TrafficWorks Software Release c for Brocade ServerIron ADX Series Application Delivery Switches Release Notes v1.3

Transcription

1 TrafficWorks Software Release c for Brocade ServerIron ADX Series Application Delivery Switches Release Notes v1.3 November 2, 2009 Document History Document Title Summary of Changes Publication Date TrafficWorks Software Release v for Brocade ServerIron Application Switches Release Notes v1.0 Initial release May 15, 2009 TrafficWorks Software Release v a for Brocade ServerIron Application Switches Release Notes v1.1 TrafficWorks Software Release v b for Brocade ServerIron Application Switches Release Notes v1.2 TrafficWorks Software Release v c for Brocade ServerIron Application Switches Release Notes v1.3 Defects closed as described Defects closed as described Defects closed as described July 24, 2009 September 25, 2009 November 2, 2009

2 Copyright 2009 Brocade Communications Systems, Inc. All Rights Reserved. Brocade, the B-wing symbol, BigIron, DCX, Fabric OS, FastIron, IronPoint, IronShield, IronView, IronWare, JetCore, NetIron, SecureIron, ServerIron, StorageX, and TurboIron are registered trademarks, and DCFM, Extraordinary Networks, and SAN Health are trademarks of Brocade Communications Systems, Inc., in the United States and/or in other countries. All other brands, products, or service names are or may be trademarks or service marks of, and are used to identify, products or services of their respective owners. Notice: The information in this document is provided AS IS, without warranty of any kind, including, without limitation, any implied warranty of merchantability, noninfringement or fitness for a particular purpose. Disclosure of information in this material in no way grants a recipient any rights under Brocade's patents, copyrights, trade secrets or other intellectual property rights. Brocade reserves the right to make changes to this document at any time, without notice, and assumes no responsibility for its use. The authors and Brocade Communications Systems, Inc. shall have no liability or responsibility to any person or entity with respect to any loss, cost, liability, or damages arising from the information contained in this book or the computer programs that accompany it. Notice: The product described by this document may contain open source software covered by the GNU General Public License or other open source license agreements. To find-out which open source software is included in Brocade products, view the licensing terms applicable to the open source software, and obtain a copy of the programming source code, please visit Export of technical data contained in this document may require an export license from the United States Government. ServerIron ADX Series v c Release Notes v 1.3 Page 2 of 21

3 Contents Document History... 1 Supported Devices for TrafficWorks About This Release... 4 Summary of Enhancements in ServerIron ADX Feature Support... 5 New Features of this Release... 5 ServerIron Features Supported with the Release... 6 Features Not Available in this Release that are in ServerIron Release Image Files for TrafficWorks c... 9 Factory Pre-loaded Software... 9 Downloading a ServerIron ADX Image Downloading a Software Image as Primary Downloading a Software Image as Secondary Loading an Application Image from a TFTP Server Saving and Uploading a System Snapshot for Tech Support Command Syntax Example Technical Support Closed defects in TrafficWorks release c Closed defects in TrafficWorks release b Closed defects in TrafficWorks release a ServerIron ADX Series v c Release Notes v 1.3 Page 3 of 21

4 Supported Devices for TrafficWorks This software release applies to the following ServerIron ADX switches: ServerIron ADX 1000 ServerIron ADX 4000 ServerIron ADX 8000 ServerIron ADX 10K (ADX 10000) About This Release This release introduces the ServerIron ADX Series Application Switches. This release supports a Layer 2 software image and a Layer 3 Software Image. Summary of Enhancements in ServerIron ADX These release notes include a list of supported features in TrafficWorks software release For specific details of the features, and all other information required to operate the devices, refer to the following manuals: ServerIron ADX Server Load Balancing Guide ServerIron ADX Advanced Server Load Balancing Guide ServerIron ADX Global Server Load Balancing Guide ServerIron ADX Security Guide ServerIron ADX Administration Guide ServerIron ADX Switching and Routing Guide ServerIron ADX Firewall Load Balancing Guide ServerIron ADX Graphical User Interface Guide ServerIron ADX Hardware Installation Guide IronWare MIB Reference ServerIron ADX Series v c Release Notes v 1.3 Page 4 of 21

