Cisco Nexus 7000 Series NX-OS Release Notes, Release 5.0

Transcription

1 Cisco Nexus 7000 Series NX-OS Release Notes, Release 5.0 Date: November 22, 2010 Part Number: Current Release: 5.0(5) Deferred Release 5.0(2) This document describes the features, caveats, and limitations for Cisco NX-OS software for use on the Cisco Nexus 7000 Series switches. Use this document in combination with documents listed in the Related Documentation section on page 45. Note Release notes are sometimes updated with new information about restrictions and caveats. See the following website for the most recent version of the Cisco Nexus 7000 Series NX-OS Release Notes, Release 5.x Release Notes: Table 1 shows the online change history for this document. Table 1 Online History Change Part Number Revision Date Description OL A0 May 24, 2010 Created release notes for Release 5.0(2). OL A0 May 26, 2010 Created release notes for Release 5.0(2a). B0 June 08, 2010 Added the 6.0-kW DC power supply information to Table 1. C0 June 28, 2010 Added the 10-Gbps SFP+ transceivers to Table 3. Americas Headquarters: Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA USA

2 Contents Table 1 Online History Change (continued) Part Number Revision Date Description OL A0 July 25, 2010 Created release notes for Release 5.0(3). B0 August 4, 2010 Moved CSCtg79818 to the Resolved Caveats Cisco NX-OS Release 5.0(3) section. C0 August 5, 2010 Added Resolved Caveat CSCth D0 November 8, 2010 Added Open Caveat CSCtg A0 November 22, 2010 Created Release Notes for Release 5.0(5). Contents This document includes the following sections: Introduction, page 2 System Requirements, page 2 Upgrade/Downgrade Caveats, page 8 CMP Images, page 9 EPLD Images, page 9 Cisco DCNM, page 9 New Software Features, page 9 Licensing, page 17 MIBS, page 17 Limitations, page 18 Caveats, page 22 Related Documentation, page 45 Obtaining Documentation and Submitting a Service Request, page 46 Introduction The Cisco NX-OS software for the Cisco Nexus 7000 Series switches fulfills the routing, switching, and storage networking requirements of data centers and provides an Extensible Markup Language (XML) interface and a command-line interface (CLI) similar to Cisco IOS software. System Requirements This section includes the following topics: Hardware Supported, page 3 Memory Requirements, page 3 Supported Device Hardware, page 3 2

3 System Requirements Hardware Supported The Cisco NX-OS software supports the Cisco Nexus 7000 Series chassis. You can find detailed information about supported hardware in the Cisco Nexus 7000 Series Hardware Installation and Reference Guide. Memory Requirements The Cisco NX-OS software requires 4 GB of memory. Supported Device Hardware Cisco NX-OS Release 4.2(1) and later releases support management and monitoring of the Cisco Nexus 7010 switch and Cisco Nexus 7018 switch. Although you can use Cisco NX-OS Release 4.0 to manage a Cisco Nexus 7010 switch, you must use Cisco NX-OS Release 4.1(2) or later releases to manage a Cisco Nexus 7018 switch, the 7.5-kW AC power supply unit, and the 48-port 1-Gigabit SFP I/O module. Cisco NX-OS Release 5.0(2a) or a later release is required to manage the 8-port Gigabit Ethernet I/O module XL and the 48-port Gigabit Ethernet I/O module XL. The default behavior of the XL modules is the same as it is for the non-xl modules. Depending on the chassis, the Cisco Nexus 7010 Scalable Feature Package license (N7K-C7010-XL) or the Cisco Nexus 7018 Scalable Feature Package license (N7K-C7018-XL) is required to enable all XL-capable I/O modules to operate in XL mode. Cisco NX-OS Release 5.0 introduces support for the 6.0-kW DC power supply and the DC power interface unit. Table 2 shows the hardware supported by Cisco NX-OS Release 5.0 and all Cisco NX-OS Release 4.x software. Table 3 shows the transceivers supported by each release. Table 2 Hardware Supported by Cisco NX-OS Software Releases Cisco NX-OS Release 4.1(2) through 4.2(4) Support Hardware Part Number Cisco NX-OS Release 4.0 Support Cisco Nexus 7010 chassis N7K-C7010 X X X Cisco Nexus 7018 chassis N7K-C7018 X X Supervisor module N7K-SUP1 X X X Fabric module, Cisco Nexus 7000 Series 10-slot N7K-C7010-FAB-1 X X X Fabric module, Cisco Nexus 7000 Series 18-slot N7K-C7018-FAB-1 X X 8-port 10-Gigabit Ethernet I/O module XL 1 N7K-M108X2-12L X 48-port 1-Gigabit Ethernet I/O module XL 1 N7K-M148GS-11L X 48-port 10/100/1000 Ethernet I/O module N7K-M148GT-11 X X X 48-port 1-Gigabit Ethernet SFP I/O module N7K-M148GS-11 X X 32-port 10-Gigabit Ethernet SFP+ I/O module N7K-M132XP-12 X X X Cisco NX-OS Release 5.0(2) through 5.0(5)Support 3

4 System Requirements Table 2 Hardware Supported by Cisco NX-OS Software Releases (continued) Hardware System fan tray for the Cisco Nexus 7010 chassis N7K-C7010-FAN-S X X X Fabric fan tray for the Cisco Nexus 7010 chassis N7K-C7010-FAN-F X X X Fan tray for the Cisco Nexus 7018 chassis N7K-C7018-FAN X X 6.0-kW AC power supply unit N7K-AC-6.0KW X X X 7.5-kW AC power supply unit 6.0-kW DC power supply unit (cable included) DC power interface unit DC 48 V-48 V cable (spare) Part Number N7K-AC-7.5KW-INT N7K-AC-7.5KW-US N7K-DC-6.0KW N7K-DC-PIU N7K-DC-CAB= Cisco NX-OS Release 4.0 Support 1. Requires the Cisco Nexus 7010 Scalable Feature Package license (N7K-C7010-XL) or the Cisco Nexus 7018 Scalable Feature Package license (N7K-C7018-XL), depending on the chassis, to enable all XL-capable I/O modules to operate in XL mode. Cisco NX-OS Release 4.1(2) through 4.2(4) Support X X Cisco NX-OS Release 5.0(2) through 5.0(5)Support X X X X Table 3 Transceivers Supported by Cisco NX-OS Software Releases I/O Module Transceiver Type Product ID Minimum Software Version N7K-M108X2-12L 10GBASE-X X2 X2-10GB-SR 5.0(2a) X2-10GB-LR 5.0(2a) X2-10GB-LRM 5.0(2a) X2-10GB-ER 5.0(2a) N7K-M108X2-12L 10GBASE-DWDM X2 DWDM-X = 5.0(2a) 4

