Release Notes for MSS Version (MR4)

Transcription

1 Release Notes for MSS Version (MR4) Feedback and Support Web Authentication on WLC Web Authentication on WLC Release Compatibility Upgrading to MSS Release Installing Upgrade Activation Keys on a WLC Issues Resolved in MSS (9.2MR4) Issues Resolved in MSS (9.2MR3) Issues Resolved in MSS (9.2MR2) Issues Resolved in MSS (9.2MR1) Issues Resolved in MSS (9.1MR8) Issues Resolved in MSS (9.1MR7) Issues Resolved in MSS (9.1MR6) Issues Resolved in MSS (9.1MR5) Issues Resolved in MSS (9.1MR4) Issues Resolved in MSS (9.1MR3) Issues Resolved in MSS (9.1MR2) Issues Resolved in MSS (9.1MR1) Known Behaviors and Issues Changes to Default Behaviors Known Limitations Errata in Documentation We recommend that you familiarize yourself with this release notes before installing Mobility System Software (MSS) Release 9.1. For additional product information, see the following manuals available at Wireless LAN Services (WLS) Product Documentation. MSS Quick Start Guide, Release 9.1 MSS Configuration Guide, Release 9.1 MSS Command Reference Guide, Release 9.1 Copyright 2017, Juniper Networks, Inc. 1

2 Feedback and Support Juniper Networks encourages you to provide feedback about your experiences in installing and using the product to the Juniper Networks Customer Assistance Center (TAC). Web Authentication on WLC When you set the following web portal modes, if the client requests any URL, the WLC presents its own certificate that was issued for the virtual interface IP address. This IP address will not match the URL/IP address that was requested by the client and the certificate will not be trusted unless the client forces an exception in the browser. A certificate warning is displayed. WLC# set web-portal ssl-mode full WLC# set web-portal ssl-mode partial New and Enhanced Features Enhancements in MSS 9.1 Release Enhancements in MSS (MR1) Release What is New in MSS (MR4) Release Enhancements in MSS 9.1 Release This release includes the following new features: Bonjour Gateway Support In this release, the Juniper Networks Wireless LAN Controllers (WLCs) provide support for Bonjour Gateway, which enables you to filter local Bonjour mdns packets on the network and supports service discovery across multiple VLANs. The current implementation supports only IPv4 addressing. Juniper Networks Bonjour solution is a cache- and-proxy-response approach. It supports distinct policies for both service advertisement (what gets cached) and for discovery (what gets responded to). The following capabilities are supported in this release: Sharing Bonjour services across subnets and VLANs Limiting Bonjour traffic over the WLAN Limiting Bonjour services by user, location, and VLAN Limiting devices by user role The Advanced Access Point Data Rate Adaptation This feature enhancement provides a robust wireless link between any client type or mesh node and access points under normal as well as under challenging signal-to-noise ratio (SNR) conditions while delivering the best possible performance for user applications or mesh links. The advanced data rate adaptation feature improves the reliability and efficiency of the wireless links between clients and the access points (WLAs) by adjusting data rates intelligently on the basis of various performance metrics and requirements. JunosV Wireless LAN Controller (JunosV WLC) The JunosV WLC supports up to 500 access points. JunosV WLC is a next-generation virtual wireless LAN controller that uses a cloud-based architecture with physical access points. The virtual controller runs on a virtual machine (VM) environment that supports operating systems and executes applications. You can install up to 32 instances of JunosV WLC in a cluster on multiple physical servers running VMWare ESXi Hypervisor and can support up to 4000 access points. 2 Feedback and Support Copyright 2017, Juniper Networks, Inc.

3 WLA Name in RADIUS Server In releases earlier than 9.1, the controller ID (WLC ID) was used as the NAS ID when a RADIUS request is sent to the RADIUS server. With this feature enhancement, instead of the WLC ID, the access point name is now used in the NAS ID field while sending RADIUS requests to the RADIUS server. This helps the RADIUS server make intelligent, location-based decisions for accepting or rejecting to join the RADIUS request or assign an appropriate VLAN to the access point location. The SNMP Functionality Enhancement SNMP now includes the following CLI capabilities (show commands): Tracking load information for each access point or access point group is equivalent to the show ap load command in the CLI and is associated with the AP MIB. Tracking ACL security hits on the WLC is equivalent to the show security acl hits command in the CLI and is associated with the session MIB. Tracking mesh topology and mesh WLA link statistics is equivalent to the show ap mesh-link command in the CLI and is associated with the AP MIB. Tracking the rogue access points is equivalent to the show rf data class rogue command and is associated with the RF detect MIB. DFS Support In this release, the Juniper WLCs provide support for Dynamic Frequency Selection (DFS) feature. This feature enables the wireless devices to scan and select channels where there is minimal congestion corresponding to the frequencies available in a regulatory domain. In countries where DFS is required, MSS performs the appropriate check for radar. If radar is detected on a channel, the WLA radio stops performing active scans on that channel in accordance with DFS. However, the radio continues to passively scan for beacons from rogue devices. DFS is applicable for radios operating in 5GHz bands (802.11a radios) only. WLAs Supported in MSS Release 9.1 The WLAs supported in this release includes: WLA321 WLA322 WLA522 and WLA522E WLA532 and WLA532E WLA632 MP-422 (MP-422, MP-422A, MP-422B, MP-422F, and MP-422FB) MP-432 (MP-432 and MP-432F) MP-522 and MP-522E MP-620 (MP-620A and MP-620B) MP-622 MP-632 and MP-632F See the End of Life (EOL) and End of Support (EOS) milestones page for the WLAN Series Hardware Dates and Milestones at Enhancements in MSS (MR1) Release MSS has the following enhancements: SNMP Traps Enhancements The trpz-trap MIB used by MSS has definitions of the traps generated by the WLCs. 3 New and Enhanced Features Copyright 2017, Juniper Networks, Inc.

