Allied Telesis Patch 86251-08 Mode d’emploi

Simply connecting the world

Patch Release Note

Patch 86251-08

For Rapier Series Switches

Introduction

This patch release note lists the issues addressed and enhancements made in

patch 86251-08 for Software Release 2.5.1 on existing models of Rapier L3

managed switches. Patch file details are listed in Table 1.

This release note should be read in conjunction with the following documents:

■Release Note: Software Release 2.5.1 for Rapier Switches (Document

Number C613-10354-00 Rev A) available from www.alliedtelesyn.co.nz/

documentation/documentation.html.

■Rapier Switch Documentation Set for Software Release 2.5.1 available on

the Documentation and Tools CD-ROM packaged with your switch, or

from www.alliedtelesyn.co.nz/documentation/documentation.html.

WARNING: Using a patch for a different model or software release may cause

unpredictable results, including disruption to the network. Information in this

release note is subject to change without notice and does not represent a

commitment on the part of Allied Telesyn International. While every effort has

been made to ensure that the information contained within this document and

the features and changes described are accurate, Allied Telesyn International

can not accept any type of liability for errors in, or omissions arising from the

use of this information.

Table 1: Patch file details for Patch 86251-08.

Base Software Release File 86s-251.rez

Patch Release Date 9-Dec-2003

Compressed Patch File Name 86251-08.paz

Compressed Patch File Size 545820 bytes

2Patch Release Note

Patch 86251-08 for Software Release 2.5.1

C613-10356-00 REV I

Some of the issues addressed in this Release Note include a level number. This

number reflects the importance of the issue that has been resolved. The levels

are:

Features in 86251-08

Patch 86251-08 includes all issues resolved and enhancements released in

previous patches for Software Release 2.5.1, and the following enhancements:

The device responded when it received a directed broadcast ICMP echo

request that was in its supernet, but not its subnet. This issue has been

resolved.

An incorrect object ID (OID) was being returned for Fan/PSU in SNMP v1

trap messages.This issue has been resolved.

Session-only counters have been added to the MIB entry for BGP peers.

Interoperating with other vendors implementations of ISAKMP was

occasionally causing errors following key exchanges. This relates to

differing implementations of the RFC regarding the retention of leading

zeros. This issue has been resolved by modifying the software to retain

leading zeros. An additional command provides compatibility with routers

that still use previous software versions. The command details are:

SET ENCO DHPADDING={ON|OFF}

This command controls the padding process for Diffie Hellman generated

values. This may be required when interoperability is required with other

vendor’s equipment that uses the Diffie Hellman algorithm.

The DHPADDING parameter specifies whether the Diffie Hellman

generated values should be padded or not. If ON is specified, then leading

zeros will be inserted into the generated values. If OFF is specified, then the

generated values will not be padded. The default is ON.

For example, to turn off the Diffie Hellman padding, use the command:

SET ENCO DHPADDING=OFF

Also, the output of the SHOW ENCO command now contains a new line

showing the setting for DHPADDING.

Level 1 This issue will cause significant interruption to network services, and

there is no work-around.

Level 2 This issue will cause interruption to network service, however there

is a work-around.

Level 3 This issue will seldom appear, and will cause minor inconvenience.

Level 4 This issue represents a cosmetic change and does not affect network

operation.

PCR: 03179 Module: IPG Level: 3

PCR: 03359 Module: CORE Level: 3

PCR: 03527 Module: BGP Level: 4

PCR: 03622 Module: ENCO Level: 2

Patch 86251-08 For Rapier Series Switches 3

Patch 86251-08 for Software Release 2.5.1

C613-10356-00 REV I

A fanAndPsRedundantFanTrap message was sent from a Rapier when the

RPS (Redundant Power Supply) was turned on or off, even though Rapiers

do not monitor the redundant fan status. This issue has been resolved.

The time recorded when a user logged in was overwritten when the same

user logged in a second time while the original connection was still active.

This meant the SHOW USER command displayed the same time for both

connections. This issue has been resolved.

Occasionally a fatal error occurred if BGP debug was disabled. Also, BGP

debug messages were sometimes still displayed after BGP debug was

disabled. These issues have been resolved.

