relnote_awp545-1.3

Software Maintenance Release Note

AlliedWare Plus™ Software Version 5.4.5-1.3For SwitchBlade x8100, SwitchBlade x908, x930, x610, x510, IX5, x310,x230 and x210 Series Switches and AR4050 and AR3050 securityappliances

IntroductionThis document lists the issues addressed in AlliedWare Plus™ softwaremaintenance version 5.4.5-1.3.

Read this maintenance release note in conjunction with the:

■ New and Enhanced Features in AlliedWare Plus 5.4.5 Major and Minor Versions,Available from: http://alliedtelesis.com/support/documentation_keyword_newand enhanced.aspx, which describes new and enhanced features in this andprevious minor and major versions since AlliedWare Plus 5.4.4.

■ Software Reference for AlliedWare Plus™ Operating System Version 5.4.5 foryour switch.

ContentsIntroduction ...................................................................................................... 1Installing the GUI to your Switch using an SD Card or USB Device ..................... 4Installing the GUI to your Switch via TFTP Server ............................................... 6Installing and Enabling this Version ................................................................... 8ISSU (In-Service Software Upgrade) on SBx8100 with CFC960 ......................... 10Enhancements in 5.4.5-1.3 ............................................................................. 11Enhancements in 5.4.5-0.3 ............................................................................. 12Issues Resolved in 5.4.5-1.3 ............................................................................ 13Issues Resolved in 5.4.5-0.4 ............................................................................ 19Issues Resolved in 5.4.5-0.3 ............................................................................ 23Issues Resolved in 5.4.5-0.2 ............................................................................ 35

http://alliedtelesis.com/support/documentation_keyword_new and enhanced.aspx

http://alliedtelesis.com/support/documentation_keyword_new and enhanced.aspx

AlliedWare Plus Software Maintenance Release Note: 5.4.5-1.3 2

Models Series Release File Date GUI file

x210-9GT

x210-16GT

x210-24GT

x210 x210-5.4.5-1.3.rel Sep 2015 x210-gui_544_08.jar

x230-10GPx230-18GP


x310-26FT

x310-50FT

x310-26FP

x310-50FP


IX5-28GPX IX5 IX5-5.4.5-1.3.rel Sep 2015 IX5-gui_544_09.jar

x510-28GTX

x510-52GTX

x510-28GPX

x510-52GPX

x510-28GSX

x510-28GSX-80

x510DP-28GTX

x510DP-52GTX

x510L-28GT

x510L-28GP

x510L-52GT

x510L-52GP


x610-24Ts

x610-24Ts-POE+

x610-24Ts/X

x610-24Ts/X-POE+

x610-24SPs/X

x610-48Ts

x610-48Ts-POE+

x610-48Ts/X

x610-48Ts/X-POE+


SwitchBlade x908* SBx908 SBx908-5.4.5-1.3.rel Sep 2015 x900-gui_544_08.jar

x930-28GTX

x930-28GPX

x930-52GTX

x930-52GPX

x930 x930-5.4.5-1.3.rel

SBx81CFC400

SBx81CFC960

SBx8100 SBx81CFC400-5.4.5-1.3.rel

SBx81CFC960-5.4.5-1.3.rel

Sep 2015 SBx81CFC400_gui_544_09.jar

SBx81CFC960_gui_544_05.jar

AR3050S NGFW AR3050S-5.4.5-1.3.rel Sep 2015

AR4050S NGFW AR4050S-5.4.5-1.3.rel Sep 2015

Supported Models and Software File Names

Table 1: Supported switch models and software file names

C613-10520-00-REV C


Caution:Using a software version file for the wrong switch model may causeunpredictable results, including disruption to the network. Information in thisrelease note is subject to change without notice and does not represent acommitment on the part of Allied Telesis, Inc. While every effort has been madeto ensure that the information contained within this document and the featuresand changes described are accurate, Allied Telesis, Inc. can not accept any typeof liability for errors in, or omissions arising from, the use of this information.

Table 2: *Expansion modules for the SwitchBlade x908 in version 5.4.5

Product Supported in version 5.4.5

XEM-1XP No

XEM-2XP Yes

XEM-2XS Yes

XEM-2XT Yes

XEM-12S No

XEM-12T No

XEM-12Sv2 Yes

XEM-12Tv2 Yes

XEM-24T Yes

C613-10520-00-REV C


Installing the GUI to your Switch using an SD Card orUSB Device

1. Download a GUI Java applet.

The GUI Java applet file is available in a compressed (zip) file with theAlliedWare Plus Operating System software from the Software Downloadarea of the Allied Telesis Website: http://www.alliedtelesis.com/support/software/restricted. Log in using your assigned Email Address andPassword. Download the Java applet file. This file will have a .zip filename extension. You need to extract the Java .jar file from the compressed.zip file. The version number of the software applet file (.jar) gives theearliest version of the software file (.rel) that the GUI can operate with.

2. Copy the GUI Java applet .jar file to an SD card or USB storage device.

Insert the SD card in the SD slot on the front of your switch or the USBdevice into the USB port on the switch. Connect to the management port,then login to the switch.

Copy the GUI Java applet to your switch, using the below commands:

awplus# copy card:/<filename.jar> flash:/

or

awplus# copy usb:/<filename.jar> flash:/

Where <filename.jar> is the GUI Java applet file you downloaded inStep 1.

Note: Where the GUI file is not in the root directory of the USB flash drive, you mustenter the full path to the GUI file. For example, where the GUI file resided in the foldergui_files, you would enter the command: copy usb:/gui_files/filename.jar flash:/

3. Assign IP addresses.

Use the following commands to assign the IP addresses for connecting tothe Java applet.

awplus# configure terminal

awplus(config)# interface vlan1

awplus(config-if)# ip address <address>/<prefix-length>

Where <address> is the IP address that you will subsequently browse towhen you connect to the GUI Java applet. For example, to give the switchan IP address of 192.168.2.6, with a subnet mask of 255.255.255.0,use the following command:

awplus(config-if)# ip address 192.168.2.6/24

4. Configure the gateway.

Configure your switch with a default gateway, if necessary, using thesecommands:

awplus(config-if)# exit

awplus(config)# ip route 0.0.0.0/0 <gateway-address>

Where <gateway-address> is the IP address for your gateway device.Note that you do not need to define a default gateway if you browse to theswitch from within its own subnet.

C613-10520-00-REV C

http://www.alliedtelesis.com/support/software/restricted.

http://www.alliedtelesis.com/support/software/restricted.


5. Create a user account.

In order to log into the GUI, you must first create a user account. Use thesecommands to setup a user account:

awplus(config)# username <username> privilege 15 password<password>

awplus(config)# exit

Note that you can create multiple users to log into the GUI. See theAlliedWare Plus Software Reference for information about the usernamecommand.

6. Ensure HTTP service is enabled.

The HTTP service needs to be enabled on the switch before it acceptsconnections from a web browser. The HTTP service is enabled by default.However, if the HTTP service has been disabled, you must enable the HTTPservice again. If the HTTP service is disabled, use the following commandto enable it:

awplus(config)# service http

See the AlliedWare Plus Software Reference for information about the servicehttp command.

7. Log into the GUI.

Start a browser and enter the IP address you configured in Step 3 as theURL. You will be presented with a login screen after the GUI Java applet hasstarted. Log in with the username and password that you defined in theearlier step, named Create a user account.

Note: Any configuration changes should be saved to ensure the device settings areretained.

C613-10520-00-REV C


Installing the GUI to your Switch via TFTP Server

1. Download a GUI Java applet file from the support site.

The GUI Java applet file is available in a compressed (.zip) file with theAlliedWare Plus Operating System software from the Support area of theAllied Telesis Website: http://www.alliedtelesis.com. Download the Javaapplet file. This file will have a .zip file name extension. You need toextract the Java .jar file from the compressed .zip file. The versionnumber of the software applet file (.jar) gives the earliest version of thesoftware file (.rel) that the GUI can operate with.

2. Copy the GUI applet.

Copy the GUI applet .jar file onto a TFTP server. Ensure this TFTP server isenabled and ready for the switch. Connect to the management port of theswitch, then login to the switch. Do not connect to the management port ofthe TFTP server

3. Assign the IP addresses.

Use the following commands to configure your switch with an appropriateIP address:

awplus# configure terminal

awplus(config)# interface vlan1


Where <address> is the IP address that you will subsequently browse towhen you connect to the GUI Java applet. For example, to give the switchan IP address of 192.168.2.6, and a subnet mask of 255.255.255.0,use the following command:


Use the following commands to configure your switch with a defaultgateway:


awplus(config)# ip route 0.0.0.0/0 <gateway-address>

4. Configure the default gateway.

In necessary, use the following commands to configure the default gateway.


awplus(config)# ip route 0.0.0.0/0 <gateway address>

Where <gateway-address> is the IP address for your gateway device.Note that you do not need to define a default gateway if you browse to theswitch from within its own subnet.

5. Copy the GUI Java applet to your switch.

Use the following commands to copy the GUI Java applet to your switch:

awplus# copy tftp://<server-address>/<filename.jar>flash:/

Where <server-address> is the IP address for the TFTP server, andwhere <filename.jar> is the GUI Java applet file you downloaded inStep 1.

C613-10520-00-REV C

http://www.alliedtelesis.co.nz/support/updates/controlled/

http://www.alliedtelesis.com


6. Create a user account.

In order to log into the GUI, you must first create a user account. Use thefollowing commands to setup a user account.

awplus(config)# username <username> privilege 15 password<password>

awplus(config)# exit

Note that you can create multiple users to log into the GUI. See theAlliedWare Plus Software Reference for information about the usernamecommand.

7. Start the Java Control Panel, to enable Java within a browser .

On your PC, start the Java Control Panel by opening the Windows ControlPanel from the Windows Start menu. Then enter Java Control Panel in thesearch field to display and open the Java Control Panel.

Next, click on the ‘Security’ tab. Ensure the ‘Enable Java content in thebrowser’ checkbox is selected on this tab.

8. Enter the URL in the Java Control Panel Exception Site List.

Click on the ‘Edit Site List’ button in the Java Control Panel dialog Securitytab to enter a URL in the Exception Site List dialog. In the ‘Exception SiteList’ dialog, enter the IP address you configured in Step 4, with a http://prefix.

After entering the URL click the Add button then click OK.

9. Log into the GUI.

Start a browser then enter the IP address you configured in Step 3 as theURL. You will then be presented with a login screen after the GUI Javaapplet has started. You can then Log in with the username and passwordthat you defined previously in Step 6.

Note: Any configuration changes should be saved to ensure the device settings areretained.

For more information please refer to the 5.4.5 Software Reference availablefrom the Support area of the Allied Telesis Website:http://www.alliedtelesis.com/support

C613-10520-00-REV C

http://www.alliedtelesis.com/support

http://www.alliedtelesis.co.nz


Installing and Enabling this VersionTo use this version, your switch must already be running AlliedWare Plus.Contact your distributor or reseller for more information.

To install this version:

1. Put the version file onto your TFTP server.

2. If necessary, delete or move files to create space in the switch’s Flashmemory for the new file.

Note that you cannot delete the current boot file.

To list files, use the command:

awplus# dir

To see the memory usage, use the command:

awplus# show file systems

To delete files, use the command:

awplus#del <filename>

3. Copy the new release from your TFTP server onto the switch.

To do this, enter Privileged Exec mode and use the command:

awplus#copy tftp flash

Follow the onscreen prompts to specify the server and file.

4. Set the switch to boot from the new release.

Enter Global Configuration mode.

On the x210 Series switches, use the command:

awplus(config)#boot system x210-5.4.5-1.3.rel







On the IX5-28GPX switch, use the command:

awplus(config)#boot system ix5-5.4.5-1.3.rel





On the SwitchBlade x908, use the command:

awplus(config)#boot system SBx908-5.4.5-1.3.rel

On the SwitchBlade x8100 Series switches with a SBxCFC400 controller cardinstalled, use the command:

awplus(config)#boot system SBx81CFC400-5.4.5-1.3.rel

C613-10520-00-REV C


On the SwitchBlade x8100 Series switches with a SBxCFC960 controller cardinstalled, use the command:

awplus(config)#boot system SBx81CFC960-5.4.5-1.3.rel

On the ARxx series (NGFW) security appliances, use the commands foreach product as follows:

awplus(config)#boot system AR3050S-5.4.5-1.3.rel

awplus(config)#boot system AR4050S-5.4.5-1.3.rel

If desired, check the boot settings by entering Privileged Exec mode andusing the following command:

awplus#show boot

5. Reboot.

To do this, enter Privileged Exec mode and use the command:

awplus#reload

C613-10520-00-REV C


ISSU (In-Service Software Upgrade) on SBx8100 withCFC960

ISSU is available on standalone SBx8100 Series switches with dual CFC960control cards, and on switches using VCStack Plus™ to create a single virtualunit out of two chassis (where each chassis has a pair of CFC960 control cards).ISSU allows you to upgrade the software release running on the CFCs with nodisruption to network traffic passing through the chassis.

This maintenance release cannot be upgraded from any previous release usingISSU.

For each issue resolved on these platforms, the resolution will take effect asindicated when:

■ CFCs upgraded: The issue will be resolved once all CFCs have rebootedand are running the same SW version.

■ ISSU Complete: The issue will be resolved once all cards in the system arerunning the same SW version.

Please refer to the ISSU compatibility matrix below to determine ISSU releasecompatibility.

Additional informationFor more information about ISSU, see the New and Enhanced Features inAlliedWare Plus 5.4.4 Major and Minor Versions. ISSU Introduction and ISSUCommands in the Software Release Note for AlliedWare Plus Version 5.4.4-1.1. ISSUis not supported on other platforms.

You may also find the following How To Note useful:

■ How to Use the In-Service Software Upgrade (ISSU) Feature

TO

FROM

RELEASE 5.4.5-1.2 5.4.5-1.3

5.4.5-1.1 C I

5.4.5-1.2 I

5.4.5-1.3

C613-10520-00-REV C

http://alliedtelesis.com/userfiles/file/How_To_ISSU_RevA.pdf


Enhancements in 5.4.5-1.3The following enhancements have been made for all supported models, unlessotherwise stated.

CR Module Description

ER-278 VRRP Previously, VRRPv3 on AlliedWare Plus was limited to 32 IPv4 VRRP instances, and 32IPv6 VRRP instances. This has now been increased to a maximum of 255 VRRPinstances, regardless if they are IPV4 or IPv6, or a combination of both IPv4 and IPv6VRRP instances.

Policy-basedRouting

This software update enables PBR routing on SBx8100 series, limited to only 128 PBRroutes. This 128 route limitation is the same limitation that already applies to allexisting switches that support PBR.

C613-10520-00-REV C


Enhancements in 5.4.5-0.3The following enhancements have been made for all supported models, unlessotherwise stated.

CR Module Description

ER-551 PoE With this software update, the default state for PoE RPS Boost Mode has beenchanged from Enabled to Disabled on the x930.

C613-10520-00-REV C


AR

4050

Issues Resolved in 5.4.5-1.3This AlliedWare Plus maintenance version includes the resolved issues in thefollowing table, ordered by feature.

CR number format: A new issue tracking system is being introduced. The CRsin the new system use a new format (CR-5xxxx). The previous system used theformat: CR000xxxx.

For the next while, both systems will be used and both formats may appear inthese tables. When referring to CRs, use the full CR format, e.g. CR-5xxxx.

Note: This release does not support ISSU.

CR Module Description x210

x230

x310

x350

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

CR-52042 802.1x

VCStack

Previously, roaming authenticationwas not possible on stacks ifdynamic VLAN assignment wasbeing used.

This issue has been resolved.

– – Y – Y Y Y Y Y Y Y – –

CR-52824 ACL, DHCPSnooping

Previously, the static source addressbinding for a DHCP snooping ACLwas not updated onto non-masterstack members during stack bootup.As a result, the traffic from the staticbinding host could be dropped.


– – Y – Y Y Y Y – – – – –

CR-52464 AMF Previously, a SBxCFC960 controllercard could restart unexpectedly ifthe configuration of an AMFcontroller was removed and then re-added.


– – – – – – – – – – Y – –

CR-52093 AMF

VCStack

Previously, in rare circumstances, theAMF process would exitunexpectedly after a stack masterfailover.


Y Y Y – Y Y Y Y Y Y Y Y Y

CR-52797 ARP

NeighborDiscovery

Previously, the output for the showarp command would incorrectlydisplay as flood even if the ARP wasalready resolved for a multicast MACaddress.


Y Y Y – Y Y Y Y – – – – –

C613-10520-00-REV C


AR

4050

CR-52740 Bridge Previously, when bridging was usedon an AlliedWare Plus router withmore than two interfaces in thebridge, one of them being a VLANinterface, broadcast packets couldbe forwarded to some interfaceswith incorrect source anddestination MAC addresses.


– – – – – – – – – – – Y Y

CR-52159 DHCPSnooping

Previously, when using the"vlantriplet" option for the circuit-IDfor DHCP Snooping option 82 on anSBx8100 chassis, the value wasincorrect.

For example, for port 1.8.1 the valuewould be 08000100 instead of theexpected 01080100.


If the current DHCP server or NMSconfiguration is using the previousincorrect values generated by anSBx8100 switch with the"vlantriplet" option configured, theserver configuration will need to beupdated to support the correctvalues with this release.

– – – – – – – – – Y Y – –

CR-52514 EnviroMonitoring

Previously on a SBx8100 switch, asingle low fan tray temperaturesensor reading would slow down allthe fans in the chassis to theirminimal speed. This issue has beenresolved and the fans will only run atminimal speed when all threetemperature sensors report a lowread-out.

– – – – – – – – – Y Y – –

CR-52769 IGMP, MLD,

VRF-lite

Previously, a specific configurationand series of commands using VRF,VLANs and aggregators could resultin corrupted multicast-related showoutput or an unexpected restart ofthe device.


– – – – – – Y Y Y – Y – –

CR-52780 IPv4 With this software update, theoutput of the command showplatform table ip will now includean LTT (Lookup Translation Table)column on a SBx908 switch.

– – – – – – – – Y – – – –


x230

x310

x350

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

C613-10520-00-REV C


AR

4050

CR-52550 IPv6 Previously, the global ip redirectcommand was not working asexpected on a x510 or x930 switchfamily.


Now when the global ip redirectcommand is issued, all redirectedpackets will also be mirrored to theCPU correctly and will be processedaccordingly.

– – – – Y Y – Y – – – – –

CR-52902 MulticastRouting

Previously, if a multicast group waslearnt at a particular time during thelate joining of a member to a stack,the event could result in unnecessaryattempts to send multicast hellopackets, resulting in a “send failed”error message appearing in the log.


– – Y – – Y Y – Y Y Y Y Y

CR-52251 Multicastrouting

VLAN

Previously, if subnet-VLAN classifierswere used with fully populatedmulticast routing tables, then thesubnet-VLAN classification wouldfail to work.


ISSU: Effective when ISSU complete.

– – – – – – – – – Y Y – –

CR-52835 Port Auth Previously, IP traffic was softwarerouted to an authenticated port,resulting in high CPU utilisation.

This issue has been resolved, so thetraffic is now routed (L3 switched) inhardware.

Y Y Y – Y Y Y Y Y Y Y – –

CR-52911 Port Config Previously, packets would bediscarded incorrectly by an x210switch on a port linked up in half-duplex mode.


Y – – – – – – – – – – – –


x230

x310

x350

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

C613-10520-00-REV C


AR

4050

CR-52712 RIP Previously, when RIP was configuredto redistribute connected routes,and it received a route from aneighbor that had an identicaldestination subnet and next-hop asa connected route it hadredistributed, the learnt route wouldreplace the redistributed route in RIPtable. If the learnt route waseventually withdrawn with a metricof 16, the redistributed route wouldnever be re-added. This issue hasbeen resolved. RIP will now keepredistributed routes in its table, andidentical routes received fromneighbors will be added asadditional paths (visible via thecommand show ip rip databasefull') instead of over-writing theredistributed route. When the learntroute becomes unreachable withmetric 16, the redistributedconnected route will remain in RIP'sRIB, undisturbed.


CR-52337 SNMP Previously, SNMP traps sent from aCFC used the stack member ID,whereas the node ID should havebeen used.


– – – – – – – – – – – Y Y

CR-52488 SNMP Previously, there was a security issuewhereby a switch would still respondto SNMPv3 requests even when thecorresponding SNMPv3 user wasdeleted.



CR-52481 SSL With this software update, SSL hasbeen updated to protect againstpotential security vulnerabilitiesidentified by the following CERTadvisories:

CVE-2015-4000

CVE-2015-1793

CVE-2015-1792

CVE-2015-1791

CVE-2015-1790

CVE-2015-1788



x230

x310

x350

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

C613-10520-00-REV C


AR

4050

CR-52161 System With this software update, thevulnerability described in CERTadvisory CVE-2015-1465 has beenresolved.

Y Y Y _ Y Y Y Y Y Y Y – –

CR-52852 UnicastForwarding

Previously, if a "non-forwarding"Ethernet management interface ona switch unexpectedly received IPpackets matching a static defaultroute (where the static default routeis associated with a completelyunrelated L3 forwarding interface),and the matching IP packets werereceived before the default routehad been used for routing packetsoriginating from forwardinginterfaces, then static default routewas rendered un-useable.


Y Y Y Y Y Y Y Y Y Y Y Y Y

CR-52401 UnifiedWireless

Controller

The default channel-bandwidthcalculation has been updated to bebased on the maximum allowablechannel-bandwidth for the newmode, instead of using the oldmodes default bandwidthcalculation.

– – – – – – – Y Y – Y – –

CR-52822 UserManagement

Previously, there were someinconsistencies in the behaviour of aswitch when a user used the“enable” command if the user wasbelow privilege level 15 and nopassword was configured for level15 privilege.


Y Y Y Y Y Y Y Y Y Y Y Y Y

CR-52468 VCStack Previously, it was possible for a stackmember to falsely detect a duplicatemaster situation, resulting in anunnecessary reboot of the wholestack.


– – Y – Y Y Y Y – Y Y – –

CR-52817 VCStack Previously, the x930 switch could failto recognise a particular type of Tycostacking cable.


– – – – – – – Y – – – – –


x230

x310

x350

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

C613-10520-00-REV C


AR

4050

CR-52737 VLAN Previously, when removing a VLANclassifier group from an interface, itincorrectly removed classifiers onother interfaces.


Y Y Y – Y Y Y Y Y Y Y – –


x230

x310

x350

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

C613-10520-00-REV C


Issues Resolved in 5.4.5-0.4


x230

x310

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

CR-52108 AMF Previously, AMF automaticrecovery relied on a physical or avirtual link between two devicesand recovery over aggregatedlinks was not supported.

There was a time window (duringthe initialisation of the remotenode when it activated itsaggregated links) that theinitiating device was unable toidentify that they wereaggregated links.


ISSU: Effective when CFCsupgraded.

Y Y Y Y Y Y Y Y Y Y Y Y

CR-52228 ARP

Neighbordiscovery

Previously, the arp-mac-disparity command could causethe console to lockup.


Y Y Y Y Y Y Y – – – – –

CR-52242 ARP

Neighbordiscovery

Previously, when a stack failedover, it would incorrectly delete allmulticast FDB entries - both staticand dynamic entries.

This issue has been resolved. Nowa stack failover will just remove alldynamic multicast FDB entries.

ISSU: Effective when ISSUcomplete.

– – – – – – – Y Y Y – –

CR-52112 DeepPacket

Inspection

Previously, DPI sometimes wouldnot identify applications in flowsthat consisted of only a fewpackets (e.g. DNS).


– – – – – – – – – – Y Y

CR-52269 Firewall Previously, in a given firewallzone, there was a limitation of 8networks. The number ofnetworks is now dynamicallycalculated.


– – – – – – – – – – Y Y

C613-10520-00-REV C


CR-52271 Firewall,NAT

Previously, NAT rules woulddisplay incorrect firewall entrieswhen a NAT rule and a firewallrule were configuredsimultaneously.


– – – – – – – – – – Y Y

CR-52319 IGMP Previously, IGMP proxy would stillreport an IGMP Join in responseto an IGMP Query, even if themulticast group had already left.



– – Y Y Y Y – Y Y Y – –

CR-52260 IPv6 Previously, the NGFW would failto send an ICMP error message ifit encountered problemsprocessing fragmented IPv6packets.

This issue has been resolved. NowICMP errors are correctlygenerated when there is aproblem with fragmentedpackets.

– – – – – – – – – – Y Y

CR-52274 IPv6 Previously, the NGFW wouldoccasionally fail to disable an IPv6interface when it detected thatthe IPv6 address used by theinterface was also used byanother device in the network.

This detection of already-usedaddresses is part of the DADprocess and required by the RFC.


– – – – – – – – – – Y Y

CR-50744 MACThrashing

Previously, a mac-thrashing portdown action on a SBx8100CFC960 could result in the restartof a line card.



– – – – – – – – – Y – –


x230

x310

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

C613-10520-00-REV C



VLAN

Previously, if subnet-VLANclassifiers were used with fullypopulated multicast routingtables, then the subnet-VLANclassification would fail.



– – – – – – – – Y Y – –

CR-51331 NTP Some security vulnerabilitiesrelated to NTP have beenresolved. (CERT Vulnerability NoteVU#852879)



CR-52226 SNMP Previously, when SNMP wasconfigured on a NGFW router,unnecessary SNMP errormessages would occur wheneverthe device was polled.


– – – – – – – – – – Y Y


Controller

x908 only.

Previously, on a SBx908 with nosupported XEMs, the wirelessmanager process could restartunexpectedly at bootup.


– – – – – – – – Y – – –


Controller

Previously, the commandno channel auto-eligible 132could not be applied at devicestartup due to an incorrectconfiguration order.



– – – – – – Y Y – Y – –


Controller

Previously, changing the channel-bandwidth of a unified wirelessmanager capable device resultedin inconsistency between therunning configuration and theoutput of the show wireless approfile radio auto-eligiblecommand.



– – – – – – Y Y – Y – –


x230

x310

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

C613-10520-00-REV C



Controller

Previously, the wireless managercould fail to operate after a CFCmaster failover.



– – – – – – – – – Y – –

CR-51585 VLAN Previously, subnet-based VLANclassifiers did not work at all onx230 and x310 switches.


– Y Y – – – – – – – – –

CR-51900 VLAN Previously, when a port withVLAN classification enabled wasadded to an aggregation, theaggregation would not besuccessfully added to the VLAN.




CR-51900 VLAN Previously, the switch would failto register MAC addresses intothe FDB table on ports in a LAGon which a protocol VLAN hadbeen configured.



Y Y Y Y Y Y – Y Y Y


x230

x310

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

C613-10520-00-REV C


Issues Resolved in 5.4.5-0.3


x230

x310

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

CR-52108 AMF Previously, AMF automaticrecovery relied on a physical or avirtual link between two devicesand recovery over aggregatedlinks was not supported.

There was a time window (duringthe initialisation of the remotenode when it activated itsaggregated links) that theinitiating device was unable toidentify that they wereaggregated links.




CR-52228 ARP

Neighbordiscovery

Previously, the arp-mac-disparity command could causethe console to lockup.


Y Y Y Y Y Y Y – – – – –

CR-52242 ARP

Neighbordiscovery

Previously, when a stack failedover, it would incorrectly delete allmulticast FDB entries - both staticand dynamic entries.

This issue has been resolved. Nowa stack failover will just remove alldynamic multicast FDB entries.


– – – – – – – Y Y Y – –

CR-52112 DeepPacket

Inspection

Previously, DPI sometimes wouldnot identify applications in flowsthat consisted of only a fewpackets (e.g. DNS).


– – – – – – – – – – Y Y

CR-52269 Firewall Previously, in a given firewallzone, there was a limitation of 8networks. The number ofnetworks is now dynamicallycalculated.


– – – – – – – – – – Y Y

C613-10520-00-REV C


CR-52271 Firewall,NAT

Previously, NAT rules woulddisplay incorrect firewall entrieswhen a NAT rule and a firewallrule were configuredsimultaneously.


– – – – – – – – – – Y Y

CR-52319 IGMP Previously, IGMP proxy would stillreport an IGMP Join in responseto an IGMP Query, even if themulticast group had already left.



– – Y Y Y Y – Y Y Y – –

CR-52260 IPv6 Previously, the NGFW would failto send an ICMP error message ifit encountered problemsprocessing fragmented IPv6packets.

This issue has been resolved. NowICMP errors are correctlygenerated when there is aproblem with fragmentedpackets.

– – – – – – – – – – Y Y

CR-52274 IPv6 Previously, the NGFW wouldoccasionally fail to disable an IPv6interface when it detected thatthe IPv6 address used by theinterface was also used byanother device in the network.

This detection of already-usedaddresses is part of the DADprocess and required by the RFC.


– – – – – – – – – – Y Y

CR-50744 MACThrashing

Previously, a mac-thrashing portdown action on a SBx8100CFC960 could result in the restartof a line card.



– – – – – – – – – Y – –


x230

x310

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

C613-10520-00-REV C



VLAN

Previously, if subnet-VLANclassifiers were used with fullypopulated multicast routingtables, then the subnet-VLANclassification would fail.



– – – – – – – – Y Y – –

CR-51331 NTP Some security vulnerabilitiesrelated to NTP have beenresolved. (CERT Vulnerability NoteVU#852879)



CR-52226 SNMP Previously, when SNMP wasconfigured on a NGFW router,unnecessary SNMP errormessages would occur wheneverthe device was polled.


– – – – – – – – – – Y Y


Controller

x908 only.

Previously, on a SBx908 with nosupported XEMs, the wirelessmanager process could restartunexpectedly at bootup.


– – – – – – – – Y – – –


Controller

Previously, the commandno channel auto-eligible 132could not be applied at devicestartup due to an incorrectconfiguration order.



– – – – – – Y Y – Y – –


Controller

Previously, changing the channel-bandwidth of a unified wirelessmanager capable device resultedin inconsistency between therunning configuration and theoutput of the show wireless approfile radio auto-eligiblecommand.



– – – – – – Y Y – Y – –


x230

x310

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

C613-10520-00-REV C



Controller

Previously, the wireless managercould fail to operate after a CFCmaster failover.



– – – – – – – – – Y – –

CR-51585 VLAN Previously, subnet-based VLANclassifiers did not work at all onx230 and x310 switches.


– Y Y – – – – – – – – –

CR-51900 VLAN Previously, when a port withVLAN classification enabled wasadded to an aggregation, theaggregation would not besuccessfully added to the VLAN.




CR-51900 VLAN Previously, the switch would failto register MAC addresses intothe FDB table on ports in a LAGon which a protocol VLAN hadbeen configured.



Y Y Y Y Y Y – Y Y Y


x230

x310

IX5

x510

,x51

0L

x610

x930

x900

/SB

x908

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050


x230

x310

IX5

x510

,x51

0L

x610

x930

SBx9

08

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

CR-51397 AMF Previously, if a stack failed-over or hadmembers added to it and an AMFworking-set command involving thestack was issued, the console mightlock up and the message No such VRwould appear on the stack masterconsole.


ISSU: Effective when CFCs upgraded.

– – Y Y Y Y Y Y Y Y – –

C613-10520-00-REV C


CR-51462 AMF The ATMF backup process will backupas many devices as was possible forthe available external memory.Previously, the process mistakenly ranuntil it exhausted the externalmemory, which then causedundesirable effects.

This software update ensures thatthere is enough external memory foreach device before continuing withthe backup for that device. A checkwill be performed on all devices andlogs indicating the exhaustion ofmemory will be generated.



CR-51865 AMF Previously, an erroneous critical AMFerror message: user.crit MR2ATMF[918]: ATMF local area id (120)does not match that set on MR2would occasionally appear on remotearea Masters.



– – – – – Y Y Y Y Y – –

CR-51934 AMF Previously, after a rolling reboot wassuccessfully performed on a localmaster, the local master wouldbecome unreachable from the AMFcontroller core network even thoughit was reachable via IPv6.



– – – – – Y Y Y Y Y – –

CR-52011 AMF Previously, when executing thecommand atmf distribute firmwareto update the firmware on routers,the incorrect software would be usedfor the update.


– – – – – – – – – – Y Y

CR-52045 AMF Previously, it was possible that after aVCS master failover on an AMF node,the node would fail to join a working-set.


ISSU: Effective when CFCs upgraded



x230

x310

IX5

x510

,x51

0L

x610

x930

SBx9

08

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

C613-10520-00-REV C


CR-52141 AMF Previously, on rare occasions afterdevice startup, AMF would notfunction and the command showatm detail would show DomainState: Init and Management andDomain VIDs of 0.




CR-52186 AMF This software update improvesencryption for ATMF areas (ATMFremote Masters and ATMFControllers) which are supported from5.4.5-0.1 release onwards.

The change is not backwardscompatible. If an ATMF Controller isrunning 5.4.5-0.1 and it is upgradedto 5.4.5-0.3, Remote ATMF Masterswill need to be upgraded to 5.4.5-0.3before areas will authenticate.



CR-52199 CLI Previously, if a device started withunknown commands in InterfaceConfiguration mode, the use interfaceprocess would restart unexpectedlyduring startup.



CR00042477 DHCPv4 Previously, unrecoverable parity errorsmight occur. This issue has beenaddressed to allow the switch torecover from parity errors.

Y Y Y Y Y Y – – – – – –

CR-51980 Eth Previously, if duplex speed or polaritywas set on an Ethernet port in thestartup configuration, these settingswould not take effect on an SBx908 orSBx81CFC400.



– – – – – – Y Y Y Y – –

CR-51637 HA Previously, the high availability LEDwould not flash amber when anHA-VRRP device failed over due tocircuit monitoring.


– – – – – – – – – – Y Y


x230

x310

IX5

x510

,x51

0L

x610

x930

SBx9

08

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

C613-10520-00-REV C


CR-52034 HSL Previously, in extremely rare cases, aport down event which was the lastport in a VLAN, could cause anunexpected restart due to an internalrace condition.


Y Y Y Y Y Y Y – – – Y Y

CR-51960 IP-Reputation

Updatemanager

Previously, in rare circumstances, theIP-Reputation update manager wouldupdate features that only had theirprovider set.


– – – – – – – – – – Y Y

CR-52055 IPSec Previously, running many IPSECtunnels over a long period of timecould result in unexpected reboot.


– – – – – – – – – – Y Y

CR-52113 IPSec Previously, when there were manyIPSec tunnels configured in thestartup configuration that were allsimultaneously trying to connect,some tunnels could end up withmismatching SPIs after startup duringSecurity Association negotiation,resulting in encrypted traffic failing topass through those tunnels.


– – – – – – – – – – Y Y

CR-51978 IPv6 Previously, class-maps configured tomatch on DSCP or IP-PREC wouldcorrectly match IPv4 packets, butfailed to match IPv6 packets.


Y Y Y Y Y Y Y – – – – –

CR-51978 IPv6, QoS Previously, class maps configured tomatch on DSCP or IP-Precedence didnot match IPv6 traffic.



– – – Y Y Y – Y Y Y – –

CR-52114 IPV6, VRRP Previously, configuring an IPv6 addresson a VLAN interface with VRRP,followed by removing the IPv4address from that VLAN would causea device to restart.


SSU: Effective when CFCs upgraded.

– – Y Y Y Y – Y Y Y – –


x230

x310

IX5

x510

,x51

0L

x610

x930

SBx9

08

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

C613-10520-00-REV C


CR-51896 ISAKMP Previously, a small amount of memorywas leaked when adding and deletingISAKMP policies.


– – – – – – – – – – Y Y

CR-51660 L2TP Previously, when the device startedup, it could take up to 5 minutes toestablish communication over anL2TPv3 link.


– – – – – – – – – – Y Y

CR00042741 Layer 3switching

Previously, a host connected to anisolated or community port on asecondary VLAN of a private VLANwas able to communicate with a hoston a conventional VLAN configuredon the same switch.

This was however incorrect, as thepurpose of secondary VLANs is toprevent the host port from directlycommunicating with any other portoutside the private VLAN.



– – – – – – – Y Y Y – –

CR-51441 MLD Previously, when an interface that wasnot configured for MLD received anMLD packet, a warning log: NO MLD-IF for interface <name> would begenerated.

With this software update, the MLDlog message has been downgraded toINFO level. The error message can stillbe seen by enabling MLD debug:debug MLD all.




CR-52081 MLD

RIPng

Previously, MLD snooping was notcorrectly processing MLD packetreceived on switch ports that hadpreviously received an IPv6 RIP packet.





x230

x310

IX5

x510

,x51

0L

x610

x930

SBx9

08

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

C613-10520-00-REV C


CR-51979 NGFW Previously, the TCP ports 3128 (proxy)and 111 (non-stacking targets) wereresponding to packets when theyshouldn’t have been doing so.

This issue has been resolved - thoseports are now blocked.

– – – – – – – – – – Y Y

CR-52063 NGFW Previously, both Antivirus and DeepPacket Inspection (DPI) features usedthe same address for markingpackets. As a result, when bothfeatures were enabled, packets wouldbe handled incorrectly.


– – – – – – – – – – Y Y

CR-52110 NGFW Previously, the combination ofFirewall, DPI, and traffic shapingfeatures would not work as expected,as they were overwriting the sameinternal table resource.


– – – – – – – – – – Y Y

CR-51579 OSPF Previously, executing the commandclear ip ospf process when the sameOSPF networks were configured inmultiple VRF instances would causean unexpected error.



– – – – – Y Y – – Y – –

CR-51950 Ping-poll Previously, the ping-poll processwould restart unexpectedly when anIPv6 address longer than 15characters was used as the ping-polltarget.




CR-51230 Pluggable Previously, if an SFP was inserted intoan SFP+ socket on an x930, a linkwould be established, but if the cablewas subsequently removed andreconnected, the link would fail to re-establish.


– – – – – – Y – – – – –


x230

x310

IX5

x510

,x51

0L

x610

x930

SBx9

08

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

C613-10520-00-REV C


CR-52089 Pluggable Previously, repeated linkup/linkdownevents on a pluggable port of an x510port could cause the port to startcorrupting packets if it was operatingat 100Mbps.


– – – Y Y Y Y – – – – –

CR-52104 Port Auth Previously, an unexpected restartcould occur when 1024 authenticatedMAC addresses were cleared from thehardware table.



Y Y Y Y Y Y Y Y Y Y – –

CR00042753 STP Previously, under some circumstancesRSTP and MSTP would send, fromdesignated ports, BPDUs thatcontained the bridge ID of theneighbouring device rather than itsown bridge ID.




CR00042477 Swi Previously, on rare occasions, theswitch would be affected byunrecovered parity errors. With anupdate to the switch chip driver, theseparity errors are now automaticallyrecovered.


Y Y Y Y Y Y Y – – – – –

CR-52167 System Previously, after receivingapproximately 4 billion multicastpackets on a VLAN, the VLAN couldbe deleted unexpectedly.




CR-52062 TrafficShaping

Previously, there was a problem withvirtual-bandwidth not applyingcorrectly to an interface.


– – – – – – – – – – Y Y


x230

x310

IX5

x510

,x51

0L

x610

x930

SBx9

08

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

C613-10520-00-REV C



ControllerThere are two command variations:

1. For the command, qos station-edca ...

■ The value range for parameter aifsis changed to <1-15> from<1-255>.

■ The help string for it is changedfrom “Enter valid time inmilliseconds” to “Enter valid slotnumber”.

2. For the command, qos ap-edca ...

■ The value range for parameter aifsis changed to <1-15> from<1-255>.

■ The help string for it is changedfrom “Enter valid time inmilliseconds” to “Enter valid slotnumber”.

■ The value range for parametermax-burst is changed from<0-999900> to <0-999000>


– – – – – – Y – – Y – –

CR-51915 Updatemanager

Previously, after executing thecommand no <feature> while thefeature downloadable resource wasbeing downloaded, subsequentshow resource command outputwould show invalid information forthe resource.


– – – – – – – – – – Y Y

CR-52002 Updatemanager

Previously, error messages would begenerated if IP Reputation andMalware Protection had theirresources updated in a quicksuccession.


– – – – – – – – – – Y Y

CR-52053 VCStack Previously, packets whose headershad been corrupted in a very specificmanner could cause an internalpacket storm in a VCStack Plus setup.



– – – – – – – – – Y – –


x230

x310

IX5

x510

,x51

0L

x610

x930

SBx9

08

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

C613-10520-00-REV C


CR-52073 VCStack Previously, when a VCStack memberrejoined the stack, there was a smallpossibility that the stack wouldseparate and a stack member couldreboot unexpectedly.


– – Y Y Y Y Y Y – – – –

CR-52053 VCStack Previously, packets whose headershad been corrupted in a very specificmanner could cause an internalpacket storm in a VCStack setup.



– – – – – – – – Y Y – –

CR00042741 VLAN Previously, a host on a secondaryVLAN could communicate with a hoston the conventional VLAN configuredon the same switch.



– – – – – – – Y Y Y – –

CR-51476 VRRP Previously, pinging a VRRP instance ona device where the instance was on adifferent subnet to the ping sourcewould result in no ping reply beingreceived.



– – Y Y Y Y Y Y Y Y Y Y

CR-52114 VRRP Previously, removing an IPv4 addresson a VRRP interface configured withan IPv6 address could cause anunexpected restart.



– – Y Y Y Y Y Y Y Y Y Y

CR-51476 VRRP Previously, with VRRPv3, pinging aVRRP instance on a device where theinstance was on a different subnet tothe ping source would result in lostreplies.



– – Y Y Y Y – Y Y Y – –

CR-52019 Web control Previously, Web Control was unable toclassify HTTP requests by sourceinterface.


– – – – – – – – – – Y Y


x230

x310

IX5

x510

,x51

0L

x610

x930

SBx9

08

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

C613-10520-00-REV C

Issues Resolved in 5.4.5-0.2This AlliedWare Plus maintenance version includes the resolved issue in thefollowing table, ordered by feature.


x230

x310

IX5

x510

,x51

0L

x610

x930

SBx9

08

SBx8

100

CFC

400

SBx8

100

CFC

960

AR

3050

AR

4050

CR-52143 EnvironmentMonitoring

Previously, an x930 with two powersupplies installed would fail togenerate a fault message if one ofthose supplies became faulty or wasunplugged.


– – – – – – Y – – – – –

C613-10520-00-REV C

North America Headquarters | 19800 North Creek Parkway | Suite 100 | Bothell | WA 98011 | USA | T: +1 800 424 4284 | F: +1 425 481 3895

Asia-Pacifi c Headquarters | 11 Tai Seng Link | Singapore | 534182 | T: +65 6383 3832 | F: +65 6383 3830

EMEA & CSA Operations | Incheonweg 7 | 1437 EK Rozenburg | The Netherlands | T: +31 20 7950020 | F: +31 20 7950021

alliedtelesis.com© 2015 Allied Telesis Inc. All rights reserved. Information in this document is subject to change without notice. All company names, logos, and product designs that are trademarks or registered trademarks are the property of their respective owners.

relnote_awp545-1.3

Documents

software version

software upgrade

software reference

software file namestable

software file namesc613

tspoe x61024tsxx610

tspoe x61048tsxx610

tsxpoe x61024spsxx610