Allied Telesis 86222-21 Instruction Manual

Simply connecting the world
Patch Release Note
Patch 86222-21
For Rapier Switches and AR800 Series
Modular Switching Routers
Introduction
This patch release note lists the issues addressed and enhancements made in
patch 86222-21 for Software Release 2.2.2 on existing models of Rapier L3
managed switches and AR800 Series L3 modular switching routers. Patch file
details are listed in Table 1.
This release note should be read in conjunction with the following documents:
■Release Note: Software Release 2.2.2 for Rapier Switches, AR300 and
AR700 Series Routers, and AR800 Series Modular Switching Routers
(Document Number C613-10313-00 Rev A) available from
www.alliedtelesyn.co.nz/documentation/documentation.html.
■Rapier Switch Documentation Set for Software Release 2.2.1 available on
the Documentation and Tools CD-ROM packaged with your switch, or
from www.alliedtelesyn.co.nz/documentation/documentation.html.
■AR800 Series Modular Switching Router Documentation Set for Software
Release 2.2.1 available on the Documentation and Tools CD-ROM
packaged with your switching router, or from www.alliedtelesyn.co.nz/
documentation/documentation.html.
WARNING: Using a patch for a different model or software release may cause
unpredictable results, including disruption to the network. Information in this
release note is subject to change without notice and does not represent a
commitment on the part of Allied Telesyn International. While every effort has
been made to ensure that the information contained within this document and
the features and changes described are accurate, Allied Telesyn International
can not accept any type of liability for errors in, or omissions arising from the
use of this information.
Table 1: Patch file details for Patch 86222-21.
Base Software Release File 86s-222.rez
Patch Release Date 03-Oct-2002
Compressed Patch File Name 86222-21.paz
Compressed Patch File Size 408864 bytes

2Patch Release Note
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
Features in 86222-21
Patch 86222-21 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancements:
Locally generated ICMP messages, that were passed out through a firewall
interface because they were associated with another packet flow, had their
source address changed to that of the associated packet flow and were also
forwarded with incorrect IP checksums. This only occurred when there was
no NAT associated with the packet flow. This issue has been resolved.
Sometimes the retransmission of an FTP packet was not permitted through
the Firewall. This issue has been resolved.
VRRP returned an incorrect MAC address for an ARP request. This issue
has been resolved.
In some situations, multihomed interfaces caused the Firewall to apply
NAT and rules incorrectly when packets were received from a subnet that
was not attached to the receiving interface. This issue has been resolved.
An ARP entry for a host has been removed whenever a DHCP DISCOVER
or DHCP REQUEST message is received from the host. This allows for
clients changing ports on a switch.
The sequence number extracted from the AH and ESP header was in the
wrong endian mode, which caused an FTP error with IPSEC anti-replay.
This issue has been resolved.
When acting as a PPPoE Access Concentrator (AC), if a PPPoE client sent
discovery packets without the "host-unique" tag, the discovery packets sent
by the AC were corrupted. This issue has been resolved.
IGMP failed to create an automatic IGMP membership with no joining port
when it received multicast data that no ports were interested in, when IP
TimeToLive was set to 1 second. Also, IGMP erroneously sent a query on an
IGMP enabled IP interface even when IGMP was disabled. These issues
have been resolved.
PCR: 02167 Module: FIREWALL Network affecting: No
PCR: 02236 Module: FIREWALL Network affecting: No
PCR: 02245 Module: VRRP Network affecting: No
PCR: 02327 Module: IPG/FIREWALL Network affecting: No
PCR: 02329 Module: DHCP Network affecting: No
PCR: 02332 Module: IPSEC Network affecting: No
PCR: 02343 Module: PPP Network affecting: No
PCR: 02368 Module: IPG/IGMP Network affecting: No

