Release Notes for the Passport 8000 Series Switch Software Release 3.5

Transcription

1 Part No A Rev 00 May Great America Parkway Santa Clara, CA Release Notes for the Passport 8000 Series Switch Software Release 3.5

2 2 Copyright 2003 Nortel Networks All rights reserved. May The information in this document is subject to change without notice. The statements, configurations, technical data, and recommendations in this document are believed to be accurate and reliable, but are presented without express or implied warranty. Users must take full responsibility for their applications of any products specified in this document. The information in this document is proprietary to Nortel Networks Inc. The software described in this document is furnished under a license agreement and may be used only in accordance with the terms of that license. Trademarks Nortel Networks, the Nortel Networks logo, the Globemark, Unified Networks, Passport, and Alteon are trademarks of Nortel Networks. Microsoft, Windows, and Windows NT are trademarks of Microsoft Corporation. Adobe and Acrobat Reader are trademarks of Adobe Systems Incorporated. SSH is a registered trademark and SSH Secure Shell is a registered trademark of SSH Communications Security Corp ( The use of these trademarks is permitted to describe a product that conforms to the SSH standard and protocol. The asterisk after a name denotes a trademarked item A Rev 00

3 Contents 3 Contents Introduction New hardware introduced in this release CPU memory upgrade Adding MAC addresses Hardware enhancements in this release SMLT network design tips New software features and software enhancements introduced in this release IP multicast features Layer 2 features Layer 3 feature enhancements Security enhancements Serviceability Platform management: hardware record utilization ATM enhancements Supported software and hardware capabilities Supported software capabilities Non-supported software capabilities Non-supported hardware capabilities Limitations between WSM & Alteon 180 Series Stackable Switches Device Manager Installation Documentation corrections and additions General Upgrading to Passport 8000 Switch Series Software Release 3.5 ( A) Getting Started (part number C) Configuring and Managing Security (part number B) Managing Platform Operations and Using Diagnostic Tools (part number B) Configuring BGP Operations ( B) Configuring IP Multicast Protocols (part number B) Configuring Layer 2 Operations: VLANs, Spanning Tree, Multilink Trunking (part number B) Release Notes for the Passport 8000 Series Switch Software Release 3.5

4 4 Contents Configuring IP Routing Operations ( B) Configuring QoS and IP Filtering (part number A) Using the Packet Capture Tool (part number B) Configuring IPX Routing Operations ( A) Installing 8600 Switch Modules ( F) Using the Passport 8672 ATM/ATME/ATMM module ( D) Configuring IGMP for User Authentication Protocol (IGAP) (part number A) Configuring Network Operations ( B) Using the Packet Capture Tool (PCAP) ( B) Using the 10 Gigabit Ethernet Modules: 8681XLR and 8681XLWe CRs fixed or bug fixes ported from previous releases Bugs fixed in this release Platform Switch management Hardware Filters and bandwidth control Layer 2 switching IP unicast IP multicast IPX routing Known limitations and considerations in this release Platform Switch management Hardware Layer 2 switching Filters and bandwidth control IP unicast IP multicast IPX routing A Rev 00

5 Contents 5 Reading path Important information and release notes Upgrading your switch Chassis and module installation Solution overview Module configuration Engineering notes Related publications Hard-copy technical manuals How to get help Release Notes for the Passport 8000 Series Switch Software Release 3.5

6 6 Contents A Rev 00

7 7 Introduction These release notes for the Nortel Networks* 8000 Series Switch Software Release 3.5 describe the new hardware and software enhancements introduced in this release and known issues that exist in this software release. In addition, these notes describe bugs fixed since Passport 8000 Series Switch Software Release, 3.3 and 3.3.1, and provide a list of bugs fixed ported from software releases 3.2.x.x and 3.3.x.x (see CRs fixed or bug fixes ported from previous releases on page 54). For information on how to upgrade your switch to Passport 8000 Series Switch Software Release 3.5 or WebOS version , see Upgrading to the 8000 Series Switch Software Release 3.5 (part number A). For information on how to upgrade your version of Device Manager, see Installing and Using Device Manager (part number A). A list of related publications can be found on page 105. The 8000 Switch Series Software Release 3.5 documentation suite can be found on the documentation CD included with your software or on the Nortel Networks technical documentation Web site, In future major software releases, Passport 8000 Switch Series documentation will be delivered through the Nortel Networks Helmsman global documentation delivery process. While you will still be able to access your documentation on the Nortel Networks external documentation Web site, documentation, you will also be able to access it through the Helmsman web interface and by using a Helmsman documentation CD. We will provide instructions on how to use Helmsman and the Helmsman documentation CD when we make this transition. The software in release 3.5 supports all current Passport 8100 and 8600 modules, although certain features are available only for the 8600 modules. Release Notes for the Passport 8000 Series Switch Software Release 3.5