5 System Requirements Table 3 Transceivers Supported by Cisco NX-OS Software Releases (continued) I/O Module Transceiver Type Product ID Minimum Software Version DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) DWDM-X = 5.0(2a) 5

6 System Requirements Table 3 Transceivers Supported by Cisco NX-OS Software Releases (continued) I/O Module Transceiver Type Product ID Minimum Software Version N7K-M148GS BASE-CWDM CWDM-SFP (1) CWDM-SFP (1) CWDM-SFP (1) CWDM-SFP (1) CWDM-SFP (1) CWDM-SFP (1) CWDM-SFP (1) CWDM-SFP (1) 6

7 System Requirements Table 3 Transceivers Supported by Cisco NX-OS Software Releases (continued) I/O Module Transceiver Type Product ID Minimum Software Version N7K-M148GS BASE-DWDM DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) 7

8 Upgrade/Downgrade Caveats Table 3 Transceivers Supported by Cisco NX-OS Software Releases (continued) I/O Module Transceiver Type Product ID Minimum Software Version DWDM-SFP (1) DWDM-SFP (1) DWDM-SFP (1) N7K-M148GS BASE-SX SFP-GE-S 4.1(2) GLC-SX-MM 4.1(2) 1000BASE-LX SFP-GE-L 4.1(2) GLC-LH-SM 4.1(2) 1000BASE-ZX SFP-GE-Z 4.1(2) GLC-ZX-SM 4.1(2) 1000BASE-T GLC-T 4.2(1) SFP-GE-T 4.2(1) N7K-M148GS-11L 1000BASE-SX SFP-GE-S 5.0(2a) GLC-SX-MM 5.0(2a) 1000BASE-LX SFP-GE-L 5.0(2a) GLC-LH-SM 5.0(2a) 1000BASE-ZX SFP-GE-Z 5.0(2a) GLC-ZX-SM 5.0(2a) 1000BASE-T GLC-T 5.0(2a) SFP-GE-T 5.0(2a) N7K-M132XP Gbps SFP+ SFP-10G-ER 5.0(2a) SFP-10G-SR (short 5.0(2a) range) SFP-10G-LR (long 5.0(2a) range) 10GBASE-SR SFP-10G-SR 4.0(1) 10GBASE-LR SFP-10G-LR 4.0(3) Note Version -01 of X2-DWDM Fujitsu with serial number prefix ONJxxxxxxx can be used with the 8-port Gigabit Ethernet I/O module XL. All version -02 of X2-DWDM Fujitsu can be used as well. Upgrade/Downgrade Caveats The following caveats apply to the Cisco NX-OS Release 4.2(1) or later for the Cisco Nexus 7000 Series devices: Do not change any configuration settings or network settings during the upgrade. Any changes in the network settings may cause a disruptive upgrade. 8

9 CMP Images Release 5.0(5) is ISSU-compatible with Release 5.0(3, 5.0(2a), and 5.0(2) and with all 4.2(x) releases. Release 5.0(5) is not ISSU-compatible with 4.1(x) and 4.0(x) releases. You can nondisruptively downgrade from Cisco NX-OS Release 5.0(3) to Release 5.0(2a), Release 5.0(2), and to any 4.2(x) release. Downgrades to a 4.1(x) or 4.0(x) release are disruptive. CMP Images Cisco NX-OS Release 5.0(5) does not include a new image for the CMP. Cisco NX-OS Release 5.0(2a) includes a new image for the CMP. The CMP is upgraded to Release 5.0(2a) on a successful ISSU of Cisco NX-OS to Release 5.0(2a). EPLD Images Cisco NX-OS Release 5.0(5), Release 5.0(3) and Release 5.0(2a) use the Release 5.0(2) EPLD images. Many of the EPLD images were upgraded for Cisco NX-OS Release 5.0(2). To determine whether you need to upgrade the EPLD images on your Cisco Nexus 7000 Series switch, see the Cisco Nexus 7000 Series FPGA/EPLD Upgrade Release Notes, Release 5.0. Cisco DCNM Cisco Data Center Network Manager (DCNM) Release 5.0(2) supports Cisco NX-OS 5.0(5) and other software release versions depending on the Cisco Nexus platform. See the Cisco DCNM Release Notes, Release 5.0(2) for specific information about the Cisco Nexus platforms and software release versions that Cisco DCNM supports. New Software Features This section briefly describes the new features introduced in Cisco NX-OS Release 5.0 for the Cisco Nexus 7000 Series switches. For detailed information about the features listed, see the documents listed in the Related Documentation section on page 45. The New and Changed Information section in each of these books provides a detailed list of all new features and includes links to the feature description or new command. This section includes the following topics: Cisco NX-OS Release 5.0(5) Cisco NX-OS Release 5.0(3) Cisco NX-OS Release 5.0(2a) Cisco NX-OS Release 5.0(5) Cisco NX-OS Release 5.0(5) is a maintenance release and does not include any new features. 9