4 Some of these traps are specific to the WLCs and some are related to WLAs, providing information on specific WLAs. In this enhancement, the WLA name and the WLA number have been included as part of all WLA related traps (35 traps in all). With this feature enhancement, users can identify and debug issues on a per WLA basis. Remote NAT Support In this release, remote NAT support has been provided to enable both controllers and access points to be behind NAT. This is a flexible deployment where you can deploy all or specific WLCs and all or specific WLAs behind NAT. To support this feature, the WLCs and WLAs behind NAT are subjected to a 1:1 static NAT where there is no port translation and each WLC or WLA has a unique public IP address. When you enable WLC clustering, for a controlled communication between WLCs in the cluster, it is essential that you also configure NAT hairpinning support in the router or security gateway where 1:1 static NAT is enabled. NAT hairpinning enables the WLCs within the same Layer 2 domain to reach each other by using their public IP addresses (rather than local private IP addresses) because the mobility domain configured with the WLCs use their public IP addresses. For WLCs behind NAT, following are the requirements on the NAT gateway: Support for 1:1 static NAT Support for both source and destination NAT Support for NAT hairpinning For WLAs behind NAT, following are the requirements on the NAT gateway: Support for 1:1 static NAT Support for both source and destination NAT CE Compliance Declaration of Conformity with Regard to the ETSI EN v1.8.1 Standard This declaration is valid only for configurations supported or provided by Juniper Networks Systems for use within the EU. All Juniper WLA532-WW, WLA532E-WW, WLA322-WW, and WLA321-WW equipment are now compliant with the ETSI EN v1.8.1standard. The WLA devices are categorized as non-frequency Hopping Spread Spectrum (FHSS) and Adaptive devices. Specifically, this MSS release ensures that the WLAs are compliant with requirements such as Adaptivity and others detailed in Sections from through for non-fhss devices in the mentioned ETSI EN v1.8.1 standard. What is New in MSS (MR4) Release WLA Radio Spectral Scan Mode Spectral analysis starts with the RF detect function. The primary function of RF detect is to detect and classify devices. However, for spectral analysis, that function is extended to recognize non sources of interference. WLAN radios continuously scan for potential clients. In addition to finding clients, these scans detect other electronic devices, such as other WLAs and various non equipment. After the scan is complete, a spectrogram report is generated as a graph. This graph can be viewed in RingMaster by selecting the WLA s radio to scan in the Spectral mode. When a WLA s radio is enabled for this spectral scan mode, there is a time lag of up to 5 seconds between voice and video, and at times, data packets are delayed during heavy data traffic because the radio holds back these packets for processing during those few seconds. WLC100 Interoperability Issue with Other Vendor Switches The interoperability issue can be classified as a limitation that occurs only when WLC100 controllers are used with third-party switches. We recommend that you use WLC100 with the Juniper Networks switches. 4 New and Enhanced Features Copyright 2017, Juniper Networks, Inc.

5 CLI Commands Introduced from This MSS Release In this MSS release, a new CLI command has been introduced, using which you can enable or disable the country IE mode. To enable or disable the country IE mode in WLCs, use the following command: WLC# set country-ie mode disable success: change accepted Also, this command can be used to enable or disable the country IE mode in WLAs. When country IE mode is enabled, country IE and power constraint IE parameters can be configured in WLA radio beacons and probe responses. When a WLC is configured as part of a cluster, the command can be issued only in the current active seed, and it is synchronized across cluster members including the secondary seed. This command is executed on the secondary seed when the connection to the primary seed is lost and the secondary seed becomes the active seed. Note that this command is not radio-specific and is, therefore, applied to all the radios in all the WLAs under a controller. By default, country IE mode is enabled. To display the configured country IE mode, use the following command: WLC# show country-ie mode Beacon IE mode: disable Release Compatibility RingMaster This release of Mobility System Software (MSS) is compatible for use with RingMaster Release 9.1 or later releases only. Minimum MSS Requirements for Upgrade Table 1 lists the minimum required MSS release and the upgrade path for each controller for upgrading to MSS Release 9.1. Use the upgrade path to upgrade the WLCs to MSS release 9.1 from the minimum MSS release. Table 1: Software Requirements for Upgrade to MSS Release 9.1 Product Minimum MSS Release Required Upgrade Path WLC > 7.1 > 7.3 > 7.5 > 7.6 > 7.7 > 8.0 > 9.0 > 9.1 WLC880R 7.5.xx 7.5 > 7.6 > 7.7 > 8.0 > 9.0 > 9.1 WLC x 7.3 > 7.5 > 7.6 > 7.7 > 8.0 > 9.0 > 9.1 WLC > 9.1 JunosV WLC > 9.1 WLC2 7.x 7.0 > 7.1 > 7.3 > 7.5 > 7.6 > 7.7 > 8.0 > 9.0 > 9.1 WLC8 7.x 7.0 > 7.1 > 7.3 > 7.5 > 7.6 > 7.7 > 8.0 > 9.0 > 9.1 WLC200 7.x 7.0 > 7.1 > 7.3 > 7.5 > 7.6 > 7.7 > 8.0 > 9.0 > 9.1 If you have MSS Release 8.0 or later installed on your WLC, you can upgrade your WLC directly to MSS Release 9.1. However, if you have a release earlier than MSS Release 8.0, then you must first upgrade to MSS Release 8.0 before upgrading to any later releases of MSS. You cannot upgrade MSS versions 9.1.x.x through 9.5.x.x to MSS versions 9.6.x.x through 9.9.x.x. If you attempt these upgrades, the controller booting the upgraded MSS (versions 9.6.x.x through 9.9.x.x) reboots from the previous partition that holds the previous MSS version (versions 9.1.x.x through 9.5.x.x). However, you can upgrade from MSS versions 9.6.x.x through 9.9.x.x to MSS versions 9.1.x.x through 9.5.x.x. 5 Release Compatibility Copyright 2017, Juniper Networks, Inc.