Patch 86222-21 For Rapier Switches and AR800 Series Modular Switching Routers 3
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
In the ADD SWITCH L3FILTER command, the EPORT parameter
incorrectly accepted the value 62-63 as multicast and broadcast ports 63-64.
This issue has been resolved.
After a prune lifetime had expired, the interface was not joined back to the
DVMRP multicast delivery tree. This issue has been resolved.
DVMRP multicast forwarding failed to send tagged packets to a tagged
port. Packets were erroneously sent untagged to tagged ports. This issue
has been resolved.
Features in 86222-20
Patch file details for Patch 86222-19 are listed in Table 3:
Patch 86222-20 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancements:
The IGMP specific query sent by the router/switch now contains the correct
default response time of 1 second. Also, ifOutOctets in the VLAN interface
MIB now increments correctly.
If a port did not belong to an ethernet interface, or was not directly
connected to the seed port it could not receive advertised router numbers.
This issue has been resolved.
When an interface went down (or was disabled) on an AS border router, the
external routes were not removed from the routing domain. Such routes are
now removed by premature aging.
Proxy Arp can now be used on VLAN interfaces.
PCR: 02374 Module: SWI Network affecting: No
PCR: 02397 Module: DVMRP Network affecting: No
PCR: 02404 Module: IPG Network affecting: No
Table 2: Patch file details for Patch 86222-20.
Base Software Release File 86s-222.rez
Patch Release Date 23-Aug-2002
Compressed Patch File Name 86222-20.paz
Compressed Patch File Size 397708 bytes
PCR: 01226 Module: IGMP Network affecting: Yes
PCR: 01270 Module: APPLE Network affecting: No
PCR: 01285 Module: OSPF Network affecting: No
PCR: 02024 Module: IPG Network affecting: No

4Patch Release Note
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
A fatal error sometimes occurred if a TCP session originating on the public
side of the firewall sent packets before the session was established with the
host on the private side of the firewall. This issue has been resolved.
Some FTP packets handled by the firewall were forwarded with incorrect
sequence numbers, causing FTP sessions to fail. This issue has been
resolved.
When passing 64-bit counters in an SNMP packet, only the lower 32 bits
were passed. Now the full 64 bits of the counter will be returned if all are
required.
When a TCP RST/ACK was received by a firewall interface, the packet that
was passed to the other side of the firewall lost the ACK flag, and had an
incorrect ACK number. This issue has been resolved.
The IP Filter SIZE parameter was not being applied correctly. This issue has
been resolved.
The SET IP FILTER command would not update the SIZE parameter
correctly. This issue has been resolved.
The TOS field in IP packets was not being processed by IP POLICY filters
with an identifier greater than 7. This issue has been resolved.
A feature has been added that makes pings pass from the source IP address
of the public interface to the IP address on the private interface in the
firewall.
If a port on a Rapier 48 or Rapier 48 i went down, some associated entries
were not promptly removed from the forwarding, Layer 3 and default IP
tables. This issue has been resolved.
This PCR includes the following enhancements:
• A new command, SET DHCP EXTENDID allows for multiple DHCP
clients, and handling of arbitrary client IDs on the server.
• Static DHCP entries now return to the correct state when timing out.
• DHCP entry hashes now have memory protection to prevent fatal
errors.
• DHCP client now retransmits XID correctly.
PCR: 02122 Module: FIREWALL Network affecting: No
PCR: 02128 Module: FIREWALL Network affecting: No
PCR: 02150 Module: CORE, SNMP Network affecting: No
PCR: 02158 Module: FIREWALL Network affecting: No
PCR 02161 Module: IPG Network affecting: No
PCR 02162 Module: IPG Network affecting: No
PCR 02172 Module: IPG Network affecting: No
PCR: 02174 Module: FIREWALL Network affecting: No
PCR: 02195 Module: SWI Network affecting: No
PCR: 02198 Module: DHCP Network affecting: Yes

Patch 86222-21 For Rapier Switches and AR800 Series Modular Switching Routers 5
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
• Lost OFFER messages on the server are now handled correctly.
• The DHCP server now correctly handles DHCP clients being moved to
a different interface on the DHCP server after they’ve been allocated an
IP address.
Responses to DNS requests received by a DNS relay agent, and forwarded
to the DNS server, were returned to the requester with a source IP address
of the DNS server rather than the DNS relay agent. This issue has been
resolved.
Log messages are no longer stored in NVS.
A buffer leak occurred when a large number of flows (over 4000) were in use
and needed to be recycled. This issue has been resolved.
When the only feature licence in the feature licence file was disabled, the
licence file stored on FLASH memory did not change. This was due to a
previous enhancement in PCR 02184 which prevented existing files being
deleted before a new version was stored. This issue has been resolved.
The EPORT parameter in the ADD SWITCH L3FILTER ENTRY and SET
SWITCH L3FILTER ENTRY commands was matching multicast and
broadcast packets with software filtering. This issue has been resolved.
Some switch chip register values have been changed to improve QoS
support on Rapier G6 and Rapier G6f switches.
The PURGE IP command now resets the IP route cache counters to zero.
On a Rapier 24, adding an IP interface over a FR interface caused an
ASSERT debug fatal error. This issue has been resolved.
The ARL entry for the virtual router MAC was incorrectly showing a
numerical value. The entry now shows the CPU’s port value.
Sometimes the Firewall erroneously used NAT. This issue has been
resolved.
A dual Ethernet router was incorrectly accepting an IP address from a
DHCP server when the offered address was on the same network as the
other Ethernet interface. An error is now recorded when DHCP offers an
address that is in the same subnet as another interface.
PCR: 02203 Module: IPG Network affecting: No
PCR: 02208 Module: LOG Network affecting: No
PCR: 02214 Module: IPG Network affecting: No
PCR: 02215 Module: FILE Network affecting: No
PCR: 02220 Module: SWI Network affecting: No
PCR: 02224 Module: SWI Network affecting: No
PCR: 02229 Module: IPG Network affecting: No
PCR: 02242 Module: IPG Network affecting: No
PCR: 02246 Module: VRRP Network affecting: No
PCR: 02250 Module: FIREWALL Network affecting: No
PCR: 02259 Module: DHCP, IPG Network affecting: No

