Full Cisco Trademarks with Software License
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.
Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)
About Cisco 1000 Series Integrated Services Routers
The Cisco 1000 Series Integrated Services Routers (also referred to as router in this document) are powerful fixed branch routers based on the Cisco IOS XE operating system. They are multi-core routers with separate core for data plane and control plane. There are two primary models with 8 LAN ports and 4 LAN ports. Features such as Smart Licensing, VDSL2 and ADSL2/2+, 802.11ac with Wave 2, 4G LTE-Advanced and 3G/4G LTE and LTEA Omnidirectional Dipole Antenna (LTE-ANTM-SMA-D) are supported on the router.
 Note |
Cisco IOS XE Cupertino 17.9.1a is the first release for Cisco 1000 Series Integrated Services Routers in the Cisco IOS XE Cupertino 17.9.x release series. |
Product Field Notice
Cisco publishes Field Notices to notify customers and partners about significant issues in Cisco products that typically require an upgrade, workaround or other user action. For more information, see https://www.cisco.com/c/en/us/support/web/field-notice-overview.html.
We recommend that you review the field notices to determine whether your software or hardware platforms are affected. You can access the field notices from https://www.cisco.com/c/en/us/support/web/tsd-products-field-notice-summary.html#%7Etab-product-categories.
New and Changed Hardware and Software Features
New and Changed Software Features
|
Feature |
Description |
||
|---|---|---|---|
|
This feature introduces support for configuration of unicast-to-multicast destination reflection to facilitate unicast-to-multicast destination translation and unicast-to-multicast destination splitting. It also provides the capability for users to translate externally received unicast destination addresses to multicast addresses. |
|||
|
Support for BGP additional paths with label-unicast unique mode |
This enhancement introduces support for configuring BGP additional paths when label-unicast unique mode is configured |
||
|
Cube Features |
|||
|
CUBE: End-to-end Secure Calling for Courtesy Call Back and Unified Contact Center Survivability |
With the Cisco Voice Portal (CVP) application, a caller may request an automatedcallback, rather than wait in a queue for an extended period. When an agent becomes available, CVP sends a request to place a call to the original caller. When the call is answered, the agent is connected. With this update, outbound calls over a secure SIP PSTN trunk are possible. |
||
|
Previously, CUBE (Local Gateway) had to be configured with separate dial-peers to monitor the availability of individual proxies used in services such as Webex Calling. To simplify this configuration, all targets resolved from a DNS SRV record may now be monitored using a common Options Ping policy defined for a single dial-peer. If a remote server becomes unresponsive, CUBE will busy out that destination, allowing calls to be sent to alternative destinations. |
|||
|
Cisco IOS gateways can use FTP and now SFTP servers to transfer call accounting files. |
|||
|
From Unified SRST 14.3, new CLI commands are introduced to support the forthcoming Webex Calling Site Survivability mode. This feature will only be available for use when the Webex Calling Site Survivability solution is made available through Webex Control Hub. |
|||
|
Programmability Features |
|||
|
Pubd Restartability |
The pubd process is restartable on all platforms in this release. Prior to this release, pubd was restartable only on certain platforms. On other platforms, to restart the pubd process, the whole device had to be restarted. |
||
|
Smart Licensing Using Policy Features |
|||
|
Hostname support |
Support for sending hostname information was introduced. If you configure a hostname on the product instance and disable the corresponding privacy setting (no license smart privacy hostname command in global configuration mode), hostname information is sent from the product instance, in a separate sync message or offline file. Depending on the topology you have implemented, the hostname information is received by CSSM, CSLU, and SSM On-Prem. It is then displayed on the corresponding user interface. For more information, see license smart (global config). With the introduction of this enhancement, the hostname limitation which existed from Cisco IOS XE Amsterdam 17.3.2 to Cisco IOS XE Cupertino 17.8.x – is removed. In these earlier releases, hostname information is not sent or displayed on various licensing utilities (CSSM, CSLU, and SSM On-Prem). |
||
|
Inconsistent system behavior for license boot global configuration command rectified. |
The system does not allow overlapping suite and technology package configuration to co-exist. For more information, see license boot. |
||
|
New mechanism to send data privacy related information |
A new mechanism to send data privacy related information was introduced. This information is no longer included in a RUM report. If data privacy is disabled (no license smart privacy{all|hostname|version} command in global configuration mode), data privacy related information is sent in a separate sync message or offline file. Depending on the topology you have implemented, the product instance initiates the sending of this information in a separate message, or CSLU and SSM On-Prem initiates the retrieval of this information from the product instance, or this information is saved in an offline file. For more information, see license smart (global config). |
||
|
RUM Report Throttling |
For all topologies where the product instance initiates communication, the minimum reporting frequency is throttled to one day. This means the product instance does not send more than one RUM report a day. The affected topologies are: Connected Directly to CSSM, Connected to CSSM Through CSLU (product instance-initiated communication), CSLU Disconnected from CSSM (product instance-initiated communication), and SSM On-Prem Deployment (product instance-initiated communication). This resolves the problem of too many RUM reports being generated and sent for certain licenses. It also resolves the memory-related issues and system slow-down that was caused by an excessive generation of RUM reports. You can override the reporting frequency throttling, by entering the license smart sync command in privileged EXEC mode. This triggers an on-demand synchronization with CSSM or CSLU, or SSM On-Prem, to send and receive any pending data. RUM report throttling also applies to the Cisco IOS XE Amsterdam 17.3.6 and later releases of the 17.3.x train, and Cisco IOS XE Bengaluru 17.6.4 and later releases of the 17.6.x train. From Cisco IOS XE Cupertino 17.9.1, RUM report throttling is applicable to all subsequent releases. |
||
|
Virtual Routing and Forwarding (VRF) Support |
On a product instance where VRF is supported, you can configure the license smart vrf vrf_string command and use a VRF to send licensing data to CSSM, or CSLU, or SSM On-Prem.
