Inter-Switch Link [ISL]).
•
Symptom: Spurious memory access at lss_arm_atm_adjacency_mac is observed after there is a CLI epc portstuck-manual-reload command entered on two ATM router module interfaces, while two Catalyst 8540 MSRs are connected.
This has no functionality impact.
Workaround: None.
•
Symptom: Oversized packets on the Enhanced ATM router module interface are observed when it is a member of a BVI. This console output relates to the oversized packets on the Enhanced ATM router module interface. The following message is displayed:
00:41:36: %TBRIDGE-4-GIANT: Giant received on ATM3/0/1, 1514 exceeds 1500DA 0100.5e00.0005 SA 0001.4274.ee09 [0x080045C0]The system recovers from this. The cause of this may be temporary congestion in the switch fabric, leading to the loss of the last cell of the packet.
Workaround: None.
•
Symptom: In a multi-vendor environment, if a non-Cisco IMA interface side does not support Test pattern, as specified in Inverse Multiplexing for ATM (IMA) Specification Version 1.1 by the ATM Forum, the Cisco IMA interface status might from up to down continuously.
Workaround: None.
•
Symptom: The output from the show bridge command is incomplete.
Workaround: None.
•
Symptom: The receiver circuitry on DS3 port adapters can interpret noise as a valid signal. This signal is framed incorrectly and does not contain real data. The DS3 controller interprets the signal as a bad signal instead of no signal, and the red RX LED lights up.
Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(12c)EY
Cisco IOS Release 12.1(12c)EY is a rebuild release for Cisco IOS Release 12.1(12c)E1. The caveats in this section are resolved in Cisco IOS Release 12.1(12c)EY but may be open in previous Cisco IOS releases.
•
Symptom: A memory leak might occur during an "atmSoft_timerProcess". With every "soft-vc" retry the holding memory on "atmsig CC" and "atm soft CV timer" increases and the "free" memory decreases. The free memory might fall to as low as 700K at times.
Workaround: None.
•
Symptom: After you configure a Point-to-Multi Point connection, if you try to remove the connection from the leaf side, the following message is displayed:
% PVC de-configuration not allowed with snooping on!!% De-configure snooping first.Workaround: Delete the PVC or PVP from the root end.
•
Symptom: The switch crashes when the IPX encapsulation is changed on Fast Ethernet or Portchannel interfaces.
This might occur after you change encapsulation and then use the shutdown and no shutdown commands.
Workaround: None.
•
Symptom: Multiple Cisco products contain vulnerabilities in the processing of Simple Network Management Protocol (SNMP) messages. The vulnerabilities can be repeatedly exploited to produce a denial of service. In most cases, workarounds are available that may mitigate the impact. These vulnerabilities are identified by various groups as VU#617947, VU#107186, OUSPG #0100, CAN-2002-0012, and CAN-2002-0013.
This advisory is available at http://www.cisco.com/warp/public/707/cisco-malformed-snmp-msgs-pub.shtml.
Workaround: None.
•
Symptom: SSH fails with the CRC-check failed error message sometimes.
Workaround: None.
•
Symptom: A Simple Network Management Protocol version 3 (SNMPv3) user is created by using message digest 5 (MD5) authentication with the following commands:
–
–
An SNMP walk is performed, the configuration is saved, and the switch is reloaded.
newhope:~/src/wccp2# snmpwalk -v 3 -u abcdefghij -A abcdefghij -a MD5 -lAuthNoPriv 194.12.224.11It is working and a debug snmp header shows this:
Incoming SNMP packet: v3 packet security model: v3 security level: authusername: abcdefghijA second SNMP walk is performed:
newhope:~/src/wccp2# snmpwalk -v 3 -u abcdefghij -A abcdefghij -a MD5 -lAuthNoPriv 194.12.224.11After the second SNMP walk is performed, the command does not return any output and the debug snmp headers show this:
Incoming SNMP packet: v3 packet security model: v3 security level: noauth: username: abcdefghijWorkaround: None.
Resolved Caveats—Cisco IOS Release 12.1(12c)E1
Cisco IOS Release 12.1(12c)E1 is a rebuild release for Cisco IOS Release 12.1(12c)E. The caveats in this section are resolved in Cisco IOS Release 12.1(12c)E1 but may be open in previous Cisco IOS releases.
•
Symptom: If an IMA group exists between a Catalyst 8540 and Catalyst 8510 switches with CBR soft VCs configured between the switches and a link of the IMA group is shut down or fails, the IMA interfaces still display the pervious bandwidth value. This bandwidth value is greater than the actual resources available on the interface and the soft VCs still appear as "up" on both the Catalyst 8540 and Catalyst 8510 switches. This continues to happen as more links are shut down or fail until the 2 CBR soft VCs that require the resources of 7 E1 links still appear as "up" with only 1 E1 link actually "up" between the IMA interfaces and the other 6 links that are shutdown.
Note
Workaround: Use the shutdown and no shutdown commands on the IMA group and it will display the correct values of available and allocated bandwidth.
•
Symptom: The Catalyst 8510 MSR might encounter a memory leak in ATMSIG processes and this might render the switch unusable after one month of operation.
Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(12c)E
Cisco IOS Release 12.1(12c)E is a rebuild release for Cisco IOS Release 12.1(11)E1. The caveats in this section are resolved in Cisco IOS Release 12.1(12c)E but may be open in previous Cisco IOS releases.
•
Symptom: When an ATM Soft-VC or Soft-VCP is configured between two interfaces of a Catalyst 8540 MSR using a particular VPI, and a Soft-VC or Soft-VCP is configured with the same VPI, the following error appears:
%ATMCORE-3-INTERNAL_ERROR: atmCore_connAllocateHalfLeg: return resource err.2The internal error message should not appear when the Soft-VC or Soft-VCP configuration fails.
Plus, the following expected message is seen more than once:
connection creation fails:vpi/vci has been usedThe internal error message is not seen when a PVC configuration on an interface is followed by a PVP configuration that uses the same VPI. Also, the internal error is not seen when the interface on which the configuration is being done does not have the resources required by the Soft-VC or Soft-VCP.
After the configuration is executed and then fails, this causes the allocation of the bandwidth requested by the CBR VC even though no VC actually exists. If, for example, N kbps is free on an interface, and a Soft-VC is configured from that interface with a VPI-VCI already in use and uses a CTTR of N kbps, the configuration fails, but all N kbps that were free on that interface are lost. This bandwidth loss is seen only with the CBR service-category.
Note
Workaround: For the Catalyst 8510 MSR, if you switchover the route processor it recovers the lost bandwidth on the interface. No workaround exists on the Catalyst 8510 MSR.
No workaround exists for the following error message:
"%ATMCORE-3-INTERNAL_ERROR: atmCore_connAllocateHalfLeg: return resource err.2•
Symptom: If a VC is down when the switch is reloaded, the ARM subinterface stays UP even though the OAM-state is OAM-Down.
Workaround: Bring the VC UP at least once after a reload.
•
Symptom: If you configure OAM on a PVC while it is down, the OAM state of the VC is displayed as "not applicable" instead of "OAM-Down" and never changes. This means OAM cells are not sent even after the VC comes UP. This only occurs if AIS is not enabled for the VC.
Workaround: Configure OAM for a VC only when it is in UP state.
•
Symptom: After OAM detects a failure on a PVC terminating on the ATM Router Module (ARM), it fails to remove the adjacency, the directly connected route, and any additional route pointing to the next hop reachable over the failed PVC. This condition might stop traffic.
Workaround: There is no work-around, other than to perform an admin shutdown of the ARM subinterface (if the PVC is the last or only PVC on that subinterface). Alternatively, you could remove the PVC until the problem has been rectified.
•
Symptom: The PNNI-MIB object pnniLinkIfIndex(.1.3.6.1.4.1.353.5.4.1.1.9.1.11) returns 0 on the main interface running PNNI.
This problem does not exist in 12.0(13)W5(19c) but exists in 12.0(18)W5(22) and 12.0(20)W5(24a).
Workaround: None.
•
Symptom: Two adjacent ATM devices (for example, ATM port at Catalyst 8510, ATM NIC, or Cisco 7200 router) had problems performing ILMI negotiation. The result of the ILMI negotiation is VPI/VCI range fails and the following error message appears:
%SYS-2-MALLOCFAIL: Memory allocation of 1650891065 bytes failed from 0x6066352C,pool Processor, alignment 0-Process= "ILMI Response", ipl= 0, pid= 80-Traceback= 6009E1F4 6009FCA0 60663534 60661488 6065EF94 6065E934 6009944C 60099438Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(11b)E1
Cisco IOS Release 12.1(11b)E1 is a rebuild release for Cisco IOS Release 12.1(11b)E. The caveats in this section are resolved in Cisco IOS Release 12.1(11b)E1 but may be open in previous Cisco IOS releases.
•
Symptom: An ARM configured with subinterface and PVCs loses IP connectivity over the active PVCs.
Workaround: To delete and reconfigure the PVC configuration restores connectivity.
•
Symptom: LightStream 1010 switches running 12.0(X)W5 Cisco IOS may not completely adhere to the ITU-T Q.2971 "B-ISDN DSS2 UNI Layer 3 Specification for Point-to-Multipoint Call/Connection Control". This could affect interoperability.
Workaround: Configure UNI Version 3.1 on the LightStream 1010 ATM interfaces if the point-to-multipoint interoperability issue is observed.
•
Symptom: Occasionally after a system crash or route processor switchover you may see a PVC connection that exists in the interface software configuration but not does appear configured in the interface hardware.
Workaround: Perform an OIR on the interface module with the failed connection or perform a route processor switchover to restore the connection on the interface hardware.
•
Symptom: If you use the no negotiation auto command in interface config mode on a 2-port Enhanced Gigabit Ethernet interface module with GMAC-D2 (hw-version 6.0 onwards), any packets larger than 1518 bytes or less than 64 bytes are filtered by the GMAC (Gigabit Ethernet Media Access Controller).
Workaround: Reload the particular interface using the epc portstuck-manual-reload interface card/subcard/port command.