8 8 Introduction In addition, this software release supports the Web Switching Module (WSM) running version WebOS software code and the 8661 SAM running version software code on the 8000 Series Switch. This document contains information about the following topics: Topic Page New hardware introduced in this release 9 Hardware enhancements in this release 10 SMLT network design tips 10 New software features and software enhancements introduced in this 11 release Supported software and hardware capabilities 22 Device Manager Installation 26 Documentation corrections and additions 27 CRs fixed or bug fixes ported from previous releases 54 Bugs fixed in this release 60 Known limitations and considerations in this release 68 Reading path 105 Hard-copy technical manuals 108 How to get help 109 The information in these release notes supersedes applicable information in other documentation A Rev 00

9 New hardware introduced in this release New hardware introduced in this release 9 Table 1 describes the new hardware introduced in this release. Table 1 New hardware in this release New hardware Module part number Where to find information Document part number 1000BASE-T GBIC 1 256MB CPU Memory Upgrade Kit for the Passport both 8690 Switch Fabric (SF) and 8190SM. DS DS Installing Gigabit Interface Converters A (GBICs) Installing the 8000 Series Chassis B Installing 8600 Switch Modules F For a brief description of this feature, see CPU memory upgrade on page 9. For more information, see Installing a CPU Memory Upgrade A MAC Upgrade kit. DS For a brief description of this feature, see Adding MAC addresses on page 10. For more information, see Adding MAC Addresses to the 8600 Series Chassis A 1 Supported on the Passport 8608GB, 8608GBE or 8608GBM and 8632TXE modules. CPU memory upgrade Passport 8000 Software Release 3.5 introduces an advanced set of features, enhancements and capabilities to address new applications that will require the 256MB CPU Memory Upgrade Kit for the Passport 8690 Switch Fabric (SF) and 8190SM (Part # DS ). For a brief description of the CPU Memory Upgrade Kit, see CPU memory upgrade on page 9. For the Passport 8691SF, upgrading the memory to 256MB is not required with Passport 8000 Switch Series Software Release 3.5, but may be implemented now to prepare for future release requirements. For more information on upgrading CPU memory, refer to Installing a CPU Memory Upgrade (part number A). Release Notes for the Passport 8000 Series Switch Software Release 3.5

10 10 Hardware enhancements in this release Adding MAC addresses In this release, you can purchase a MAC address upgrade kit that allows you to increase the media access control (MAC) addresses on your Passport 8600 Series Chassis to a total of 4096 MAC addresses. This upgrade is required when more than 512 IP interfaces need to be configured on the switch. For more information about this kit, see Adding MAC Addresses to the 8600 Series Switch (part number A). Hardware enhancements in this release The 8624FXE module has been verified to support 50/125um multimode fiber (MMF) cable for a distance of 2000m. In previous releases the 8624FXE module supported a maximum distance of 1300m with 50/125um MMF cable. SMLT network design tips Use the following base guidelines when designing a SMLT network (for more information, refer to the Network Design Guidelines for Passport 8000 Series Software Release Define a separate VLAN for the IST protocol: #config/mlt/1/ist/create ip <value> vlan-id <value> 2 Disable CP-limit on the IST ports (leave CP-limit enabled on the SMLT ports): # config/ethernet <slot/port> cp-limit disable 3 Enable loopdetect on SMLT ports: #config/ethernet <slot/port> loop-detect enable A Rev 00

11 New software features and software enhancements introduced in this release 11 New software features and software enhancements introduced in this release This section provides a brief description of the new software features and enhancements in Passport 8000 Switch Series Software Release 3.5, and also provides the document title and part number where the feature or enhancement is documented. IP multicast features This section describes the new multicast features and enhancements in Passport 8000 Switch Series Software Release 3.5. Internet membership Group Authentication Protocol (IGAP) The name of this feature has been changed to Internet membership Group Authentication Protocol instead of IGMP for User Authentication Protocol (IGAP). This will be changed in the documentation in a future release. Internet membership Group Authentication Protocol (IGAP) is an authentication and accounting protocol for clients receiving multicast streams. With IGMP and existing multicast protocols, users can join an IP multicast group and receive all the multicast traffic that any other member in the group had access to. With IGAPs authentication and accounting features, service providers and enterprises have more control over their networks and can better manage the multicast groups on their networks. IGAP uses a standard authentication server like RADIUS with extensions for IGAP. You can find more information on this feature in Configuring IGMP for User Authentication Protocol (IGAP) (part number A). Release Notes for the Passport 8000 Series Switch Software Release 3.5