For more information, see license smart (global config) |
||
Note |
From Cisco IOS XE Release 17.9.1a, guestshell is removed from the IOS XE software image. As a result, Zero Touch Provisioning (ZTP) python script is no longer supported on Cisco 1000 Series Integrated Services Routers. If you need to use guestshell, then download it from https://developer.cisco.com/docs/iox/#!iox-resource-downloads/downloads. For more information, see Guestshell installation procedure. |
Note |
From the Cisco IOS XE 17.9.2a release, the 5G sub-6 GHz Pluggable Interface Module (PIM) P-5GS6-GL is supported on the Cisco 1000 Series Integrated Services Routers. |
New and Changed Software Features in Cisco IOS XE 17.9.6
There are no new features in this release.
New and Changed Software Features in Cisco IOS XE 17.9.5a
There are no new features in this release.
New and Changed Software Features in Cisco IOS XE 17.9.4a
There are no new features in this release. This release provides a fix for CSCwh87343: Cisco IOS XE Software Web UI Privilege Escalation Vulnerability. For more information, see the Security Advisory: cisco-sa-iosxe-webui-privesc-j22SaA4z.
New and Changed Software Features in Cisco IOS XE 17.9.4
There are no new software features in this release.
New and Changed Software Features in Cisco IOS XE 17.9.3a
There are no new software features in this release.
New and Changed Software Features in Cisco IOS XE 17.9.2a
There are no new software features in this release.
Cisco ISR1000 ROMMON Compatibility Matrix
The following table lists the ROMmon releases supported in Cisco IOS XE 16.x.x releases and Cisco IOS XE 17.x.x releases.
Note |
To identify the manufacturing date, use the show license udi command. For example: The xxxx in the command output represents the manufacturing date.
|
|
Cisco IOS XE Release |
Minimum ROMmon Release for IOS XE |
Recommended ROMmon Release for IOS XE |
|---|---|---|
|
16.6.x |
16.6(1r) |
16.6(1r) |
|
16.7.x |
16.6(1r) |
16.6(1r) |
|
16.8.x |
16.8(1r) |
16.8(1r) |
|
16.9.x |
16.9(1r) |
16.9(1r) |
|
16.10.x |
16.9(1r) |
16.9(1r) |
|
16.11.x |
16.9(1r) |
16.9(1r) |
|
16.12.x |
16.9(1r) |
16.12(1r) |
|
17.2.x |
16.9(1r) |
16.12(1r) |
|
17.3.x |
16.12(2r) |
16.12(2r) |
|
17.4.x |
16.12(2r) |
16.12(2r) |
|
17.5.x |
17.5(1r) |
17.5(1r) |
|
17.6.x |
17.5(1r) |
17.5(1r) |
|
17.7.x |
17.5(1r) |
17.5(1r) |
|
17.8.x |
17.5(1r) |
17.5(1r) |
|
17.9.x |
17.5(1r) |
17.5(1r) |
Resolved and Open Bugs in Cisco 1000 Series Integrated Services Routers
Resolved Bugs in Cisco IOS XE 17.9.6
|
Bug ID |
Description |
|---|---|
|
Crypto IKEv2 - Fragmented authentication packets detected as malformed on third party vendor device. |
|
|
Unexpected reload when using show running-config full | format. |
|
|
Unexpected reload due IPv6 TCP packet in QFP. |
|
|
SKA_PUBKEY_DB leak in TDL. |
|
|
DSL module gets stuck in a booting state. |
|
|
Router may crash due to Crypto IKMP process. |
|
|
Cosmetic 3G issue causing distress to customers - Modem WCDMA 900 is displayed as unknown. |
|
|
Memory leak in crypto IKEv2 due to C_NewObject. |
|
|
IPSec tunnel fails to establish due to error IPSec policy invalidated proposal. |
|
|
UNIX-EXT-SIGNAL: Segmentation fault(11), Process = Cellular CNM. |
|
|
Unencrypted traffic due to non-functional IPSec tunnel in FLEXVPN hub and spoke setup. |
|
|
Endpoint tracker using DNS does not log DOWN message when DNS server reachability is lost. |
|
|
Wireless config not pushing to EWC on device. |
|
|
EzPM application-performance profile cause memory leak and crash with long-lived idle TCP flows. |
|
|
Mobile-app causing excessive authorization attempts with a null username. |
|
|
Repeated and endless messages network change event - activated 4G carrier aggregation. |
|
|
Segmentation fault - process = IPSec dummy packet process. |
|
|
PKI crash after failing a CRL fetch. |
|
|
Memory dump outputs appear without debugs enabled in SSL VPN code. |
|
|
Reload in tcp_sanity due to l4 pointer not set. |
|
|
Tsn4P: Trunk interface traffic blocked in STP disabled Vlan. |
|
|
Device reloaded due to ezManage mobile app service. |
|
|
Router should discard IKE notification messages with incorrect DOI. |
|
|
MACSEC not working under LACP port-channel member port. |
|
|
Race condition crash on IOS-XE device. |
|
|
Trim installed certificate on upgrade. |
|
|
Inbound calls through device results in phantom calls (64.3.0, 60.1.4, 62.3.3). |
|
|
Shutting a dialer interface with PPPoA unshuts it automatically. |
|
|
FlexVPN client : IPSec tunnels are down due to issue with SADB detach and delete. |
|
|