•
Symptom: After deleting a connection, an immediate request to re-install with the same VPI/VCI results in connection-creation failure messages.
Workaround: Increase the bit map size from 32 to 64, to avoid reuse of the same VPI/VCI immediately after a call is released.
Resolved Caveats—Cisco IOS Release 12.1(11b)E
Cisco IOS Release 12.1(11)E is a rebuild release for Cisco IOS Release 12.1(10)EY. The caveats in this section are resolved in Cisco IOS Release 12.1(11)E but may be open in previous Cisco IOS releases.
•
Symptom: AIS signal taken into account with 2 seconds delay.
Workaround: None.
•
Symptom: Globally changing TDP to LDP or changing LDP to TDP sometimes causes a loss of neighbors.
Workaround: Following is a four-step work-around:
1. Configure no tag-switching ip on both sides.
2. Configure the desired protocol at each end.
3. Wait two minutes.
4. Configure tag-switching ip at each end.
•
Symptom: If PNNI continuously receives a high rate of corrupted PTSP packets over a long period of time, it can cause a large number of internal node numbers to be generated for bogus Node IDs. If the number of internal node numbers reaches 1032, it can cause a crash.
Under normal conditions, PTSP packets should have a very low rate of being corrupted. But if PNNI interfaces are tunneled through a network where the connections are rate limited to a too low rate it can force cell drops which can corrupt packets.
Workaround: Troubleshoot and remove the cause of PTSP packet corruption.
•
Symptom: You might see a Bus Error exception at get_slot_ptr while trying to do the continuous snmpwalk on the ciscoLS1010SubModuleGroup object of CISCO-RHINO-MIB and simultaneously toggling the redundant power-supply after at least one route processor switchover.
Workaround: None.
•
Symptom: Once the route processor switches over the following error message is seen on new Primary if we have a Gigabit processor interface module:
%ONLINEDIAG-6-ACCESS_TEST_WARNING: Unable to read from card in slot 10 sub_card 0.Enter the show diag online access command to get more details about the failure.
Workaround: None.
•
Symptom: Catalyst 8510 CSR eight port Gigabit Ethernet interface modules fails to run CLNS.
Workaround: Update to Cisco IOS release 12.1(11b)E.
•
Symptom: A Catalyst 8510 MSR locks up when configuring ATM port snooping. The switch lockup can occur if ATM port snooping is configured without an analyzer connected to the snoop port.
Workaround: 1.- Load the most recent version of Cisco IOS.
or
2.- Have the analyzer connected to the snoop port prior to configuring ATM port snooping. Keep the analyzer connected until the snoop configuration is removed.
•
Symptom: In a network running cell-mode MPLS (tag switching) with a large number of IP routes (and consequently, with many TVCs being set up), a 16-port OC-3 interface module might fail to allocate a new TVC on a bind request and print out the below error message. This occurs even though the number of TVCs currently set up does not reach the limit of VCs supported on that interface or the cross-connect interface.
Jun 22 20:49:02.011: %TCATM-4-RESOURCE_LIMIT: VC resource exhausted on ATMx/y/z
Workaround: Enter the shutdown command followed by the no shutdown command on the interface for which the error message appears.•
Symptom: A switch router with an 8-port Gigabit Ethernet interface module might forward duplicate broadcasts when bridging is configured on a trunk.
Workaround: None.
•
Symptom: The Internetwork Packet Exchange (IPX) statistics sometimes fluctuate when no traffic is flowing through the interface. The only affected functionality is IPX statistics.
Workaround: None.
•
Symptom: The hierarchical VP tunnel configuration fails on a WAI-OC3-1S3M mixed mode port adapter module when it is in slot 0 subslot 1 of the C85MS-SCAM-2P carrier module. Slot 0 subslot 0 of the carrier module can either be empty or have another card in it, and hierarchical VP tunnel configuration will still fail. However, if the mixed mode port adapter is inserted in slot 0 subslot 0 of the carrier module, then the hierarchical VP tunnel can be configured.
Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(10)EY
Cisco IOS Release 12.1(10)EY is a rebuild release for Cisco IOS Release 12.1(10)E. The caveats in this section are resolved in Cisco IOS Release 12.1(10)EY but may be open in previous Cisco IOS releases.
•
Symptom: Excessive CLP0 discards on TSCAM for PD enabled VCs.
Workaround: None.
•
Symptom: The LightStream 1010 switch might drop OAM F5 END loopback cells under its default configuration of OAM intercept (which is enabled by default).
Workaround: Disable OAM intercept to avoid dropping F5 OAM cells.
•
Symptom: The Catalyst 8510MSR and LightStream 1010 console hangs when using the hw-module {slot number | subslot subslot/subcard} reset command on the Frame Relay E1 interface nodule.
Workaround: Shutdown all controllers in the module before using the hw-module {slot number | subslot subslot/subcard} reset command.
•
Symptom: Ping fails when one of the two parallel soft VCs is missing.
Workaround: Use clear bridge command to reset bridge forwarding cache.
