Release Notes for NBAR2 Protocol Pack for Cisco Wireless Controllers

Transcription

1 Release Notes for NBAR2 Protocol Pack for Cisco Wireless Controllers Overview, page 1 Supported Platforms, page 2 New Protocols in NBAR2 Protocol Pack , page 2 Updated Protocols in NBAR2 Protocol Pack , page 3 Deprecated Protocols in NBAR2 Protocol Pack , page 6 Caveats in NBAR2 Protocol Pack , page 6 Downloading NBAR2 Protocol Pack , page 8 Special Notes and Limitations, page 8 Overview NBAR2 Protocol Pack provides classification improvements and bug fixes. Early DNS decision: Uses DNS traffic to learn server IP addresses and efficiently classify future flows from the first packet. New protocols: Mongo and OCSP Fixed a DNS socket cache issue to resolve DNS customization issue CSCuz Enhanced Web Classification feature supporting multi-transactions export of URLs. Automatic Local Services Discovery feature. As a part of this feature, to handle business-relevant generic local network traffic, two protocols are added: http-local-net ssl-local-net 1

2 Supported Platforms Release Notes for Supported Platforms NBAR2 Protocol Pack is supported on the following platforms: Cisco 5508 Wireless Controller Cisco 5520 Wireles Controller Cisco Flex 7500 Series Wireless Controllers Cisco 8510 Wireless Controller Cisco 8540 Wireless Controller Cisco Wireless Services Module 2 (WiSM2) New Protocols in NBAR2 Protocol Pack The table below lists the new protocols added in NBAR2 Protocol Pack (protocols added since ). Protocol Name mongo Common Name Mongo Long Description Mongo is a leading NoSQL database designed with both scalability and developer agility in mind. Instead of storing your data in tables and rows as you would with a relational database, MongoDB stores JSON-like documents with dynamic schemas. ocsp http-local-net ssl-local-net crashplan cisco-collaboration cisco-spark https pearson OCSP Local Net HTTP Local Net SSL Crashplan Cisco Collaboration Media Cisco Spark Hypertext Transfer Protocol Secure (HTTPS) Pearson OCSP - Online Certificate Status Protocol Local network generic HTTP traffic. Local network generic SSL traffic. Online data backup software. Silently and continuously backs up end-user data for complete visibility and control on a single, secure platform. Cisco Collaboration Media - Voice, video, and desktop sharing by various Cisco Unified Communications clients. Cisco Spark - unified communications client and SaaS with mobile team communication: group chat, private chat, video calls with screen sharing, and file sharing. Hypertext Transfer Protocol Secure (HTTPS) Pearson - education content provider. 2

3 Release Notes for Updated Protocols in NBAR2 Protocol Pack Protocol Name statistical-conf-audio statistical-conf-video statistical-download statistical-p2p wifi-calling ms-services Common Name Statistical Conference Audio Statistical Conference Video Statistical Download Statistical Peer-To-Peer Wi-Fi Calling Microsoft Services Long Description Statistical Conference Audio based on machine learning. Statistical Conference Video based on machine learning. Statistical Download based on machine learning. Statistical Peer-To-Peer based on machine learning. Wi-Fi Calling uses WiFi to provide better mobile phone coverage for a mobile carrier. Microsoft Services is a set of tools, APIs and web services used by Microsoft applications. Updated Protocols in NBAR2 Protocol Pack The table below lists the protocol(s) updated in NBAR2 Protocol Pack (protocols updated since ). Protocol cisco-jabber-audio cisco-jabber-control cisco-jabber-video cisco-phone-audio cisco-phone-video dns exchange http-local http mysql secondlife ssl-local Updates 3

4 Updated Protocols in NBAR2 Protocol Pack Release Notes for Protocol teredo-ipv6-tunneled vmware-vsphere webthunder cisco-collaboration cisco-jabber-audio cisco-jabber-control connected-backup exchange ms-lync ms-services ms-wbt mysql netflix oracle-sqlnet pearson perforce rtp-audio rtp-video secure-imap secure-pop3 secure-smtp sqlserver ssl telepresence-control Updates 4

5 Release Notes for Updated Protocols in NBAR2 Protocol Pack Protocol telepresence-media teredo-ipv6-tunneled vnc windows-azure aol-messenger capwap-control capwap-data cisco-jabber-control citrix gmail google-services h323 ip-messenger ms-lync ms-office-365 ms-services openvpn oracle-sqlnet perforce skype socks teamviewer ventrilo vmware-vsphere Updates 5