5 Feature Support The section describes the feature highlights in this release. Features or options not listed in this section or documented in the ServerIron ADX Configuration Guides are not supported. New Features of this Release The following features are new to the ServerIron product line with this release. The ServerIron ADX Family of Application Switches ADX 1000, ADX 4000, ADX 8000 & ADX 10K Single unified software image for MP, BP and all ADX platforms Inclusion of Product Serial Number in Output from the show version command Auto-speed fans for optimal cooling Internal USB storage flash of 4Gig External USB port Virtual BP Mode for centralized view of all BPs Enhanced debug filter utility increased buffer size, packet capturing at MP, BP, Line Card and SFM, save captured packets into pcap format file High-speed Syn-attack Protection and several DoS attacks protection in hardware with 0% impact on System CPU Increased configuration file size Enhanced traffic distribution mechanism for distributing load among application cores New web GUI modules High Availability & Health Checks Increase in the server & port count Up to 16K reals, 4K virtuals and 32K ports in ADX 4000, ADX 8000 & ADX 10K Hardware-based ACL processing ServerIron ADX Series v c Release Notes v 1.3 Page 5 of 21

6 ServerIron Features Supported with the Release The following is a brief highlight of features supported in this release. Server Load Balancing (SLB) : Load Balancing predictors Sticky Connections, concurrent connections DSR remote servers Primary and Backup servers port tracking port aliasing Advanced Health Checks : L2/3 ARP & ICMP checks L4 checks Intelligent L7 health checks Port Ranges Port Profiles Port Policies Stateless SLB Intelligent Layer 7 Application Switching using CSW SPAM mitigation using PBSLB Three modes of High Availability Hot-Standby, Symmetric and Sym-active SIP server load balancing (for VoIP deployments) Transparent Cache Switching Firewall Load Balancing Security Hardware based Syn Attack Protection (Syn-Proxy) Syn-Defence for DSR setup DoS Attack Protection Transaction and Connection Rate Limiting ServerIron ADX Series v c Release Notes v 1.3 Page 6 of 21

7 Management Traffic Attack Protection Service Port Attack Protection Access Control Lists (ACLs) IP NAT Global Server Load Balancing ServerIron management Telnet, SSHv2, SNMP ServerIron web GUI Syslog Switching & Routing Static Routing RIP, OSPF VRRP & VRRP-E STP & RSTP VLANs Trunks (LACP and Ether Switch/Ether Server) Tagging NOTE : 1) The two auxiliary ports as seen from the ServerIron ADX front panel are currently not available. They are reserved for future use. 2) The management port as seen from the ServerIron ADX front panel isn't available in this release. As an exception in release 12.0, if for troubleshooting purpose, booting the system from TFTP is necessary, then this management port can be utilized. It isn't possible to boot the ADX system from TFTP through an interface module port. ServerIron ADX Series v c Release Notes v 1.3 Page 7 of 21

8 Features Not Available in this Release that are in ServerIron Release The following features are in ServerIron Release but are not in this release. Many of the features on this list will be supported in future releases for the ServerIron ADX family of application switches. SSL acceleration HTTP compression Application firewall IPv6 SLB Total Content Analysis & Deep Packet Scan IDS load balancing Content aware switching in TCS Sflow IPSEC load balancing Predictor : response time and bandwidth, least-local-connections (deprecated) & least-localsessions (deprecated) Legacy layer 7 switching command line is removed Legacy L2/3 commands are removed Role Based Management VRRP-E grouping, & track-trunk-port ACLs flow-based ACLs, QoS-based ACLs, Egress ACLs and strict IP ACLs Route-only Interface Broadcast, multicast and unknown-unicast limits Rate-limit-arp Rarp Relay-bootp ServerIron ADX Series v c Release Notes v 1.3 Page 8 of 21