A buffer leak occurred when rapid STP was specified with the SET STP

MODE=RAPID command, but STP had not been enabled with the ENABLE

STP command. This issue has been resolved.

When a file was copied, only blocks of 1024 bytes were copied successfully.

The remainder was discarded. This had two possible consequences. Either

a truncated file was created on the destination media, or the device restarted

with a fatal error. This issue has been resolved so that files copy correctly.

This PCR implements RFC 1256 “ICMP Router Discovery Messages”. This

enhancement allows the device to advertise its interface IP addresses to

local hosts. For details, see “ICMP Router Discovery Advertisements” on

page 47.

When a connector was plugged into one physical interface, the RIPng

request packet was erroneously transmitted from all interfaces on the

switch. This issue has been resolved.

The STATIC and INTERFACE options have been removed from the

PROTOCOL parameter in the ADD IP ROUTE FILTER and SET IP ROUTE

FILTER commands. These parameters were redundant because received

static and interface routes are always added to the route table.

Reverse enhanced NAT was not working for ICMP packets. This issue has

been resolved.

Repeated Assert messages were sent after the prune limit expired. This issue

has been resolved. The default dense mode prune hold time has been

changed from 60 seconds to 210 seconds.

PCR: 03684 Module: CORE Level: 4

PCR: 03726 Module: TTY, USER Level: 3

PCR: 03746 Module: BGP Level: 2

PCR: 03781 Module: STP Level: 2

PCR: 03856 Module: FIRE, UTILITY Level: 2

PCR: 03858 Module: IP

PCR: 03861 Module: IPV6 Level: 2

PCR: 03873 Module: IPG Level: 4

PCR: 03893 Module: FW Level: 3

PCR: 03926 Module: PIM Level: 2

4Patch Release Note

Patch 86251-08 for Software Release 2.5.1

C613-10356-00 REV I

ISAKMP debug messages now correctly output IPv6 addresses when using

IPv6, and IPv4 addresses when using IPv4.

The IP version of packets was not being checked, so an IPv4 packet could

match an IPv6 IPSec policy. This issue has been resolved.

On AT-8800 series switches, strict QoS scheduling is now enforced for ports

where egress rate limiting is applied. On Rapier i series switches, the same

QoS setup is now applied to all of the appropriate ports when setting up

egress rate limiting.

The ADD FIREWALL POLICY RULE and SET FIREWALL POLICY RULE

commands no longer accept the GBLREMOTEIP parameter with standard

NAT, or enhanced NAT for a private interface.

The PIM-DM prune expiry time was not reset when a State Refresh message

was received. This issue has been resolved.

IPv6 used the same SA soft expiry timer at both ends of a link, which used

memory unnecessarily. This issue has been resolved.

RIP did not send the correct next hop address if the route originated from a

different subnet to that of the egress interface. This issue has been resolved.

If an IPv6 filter that blocked traffic on a VLAN interface was removed, the

traffic was still blocked. This issue has been resolved.

When equal cost multipath routes were used, the IP option field for trace

route was not applied correctly. This issue has been resolved.

Occasionally an error occurred with OSPF’s route table calculation, so all

routes in the network were not discovered. The error only happened with a

network topology that involved connections between routers via both a

Point to Point link and a transit network link. This issue has been resolved.

A new command has been added that forces a route table recalculation by

rerunning the Shortest Path First calculation. The command is:

RESET OSPF SPF [DEBUG]

If DEBUG is specified, debugging information for the route table calculation

is output to the port from which the command was executed. SPF

debugging can be turned on for every route table calculation using the

ENABLE OSPF DEBUG=SPF command, but this will be overridden if

DEBUG is specified with the RESET OSPF SPF command.

PCR: 03935 Module: ISAKMP Level: 3

PCR: 03937 Module: IPSEC Level: 2

PCR: 03953 Module: SW56 Level: 3

PCR: 03958 Module: FIREWALL Level: 2

PCR: 03961 Module: PIM, PIM6 Level: 2

PCR: 03965 Module: IPSEC Level: 3

PCR: 03967 Module: IPG Level: 2

PCR: 03970 Module: IPV6 Level: 3

PCR: 03973 Module: IPG Level: 3

PCR: 03978 Module: OSPF Level: 3

Patch 86251-08 For Rapier Series Switches 5

Patch 86251-08 for Software Release 2.5.1

C613-10356-00 REV I

The SMTP proxy did not correctly filter sessions where messages were

fragmented. This had the potential to prevent the detection of third-party

relay attacks. This issue has been resolved.