12 12 New software features and software enhancements introduced in this release PIM-SSM (source-specific multicast) Source Specific Multicast (SSM) optimizes PIM-SM by simplifying the many-to-many model. Since most multicast applications distribute content to a group in one direction, SSM uses a one-to-many model that only uses a subset of the PIM-SM features. This model is more efficient and puts less of a load on multicast routing devices especially when used with high bandwidth applications like video and TV-based applications. You can find more information on this feature in Configuring IP Multicast Protocols (part number B). Multicast Access Control enhancements These enhancements allow you to restrict users from sending or receiving to or from specific multicast groups. The enhanced functionality provides a full set of capabilities that allow the you to use the following: deny receive, Deny transmit, deny both or allow only transmit, allow only receive or allow only both. The configuration is enhanced to include range of IP multicast group addresses and source addresses. This functionality is multicast specific control functionality to allow for a secure and controlled multicast network. You can find more information on this feature in Configuring IP Multicast Protocols (part number B). Static mroute for PIM-SM or PIM-SSM enhancement In Passport 8000 Switch Software Release 3.3, static source groups (or static mroutes) enabled you to configure static source-group entries in the DVMRP multicast routing table. In Passport 8000 Switch Software Release 3.5, static source groups (or static mroutes) enable you to configure static source-group entries in the DVMRP, PIM-SM or PIM-SSM multicast routing table. DVMRP and PIM cannot prune these entries from the distribution tree. In other words, even if there are no receivers for the group, the multicast stream for a static source-group entry stays active. Static forwarding entries are never pruned. Static source groups ensure that the multicast route (mroute) records remain in the distribution tree. When receivers join the group, there is no delay in receiving multicast data because there is no need to graft onto the group or start a join process in the case of PIM. This is essential for applications where the multicast A Rev 00

13 New software features and software enhancements introduced in this release 13 data must be sent to a receiver as soon as the receiver joins the group. For example, consider a case where a switch delivers TV channels to receivers. When the receiver turns the channel, which is equivalent to joining a group, the receiver should be able to view the channel immediately. Static entries result in continuous traffic if the source is active, even when no receivers are present. However, traffic does not get forwarded by an 8000 Series switch with static entry if there are no receivers, but it gets forwarded continuously to the switch where the entry is programmed and crosses intermediate switches on the path. You can find more information on this feature in Configuring IP Multicast Protocols (part number B). Multicast Stream Limitation The multicast stream limitation feature allows you to limit the number of multicast groups that can join a VLAN. By limiting the number of concurrent multicast streams, a service provider can, for example, protect the bandwidth on a specific interface and control access to multicast streams. You can find more information on this feature in Configuring IP Multicast Protocols (part number B). PIM Passive Interface You can specify whether you want a PIM interface to be active or passive. An active interface allows PIM control traffic to be transmitted and received. A passive interface drops all PIM control traffic, thereby reducing the load on the system. This feature is useful when you have a high number of PIM interfaces and these interfaces are connected to end-users, not to other switches. You can find more information on this feature in Configuring IP Multicast Protocols (part number B). Release Notes for the Passport 8000 Series Switch Software Release 3.5

14 14 New software features and software enhancements introduced in this release IGMP Fast Leave enhancements The 8000 Series switches support a fast leave feature that is useful for multicast-based TV distribution applications. Fast leave relies on an alternative leave process in which the switch stops sending traffic for the group immediately after receiving a leave message, without issuing a query to check if other group members are present on the network. Fast leave alleviates the network from additional bandwidth demand when changing TV channels. The enhancements introduced in software release 3.5 allow the support of multiple receivers on the same interface by actively monitoring the number of receivers present and listening to a given group. You can find more information on this feature in Configuring IP Multicast Protocols (part number B). IGMPv3 support for PIM-SSM IGMPv3 is supported in release 3.5 for PIM-SSM. It is required for those who need IGMPv3 support in an SSM environment. Also, it is possible to use IGMPv3 and PIM-SSM along with the static SSM channels feature that is introduced in this release. You can find more information on this feature in Configuring IP Multicast Protocols (part number B). IGMPv2 support for PIM-SSM: Static SSM Channels Extensions to SSM has been introduced in this release to allow the benefit from PIM-SSM in an existing IGMPv2 environment without the need to change any configuration on the clients running IGMPv2. These extensions are the static SSM channels that map a joined group to its source. You can find more information on this feature in Configuring IP Multicast Protocols (part number B) A Rev 00

15 New software features and software enhancements introduced in this release 15 Multicast Flow Distribution over MLT MultiLink Trunking (MLT) provides a mechanism for distributing multicast streams over an MLT. It does so based on source address and group addresses and in the process provides you with the ability to choose the address and the bytes in the address for the distribution algorithm. As a result, you can now distribute the load on different ports of the MLT and aim (whenever possible) to achieve an even distribution of the streams. In applications like TV distribution, multicast traffic distribution is particularly important since the bandwidth requirements can be substantial when a large number of TV streams are employed. You can find more information on this feature in Configuring IP Multicast Protocols (part number B). Layer 2 features This section describes the new Layer 2 features and enhancements in Passport 8000 Switch Series Software Release 3.5. PPPoE protocol-based VLANs The Passport 8600 switch allows you to configure PPPoE VLANs using protocol-based VLANs. The protocol types used by the Passport 8600 switch to classify PPPoE packets in a PPPoE VLAN are 0x8863 (discovery stage), 0x8864 (PPP session stage). You can find more information on this feature in Configuring Layer 2 Operations: VLANs, Spanning Tree, and Multilink Trunking (part number B). Single-port SMLT enhancement Single port SMLT lets you configure a split multilink trunk using a single port. The single port SMLT behaves just like an MLT-based SMLT and can coexist with SMLTs in the same system. Single port SMLT lets you scale the number of split multilink trunks on a switch to a maximum number of available ports. Release Notes for the Passport 8000 Series Switch Software Release 3.5