6Patch Release Note
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
When a ‘\n’(LF) character was received, the router/switch did not
recognise this as the termination of a command over Telnet. This issue has
been resolved.
Responses to MX record requests were not handled correctly if the preferred
name in the MX record differed from the one that was requested. This issue
has been resolved.
The virtual MAC address was used as the source MAC for all packets
forwarded on an interface associated with a Virtual Router (VR). This was
confusing when multiple VRs were defined over the same interface because
only one virtual MAC address was ever used. The other virtual MAC
addresses (for the other VR's) were only used if the source IP address
matched the VR’s IP address. To avoid this confusion, the system MAC
address is now always used unless the source IP address of the packet is the
same as the VR’s IP address.
PIM or DVMRP failed to see any data if IGMP snooping was on and
DVMRP or PIM was enabled after the data stream had reached the router/
switch. This issue has been resolved.
MAC address lists were not working with Firewall rules. This issue has
been resolved.
HTTP requests from a fixed IP address were erroneously reported as a host
scan attack in the Firewall deny queue. This issue has been resolved.
Under certain circumstances, the Asyn Loopback Test failed. This issue has
been resolved.
ARL message interrupts have been re-enabled after a software table rebuild
to fix synchronisation of the software forwarding database with the
hardware table.
Some routes were not added into the OSPF route list, and therefore were not
added into the IP route table. This issue has been resolved.
The CREATE CONFIG command did not save the SOURCEPORT
parameter to the configuration file when the low value of the source port
range was set to zero. This issue has been resolved.
PCR: 02260 Module: TTY Network affecting: No
PCR: 02262 Module: DNS Network affecting: No
PCR: 02263 Module: VRRP Network affecting: No
PCR: 02264 Module: PIM, DVMRP, SWI Network affecting: No
PCR: 02265 Module: FIREWALL Network affecting: No
PCR: 02268 Module: FIREWALL Network affecting: No
PCR: 02269 Module: DUART, TM Network affecting: No
PCR: 02274 Module: TPAD Network affecting: No
PCR: 02275 Module: OSPF Network affecting: No
PCR: 02276 Module: FIREWALL Network affecting: No

Patch 86222-21 For Rapier Switches and AR800 Series Modular Switching Routers 7
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
Existing IGMP groups were not deleted when IGMP was disabled globally
or on the associated interface. This gave the groups very high timeout
values. This issue has been resolved.
If a packet with a destination IP address equal to a VRRP IP address was
received when the router didn’t own the IP address, (because it didn’t have
an interface with that IP address) the router incorrectly tried to forward the
packet and send an ICMP “redirect” message to the source. Now, if such a
packet is received, it will be discarded and an ICMP “host unreachable”
message will be sent to the source.
VRRP used the wrong source IP address in ICMP redirects. RFC 2338 states
that the source IP address of ICMP redirects should be the IP address that
the end host used when making its next hop routing decision. In the case of
a packet sent to a VRRP virtual MAC address, this is the primary VRRP IP
address associated with the MAC address, provided such a VR exists and is
in the master state. This issue has been resolved.
The SIZE functionality on the IP filter was not working for IP fragmented
packets. This issue has been resolved.
Features in 86222-19
Patch file details for Patch 86222-19 are listed in Table 3:
Patch 86222-19 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancements:
When OSPF was calculating routes from an AS external LSA and the AS
external router had two next hops with different metrics, the router
erroneously added two routes instead of one route with the best metric. This
issue has been resolved. Also, when the two equal cost routes were on the
same IP interface, but to different next hops, the router sent the packets to
the wrong MAC address. This issue has been resolved.
PCR: 02287 Module: IPG Network affecting: No
PCR: 02299 Module: VRRP Network affecting: No
PCR: 02304 Module: VRRP Network affecting: No
PCR: 02317 Module: IPG Network affecting: No
Table 3: Patch file details for Patch 86222-19.
Base Software Release File 86s-222.rez
Patch Release Date 11-Jun-2002
Compressed Patch File Name 86222-19.paz
Compressed Patch File Size 364584 bytes
PCR: 02018 Module: OSPF Network affecting: No