9 Required Software Images The ServerIron ADX Series of Applications Switches are upgraded using a single software image. This image is downloaded to the ServerIron ADX switch as either a Primary or Secondary. The default booting image is the Primary while the ServerIron ADX switch can be configured to boot from the Secondary. Image Files for TrafficWorks c The following Switch Software Image Files are available for TrafficWorks c. Device Switch Image File Router Image File Boot Image File ServerIron ADX Series: All models ASM12000c.bin ASR12000c.bin A1B12000.bin Note: Brocade recommends using the latest software versions to get the greatest benefit from the ServerIron Application Delivery Controller. Factory Pre-loaded Software ServerIron ADX Application switches are pre-loaded with a switch image on both primary and secondary flash. If you place an order for ServerIron ADX (PREM) then the unit will still ship with switch code on primary and secondary flash. However, the unit will be activated for PREM code, so you will be able to download the PREM code from the Brocade Knowledge Portal and run it on the system. ServerIron ADX Series v c Release Notes v 1.3 Page 9 of 21

10 Downloading a ServerIron ADX Image By default, a ServerIron ADX switch boots from primary. Optionally, it can be configured to boot from secondary. The following sections describe the following: How to download a Software Image as Primary Image. This is the default operation. How to download a Software Image as Secondary Image. Downloading a Software Image as Primary To download a software image to a ServerIron ADX switch and reload, follow these steps: 1. Copy the correct ServerIron software image to a TFTP server. 2. Use the copy tftp flash command on the ServerIron ADX switch to download the software image from the TFTP server, as shown in the following: ServerIron# copy tftp flash <ip_addr> asm12000c.bin primary In this example the image is downloaded to flash as primary. 3. Reload the ServerIron ADX as shown in the following. ServerIron# reload When the ServerIron ADX reloads, it will boot using the primary image. Downloading a Software Image as Secondary By default, the ServerIron ADX, uses the primary image as its working image. You can configure a ServerIron ADX switch to use the secondary image as its working image as shown in the following: 1. Copy the correct ServerIron software image to a TFTP server. 2. Use the copy tftp flash command on the ServerIron ADX switch to download the software image from the TFTP server, as shown in the following: ServerIron# copy tftp flash <ip_addr> asm12000c.bin secondary ServerIron# In this example the image is downloaded to flash as secondary. 3. Configure the ServerIron ADX switch to use secondary as its working image. ServerIron(config)# boot system flash secondary 4. Save the running configuration to the startup configuration and reload the switch, as shown in the following. ServerIron# write memory ServerIron# reload When the ServerIron ADX reloads, it will boot using the secondary image. ServerIron ADX Series v c Release Notes v 1.3 Page 10 of 21

11 Loading an Application Image from a TFTP Server In some situations, you may need to load the application image from a TFTP server. The following steps describe the required procedure. 1. Directly connect the TFTP server to the management port of the ServerIron ADX. 2. Reload the ServerIron ADX and enter b while the switch is booting. This will put the ServerIron ADX into the monitor mode 3. In monitor mode, assign an IP address and configure a default-gateway to reach the TFTP server through the management port. In the following example, the ServerIron is configured in monitor mode the IP Address for the ServerIron : and the Default Gateway : Monitor> remote address Monitor> remote default-gateway Ping the TFTP server from the ServerIron ADX. Monitor> ping Load the required application image located on the TFTP server to the ServerIron ADX as shown: Monitor> boot system tftp ASR12000c.bin After loading the applications image using this procedure, copy the images to either primary or secondary (as described previously) so that the ServerIron can be booted from flash instead of TFTP. NOTE : The management port on the ServerIron ADX can only be used for this procedure. In release 12.0, it is not available for any other use. Saving and Uploading a System Snapshot for Tech Support Beginning with release b, you can save a system snapshot and upload it as a text or HTML file for use by Brocade Technical support using the following procedure : 1. Save the system snapshot as either a text or HTML file to flash using the save tech-support command. 2. Copy the saved file that contains the system snapshot from flash to the internal USB drive (usb0) using the copy flash usb0 command. 3. Copy the saved file that contains the system snapshot from internal USB drive to TFTP server using the copy usb0 tftp command. Command Syntax The syntax for the commands described in steps 1 through 3 above is described in the following. ServerIron ADX Series v c Release Notes v 1.3 Page 11 of 21