16 16 New software features and software enhancements introduced in this release The SMLT scaling enhancement allows configuring any switching port to become a SMLT member thus allowing you to scale up to more than 360 SMLT ports. This enhancement allows for large server farm connectivity leveraging dual homing into a pair of server farm SMLT aggregation switches as well as wiring closet applications with single port SMLT links on each SMLT aggregation switch side. You can find more information on this feature in Configuring Layer 2 Operations: VLANs, Spanning Tree, and Multilink Trunking (part number B). Stacked VLANs A SVLAN transparently tunnels packets through a SVLAN domain by adding an additional 4-byte header to each packet. SVLANs allows for transparent bridging of tagged and untagged traffic through a SVLAN tagged core. SVLANs provide the following features: VLAN transparency for IEEE 802.1Q tagged or untagged traffic through service provider core networks A solution to VLAN scalability issues by allowing you to summarize customer VLANs into core SVLANs Use layered architecture to improve scalability You can find more information on this feature in Configuring Layer 2 Operations: VLANs, Spanning Tree, and Multilink Trunking (part number B). Single Fiber Fault Detection (SFFD) Single Fiber Fault Detection (SFFD) provides an alternative method for RFI. SFFD must only be used when one or both devices in a Gigabit Ethernet fiber connection do not support Auto-Negotiation A Rev 00

17 New software features and software enhancements introduced in this release 17 A connection to a Passport 8600 to a BayStack or BPS2000 2GE MDA requires enabling this feature for proper remote fault indication. Both connected devices (Passport 8600 to BayStack/BPS2000 that support the SFFD feature) should be configured with SFFD in order for this protocol to work properly. Note: You do not need to use SFFD between Passport 8600 switches. For more information about Single Fiber Fault Detection see the publication, Network Design Guidelines (part number C). For more information regarding SFFD and your BayStack/BPS 2000 product, refer to refer to Release Notes for BoSS, Software Version 3.0 (part number A). Layer 3 feature enhancements 1980 Routed VLAN support Release 3.5 allows you to configure up to 1980 routed VLANS. You will need the MAC upgrade in order to perform this configuration. For more information of the MAC upgrade, see Adding MAC addresses on page 10. You can find more information on this feature in Configuring Layer 2 Operations: VLANs, Spanning Tree, and Multilink Trunking (part number B). Security enhancements This section describes the security enhancements in Passport 8000 Switch Series Software Release 3.5. RADIUS accounting for SNMP This feature provides accounting for SNMP communication with the Passport 8600 based on a context based on the combination of an IP address/community string. You can find more information on this enhancement in Configuring and Managing Security (part number B). Release Notes for the Passport 8000 Series Switch Software Release 3.5

18 18 New software features and software enhancements introduced in this release CLI access rights for RADIUS The feature allows the customization of access levels for CLI commands. You can find more information on this enhancement in Configuring and Managing Security (part number B). Community string and Web-server password encryption enhancements In the Passport 8000 Series switch software release 3.5, community strings are stored (as passwords have been since release 3.2.1) in encrypted format and are no longer stored in the configuration file. If a configuration file saved prior to release 3.5 is loaded, any saved community strings from the configuration file will not be recognized. If the switch is booted for the first time with the software release 3.5 image, the community strings are reset to default values and a log is generated indicating any changes. Caution: For security reasons, Nortel Networks recommends that you set the community strings to values other than the factory defaults. In this release, Web-server passwords and SNMP community strings are encrypted. Web-Server password The web-server passwords authenticate the user who is accessing the switch using the web interface. The passwords are encrypted using the blowfish algorithm and are stored in a hidden file. They are not visible on the switch through any show command and are not stored in the config file. SNMP community strings SNMP community strings are used when the user logs in to the switch over SNMP, for example, using Device manager. These strings are encrypted using the blowfish algorithm and are stored in a hidden file. They are not displayed on the switch and are not stored in the config file A Rev 00