CPP CP SVR crash after decoding all packets to text (using l2 copy) on fia trace. |
|
|
DMVPN spoke to spoke tunnel fails to come up, when the cable is unplugged and plugged back. |
|
|
Failure to communicate a period of time after the STP status changes. |
|
|
Device crashes while processing an NWPI trace. |
|
|
MGCP GW does not respond with 250 OK for a DLCX leading to DLCX loop from CUCM side. |
|
|
Router rebooted when attempting merge on used CVLA block. |
Open Bugs in Cisco IOS XE 17.9.6
|
Bug ID |
Description |
|---|---|
|
SD-WAN router does not establish BFD sessions after upgrade. |
|
|
Speed mismatch in IOS-XE configuration after device template push for device. |
|
|
NAT command not readable after reloaded. |
|
|
Cellular interface in last resort mode should be admin up, line protocol down. |
|
|
GETVPN COOP KS | wrong severity for rekey acknowledgement configuration mismatch log message. |
|
|
Device crash due to dbgd process. |
|
|
Cisco DNA center - SBEN onboarding fails - EAP-TLS failed to fetch IP address. |
|
|
ZBF drops transit WAAS PSH/ACK packet due to invalid ACK number. |
|
|
Device running IOS version rebooted unexpectedly due to process NHRP crash. |
|
|
Traceback seen @_nhrp_cache_delete due to negative global cache count. |
|
|
Unexpected reboot of the ESP seen after enabling platform qos port-channel-aggregate. |
|
|
Startup configuration failure post PKI server enablement. |
|
|
IOS XE controller mode - WAN IP is allowed to be configured as system IP. |
|
|
ARP incomplete in VRF mgmt-intf - G0/0/0 - Switch -G0. |
|
|
MGCP GW fails to respond with 250 OK when there is a delay from dataplane in gathering stats. |
|
|
BFD timers reverting back to default value after negotiating correctly. |
|
|
Process IOMd memory leak due to POE TDL message. |
|
|
Crash due a segmentation fault due a negative value. |
|
|
CWMP : Add vendor specific parameter for NBAR protocol pack version. |
|
|
Router crash with segmentation fault(11), process = NHRP when processing NHRP traffic. |
|
|
After deleting a NAT configuration, the IP address still shows up in routing table. |
|
|
CCA detected logic error, code = 14 traceback seen constantly. |
|
|
QoS more than four remarks with set-cos not working. |
|
|
Umbrella SMU for CSCwk23723 and CSCwj83844. |
|
|
IKEv2 session is down after reload if identity local address is assigned to interface on switch. |
|
|
Unexpected reboot while dispalying information from cleared SSS session. |
|
|
GETVPN/migrating to new KEK RSA key does not trigger GM re-registration. |
|
|
BFD sessions are down and not recovering for one color after hub replacement. |
|
|
IOS XE router: Unexpected reboot during PVDM OIR. |
|
|
IOS-XE crashes in IOSd due to malformed DMVPN-5-NHRP_RES_REPLY_IGNORE syslog. |
|
|
Unable to build two IPSec SAs w/same source/destination where one peer is PAT'd through the other. |
|
|
Endpoint tracker does not fail if default route is removed. |
|
|
Enable SoS/ROC feature for DSL. |
|
|
Enable BFD L2 messages in the punt path for devices. |
|
|
Dialer interface MAX MTU for PPPOA is 1492. |
|
|
DDNS update retransmission timer fails to work with a traceback error. |
|
|
Cellular connection is picking the wrong profile. |
|
|
DSL router crashing due to %PLATFORM-3-ELEMENT_CRITICAL memory level/iomd process. |
|
|
Static NAT DIA inside static routes being advertised over OMP to remote sites. |
|
|
PPPoE session with sub-interface getting stuck after reboot. |
|
|
IPv6 PREFIX delegation is not working on ADSL PPPOA. |
|
|
Inconsistencies with openconfig-interfaces:config yang model in IOS-XE after defaulting interface. |
|
|
IPv6 tcp adjust-mss not working after delete and reconfigure. |
|
|
Packet drops observe between LISP EID over GRE tunnel. |
|
|
CPU usage due to memory pressure exceeds threshold on BINOS_FRU. |
|
|
show crypto ipsec sa output displays incorrect replay status. |
Resolved Bugs in Cisco IOS XE 17.9.5a
|
Bug ID |
Description |
|---|---|
|
HSRP loss communication with HSRP neighbor after two weeks of being configured. |
|
|
Device reloads changing the resource profile. |
|
|
Modem may not come back up from FW upgrade with LM960A18 and FN980 modems. |
|
|
Device "No licenses in use" after upgrading from traditional to Smart Licensing IOS-XE versions. |
|
|
Router keeps crashing when processing a firewall feature. |
|
|
Device observes memory leak at process "SSS Manager". |
|
|
Device "write" or "do write" saves configuration but RSA keys /SSH lost after reload. |
|
|
cEdge Policy commit failure notification and alarm from vSmart. |
|
|