10 New Software Features Cisco NX-OS Release 5.0(3) This section briefly describes the new features introduced in Cisco NX-OS Release 5.0(3) for the Cisco Nexus 7000 Series switches and includes the following topics: Cisco Overlay Transport Virtualization, page 10 Cisco Overlay Transport Virtualization Cisco Overlay Transport Virtualization (OTV) is a MAC-in-IP method that extends Layer 2 connectivity across a core network infrastructure. OTV provides an overlay that enables Layer 2 connectivity between separate Layer 2 domains. Using MAC address-based routing and IP-encapsulated forwarding across a core network, OTV provides support for applications that require Layer 2 adjacency, such as clusters and virtualization. You deploy OTV on the edge devices in each site. OTV requires no other changes to the sites or the core network. In addition to having no impact on existing network design, OTV can deliver the following benefits: Failure isolation Failure boundaries and site independence are preserved so that sites are independent of each other and failures do not propagate beyond the OTV edge device. Optimized operations OTV uses a single protocol that simplifies site additions and removals. Optimal bandwidth utilization, resiliency, and scalability OTV allows for multipathing, seamless multihoming with built-in loop prevention, and multipoint connectivity in a point-to-cloud model. Seamless migration path Because OTV is transparent to the core network, it can be incrementally deployed over an existing topology without altering the network design. OTV requires the Transport Services Package license. Cisco NX-OS Release 5.0(2a) This section briefly describes the new features introduced in Cisco NX-OS Release 5.0(2a) for the Cisco Nexus 7000 Series switches and includes the following topics: Bidirectional Forwarding Detection, page 11 IPv6 PMTU, page 11 IPv6 on CMP Interface, page 12 HSRP for IPv6, page 12 IPv6 Support in Object Tracking, page 12 CMP Enhancements, page 12 Q-in-Q VLAN Tunnels, page 12 Promiscuous Trunk Port, page 12 Secondary Private VLAN Trunks, page 12 LLDP, page 13 VRF Support in DHCP, page 13 NPE Image, page 13 Time Domain Reflectometer, page 13 10

11 New Software Features IS-IS Non Stop Routing, page 14 Per-command Authorization for TACACS+, page 14 AAA Enhancements, page 14 NTP Enhancements, page 14 VPC Enhancement, page 15 VPC Peer Switch Feature, page 15 Route Policy Manager Enhancements, page 15 Call Home, page 15 SSH Enhancements, page 15 IEEE 802.1x Enhancements, page 16 Configurable Maximum Fabric Modules Per System, page 16 Display of Power Draw for Modules and Fan, page 16 Fan Embedded Event Manager Policies, page 16 Bidirectional Forwarding Detection Bidirectional Forwarding Detection (BFD) provides low-overhead, short-duration detection of failures in the path between adjacent forwarding engines. In Cisco NX-OS Release 5.0(2a), BFD has been enhanced to detect bidirectional forwarding failures in subsecond time. BFD is a fixed-length hello protocol, in which each end of a connection transmits packets periodically over a forwarding path. Cisco NX-OS supports BFD adaptive detection times. In addition, Cisco NX-OS supports BFD (version 1) for the verification of IPv4 single-hop connectivity. Cisco NX-OS supports asynchronous mode. BFD works over Gigabit Ethernet, 10 Gigabit Ethernet, and port channel interfaces. BFD can be used with the following features and protocols: Static routes Border Gateway Protocol (BGP) Intermediate System-to-Intermediate System (IS-IS) Open Shortest Path First (OSPF) Enhanced Interior Gateway Routing Protocol (EIGRP) Hot-Standby Router Protocol (HSRP) Protocol Independent Multicast (PIM) IPv6 PMTU IPv6 path MTU (PMTU) uses larger TCP Max Segment Size while communicating with peers that are not directly connected. The result is better performance in the form of higher data throughput on the connections. 11

12 New Software Features IPv6 on CMP Interface The following IPv6 features are available on the Connectivity Management Processor (CMP) interface: IPv6 support on CMP management interface Ability to configure IPv6 from startup scripts Telnet and SSH reachability to CMP through IPv6 Ping6 and Traceroute6 support on CMP HSRP for IPv6 Cisco NX-OS Release 5.0 supports the Hot Standby Routing Protocol for IPv6 (HSRPv6). This support includes link-layer address as well as global IPv6 address support. IPv6 Support in Object Tracking With this enhancement, objects tracked now include static as well as dynamic IPv6 routes. Cisco NX-OS Release 5.0 also supports IPv6 routing on interfaces, similar to IPv4. CMP Enhancements The Connectivity Management Processor (CMP) that is included on the Cisco Nexus 7000 Series supervisor module, now supports the following features: Cisco Discovery Protocol (CDP) Front-panel console monitoring Q-in-Q VLAN Tunnels A Q-in-Q VLAN tunnel enables a service provider to segregate the traffic of different customers in their infrastructure, while still giving the customer a full range of VLANs for their internal use by adding a second 802.1Q tag to an already tagged frame. Promiscuous Trunk Port Beginning with Cisco NX-OS Release 5.0(2a), you can configure a Layer 2 interface as a private VLAN promiscuous trunk port and then associate that promiscuous trunk port with multiple primary VLANs. These promiscuous trunk ports carry traffic for multiple primary VLANs as well as normal VLANs. Secondary Private VLAN Trunks In addition to promiscuous trunk ports, Cisco NX-OS Release 5.0(2a) supports another form of private VLAN trunks called secondary trunk ports. These ports can carry traffic of multiple isolated VLANs, as well as normal VLANs on the same trunk port. The traffic of the associated primary VLAN is translated to the respective isolated VLAN before it leaves the trunk port. 12