8Patch Release Note
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
STP always transmits untagged packets. If a port does not belong to a
VLAN as an untagged port, then the port must belong to one VLAN as a
tagged port. In this case, STP should transmit VLAN tagged packets out of
the port.
The IP, MASK, and ACTION parameters could not be set with the SET IP
ROUTE FILTER command. This issue is resolved when the filter number is
specified at the start of the command, for example:
SET IP ROUTE FILTER=filter-id IP=ipadd MASK=ipadd
ACTION={INCLUDE|EXCLUDE}
where: filter-id is the filter number. Filter numbers are displayed in the
output of the SHOW IP ROUTE FILTER command.
The built in Self Test Code for all Rapiers, except G6, has been improved to
enhance the detection of faults in switch chip external packet memory.
An AS boundary router advertises AS external LSAs to other routers.
However, when the router’s configuration changed, either by adding an IP
route filter, or by setting its ASEXTERNAL parameter to OFF using the SET
OSPF ASEXTERNAL command followed by a restart, its neighbour state
could not reach full state. Also, when the router had IP route filters
configured, matched routes were not being flooded into other routers.
However, these routes should still have been imported into the router’s
own LSA database, but were not. These issues have been resolved.
The IPG module has been enhanced to support gratiutous ARP request and
ARP reply packets.
The Rapier was not detecting invalid checksums in ICMP echo request
packets. This issue has been resolved. ICMP echo request packets with
invalid checksums are now dropped and the ICMP inErrors and inDiscards
counters are incremented.
A simple DHCP range MIB and a trap have been added. The trap is
triggered when a DHCP request cannot be satisfied. The gateway address
and the interface address are sent as trap variables. The range table shows
which range was exhausted. A debug variable,
swiDebugBroadcomParityErrors has been added to the SWI module MIB to
count the SDRAM parity errors in the packet memory of the Broadcom
switch chip.
Packets traversing in and out of the same public firewall interface were
sometimes blocked. The firewall should only control packets passing
between a public and a private interface. This issue has been resolved.
PCR: 02098 Module: STP Network affecting: No
PCR: 02123 Module: IPG Network affecting: No
PCR 02138 Module: SWI Network affecting: No
PCR 02140 Module: OSPF Network affecting: No
PCR 02144 Module: IPG Network affecting:No
PCR 02151 Module: IPG Network affecting: No
PCR 02164 Module: DHCP Network affecting: No
PCR 02176 Module: FIREWALL Network affecting: No

Patch 86222-21 For Rapier Switches and AR800 Series Modular Switching Routers 9
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
When a file upload was interrupted, the file being uploaded was not
unlocked. The file could not be deleted without restarting the router. This
issue has been resolved.
RIP was incorrectly sending triggered request packets over VLANs, even on
non-demand links. This issue has been resolved.
When VRRP responded to an ARP request for the VR IP address it was not
making an entry in the ARP table and the switch L3 table. This issue has
been resolved.
Features in 86222-18
Patch file details for Patch 86222-18 are listed in Table 4:
There is no patch release 86222-17 because this patch was withdrawn.
Patch 86222-18 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancements:
In some situations, the switch would stop forwarding packets via internal
and/or external uplink ports. This issue has been resolved.
If a flash write error occurred when a file was being written, the file’s
directory entry was deleted leaving a partial file in flash. Subsequent
attempts to write the file failed because a file of the same name already
existed. This issue has been resolved.
In configurations containing a large number of OSPF routes, the SPF
calculation could take a long time. During this calculation, other events
would not be processed. This patch reduces the time required for an SPF
calculation and allows the switch to respond to other events in the mean
time. This patch also improves the performance of flow cache updates.
PCR 02181 Module: LOAD Network affecting: No
PCR 02186 Module: IPG Network affecting: No
PCR 02188 Module: VRRP Network affecting: No
Table 4: Patch file details for Patch 86222-18.
Base Software Release File 86s-222.rez
Patch Release Date 6-May-2002
Compressed Patch File Name 86222-18.paz
Compressed Patch File Size 342720 bytes
PCR: 02041 Module: SWI Network affecting: No
PCR: 02073 Module: FILE Network affecting: No
PCR: 02075 Module: OSPF, IPG Network affecting: No

