Ethernet Routing Switch 8600 Software Release Notes

Transcription

1 Ethernet Routing Switch 8600 Software Release Notes SOFTWARE RELEASE NOTES... 1 SOFTWARE RELEASE Release Summary Important Notes before Upgrading to This Release Platforms Supported Notes for Upgrade File Names for This Release Version of Previous Release Compatibility Changes in This Release Outstanding Issues Known Limitations Documentation Corrections... 13

2 Ethernet Routing Switch 8600 Software Release Release Summary Release Date: 6 November 2009 Purpose: Software maintenance release to address software issues found both in the field and internal to Nortel. 2. Important Notes before Upgrading to This Release If upgrading to code within any SMLT designed network from a release prior to or , i.e. a release which runs the older SMLT architecture, then care should be taken to follow the proper upgrade steps. Please review the Readme or Release Notes for specific details. REGARDLESS OF SOFTWARE VERSION, the system-monitor flag should be checked on all systems to be sure it is enabled. This flag should always be enabled. The flag setting can be checked via the command, show config. The display should be something like: ERS8600:6# show config Preparing to Display Configuration... #!flags m-mode false #!flags enhanced-operational-mode false #!flags vlan-optimization-mode false #!flags global-filter-ordering false #!flags r-mode true #!resource-reservation max-vlan false #!resource-reservation multicast 2048 #!flags multicast-check-packet true #!flags system-monitor true (enabled) #!flags regular-autoneg false #!record-reservation filter 4096 or potential false (disabled) If the system-monitor flag is set false, then it should be changed to true (requires a reboot to take affect), which can only be accomplished by JDM, Edit Chassis -> System Flags and then look under System Monitoring at the bottom of the screen. Checked equals enabled. To set via SNMP use: MIB is rapidcity.rcmgmt.rcchassis.rcchassystemmonitorenable snmpset -v 1 -c public <ip address> enterprises To view the setting via SNMP use:

3 snmpget -v 1 -c public <ip address> enterprises Output is either: FALSE - SNMPv2-SMI::enterprises = INTEGER: 2 (disabled) TRUE - SNMPv2-SMI::enterprises = INTEGER: 1 (enabled) 3. Platforms Supported All Ethernet Routing Switch 8600 modules are supported in the 8006, 8010, and 8010co Chassis. Full slot support for all modules may be dependant on the presence of the High Performance Backplane. An upgrade option for the High Performance Backplane is available. The following modules are not supported in the 8003 chassis: 8692SF/CPU All R/RS modules Please refer to the following documents for details on the Platforms Supported: Release Notes for the Ethernet Routing Switch 8600 Series Switch Software Release (Doc # NN , Rev 3.01) Nortel Ethernet Routing Switch Upgrade Manual (Doc # NN , Rev 3.01) Nortel Ethernet Routing Switch 8600 Installation - Modules Manual for Software Release 5.0 (Doc # NN , Rev 3.02) Nortel Ethernet Routing Switch 8600 Administration Manual for Software Release 5.0 (Doc # NN , Rev 2.03) Nortel Ethernet Routing Switch 8600 Routine Maintenance Manual for Software Release 5.0 (Doc # NN , Rev 2.01) Note: R/RS-series modules are supported in the 8010co chassis only with a High Performance Backplane installed. 4. Notes for Upgrade Please see Upgrade Guide and Release Notes for the Ethernet Routing Switch 8600 Series Switch Software Release available at 5. File Names for This Release Module or file Type Description File name Size in Software tar file Tar file of all software Ethernet Routing Switch images Deliverables (includes images that also contain encryption software) bytes pr86_5050.tar.gz Boot monitor image CPU and switch fabric firmware p80b5050.img