13 New Software Features LLDP The Cisco Discovery Protocol (CDP) is a device discovery protocol that runs over the data-link layer (Layer 2) on all Cisco-manufactured devices (routers, bridges, access servers, and switches). CDP allows network management applications to automatically discover and learn about other Cisco devices that are connected to the network. To permit the discovery of non-cisco devices, the switch also supports the Link Layer Discovery Protocol (LLDP), a vendor-neutral device discovery protocol that is defined in the IEEE 802.1ab standard. LLDP allows network devices to advertise information about themselves to other devices on the network. This protocol runs over the data-link layer, which allows two systems running different network layer protocols to learn about each other. LLDP is a one-way protocol that transmits information about the capabilities and current status of a device and its interfaces. LLDP devices use the protocol to solicit information only from other LLDP devices. LLDP supports a set of attributes that it uses to discover other devices. These attributes contain type, length, and value (TLV) descriptions. LLDP devices can use TLVs to send and receive information to other devices on the network. Details such as configuration information, device capabilities, and device identity can be advertised using this protocol. VRF Support in DHCP In typical network deployments, multiple VPNs and VPN routing and forwarding (VRF) instances are serviced by one single network element (such as a router) where a relay agent can exist. It might be desirable to have just one Dynamic Host Configuration Protocol (DHCP) server placed in one VRF to cater to all the clients in different VRFs. This configuration enables a network administrator to conserve address space by allowing overlapping addresses. In Cisco NX-OS Release 5.0(2a), the relay agent can now support multiple clients on different VPNs, and many of these clients from different VPNs can share the same IP address. NPE Image Cisco NX-OS Release 5.0(2a) provides a no payload encryption (NPE) image for countries who have import restrictions on products that encrypt payload data. The NPE image supports all Cisco NX-OS features included in Release 5.0(2a) except Cisco Trusted Security (CTS). To differentiate the NPE image from the standard software image, the letters npe are included in the image name as follows: n7000-s1-dk9-npe bin. Time Domain Reflectometer A Time Domain Reflectometer (TDR) can be used to find physical layer network problems such as cable faults. TDRs give network administrators the ability to remotely diagnose a cable failure. As a result, they can quickly and effectively identify the root cause of a problem and provide users with a prompt response to their connectivity problems. Moreover, with cable diagnostic capabilities now embedded directly on the Cisco Nexus 7000 Series modules, it is no longer necessary to unplug cables and connect cable testers to diagnose a link fault. The ports on each module can independently detect cabling problems and report them to the switch software. The TDR feature is available only on the 48-port Gigabit Ethernet I/O module XL, N7K-M148GS-11L. 13

14 New Software Features IS-IS Non Stop Routing This feature combines stateful high availability with graceful restart support for the Intermediate System-to-Intermediate System (IS-IS) protocol to maintain routing sessions during switch supervisor switchover. As a result, there is zero downtime during system upgrades (ISSU) and disruptions. Per-command Authorization for TACACS+ The current Cisco NX-OS software provides local and remote authentication and command authorization using local RBAC roles and does not support any means for commands to be verified by a server outside the switch. The capability to verify users (authentication) and commands (authorization) using a TACACS+ server is now supported in Cisco NX-OS Release 5.0(2a). This feature provides IOS like privilege levels and two stage authentication using the new enable secret password command. This capability allows network administrators to leverage existing TACACS+ policies for both IOS and NX-OS devices simultaneously. AAA Enhancements Authentication, authorization, and accounting (AAA) has been enhanced with the following capabilities: Per-command authorization with roles for AAA AAA Challenge Handshake Authentication Protocol (CHAP) authentication Lightweight Directory Access Protocol (LDAP) and Microsoft Active Directory support for AAA Support for an OTP (OneTimePassword) scheme for the AAA infrastructure Enhancement to enable or disable fallback to local if remote authentication fails Support added in the SNMP MIB to get the list of logged in users Capability to configure test parameters at the AAA group level instead of having to set them up individually for each server in the AAA group Capability to enable AAA accounting on LOGFLASH for the Cisco Nexus 7000 Series NTP Enhancements Cisco NX-OS Release 5.0(2a) includes the following Network Time Protocol (NTP) enhancements: NTP ACLs The NTP access group can be used to specify the servers and peers from which time responses are accepted. These lists are built on the ACL infrastructure of Cisco NX-OS. NTP authentication Authentication support allows the NTP client to verify that servers are known and trusted and not intruders intending accidentally or intentionally to masquerade as legitimate servers. NTP authentication uses symmetric key cryptography. NTP logging and debugging With logging enabled, significant NTP daemon events (such as synchronization to a server or a clock reset) are logged. 14

15 New Software Features ACL Logging on Management Interfaces The ACL log feature allows you to monitor flows that hit specific ACLs. You can configure specific ACLs with the logging option. When such an option is configured, statistics for each flow that matches the permit or deny conditions of the ACL entry are logged in software. VPC Enhancement Virtual Port Channel (VPC) now allows new ports to be enabled on the vpc primary switch when the peer link is down. VPC Peer Switch Feature Cisco NX-OS Release 5.0(2) includes the vpc peer switch feature. This feature allows a pair of Cisco Nexus 7000 Series devices to appear as a single STP root in the Layer 2 topology. The vpc peer switch feature eliminates the need to pin the STP root to the vpc primary switch and improves vpc convergence if the vpc primary switch fails. This feature can be used with these topologies: The pure peer switch topology in which the devices all belong to the vpc. The hybrid peer switch topology in which there is a mixture of vpc and non-vpc devices in the configuration Route Policy Manager Enhancements The following new commands support the route policy manager: match metric command match mac command match vlan command Call Home The Call Home feature has been enhanced and now offers these capabilities: Multiple SMTP server capability with Call Home. Call Home messages for process failures on a module. Enhancement for syslog alerts. VRF support for the HTTP transport. SSH Enhancements The enhancements to Secure Shell (SSH) include the following: Support for the SSH command in boot mode. 15