•
Symptom: After the simultaneous rebooting of switches terminating the active and passive side of Soft-VC for FRF5, randomly Soft-VPC stays up but, traffic might be dropped on the Frame Relay interface module. This might occur either on the active side of Soft-PVC or on the passive side of the call.
Workaround:
The Frame Relay interface module starts forwarding traffic only after you use the shutdown and no shutdown commands on the serial interface.
You might see the following error message when you reset the Frame Relay interface module:
Error Message: Channel-Group 1 State Change on FR-PAM failed 1For additional details, refer to DDTS CSCdv17817.
Resolved Caveats—Cisco IOS Release 12.1(10)E
Cisco IOS Release 12.1(10)E is a rebuild release for Cisco IOS Release 12.1(7a)EY1. The caveats in this section are resolved in Cisco IOS Release 12.1(10)E but may be open in previous Cisco IOS releases.
•
Symptom: A crash occurs while configuring BVI/eigrp, or while powering off the redundant power supply.
Workaround: None.
•
Symptom: When running Cisco IOS Release 12.0(18)W5(22) on a Catalyst 8510 MSR, or on a LightStream 1010, interoperability problems occur when peers run an older Cisco IOS version, and tunnels and SVC/Soft VCs are used.
Workaround: Upgrade all switches to the most current Cisco IOS release.
•
Symptom: Point-to-multipoint PVCs that are configured by using SNMP are not preserved across route processor switchovers.
Workaround: Disable the dynamic synchronization feature.
•
Symptom: When using a Packet Over SONET card, the Open Shortest Path First (OSPF) routes do not come up after a route processor switchover, even though they were up before the switchover.
Workaround: None
•
Symptom: The switch might reload when VP tunnels are created and removed.
Workaround: None.
•
Symptom: The Management Information Base (MIB) object "ifAdminStatus" shows "UP" for an ADMIN DOWN E1 Controller after a reload or a route processor switchover.
Workaround: Enter the no shutdown/shutdown command sequence on the controller.
•
Symptom: With a Frame Relay-ATM Soft-VC set up in FRF5, UPC on the passive side is always set to PASS, regardless of the hard setting on the serial interface with the frame-relay upc-intent tag-drop command. The default is PASS. When this is changed to tag-drop, the configuration does not reflect the change and the show vc int serial command always shows the UPC intent as PASS.
Workaround: None.
•
Symptom: The SNMP TRAP object ccrCpuStatusChange returns an invalid value.
Workaround: None.
•
Symptom: A port of a 4-port DS3 port adapter for LightStream 1010s and for Catalyst 8510s is in a yellow or red alarm state, and stops sending DS3 framing for a brief time when the alarm is cleared from the interface and the interface transitions to an UP/UP state. The loss of frame (LOF) can be seen when the Acterna tool TBERD is connected to the TX port of the DS3 port.
Workaround: None.
•
Symptom: The EIGRP Summary Routes are not properly populated in the adjacency table when a default route also exists. This affects the Fast Ethernet and ATM router module interfaces, but does not impact the Gigabit Ethernet interfaces.
Workaround: None.
•
Symptom: A Cisco edge services router (ESR) that is running Cisco IOS Release 12.1(2)E1 experiences interoperability problems when an ATM traffic descriptor information element is included in the CONNECT message on a non-negotiated link. Under such conditions, a STATUS message is sent with cause "invalid information element contents (100)" and call will not succeed. This problem is observed when Cisco routers are connected to other vendor switches like FORE, and occurs only when UNI version is 4.0.
Workaround: None.
•
Symptom: One side of a circuit emulation service (CES) E1 port of a LightStream LS1010 switch connection remains consistently in the YELLOW alarm or ALARM INTEGRATION state.
Workaround: None.
•
Symptom: After rebooting the switch router, Ethernet interfaces might have invalid MAC addresses, causing connectivity problems over that interface.
Workaround: Enter the shutdown command and then the no shutdown command on the affected Ethernet interfaces.
•
Symptom: IP traffic is not sent over a PVC if aal5mux encapsulation is used on a point-to-point subinterface on the Catalyst 8510 MSR. If the deb atm errors command is enabled, the following error messages will appear:
point-to-point interface does not have a VCDWorkaround: None.
Resolved Caveats—Cisco IOS Release 12.1(7a)EY1
Cisco IOS Release 12.1(7a)EY1 is a rebuild release for Cisco IOS Release 12.1(7a)EY. The caveats in this section are resolved in Cisco IOS Release 12.1(7a)EY1 but may be open in previous Cisco IOS releases.
•
Symptom: When a Catalyst 8510 MSR has a large number of inverse multiplexing over ATM (IMA) port adapter modules, a message similar to the following is generated:
-Process= "IMAPAM Onesec", ipl= 6, pid= 70-Traceback= 600D8280 600D8644 6049F928 600C03CC 600C03B8%SCHED-3-THRASHING: Process thrashing on watched message event.Workaround: None.
•
Symptom: Cisco Discovery Protocol (CDP) does not work over Portchannel platforms.
Workaround: None.