Using special characters in the password while generating TP generates an invalid TP. |
|
|
Unexpected reboot after establishing control plane of EVPN MPLS and receiving packets. |
|
|
NHRP reply processing may dequeue an unrelated request. |
|
|
CPU usage mismatch in "sh sdwan system status" vs "sh proc cpu platform" |
|
|
Device crash with crash info files were generated with Segmentation fault, Process IPSEC key engine. |
|
|
OMP route is being advertised although the route is not available. |
|
|
Ten0/0/2 from Port-channel going to suspended status applying "platform qos port-channel-aggregate" |
|
|
Netflow stops working when flow monitor reaches cache limit in device. |
|
|
Telstra Cert: FN980 modem (P-5GS6-GL) is showing 4 additional NR bands support - 1, 3, 7, and 28 |
|
|
IOS XE 17 - NAT HSL logging vrf-filter not working. |
|
|
VPN is established although the peer is using a revoked certificate for authentication. |
|
|
Environmental syslog is not appearing when power cord is disconnected from the redundant PS. |
|
|
Device is crashing while adding a trustpoint to the router. |
|
|
CSDL Compliance failure : Use of 3DES by IPSec is denied. |
|
|
Unexpected reload on device due to Critical process fman_fp_image in 17.9.3a |
|
|
Device reboots with sslproxy and utd enabled |
|
|
Device data plane crash in Umbrella/OpenDNS processing due to incorrect UDP length |
|
|
"Configure replace" command fails due to the "license udi PID XXX SN:XXXX" line on IOS-XE devices. |
|
|
Unexpected reboot after configuring application redundancy. |
|
|
IOS XE router software forced reset during high IPC congestion with IPsec. |
|
|
ITU channel configuration seems not working on device. |
|
|
Crashed by TRACK Client thread at access invalid memory location. |
|
|
Unable to migrate from ADSL to VDSL without reboot on device. |
|
|
Crash in IP Input process during tunnel encapsulation. |
|
|
Can't disable DMVPN logging in IOS-XE 17.8 and higher. |
|
|
Crypto PKI-CRL-IO_0 process crash when PKI trustpoint is being deleted. |
|
|
Crypto PKI-CRL-IO_0 process crash when PKI trustpoint is requested & deleted. |
|
|
IPv4 connectivity over PPP not restored after reload. |
|
|
Spoke-spoke cache refresh not working correctly in case of multiple cache entries for same next hop. |
|
|
IOS XE - Vdaemon debug log should mention port-hop and reason prior to DISTLOC. |
|
|
Keyman process crash seen while re-generating SSH key in device. |
|
|
B2B NAT: when configuration IP NAT inside/outside on VASI interface,ack/seq number abnormal. |
Open Bugs in Cisco IOS XE 17.9.5a
|
Bug ID |
Description |
|---|---|
|
ZBF drops transit WAAS PSH/ACK packet due to 'Invalid ACK number'. |
|
|
Interfaces configuration change from negotiation auto to no negotiation auto after a reboot. |
|
|
IPv6 PREFIX delegation is not working on ADSL PPPOA. |
|
|
CPP CP svr crash after decoding all packets to text (using l2 copy) on fia trace. |
|
|
Router FTM crash with SIG enabled. |
|
|
Cosmetic 3G issue causing distress to customers - Modem WCDMA 900 is displayed as unknown. |
|
|
Endpoint tracker triggers a CPU Hog. |
|
|
Packets with Unicast MAC get dropped on a Port Channel L2 Sub-intf after a router reboot. |
|
|
Router Crash with Segmentation fault(11), Process = NHRP when processing NHRP traffic. |
|
|
DSP reporting out of range utilization values in SNMP. |
|
|
Router may crash due to Crypto IKMP Process. |
|
|
Enable SoS/ROC feature for DSL. |
|
|
Device LED L remains green after port shutdown. |
|
|
IKEv2 - diagnose feature is taking 11% CPU during session bring up. |
|
|
DDNS update retransmission timer fails to work with a traceback error. |
|
|
Device Custom Application is marked as invalid. |
|
|
Router should discard IKE Notification messages with incorrect DOI. |
|
|
PKI crash after failing a CRL Fetch. |
|
|
Warning and critical CPU utilization thresholds not recomputed when using data-plane-heavy mode. |
|
|
NAT Command not readable after reloaded. |
|
|
PoE module is not providing enough power to bring the ports after an unexpected reload. |
|
|
Segmentation fault observed in ikev2_dupe_delete_reason. |
|
|
IPv6 tcp adjust-mss not working after delete and reconfigure. |
|
|
Packet drops observe between LISP EID over GRE Tunnel. |
|
|
Unknown app ID in ZBFW HSL log. |
|
|
CWMP : Add vendor specific parameter for NBAR protocol pack version. |
|
|
MFG Manhattan can't boot up in IOS. |
|
|
IOS XE:Traffic not encrypted and droped over IPSEC SVTI tunnel. |
Resolved Bugs - Cisco IOS XE 17.9.4a
All resolved bugs for this release are available in the Cisco Bug Search Tool.