4 Run-time image Run-time image p80a5050.img Run-time image for R modules Image for R modules p80j5050.dld Run-time image for RS modules Run-time image for RS modules p80k5050.dld Run-time image for Enterprise Enhanced SF/CPU Daughter Card (SuperMezz) 3DES AES Image for the SuperMezz card p80m5050.img Encryption module for privacy protocol with Secure Shell (SSH) Encryption module for privacy protocol for SNMPv3. Includes AES and 3DES p80c5050.img p80c5050.aes (this image includes the 3DES image) MIB MIB files p80a5050.mib MIB (zip file) Zip file containing MIBs p80a5050.mib.zip MD5 checksum file md5 checksums of all Release 5.1 software p80a5050.md files Runtime image for ATM Runtime image for the ATM module p80t5050.dld Runtime image for POS Runtime image for the POS module p80p5050.dld Firmware images FOQ for R modules Feedback output queuing FPGA firmware foq267.xsvf BMC for R modules BAP memory controller FPGA firmware bmc776.xsvf DPC for R modules Dual port Controller FPGA firmware dpc184.xsvf PIM8630GBR Firmware for RS modules PIM images for RS modules SSL images Programmable I/O module FPGA firmware; for the 8630GBR only Contains FOQ, BMC, DPC, mirroring, and loopback images PIM FPGA firmware required for 8612XLRS module only PIM FPGA firmware required for 8634XGRS module only PIM FPGA firmware required for 8648GBRS module only PIM FPGA firmware required for 8648GTRS module only PI_769.xsvf rs_dpm_fpga.bin pim8612xlrs.bi n pim8634xgrs.bi n pim8648gbrs.bi n pim8648gtrs.bi n SSL cluster upgrade SSL boot monitor Ethernet Routing Switch 8600 clustered SSL modules self-installing runtime image/upgrade Ethernet Routing Switch 8600 SSL module boot monitor p80s5050.pkg p80s5050.img

5 SSL upgrade instructions SSL installation instructions SSL diagnostics Ethernet Routing Switch 8600 SSL upgrade instructions Ethernet Routing Switch 8600 SSL installation instructions Ethernet Routing Switch 8600 SSL diagnostics p80s5050.upgrad e 1481 p80s5050.install 2895 p80s5050.diag WSM images for Ethernet Routing Switch 8600 WebOS firmware image WSM WebOS v firmware image wsm _mp.img WebOS binary WSM WebOS v binary image wsm _bin.img WebOS boot image WSM WebOS v boot image wsm _bo ot.img Device Manager images Solaris for SPARC image Device Manager software image jdm_6162_solaris _sparc.sh MB Microsoft Windows image Device Manager software image jdm_6162.exe 190MB Linux image Device Manager software image jdm_6162_linux.s h 196MB Service Delivery Module images Service Delivery Module Firewall Boot ISO for the NSF Service Delivery Module Firewall booting from CD-ROM Upgrade package for the NSF Service Delivery Module Firewall NSF5100_ _SDM_R60.iso NSF5100_ _SDM_R65.iso NSF5100_ _SDM_R60.pkg.gz NSF5100_ _SDM_R65.pkg.gz Service Delivery Module TPS Trace files MPLS trace file Boot image for TPS Intrusion Sensor Boot ISO for TPS Defense Center booting from CD-ROM Upgrade script (patch) to upgrade TPS IS from to IS upgrade download verification file. Trace file for MPLS. This is auto generated and appears on the PCMCIA after upgrade. Nortel_TPS_Intrusion_Sensor-SDMv Install.iso NortelTPSDefenseCenter_2x70v4.5. 0_627_Install.iso Nortel_TPS_IS_Upgrade_4.5.0_to_4. 5.1_Upgrade-47.sh Nortel_TPS_IS_Upgrade_4.5.0_to_4. 5.1_Upgrade-47.sh.md5 nbpdtrc.lo0 variable 6. Version of Previous Release Software Version