Sometimes on Rapier series switches, a severe multicast or broadcast storm

depleted packet buffers, so the switch received packets intermittently. This

issue has been resolved.

In the output of the SHOW IP IGMP COUNTER command, the outQuery

and outTotal counters were always displaying “0”. This issue has been

resolved.

When executing the SET DHCP POLICY, DELETE DHCP POLICY and

DESTROY DHCP POLICY commands, memory was not de-allocated

correctly. This issue has been resolved.

Sometimes the device rebooted when a severe multicast storm occurred due

to a loop in the network. This issue has been resolved.

The server string was not copied correctly into an HTTP file request when

loading information from the configuration script. This issue has been

resolved.

If ports were set to a speed of 100m when creating a switch trunk, the speed

could not subsequently be set to 1000m, even if the ports were capable of

that speed. This issue has been resolved.

The PORT and PORTPRIORITY parameters of the STP PORT command

were not always updating switch instances on ports that are members of

multiple STP instances. This issue has been resolved.

The RootDispersion value in NTP packets was negative. RFC 1305 states that

only positive values greater than zero are valid. This issue has been

resolved.

The checksum for the PIMv2 Register message for IPv6 was not being

calculated correctly. This issue has been resolved.

When the switch received a generation ID change message, it was not

responding by sending a PIM HELLO message. This issue has been

resolved.

PCR: 03982 Module: FIREWALL Level: 3

PCR: 03985 Module: SWI Level: 2

PCR: 31000 Module: IGP Level: 3

PCR: 31001 Module: DHCP Level: 2

PCR: 31002 Module: UTILITY Level: 2

PCR: 31009 Module: HTTP Level: 3

PCR: 31013 Module: SWI Level: 2

PCR: 31015 Module: STP Level: 2

PCR: 31017 Module: NTP Level: 3

PCR: 31019 Module: PIM6 Level: 2

PCR: 031020 Module: PIM Level: 2

6Patch Release Note

Patch 86251-08 for Software Release 2.5.1

C613-10356-00 REV I

BGP did not always send Withdrawn advertisements when a route went

down. This issue has been resolved.

When two devices are BSR candidates, and have the same preference set

with the SET PIM BSRCANDIDATE PREFERENCE command, the device

with the higher IP address was not elected as the candidate. This issue has

been resolved.

A Prune message sent to an old RP neighbour was ignored when a new

unicast route was learned. This issue has been resolved.

The log message “IGMP Snooping is active, L3FILT is activated”

has been changed to “IGMP packet trapping is active, L3FILT is

activated”. The revised message is clearer when IGMP is enabled and

IGMP snooping is disabled.

The following changes have been made to the ADD FIREWALL POLICY

RULE and SET FIREWALL POLICY RULE commands:

• An IP address range for the IP parameter is now only accepted when

enhanced NAT is configured.

• An IP address range for GBLREMOTE parameter is now only accepted

when reverse or reverse-enhanced NAT is configured.

• The GBLIP parameter is not accepted for a public interface when

enhanced NAT is configured.

When the interval between the NTP server and client exceeded 34 years 9

days and 10 hours, the time set on the client was incorrect. This issue has

been resolved.

MVR was not operating if IGMP had not been enabled. This issue has been

resolved.

A fatal error occurred when the PURGE STP command was executed when

STP instances were defined with VLAN members. This issue has been

resolved.

PCR: 31028 Module: BGP Level: 2

PCR: 31040 Module: PIM Level: 2

PCR: 31041 Module: PIM Level: 3

PCR: 31044 Module: SWI Level: 4

PCR: 31052 Module: FIREWALL Level: 3

PCR: 31058 Module: NTP Level: 3

PCR: 31063 Module: IPG Level: 2

PCR: 31068 Module: STP Level: 2

Patch 86251-08 For Rapier Series Switches 7

Patch 86251-08 for Software Release 2.5.1

C613-10356-00 REV I

The warning given when a QoS policy is active on a port operating at

reduced speed has been changed to reflect the problem more accurately. The

old message was:

Warning (2087343): Port <Port num> is currently used in QoS

policy <QoS policy num>, this policy may become incorrect

due to the port bandwidth.