|
Bug ID |
Description |
|---|---|
|
Cisco IOS XE Software Web UI Privilege Escalation Vulnerability. For more information, see Security Advisory: cisco-sa-iosxe-webui-privesc-j22SaA4z |
Open Bugs in Cisco IOS XE 17.9.4a
|
Bug ID |
Description |
|---|---|
|
IOS-XE cpp crash when entering no ip nat create flow-entries. |
|
|
Crypto PKI-CRL-IO_0 process crash when PKI trustpoint is being deleted. |
|
|
NHRP BFD flaps randomly with dynamic tunnel (NHRP phase 3) in DMVPN. |
|
|
HSRP loss communication with HSRP neighbor after two weeks of being configured. |
|
|
VPN is established although the peer is using a revoked certificate for authentication. |
|
|
Static NAT DIA inside static routes being advertised over OMP to remote sites. |
|
|
Configure replace command fails due to the license udi PID XXX SN:XXXX line on IOS-XE devices. |
|
|
UTD packet drop due to fragmentation for ER-SPAN traffic. |
|
|
Device reloads changing the resource profile. |
|
|
CLI template fails to attach to device with error access-denied. |
|
|
%CRYPTO_SL_TP_LEVELS-6-VAR_NEW_VALUE message is observed in each write config with same crypto value. |
|
|
Device is crashing while adding a trustpoint to the router. |
|
|
Unexpected reload due to memory corruption when modifying and access list. |
|
|
Device crash with crashinfo files were generated with segmentation fault, process IPSEC key engine. |
|
|
IOS XE - debug log should mention port-hop and reason prior to DISTLOC. |
|
|
Packets with L2TP headers cause device to crash. |
|
|
Static NAT entry gets deleted from running config; but remains in startup config. |
|
|
No licenses in use after upgrading from traditional to smart licensing IOS-XE versions. |
|
|
SNMP if index persist does not work. |
|
|
Netflow stops working when flow monitor reaches cache limit. |
|
|
Output packet bytes calculation biased when we enable QoS on port channel. |
|
|
QoS more than four remark with set-cos not work. |
|
|
EVPN: BUM traffic is not flooded to bridge domain interface. |
Resolved Bugs in Cisco IOS XE 17.9.4
|
Bug ID |
Description |
|---|---|
|
FlexVPN: Stale client routes stuck in RIB on FlexServer. |
|
|
NAT ALG is changing the Call-ID within SIP message header causing calls to fail. |
|
|
Device freezes on using show sdwan commands. |
|
|
SNMP MIB does not show correct firmware version for LTE module. |
|
|
ALG breaks NBAR recognition impacting application firewall performance. |
|
|
Device crashes unexpectedly due to a fault in the 'TLSCLIENT_PROCESS'. |
|
|
NHRP cache entries flood matching a /32 default route. |
|
|
Crashes while importing big CRL file into switch. |
|
|
Auto-update cycle incorrectly deletes certificates. |
|
|
uCode crash seen on thorium with traffic pointing to segfault in coff handler. |
|
|
Memory allocation failure with extended antireplay enabled. |
|
|
NAT entries expire on standby router. |
|
|
Configuring entity-information xpath filter causes syslogs to print, does not return data. |
|
|
SNMP MIB OID changing its last index. |
|
|
Device is crashing after importing the trustpoint with rsakeypair. |
|
|
Unexpected reload with IPS configured. |
|
|
Observed qfp-ucode-wlc crash. |
|
|
GARP on port up/up status from router is not received by remote peer device. |
|
|
Pseudowire control word not working on device. |
|
|
MCID (Malicious Call Identification) gets broken due to custom prefix setting under STCAPP FAC. |
|
|
NAT: Traffic is not translated to the same global address though PAP is configured. |
|
|
Device can lose its config during a triggered resync process if lines are in an off-hook state. |
|
|
No way audio when using secure hardware conference with secure endpoints. |
|
|
VMWI race condition causes no ringing for analog phones. |
|
|
Router crashes due to CPUHOG when walking ciscoFlashMIB @snmp_platform_get_flash_file_info. |
|
|
Router IOS-XE crash while executing AES crypto functions. |
|
|
Packet duplication: Duplicate packets are counted on primary tunnel interface statistics. |
|
|
ISAKMP profile does not match as per configured certificate maps. |
|
|
Failed to ping gateway while configuring shared LOM with console, te1 interface until router reload. |
|
|
ISG: L2-connected subscriber: IPv6 prefix delegation is not reachable when packets are switched. |
|
|
Device punt-policer is not configurable. |
|
|
Device uses excessive memory when configuring ACLs with large object groups. |
|
|
Unexpected reboot due to IOSXE-WATCHDOG: Process = Crypto IKMP. |
|
|
Segmentation fault in SDWAN PB rx when per-tunnel QoS config withdraw. |
|
|
NAT configuration with redundancy, mapping id and match-in-vrf options with no-alias support. |
|
|
MACSEC remains marked as SECURED, but randomly the traffic stops working. |
Open Bugs in Cisco IOS XE 17.9.4
|
Bug ID |
Description |
|---|---|
|
IOS-XE cpp crash when entering no ip nat create flow-entries. |
|
|
Crypto PKI-CRL-IO_0 process crash when PKI trustpoint is being deleted. |
|
|
NHRP BFD flaps randomly with dynamic tunnel (NHRP phase 3) in DMVPN. |
|
|
HSRP loss communication with HSRP neighbor after two weeks of being configured. |
|
|
VPN is established although the peer is using a revoked certificate for authentication. |
|
|
Static NAT DIA inside static routes being advertised over OMP to remote sites. |
|
|
Configure replace command fails due to the license udi PID XXX SN:XXXX line on IOS-XE devices. |
|
|
UTD packet drop due to fragmentation for ER-SPAN traffic. |
|
|
Device reloads changing the resource profile. |
