Cisco Blog » The Platform

2015年9月1日星期二

Cisco Notification Alert -Nexus 6000 Series Switch-01-Sep-2015 16:53 GMT

 

 

 

 

 

 

 


Security Advisories & Responses - Nexus 6000 Series Switches

Title:
OpenSSL Alternative Chains Certificate Forgery Vulnerability (July 2015) Affecting Cisco Products
Description:

On July 9, 2015, the OpenSSL Project released a security advisory detailing a vulnerability affecting applications that verify certificates, including SSL/Transport Layer Security (TLS)/Datagram Transport Layer Security (DTLS) clients and SSL/TLS/DTLS servers using client authentication.

Multiple Cisco products incorporate a version of the OpenSSL package affected by this vulnerability that could allow an unauthenticated, remote attacker to cause certain checks on untrusted certificates to be bypassed, enabling the attacker to forge "trusted" certificates that could be used to conduct man-in-the-middle attacks.

This advisory will be updated as additional information becomes available.

Cisco will release free software updates that address this vulnerability.

Workarounds that mitigate this vulnerability may be available.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150710-openssl

Date:
29-AUG-2015

Find additional information in Cisco Security Advisories & Responses

Software Updates for Nexus 6000 Series Switches

Product Name:
Nexus 6004 Switch
Software Type:
NX-OS System Software
Release Version:
7.1(2)N1(1)
Alert Type:
New File
File Name:
n6000-uk9.7.1.2.N1.1.bin
File Description:

Cisco Nexus 6000/5600 Series Switches 7.1(2)N1(1) System Image

File Release Date:
03-AUG-2015

Software Updates for Nexus 6000 Series Switches

Product Name:
Nexus 6004 Switch
Software Type:
NX-OS System Software
Release Version:
7.0(7)N1(1)
Alert Type:
New File
File Name:
n6000-uk9.7.0.7.N1.1.bin
File Description:

Cisco Nexus 6000/5600 Series Switches 7.0(7)N1(1) System Image

File Release Date:
27-AUG-2015
Find additional information in Software Downloads index.

Software Updates for Nexus 6000 Series Switches

Product Name:
Nexus 6004 Switch
Software Type:
NX-OS Kick Start
Release Version:
7.0(7)N1(1)
Alert Type:
New File
File Name:
n6000-uk9-kickstart.7.0.7.N1.1.bin
File Description:

Cisco Nexus 6000/5600 Series Switches 7.0(7)N1(1) Kick Start Image

File Release Date:
27-AUG-2015
Alert Type:
New File
File Name:
n6000_poap_script.7.0.7.N1.1.tcl
File Description:

Cisco Nexus 6000/5600 Series Switches 7.0(7)N1(1) TCL Reference script for PowerOn Auto Provisioning (POAP)

File Release Date:
27-AUG-2015
Alert Type:
New File
File Name:
n6000_poap_script.7.0.7.N1.1.py
File Description:

Cisco Nexus 6000/5600 Series Switches 7.0(7)N1(1) Python Reference script for PowerOn Auto Provisioning (POAP)

File Release Date:
27-AUG-2015

Software Updates for Nexus 6000 Series Switches

Product Name:
Nexus 6004 Switch
Software Type:
NX-OS Kick Start
Release Version:
7.1(2)N1(1)
Alert Type:
New File
File Name:
n6000_poap_script.7.1.2.N1.1.tcl
File Description:

Cisco Nexus 6000/5600 Series Switches 7.1(2)N1(1) TCL Reference script for PowerOn Auto Provisioning (POAP)

File Release Date:
31-JUL-2015
Alert Type:
New File
File Name:
n6000-uk9-kickstart.7.1.2.N1.1.bin
File Description:

Cisco Nexus 6000/5600 Series Switches 7.1(2)N1(1) Kick Start Image

File Release Date:
31-JUL-2015
Alert Type:
New File
File Name:
n6000_poap_script.7.1.2.N1.1.py
File Description:

Cisco Nexus 6000/5600 Series Switches 7.1(2)N1(1) Python Reference script for PowerOn Auto Provisioning (POAP)

File Release Date:
31-JUL-2015
Find additional information in Software Downloads index.