•
Symptom: After the Tag Distribution Protocol (TDP) toggles from down to up ("flaps") on the Label Controlled ATM (LC-ATM) interface, it takes a long time for the interface to become TDP ready. Entering the show tag-switching tdp discovery command might indicate that TDP is not ready, and TVCs might still be allocated on the interface. This can occur under stressful conditions in which cross-connections fail to be de-allocated on the ATM switching fabric.
Workaround: None.
•
Symptom: Under stressful conditions such as large topology changes, TVC cross-connections might fail to be removed from the ATM switching fabric, causing the TC-ATM function to repeat attempts to remove the TVCs. This might lead to the TC-ATM state process entering a bad state, and to an error message being displayed.
Workaround: None.
•
Symptom: Not all of the contents of the atmVcCrossConnectTable can be seen after the removal and re-insertion of a module. The message:
%ATMCORE-3-INTERNAL_ERROR: ATOM ERROR: ifCB_p=NULL for lowIfis seen on the console during some Simple Network Management Protocol (SNMP) get operations.
Workaround: None.
•
Symptom: What is present in the Patricia trie in the Ethernet processor interface is out of synchronization with what is present in IP Cisco Express Forwarding (CEF). This might cause connectivity problems. This problem only exists on Ethernet processor interfaces; entries in the Switching Database Manager (SDM) on Gigabit processor interface cards are not affected.
Workaround: Find the route (for example, the route network_x) that is not consistent with IP CEF; enter (in the case of this example) the clear ip route network_x command.
•
Symptom: Some point-to-multipoint crossconnnect entries are missing from the atmVcCrossConnectTable when the point-to-multipoint root if-index is higher than the if-index of the leaves.
Workaround: None.
•
Symptom: Interfaces with Tag enabled get stuck in the TDP not ready state.
Workaround: None. The only way to bring up the Tag on such interfaces is via system reload.
•
Symptom: During TagVC installation, if the switch driver returns an error, the Connection Manager leaves the TagVC in the wrong FSM state. This can lead to TVCs existing on an interface when there are no tag bindings.
Workaround: None; reload the switch to clear such unused TVCs.
•
Symptom: When running Cisco IOS Release 12.0(13)W05(19), a bus error causes the system to restart. This occurs when an 8-port Gigabit Ethernet card with control traffic is at or near its traffic capacity.
Workaround: None.
•
Symptom: If a large frame or packet (more than 6096 Bytes) is received on the tag control virtual circuit (0/32 of an interface enabled for tag switching), the frame is not purged from the switch fabric. Subsequent packets received on this virtual circuit are dropped, causing the Tag Distribution Protocol (TDP) and the routing session (OSPF) to time out.
Workaround: Disable, then re-enable, tag switching on the affected interface; subsequent occurrences can be avoided by increasing the queue depth, using the following entry:
atm threshold 2 max-queue-limit 511
•
Symptom: After reloading the core switch, all neighboring switches running 12.0(16)W6(21) or 12.0(16)W6(21a) crash, and a message similar to the following is generated:
Jul 14 05:00:09: %ATMSIG-3-FAILXCONN: Xconnect failed, xconn fail-Traceback= 6054A204 6054C0A0 60556188 60545538 6054561C 6009930C 600992F8Queued messages:Jul 14 05:00:09: %SYS-3-LOGGER_FLUSHING: System pausing to ensure console debugging output.Jul 14 05:00:09: %ATMSIG-3-FAILXCONN: Xconnect failed, xconn fail-Traceback= 6054A204 6054C0A0 60556188 60545538 6054561C 6009930C 600992F8Jul 14 05:00:09: ATMSIG(10/0/0:0 0,66 - 0004/25): (vcnum:0) XConnected failed ToJul 14 05:00:09: ATMSIG(ATM13/0/0 0,111 - 0046/25): (vcnum:111)Jul 14 05:00:09: ATMSIG: CONNECTION MANAGER/CAC Xconn install requestPort A - (10/0/0) : 0 vpi = 0; vci = 66Port B - (13/0/0) : 0 vpi = 0; vci = 111; new vpi = 0; new vci = 111 existing vpi/vci for leg BJul 14 05:00:09: ATMSIG: CONNECTION MANAGER/CAC Xconn install resultCONN_INSTALL_RESULT_HW_FAILWorkaround: None.
•
Symptom: The ifTable indexes do not match the MIB-II table indexes.
Workaround: None.
•
Symptom: A LightStream 1010 stops switching some VCs, and log error messages similar to the following example are generated:
Jan 9 12:37:34.793: ATMSIG(12/1/0:0 0,37 - 274610/00): (vcnum:0) XConnected failed ToJan 9 12:37:34.793: ATMSIG(12/0/1:0 0,268 - 398903/00): (vcnum:0)Jan 9 12:37:34.793: ATMSIG: CONNECTION MANAGER/CAC Xconn install requestPort A - (12/1/0) : 0 vpi = 0; vci = 37Port B - (12/0/1) : 0 vpi = 0; vci = 268; new vpi = 0; new vci = 268 existing vpi/vci for leg BJan 9 12:37:34.793: ATMSIG: CONNECTION MANAGER/CAC Xconn install resultCONN_INSTALL_RESULT_HW_FAILWorkaround: Reload the switch.
