Datacom Systems Inc. 9 Adler Dr. East Syracuse, NY Phone: Support:

Transcription

1 Datacom Systems Inc. 9 Adler Dr. East Syracuse, NY Phone: Support: Release Notes Firmware for: VS-1012-F, VS-1012-F-1pwr, VS-1024-F, VS-1112-F, VS-1124-F, VS-1212-F, VS-1224-F Upgrade File Name: Orion tar.gz Compatible Browsers: Google Chrome 35, Microsoft Internet Explorer 11, Mozilla Firefox 33 Release Version: Orion Required Release Version Prior to applying this Upgrade: Orion or Orion Installation Notes (When upgrading from Orion ): Note 1: Improved password encryption and length. This feature requires the user to change their password after upgrade due to change in encryption mechanisms. Their new password is reset to their [Username]123. If the Username is Administrator the password after the upgrade will change to Administrator123 Note 2: Configuration backups from previous version of firmware are not supported and should not be used since they will result in device instability and loss of configuration. Note 3: Copper 10mb is no longer a supported port speed. Any configured 10mb ports will be changed to copper auto negotiate after the upgrade. Installation Notes (When upgrading from Orion ): Note 1: NTP server configurations and Remote Event Log configurations will be reset to thier default values. Page 1 of 8

2 1. New Features 1.1. A new and improved user-friendly CLI structure 1.2. Added new searching capability to help command Improved user interface response time 1.4. Improved SFP scanning 1.5. Configuration and Event logging 1.6. Improved password encryption 1.7. Added Syslog support 1.8. Configurable Keepalive interval 1.9. NTP server configuration Ability to upload a SSL Certificate Improved Load Balancing Page 2 of 8

3 2. Changes 2.1. Improved password encryption for longer passwords up to 16 characters RADIUS and TACACS+ configurations support up to 4 servers GUI Help is now integrated into the current pages and is indicated by a yellow question mark icon CLI Help Menu Improvements: Alphabetical sorting Change in formatting for ease of use HELP (HE) command can take a search argument. Eg. HELP SNMP will list only the commands related to SNMP SHOW FIRMWARE VERSION (SH FW VE) - Format of firmware string has changed to accommodate longer string SHOW FILTER command improvements: SHOW FILTERS (SH FI) - Output is lexicographically organized now Search function for filters: SHOW FILTERS FILTERED (SH FI FI) - Display Filters than contain the filter string in their name. Eg. SHOW FILTERS FILTERED https Will display all filters containing https in their name Changed filter names to No spaces in filter name: ADD FILTER (AD FI) ADD FILTER OVERWRITE (AD FI OV) 2.8. Added port list support to the following commands: SHOW PORT CONFIGURATION (SH PO CO) - Parameter changes [ Port# "ALL" Port-list ] SHOW PORT DESCRIPTION (SH PO DE) - Parameter changes [ Port# "ALL" Port-list ] SHOW PORT TYPE (SH PO TY) - Parameter changes [ Port# "ALL" Port-list ] SET PORT FILTER (SE PO FI) - Parameter changes [ Port# "ALL" Port-list ] SET PORT SPEED (SE PO SP) - Parameter changes [ Port# "ALL" Port-list ] 2.9. SHOW PORT ROUTING (SH PO RO) - Output Title bars changed to clarify RX & TX SHOW SERVICE STATUS (SH SV ST) - Additional services now displayed for new features: NTP, Local Events, Remote Events Shortened CLI commands to 3 keywords: SET SNMPV3 TRAP (SE V3 TR) SET SNMPV2C TRAP (SE V2 TR) SHOW SNMPV3 TRAP (SH V3 TR) SHOW SNMPV2C TRAP (SH V2 TR) Port Group Management and Load Balancing Commands changes: Quoted names are no longer used in ALL the GROUP and LB commands. Previously quoted fields are now white space delineated by default, and 'SPACE' characters are no longer valid in names. Databases are scrubbed on upgrade to replace spaces in current names with the underscore '_' character. The affected commands are: Port Group Management commands: ADD GROUP MEMBER (AD GR ME) CREATE GROUP (CR GR) DELETE GROUP (DE GR) REMOVE GROUP MEMBER (RE GR ME) SET GROUP DESCRIPTION (SE GR DE) SHOW GROUP (SH GR) SHOW GROUP MEMBERSHIP (SH GR ME) Page 3 of 8