Software Updates for Nexus 6000 Series Switches

Product Name:
Nexus 6001 Switch
Software Type:
NX-OS System Software
Release Version:
7.0(7)N1(1)
Alert Type:
New File
File Name:
n6000-uk9.7.0.7.N1.1.bin
File Description:

Cisco Nexus 6000/5600 Series Switches 7.0(7)N1(1) System Image

File Release Date:
27-AUG-2015

Software Updates for Nexus 6000 Series Switches

Product Name:
Nexus 6001 Switch
Software Type:
NX-OS System Software
Release Version:
7.1(2)N1(1)
Alert Type:
New File
File Name:
n6000-uk9.7.1.2.N1.1.bin
File Description:

Cisco Nexus 6000/5600 Series Switches 7.1(2)N1(1) System Image

File Release Date:
31-JUL-2015
Find additional information in Software Downloads index.

Software Updates for Nexus 6000 Series Switches

Product Name:
Nexus 6001 Switch
Software Type:
NX-OS Kick Start
Release Version:
7.1(2)N1(1)
Alert Type:
New File
File Name:
n6000_poap_script.7.1.2.N1.1.tcl
File Description:

Cisco Nexus 6000/5600 Series Switches 7.1(2)N1(1) TCL Reference script for PowerOn Auto Provisioning (POAP)

File Release Date:
31-JUL-2015
Alert Type:
New File
File Name:
n6000_poap_script.7.1.2.N1.1.py
File Description:

Cisco Nexus 6000/5600 Series Switches 7.1(2)N1(1) Python Reference script for PowerOn Auto Provisioning (POAP)

File Release Date:
31-JUL-2015
Alert Type:
New File
File Name:
n6000-uk9-kickstart.7.1.2.N1.1.bin
File Description:

Cisco Nexus 6000/5600 Series Switches 7.1(2)N1(1) Kick Start Image

File Release Date:
31-JUL-2015

Software Updates for Nexus 6000 Series Switches

Product Name:
Nexus 6001 Switch
Software Type:
NX-OS Kick Start
Release Version:
7.0(7)N1(1)
Alert Type:
New File
File Name:
n6000_poap_script.7.0.7.N1.1.py
File Description:

Cisco Nexus 6000/5600 Series Switches 7.0(7)N1(1) Python Reference script for PowerOn Auto Provisioning (POAP)

File Release Date:
27-AUG-2015
Alert Type:
New File
File Name:
n6000-uk9-kickstart.7.0.7.N1.1.bin
File Description:

Cisco Nexus 6000/5600 Series Switches 7.0(7)N1(1) Kick Start Image

File Release Date:
27-AUG-2015
Alert Type:
New File
File Name:
n6000_poap_script.7.0.7.N1.1.tcl
File Description:

Cisco Nexus 6000/5600 Series Switches 7.0(7)N1(1) TCL Reference script for PowerOn Auto Provisioning (POAP)

File Release Date:
27-AUG-2015
Find additional information in Software Downloads index.

Known Bugs - Nexus 6000 Series Switches

Alert Type:
Updated *
Bug Id:
CSCut74244
Title:
[iluka MR5] Fex not coming up after ISSU ND
Status:
Fixed
Severity:
2 Severe
Description:

Symptom:
Fexes in AA-Version Mismatch State do not come up in the secondary switch with NDISSU

Conditions:
Did a reload on the secondary switch before doing the ISSU ND.

Workaround:
Did shut / no shut on the up-link port.