6 Deprecated Protocols in NBAR2 Protocol Pack Release Notes for Protocol whatsapp windows-azure windows-update xbox-web-portal xunlei-kankan dropbox itunes ms-live-accounts ms-lync ms-lync-audio ms-lync-video telepresence-media Updates Signatures were updated to support the Skype business client Signatures were updated to support the Skype business client Signatures were updated to support the Skype business client Signatures were updated to support Cisco Telepresence MX300 Deprecated Protocols in NBAR2 Protocol Pack In this release, the following protocol has changed status to deprecated: secure-http Caveats in NBAR2 Protocol Pack Note If you have an account on Cisco.com, you can view information on select caveats, using the Bug Search Tool ( Resolved Caveats in NBAR2 Protocol Pack The following table lists the caveats resolved in NBAR2 Protocol Pack (since ): Resolved Caveat CSCuz39567 Description DNS customization does not work under some conditions 6

7 Release Notes for Caveats in NBAR2 Protocol Pack Resolved Caveat CSCuy06350 CSCuy09714 CSCuy11306 CSCux74649 CSCuy68203 CSCux67672 CSCux81395 CSCux62325 CSCuu61615 CSCuu99278 CSCuv56693 Description Changed teredo to generic protocol mysql traffic is mis-classified as webthunder RTP audio traffic is mis-classified as Second Life RTP-based mis-classifications: Cisco collaboration and vanilla rtp Amazon-web-services traffic is classified as SSL Fix CLI chopped protocol names. Some cisco-jabber traffic may not be classified (in Protocol Pack ) Traffic from Polycom device may be misclassified as cisco-jabber-audio Traffic generated by SIP based protocols (such as telepresence) might be classified as RTP Traffic generated by capwap-data protocol might be misclassified Traffic generated by Cisco Telepresence MX300 might be misclassified as RTP Known Caveats in NBAR2 Protocol Pack The following table lists the known caveats in NBAR2 Protocol Pack (since ): Known Caveat CSCuh49380 CSCuh53623 CSCun61772 CSCuz48467 CSCux33859 Description PCoIP session-priority configuration limitation. Segmented packets are not classified when using NBAR sub classification. IPv4 bundles might be used in IPv6 traffic. CPUHOG message appears when loading Protocol Pack on Cisco ISR 800 Series routers (Applies only to Cisco IOS XE S Version 15.5(3)S1, and IOS Version 15.5(3)M1) Microsoft Lync audio/video is not classified correctly in some cases. If your organization uses Microsoft Lync and one of these releases, it is not recommended to upgrade to Protocol Pack Use a later release (such as S and above) for full Protocol Pack support of Microsoft Lync audio/video. 7

8 Downloading NBAR2 Protocol Pack Release Notes for Downloading NBAR2 Protocol Pack NBAR2 Protocol Packs are available for download on the Cisco.com software download page ( On the download page, specify a platform model to display software available for download. One software option will be NBAR2 Protocol Packs. Example To display protocol packs available for the Cisco ASR 1001 platform, the navigation path is: Products > Routers > Service Provider Edge Routers > ASR 1000 Series Aggregation Services Routers > ASR 1001 Router Special Notes and Limitations Protocol Name apple-app-store bittorrent capwap-data cisco-phone cisco-jabber-audio ftp hulu logmein ms-lync pcanywhere perfect-dark qq-accounts Special Note or Limitation Login and a few encrypted sessions are classified as itunes. HTTP traffic generated by the bitcomet bittorrent client might be classified as HTTP. For capwap-data to be classified correctly, capwap-control must also be enabled. Cisco WLC upgraded to NBAR Protocol Pack 24 resolves traffic clasification issues faced using PP Cisco WLC upgraded to NBAR Protocol Pack 24 resolves traffic clasification issues faced using PP During configuring QoS class-map with ftp-data, the FTP protocol must be selected. As an alternative, the FTP application group can be selected. Encrypted video streaming generated by hulu may be classified as its underlying protocol rtmpe. Traffic generated by the logmein android app may be classified incorrectly as ssl. Login and chat traffic generated by the ms-lync client may be classified incorrectly as ssl. Traffic generated by pcanywhere for mac may be classified as unknown. Some perfect-dark sessions may be classified as unknown. Login to QQ applications which is not via the internet may not be classified as qq-accounts. 8

9 Release Notes for Special Notes and Limitations Protocol Name secondlife ssl Special Note or Limitation Voice traffic generated by secondlife may be classified incorrectly as ssl. The Sub Classification (SC) mechanism was modified to include search for wildcard. Note The SC rule for the part of the Server Name Indication (SNI) or the common name (CN) can now include a wildcard. If a wildcard is not used, the complete SNI or the CN is required. For example, you can either use, "*.pqr.com" or "abc.pqr.com" to classify abc.pqr.com. 9

10 Special Notes and Limitations Release Notes for 10