4 Load Balancing Commands: CREATE LBC (CR LB) DELETE LBC (DE LB) SET LBC DESCRIPTION (SE LB DE) SET LBC EGRESS-PORTS (SE LB EG) SET LBC INGRESS-PORTS (SE LB IN) SET LBC STATE (SE LB ST) SET LBG ADMIN-STATE (SE LB AD) SET LBG PORT-STATE (SE LB PO) SHOW LBC (SH LB) Improved load balancing algorithim that will pair data streams together more effectively. 3. Additions: 3.1. Added New link summary command for a quick overview of port state in the CLI GET LINK SUMMARY (GE LI SU) - Get Summary status of all Ports/Links Added NTP time source support. GUI interface is under the System page NTP Configuration Commands ADD NTP SERVER (AD NT SE) - Add a new NTP server <IP Address> into the server list CLEAR NTP SERVER-LIST(CL NT SE) - Remove all configured NTP servers REMOVE NTP SERVER (RE NT SE) - Remove the designated server SHOW NTP (SH NT) - Display a summary of the NTP service status and servers SHOW NTP SERVER-LIST (SH NT SE) - Display the list of configured NTP servers SHOW NTP STATUS (SH NT ST) - Display the NTP status Added syslog support. Syslog and EventLog GUI pages added under Status in the toolbar menu. Configuration settings are added under the Syslog page New Syslog, EventLog configuration commands: ADD SYSLOG SERVER (AD SY SE) - Add a new remote Syslog Server at IP:Port CLEAR SYSLOG SERVER-LIST (CL SY SE) - Remove all configured remote SYSLOG servers GET SYSLOG SERVER-LIST (GE SY SE) - Get the list of remote syslog servers GET SYSLOG STATE (GE SY ST) - Get the state of the remote syslog feature REMOVE SYSLOG SERVER (RE SY SE) - Remove the designated remote Syslog server SET SYSLOG STATE (SE SY ST) - Enable/Disable the remote syslog feature SHOW SYSLOG (SH SY) - Get the remote syslog servers list and the state of the feature Added new command to generate a new SSL web certificate that matches the set device IP: REGEN WEB CERTIFICATE (RE WE CE) Added DELETE SYS DESC and DE SY DE to remove the system description Added DELELE FILTER DESC <filtername> and DE FI DE <filtername> Added Keep Alive feature. GUI page under Status System Health Keep Alive commands: SET KEEPALIVE INTERVAL (SE KE IN) - Set the interval for box health events seconds GET KEEPALIVE INTERVAL (GE KE IN) - Get the interval for box health pings Added CLI port counters commands: GET PORT COUNTERS (GE PO CO) - Retrieve port level interface statistics RESET PORT COUNTERS (RE PO CO) - Reset port statistics to zero Page 4 of 8

5 3.9. Added new more granular user management commands: CREATE USER (CR US ) - Create a new local user (w/ no access privileges to start) GET USER (GE US) - Get specifics about a local named user REMOVE USER (RE US) - Remove/Delete the specified local user REMOVE USER PHONE (RE US PH) - Clear the local user's phone info REMOVE USER CELL (RE US CE) - Clear the local user's mobile info REMOVE USER (RE US EM) - Clear the local user's info SET USER ACCESS (SE US AC) - Configure terminal access privileges for a local user SET USER CELL (SE US CE) - Configure the user's mobile phone contact SET USER (SE US EM) - Configure the user's contact SET USER PASSWORD (SE US PA) - Configure user password SET USER PHONE (SE US PH) - Configure the user's desk phone contact SHOW CURRENT USER (SH CU US) Show the current user logged in. 4. Redactions: M Speed is not longer supported by these products. The CU-10M port speed setting has been removed. 4.2 Obsolete User management commands: Replaced by the New User management commands ADD USER (AD US) - Obsoleted, replaced with CR US / CREATE USER EDIT USER (ED US) - Obsoleted, replaced with atomic attribute setting commands DELETE USER (DE US) - Obsoleted, replaced with RE US / REMOVE USER Fixes 1. Ports could be configured for a speed impossible for the inserted SFP. 2. Inconsistency between port lights and negotiated speeds. 3. Some commands allowed incorrectly formatted fields. 4. Port counters page in GUI would occasionally stop incrementing with traffic flow. 5. Various bug fixes. Page 5 of 8

6 Known Issues: Functional: 1. Incorrect IP addresses are allowed by NTP, RADIUS, and TACACS related commands in the CLI. a. Workaround: Use proper digit octets for IP addresses 2. Creating an IP filter on the GUI sometimes gives the incorrect Mask option. a. Workaround: Use Command Line Interface if issue persists using the GUI. 2. Restoring a configuration does not restore the list of filters. a. Workaround: Record filter syntax in descriptions to recreate filters. Cosmetic: 1. Regen web certificate, Add ntp server, and Remove ntp server commands cause a CLI echo when connecting to the serial interface. 2. When placing ports that are being steered into an LBC, the Show port routing command will be offset from the intended format. Notes and Limitations: 1 CLI and GUI 1.1. The following characters should not be used for names or descriptions: Curly brackets (braces) { } Backslash \ Pipe Tilde ~ Number sign # Grave accent ` Quotes Apostrophe Colon : These characters may cause inconsistent displays, or misinterpreted entries GUI supports only encrypted web sessions (HTTPS). Unencrypted web sessions (HTTP) are not supported If the GUI System Time is not set properly it can cause a situation where the interface results in an immediate timeout when logging in. The solution is to set the time. 2 SNMP 2.1. SNMP Service: Going from an ON state to OFF and back ON which is necessary for configuration changes, results in SNMP traps for all down ports and power supplies. 3 Load Balancing 3.1. On 24 port models only 16 ports can be part of active egress groups of all Load Balancing Configurations. Page 6 of 8