•
Symptom: When using the Internetwork Packet Exchange (IPX), the output of the traceroute command skips the middle hop when the middle router is a Catalyst 8540/8510 MSR, Catalyst 8540/8510 CSR, or LightStream 1010.
Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(7a)EY
Cisco IOS Release 12.1(7a)EY is a rebuild release for Cisco IOS Release 12.1(6)EY1. The caveats in this section are resolved in Cisco IOS Release 12.1(7a)EY but may be open in previous Cisco IOS releases.
•
Symptom: In Cisco IOS Release 12.1(6)EY and earlier, only two equal-cost IP paths were supported on Fast Ethernet and Gigabit Ethernet interface modules that were based on an Ethernet processor interface.
Workaround: Upgrade to Cisco IOS Release 12.1(7a)EY; in that release, four-path load balancing for IP is available through use of the epc epif-4-path-lbal command.
•
Symptom: When entering the show atm ilmi-status command the switch shows the 0.0.0.0 as a peer IP address even though a loopback address is configured.
Workaround: None.
•
Symptom: In the ATM-MIB there is an atmVcCrossConnectTable that allows SNMP to create VC Cross-connects. It is not possible to create multipoint connections. At the time of creating the second entry corresponding to the multipoint connection, SNMP reports the following error:
# ./snmpset -c private lore atmVcCrossConnectRowStatus.8431167.3.0.51.2.0.41 integer 5 atmMIB.atmMIBObjects.atmVcCrossConnectTable.atmVcCrossConnectEntry.atmVcCrossConnectRo wStatus.8431167.3.0.51.2.0.41 : INTEGER: createAndWait # ./snmpset -c private lore atmVcCrossConnectRowStatus.8431167.3.0.51.3.0.55 integer 5 snmpset: Agent reported error with variable #1. .iso.org.dod.internet.mgmt.mib-2.atmMIB.atmMIBObjects.atmVcCrossConnectTable.atmVcCros sConnectEntry.atmVcCrossConnectRowStatus.8431167.3.0.51.3.0.55: SNMP: A general failure occurred on the agent.Workaround: None.
•
Symptom: If an interface comes up after the system initialization, the scheduler for that interface might not be programmed correctly. Since IMA interfaces comes up after system initialization, IMA interfaces are usually affected by this.
Workaround: Enter the shutdown command on the IMA interface. Take the first link on the IMA interface out of IMA group. Bring that interface up. Shutdown that interface and then make it part of IMA group. Enter the no shutdown command to bring the IMA interface up.
•
Symptom: When the switch router is under stress because there are greater than 1000 TVCs on a given interface, some TVCs might not get set up successfully and the following error message occurs:
%TCATM-4-RESOURCE_LIMIT: VC resource exhausted
Workaround: Configure less than 1000 TVCs on interfaces.•
Symptom: The transmit side of a tag-enabled ATM interface may go into the "not TDP ready" state Use the show tag tdp discovery command to verify that it is in the "not TDP ready" state. As a consequence, Tag is inactive on that interface.
Workaround: Enter the shutdown command followed by the no shutdown command. If this does not work, there is no workaround.
•
Symptom: Performing a shutdown/no shutdown command sequence on an ATM router module interface, especially when it has configured a large number of LANE clients, might cause an error message like this to appear:
%LANE-3-LANE_ERROR: lecs finder: ILMI hung on interface ATM1/0/0It indicates an internal timeout occurred. It should try to self-cover and not affect any normal operations.
Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(6)EY
Cisco IOS Release 12.1(6)E is a rebuild release for Cisco IOS Release 12.1(5)EY1. The caveats in this section are resolved in Cisco IOS Release 12.1(6)EY but may be open in previous Cisco IOS releases.
•
There might be a buffer overflow.
Symptom: Sending a crafted control NTP packet might cause a buffer overflow.
Workaround: Include the "ntp access-group serve-only" line in the configuration of the router.
•
Symptom: The snmp polling of the virtual path mibs atmVplLastChange and atmVplOperstatus results in unavailability of the virtual path. But the polling of the virtual circuit in this virtual path states that it is available.
Workaround: None.
•
Symptom: A LightStream 1010 switch router might automatically reload. When you enter the show version command, the switch reports the reason as "System was restarted by error - a Software forced crash". In addition, log error message might say:
"SYS-6-BLKINFO: Corrupted @redzone blk"Other messages indicating memory corruption might also occur.
Workaround: None.
•
Symptom: After resetting a switch or router that is connected to a CES port on a LightStream 1010 or Catalyst 8510, there is connectivity about the physical layer.
Workaround: Enter the shutdown command and then the no shutdown command on the CBR interface of the LightStream 1010 or Catalyst 8510.
•
Symptom: ILMI might stay in the "waitdevtype" state after a redundancy failover. This is because on an OC3 port adapter, each of the 4 ports are served by one processor interface. The first port needs to be set for the other three ports to be able to receive. Sometimes this does not occur on a redundancy failover.