6 Table 2: Client and Session Parameters Parameter Maximum instantaneous web authentication connections Supported Value WLC2800: 192 WLC800R: 96 WLC880: 96 WLC100: 32 JunosV WLC: 256 This is the maximum instantaneous Web authentication connection requests that each controller can handle at a time. When the number of requests exceeds this limit, Web authentication connection fails and the controller displays the message: Not enough resources for client. Table 3: JunosV Wireless LAN Controller Parameters Parameter Description or Supported Value Form factor Virtual Machine Software Deployment modes Local switching mode Yes Overlay mode Yes Mesh Yes Scale Minimum access points 4 Maximum access points 256 Active Maximum client support 6400 Maximum number of remote WLA groups 256 Active, 2048 in cluster Maximum access points per remote WLA 100 group Maximum SSIDs 128 Maximum VLANs 256 Minimum Hardware Specification Interfaces or network I/O 1 GE CPU 2 GHz Memory 2 GB recommended Disk Space 16 GB Features Supported Auto-tune Yes Bandwidth Control (Identity based) Yes Admission Control (CAC)/Wi-Fi Multimedia Yes (WMM) Guest services (wireless) Yes Wired Authentication Yes Access Control Lists (ACLs) Yes JunosV WLC High Availability WLC Controller Clustering 6 Release Compatibility Copyright 2017, Juniper Networks, Inc.

7 Software Releases on the Juniper Support Site On the software downloads page at there are two different files for each WLC/MX platform. The software files labeled MX0XXXX.platform.zip are for the legacy platforms sold by Trapeze Networks. These controllers bear the Trapeze logo and product name on the front panel. The WC0XXXXX.platform.zip software files are intended for the Juniper-branded platforms. These controllers bear the Juniper Networks logo and the Juniper Networks product name on the front panel. For JunosV WLC, the software files are labelled as WCXXXXXX.V.tgz and WCXXXXXX.INA.V.tgz (for upgrade only). Caution: The two file types are not interchangeable between Trapeze-branded and Juniper-branded platforms. You must install the MX file release on Trapeze products, and the WLC file release on Juniper products. Upgrading to MSS Release 9.1 Before you upgrade, see Release Compatibility on page 5. After you verify that the WLC is running the minimum MSS release required to upgrade to MSS Release 9.1, return to this section. Preparing the WLC for Upgrade While preparing the WLC for an upgrade, consider the following details: VLAN IDs higher than 3584 Informational Note: To avoid conflicts with the Juniper internal VLAN numbering scheme, we strongly recommend that you use VLAN IDs less than 3584 on WLCs that are being upgraded to MSS Release 9.1. Use VLAN IDs up to 3583 only. Failure to do so might result in lost configuration data. Caution: Create a backup of your WLC files before you upgrade the WLC. We recommend that you save a backup configuration of the WLC before you install the upgrade so that if an error occurs during the upgrade, you can restore your WLC to a previous configuration. Informational Note: When saving the backup file, MSS copies the file to a temporary location to compare it against an existing file for any errors that might have been introduced during the copying process. After verifying that the file is error-free, MSS deletes the file from the temporary location. Informational Note: Controller Cluster Configuration Recommendation. We recommend that you install the same release of MSS on all cluster members to have feature parity between the seeds and members. Additionally, we recommend that you use the same WLC models in a cluster configuration. Backing Up the Configuration Files To backup the configuration files, use the following command: WLC# backup system [tftp:/ip-addr/]filename [all critical] To restore a WLC that is backed up, use the following command: WLC# restore system [tftp:/ip-addr/]filename [all critical] 7 Release Compatibility Copyright 2017, Juniper Networks, Inc.

8 To back up only the critical files such as the configuration, system, and core files, enter the keyword critical. To back up all files, enter the keyword all, which is the default value. Upgrade Scenario on page 9 shows an example of using the backup command. For more information about the commands, see the Backing Up and Restoring the System section in the Managing System Files chapter of the Mobility System Software Configuration Guide. Upgrading an Individual WLC by Using the CLI Caution: If you have made configuration changes, but have not saved the changes, use the save config command to save the changes, before you back up the WLC. 1. Back up the configuration on the WLC by using the backup system command. 2. Copy the new software image on to a TFTP server. For example, log in to by using a Web browser on your TFTP server and download the image onto the server. 3. Copy the new system image file from the TFTP server onto an inactive boot partition in the nonvolatile storage of the WLC. For example, WLC800# copy tftp:// /wc boot1:wc To get the list of images for the WLCs, go to the Software Downloads page on Informational Note: If boot1 is the active boot partition, an error is displayed. You must copy the new image to the other boot, which is boot0. If boot1 is the configured boot partition and not the active boot, an error is displayed. Change boot0 to the configured boot by using the command set boot partition boot0 and then copy the image to boot1. 4. Set the partition to the boot to which the new system image is copied by using the command WLC# set boot partition boot1 5. To verify that the new image file is installed, type show boot. The output of this command confirms the installation. 6. Reboot the software. To restart the WLC and reboot the software, type the following command: WLC# reset system When you restart the WLC, the WLC boots by using the new MSS image. The WLC also sends the WLA release of the new boot image to WLAs and restarts the WLAs. After a WLA restarts, the release number of the new WLA boot image is checked to ensure the release number is the updated release number on the WLA. If the release number is the updated one, the WLA completes installation of the new boot image by copying the boot image into the WLA flash memory, which takes about 30 seconds, and then restarts again. The upgrade of the WLA is complete after the second restart. 8 Release Compatibility Copyright 2017, Juniper Networks, Inc.