12 Syntax : save tech-support text html <saved-file-name> Using the text parameter specifies that the system snapshot will be saved as a text file. Using the html parameter specifies that the system snapshot will be saved as a html file. The <saved-file-name> variable specifies the name of the file you are saving to flash. Syntax: copy flash usb0 <from-filename> <to-filename> The <from-filename> variable specifies the name of the file that you want to copy from flash to the USB0 drive. The <to-filename> variable specifies the name of the file that you are copying to on the USB0 drive. Syntax : copy usb0 tftp <tftp-server-ip-addr> <from-file-name> <to-file-name> The <tftp-server-ip-addr> variable specifies the IP address of the TFTP server you want to upload the file to. The <from-filename> variable specifies the name of the file that you want to copy from USB0 drive to the TFTP server. The <to-filename> variable specifies the name of the file that you are copying to on the TFTP server. Example The following example describes the procedure for saving a system snapshot as a text file named sysfile1.txt to flash,, copying it to the internal USB drive (usb0) and uploading it to a TFTP server. ServerIron# save tech-support text sysfile1.txt ServerIron# copy flash usb0 sysfile1.txt sysfile1.txt ServerIron# copy usb0 tftp sysfile1.txt sysfile1.txt Technical Support Contact your switch supplier for hardware, firmware, and software support, including product repairs and part ordering. To expedite your call, have the following information immediately available: General Information Technical Support contract number, if applicable Switch model Switch operating system version Error numbers and messages received ServerIron ADX Series v c Release Notes v 1.3 Page 12 of 21

13 Detailed description of the problem, including the switch or network behavior immediately following the problem, and specific questions Description of any troubleshooting steps already performed and the results Switch Serial Number ServerIron ADX Series v c Release Notes v 1.3 Page 13 of 21

14 Closed defects in TrafficWorks release c The table below lists the software issues that were fixed in the c patch release. The P column indicates the priority of the software fix, as follows: 0 = Critical 1 = Major 2 = Medium 3 = Minor The table is sorted by Category, then by Priority, then by Bug ID. Category P Description Bug ID # CLI 2 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: A page-display-mode does not work for certain show commands such as show server real CLI 3 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom:A ServerIron logs a debug level message on the console when a user tries to disable an interface module with the disable module <module name> command. Fragmentation 1 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: While Layer-3 switching out-of-order non-head packets, ServerIron does not rewrite source Mac-address information in the Layer-2 header of these packets. FWLB 1 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: A ServerIron may perform a system reset when it receives a packet from the firewall, if the source MAC-address in the packet is not learned. IP Routing 1 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: A ServerIron may perform a system reset when it receives traffic matching a null route ServerIron ADX Series v c Release Notes v 1.3 Page 14 of 21

15 Category P Description Bug ID # L2 Switching 1 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: A ServerIron may perform a system reset when it tries to program a MAC address and it has reached maximum number of MAC addresses it can program. L7 Switching 0 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: A ServerIron configured with advanced L7 switching, such as content switching (CSW), may perform a system reset when it receives HTTP request with POST method and under certain circumstances. L7 Switching 1 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: In a High-Availability setup with ServerIrons configured with an advanced L7 switching such as content switching (CSW), upon failover, a newly Active ServerIron may perform a system reset while processing traffic for which it does not have session information. L7 Switching 1 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: A ServerIron configured with an advanced L7 switching, such as content switching (CSW), may perform a system reset while processing TCP RST under certain circumstances. SLB 3 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: Starting this release, the host-range limit has been increased from 2048 to SNMP 0 Module: ADX1000, ADX4000, ADX8000 Symptom: ServerIron may perform a system reset when user tries to configure a command snmp-server view. System 1 Module: ADX1000, ADX4000 & ADX8000 & ADX 10K Symptom: A loopback IP address cannot be pinged if it is configured prior to reloading the ServerIron. You need to delete it and add it back to make it work ServerIron ADX Series v c Release Notes v 1.3 Page 15 of 21