Workaround: Bring up port 0, if problem is seen on ports 1-3, port 4, if problem is seen on ports 5-7, port 8, if problem is seen on ports 9-11, and port 12, if problem is seen on ports 14-15. The ports can be brought up by connecting a loopback cable, or by simply using that port.
•
Symptom: When access is made to PNNI tables, a memory leak might occur. This only happens when an Network Management System (NMS) is running SNMP on the switch router.
Workaround: Turn off NMS polling of PNNI tables and instead use the commands for determining any PNNI information.
•
A peer switch might not learn an IP address through ILMI-status.
Symptom: An IP address might not be learned by peer switch when using ILMI-status.
Workaround: None.
•
Symptom: Port stuck messages might not log into the system log.
Workaround: None.
•
Symptom: The outbound ACL fails to filter packets in the subinterface when the static ARP is configured and the ACL is used with it. If a static ARP is configured and the same address is moved from an interface to a subinterface of the same interface, the static ARP entry remains associated with the main interface itself.
Workaround: When the IP address is reconfigured to a subinterface of a main interface, you then need to delete and reconfigure the ARP address.
•
Telnet might be slow.
Symptom: Telnet responses between two switch routers might be very slow.
Workaround: Replace one switch router with another that can accept ISL-frames less than 94B in size (for instance, the Catalyst 5000).
•
Symptom: The switch router might loose traffic on its LANE or 1483 or 1577 interfaces on ATM router module. Frame interfaces or non-LANE interfaces on ATM router module with configured PVCs should pass traffic without any problems. It doesn't matter if the traffic is going to route processor or not, part of the traffic is lost.
Workaround: The switch router will recover from this state only after an OIR of the module or a reload.
•
Symptom: A switch with a lot of FC-PCQ connections or running a lot of LANE traffic, might display the following message when the interface carrying most of the traffic is shutdown:
../src-4k-ls1010/mmc_dvr.c 2428 PORT DIED: 0/0/0, taking off lineWorkaround: None.
•
Symptom: In the Cisco IOS release image ls1010-wp-mz.120-13.W5.19, the LS1010 power on diagnostic test causes the IOS not to boot while the ATM router module and Fast Ethernet modules are installed.
Workaround: Upgrade to Cisco IOS release image version ls1010-wp-mz.120-13.W5.19a.
•
Symptom: When entering the show atm interface traffic command on an ATM subinterface, the total number of cells that has passed might show as zero. This rate is incorrect.
Workaround: None.
•
Symptom: The atmVcCrossConnectAdminStatus entries might disappear.
Workaround: None.
•
Symptom: HVPT: Incorrect scheduling values installed for low PCR. When a HVPT with a PCR of 2 kbps is configured on a OC-3 interface, this results in the cell starving of WKVC on the main interface.
Workaround: None.
Resolved Caveats—Cisco IOS Release 12.1(5)EY1
Cisco IOS Release 12.1(5a)EY1 is a new build of a Cisco IOS Release. The caveats in this section are resolved in Cisco IOS Release 12.1(5a)EY1 but may be open in previous Cisco IOS releases.
•
Symptom: HSRP cannot be configured on Cisco IOS Release 12.1(5)EY1 image on the Catalyst 8510 MSR platform.
Workaround: None.
•
Symptom: An ATM router module port configured for transparent bridging and in blocking state may forward certain frames.
Workaround: Ensure that a non-ATM router module port is in blocking state. If this is not feasible, physically shutdown the ATM router module port that is in blocking state.
•
Symptom: The IP PAT tree becomes programmed incorrectly for 1483 SVC after removing the ATM router module. If an SVC is configured on an ATM router module/Enhanced ATM router module card and the card is OIRed, the adjacency available across the SVC will remain valid in the EPIF/XPIF cam. This results in packets destined to that adjacency to disappear.
Workaround: Before OIRing an ATM router module/Enhanced ATM router module card, remove any subinterfaces that have a SVC configurations, then proceed to do the OIR.
•
Symptom: The ATM router module sets the CLP of all cells to 1 when bridging is configured over a 1483 PVC. This happens for cells being transmitted over the 1483 PVC only.
Workaround: None.
•
Symptom: On Cisco IOS Release 12.0(10)W5(18b), when the module with c8510-ACL is in the Catalyst 5500 chassis, the show hardware command does not show the ACL daughter card.
Workaround: None.
•
Symptom: The IP CEF adjacencies are reported as invalid when using the ATM router module configured with LANE clients on the Catalyst 8510 MSR. The router reports an invalid cached adjacency for ip addresses that is not reachable through the LANE interface when running the show ip cef ip address command.
For example:
show ip cef 207.18.18.0207.18.18.0/24, version 25, cached adjacency to ATM11/0/0.10 packets, 0 bytesvia 207.18.19.1, ATM11/0/0.1, 0 dependenciesnext hop 207.18.19.1, ATM11/0/0.1invalid cached adjacencyWith an invalid cache adjacency, all the packets destined to this address will be sent to the route processor for processing.
The CEF adjacency will be invalid until a LANE data direct VC and valid LE-ARP entry are established on the adjacent device. As soon as the data direct VC and LE-ARP entry are established, the adjacency will be reported as valid.