19 New software features and software enhancements introduced in this release 19 You can find more information on these enhancements in Configuring and Managing Security (part number B). High-secure mode to prevent certain denial of service (DOS) attacks To protect the Passport 8600 against IP packets with illegal IP addresses such as loopback addresses or a Source IP address of all ones, or Class D or Class E addresses from being routed, the Passport 8600 now supports a configurable mode, high-secure. You can find more information on this new command in Configuring and Managing Security (part number B). hsecure bootconfig flag The Passport 8000 supports a new flag, called hsecure (for High Secure) configurable in bootconfig mode. This flags introduces a new behavior for the password (8 characters enforcement, aging time) and a new protection mechanism to filter certain IP addresses. For information on how to use this new feature, see New security feature: hsecure bootconfig flag: in the Documentation corrections and additions section of these release notes on page 28. Serviceability This section describes the serviceability enhancements in Passport 8000 Switch Series Software Release 3.5. System Messaging Platform (SMP) The primary goal of SMP is to increase serviceability for the Passport 8000 platform. SMP is part of the serviceability tools platform SMP is a protocol standard to standardize how Passport 8000 error messages are: Generated Stored Release Notes for the Passport 8000 Series Switch Software Release 3.5

20 20 New software features and software enhancements introduced in this release Analyzed Documented Release 3.5 introduced additional enhancements in the logging messages used in SMP. You can find more information about this feature in the System Messaging Platform Reference Guide (part number B). Packet Capture Tool PCAP is an onboard data packet capture tool capturing packets ingressing and egressing on selected I/O ports. This feature allows customer support personnel to capture, save, and download one or more traffic flows through the Passport 8600 switch and analyze the captured traffic offline. All captured packets are stored on the secondary CPU in the PCAP engine. The primary CPU maintains its protocol handling and will not be affected by any PCAP capture activity. You can find more information about this feature in the Using the Packet Capture Tool (PCAP) (part number B). Ping Snoop Ping snoop is a feature used to troubleshoot Multilink-trunking (MLT) and Split Multilink-trunking (SMLT) networks. This feature displays what path ICMP traffic takes over an MLT or SMLT path. The console displays the port that is used for each IP traffic flow, from source to destination station. You can find more information about this feature in the Managing Platform Operations and Using Diagnostic Tools (part number B). Platform management: hardware record utilization The Passport 8600 switch creates hardware records for routing protocol destination multicast addresses that allows dropping these frames at the hardware level in the case they are received when the corresponding protocol is not enabled. This results in creating these records for RIP, OSPF, VRRP, DVMRP and PIM on A Rev 00

21 New software features and software enhancements introduced in this release 21 all VLANs. In the case of a scaled environment, a new feature has been introduced that allows you to optimize record utilization by not programming these records, especially that they are used only when routing is not enabled on the interface. For more information on how to configure this feature, see Managing Platform Operations and Using Diagnostic Tools (part number B) on page 32. ATM enhancements This section describes the ATM enhancements in Passport 8000 Switch Series Software Release 3.5. SNMP-based statistics support for ATM This release introduces the ability to enable and display ATM ELAN statistics using SNMP. These statistics are also available using Device Manager and up or a MIB browser. For information on the CLI commands to use this feature, see Using the Passport 8672 ATM/ATME/ATMM module ( D) on page 47. Fast failover for ATM This feature boots the 8672ATM module in fast mode during a Passport 8600 CPU switchover.this significantly reduces the time taken by the 8672ATM module to come to an active state after a CPU switchover. The entire 8672ATM configuration is now re-loaded to the 8672ATM module (any type) from the saved configuration on the switched CPU and the 8672ATM module will be reinitialized again. A message will be printed on the console when the 8672ATM module is booting in fast mode. If the correct image is not present on the switched CPU flash or PCMCIA card, the 8672ATM module will be put offline and a message will be printed on the console and in the logfile. This feature will save time only in booting of 8672ATM module and will not improve or modify the procedure of downloading the configuration on the 8672ATM module. Release Notes for the Passport 8000 Series Switch Software Release 3.5

22 22 Supported software and hardware capabilities Supported software and hardware capabilities This section describes supported software and hardware capabilities in 8000 Series Switch Software Release 3.5, and contains the following topics: Topic Page Supported software capabilities 22 Non-supported software capabilities 25 Non-supported hardware capabilities 26 Limitations between WSM & Alteon 180 Series Stackable Switches 26 Supported software capabilities Table 2 lists the current values for supported capabilities in the 8000 Series Software Release 3.5. These capabilities are enhanced in subsequent software releases. Note: The capabilities described in Table 2 are supported as individual protocols. Table 2 Supported capabilities in the Passport 8000 Series switch (Release 3.5) Feature Maximum number supported Hardware forwarding records Non-E and E-modules: 25,000 M modules: 125, GE LAN/WAN modules This release does not support the combination of the following features with the 10 GE LAN/WAN module: IPX routing SMLT MLT (Nortel Networks recommends that you use a layer 3 protocol for resiliency, for example, OSPF associated to Equal Cost MultiPath (ECMP)) Egress port mirroring A Rev 00