10 Patch Release Note
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
If the FILE module was required to re-write a file, the existing file would be
deleted before the size of the new file was known. This issue has been
resolved.
OSPF virtual links running across a single network segment would accept
0.0.0.0 as the next hop address. This was inherited by derivative routes,
making them unusable. This issue has been resolved.
If a file ended short of an erase block boundary and a compaction was
started, the block in which the file was stored was not erased, causing errors
when new files were written. Also, if the last file in the filing system ended
on or short of an erase block boundary, and a compaction was started, then
compaction would fail. These issues have been resolved.
Port mirroring on the Rapier 48 and 48i was not operating correctly because
Destination Lookup Failure (DLF) frames were sent from the mirror port.
This issue has been resolved.
The software routing performance of the Rapier 48 and Rapier 48i has been
enhanced.
The layer 3 hardware table was not sorted properly when it contained a
very wide range of IP addresses (eg. 10.0.0.1 - 205.33.3.1). This caused a
small number of packets to be routed by software rather than hardware.
This issue has been resolved.
The periodic and time trigger counts were incrementing by two instead of
one on each update. This issue has been resolved.
An error occurred when the FLASH write driver was required to write
values that were not long-word aligned and were at the driver’s page
boundary. The driver attempted to write into the next section of memory. It
also attempted to read the status of this section of memory, and
misinterpreted the result as a low Vpp voltage. Also, errors occurred during
FLASH compaction. These issues have been resolved.
PCR: 02081 Module: FILE, FFS Network affecting: No
PCR: 02082 Module: OSPF Network affecting: Yes
PCR: 02086 Module: FFS Network affecting: No
PCR: 02088 Module: SWI Network affecting: No
PCR: 02095 Module: SWI Network affecting: No
PCR: 02101 Module: SWI Network affecting: No
PCR: 02104 Module: TRG Network affecting: No
PCR: 02105 Module: FFS Network affecting: No

Patch 86222-21 For Rapier Switches and AR800 Series Modular Switching Routers 11
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
Features in 86222-16
Patch file details for Patch 86222-16 are listed in Table 5:
Patch 86222-16 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancements:
The SET SWITCH L3 FILT command overwrote existing Layer 3 filters. If
multiple filter entries existed, this command changed the most recent entry,
rather than the one specified. These issues have been resolved. Also, the SET
SWITCH L3 FILT command now allows for creation of multiple filter
entries with the SETPRIORITY and SETTOS parameters. The Layer 3 filter
protocol match now has no limit.
A switch sometimes restarted if it was configured with static DHCP entries
and was handling a large number of DHCP clients. This issue has been
resolved.
Features in 86222-15
Patch file details for Patch 86222-15 are listed in Table 6:
Patch 86222-15 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancements:
A fatal error occurred when an invalid SNMP message was received. This
issue has been resolved.
When disabling port mirroring the VLAN tagging configuration of other
ports was corrupted. This issue has been resolved.
Table 5: Patch file details for Patch 86222-16.
Base Software Release File 86s-222.rez
Patch Release Date 1-Apr-2002
Compressed Patch File Name 86222-16.paz
Compressed Patch File Size 336952 bytes
PCR: 02092 Module: SWI Network affecting: No
PCR: 02099 Module: DHCP Network affecting: No
Table 6: Patch file details for Patch 86222-15.
Base Software Release File 86s-222.rez
Patch Release Date 26-Mar-2002
Compressed Patch File Name 86222-15.paz
Compressed Patch File Size 336608 bytes
PCR: 02015 Module: SNMP Network affecting: No
PCR: 02020 Module: SWI Network affecting: No