6 7. Compatibility This software release is managed with Java Device Manager (JDM) release or higher. This software release supports the Web Switching Module (WSM) release WebOS This code is found on Nortel web site under Content Networking -> Web Switches -> Ethernet Routing Switch Web Switch Module. This software release supports SDM FW Release up to This code is found on Nortel web site under Security & VPN -> Service Delivery Module 8660, which provides a link to CheckPoint web site. This software release supports SDM TPS Release up to This code is found on Nortel web site under Security & VPN -> Service Delivery Module To download any of these code releases requires valid Nortel support web access, as well as valid CheckPoint support site access for most FW code. 8. Changes in This Release New Features in This Release With this release, ERS 8600 introduces new commands to better handle the reception bad OSPF LSAs. The Switch will have an option to configure the way the router behaves on receiving a bad LSA. There are now different options on how to handle a received BAD LSA (with hole in mask). This can affect how adjacency is form to other routers in the network. (Q and Q ) The following commands have been implemented for this new functionality: config ip ospf bad-lsa-ignore <enable disable> To enable the Switch to keep accepting the bad LSAs (with hole in mask) use the following CLI command (default behavior is disable): config ip ospf bad-lsa-ignore enable Alternatively use the following NNCLI command: bad-lsa-ignore enable Other associated NNCLI commands would be: no bad-lsa-ignore [enable] default bad-lsa-ignore [enable] Setting the ospf bad-lsa-ignore parameter to enabled maybe required to maintain adjacency with other non-nortel switch/routers, especially Cisco models. The same commands under VRF configuration mode are for CLI: config ip vrf <vrf-id> ospf bad-lsa-ignore <enable disable>

7 and for NNCLI: as well as: ip ospf bad-lsa-ignore enable no ip ospf bad-lsa-ignore enable default ip ospf bad-lsa-ignore [enable] To execute these commands OSPF needs to be disabled globally first. There is no JDM support for these commands at this time, nor is any future support planned (CR Q ). With this release the ERS 8600 provides a command that will help to achieve proper auto-negotiation with other non-nortel devices (specifically Aironet 1250) from any classic (E/M) modules. If the command is enabled the module s ports will keep trying to renegotiate with the other end box even if autonegotiation is in an in-between terminated state until autonegotiation is achieved. (Q ) The following commands have been implemented for this new functionality: config sys set flags regular-autoneg <enable disable> By default it is disable. Currently there is no MIB or JDM support for this command. Also the corresponding NNCLI command has not been implemented. Future support in either of these areas is not planned. Old Features Removed From This Release None. Problems Resolved in This Release Switch management ERS 8600 will now load the complete configuration in NNCLI mode properly. Previously. when switch was loaded in NNCLI mode, after loading the configuration of 48 th port of 10 th slot card, there would be a double exit and any further configuration would fail to loaded properly; this is now resolved. (Q ) When multiple IGMP access control lists are configured on a brouter port, the configuration is no longer lost upon switch reset. (Q ) ERS 8600 will now be able to retrieve a VLAN s Layer 2 (MAC) Forwarding Database (FDB) ( ) using a MIB walk or SNMP get/get-next. This functionality previously was broken in all 5.0.x code releases. (Q )

8 Platform ERS 8600 no longer experiences unexpected Mezz CPU failover with the Mezz card enabled and then saving the configuration via JDM. (Q ) The potential for traffic interruption associated with the Gig ports on the 8634XLRS module has now been resolved. (Q ) ERS 8600 will no longer show any system instability associated with 8630GBR module. (Q ) If the verify-config flag is set to true, ERS 8600 no longer defaults the configuration on boot if an R module fails to initialize or is not present, even though there exists configuration information for that slot. (Q ) Switch will no longer experience potential communication loss between Base CPU and Mezz CPU. This will also now stop potential access issues to either the PCMCIA or Flash memory. (Q ) Displaying ACL/ACE statistics via CLI or JDM for an advanced filter that is applied on a VLAN with ports on different physical modules can sometimes result in high CPU utilization, and slow network management responsiveness. (Q ) ERS 8600 will no longer reset when a WSM card is pulled out from a switch operating in enhanced-operational-mode and an MLT is configured as part of the WSM ports. (Q ) ERS 8600 will now be able to properly detect all versions of the AA E6 SFP (1000Base-LX) even after any switch reboot. (Q ) Netapps server will now be able to negotiate the flow control with ERS 8600 properly as pause capable bit in the PHY initialization code has now been improved. (Q ) Switch will no longer show potential system instability in a square SMLT/IST design with R/RS modules in use. (Q ) Any known issues with LANE or port lock-ups in association with any RS modules are now resolved. (Q ) ACE filters that match on an IP protocol and have subsequent ACE filters that match on source or destination IP will now function properly after the switch is rebooted. (Q ) Previously certain IST message handling could be delayed by other system functions, thereby potentially causing IST instability (up/down/up). As well, system instability associated with SMLT (IST Peers) in association with high CPU utilization and potentially SLPP operations have both now been resolved. Customers that had previously disabled SLPP on their systems/network, can now be re-enable SLPP with the release. (Q /Q /Q /Q ) ERS 8600 console will now no longer spool repeated messages of AA E6 (LX) SFP insertion after a switch reboot. (Q )