16 Category P Description Bug ID # System 2 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: The maximum number of L4 CAM entries allowed to be programmed is limited to 4K and there is no command to change this value. Also the limit of 4K is smaller when configured with a large number real and virtual servers. There is a need to increase this limit from 4K to 32K. Resolution: Added in Release c. Starting this release, a new system-max command has been added. Also the maximum number of L4 CAM entries limit has been increased from 4K to 32K. Command: [no] system-max max-l4-cam-entries <value> The range is from 4096 to Note: This command needs a reload similar to other system-max commands. In order to change the default value of 4K to other values ranging from 4K to 32K, you need to configure this command and then write to memory and reload the ServerIron. TCS 1 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: A ServerIron may perform a system reset when it receives packet with TCP or UDP source port as 0 for which there is no matching session found. TCS 1 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: When a ServerIron is configured for TCS, by default, cachepersistence is maintained for cache servers and this may lead to uneven load distribution if one or more cache servers fail There is no command to disable this cache-persistence behavior. Starting this release, you can disable this behavior with the following global config command. ServerIron(config)# server disable-cache-persist In addition to above new command, the following two commands are also needed in order to reditribute hash buckets to all available cache servers in case a given cache server goes DOWN or comes back UP. ServerIron(config)# server force-cache-rehash ServerIron(config)# server no-slow-start ServerIron ADX Series v c Release Notes v 1.3 Page 16 of 21

17 Category P Description Bug ID # VRRP-E 3 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: VRRP-E tracking with number of BPs count needs to be supported. Resolution: Added in Release c. Starting with this release, a user can enable this feature with the configurable commands. When an ASM module is disabled or pulled out, the number of active BPs will be decremented by 8. BP count track priority will be calculated based on the formula shown below and the resulting value will be subtracted from VRID backup priority. If the new backup priority is less than backup priority configured on peer ServerIron, failover will take place Track priority carried by BP count is calculated by the following formula: Current VRRP-E VRID priority = (configured VRRP-E priority) - (maximum number of possible BPs available active BPs) * bp-priority (track-port priority) Note: Maximum number of possible BPs are: For ADX-8000: 32 For ADX-4000: 16 Command: [no] track-bp bp-priority <value> interface ethernet ve 10 ip-address ip vrrp-e vrid 30 backup priority 101 ip-address track-port 1/1 priority 24 track-port 1/2 priority 24 track-bp bp-priority 1 enable! interface ethernet ve 20 ip-address ip vrrp-e vrid 20 backup priority 101 ip-address track-port 1/1 priority 24 track-port 1/2 priority 24 track-bp bp-priority 1 enable Web Management 2 Module: ADX1000, ADX4000, ADX8000 & ADX 10K Symptom: Th e Management CPU (MP) memory usage value is always seen as 100% when checked via Web GUI. It shows correct values when checked with CLI ServerIron ADX Series v c Release Notes v 1.3 Page 17 of 21

18 Closed defects in TrafficWorks release b Note: When installing a DC power supply with model number in a ServerIron ADX chassis running b code, output from the show chassis command will mistakenly display the power supply as an AC power supply as shown in the following: } text {Power Supply 1:left most - Present (OK):(Model#: Serial#: AC Firmware Rev#: 1. 8) } text {Power Supply 2:second from left - Present (OK):(Model#: Serial#: AC Firmware Rev#: 1. 8) } text {Power Supply 3:Third from left - Present (OK):(Model#: Serial#: AC Firmware Rev#: 1. 8) } text {Power Supply 4:last - Present (OK):(Model#: Serial#: AC Firmware Rev#: 1. 8) } text {Total power budget for system = 4800 W The table below lists the software issues that were fixed in the a patch release. The P column indicates the priority of the software fix, as follows: 0 = Critical 1 = Major 2 = Medium 3 = Minor The table is sorted by Category, then by Priority, then by Bug ID. Category P Description Bug ID # IP FORWARDING 0 Module: ADX1000, ADX4000 & ADX8000 Symptom: A ServerIron configured with TCS may perform a system reset when it receives a TCP forward traffic flow that matches a reverse session. Resolution: Fixed in Release b ServerIron ADX Series v c Release Notes v 1.3 Page 18 of 21