|
|
CLI template fails to attach to device with error access-denied. |
|
|
%CRYPTO_SL_TP_LEVELS-6-VAR_NEW_VALUE message is observed in each write config with same crypto value. |
|
|
Device is crashing while adding a trustpoint to the router. |
|
|
Unexpected reload due to memory corruption when modifying and access list. |
|
|
Device crash with crashinfo files were generated with segmentation fault, process IPSEC key engine. |
|
|
IOS XE - debug log should mention port-hop and reason prior to DISTLOC. |
|
|
Packets with L2TP headers cause device to crash. |
|
|
Static NAT entry gets deleted from running config; but remains in startup config. |
|
|
No licenses in use after upgrading from traditional to smart licensing IOS-XE versions. |
|
|
SNMP if index persist does not work. |
|
|
Netflow stops working when flow monitor reaches cache limit. |
|
|
Output packet bytes calculation biased when we enable QoS on port channel. |
|
|
QoS more than four remark with set-cos not work. |
|
|
EVPN: BUM traffic is not flooded to bridge domain interface. |
|
|
CUBE - SIP Message Queuing Fails to Resume Transmission |
Resolved Bugs in Cisco IOS XE 17.9.3a
|
Bug ID |
Description |
|---|---|
|
MSR Unicast-To-Multicast not working if destination and source are the same in service reflect configuration. |
|
|
Unexpected reload after running show voice dsp command while an ISDN call disconnects. |
|
|
ISG FFR: ARP request to reroute nexthop IP is not triggered if ARP entry not in ARP table. |
|
|
Device controller crash when sending full line rate of traffic with >5 Intel AX210 stations. |
|
|
Service Engine YANG support for ZBFW. |
|
|
GetVPN long SA - GM re-registration after encrypting 2^32-1 of packets in one IPSEC SA. |
|
|
QoS classification not working for DSCP or ACL + MPLS EXP. |
|
|
Clear ISG existing lite-session upon reception of DHCP packet for same client. |
|
|
FMAN crash seen in SGACL@ fman_sgacl_calloc. |
|
|
Interface VLAN1 placed in shutdown state when configured with ip address pool. |
|
|
Data plane crash on device when making per-tunnel QoS configuration changes with scale. |
|
|
IKEv2/IPSec - phase 2 rekey failing when peer is behind NAT. |
|
|
Device unexpected reload after set ospfv3 authentication null command. |
|
|
CEF DPI load-balancing causes out of order packets. |
|
|
Device crashing and restarting during call flow with new image. |
|
|
Dataplane memory utilization issue - 97% QFP DRAM memory utilization. |
|
|
Invalid TCP checksum in SYN flag packets passing through router. |
|
|
[MBPL Integration] Kernel crash is observed when modem-power-cycle is executed. |
|
|
GETVPN: KS reject registration from a public IP. |
|
|
Unconditional excessive logging in eogre tunnel error handling case. |
|
|
CWMP : MAC address of ATM interface is not included in inform message. |
|
|
MPLS VPN traffic dropped due FDB OOM with cause FIAError under scale flow number (<1M). |
|
|
DHCP behavior issue when BDI interface is enabled on WAN and SVI interface. |
|
|
Stale ip alias left after NAT statement got removed. |
|
|
ISG uses identifier mac-address 0000.0000.0000 when DHCP LQ does not reply. |
|
|
GETVPN : Traffic drops seen on GM after rekey installing policies. |
|
|
Single WAN interface subslot 0/0 timing. |
|
|
Memory leak under linux_iosd-image related to SNMP. |
Open Bugs in Cisco IOS XE 17.9.3a
|
Bug ID |
Description |
|---|---|
|
IOS-XE cpp crash when entering no ip nat create flow-entries. |
|
|
Memory leak caused router reload. |
|
|
NAT: Traffic is not translated to the same global address though PAP is configured. |
|
|
OID for SNMP monitoring of DSP resources are not working as expected. |
|
|
ALG breaks NBAR recognition impacting application firewall performance. |
|
|
VPN is established although the peer is using a revoked certificate for authentication. |
|
|
NIM-LTEA-EA module incorrectly shows "Profile 1 = INACTIVE*". |
|
|
UTD packet drop due to fragmentation for ER-SPAN traffic. |
|
|
Router IOS-XE crash while executing AES crypto functions. |
|
|
Device always fails to push any template to device if device is running in FIPS mode. |
|
|
Unable to match on customer profile based on certificate-map. |
|
|
PFP policy in SRTE, RIB resolution in FC bring down ipsec tunnel interface- stuck at linestate down. |
|
|
IP CEF load sharing command is being changed by the device. |
|
|
NAT configuration with no-alias option is not preserved after reload. |
|
|
CUBE - SIP Message Queuing Fails to Resume Transmission |
Resolved Bugs in Cisco IOS XE 17.9.2a
|
Bug ID |
Description |
|---|---|
|
NAT not requesting further for low ports after initial allocation when CLI knob reserved-ports set. |
|
|
Crash saving tracelogs after "Too many open files" error. |
|
|
vTCP does not support L2 correctly. |
|
|
ERROR info: Router configuration failed:interface Serial0/1/0:23 isdn switch-type primary-ntt. |
|
|
UCode crash during FW classification, session frees. |
|
|
Routes added by IKEv2 getting deleted at responder. |
|
|
Firewall drop seen stating “FirewallL4” seen on device. |
|
|
Bootstrap failing on device. |
|
|
Device is not programming correct next-hop for unicast prefix with multicast config present. |
|
|
Crash @ UNIX-EXT-SIGNAL: Aborted(6), Process = Check heaps, having PPPoe with cwmp configs. |
|
|
IKEv2 cert-based IPsec not working between IOS-XE and AWS. |
|
|
Device unexpected reload due to QFP UCode crash. |
|
|
Packet duplication is causing drops in payment transactions. |
|
|