9 ERS 8600 will no longer face a tmaintaskloop leading to instability while processing IST type-9 messages. (Q ) ERS 8600 will no longer flood the unicast traffic destined to Static Route, coming on IST link, as FDB entry associated with IST MGID will no longer age out improperly. (Q ) MSTP/RSTP ERS 8600 will now remain stable when operating under RSTP enabled mode, such that a change to the root bridge without any link up/down will no longer occur. (Q ) IP Unicast Static Route UDP BGP OSPF ERS 8600 will now successfully allow the Static default route creation on RSMLT enabled interfaces for the default VRF (VRF 0). (Q ) Previously, if UDP forwarding was configured on IST switches, the destination subnet will receive two copies of the original packet, as both IST switches will receive and forward the packet. If the forwarding address is a subnet broadcast and that VLAN is configured on both of the IST switches, instability may be observed on the IST link. Nortel previously recommends to only configure UDP forwarding for any VLAN on only one of the two IST Peer switches; this configuration restriction is no longer required. (Q ) Operational problems with BGP software that could have led to potential system instability issues have been resolved. (Q ) BGP input policies are now properly applied when a soft-restart is performed. (Q ) ERS 8600 will now establish OSPF virtual neighbor state properly. Now when the switch receives a self originated LSA for the backbone area with no active interface present for this area and there is not any virtual link adjacency in FULL state, then these LSA s will be purged. (Q ) When the forwarding address is set to a non-zero value for an AS external LSA, ERS 8600 will now use this address as the next-hop. (Q )

10 ERS 8600 will now be able to establish the OSPF Virtual link adjacency to Full state, even when not in same subnet. (Q ) MLT / SMLT In RSMLT edge support enabled mode, the creation of a new RSMLT enabled VLAN interface only on one aggregation box will no longer cause the static default route to get deleted from the hardware, and thereby affect RSMLT forwarding and re-convergence time. (Q ) When adding VLANs to a MLT/SMLT with POS ports in it, the STP state will no longer be toggle, which in the past would cause the SMLT state to also then go down. (Q ) ERS 8600 will no longer potentially flood unicast traffic received over the IST ports. (Q ) In HA CP mode, SMLT status will now synchronize properly to the slave when IST goes down or comes up. (Q ) ERS 8600 will now check the "more fragment" bit in the IP header. If it's set, and only for this specific condition, the switch will now use the L3 hashing algorithm for MLT instead of current L4 MLT hashing algorithm. (Q ) The ERS 8600 will now check for the SMLT status of an MLT only if it is configured as an SMLT, while sending a MAC-address-learn message for any MAC learnt on the MLT. If the MLT is not configured for SMLT, then SMLT status will not be checked and an MAC-address-learn message will be sent to the IST peer. (Q ) With IPFix configured on all ports, ERS 8600 will no longer delay the processing of IST Type-9 packets. (Q ) ERS 8600 will no longer display the MAC entries in FDB table as zeroes (Q ) In an SMLT deployment, the ERS 8600 will age out the FDB entries naturally. It will no longer take 2-3 cycles to age-out from the box. (Q ) ERS 8600 will no longer replace Vlan router MAC by OSPF mcast MAC when the IST state is bounced. It will check to install only unicast MAC address as VLAN router MAC. (Q ) ERS 8600 will no longer delete the MAC from IST MGID if the activity bit is set. This will now stop unnecessary flooding of some traffic. (Q )