9 Upgrade Scenario This upgrade example is for upgrading a WLC2800. In this example, the image file is copied to boot partition 0. Caution: On your WLC, copy the image file into the boot partition that was not used the last time the WLC was restarted. For example, if the WLC booted from boot partition 1, copy the new image into boot partition 0. To see boot partition information, type the show boot command. *WLC2800-M24# copy tftp:// /images/ /wc boot0: success: received bytes in seconds [ bytes/sec] success: copy complete. *WLC2800-M24# set boot partition boot? <partition> Choice of boot0, boot1 *WLC2800-M24# set boot partition boot0 success: Boot partition set to boot0:wc ( ). *WLC2800-M24# save configuration success: configuration saved. WLC2800-M24# show mobility-domain Mobility Domain name: default Flags: u = up[1], d/e = down/config error[0], c = cluster enabled[0], p = primary seed, s = secondary seed (S = cluster preempt mode enabled), a = mobility domain active seed, A = cluster active seed (if different), m = member, y = syncing[0], w = waiting to sync[0], n = sync completed[0], f = sync failed[0] Member: * = switch behind NAT Member Flags Model Version NoAPs APCap upa-- WLC WLC2800-M24# reset system This will reset the entire system. Are you sure (y/n)y Closing network connections... Preserving command audit logs. Size of preserved command audit log is now 5362 blocks Shutting down daemons... Shutting down filesystems... Wireless Switch Bootstrap 7.8 Release OK unzip file len OK system_mem_top 0x Warm Reset Cause. Reset Cause = 0x01 Wireless Switch Bootstrap/Bootloader Version Release Compiled on Thu Feb 23 11:41:27 PST 2012 by build Bootstrap 0 version: 7.8 Active Bootloader 0 version: Active Bootstrap 1 version: 7.8 Bootloader 1 version: Release Compatibility Copyright 2017, Juniper Networks, Inc.

10 Mainboard Revision: 5. CPLD Controller Revision: 23. Using SST NAND drive / BOOT Index: 0 BOOT TYPE: c DEVICE: boot0: FILENAME: default FLAGS: OPTIONS: run=nos;root=md0a Autoboot flag set, enter q followed by ENTER to abort...1 Compact Flash load from boot0:default matches WC OK unzip file len OK DOC Driver, ver xpt_configure: doc SIM attach failure Unable to access /dev/hd0 Downloading HYDRA FPGA HYDRA FPGA download complete. [12] System Initialized (6.4.1), starting MSS Starting supervisor _ Copyright (c) Juniper Networks, Inc. All rights reserved. When saving the backup file, MSS copies the file to a temporary location to compare it against an existing file for any errors that might have been introduced during the copying process. After verifying that the file is error-free, MSS deletes the file from the temporary location. Hitless Upgrade of Controllers in a Cluster-Enabled Mobility Domain To upgrade all the controllers in a cluster-enabled mobility domain: 1. Back up the WLC by using the backup system command. 2. Copy the new system image from a TFTP server to the inactive boot partitions of all the controllers in the mobility domain. The boot partition must not be the configured partition or the active boot partition. For example, to copy the new system image from a TFTP server to the inactive boot partition, type the following command: WLC# copy tftp://<tftp-server-ip-address>/<image-name>/boot1:<image-name> To get the list of images for the WLCs, go to the Software Downloads page at Informational Note: If boot1 is the active boot partition, an error is displayed. You must copy the new image to the other boot, which is boot0. If boot1 is the configured boot partition and not the active boot, an error is displayed. Change boot0 to the configured boot by using the command set boot partition boot0 and then copy the image to boot1. 10 Release Compatibility Copyright 2017, Juniper Networks, Inc.

11 3. Set the partition to the boot to which the new system image is copied to every controller by using the following command: WLC# set boot partition boot1 4. Save the configuration in every controller. Enter the following command in the primary seed, secondary seed, and all member controllers: On the primary and secondary seeds: WLC# save configuration On all member controllers: WLC# save configuration local 5. Enter the following command in the primary seed of the mobility domain: WLC# upgrade cluster To Downgrade an MSS Release in a Cluster-Enabled Mobility Domain 1. Copy the image from a TFTP server to the inactive boot partitions of all the controllers in a mobility domain. The boot partition must not be the configured partition or the active boot partition. For example, to copy the new system image from a TFTP server to the inactive boot partition, type the following command: WLC# copy tftp://<tftp-server-ip-address>/<image-name>/ boot1:<image-name> To get the list of images for the WLCs, go to the Software Downloads page on 2. Set the partition to the boot to which the new system image is copied to every controller by using the following command: WLC# set boot partition boot1 3. Save the configuration in every controller. Enter the following command in the primary seed, secondary seed, and all member controllers. On the primary and secondary seeds: WLC# save configuration On all member controllers: WLC# save configuration local 4. Enter the following command in every controller in the mobility domain: WLC# reset system Installing Upgrade Activation Keys on a WLC WLA licensing is supported on WLC platforms as shown in Table 4. Table 4: Licensing and Upgrade Increments for the WLC Models WLC Model Base WLA Support Maximum WLA Support Upgrade Increment WLC or 128 Copyright 2017, Juniper Networks, Inc. Release Compatibility 11