23 Supported software and hardware capabilities 23 Table 2 Feature Supported capabilities in the Passport 8000 Series switch (Release 3.5) (continued) Maximum number supported VLANs 1980 IP subnet-based VLANs (8600 only) Non-E and E-modules: 200 M modules: 800 IP interfaces (8600 switch only) 512 or 1980 with MAC upgrade (see Adding MAC addresses on page 10). BGP forwarding routes Maximum of 20,000 forwarding routes with the 32K (non-e modules and E modules) Maximum of 119,000 forwarding routes with the 128K (M Modules) BGP peers 10 RIP routes (8600 switch only) 2,500 OSPF areas per switch (8600 switch only) 5 OSPF adjacencies per switch (Passport 8600 switch only) 80 OSPF routes (8600 switch only) Non-E and E-modules: 15,000 M modules: 20,000 DVMRP routes (8600 switch only) 2,500 DVMRP passive interfaces (8600 switch only) 500 or 1980 with the MAC upgrade (see Adding MAC addresses on page 10). DVMRP active interfaces (8600 switch only) 80 DVMRP neighbors (8600 switch only) 80 PIM passive interfaces (8600 switch only) 500 or up to 1980 with the MAC upgrade (see Adding MAC addresses on page 10). PIM active interfaces (8600 switch only) 80 PIM neighbors (8600 switch only) 80 Multicast source subnet trees 500 (Passport 8600 switch only) Multicast (S, G) records PIM 2,000 Multicast (S, G) records DVMRP 2,000 Release Notes for the Passport 8000 Series Switch Software Release 3.5

24 24 Supported software and hardware capabilities Table 2 Feature Supported capabilities in the Passport 8000 Series switch (Release 3.5) (continued) Maximum number supported IPX interfaces (Passport 8600 switch only) 100 IPX RIP routes (Passport 8600 switch only) 5,000 IPX SAP entries (Passport 8600 switch only) 7,500 VRRP interfaces (Passport 8600 switch only) 255 Spanning Tree Groups Passport 8100 switch: 1 Passport 8600 switch: 25 2 MLT groups 3 Passport 8100 switch: 6 Passport 8600 switch: 32 Ports per MLT 4 Passport 8100 switch: 4 Passport 8600 switch: 8 1 The number of records available, with all the record reservation fields set to zero. See Platform and System Management (part number A) for more information about the record reservation feature. 2 Nortel Networks supports ONLY 25 STGs in this release. Although you can configure up to 64 STGs (only 63 when a Web Switching Module is present), configurations including more than 25 STGs are not supported. If you need to configure more than 25 STGs, please contact your Nortel Networks Customer Support representative for more information about the support of this feature. 3 The MLT feature is statically compliant with the 802.3ad standard (no support of LACP). 4 When multicast is used in MLT configurations, Nortel recommends using -E modules or -M modules if the MLT on the Passport 8600 is connected to a different device (non-passport 8600). Table 3 lists the current values for supported capabilities for the Web Switching Module in release 3.5. These capabilities are enhanced in subsequent software releases. Table 3 Current supported capabilities in the Web Switching Module (release 3.5) Feature Maximum number supported Ethernet 1000BASESX or 10/100BASE-T ports 4 (or any combination that equals four ports) IP interfaces per module 255 RIP routes per module 1024 Spanning tree group 15 Virtual Matrix Architecture yes IP Routing yes IP Routing Interfaces A Rev 00

25 Supported software and hardware capabilities 25 Table 3 Current supported capabilities in the Web Switching Module (release 3.5) (continued) Feature Maximum number supported MLT groups 4 Ports/Trunk per MLT 4 VLANs 246 Port Mirroring yes Filters 2048 Quality of Service (filter IP ToS) SNMP Private MIB yes yes Chassis support: The Web Switching Module is supported in the 8006, 8010, 8010co chassis, and as of release 3.3, supported in the 8003 chassis. Table 4 lists the current values for supported capabilities for the 8661 SAM in release 3.5. These capabilities are enhanced in subsequent software releases. Table 4 Current supported capabilities in the 8661 SAM (release 3.5) Feature Maximum number supported SSL Transactions per second per module 3000 Concurrent Sessions per module 64,000 Bulk Encryption Throughput per module 260 Mbps Virtual SSL servers supported per cluster 100 SNMP Private MIB yes Non-supported software capabilities Device Manager version and up no longer provides support for the Passport x software code. (Q ) The Passport 8100 Switch does not support IGAP. The 8672ATME/ATMM modules do not support stacked VLANs (SVLANs). The 8672 ATM/ATME/ATMM or 8683POS/POSE/POSM, the 8661 SSL Acceleration Module, and the Web Switching Module are not supported in HA-mode. (Q , Q , Q , Q ) Release Notes for the Passport 8000 Series Switch Software Release 3.5