16 New Software Features PKI X509 certificate support for SSH. File copy without a password to an SCP server. IEEE 802.1x Enhancements Cisco NX-OS Release 5.0(2a) includes the following IEEE 802.1x features: Support for dot1x on port channels Enhancements related to Protected Access Credential (PAC) provisioning Configurable Maximum Fabric Modules Per System Cisco NX-OS reserves power for all five fabric modules in the Cisco Nexus 7000 Series. This feature allows customers to release some of the reserved power, by allowing power to the configured fabric module. Fabric modules in slots that are unsupported are kept powered down. Display of Power Draw for Modules and Fan Support is now provided to display the actual power draw for newer modules like the Cisco Nexus 7000 Series 48-Port Gigabit Ethernet XL module and 8-Port 10 Gigabit Ethernet XL module. Support is also provided to display the estimated power draw for the fan. Fan Embedded Event Manager Policies Cisco NX-OS Release 5.0(2a) supports the new Embedded Event Manager (EEM) policies. The following EEM policies apply to the Cisco Nexus 7010 switch: The fan table speed is capped at a lower value, and the maximum reserved power for the fan can be reduced. Fan table mappings at various speeds have changed. The fan shutdown policy for the 10-slot chassis has changed as follows: If a system fan is removed: Earlier releases shut off the other fan in 3 minutes. The new policy is to increase the speed of the other fan based on the table mapping. If a fabric fan is removed: Earlier releases shut off the other fan in 3 minutes. The new policy is to increase the speed of the other fan to the maximum. Hysteresis: fan speed is controlled by temperature. If the temperature increases too high, the fan speed is increased to cool down. If successful, the fan speed is not reduced until the temperature is reduced. The following EEM policies apply to the Cisco Nexus 7018 Switch: The fan table speed is capped at a lower value, and hence the maximum reserved power for the fan can be reduced. Fan table mappings at various speeds have changed. The fan shutdown policy has not changed. 16

17 Licensing Hysteresis: fan speed is controlled by temperature. If the temperature increases too high, the fan speed is increased to cool down. If successful, the fan speed is not reduced until the temperature is reduced. Licensing Cisco NX-OS Release 5.0(3) includes one new license that is described in the following section: Transport Services Package, page 17 Transport Services Package The Transport Services Package license is required to use the Overlay Transport Virtualization (OTV) feature that is being launched in Cisco NX-OS Release 5.0(3). Cisco NX-OS Release 5.0(2a) includes one new license that is described in the following section: Scalable Feature Package, page 17 Scalable Feature Package The Cisco Nexus 7000 Series Scalable Feature Package license provides the flexibility to enable system-wide XL capabilities without requiring a hardware module change or upgrade. A single license per system enables all XL-capable I/O modules to operate in XL mode. After the single system license is added to a system, all modules that are XL capable are enabled with no additional licensing. MIBS The following MIBs are supported: IP-MIB (RFC-2011) IP Forwarding Table (RFC4292) UDP MIB (RFC4113) The following MIBs have been enhanced to include the notifications listed below each MIB name: CISCO-SYSTEM-EXT-MIB cseharestartnotify cseshutdownnotify csefailswcorenotify csefailswcorenotifyextended ciscoswfailurenotifenable CISCO-ENHANCED-MEMPOOL-MIB ModuleInstalledMemory ModuleSystemHeapFree Dynamically load/unload MIB 17

18 Limitations CiscoConfigManMIB ccmhistoryrunninglastsaved ccmhistorystartuplastchanged ccmhistoryrunninglastchanged Limitations This section describes the limitations in Cisco NX-OS Release 4.2(1) for the Cisco Nexus 7000 Series switches. This section includes the following topics: vpcs, page 18 XML Management Interface, page 19 QoS, page 19 Rollback, page 19 Port Profiles, page 19 GOLD, page 19 Multicast over Tunnel Interfaces, page 19 Syslog Message Indicates SAP Failure, page 20 vpc Peer Link Inconsistency Messages, page 20 VDC Snapshot Files are Saved in bootflash, page 20 The Number of SXP Connections Exceeds the Limit, page 20 Stale V6 Adjacencies Are Recovered Following an ISSU, page 20 Old Switch Name Appears Following Write Erase, page 21 A Version Mismatch Syslog Message Displays Following an ISSD, page 21 NTP Errors Display During a Switchover, page 21 Packet Forwarding in a vpc with a HSRP V6 Group, page 21 vpcs Cisco NX-OS Release 4.2(1) for Cisco Nexus 7000 Series switches supports up to 256 vpcs per device. 18

19 Limitations The Cisco NX-OS software for Cisco Nexus 7000 Series switches does not support PIM SSM or BIDIR on vpcs; PIM ASM is fully supported. XML Management Interface You must enable the Secure Shell (SSH) server on the device to use the XML management interface because this is a mandatory requirement of the NETCONF Configuration Protocol (RFC 4741). QoS The Cisco NX-OS software does not support Quality of Service (QoS) policing on Layer 2 interfaces in the egress direction, only ingress. Rollback In Cisco NX-OS Release 4.1(4) and later releases, if you configure the Cisco NX-OS device while an atomic rollback is in progress, the rollback operation fails. Port Profiles In Cisco NX-OS Release 4.2(1), port profiles do not support Layer 3 (routing and routing protocol) commands nor CTS commands. A maximum of 512 interfaces can inherit a single port profile. The system allows only one level of inheritance for all commands for the following functions: switchport private-vlan mapping private-vlan mapping To inherit port profiles, you must have the same configuration settings for the following: switchport medium p2p GOLD In Cisco NX-OS Release 4.2(1), the PortLoopback test is deprecated on the N7K-M148GS-11 module. Multicast over Tunnel Interfaces In Cisco NX-OS Release 4.2(1) and later releases, tunnel interfaces do not support Protocol-Independent Multicast (PIM). 19

20 Limitations Syslog Message Indicates SAP Failure During a Service Access Point (SAP) negotiation on a port that is shut, the following syslog message might display: CTS_SAP_REKEY_FAILED: SAP exchange failed on interface Ethernet8/8. (Reason: CTS hardware programming failure (for action: number)) This message might be triggered when the port is in an Auth Pending state or an SAP rekey is occurring on the port. There is no impact to functionality associated with this message. Enter the no shut command if you see this message and all operations continue normally. This limitation is associated with CSCtg vpc Peer Link Inconsistency Messages In a large scale vpc configuration, operations triggered by the shut command and no shut command on on a peer link, or the reload of secondary switch may cause peer link inconsistency messages to be displayed. The messages appear for a transient period until convergence is achieved. No action is required if you see these messages because the system converges automatically. This limitation is associated with CSCtf VDC Snapshot Files are Saved in bootflash When you create a VDC, a snapshot file is saved in bootflash and remains there even after the VDC is deleted. You can manually delete the snapshot file if it is not needed. This limitation is associated with CSCte The Number of SXP Connections Exceeds the Limit If you have more than 984 SXP connections configured, your system may get extremely busy and nonresponsive. If this occurs, remove some of the SXP connections to get the number of connections under 984. The system does not support more than 984 SXP connections. This limitation is associated with CSCtf Stale V6 Adjacencies Are Recovered Following an ISSU If you perform an ISSU to Cisco NX-OS Release 5.0(2a) from NX-OS Release 4.2(4), any stale V6 adjacencies that exist in persistent storage service (PSS) are recovered. You can enter the clear ip adjacency command to clear these adjacencies. This limitation is associated with CSCtg