12 Table 4: Licensing and Upgrade Increments for the WLC Models WLC Model Base WLA Support Maximum WLA Support Upgrade Increment WLC880R WLC WLC WLC100-U4 support 4 WLAs JunosV WLC , 100 WLC2 4 4 NA WLC NA WLC Caution: If you downgrade to an earlier release of MSS that does not support the higher capacity licenses, the number of supported WLAs is reduced to the number that was supported in the earlier software release. Feature licensing support on WLC platforms is as show in Table 5. Table 5: WLC Feature Licensing Matrix Spectrum Analysis High Availability (WLA522, WLA532, WLC Model Advance Voice Module Module Mesh/Bridging Module WLA321 and WLA322) WLC2800 Supported Supported Up to 512 WLAs (2048 in cluster mode) WLC880R Supported Supported Up to 256 WLAs Supported Supported (2048 in cluster Mode) WLC800 Supported Supported Up to 128 WLAs (512 WLAs in cluster mode) WLC100 Supported Supported Up to 32 WLAs (128 in cluster mode) JunosV WLC Supported Supported Up to 512 WLAs (2048 in cluster mode) WLC2 Supported Supported Up to 4 WLAs (16 WLAs in cluster mode) WLC8 Supported Supported Up to 12 WLAs (48 in cluster mode) WLC200 Supported Supported Up to 192WLAs (768 in cluster mode) Supported Supported Supported Supported Supported Supported 12 Release Compatibility Copyright 2017, Juniper Networks, Inc.

13 Informational Note: Spectrum analysis is supported on WLCs as follows: WLC2800, WLC880R, and WLC800 support six radios on simultaneous WLAs in spectral graphing mode. WLC100 support one radio on simultaneous WLAs in spectral graphing mode. JunosV WLC support six radios on simultaneous WLAs in spectral graphing mode. WLC2 and WLC8 support one radio on simultaneous WLAs in spectral graphing mode. WLC200 supports four radios on simultaneous WLAs in spectral graphing mode. Informational Note: Spectrum analysis licensing for cluster configuration is applied to the primary seed and propagated to the secondary seed. However, in a Mobility Domain without a cluster configuration, Spectrum Analysis licensing is applied to any WLC that has a WLA capable of running Spectrum analysis. To upgrade a WLC license: 1. Obtain a license coupon for the upgrade from Juniper Networks or your reseller. 2. Establish a management session with the WLC to display the serial number. To display the serial number, type the command show version. In the following example, the WLC serial number is LG WLC2800-M24# show version Mobility System Software, Version: REL Copyright (c) Juniper Networks, Inc. All rights reserved. Build Information: (build#0) REL_9_1_0_branch :56:00 Model: WLC2800 Hardware Mainboard: version 5 ; revision A10 ; FPGA version 23 Wireless Accelerator version Serial number LG Flash: Kernel: BootLoader: 7.8 / Use a Web browser to access the Juniper Networks license server at: 4. On the WLC, use the following command at the enable (configuration) level of the CLI to install the activation key: WLC800# set license activation-key In the following example, an activation key for an additional 96 WLAs is installed on WLC800. WLC800# set license 3B02-D821-6C19-CE8B-F20E success: license accepted 5. Verify installation of the new license by typing the following command: WLC800# show licenses Feature : 96 additional APs Support for the additional WLAs begins immediately. You do not need to restart the WLC to effect the upgrade. Copyright 2017, Juniper Networks, Inc. Release Compatibility 13

14 Informational Note: Unlike other WLCs, for JunosV WLC, you do not have to procure license coupons for applying the license. The JunosV WLC follows the Juniper Software Advantage (JSA) model of licensing. You can purchase JSA-based JunosV WLC licenses to support up maximum of 500 WLAs. The default license, which is the base license SKU (JUNOSVWLC-BASE), supports up to 10 WLAs. You can purchase additional license SKUs up to 500 WLAs and can enable the support for these additional licenses by using the following command: set license ap anykey where anykey can be any text or special character. Caution: You must purchase the required number of JSA-based JunosV WLC licenses to support the number of WLAs in your deployment environment. Table 4 lists the minimum system specification for JunosV WLC. Table 6: JunosV Wireless LAN Controller Minimum System Specification Parameter Description or Supported Value Minimum Hardware Specification Note: For the minimum hardware specification, a single instance of JunosV WLC can support up to 16 WLAs. Interfaces or network I/O CPU Memory Disk space 1 GE 1 virtual CPU 320 MB 16 GB Issues Resolved in MSS (9.2MR4) WLC2800 cluster, running MSS , displays multiple core files. [PR : This issue has been PCI compliance report shows WPA SSID as WEP. [PR : This issue has been Issues Resolved in MSS (9.2MR3) There are multiple potential vulnerabilities in WPA1, WPA2/TKIP, AES-CCMP, and WPA2-Enterprise clients and WLAs. [PR : This issue has been The following CVE is applicable to Juniper WLAs in Mesh topology (Mesh Portal to Mesh WLA) connection: > CVE : reinstallation of the pairwise key in the 4-way handshake: new case of key re-installation through handshake message-1 is handled now. 14 Issues Resolved in MSS (9.2MR4) Copyright 2017, Juniper Networks, Inc.