26 26 Device Manager Installation Non-supported hardware capabilities The 8003 Series Chassis does not support the 8661 SAM. The 8661 SAM maintenance port is not supported in this release. Support is planned in a future release. Currently, the 8681XLW and 8681XLR 10 gigabit Ethernet modules are not supported in a configuration of 8661 SAMs and Web Switching Modules. Passport 8000 Series software release and later does not support configurations of Passport 8100 modules and Passport 8600 modules simultaneously within the same chassis. The Web Switching Module is not supported in the Passport 8100 switch or in 8100 module configurations. The Passport 8003 chassis does not support Passport 8100 switch modules. (Q ) The 8690SF module does not support the M Mode (128K records mode) introduced in release 3.3. In a configuration of M modules and the 8690SF, the modules revert to 32K record mode. Limitations between WSM & Alteon 180 Series Stackable Switches The Web Switching Module WebOS software implementation for STP over MLT has been modified in Passport 8000 Series Software Release 3.3.x or higher and WebOS x or higher to make it fully compatible with Nortel Passport 8600 series switches. Note that if you trunk the Web Switching Module with Alteon Stackable 180 series switches, STP must be disabled on either the Web Switching Module or the Alteon Stackables to avoid incorrect STP operation. Device Manager Installation Device Manager installation procedures are now standardized across all platforms. In addition, the required Java Runtime Environment (JRE) (version 1.3.1) is now part of the JDM installation package and does not require a separate installation. The bundled JRE will be used with this JDM only and should not affect other JAVA applications on the same system A Rev 00

27 Documentation corrections and additions 27 Please note for Solaris and HP-UX, certain OS patches are required for JDM/JRE to function properly. Please consult SUN or HP to install the appropriate OS patches before launching JDM. For complete information on how to install and use Java Device Manager in this release, refer to Installing and Using Device Manager (part number A) Documentation corrections and additions General This section describes information that requires correction in the documentation in this software release or were not described in the documentation set, and also describes configuration considerations that would normally be included with a feature or protocol in the documentation. Some Passport 8000 Switch Software Release 3.5 documentation may contain legacy screenshots that incorrectly reflect the display of non-encrypted community strings when executing the CLI command config sys set snmp. These will be replaced with accurate screenshots in a future release. Upgrading to Passport 8000 Switch Series Software Release 3.5 ( A) In this release, after rebooting your switch, an unknown file engboot is created after the reboot. This has no effect on the performance of the switch. (Q ) Getting Started (part number C) Page 50 refers to hot standby disabling all layer 3 routing operations, but fails to mention that layer 3 static routes will still work in HA mode. Release Notes for the Passport 8000 Series Switch Software Release 3.5

28 28 Documentation corrections and additions Configuring and Managing Security (part number B) This section describes new features not documented and changes required to the document, Configuring and Managing Security. New security feature: hsecure bootconfig flag The Passport 8000 supports a new flag, called hsecure (for High Secure) configurable in bootconfig mode. This flags introduces a new behavior for the password (8 characters enforcement, aging time) and a new protection mechanism to filter certain IP addresses. When the hsecure flag is enabled, the software enforces the 8 characters rule for all passwords. When upgrading from a previous release, if the password does not have at least 8 characters, you will be prompted to change your password to the mandatory character length. Enabling or disabling hsecure To enable (or disable) hsecure, execute the CLI command: config bootconfig flag hsecure [true false] A warning message will display prompting you to reboot the switch for the change to take effect: Warning: Please save boot configuration and reboot the switch for this to take effect. Changing an invalid-length password Once you have enabled hsecure and rebooted the switch, any user with an invalid-length password will be prompted to change their password: Login: rwa Password: *** Your password is valid but less than mandatory 8 characters. Please change the password to continue. Enter the New password : ********* Re-enter the New password : ********* A Rev 00

29 Password changed successfully New default passwords and community strings Documentation corrections and additions 29 If the switch boots in hsecure mode after default factory settings, without any password previously configured, the default passwords have been changed to respect this rule. Table 5 describes the new default passwords. Table 5 New default setting passwords User ID rwa rw ro l3 l2 l1 l4admin slbadmin oper l4oper slboper ssladmin New default password rwarwarrw rwrwrwrw rorororo l3l3l3l3l l2l2l2l2 l1l1l1l1 l4adminl slbadmin operoper l4operl4 slbopers ssladmin Table 6 describes the new default community strings. Table 6 New default community strings ro l1 l2 l3 rw rwa publiconly privateonly privateonly privateonly privateonly secretonly Release Notes for the Passport 8000 Series Switch Software Release 3.5