The new message is:

Warning (2087350): Port <Port num> is operating at less than

its maximum speed: this may affect QoS policy <QoS policy

num>.

If the DISABLE SWITCH PORT command appeared in the configuration

script, an interface could come up even though ifAdminStatus was set to

‘down’. This issue has been resolved.

When a ping was sent to the device’s link-local address, the device flooded

the ICMP Reply packet over the VLAN. This issue has been resolved.

This patch adds an enhancement that allows a Virtual Router IP address to

be adopted by the current master Virtual Router. This means that regardless

of whether the device actually ‘owns’ the IP address, it will respond to

specific service requests made to that IP address. The service requests are

ICMP echo (ping), Telnet, SSH, SNMP, HTTP server (GUI), and SSL for the

GUI. For details, see “Adopting the VRRP IP Address” on page 56.

Files with lines over 132 characters in length could not be transferred using

TFTP. This limit has now been raised to 1000 characters to match the

maximum command line length.

The SHOW FILE command caused an error when the displayed file had a

duplicate entry due to file size mismatch. This issue has been resolved. An

error message is now logged when the SHOW FILE command detects a

duplicate file. The first FFS file will be deleted when a duplicate exists.

Static DHCP address ranges were not reclaimed if the Reclaim operation was

interrupted by the interface going down. This issue has been resolved.

When a boot file for DHCP was specified with the ADD DHCP POLICY

FILE command, a blank space was added after the filename in the

configuration. This meant the file could not be found. This issue has been

resolved.

PCR: 31071 Module: SWI Level: 4

PCR: 31072 Module: SWI Level: 3

PCR: 31080 Module: IPV6 Level: 2

PCR: 31081 Module: VRRP, IP, TCP, TELNET,

HTTP, SNMP, SSH

PCR: 31094 Module: FILE Level: 3

PCR: 31096 Module: FFS Level: 3

PCR: 31098 Module: DHCP Level: 3

PCR: 31102 Module: DHCP Level: 2

8Patch Release Note

Patch 86251-08 for Software Release 2.5.1

C613-10356-00 REV I

When the device received a version 1 Query packet, it become a non-querier

on that interface, even if it should have remained as the querier. This issue

has been resolved.

When the TYPE parameter was specified for the ADD SWITCH L3FILTER

command, the type was sometimes a different value in the device’s

hardware table. This issue has been resolved.

A fatal error occurred if IPX was disabled and then re-enabled when there

was a high rate of incoming IPX traffic on the device. This issue has been

resolved.

A STP topology change incorrectly deleted static ARP entries. This issue has

been resolved.

IP MVR member ports were not timing out. MVR member ports now

timeout in the same way as IP IGMP ports. The timeout values are

configured by IGMP. Also, IGMP interfaces were incorrectly being enabled

and disabled by MVR. This issue has been resolved.

Features in 86251-07

Patch file details are listed in Table 2:

Patch 86251-07 includes all issues resolved and enhancements released in

previous patches for Software Release 2.5.1, and the following enhancements:

MLD snooping is now supported on AT-9800 Series Switches and Rapier i

Series Switches. For details, see “MLD Snooping” on page 57.

Support has been added for the Ping Polling enhancement. For details, see

“Ping Polling of Device Reachability” on page 58

PCR: 31106 Module: MLD Level: 2

PCR: 31118 Module: SWI Level: 2

PCR: 31129 Module: IPX2 Level: 2

PCR: 31162 Module: SWI Level: 2

PCR: 31167 Module: IPG Level: 2

Table 2: Patch file details for Patch 86251-07.