15 Issues Resolved in MSS (9.2MR2) The updated value precedence from Radius server is not displayed in the client session database. [PR : This issue has been Local VLAN-pool is used instead of tunnelled VLAN when you connect a client to WLA. [PR : This issue has been There are multiple vulnerabilities in WPA1, WPA2/TKIP, AES-CCMP, and WPA2-Enterprise clients and WLAs. [PR : This issue has been The following CVEs are applicable to Juniper WLAs in Mesh topology (Mesh Portal to Mesh WLA) connection: > CVE : reinstallation of the pairwise key in the 4-way handshake > CVE : reinstallation of the group key in the 4-way handshake > CVE : reinstallation of the group key in the group key handshake The following CVEs are NOT applicable to Juniper WLAs: > CVE : reinstallation of the integrity group key in the 4-way handshake > CVE : reinstallation of the integrity group key in the group key handshake > CVE : accepting a retransmitted FT Reassociation Request and reinstalling the pairwise key while processing it Issues Resolved in MSS (9.2MR1) Multiple SNMPD core files generated in WLC100 running MSS version [PR : This issue has been Issues Resolved in MSS (9.1MR8) Cluster instability issues might be observed in MSS x, MSS9.6.4.x, and MSS x releases even after following the troubleshooting plan. [PR : This issue has been Cluster drops TAPA packets due to rate limiting filter when it is upgraded to MSS [PR: This issue has been Issues Resolved in MSS (9.1MR7) Vulnerability issues is observed in WLC. [PR : This issue has been WLC2800, running MSS , crashes and displays two httpd core files. [PR : This issue has been On a WLC800R running MSS , the netsys core file crashes resulting in ERROR gateway_alloc: malloc failed. [PR : This issue has been Issues Resolved in MSS (9.1MR6) Cluster instability issues might be observed in MSS [PR : This issue has been On a WLC2800 running MSS , the netsys core file crashes. [PR : This issue has been On a WLC800R running MSS , snmpwalk traps are not generated for trpzapstatradiostatustable. [PR : This issue has been Copyright 2017, Juniper Networks, Inc. Issues Resolved in MSS (9.2MR2) 15

16 Client IP address is displayed in reverse order through vwlc. [PR : This issue has been The following OpenSSL vulnerabilities are addressed: [PR : This issue has been ASN1_Type_cmp (CVE ) ASN.1 reuse (CVE ) PKCS7 NULL pointer (CVE ) Base64 decode (CVE ) The following OpenSSL vulnerabilities are addressed: [PR : This issue has been Assert DoS in SSLv2 (CVE ) d2i_ecprivatekey (CVE ) X509_to_X509_REQ (CVE ) The output of the show process command displays negative values. [PR : This issue has been Client are unable to connect until WLAs reboot. [PR : This issue has been The pam conn-timeout command sets the maximum time that a WLA can take to establish primary access manager (PAM) and be operational on the WLA. [PR : This issue has been Issues Resolved in MSS (9.1MR5) WLAs do not accept requests for new sessions. [PR : This issue has been WLAs reboot and crash after an upgrade to MSS [PR : This issue has been WLAs generate core files after an upgrade to MSS [PR : This issue has been WLC880Rs crash, reboot, and generate core files. [PR : This issue has been SNMP data cannot be accessed in WLC880R. [PR : This issue has been The following OpenSSL vulnerabilities are addressed: [PR : This issue has been Cross-protocol attack on TLS using SSLv2 (DROWN) (CVE ) Divide-and-conquer session key recovery in SSLv2 (CVE ) Bleichenbacher version of Oracle in SSLv2 (CVE ) After disturbing the communication between WLAs operation on SS by applying ACL on SS, WLAs are not moving to their SAM link. [PR : This issue has been Clients are unable to access the Web portal page because of Web portal outage. [PR : This issue has been Traffic between WLA clients drops during peer blocking mode and local switching mode. [PR : This issue has been When the switch port connected to a member WLC goes down, either the WLAs reboot when the WLC fails over to SAM state or the WLCs failover time to the SAM state is delayed. [PR : This issue has been Issues Resolved in MSS (9.1MR4) In RingMaster 9.1, when you select a WLA522-WW running on a WLC800R, the RF spectrogram is not displayed. [PR : This issue has been SNMPD crashes on WLC002. [PR : This issue has been On a WLC2800 running MSS , WLAs crash on receiving packets with aggregate packet sizes greater than the aggregate size limit. [PR : This issue has been 16 Issues Resolved in MSS (9.1MR5) Copyright 2017, Juniper Networks, Inc.

17 On a WLC2800 running MSS , WLAs crash on receiving aggregate packets with sizes greater than the buffer size. [PR : This issue has been WLC880R clients are not able to connect to the wireless network. The number of sessions are shown as zero on this controller. [PR : This issue has been WLC MX2800 crashes and generates a netsys core file. [PR : This issue has been WLA532 does not support the country code for Ukraine. [PR : This issue has been On a WLC2800, when you upgrade from MSS to MSS , the WLA and the netsys core file crashes. [PR : This issue has been When WLAs reboot, they are stuck in the zombie state. [PR : This issue has been In MSS , client association fails with open authentication. [PR : This issue has been WLA321 is not able to broadcast SSIDs (PR ). To resolve this issue, two new CLI commands, set country-ie mode <enable/disable> and show country-ie mode, are introduced. [PR : This issue has been Upgrading a cluster from MSS 9.1.x.x to 9.6.x.x is not supported. [PR : This issue has been Issues Resolved in MSS (9.1MR3) Juniper WLCs do not send RADIUS server s interim-update date to the firewall filters until 3 minutes after the network comes up. [PR : This issue has been There is incompatibility between Juniper WLAN devices and Ekahau WLC devices. [PR : This issue has been Timestamp is displayed as 0 in RFDetectDoSTraps. [PR : This issue has been WLA322-WW Radio 2 (5 GHz) does not work after you upgrade the controllers from MSS to MSS [PR : This issue has been The client blacklisted alarm in RingMaster is raised when clients try to associate with, re-associate with, or de-associate from the network. [PR : This issue has been Issues Resolved in MSS (9.1MR2) After you upgrade a WLA to MSS , new clients are not able to connect to the WLA unless those clients are rebooted. [PR : This issue has been A WLA522 crashes because of a corrupted entry in the station database and an invalid beacon rate is received from TAPA packets. [PR : This issue has been WLC800R controllers running MSS version do not prioritize QoS traffic for voice over video. [PR : This issue has been WLAs crash when changes are made to the radio profile. [PR : This issue has been WLC800R controllers running MSS crash if you enter the show session command in the CLI. [PR : This issue has been resolved. A WLA532-US running MSS fails to download MSS SR and hangs while booting. [PR : This issue has been WLC2800 controllers running MSS experience Netsys crash. [PR : This issue is Clients are not redirected to the web-portal authentication page. [PR : This issue has been RingMaster displays many FakeBSSID alarms on all channels. [PR : This issue has been Copyright 2017, Juniper Networks, Inc. Issues Resolved in MSS (9.1MR3) 17