Further Problem Description:

Last Modified:
25-AUG-2015
Known Affected Releases:
7.0(6)N1(0.6)
Known Fixed Releases: *
7.0(7)N1(0.294), 7.0(7)N1(1), 7.0(7)ZN(0.194), 7.2(1)N1(0.292), 7.2(1)N1(1), 7.2(1)ZN(0.56)
Alert Type:
New
Bug Id:
CSCuu96337
Title:
N5672UP NFM crash after config change
Status:
Fixed
Severity:
2 Severe
Description:

Symptom:
NFM Crash due to Memory leak happens when there is a range of VLAN's being activated for Netflow on Multiple interfaces

Conditions:
Nexus5672UP
NXOS7.0(6)N1(1)

Workaround:


1) Not activating netflow for a range of vlan's


Further Problem Description:

Last Modified:
24-AUG-2015
Known Affected Releases:
7.0(6)N1(0.1)
Known Fixed Releases:
7.0(7)N1(0.291), 7.0(7)N1(1), 7.0(7)ZN(0.186), 7.2(1)N1(0.274), 7.2(1)N1(1), 7.2(1)ZN(0.38)
Alert Type:
New
Bug Id:
CSCuu65634
Title:
pkt based auto-config access port does not work after profile is removed
Status:
Fixed
Severity:
2 Severe
Description:

Symptom:
After a native vlan is auto-configured, then cleared with "clear fabric database host all"
auto-config will stop working on the native vlan, and untagged packets will be seen on dot1q
reserved vlan 4041.

Conditions:
n6k box in vinci setup with autoconfig enabled

Workaround:

Further Problem Description:
We do some checks with FWM_FWIM_LIF_UNTAG_DEFAULT_VLAN() that checks whether to untag the default
vlan from a port. This function is currently returning FALSE when the native vlan of a port is down
with fwm_fwim_vlan_state_deleted(). However auto-config will allow this port to receive packets on
the native vlan even when it is down.When this function returns FALSE, we go and set the default_vlan of the port to dot1q reserved vlan4041. This seems fine without auto-config, but because we would want packets to trigger vlan
creation of native vlan, we should not be returning FALSE when the native vlan is down.

Last Modified:
24-AUG-2015
Known Affected Releases:
7.0(6)N1(0.269)
Known Fixed Releases:
7.0(7)N1(0.70), 7.0(7)N1(1), 7.0(7)ZN(0.149)
Alert Type:
New
Bug Id:
CSCuw01105
Title:
DFA: multicast duplicate packets or loop on border leafs
Status:
Open
Severity:
2 Severe
Description:

Symptom:
Duplicate multicast packets seen in multicast receiver in fabric for outside fabric source.
Multicast loop packets seen for multicast receiver in fabric for inside fabric source.

Conditions:
Connection between fabric and external devices happend to 2 border leafs that see each other on a shared L2 segment, i.e. each border leaf sees the external router as well as the other border leaf as PIM neighbor.

Workaround:
Under investigation.

Further Problem Description:

Last Modified:
29-AUG-2015
Known Affected Releases:
7.1(2)N1(1)
Known Fixed Releases:
Alert Type:
New
Bug Id:
CSCuq59436
Title:
IPQOSMGR-4-QOSMGR_PPF_WARNING: PPF library warning: DDB Error: 0x4117004
Status:
Fixed
Severity:
2 Severe
Description:

Symptom:
The following error appears on the console at boot up stage.
?IPQOSMGR-4-QOSMGR_PPF_WARNING: PPF library warning: DDB Error: 0x41170040?

Conditions:
Error message displayed on boot up of n5500/ n6000

Workaround:
No workaround available

Further Problem Description:
This issue doesn't have an impact on the functionality.

Last Modified:
27-AUG-2015
Known Affected Releases:
7.0(4)N1(0.148), 7.2(0)N1(0.134)
Known Fixed Releases:
7.0(7)ZN(0.124), 7.1(2)N1(0.544), 7.1(2)N1(1), 7.1(2)ZN(0.3), 7.2(0)N1(0.166), 7.2(0)N1(1), 7.2(0)VZN(0.34), 7.2(0)ZN(0.169), 7.3(0)N1(0.25), 7.3(0)N1(1)
Alert Type:
New
Bug Id:
CSCuv30768
Title:
fwm core on best_n6k_issu_n6000_NXOS
Status:
Open
Severity:
2 Severe
Description:

Symptom:
fwm crashes and cored in kokomo image REL_7_3_0_ZN_0_59 for for zn7_3_bundle

Conditions:
On loading the setup with image and applying the configs,the box crashes.