Base Software Release File 86s-251.rez

Patch Release Date 18-Sep-2003

Compressed Patch File Name 86251-07.paz

Compressed Patch File Size 487620 bytes

PCR: 02414 Module: IPV6, SWI, IPG, VLAN

PCR: 03445 Module: IPG

Patch 86251-08 For Rapier Series Switches 9

Patch 86251-08 for Software Release 2.5.1

C613-10356-00 REV I

OSPF disabled RIP unless RIP was activated using the SET OSPF RIP

command. This issue has been resolved.

Running the PURGE IP command with a multicast address and multiple

sources was causing a fatal error. This issue has been resolved.

The value specified for the IP parameter in the ADD FIREWALL POLICY

PROXY command was not being used by the HTTP proxy. This issue has

been resolved.

Previously, there was no limit to the number of concurrent ISAKMP

Security Associations (SAs), and occasionally new SAs were created until all

free memory was exhausted. This issue has been resolved. The number of

ISAKMP SAs is now limited to the maximum number of ENCO channels.

Also, if the ISAKMP policy’s REMOTEID was set as an X.500 distinguished

name (e.g. ocn=user), a small amount of memory was consumed by each

ISAKMP exchange. This issue has been resolved.

After about 250 days, commands such as SHOW BRIDGE COUNT were not

displaying the correct number of seconds for Uptime and Last Change At.

days. This issue has been resolved.

BGP and UPNP were not informed when an ETH interface went up or

down. This issue has been resolved.

Directed IPv6 PING messages were being transmitted from other interfaces

if the specified interface was down. This issue has been resolved.

With static multicasting enabled on two VLANs, only the first few multicast

packets of a stream were L3 forwarded. This issue has been resolved.

The MLD snooping entries registered on a port were not removed when the

port went down or was unplugged. This issue has been resolved.

The IP multicast counter did not increment when IGMP, DVMRP and PIM

packets were transmitted and received. This issue has been resolved.

PCR: 03524 Module: OSPF, IPG Level: 2

PCR: 03530 Module: IPG Level: 2

PCR: 03542 Module: HTTP Level: 2

PCR: 03570 Module: ISAKMP Level: 3

PCR: 03598 Module: ETH, IPG, IPv6, IPX,

PORT, PPP.

Level: 3

PCR: 03606 Module: IPG Level: 2

PCR: 03645 Module: OSPF, IPG Level: 2

PCR: 03734 Module: IPG Level: 2

PCR: 03751 Module: MLDS Level: 3

PCR: 03764 Module: IPG Level: 3

10 Patch Release Note

Patch 86251-08 for Software Release 2.5.1

C613-10356-00 REV I

Files used during start up were backed up from NVS to FLASH even if they

were already present in FLASH. This used up FLASH memory

unnecessarily. This issue has been resolved so that files are only backed up

when a copy does not already exist in FLASH.

If a configuration file had a long file name, the SHOW CONFIG command

displayed the file name using the shortened DOS 8.3 format (where file

names are 8 characters long, with extensions of 3 characters). This issue has

been resolved so that long configuration file names are now displayed using

the DOS 16.3 format (where file names are up to 16 characters long).

The TIMEOUT and SIZE parameters are only valid for the SET IP DNS

CACHE command, but no error message was returned if either parameter

was specified for the SET IP DNS command. This issue has been resolved.

Fragmentation of IPv6 packets now complies with RFC 2460’s requirement

to align packet sizes to 8 octets.

When a 4-port ETH PIC card was installed, the output of the SHOW IP

INTERFACE command showed the ETH port as Down, but the link LEDs

on the card were lit. This issue has been resolved. The SHOW command

now shows the correct link status. The link will go down after 90 seconds if

no inbound traffic is received. When inbound traffic is received the link will

come up.

Setting RSTPTYPE to NORMAL, when normal has already been set, sets all

ports to the “sending RSTP” state process. This is referred to in IEEE 802.1w

as mCheck.

When RSTPTYPE was changed from STPCOMPATIBLE to NORMAL with

the SET STP command, the STP instance continued to send STP BPDUs

until an mCheck was performed by entering the SET STP

RSTPTYPE=NORMAL command again. This issue has been resolved so

that when RSTPTYPE is set to NORMAL an mCheck is performed, causing

the STP to start sending RSTP BPDUs immediately.