21 Limitations Old Switch Name Appears Following Write Erase If you boot the kickstart image on a switch, do a write erase, and then load the ISAN image without reloading the switch, the switch comes up with the old switch name. If this occurs, you should reload the switch following the write erase; otherwise, after you load the ISAN image, you can enter the switchname command to change the switch name. This limitation is associated with CSCsz A Version Mismatch Syslog Message Displays Following an ISSD If you perform an ISSD from Cisco NX-OS Release 5.0(2a) to any version lower than Cisco NX-OS Release 4.2(2), a syslog message displays that indicates a PSS1 version mismatch. This message is harmless and does not affect functionality. Any version lower than Cisco NX-OS Release 4.2(1) detects this situation and fixes it without user intervention. Cisco NX-OS Release 4.2(2) detect the situation and fixes it, but does not display a syslog message. This limitation is associated with CSCtd NTP Errors Display During a Switchover During a switchover, the following message displays when the NTP daemon comes up Apr 9 13:10:32 qadc3-ind18 %$ VDC-1 %$ ntpd[5251]: ntp:getconfig: Couldn't open </etc/ntp.conf> This message is informational. Traditionally the NTP configuration is provided by etc/ntp.conf, but this file is not present on the system. On a Cisco Nexus 7000 Series switch, the NTP configuration is provided through the CLI. This limitation is associated with CSCtg Packet Forwarding in a vpc with a HSRP V6 Group In a vpc, packets that are forwarded through an HSRP virtual IP address (VIP) or virtual MAC address (VMAC) might fail. This situation can occur if a VLAN that is in a vpc has a HSRP V6 group and has the use-bia option enabled on an interface. Layer 3 traffic will be disrupted and packets might not reach the VIP. Removing the use-bia option from the interface in the vpc should correct this issue. 21

22 Caveats Caveats This section includes the following topics Open Caveats Cisco NX-OS Release 5.0, page 22 Resolved Caveats Cisco NX-OS Release 5.0(5), page 29 Resolved Caveats Cisco NX-OS Release 5.0(3), page 32 Resolved Caveats Cisco NX-OS Release 5.0(2a), page 41 Resolved Caveats Cisco NX-OS Release 5.0(2), page 41 Open Caveats Cisco NX-OS Release 5.0 This section includes the following open caveats: CSCsm22329 Symptom: QoS statistics require a policing action to allow marking actions to produce statistics. Conditions: When you define a QoS service policy with only marking actions, the statistics do not work. The statistics feature works only when the service policy has a policing action defined also. Workaround: You can get statistics for a marking-only policy by applying a dummy policing action to the policies. For example, in addition to the marking actions, you should define a policing action that permits 100 percent traffic. Configure the violate and conform action as transmit. CSCta03634 Symptom: All member objects of a track list are lost after a configuration rollback. Conditions: This symptom occurs only when tracking objects of type track list. The sequence of events that trigger this symptom are as follows: 1. Create a track list with some number of objects configured as members of the track list. 2. Create a checkpoint. 3. Roll back to the created checkpoint. Workaround: Save the running configuration in a file and restore the configuration from the saved file. CSCta32738 Symptom: Under certain conditions, TrustSec 802.1AE security negotiations between ports might not complete successfully. Conditions: You might see this symptom if you have 10-Gbps ports running in full rate dedicated mode as part of a port channel with the Cisco TrustSec 802.1AE Encryption/Authentication feature enabled. Workaround: Enter the shutdown command on the port, change the port to shared mode, and then enter the no shutdown command. 22

23 Caveats CSCta58181 Symptom: When you specify a MAC ACL for a WCCP redirect-list and/or service-list of a service group and that ACL is applied to an interface, the SBADDFAIL syslog appears to indicate an invalid ACL. After you receive this error and you change the redirect ACL, the WCCP redirect for the service group is not programmed in the hardware. The syslog is as follows: Event:E_DEBUG, length:124, at usecs after Thu Jul 9 00:38: [105] WCCP-EVNT: Send to SPM: Req Id:0x18cb62, Policy ID:0, OpMode:DEL, Inte rface:all, Type:Match node update, Match id: 417 Event:E_DEBUG, length:74, at usecs after Thu Jul 9 00:38: [105] WCCP-EVNT: vrf default service 61: Request to DELETE Redirect-List <> Event:E_DEBUG, length:190, at usecs after Wed Jul 8 23:58: [105] WCCP-EVNT: Rx from SPM: Req id:0x17f5fe, Policy ID:1, OpMode:ADD, Inte rface:ethernet9/1, Type:INGRESS Redirect, Request status:failed, Error code:0x f, Error string:invalid format Event:E_DEBUG, length:116, at usecs after Wed Jul 8 23:58: [105] WCCP-EVNT: Send to SPM: Req id:0x17f5fe, Policy ID:1, OpMode:ADD, Inte rface:ethernet9/1, Type:INGRESS Redirect Event:E_DEBUG, length:80, at usecs after Wed Jul 8 23:58: [105] WCCP-EVNT: vrf default service 61: Request to ADD Conditions: You might see this symptom when you use a MAC ACL (not an IP ACL) to specify the service-list or redirect-list. Workaround: Remove the WCCP redirect on the interface. The SBDELFAIL syslog will appear with the following message: invalid id to SPM. Ignore this syslog message, and reconfigure the service group with the proper IP redirect ACL name. Then, reapply the WCCP redirect on the interface. CSCta65195 Symptom: The ping command to a First Hop Redundancy Protocol (FHRP) virtual IP address from an external device may fail. Conditions: This problem occurs when you enable Strict Unicast reverse path forwarding (RPF) on FHRP interfaces, and the response from the ping command is forced to take the path using a standby/listen or backup router. To confirm if this symptom exists in your system, enter the ping command to a virtual IP address from the same source with unicast RPF disabled on FHRP-enabled interfaces; check if the ping command succeeds. Workaround: Reconfigure the RPF to loose RPF. CSCtb67491 Symptom: When DHCP configuration ACLs are applied to a module that has an incompatible configuration or insufficient resources, the DHCP snooping service displays the message: DHCP_SNOOP-3-HWPGMFAILURE. This behavior is expected. However, when the incompatible 23