Device reloads unexpectedly due to critical FTMD fault when VRF configuration is pushed |
|
|
Unified policy HSL not sending proper NBAR application information. |
|
|
Multiple devices experience crashes every 4-5 minutes. |
|
|
Device flows are not distributed and load-balanced evenly and consistently. |
|
|
ZBFW self zone policy drops SSH session on mgmt-intf 512 ports. |
|
|
Device VRF+NAT outside source static - drop packets during FTP (active-mode) execution. |
|
|
Throughput degrades when local TLOC specified in data policy goes down. |
|
|
Slot 0/1 crash after changing switchport with allowed wide range VLANs from trunk to access. |
|
|
BFD sessions remains down if interface flap form up/down/up. |
|
|
CLI template push fails with error: 'Error: on line 48: line-mode single-wire line 0'. |
|
|
Automatically freeing up filesystems stale image or recovered folder (lost+found). |
|
|
QFP crash when ZBFW configuration features "log dropped-packets" configuration. |
|
|
Router running crashes due to CPUHOG when walking ciscoFlashMIB. |
|
|
Subscriber session getting stuck and needs clearing it manually. |
|
|
Device speed test failing with "Device error: Speed test in progress". |
|
|
Needs cert update - Azure CGW creation fails due to NVA provisioning failure. |
|
|
LAN module is down when high CPU noticed. |
|
|
ISG: Number of lite sessions conversion in progress counter not decrementing on failed account-logon. |
|
|
Crashes when virtual-access tries to bring-up/bring-down OSPFv3 IPsec crypto session authentication. |
|
|
Device pushes wrong (typo) syntax as "config wlan broadcase-ssid disable 2". |
|
|
SSH from vshell to device getting closed after update. |
|
|
BFD and control packets are dropped when ACL is applied on gigi to which loopback is bind. |
|
|
SIG tunnel tracker packets are dropped by firewall with self zone policy. |
|
|
BFD sessions are not coming up after flapping the interface due to low ftm rate. |
|
|
UTD skipped when interface UTD config is used to enable/disable UTD. |
Open Bugs in Cisco IOS XE 17.9.2a
|
Bug ID |
Description |
|---|---|
|
Device does not form BFD across serial link when upgrading. |
|
|
A high CPU utilization caused by NHRP. |
|
|
Repeating SYS-2-PAK_SUBBLOCK_BADSIZE: 4 -Process= <interrupt level>. |
|
|
After upgrade, device moved into Out of Sync status. |
|
|
NAT translation is not correctly sent to hub router from branch when SSNAT and UTD are configured. |
|
|
Device always fails to push any template if it is running in the FIPS mode. |
|
|
CERM may kick in due to IPsec sessions initiated for on-demand tunnels. |
|
|
fman crash seen in SGACL@ fman_sgacl_calloc. |
|
|
Nutella router crashing with reason CPU usage due to memory pressure exceeds threshold (reboot). |
|
|
NAT configuration with no-alias option is not preserved after reload. |
|
|
Unable to configure the local BGP as-path-list. |
|
|
0365 and MS Teams applications access issues when using DIA with app-list match in data-policy. |
|
|
With 2 sequences, should not skip if the match is different and action is same. |
|
|
Unable to push no-alias option on static NAT mapping from management system. |
|
|
SNMP polling not working on PPP Interface. |
|
|
Control connection on device does not come up with reverse proxy using enterprise certificate. |
|
|
Upgrade failures due to inability to establish NETCONF connection from device to upgrade-confirm. |
|
|
DSL: Erroneous atm interface counter at DSL retraining. |
|
|
Configuring entity-information xpath filter causes syslogs to print, does not return data. |
|
|
Login banner config is changed after upgrade. |
|
|
Invalid TCP checksum in SYN flag packets passing through router. |
|
|
check_sig_ipsec_ike_sessions fails with could not find entry for Tunnel100001. |
|
|
Device stopped forwarding traffic. Suspect OMPD is busy. |
|
|
Traffic seems not inspected by UTD when umbrella is set. |
|
|
Serviceability enhancements for config migration failures between releases. |
|
|
DHCP behavior issue when BDI interface is enabled on WAN and SVI interface. |
|
|
NAT/DIA traffic is skipping UTD in forward direction after SSNAT path from service-side. |
|
|
Router reloads unexpectedly during NHRP processing. |
|
|
After delete CSP, new CCM bring up on existing CSP is stuck in "Initializing CCM" on MT cluster. |
Resolved Bugs in Cisco IOS XE 17.9.1a
|
Bug ID |
Description |
|---|---|
|
Peer MSS value showing incorrect. |
|
|
When object-group used in a ACL is updated, it takes no effect. |
|
|
Device failed to display active flows when flow count is high on the device. |
|
|
Traceback: fman_fp_image core after clearing packet-trace conditions |
|
|
Memory leaks on keyman process when key is not found. |
|
|
CSR BFD tunnel are zero. |
|
|
Large number of DH failures. |
|
|
NAT translation stops suddenly (ip nat inside does not work). |
|
|
Revocation-check crl none does not failover to NONE DNAC-CA. |
|
|
Router crashed after new IPv6 address assigned when router use specific configuration. |
|
|
ISG: initiator unclassified ip-address LQipv4 command has no effect. |
|
|
UDP based DNS resolution does not work with IS-IS EMCP on IOX-XE. |
|
|
Destination prefix packets getting dropped because forwarding plane is not programming the next hop. |
|
|
New key for NBAR app and NBAR category without OGREF optimized. |
|
|
OMP origin protocol comparison cleanup. |
|
|
Router crashing when clearing a VPDN session. |
|
|
HUB with firewall configured incorrectly dropping return packets when routing between VRFs. |
|
|
Device support IGMP on voice vlan. |
|
|
IP device-tracking not functional with voice VLAN configured. |
|
|
Device crash for stuck threads in cpp on packet processing. |
|
|
SNMP v2 community name encryption problem |
|
|
Traceroute not working on device with NAT. |
|
|
Subject-alt-name attribute in certificate trustpoint causes Windows NDES/CA to reject SCEP requests. |
|
|
Router reload unexpectedly two times when enter netflow show command. |
|
|
Memory leak in AEM chunks related to firewall. |
|
|
CoR intercepted DNS reply packets dropped with drop code 52 (FirewallL4Insp) if UTD enabled also. |
|
|
ThousandEyes container may fail to get installed on device. |
|
|
DMVPN phase 2 connectivity issue between two spokes. |
|
|
Traceback: IOS-XE reload after segmentation fault on process = SSS manager. |
|
|
Enabling or disabling OMP overlay as prevents connected routes from being advertised in OMP. |
|
|
ROMmon version not displaying correctly. |
|
|
IOS XE image installation fails. |
|
|
ZBFW policy stops working after modifying the zone pair. |
|
|
Keyman memory leak using public keys. |
|
|
NHRP network resolution not working with link-local IPv6 address. |
|
|
NAT traffic gets dropped when default route changes from OMP to NAT DIA route. |
|
|
Incorrect reload reason - Last reload reason: LocalSoft for Netconf initiated request. |
|
|
Missing IOS config (voice translation rule) on upgrade. |
|
|
Umbrella DNS security policy does not work with cloud on ramp with SIG tunnels. |
Open Bugs in Cisco IOS XE 17.9.1a
|
Bug ID |
Description |
|---|---|
|
Crash saving tracelogs after too many open files error. |
|
|
Crash in ipv6_tunnel_macaddr while adding/removing gre multi-point tunnel mode. |
|
|
Unified policy HSL not sending NBAR application information properly. |
|
|
Firewall drop seen stating “FirewallL4” seen on device. |
|
|
Yang-management process confd is not running. |
|
|
Bootstrap failing on device. |
|
|
Device SIG GRE: Layer 7 health check does not work on loopback interfaces. |
|
|
Crash at UNIX-EXT-SIGNAL: aborted(6), process = check heaps, having PPPoE with CWMP configs. |
|
|
Device flows are not distributed and load-balancing is even and consistent. |
|
|
Device memory leak due to FTMd process. |
|
|
Device lost configuration due to multiple power cycles on site. |
|
|
Device reloads unexpectedly due to critical FTMD fault when VRF configuration is pushed. |
|
|
Device unable to establish control connection with vBond due to out of order DTLS packets. |
|
|
Static NAT configuration in CLI with the no-alias keyword cannot be retrieved via NETCONF/YANG. |
|
|
Device statistics collection causing service-side BFD to flap on every collection interval. |
|
|
Device crashed in ipv4_nat_create_out2in_session_entry. |
|
|
Router can not be upgraded. |
|
|
BFD sessions remains down if interface flap form up/down/up. |
|
|
Traffic seems not inspected by UTD when umbrella is set. |
|
|
Unable to set specific speed and duplex values on SFP ports on IOS-XE routing platforms. |
|
|
Subscriber session getting stuck and needs clearing it manually. |
|
|
DLC is not completing after upgrading to Smart Licensing from CSL. |
|
|
IOS-XE "no ip nat" config is allowed to be committed and removes nat routes among other nat config. |
|
|
BFD tunnel on router is not staying up, 1 out of 40 tunnels. |
|
|
LAN Module is down when high CPU noticed. |
|
|
Device looses all BFD sessions with invalid SPI. |
|
|
Tracebacks at cgm_avlmgr_class_init and cpuhog_key_init. |
|
|
Number of lite sessions conversion in progress counter not decrementing on failed account-logon. |
|
|
Destination not reachable if configured as a next for a static route resolvable via non /32 OMP. |
|
|
Crashes when virtual-access tries to bring-up/bring-down OSPFv3 IPsec crypto session authentication. |
|
|
BFD sessions not coming up because of ANTI-REPLAY-FAILURES. |
|
|
SIG tunnel tracker packets are dropped by firewall with self zone policy. |
|
|
Single WAN interface subslot 0/0 timing. |
|
|
Router reloaded unexpectedly. |
Related Information
Communications, Services, and Additional Information
-
To receive timely, relevant information from Cisco, sign up at Cisco Profile Manager.
-
To get the business impact you’re looking for with the technologies that matter, visit Cisco Services.
-
To submit a service request, visit Cisco Support.
-
To discover and browse secure, validated enterprise-class apps, products, solutions and services, visit Cisco DevNet.
-
To obtain general networking, training, and certification titles, visit Cisco Press.
-
To find warranty information for a specific product or product family, access Cisco Warranty Finder.
Cisco Bug Search Tool
Cisco Bug Search Tool (BST) is a web-based tool that acts as a gateway to the Cisco bug tracking system that maintains a comprehensive list of defects and vulnerabilities in Cisco products and software. BST provides you with detailed defect information about your products and software.
Documentation Feedback
To provide feedback about Cisco technical documentation, use the feedback form available in the right pane of every online document.
Troubleshooting
For the most up-to-date, detailed troubleshooting information, see the Cisco TAC website at https://www.cisco.com/en/US/support/index.html.
Go to Products by Category and choose your product from the list, or enter the name of your product. Look under Troubleshoot and Alerts to find information for the issue that you are experiencing.
Feedback