MLD and MLD Snooping accepted MLD Query packets with a hop limit

greater than 1. Duplicate packets were forwarded when the hop limit was

not 1 and the payload was 0::0. This issue has been resolved. MLD and MLD

Snooping now require the hop limit to be 1.

Packets with bad ACK numbers were sometimes generated by the firewall

as part of the proxy TCP setup process. These packets sometimes caused

TCP sessions from the public side of the firewall to fail. This issue has been

resolved.

PCR: 03778 Module: FILE, INSTALL, SCR Level: 2

PCR: 03780 Module: INSTALL Level: 3

PCR: 03783 Module: IPG Level: 3

PCR: 03784 Module: IPV6 Level: 3

PCR: 03789 Module: ETH Level: 2

PCR: 03796 Module: STP Level: 2

PCR: 03801 Module: MLDS Level: 2

PCR: 03802 Module: FIREWALL Level: 1

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Allied Telesis Changer

Allied Telesis

Allied Telesis CentreCOM GS970M Series Manuel utilisateur

Allied Telesis

Allied Telesis AlliedWare Plus x950 Series Manuel utilisateur

Allied Telesis

Allied Telesis AT-DC2552XSL3 Manuel d'installation

Allied Telesis

Allied Telesis AT-9900 Series Mode d’emploi

Allied Telesis

Allied Telesis AT-9028 Manuel utilisateur

Allied Telesis

Allied Telesis z AT-8700XL Series Manuel utilisateur

Allied Telesis

Allied Telesis AT-GS950/10PS Manuel utilisateur

Allied Telesis

Allied Telesis IA Series Manuel utilisateur

Allied Telesis

Allied Telesis AT-FS717FC/SC Manuel utilisateur

Allied Telesis

Allied Telesis x330-52GTX Manuel utilisateur

Allied Telesis

Allied Telesis AT-x220-28GS Manuel utilisateur

Allied Telesis

Allied Telesis SwitchBlade x908 Series Instructions de montage

Allied Telesis

Allied Telesis AT-FS708/POE Manuel utilisateur

Allied Telesis

Allied Telesis AT-9000/52 Manuel utilisateur

Allied Telesis

Allied Telesis GS910/XST Series Manuel utilisateur

Allied Telesis

Allied Telesis AT-9924SP Manuel utilisateur

Allied Telesis

Allied Telesis AT-8316F/MT Manuel utilisateur

Allied Telesis

Allied Telesis x320 Series Manuel utilisateur

Allied Telesis

Allied Telesis AT-x930-28GTX Manuel d'installation

Allied Telesis

Allied Telesis x330 Series Manuel utilisateur

Allied Telesis

Allied Telesis Layer 3 Switches Instructions d'installation et d'entretien

Allied Telesis

Allied Telesis AT-FS750/20 Manuel utilisateur

Allied Telesis

Allied Telesis XS900MX Series Manuel utilisateur

Allied Telesis

Allied Telesis WebSmart AT-FS750/24 Manuel utilisateur

Manuels Changer populaires d'autres marques

URC

URC Total Control MFS-8 Manuel utilisateur

Azbil

Azbil HPQ-D11 Manuel utilisateur

Sony

Sony DFS-900M Manuel utilisateur

SICK

SICK i17S Manuel utilisateur

F&F

F&F SZR-277 Manuel utilisateur

Shure

Shure UAMS/BK Manuel utilisateur

Dräger

Dräger X-zone Switch Off Manuel utilisateur

Asco

Asco Joucomatic 349 Series Manuel utilisateur

BT Mini Hub Manuel utilisateur

D-Link

D-Link DES-1226G Manuel utilisateur

Johnson Controls

Johnson Controls FS80-C Manuel utilisateur

Alcatel-Lucent

Alcatel-Lucent 7450 ESS-12 Manuel utilisateur

MicroNet

MicroNet SP1200A Manuel utilisateur

Ruijie

Ruijie RG-PF2920 Series Manuel d'installation et d'exploitation

Altinex

Altinex DA1914SX Manuel utilisateur

MiLAN

MiLAN MIL-SM2401M Manuel utilisateur

RJM

RJM MASTERMIND PBC/6X Manuel utilisateur

Atlas

Atlas MMK-KVM8 Manuel utilisateur