Workaround:

Further Problem Description:


Last Modified:
20-AUG-2015
Known Affected Releases:
7.3(0.59)
Known Fixed Releases:
Alert Type:
Updated *
Bug Id:
CSCuq70941
Title:
Inherit command on Nexus is not working with TACACS authorization
Status:
Fixed
Severity:
2 Severe
Description: *

Symptom:
Users may see the below errors:

de1dsw23702s-1(config)# no vrf context PUB-PRD-C2
ERROR: Failed to write VSH commands

Conditions:
Inherit command on Nexus is not working with TACACS authorization enabled.

Workaround:
Remove TACACS authorization commands

Further Problem Description:
In a DFA / Standalone Fabric environment, this defect may cause the user to see authentication/authorization failures on their authentication servers from the 'root' user. The fixed releases of code will prevent this behavior.

Last Modified:
11-AUG-2015
Known Affected Releases:
7.0(2)N1(1), 7.0(4)N1(1), 7.1(0)N1(0.319)
Known Fixed Releases:
7.0(1)ZN(0.553), 7.0(4)N1(0.158), 7.0(4)N1(1), 7.1(0)N1(0.322), 7.1(0)N1(1), 7.1(0)ZN(0.406), 7.2(0)ZN(0.93), 9.9(0)BS(0.13)
Alert Type:
New
Bug Id:
CSCuq89049
Title:
FC4 Type missing for hosts in the FCNS table
Status:
Open
Severity:
2 Severe
Description:

Symptom:
Some host unable to re-login after shut down of one NPIV-NPV link. Flogis missing

Conditions:
More than one link (logical link - either PO or ethernet ports) between NPIV and NPV switch

Workaround:
Flap the host port with missing flogis

Further Problem Description:

Last Modified:
20-AUG-2015
Known Affected Releases:
7.1(0)N1(0.305)
Known Fixed Releases:
Alert Type:
New
Bug Id:
CSCuq23466
Title:
CLEM: L2MP: Traffic between two switch ids is limited to 40g
Status:
Terminated
Severity:
2 Severe
Description:

Symptom:
On 100g LEM, L2MP Traffic between two switch ids is limited to 40g.

Conditions:
L2MP traffic between two switches has to be sent on a 100G LEM link

Workaround:
None

Further Problem Description:

Last Modified:
20-AUG-2015
Known Affected Releases:
7.1(0)N1(0.236)
Known Fixed Releases:
Alert Type:
New
Bug Id:
CSCuq57437
Title:
100G:Acl-based classification not supported
Status:
Terminated
Severity:
2 Severe
Description:

Symptom:
We see ingress BMI drops due to congestion at the egress interface on N96-1. The same egress interface happens to be the routing interface for erspan traffic and 100% BW is allocated to class-default. Total SPAN traffic is 40G and it should use 40% of BW of class-default. Remaining 60% BW should be utilized by class-4(regular traffic) and we should see 60% regular traffic. But we are not seeing that. There seem to be issue in the class mapping of Century.

Conditions:
this is due to not supporting Acl-based classification. All the traffic enter into default class and hence we see this case.

Workaround:

Further Problem Description:

Last Modified:
31-AUG-2015
Known Affected Releases:
7.1(0)N1(0.309)
Known Fixed Releases:
Alert Type:
New
Bug Id:
CSCut57364
Title:
DFA Autoconf/Profile-refresh failing if using vlan name in the profile
Status:
Fixed
Severity:
3 Moderate
Description:

Symptom:
DFA Autocon/Profile-refresh failing if using vlan name in the profile

Conditions:
Using vlan name in the profile

Workaround:
Do not use vlan name in the profile or use a dummy vlan name when changing another parameter and changing it back to the initial value afterwards

Further Problem Description:

Last Modified:
24-AUG-2015
Known Affected Releases:
7.1(0)N1(0.438)
Known Fixed Releases:
7.0(7)ZN(0.108), 7.2(0)N1(0.194), 7.2(0)N1(1), 7.2(0)VZN(0.34), 7.2(0)ZN(0.197), 7.3(0)N1(0.25), 7.3(0)N1(1), 7.3(0)ZN(0.24)
Alert Type:
New
Bug Id:
CSCus28695
Title:
WCCP - ACL Remark breaks TCAM redirection entry
Status:
Fixed
Severity:
3 Moderate
Description:

Symptom:
WCCP redirects all traffic instead of redirecting specified traffic via ACL. Observed with Nexus 5600/6000 switches.