Workaround: None.
•
Symptom: If the HSRP has been configured on a Catalyst 8500 running an Cisco IOS Release 12.0(10)W5(18c), and the ATM router module is removed and then reinserted, the HSRP configuration is lost.
Workaround: None.
•
Symptom: When a ping command is entered from one member of a BVI to the outside, it causes some pings between members of the BVI to timeout.
Workaround: None.
•
Symptom: The ATM router module always signals a fixed value for the PCR if LANE is configured on the ATM router module. The hidden CLI will give a way to signal the user-configured PCR. This will help with ATM traffic shaping/policing by the ATM nodes in between.
Workaround: None.
•
Symptom: The IP adjacencies are not being cleared from the gigabit ethernet card quickly. The show epc ip-address command was issued on the adjacency, it was found that the entry for the host on vlan2 was still there and took some time to clear. As soon as it did clear, the ping command works again.
Workaround: None.
•
Symptom: The switch router will crash and hang when ip http server is configured and a browser connects to http://<router-ip>/%%. This defect can be exploited to produce a denial of service (DoS) attack. This information has been announced on public Internet mailing lists which are widely read by both security professionals and by security "crackers," and should be considered public information.
Workaround: Disable the IP http server with the following command: no ip http server
Alternatively, the administrator can block port 80 connections to the switch router via access lists or other firewall methods. For further information, refer to the security advisory available at http://www.cisco.com/warp/public/707/advisory.html.•
Symptom: ifOutOctets wrapping at 3000000 on an ATM interface.
Workaround: None.
•
Symptom: On rare occasions the switch fails SVC set ups even when physical connectivity is established.
Workaround: Reload the switch.
•
Symptom: Spurious memory access on show ip route command when SONICT interface is shutdown.
If you shutdown a 10-Mbps port and then use the show ip route command, spurious memory access appears in the print_route_preamble():
Workaround: None.
Interoperability
Starting with Cisco IOS Release 12.0(10)W5(18b) software release, hardware and software functionality interoperability exists between CSR interface modules and MSR interface modules by way of the ATM router module on the MSR chassis running an MSR image.
Y2K Compliance
Catalyst 8510 and LightStream 1010 systems running Cisco IOS Release 12.0(0.6)W5(1) or later have been certified as Y2K Compliant. For more information, see the following URL:
http://www.cisco.com/warp/public/752/2000/.
Related Documentation
•
•
•
•
•
•
•
•
Obtaining Documentation
Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation on the World Wide Web at this URL:
http://www.cisco.com/univercd/home/home.htm
You can access the Cisco website at this URL:
International Cisco websites can be accessed from this URL:
http://www.cisco.com/public/countries_languages.shtml
Ordering Documentation
You can find instructions for ordering documentation at this URL:
http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm
You can order Cisco documentation in these ways:
•
http://www.cisco.com/en/US/partner/ordering/index.shtml
•
Documentation Feedback
You can submit e-mail comments about technical documentation to bug-doc@cisco.com.
You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883We appreciate your comments.
Obtaining Technical Assistance
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, the Cisco Technical Assistance Center (TAC) provides 24-hour-a-day, award-winning technical support services, online and over the phone. Cisco.com features the Cisco TAC website as an online starting point for technical assistance. If you do not hold a valid Cisco service contract, please contact your reseller.
Cisco TAC Website
The Cisco TAC website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The Cisco TAC website is available 24 hours a day, 365 days a year. The Cisco TAC website is located at this URL:
Accessing all the tools on the Cisco TAC website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a login ID or password, register at this URL:
http://tools.cisco.com/RPF/register/register.do
Opening a TAC Case
Using the online TAC Case Open Tool is the fastest way to open P3 and P4 cases. (P3 and P4 cases are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Case Open Tool automatically recommends resources for an immediate solution. If your issue is not resolved using the recommended resources, your case will be assigned to a Cisco TAC engineer. The online TAC Case Open Tool is located at this URL:
http://www.cisco.com/tac/caseopen
For P1 or P2 cases (P1 and P2 cases are those in which your production network is down or severely degraded) or if you do not have Internet access, contact Cisco TAC by telephone. Cisco TAC engineers are assigned immediately to P1 and P2 cases to help keep your business operations running smoothly.
To open a case by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447For a complete listing of Cisco TAC contacts, go to this URL:
http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
TAC Case Priority Definitions
To ensure that all cases are reported in a standard format, Cisco has established case priority definitions.
Priority 1 (P1)—Your network is "down" or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.
Priority 2 (P2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Priority 3 (P3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
Priority 4 (P4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
•
http://www.cisco.com/go/marketplace/
•
http://cisco.com/univercd/cc/td/doc/pcat/
•
•
•
http://www.cisco.com/go/iqmagazine
•
•
http://www.cisco.com/en/US/learning/index.html
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StrataView Plus, TeleRouter, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0502R)
Copyright © 2005 Cisco Systems, Inc. All rights reserved.
Posted: Fri Apr 15 17:26:14 PDT 2005
All contents are Copyright © 1992--2005 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.