19 Category P Description Bug ID # SLB 0 Module: ADX1000, ADX4000 & ADX Symptom: In a High-Availability setup, such as Hot-Standby or Symmetric or Active-Active SLB, a Standby ServerIron may perform a system reset when it receives a session-sync message for TCP FIN from an Active ServerIron. This issue is only seen if the reverse session for the same TCP connection is not present on standby the ServerIron. Resolution: Fixed in Release b. SSH 1 Module: ADX1000, ADX4000 & ADX Symptom: A ServerIron may perform a system reset when SSH connections are closed abruptly. Resolution: Fixed in Release b. STP 2 Module: ADX1000, ADX4000 & ADX Symptom: A ServerIron configured with system-max spanning-tree 256 does not allow you to enable spanning-tree on a VLAN. This issue is not seen if you use a number smaller than 256 in this command. Resolution: Fixed in Release b. System 1 Module: ADX1000, ADX4000 & ADX Symptom: The following command has been added to export a saved tech-support file to a TFTP server: copy usb0 tftp <tftp-server-ip-address> <from-file-name > <to-filename> Resolution: Fixed in Release b. ServerIron ADX Series v c Release Notes v 1.3 Page 19 of 21

20 Closed defects in TrafficWorks release a The table below lists the software issues that were fixed in the a patch release. The P column indicates the priority of the software fix, as follows: 0 = Critical 1 = Major 2 = Medium 3 = Minor The table is sorted by Category, then by Priority, then by Bug ID. Category P Description Bug ID # ACLs 0 Module: ADX 1000, ADX 4000 & ADX Symptom: With Source-NAT enabled, passive FTP traffic that is subject to ACL rules may cause an unexpected software reload. Resolution: Fixed in Release a. NAT 1 Module: ADX 1000, ADX 4000 & ADX Symptom: With Source-NAT enabled, active FTP sessions are completed successfully but the port is not freed up for several minutes. Resolution: Fixed in Release a. Router 2 Module: ADX 1000, ADX 4000 & ADX Symptom: Output from the show cpu command displays an incorrect average value. Resolution: Fixed in Release a. Router 2 Module: ADX 1000, ADX 4000 & ADX Symptom: With a hardware-based SYN-cookie, the SLB connection rate counter displays an incorrect connection rate. Resolution: Fixed in Release a. ServerIron ADX Series v c Release Notes v 1.3 Page 20 of 21

21 Category P Description Bug ID # SLB 0 Module: ADX 1000, ADX 4000 & ADX Symptom: After hot-swapping an interface module, SLB traffic may fail to be processed correctly. Resolution: Fixed in Release a. SLB 0 Module: ADX 1000, ADX 4000 & ADX Symptom: With the TCP-proxy feature enabled, HTTP traffic flows are subject to ACL rules and may not clean up the sessions correctly after the flow has ended successfully. Resolution: Fixed in Release a. SYN-proxy 1 Module: ADX 1000, ADX 4000 & ADX Web Management Web Management Web Management Symptom: When SYN-proxy is applied on a VE interface, the vlan-id is not checked for incoming SYN packets. Resolution: Fixed in Release a. 0 Module: ADX 1000, ADX 4000 & ADX 8000 Symptom: In a high-availability configuration, with SYN-proxy and IP NAT are configured, a software reload may occur after a failover has happened. Resolution: Fixed in Release a. 0 Module: ADX 1000, ADX 4000 & ADX 8000 Symptom: An unexpected software reload occurs when the system receives a malformed POST header. Resolution: Fixed in Release a. 0 Module: ADX 1000, ADX 4000 & ADX 8000 Symptom: An unexpected software reload can occur when an HTTP authentication header is sent in a packet Resolution: Fixed in Release a. ServerIron ADX Series v c Release Notes v 1.3 Page 21 of 21