30 30 Documentation corrections and additions Aging enforcement When the hsecure flag is enabled, after a certain duration (configurable, default = 90 days), you will be asked to change your password, as described previously. The aging parameter is configurable, by executing the CLI command shown in the following display: Passport-8610:5# config cli password aging <days> Set age-out time for passwords Required parameters: <days> passwords/community strings {1..365} = age-out time for Command syntax: aging <days> Note: For SNMP and FTP, when a password expires, access is denied. Community strings have to be changed to a new string made up of more than 8 characters before accessing the system. Consider the following when the hsecure flag is enabled: The Webserver cannot be enabled at any time The SSH password-authentication cannot be enabled at any time. Filtering mechanism In this release, incorrect IP source addresses as network or broadcast addresses are now filtered at the virtual router interface. For example: V1 has the network address /24 (Note that this change is valid for all IP subnets, not only for /24 as mentioned in the example) source addresses and will be discarded.) This is done only if the hsecure mode is enabled A Rev 00

31 Documentation corrections and additions 31 Modifying and Resetting Passwords The boot monitor command reset-passwd is used to reset the passwords to their default values. To reset the passwords use the following command at the boot monitor prompt: reset-passwd To change the passwords use the following commands. All passwords are case sensitive. config cli password <access-level> <username> Enter the old password: Enter the new password: Re-enter the new password: You can find more information on this enhancement in Configuring and Managing Security (part number B). Documentation corrections and additions When a Passport 8600 switch is in HA-CPU mode, and you enable RADIUS accounting for SNMP using the CLI command config radius snmp acct-ena [true false], this configuration cannot be disabled after a CPU failover occurs. To avoid this issue, you should always disable this configuration after using the feature. If the issue does occur, you need to reset the switch if you want to disable this feature after a failover. Note, this issue doesn't impact the operation of the switch, but forces the use of RADIUS accounting for SNMP. (Q ) The CLI and Device Manager incorrectly display the configurable fields context prefix and context match for SNMPv3 group access rights. These fields will be removed from the software and the documentation corrected in a subsequent release to reflect the update. (Q ) Release Notes for the Passport 8000 Series Switch Software Release 3.5

32 32 Documentation corrections and additions Managing Platform Operations and Using Diagnostic Tools (part number B) This section describes new features that are not documented in Managing Platform Operations and Using Diagnostics Tools and also describes additional information that is incorrect or missing. New features Hardware record optimization The Passport 8600 switch creates hardware records for routing protocol destination multicast addresses that allows dropping these frames at the hardware level in the case they are received when the corresponding protocol is not enabled. This results in creating these records for RIP, OSPF, VRRP, DVMRP and PIM on all VLANs. In the case of a scaled environment, a new feature has been introduced that allows you to optimize record utilization by not programming these records, especially that they are used only when routing is not enabled on the interface. When this feature is enabled (boot flag set to true), these records are not created and the switch can achieve higher record scaling as well as a faster boot time. Note: This feature is not supported in high availability (HA) mode. To enable this feature: a Execute the following CLI command: config bootconfig flags control-record-optimization [true/ false]. (The default value is false.) b Save the configuration: save bootconfig. c Reboot the switch A Rev 00

33 Documentation corrections and additions 33 Layer 2 / Layer 3 redundancy clarification When using L2/L3 redundancy, the bootconfig file is saved onto both the master and the standby CPUs and the standby CPU is reset automatically. You must manually reset the master CPU. L2 redundancy supports the synchronization of VLAN and QoS software parameters. L3 redundancy, which is an extension to and includes the L2 redundancy software feature, supports the synchronization of VLAN and QoS software parameters, static and default route records, ARP entries, and LAN virtual interfaces. Specifically, L3 redundancy passes table information and layer 3 protocol-specific control packets to the standby CPU.(Q ) L3 redundancy limitations and considerations This section describes the limitations and considerations of the L3 redundancy feature: L3 redundancy (HA-CPU) is not compatible with PCAP. Be sure to disable HA-CPU prior to using PCAP. Enabling L3 redundancy disables the IP dynamic routing protocols OSPF, RIP, and BGP; consequently, the CLI routing protocol commands config ip ospf, config ip rip, and config ip bgp will no longer be available. L3 redundancy allows redundant ARP and IP static route tables. For information about creating ARP and IP static routes, refer to Configuring IP Routing Operations. Enabling L3 redundancy disables the brouter port capability; you cannot assign IP addresses to Ethernet ports. To assign an IP address, you must create a VLAN, add ports to that VLAN, and then assign the IP address to it. L3 redundancy does not currently support the following protocols: OSPF RIP VRRP DVMRP/PIM/PGM IPX RIP/SAP WDM POS Route policies Release Notes for the Passport 8000 Series Switch Software Release 3.5

34 34 Documentation corrections and additions IP filters In Setting individual system-level switch parameters (Chapter 4), the description of the config sys set msg-control command should be: msg-control <enable disable> Enables or disables the system message control. Enable this command to suppress duplicate error messages on the console. The following CLI commands should be added to this manual: show ip dhcp-relay command The show ip dhcp-relay show-all command displays all relevant IP dhcp-relay information. The command uses the syntax: show ip dhcp-relay show-all [file <value>] where <value> is the filename to which the output will be redirected. Figure 1 shows sample output for the show ip dhcp-relay show-all command A Rev 00