18 After you upgrade WLC880R to MSS , SFP ports do not work. [PR : This issue has been Users cannot be authenticated because the RADIUS server is unable to fail over to the secondary RADIUS server. [PR : This issue is A radio profile name becomes case-sensitive only when you clear the service profile from the radio profile. [PR : This issue has been In a cluster that comprises WLCs in a virtual machine networking configuration, there is loss of connectivity between the cluster members if a port on one of the cluster members is disabled. [PR : This issue has been A WLA532-US crashes intermittently generating a signal 6 (SIGABRT) error on a WLC2800 running MSS [PR : This issue has been Netsys core files are generated on a WLC2800 running MSS [PR : This issue has been When you issue the backup system command, MSS generates the error message Failed to create VIF TOC. [PR : This issue has been Netsys core files are generated on a WLC2800 running MSS [PR : This issue has been SmartPass is unable to disconnect sessions with 1-hour duration on MSS [PR : This issue has been WLCs on WLA532 running MSS crash, displaying the error message Process 185 crashed - signal 6 (SIGABRT)! [PR : This issue has been The system uptime value retrieved using the XML interface is a negative value. [PR : This issue has been After upgrading WLA322-WW and WLA-532WW AP to MSS , the error message atheros_transmit_complete: Returning as TX Descriptor status is 15 is displayed. [PR : This issue has been Issues Resolved in MSS (9.1MR1) Port group configurations for spantree portvlanpri and portvlancost are not applied after rebooting the controller. The restoration of spanning-tree configurations for interfaces happens before the initialization of port groups when the system boots. [PR : This issue has been WLC2800 reboots without generating a core file. [PR : This issue has been WLA522 crashes during auto-channel calculations. When the scheme changes the rule to MOVE_RULE_SA, the WLA calculates the parameter avg-cost= (global-cost)/(node-count). Therefore when the node-count is 0, the avg-cost value enters an infinite loop, which causes this issue. [PR : This issue has been RingMaster does not display the secondary controller for some of the WLAs. [PR : This issue has been The DHCP server generates DHCPNAK messages while enabling no-broadcast option with local-switching mode on the WLA on which the SSID is present. [PR : This issue has been The controller sends an update packet before it sends the start packet to the RADIUS server instead of sending accounting interim update upon the accounting interim interval timer expiry. [PR : This issue has been After an upgrade to MSS 9.0.2, WLCs are unable to establish tunnels for VLANs for roaming clients. [PR : This issue has been The H-Table does not show correct power values for WLA532, WLA532E, WLA321, and WLA322. Apart from this, the channels 100 through 124 and 149 through 165 are disabled. [PR : This issue has been 18 Issues Resolved in MSS (9.1MR1) Copyright 2017, Juniper Networks, Inc.

19 The primary controller crashes creating an httpd core file when there is mobility flapping in the secondary seed and its members. [PR : This issue has been WLAs do not connect to the secondary seed promptly while the WLAs that must connect to the primary seed connect themselves to the secondary seed. [PR : This issue has been The error AP_CONFIG_ERR: AP 2023, type(dev_fingerprint_rule) is generated for simulated WLAs while these WLAs are brought up in the network. [PR : This issue has been A configuration core file is generated after the CLI of a WLC is launched. [PR : This issue has been The netsys core crashes in MSS version You can experience an infinite loop in load balancing if the first entry in the group is deleted and subsequent entries are not deleted because the radio is not overloaded at that point. [PR : This issue has been Even after sessions are disconnected, some of the mdns service advertisements are not cleared from the WLC cache. This issue might occur in a scaled setup that has more than 3000 clients and 10,000 cache entries in the WLC. [PR : This issue has been Netsys aborted at gateway_unix.c in WLC 2800 running MSS version while scaling up the mdns services. [PR : This issue has been After an upgrade from MSS to MSS , the maximum transmit power for WLA522E-WW controllers downgrades to 13 from 14. Because of this downgrade, the Ekahau location tracking system shows inaccurate results. [PR : This issue has been The crashinfo file does not have complete information about crash process. In addition, there are and also there were issues with memory debugging. [PR : This issue has been The newer ios devices and MacBook systems running Mavericks (OSX 10.9) do not detect the devices in the test environment AppleTV. [PR : This issue has been WLAs reboot displaying the system log message Atheros 1 Unable to set key in key cache for Vlan Tag. The large number of error messages slows down the logger process and the performance of the WLA. [PR : This issue has been Cluster network goes down in RingMaster and the secondary seed goes out of sync in show mobility-domain. [PR : This issue has been WLC100 controllers running MSS crash generating netsys core files. [PR : This issue has been Netsys core is generated in MSS version because the TCP socket connection is created as soon as SYN packet is received. [PR : This issue has been When local switching is enabled for WLAs, IPv6 clients are unable to transit traffic. [PR : This issue has been Controllers running MSS crash, generating core files. [PR : This issue has been Remote-Office feature with NAT support is not available for MoDo Cluster. [PR : This issue has been WLC100 controllers running MSS crash, generating configuration core files. [PR : This issue has been Netsys core crash is observed in vwlc because of the multiple errors. [PR : This issue has been WLC800R crashes, generating netsys core files even after upgrading from MSS to MSS [PR : This issue has been Clients are unable to connect to some of the WLAs if X authentication is enabled for the clients. [PR : This issue has been Copyright 2017, Juniper Networks, Inc. Issues Resolved in MSS (9.1MR1) 19