Conditions:
ACL using Remark entry.

Workaround:
Do not use ACL remark. TCAM redirection happens normally.

Further Problem Description:

Last Modified:
20-AUG-2015
Known Affected Releases:
7.0(4)N1(0.168)
Known Fixed Releases:
7.0(7)ZN(0.108), 7.1(2)N1(0.543), 7.1(2)N1(1), 7.1(2)ZN(0.2), 7.2(1)N1(0.16), 7.2(1)N1(1), 7.3(0)N1(1)
Alert Type:
New
Bug Id:
CSCuv15362
Title:
Speed auto negotiate can not be disabled on FEX 1G SFP port.
Status:
Open
Severity:
3 Moderate
Description:

Symptom:
FEX 1G SFP interface will be down (link not connected) if peer switch config "speed nonegotiate" on the interface .

Conditions:
FEX module must be SFP linecard and use 1G link .

Workaround:
No workaround

Further Problem Description:

Last Modified:
20-AUG-2015
Known Affected Releases:
6.2(8a)
Known Fixed Releases:
Alert Type:
New
Bug Id:
CSCuv64320
Title:
Multiple snmp mib community-map not shown in config
Status:
Open
Severity:
3 Moderate
Description:

Symptom:
Only the first configured snmp mib community-map is shown in the running-config

Conditions:
Configure multiple snmp mib community-map

Workaround:
"show snmp community" returns correct current inforamtion

Further Problem Description:

Last Modified:
20-AUG-2015
Known Affected Releases:
7.2(0)N1(1)
Known Fixed Releases:
Alert Type:
New
Bug Id:
CSCue60401
Title:
Telnet disconnect if we have binary characters in the show output
Status:
Fixed
Severity:
3 Moderate
Description:

Symptom:Non-ascii characters in the display of "show fex version"

Conditions:Rare situations.
Workaround:No known workaround. Need this fix.
More Info:


Last Modified:
20-AUG-2015
Known Affected Releases:
5.0(3)N2(2b)
Known Fixed Releases:
7.0(7)ZN(0.108), 7.1(1)ZN(0.115), 7.1(2)N1(0.536), 7.1(2)N1(1), 7.2(0)AB(9), 7.2(0)N1(0.127), 7.2(0)N1(1), 7.2(0)VZN(0.7), 7.2(0)ZN(0.135), 7.3(0)N1(0.3)
Alert Type:
Updated *
Bug Id:
CSCuv42326
Title:
SPAN destination on HIF port does not work for A/A FEXes.
Status:
Fixed
Severity:
3 Moderate
Description:

Symptom:
SPAN destination on A/A FEXes do not work if the FEX is N2K-C2248PQ-10GE

Conditions:
An A/A HIF port is configured as SPAN destination port in a Nexus 5K/6K series switches

Workaround:
None

Further Problem Description:

Last Modified:
14-AUG-2015
Known Affected Releases:
7.2(0)N1(1)
Known Fixed Releases: *
7.3(0)N1(0.93), 7.3(0)N1(1), 7.3(0)ZN(0.88)
Alert Type:
Updated *
Bug Id:
CSCuv45482
Title:
LEM is not coming with the kokomo image
Status:
Other
Severity:
3 Moderate
Description: *

$$PREFCS

Symptom:
LEM Module is not booting up

Conditions:
LEM Module is not booting up with the kokomo image.

Workaround:
No

Further Problem Description:

Last Modified:
10-AUG-2015
Known Affected Releases:
7.3(0)N1(0.30)
Known Fixed Releases:
Alert Type:
Updated *
Bug Id:
CSCuu97186
Title:
N6k - Fabricpath Unexpected RPF failure post PSU loss powering off mod's
Status: *
Terminated
Severity:
3 Moderate
Description:

Symptom:
N6k may experience unexplained RPF failures which may cause HSRP or other Control Protocol peering issues.
On ASIC level drops are seen for this reason:
BIG_DROP_SRC_FTAG_RPF

Conditions:
Issue is so far seen with N6004 switches when enough PSU's are lost/shutdown due to any reason causing modules/LEM's to poweroff, while SUP remains up. In short seen when 4 out of 6 PSU's fail or powered Off.
On power restoration HSRP is seen flapping as peer hello's are not received consistently.
Issue does not happen when a complete reload of the chassis or powercycle of the module is performed.

Workaround:
Shut/no shut of the affected interfaces recovers the situation.

Further Problem Description:

Last Modified:
05-AUG-2015
Known Affected Releases:
7.0(5)N1(1), 7.1(1)N1(1)
Known Fixed Releases:
Alert Type:
Updated *
Bug Id:
CSCuu06291
Title:
Nexus 5600 large lcuc files in var/tmp
Status:
Other
Severity:
4 Minor
Description: *

Symptom:/var/tmp directory is full of "lcuc-xxx.log" files.

You may run into this defect when trying to upgrade via ISSU, because your /var/tmp is full:

Pre-upgrade check failed. Return code 0x40930062 (free space in the filesystem is below threshold)

Nexus5600# show system internal dir /var/tmp | inc log
lcuc-25889.log 400
lcuc-15402.log 400
lcuc-11364.log 400
lcuc-20484.log 400
lcuc-3761.log 212711878

Conditions:Nexus 5600/6000

every time when show interface transceiver details command is issued DOM related info are getting logged in lcuc log file.
Workaround:workaround to delete unwanted files

1) Check file name using CLI  show system internal dir /var/tmp/ | grep *lcuc*
2)Use CLI to delete file - filesys delete /var/tmp/lcuc-3858.log

More Info:


Last Modified:
04-AUG-2015
Known Affected Releases:
7.1(1)BT(0.2)
Known Fixed Releases:
Alert Type:
Updated *
Bug Id:
CSCut46788
Title:
Nexus 5600: Logon prompt not correct when hostname begins with number
Status:
Fixed
Severity:
5 Cosmetic
Description:

Incorrect hostname at logon prompt when it starts with number.

Symptom:
When the hostname of the switch starts with a number, instead of alphabet the login prompt or the prompt after exiting command prompt does not reflect correct switch hostname.

For example-

change the hostname to "1TEST" and exit.

1TEST# exit

User Access Verification
H1-AA06-5672-A login: <------------- This host name was previous hostname starting with alphabet.

Conditions:
When the hostname of the switch starts with a number, instead of alphabet the login prompt or the prompt after exiting command prompt does not reflect correct switch hostname.

Workaround:
None

Further Problem Description:
None

Last Modified:
10-AUG-2015
Known Affected Releases: *
7.0(5)N1(1), 7.3(0.28)
Known Fixed Releases:
7.0(7)N1(1), 7.0(7)ZN(0.108), 7.1(1)ZN(0.107), 7.1(2)N1(0.529), 7.1(2)N1(1), 7.2(1)N1(0.5), 7.2(1)N1(1), 7.3(0)N1(1)
Alert Type:
Updated *
Bug Id:
CSCut87698
Title:
Nexus: Option 82 circuit-id same for all host when using relay
Status:
Fixed
Severity:
6 Enhancement
Description:

Symptom:
When a nexus switch acts as a relay agent, configured to insert option-82, the circuit-id is same for all host even when they are connected to different ports.

Conditions:
Nexus switch acting as a relay agent, configured to insert option-82

Workaround:
none

Further Problem Description:

Last Modified:
25-AUG-2015
Known Affected Releases:
6.2(10)
Known Fixed Releases: *
7.3(0)N1(0.105), 7.3(0)N1(1), 7.3(0)ZN(0.98)

Find additional information in Bug Search index.

 

2013 Cisco and/or its affiliates. All rights reserved. Terms & Conditions | Privacy Statement | Cookie Policy | Trademarks

 

没有评论:

发表评论