7 3.2. A Port Group configuration change does not automatically propagate to a Load Balancing Configuration. Instead the Load Balancing Group portion of the Load Balancing Configuration must be edited to take into account changes to the Port Group Load Balancing: A port which is not a member of an applied Load Balancing Configuration can be steered to one-or-more of the output ports associated with an applied Load Balancing Configuration. In this case, the data transmitted by the output port(s) will include both the Load Balanced data and the port-steered data. To assure that Load Balance Configuration ports transmit ONLY Load Balanced data, the operator must check-for and eliminate any port-steering that has been applied to the output port(s). 4 RADIUS/TACACS Only port 49 is supported for TACACS+ AA RADIUS/TACACS+ authentication and authorization are supported for GUI, SSH, and Local Console access, not TELNET access Radius Secret/Timeout can be modified based upon a specific IP/port pair. Tacacs Secret/Service can be modified based upon a specific IP/port pair. IP/port pairs cannot be modified only removed, then re-added When external RADIUS or TACACS+ is configured as the primary authentication with LOCAL as secondary authentication, the username/password WILL NOT be checked against the LOCAL user database if the external authentication server rejects a GUI login attempt When external RADIUS or TACACS+ is configured as the primary authentication with LOCAL as secondary authentication, the username/password WILL be checked against the LOCAL user database if the external authentication server rejects an SSH login attempt For Console login, the LOCAL user database is always checked first to avoid being locked out of a box. If RADIUS/TACACS+ is configured as secondary authentication, the request for external authentication will only occur when the LOCAL authentication has failed LOCAL user accounts can only be added/deleted/modified (rights) by logging in using a LOCAL account with User Permissions (i.e., Administrator) LOCAL user accounts cannot be edited by logging in using a RADIUS/TACACS+ account TACACS+ server configuration change does NOT automatically propagate to future authentication processing. The authentication order MUST be reset in order for the server configuration to be applied to future authentication requests. RADIUS server configuration changes DO automatically propagate to future authentication processing. 5 Filtering 5.1. The number of filters definitions that can be listed using the SHOW FILTERS command is 128. The number of filters that can be defined is only constrained by the onboard memory which can store thousands of filter definitions A single filter definition can contain up to 64 rules. A rule is a set of one-or-more match conditions for distinct filter types (such as MAC address, IP address, TCP port, UDP port, etc.) which are joined by the AND operator. Multiple rules can be joined by the OR operator. More than one match condition on a specific filter type requires more than one rule. The filter type match conditions are one of the following: MAC address, IP address, TCP Port, UDP Port, Ether Type, IP Protocol, IPv6 address. Page 7 of 8

8 5.3. When defining an exclude filter, the use of a! or NOT or DROP (not operators) syntax must be enclosed within an outer-most set of parenthesis. Only one NOT operator is allowed per filter. It must be used at the top-most level of the filter expression or form. Specifically, the NOT operator MUST be enclosed in its own set of parenthesis. The actual filter that is to be NOT ed, is within its own set of parenthesis. For example, if an IP address INCLUDE filter is defined as (ip.addr == ), the corresponding EXCLUDE filter must be expressed as (!(ip.addr == )) or (NOT(ip.addr == )) or (DROP(ip.addr == ) Complex filters that contain a mix of rules enclosed with parenthesis and without parenthesis may be flagged as invalid A maximum of 16 ports can have an egress filter applied on the VS-1224-F, VS-1024-F and VS-1124-F; the number of ports to which a complex multi-rule egress filter can be applied may be less than Port Settings 6.1. SET PORT TYPE Port Type checking is not enforced for port steering in the CLI; however Port Type connection rules are enforced for port steering in the GUI. Port Type checking allows or restricts connectivity between different ports labeled as Network, Monitor, Active Monitor or Interconnect ports. 7 GUI 7.1. The default user permissions for new features in the GUI are read only. To get the full permissions the Administrator account has to be used to assign privileges. 8 Boot-up 8.1. The status LED on front panel indicates the device is ready several seconds before it is ready to respond to CLI commands. Page 8 of 8