24 Caveats configuration or resource restriction is removed, subsequent DHCP configurations will not take affect on such modules and therefore no redirect ACLs are programmed. As a result, DHCP snooping or relay does not work as expected. Conditions: This symptom occurs only where there is an incompatible configuration (such as resource pooling for example, which is not supported with the DHCP feature) or insufficient resources on the module, and the DHCP configuration is applied within the first 30 seconds of enabling DHCP with the feature DHCP command. This symptom may also occur when the module reloads and incompatible DHCP configuration are applied automatically by the DHCP feature. Workaround: To avoid this issue, enable DHCP by entering the feature dhcp command, and then wait 30 seconds before applying the same configuration. Otherwise if you have already experienced this issue, take the following steps: 1. Remove the incompatible feature, such as resource pooling, or address the insufficient resource issue. 2. Enter the no feature dhcp command to disable the DHCP feature. 3. Enter the feature dhcp command to enable the DHCP feature. 4. Wait for 30 seconds and then resume the configurations. CSCtd59280 Symptom: Following a restart, OSPF v3 fails to generate an intra-area Link Service Advertisement (LSA) from the IPv6 loopback interface if there are no IPv4 addresses on the interfaces. Conditions: You might see this symptom if you do not have any IPv4 addresses on the loopback interfaces. Workaround: Configure an IPv4 address on a loopback interface. CSCtd86861 Symptom: DOM (Digital Optical Monitoring) is disabled for X2 transceivers with the manufacturer s part number QFBR-7502-CS3 because these X2 transceivers do not support DOM. Workaround: Use X2 transceivers with the manufacturer s part number QFBR-7502-CS4 because these transceivers support DOM and DOM is enabled for them. CSCte50182 Symptom: Layer 2 Protocol Tunneling (L2PT) is not part of the vpc consistency check across 802.1Q tunnel ports. Conditions: You might see this symptom under these conditions: L2PT is enabled on a 802.1Q tunnel port on a local switch. An 802.1Q tunnel port without L2PT is configured on the vpc peer switch. These ports part of a vpc. The vpc consistency check does not report an error about the missing L2PT configuration on one of the ports that is part of the vpc. Workaround: Ensure that all 802.1Q tunnel ports that are part of the vpc have the same L2PT configuration on both vpc peers. 24

25 Caveats CSCte73854 Symptom: Layer 2 Protocol Tunneling (L2PT) does not work for Spanning Tree Protocol (STP), VLAN Trunking Protocol (VTP), or Cisco Discovery Protocol (CDP) packets coming in on a Cisco Trusted Security (CTS) link to 802.1Q tunnel ports. Conditions: Enable L2PT on a 802.1Q tunnel port for all supported protocols. Connect the 802.1Q tunnel port onto a trunk port (customer side) that has CTS enabled. L2PT drops all the STP/CDP/VTP frames coming in on the 802.1Q tunnel port because the bridge protocol data units (BPDUs) are encrypted. Workaround: None. CTS encrypts the payload of the BPDUs (including LLC or SNAP information) thereby making it difficult to identify the BPDU type in order to perform L2PT. Dot1AE encryption with SAP negotiation is not compatible with Q-in-Q tunnels. CSCtf14834 Symptom: Detecting a newly inserted SFP can take as long as 30 seconds. Conditions: This symptom might be seen on N7K-M148GT-11, the 48-Port Ethernet I/O module, if a majority of the ports are populated with Copper SFPs and the Copper SFP ports are configured as non-autonegotiate. Workaround: Wait for a minute before applying any configuration. CSCtg06552 Symptom: Under certain specific configuration conditions, the following syslog might be seen following a switch reload. None of the physical interfaces are visible in the output of the show interface command: VMM-2-VMM_TIMEOUT: VDC1: Service SAP 377 timed out in INSERT_SEQ sequence Conditions: You might see this symptom after a switch reload only when a previously entered copy running-config startup-config command was executed at the same time a configuration session mode command such as the verify command, commit command, or abort command was being processed from a different console or Telnet session. In addition, QoS configurations within the configuration session mode (created using the configuration session session-name command) must exist. This situation can occur in any VDC. Workaround: Avoid entering a copy running-config startup-config command at the same time when a verify command, a commit command, or an abort command is being processed. If you observe these symptoms after a switch reload, you can resolve the issue by following these steps: 1. Copy the configurations to a file in bootflash by entering the copy startup-config bootflash:filename command. 2. Erase the startup configuration by entering the write erase command. 3. Reload the switch. 4. After the system comes back up, restore the configuration by entering the copy bootflash:filename running-config command. 5. Save the configuration by entering the copy running-config startup-config command. CSCtg48283 Symptom: OTV overlay statistics are cumulative for all configured overlays. Conditions: This symptom might be seen when the same join interface is used by multiple overlays. 25