20 In MSS version , the WLAs assert because of the double free buffer memory. [PR : This issue has been The mesh WLAs fail to boot after an upgrade to MSS version [PR : This issue has been WLA632 crashes after an upgrade to MSS [PR : This issue has been For roaming clients, the mobility domain flaps because of WLA reboots. [PR : This issue has been WLA322 crashed with Process 161 in MSS version. The issue is observed because of the memory leak in the data packet resulting in memory leak, which eventually exhausts all the memory leading to crash. [PR : This issue has been You are unable to configure the antenna type ANT77555-OUT on WLA532E-WW controllers running MSS 9.1. [PR : This issue has been WLA crashes in MSS version with cluster setup. [PR : This issue has been Clients with the wireless card Qualcomm Atheros with AR9285 disconnect from the wireless network when connected to WLA532-WW through a vwlc. [PR : This issue has been Some of the WLAs reboot and do not enter outage mode even though they are configured to enter outage mode. [PR : This issue has been The output of the command show ap counters always shows the Noise Floor parameter value as 112 instead of the actual value. [PR : This issue has been WLAs reboot even with WAN outage configurations. [PR : This issue has been When connected through WLC2800, the Web page fails to direct to the portal page. [PR : This issue has been WLAs crash because of a watchdog timeout error. [PR : This issue has been MP-82 series WLAs crash, displaying the message CAUSE: ASSERT is displayed. [PR : This issue has been Unless WLAs receive timeout requests, they do not send out SIP packets, they only buffer these packets. As a result, SIP calls are not initiated. [PR : This issue has been User authentication does not occur if vlan-pool is used with the RADIUS attribute Tunnel-Pvt-Group-ID. [PR : This issue has been Multiple WLAs crash in MSS [PR : This issue has been RingMaster is unable to connect to the WLC33 controller, the controller crashes generating an FP core file. [PR : This issue has been WLC35 controllers crash generating FP or netsys core file. [PR : This issue has been Delays of 6 7 seconds and 1 2 seconds are observed in MSS versions 7.7 and 8.0, respectively, for VoIP phones roaming from one location to other. [PR : This issue has been In MSS version 9.0, Apple ios7 clients are unable to associate with hidden SSIDs. [PR : This issue has been Clients with Wireless-AC 7260 adapter disconnect from the wireless network randomly. [PR : This issue has been After an upgrade from MSS 7.7 to MSS 9.0, the RingMaster statistics table displays an incorrect value for the number of clients. [PR : This issue has been After upgrading to MSS , WLC880 controller crash because of which users are not directed to Web portal login page. [PR :This issue has been 20 Issues Resolved in MSS (9.1MR1) Copyright 2017, Juniper Networks, Inc.

21 A large number of retransmit packets are observed on Philips MX40 wireless monitors that are associated with a WLA532. This causes the MX40 reports monitor to fetch reports every 5 minutes to show the number of retries. [PR : This issue has been Some of the VLANs are not shared between network domain members. This causes authorization errors. [PR : This issue has been Netsys core files are generated because of too many intrusion detection system entries for associations, disassociations, or reassociation events. [PR : This issue has been WLC800R controllers running MSS generate a core file generates a netsys core file after the MoDo or a cluster flaps. [PR : This issue has been After an upgrade to MSS , some of the WiFi terminals do not obtain IP address. [PR : This issue has been Users are unable to view autorf as part of user_files and, are, therefore unable to download channel plan files from user_files. [PR : This issue has been Adding more than one default gateway on a controller causes inconsistent packet forwarding. [PR : This issue has been The forwarding database entries on WLC2800 controllers might reach its maximum limit because of delayed aging of dynamically learnt entries in the PFE hardware. This issue is due to an interaction between the broadcom SDK software and the hardware. [PR : This issue has been After an upgrade to MSS , the status of SFP ports and that of the VLANs assigned to those ports on WLC800 are displayed as down. [PR : This issue has been In MSS version , after mobility domains or clusters that flapped because of some network issues become stable, incorrect WLA status is displayed across the mobility domains and adequate WLA load balancing does not occur across members. [PR : This issue has been In a cluster that has four WLC2800 controllers running MSS version , the error message ERROR CLUSTER_BAD_DATATYPE: cc_rec_commit_errors:ccm_rec_parse: Node is not allowed to modify record 55a4242c in class /dapmgr_mx_select_info is displayed. [PR : This issue has been In MSS 9.0, you are unable to change the service-profile transmit rate from RingMaster. Attempting to do this generates the error message 1020: Validation error: error: validation error in AP configuration. [PR : This issue has been WLAs that have the primary access manager connection to the primary seed reboot randomly after the scheduled restart of the primary seed. [PR : This issue has been WLAs that belong to a radio profile in which the countermeasure feature is enabled, prevent the SSID from appearing as an available network for the client, even though the SSID belongs to the same mobility domain. [PR : This issue has been After upgrading to MSS , local switching WLAs do not broadcast multicast traffic. [PR : This issue has been The signal values are always incorrect when a WLA performs a packet capture with a snoop filter attached to the WLA. [PR : This issue has been WLCs classify neighboring WLAs as rogue WLAs even though they are part of the SSID list. [PR : This issue has been In MSS , WLAs reboot because of a corrupted entry in the station database. [PR : This issue has been Copyright 2017, Juniper Networks, Inc. Issues Resolved in MSS (9.1MR1) 21