11 Multicast Routing Protocol PIM ERS 8600 will now properly forward packets to the DR when the egress port to the DR is the same as the incoming port and the destination port to the DR changes for some reason. (Q ) ERS 8600 will now properly forward multicast traffic from IST to SMLT links, when the SMLT links are running in normal mode due peer SMLT state being down. (Q ) For SMLT triangle configurations in which the edge box is running IPMC (PIM- SM), the IST peer switch with the lower IP address will no longer stop forwarding traffic downstream upon receiving traffic from the upstream edge router. (Q ) 10. Outstanding Issues Please also refer to the Outstanding Issues Section of the Release Notes for Ethernet Routing Switch 8600 Software Release Platform ERS 8600 slave CPU may show instability when a significant amount of broadcast traffic is sent to the management port and switch is running in HA mode. (Q ) ERS 8600 may show instability while sourcing the config on a box with PCMCIA. (Q ) ERS 8600 may lose access to PCMCIA card when it gets 100% full. It may also display messages being scrolled to the CP console. (Q ) ERS 8600 may show some instability when run "show ipfix flows slot#". (Q ) Current SLPP polling mechanism on ERS is not polling for correct mac address when it checks for activity. (Q ) On HA CPU failover on ERS 8600, the new master taking over may dump Error messages to the console. (Q ) Customers may see the following log message with any 5.x code release: switch-name:5# CPU5 [11/03/09 11:18:12] COP-SW WARNING Slot 2: Packet Memory Refresh Lane 1 Code 2 (slot, lane and code value can have other values)

12 This log message should have been classified as an INFO (Informational) log message in stead of a Warning. This will be corrected in a future code release. The message indicates that some memory refresh optimization was performed on the particular slot and forwarding lane noted; therefore this applies to only R or RS modules. If this optimization is seen occurring on a regular basis, the administrator should pro-actively contact Nortel support. Otherwise, this message can be ignored as it notes normal activity for the module, but activity we wish to now track. (Q ) Switch Management MIB walk might not go through completely when run on FDB Table and Route tables. It may show some error or might stop at specific places. (Q ) With a large number of tcp flows with ipfix enabled, ERS 8600 may show large number of error messages when a show ipfix flow slot# command is issued (Q ) NNCLI Mcast MAC filtering CLI configs may not get converted to NNCLI. Also The MLT option is not there in the commmand "con ip arp static-mcast " in NNCLI mode. (Q ) OSPF ERS 8600 may install RIP Routes on disabling OSPF redistribution of VRF route. Switch may also redistribute routes to OSPF domain even if OSPF is not enabled. JDM The error message thrown through JDM, while adding invalid BGP aggregate address and mask, needs to be modified. (Q ) JDM support needs to be provided for Bad-LSA-Ignore option. (Q ) 11. Known Limitations For Microsoft or other NLB (Network Load Balancing) [server] configurations, the ERS 8600 only supports one NLB server cluster per VLAN under either Multicast mode or IGMP-Multicast mode; Unicast mode is supported. To support multiple server clusters using either Multicast or IGMP-Multicast modes, the server clusters must reside in different VLANs or subnets. (Q )

13 12. Documentation Corrections Dual MLTs in SMLT designs are supported, as long as only one is configured as an IST_MLT (system will not allow mis-configuration), and as long as any use of any form of spanning tree along with the VLANs/ports associated with this form of spanning tree, remain solely on the non-ist_mlt; there can be no association or interaction of any form of STP with the IST_MLT. (Q ) The command config sys set snmp-ip no longer will accept an IP address of value , which would be illegal to start with. (Q ) The dpmgetactivitybit() and dpmcheckvlanactivitybit() log and console warning messages have been converted into TRACE messages. (Q ) Copyright 2009 Nortel Networks Limited - All Rights Reserved. Nortel, Nortel Networks, the Nortel logo, Globe mark, and Ethernet Routing Switch 8100/8300/8600 are trademarks of Nortel Networks Limited. The information in this document is subject to change without notice. The statements, configurations, technical data, and recommendations in this document are believed to be accurate and reliable, but are presented without express or implied warranty. Users must take full responsibility for their applications of any products specified in this document. The information in this document is proprietary to Nortel. To access more technical documentation, search our knowledge base, or open a service request online, please visit Nortel Technical Support on the web at: