AT-S62 and AT-S62 NE Version Management Software for AT-8500 Series Switches Software Release Notes

Transcription

1 Supported Platforms AT-S62 and AT-S62 NE Version Software Release Notes AT-S62 and AT-S62 NE Version Management Software for AT-8500 Series Switches Software Release Notes Please read this document before you begin to use the management software. The AT-S62 and AT-S62 NE Version management software is supported on the following AT-8500 Series switches: AT-8516F/SC AT-8524M AT-8524POE AT-8550GB AT-8550SP Product Documentation For hardware installation instructions, refer to the following guide: AT-8524M Layer 2+ Fast Ethernet Switch Installation Guide (PN ) For management instructions, refer to the following guides: AT-S62 Management Software User s Guide (PN ) AT-S62 Management Software Command Line User s Guide (PN ) All documents are available from the Allied Telesyn web site at Product Features AT-S62 and AT-S62 NE support the following features: Auto-Negotiation (IEEE 803.3u-compliant) for speed and duplex mode Auto and manual MDI/MDI-X Flow control (IEEE 802.3x and 802.3z-compliant) Head of line blocking prevention Multicast, broadcast and unknown unicast rate control Port mirroring PN Rev A 1 Allied Telesyn, Inc.

2 Port trunking (IEEE 802.3ad) (static link aggregation, non LACP) MAC address port security Port statistics (RMON) Static MAC addresses Spanning Tree Protocol (IEEE Std 802.1D) Rapid Spanning Tree Protocol (IEEE Std 802.1w) Multiple Spanning Tree Protocol (IEEE Std 802.1s) Virtual LANs (IEEE 802.1Q) Ingress filtering GARP VLAN Registration Protocol (GVRP)-based dynamic VLANs Secure Sockets Layer (SSL) Protocol (not included in AT-S62 NE) Secure Shell (SSH) Protocol (not included in AT-S62 NE) Public Key Infrastructure (PKI) Certificates (not included in AT-S62 NE) Management VLAN Multiple VLAN modes Event log Enhanced stacking IGMP Snooping (RFC 2236) Classifiers Access Control Lists Quality of Service Class of Service (IEEE 802.1p-compliant) Strict priority and weighted round robin priority scheduling File system SNMPv1, SNMPv2c and SNMPv3 management Text-based configuration file Denial of service prevention 802.1x Port-based Access Control Power over Ethernet (IEEE 802.3af ) (AT-8524POE switch only) RADIUS accounting Password protected management access Management access control list PN Rev A 2 Allied Telesyn, Inc.

3 RADIUS and TACACS+ authentication protocols Xmodem and TFTP downloads and uploads Static and dynamic (BOOTP and DHCP clients) IP configuration Static and dynamic (SNTP client) system time configuration Bad cable detection Fan and temperature diagnostics Caution The software described in this documentation contains certain cryptographic functionality and its export is restricted by U.S. law. As of this writing, it has been submitted for review as a retail encryption item in accordance with the Export Administration Regulations, 15 C.F.R. Part , promulgated by the U.S. Department of Commerce, and conditionally may be exported in accordance with the pertinent terms of License Exception ENC (described in 15 C.F.R. Part ). In no case may it be exported to Cuba, Iran, Iraq, Libya, North Korea, Sudan, or Syria. If you wish to transfer this software outside the United States or Canada, please contact your local Allied Telesyn sales representative for current information on this product s export status. AT-S62 and AT-S62 NE Version New Features. Classifiers Access Control Lists Quality of Service Power over Ethernet (IEEE 802.3af ) (AT-8524POE switch only) Resolved Issues. The following issues were resolved in this release: Port mirroring did not mirror egress CPU management packets. (1593) The management software did not display an error message if a port was designated as both the destination port and a source port of a port mirror. (1601) Importing an SSH or SSH2 encryption key from the AT-S62 file system to the encryption key database using the HEX format caused the switch to stop forwarding packets. The management software now displays an error message if you use an inappropriate format when importing a key. (1726) The detection of a possible IP options Denial of Service attack caused the management software to display a list of ports on the console screen rather than just the one port where the attack was detected. (1653) PN Rev A 3 Allied Telesyn, Inc.

4 The management software did not display an error message if you tried to set the speed of a GBIC module in an AT-A47 module to something other than 1000 Mbps. (1638) The management software did not display an error message if you selected invalid speed and duplex settings for the optional AT-A45 fiber optic module. (1658, 1719) A port that had learned its maximum number of MAC addresses while operating in the Limited security mode would accept one additional packet with an unknown MAC address if the packet was a management packet. (1691) The switch allowed you to configure ports 25 and 26 on an AT-8524M switch before you had installed expansion modules, which could of resulted in an invalid port configuration where the port settings were incompatible with a module. The management software now does not allow you to configure an expansion slot until an expansion module is installed. (1633) IGMP snooping, when set to the Multi-Host setting, continued to send multicast packets out a port even after host nodes issued leave requests. Additionally, the switch did not forward leave requests to the multicast router port. (1713) The switch did not send an EAPOL-LOGOFF message when 802.1x port-based access control was disabled. (1714) The LINK LED on an optional uplink port remained lit even when the port was disabled. (1712) Changing the router port settings without first disabling IGMP caused the switch management to hang. (1753) The switch delayed by several minutes the release of an IP address obtained from a DHCP server after the expiration of the lease time. (1785) The port control setting of Force-authorized in 802.1x port-based access control caused an authenticator port to discard all ingress CPU and management traffic. This obstructed remote management of the unit. (1787) Adjusting the Held Period parameter for an authenticator port in 802.1x port-based access control had no affect. (1790) The AT-S62 file system could support only 25 files. The switch can now support up to 254 files with a maximum file size of 2000 kilobytes. (1794) The 802.1x Port-based Access Control could access only the first two IP addresses of RADIUS authentication servers in the RADIUS client software. The feature can now access all three addresses. (1795) Selecting but not entering a value for the Description parameter for a port inserted an invalid command in the switch s boot configuration file. (1800) Pressing the tab key repeatedly when entering a command resulted in duplicate keywords. (1708, 1709, 1710, 1715) Entering the SET SWITCH PORT command without specifying any parameters other than a port number failed to display an error message. (1679) PN Rev A 4 Allied Telesyn, Inc.

5 The SHOW QOS CONFIG command periodically displayed a kernel error message if you typed c for Continuous at the end of the display. (1700) Not all changes made to a switch s configuration from the command line were logged in the event log. (1732) The switch displayed the wrong error message if you specified a nonexistent port on a switch when adding a static MAC address. (1699) The fragments statistics counter in the web interface was nonfunctional. (1706) The options in the System Utilities tab produced unpredictable results. The options now function properly. (1723, 1724, 1656) Configuring an AT-A46 expansion module from the web interface produced unpredictable results. (1730) You could not assign an empty expansion slot to a VLAN from a web browser management session. (1791) A port could have only one set of MSTP parameter settings, even if it belonged to more than one multiple spanning tree instance (MSTI). Now, a port that belongs to multiple instances can have different MSTP settings for each instance. (1660) The switch supported 802.1x access control only on untagged ports. This feature is now also supported on tagged ports. However, only one user will be allowed to log on to a port on the switch, regardless of whether the port is tagged or untagged. Failure to properly exit from a web browser management session blocked local management sessions of the switch. The switch now gives a network manager the option of ending a web browser management session if it detects a session is in progress when the network manager starts a local management session. (1701) The switch did not revert to the standard Manager and Operator accounts if you specified invalid global or per-server secrets when configuring the TACACS+ client software and tried to log on to the switch s management software using a TACACS+ user account. The firmware now reverts to the standard accounts. (2176) Operational Notes Flow control and back pressure on the AT-8550GB and AT-8550SP switches are operational among devices connected to the following port groups, but are not operational between these two groups: (1361) - Group 1: Ports 1 to 24 and 49 - Group 2: Ports 25 to 48 and 50 The SNTP client software on the switch sends a Transmit Time Stamp with a value NULL when synchronizing with a Network Time Protocol server. This should not affect the operations of the SNTP client software. (1676) PN Rev A 5 Allied Telesyn, Inc.

6 Disconnecting the Rx fiber strand without also simultaneously disconnecting the Tx strand from a optional Gigabit Ethernet fiber optic port while there is traffic on the cable may cause the port to fail, requiring you to reboot the system. When disconnecting the fiber optic cable from a Gigabit Ethernet fiber optic port, be sure to disconnect both Rx and Tx strands simultaneously. (2088) The feature for setting the maximum amount of power a powered device can draw from a port on an AT-8524POE switch is nonfunctional. The default setting of 15.4W cannot be change. (2250) To configure classifiers, access control lists, or QoS policies, you must use the menu interface or the command line commands. You cannot configure these features from the web browser interface. (2321, 2322) The ingress and egress ports of a Quality of Service policy on an AT-8550GB or AT-8550SP switch must be from either of the following two groups. A QoS policy cannot contain ports from both groups: (2346) - Group 1: Ports 1 to 24 and 49 - Group 2: Ports 25 to 48 and 50 The previous version of the AT-S62 Management Software User s Guide incorrectly stated that each VLAN required its own RADIUS authentication server for 802.1x port-based access control. Actually, only one authentication server is required regardless of the number of VLANs on a switch. However, the server must be communicating with the switch through a switch port that is a tagged or untagged member of the management VLAN. Do not use Microsoft s NotePad to edit or view a configuration file. There are some versions of NotePad that may add formatting codes to the file. Use WordPad instead, or some other text editor that will not add formatting codes to the file. When saving the file, do not change the.cfg extension in the filename and be sure to save the file without formatting codes. The enhanced stacking feature of the AT-S62 management software uses the IP address Do not assign this address to any device on your subnet if you intend to use the enhanced stacking feature. The port on the AT-A46 module supports Auto-MDI only when set to Auto Neg mode. The maximum length of a login password is 16 alphanumeric characters for manager accounts created through the RADIUS and TACACS+ authentication protocols and passwords for supplicant accounts for 802.1x port-based access control. Manager and supplicant accounts with passwords that exceed the limit are denied access to the switch. The activity LED on the AT-A45 module illuminates only for egress traffic. (1775) The parameter settings of a port are not returned to the default values when a port is removed from a port trunk. The port retains whatever settings it had when it was a member of the trunk. (2144) The PORT parameter featured in many of the AT-S62 command line commands has an ALL option for specifying all ports on a switch. However, on the AT-8516F/SC and AT-8524M PN Rev A 6 Allied Telesyn, Inc.

7 switches, the option only works if there are expansion modules in the expansion slots. Otherwise, you will receive an error message. To specify all ports on a switch where one or both expansion slots are empty, enter the ports as a range. For example, for an AT-8524M switch you would enter PORT=1-24. (2026) The management software can take up to four minutes to time out a failed TFTP download, during which time you will not be able to manage the switch. The switch, when configured for IGMP, will not register tagged IGMP queries in the IGMP routers list if ingress filtering is disabled. The switch can take from 0.7x to 1.4x the user configured host/router timeout value to remove inactive host nodes and multicast routers from its IGMP table. The only way to view the switch s MAC address aging timer from the command line is with the SHOW CONFIG DYNAMIC command, which displays the unit s current configuration. The aging timer value will be in the MAC Timer Configuration section of the file. If the section does not contain a setting, the aging timer is operating at the default value of 300 seconds. (2092) Do not delete port trunks on a slave switch through enhanced stacking. The results can be unpredictable. Instead, use a local management session. (1618) The following MIB objects are not supported: AtiStkSwPortMirroringConfigInfo - Source- ModuleId, AtiStkSwPortMirroringConfigInfo - SourcePortId, and AtiStkSwPortMirroring- ConfigInfo - DestinationModuleId. (1829) To enter a static MAC address in the MAC Address field of the Add MAC Address page of the web browser interface, you must move the cursor manually from field to field. The cursor does not move automatically. (2123, 1699) Allied Telesyn does not recommend connecting more than one supplicant to a authenticator port when implementing 802.1x Port-based Access Control. (1382, 1343) Note Connecting multiple supplicants to a port set to the authenticator role does not conform to the IEEE 802.1x standard, can introduce security risks, and can result in undesirable switch behavior. Allied Telesyn recommends not using the authenticator role on a port that is connected to more than one end node, such as a port connected to another switch or a hub. PN Rev A 7 Allied Telesyn, Inc.

8 Known Issues The duplex mode LED on the AT-A46 Expansion Module may remain on when the module is installed but before a cable is connected to the port or after the link to the end node is lost. This does not affect the operations of the module. (1048) The TACACS+ client software on the switch supports Password Protection Protocol (PAP), but not Challenge Handshake Authentication Protocol (CHAP) or AppleTalk Remote Access Protocol (ARAP). (1078) A boot configuration file with a large number of configuration commands can take upwards of two minutes for the switch to load. (1093) Do not download a configuration file from a master switch to a slave switch without first modifying it with a text editor. Otherwise, a slave switch could end up with the same IP address, stacking status, and system name as the master switch. To modify a configuration file, upload it to a management workstation and edit it with a text editor. You can download the edited file directly onto the slave switches from a local management session or you can transfer it back to the master switch and perform a switch-to-switch download using the menu interface. The commands to modify or delete from the file are SET IP INTER- FACE, SET SYSTEM NAME, and SET SWITCH STACKMODE. (1509) The switch can take up to two minutes to obtain its IP configuration from a BOOTP server. The DHCP and BOOTP client software is designed to query for a DHCP server first. Only if there is no response will it query for a BOOTP server. (1521) Specifying a SET SWITCH PORT command that spans all ports may be entered inconsistently into a switch s boot configuration file. In some cases, the command in the file may include the ALL option, while in other instances there might be a separate command for each port. This inconsistency does not affect the operation of the boot configuration file. (1574) Tagged frames larger than 1522 bytes are counted in the Jabber statistics counter. This applies to base ports 1 to 24, but not to expansion module ports. (1705) The per-server secrets used in configuring authentication servers for the RADIUS and TACACS+ client software are deleted if they match the global secret. (2189) Do not enter a negative number when configuring the threshold temperature for the switch. (The switch sends an SNMP trap if the threshold is exceeded.) Entering a negative value inserts an invalid command into the switch s boot configuration file. When specifying a value, use the range 1 to 73 Celsius. (2334) MSTP can take up to 35 seconds to complete a reconvergence when loops are detected among ports in the Common and Internal Spanning Tree (CIST). (2352) You cannot configure a port as an edge port if it is connected to another device that is running MSTP. (2359) Valid settings for flow control on a port are enabled and disabled. Adjusting this parameter through the web browser interface includes an Auto setting. The Auto setting is invalid and should not be used. (2355) PN Rev A 8 Allied Telesyn, Inc.

9 The command line interface does not display an error message if you try to create a QoS policy that contains ingress and egress ports from different groups on an AT-8550GB or AT-8550SP switch. As mentioned earlier under Operational Notes, the ingress and egress ports of a Quality of Service policy on an AT-8550GB or AT-8550SP switch must be from either of the following two groups. A QoS policy cannot contain ports from both groups: (2536) - Group 1: Ports 1 to 24 and 49 - Group 2: Ports 25 to 48 and 50 Flow control on a 10/100/1000Base-T port will stop working if the speed on the end node is changed from 1000 Mbps to either 10 or 100 Mbps. To activate flow control on the switch port again, you must disable and enable flow control on the port using the management software. (2363) The rate limiting feature for controlling the number of ingress broadcast, multicast, and unknown unicast packets cannot be set on a per port basis. However, if you use the web browser interface to return a switch port to the default settings and the rate limiting feature has been configured on the switch, the port s rate limiting settings may differ from the other ports. This results in an invalid configuration. To avoid this issue, check a port s rate limiting settings with other ports to be sure they match whenever you use the web interface to reset a port to the default values. If they do not match, reset the rate limiting settings on the switch. (2357) An AT-8500 Series switch functioning as the master switch of an enhanced stack must be running AT-S62 V1.2.1 or later in order to recognize an AT-8524POE switch in a stack. The management software on a master AT-8500 Series switch running an earlier version should be upgraded if a stack contains an AT-8524POE switch. PN Rev A 9 Allied Telesyn, Inc.

10 Contacting Allied Telesyn This section provides Allied Telesyn contact information for technical support as well as sales or corporate information. Online Support You can request technical support online by accessing the Allied Telesyn Knowledge Base from the following web site: You can use the Knowledge Base to submit questions to our technical support staff and review answers to previously asked questions. and Telephone Support For Technical Support via or telephone, refer to the Support & Services section of the Allied Telesyn web site: For Sales or Corporate Information You can contact Allied Telesyn for sales or corporate information at our web site: To find the contact information for your country, select Contact Us then select Worldwide Contacts. Obtaining Management Software Updates New releases of management software for our managed products can be downloaded from either of the following Internet sites: Allied Telesyn web site: Allied Telesyn FTP server: ftp://ftp.alliedtelesyn.com To download new software from the Allied Telesyn FTP server from your workstation s command prompt, you will need FTP client software and you will be asked to log in to the server. Enter anonymous as the user name and your address for the password. PN Rev A 10 Allied Telesyn, Inc.