26 Caveats Workaround: Use a different join interface for each overlay. CSCtg51234 Symptom: There is a long multicast convergence after an OTV authoritative edge failover in dual-homed devices. Conditions: The symptom might be seen when there is a failure of the OTV authoritative edge device. Workaround: None. CSCtg79256 Symptom: All X2 optical transceivers takes 60 seconds to initialize. After inserting an X2 transceiver, the following syslog message displays: 2010 May 15 02:10:13 switch %ETHPORT-5-IF_HARDWARE: Interface Ethernet8/1, hardware type changed to Transceiver initialization in progress. Can take up to 60 seconds Conditions: You might see this symptom under normal operating conditions for a Cisco Nexus 7000 Series device. Workaround: Wait for 60 seconds after insertion of the X2 transceiver, and the Port state will change from xcvrinit to SFP Inserted state. CSCtg79396 Symptom: If there are more Bidirectional Forwarding Detection (BFD) sessions configured than the Cisco Nexus 7000 Series modules can handle, then a few sessions will not come up. Conditions: When the BFD protocol is hosted on a module, sessions on physical ports and their subinterfaces always run on the same module bearing the physical port. Sessions on logical ports, such as Layer 3 port channels, their subinterfaces, and SVIs are hosted on one of the modules bearing the carrier links, such as the port channel members or Layer 2 links. There is a limitation on the number of sessions that can be hosted per module. The number of sessions is restricted by the current packet per second (pps) processed by a module. At speed 50/50/3, the number is roughly 10,000 pps, and that module can host 250 sessions. The slower the sessions, the more sessions you can have and vice versa. In an oversubscription scenario where an administrator has configured more sessions than each module can handle, the sessions are hosted on a module on a first-come first-serve basis. As BFD sessions are symmetric, on both routers the same set of sessions needs to be hosted for them to work correctly. Those sessions that do not have a peer session hosted will fail to come up. Workaround: Do not configure more sessions than the host modules can support. If there are a large number of subinterfaces for a particular port, select the most important set of subinterfaces where BFD is needed and configure BFD only on those. CSCtg82227 Symptom: Preconfigured Enhanced Interior Gateway Routing Protocol (EIGRP) interface commands do not take effect after EIGRP has been enabled on an interface. Conditions: You might see this symptom if the configuration was done manually, starting with preconfigured commands. 26

27 Caveats Workaround: To work around this issue, enable EIGRP by entering the feature eigrp command, and then enter the ip router eigrp <tag> command on the interface before entering any other commands. CSCtg84010 Symptom: When daylight saving time is configured on a switch, creating a new user with an expiry date or modifying the expiry date for an existing user may fail, depending on the expiry date. Conditions: You might see this symptom under the following conditions: Daylight savings time (summer time) is configured. The current date and time on the switch is within the daylight savings time zone and the expiry date you are trying to configure is outside the daylight savings time zone and vice-versa. Workaround: To work around this issue, do one of the following: If the current time on a switch is within the daylight savings time zone, use an expiry date within the daylight savings time zone; otherwise, use an expiry date outside the daylight savings time zone. Remove the daylight savings time (summer time) configuration from the switch. Do not give an expiry date when creating a new user. CSCtg85564 Symptom: On a Cisco Nexus 7000 Series switch, the system LED on the supervisor modules turned amber following a cold boot of the system, even though all the modules, including the active supervisor module, came up fine. Conditions: You might see this symptom following a cold boot of a Cisco Nexus 7000 Series switch. Workaround: Perform a supervisor switchover to ensure that the system LED turns green. CSCtg92420 Symptom: When you enter the show interface command on the Cisco Nexus port 10-Gigabit Ethernet SFP+ I/O module, the output incorrectly displays storm suppression in packets rather than in bytes. Conditions: You might see this symptom only on the Cisco Nexus port 10-Gigabit Ethernet SFP+ I/O module. Workaround: Interpret storm suppression packets as storm suppression in bytes on the Cisco Nexus port 10-Gigabit Ethernet SFP+ I/O module. CSCtg93564 Symptom: HSRP IPv6 groups get into the initializing state when the interface primary global unicast IPv6 address is removed. Conditions: This symptom might be seen when the interface primary global unicast IPv6 address is removed and the HSRPv6 groups on that interface move into initializing state, even if they are not configured to use a global unicast virtual address. Workaround: To work around this issue, add the interface primary unicast IPv6 address back to the HSRPv6 groups, and the groups will resume operation. 27

28 Caveats CSCtg97144 Symptom: After an ISSU from any Cisco NX-OS Release 4.2(x) to Cisco NX-OS Release 5.0(2), if there is a switch reload, followed by a supervisor switchover, HSRP groups my go to INIT state. Conditions: This symptom may occur only if the running configuration is not saved to the startup configuration after the ISSU but before the switch reload. Workaround: Enter the copy running-config startup-config command to save the running configuration to the startup configuration after the ISSU to Cisco NX-OS Release 5.0(2) is complete, even if there are no changes to the configuration. CSCtg97784 Symptom: When you remove an egress queuing policy from a port channel interface, you might see the following error message: Note: Service policy with name <policy-map-name> does not exist in output direction on interface: <if-name> Conditions: You might see this symptom if the port channel contains a mix of ports from the 8-port Gigabit Ethernet I/O module XL (N7K-M108X2-12L) and the 32-port 10-Gigabit Ethernet SFP+ I/O module (N7K-M132XP-12), and there is an egress queuing policy applied to the port channel. Workaround: Apply the same egress queuing policy on all 8-port Gigabit Ethernet I/O module XL ports that are a part of the port channel. Then remove the policy from the port channel. CSCth02149 Symptom: A Bidirectional Forwarding Detection (BFD) session goes down and fails to come back up. Conditions: You might see this symptom after a supervisor switchover, followed by a switch reload. Workaround: Enter the shut command followed by the no shut command on the VLAN interface to bring up the BFD session again. CSCth45939 Symptom: IPv6 neighbor discovery does not work over the overlay. Conditions: This symptom might be seen when IPv6 neighbor discovery is sent over the overlay. Workaround: None. CSCth65452 Symptom: When you change the default VRF to the non-default VRF for the OTV join interface, traffic over the Unicast OTV GRE tunnel does not go through. In other words, Unicast traffic does not flow through the OTV sites that are connected by these internal OTV GRE tunnels. This issue does not occur if you use the default VRF for the OTV join interface. Conditions: You might see this symptom in NX-OS Release 5.0(3) when you change the default VRF to the non-default VRF for the OTV join interface. Workaround: Avoid changing the default VRF name to the non-default VRF name for the OTV join interface. 28