12 Patch Release Note
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
The TickTimer ran one percent slower than it should have. This issue has
been resolved.
Static ARPs can now be added to tagged vlans.
When an IP flow table contained the IP flow structure for a spoofed packet,
the SHOW IP FLOW command would crash when executed. This issue has
been resolved.
Features in 86222-14
Patch file details are listed in Table 7.
Patch 86222-14 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancements:
When telnetting to the switch, the TCP connection was reset, and when the
packet was passed to IPG_Forward a fatal error occurred. This patch
implements a workaround.
The CREATE CONFIG command now correctly configures tagged ports
belonging to VLANs not in the default STP.
A new command allows the Layer 3 aging timer to be changed:
SET SWITCH L3AGEINGTIMER=<seconds>
where seconds can be 30 - 43200. After each cycle of the ageing timer, all
existing Layer 3 entries with the hit bit set will have the hit bit reset to zero,
and all existing Layer 3 entries with the hit bit set to zero will be deleted.
The SHOW SWITCH command output now displays the Layer 3 ageing
timer value.
Resolution of PCR 02011 in Patch 12 sometimes caused a fatal error. This
issue has been resolved.
PCR: 02070 Module: CORE Network affecting: No
PCR: 02079 Module: IPG Network affecting: No
PCR: 02094 Module: IPG Network affecting: No
Table 7: Patch file details for Patch 86222-14.
Base Software Release File 86s-222.rez
Patch Release Date 28-Feb-2002
Compressed Patch File Name 86222-14.paz
Compressed Patch File Size 335336 bytes
PCR: 02005 Module: IPG Network affecting: No
PCR: 02035 Module: VLAN Network affecting: No
PCR: 02036 Module: SWITCH Network affecting: No
PCR: 02038 Module: PING Network affecting: No

Patch 86222-21 For Rapier Switches and AR800 Series Modular Switching Routers 13
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
The SHOW IP ROUTE FILTER command output displayed counters for
'passes' and 'include' that were the same. This issue has been resolved.
Counters now increment only when a filter is active and do not count
interface routes.
PCR 02019 permitted the reception of packets by the CPU that should have
been discarded. This issue has been resolved.
Firewall TCP timeout values have been reduced for sessions placed in the
CLOSED state after receiving a TCP/RESET. This applies to the stateful
inspection of firewall sessions only, and not to the TCP module. Previously,
PCR 01263 reduced the timeout value for sessions placed in the CLOSED
state after a TCP/FIN packet was received.
Firewall IP access lists were not working correctly. If an IP range was
specified without spaces between the IP address and the separating '-' the
range would be ignored. Spaces are no longer required. Also, matches were
made to addresses covered by a range in an access list if the matching range
was numerically the lowest in the list. This issue has been resolved.
Features in 86222-13
Patch file details for Patch 86222-13 are listed in Table 8.
Patch 86222-13 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancements:
When a Telnet session was terminated without a proper logout, counters
recording the number of logins were not correctly decremented. This issue
has been resolved.
If a layer 3 hardware filter for a particular packet type (e.g. Netbeui) was
configured, all IP packets destined for the CPU were discarded. This issue
has been resolved.
PCR: 02039 Module: IPG Network affecting: No
PCR: 02040 Module: SWI Network affecting: No
PCR: 02057 Module: FIREWALL Network affecting: No
PCR: 02063 Module: FIREWALL Network affecting: No
Table 8: Patch file details for Patch 86222-13.
Base Software Release File 86s-222.rez
Patch Release Date 1-Feb-2002
Compressed Patch File Name 86222-13.paz
Compressed Patch File Size 328884 bytes
PCR: 02014 Module: TELNET Network affecting: No
PCR: 02019 Module: SWI Network affecting: No

14 Patch Release Note
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
Features in 86222-12
Patch file details for Patch 86222-12 are listed in Table 9.
Table 9: Patch file details for Patch 86222-12.
Patch 86222-12 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancements:
If route filters existed and a RESET IP command was executed, some static
and interface routes were incorrectly removed if the filters matched. This
issue has been resolved.
DHCP occasionally caused a fatal error. Also, while an address was in the
reclaiming list, a DHCPDISCOVERY message requesting the address made
the address disappear. These issues have been resolved.
A fatal error occurred when forwarding IP packets with VRRP enabled. This
issue has been resolved.
The firewall TCP timeout values for sessions in the CLOSED and
TIMEWAIT states have been reduced. This only applies to the stateful
inspection of firewall sessions and not to the TCP module.
When a Rapier was under heavy load from software routing (e.g. after a
reboot and before the routing tables were refreshed), OSPF could take a long
time to converge. This patch gives OSPF packets higher priority to expedite
OSPF convergence.
A new feature permits hardware filtering by the Rapier family based on the
Ethernet frame type. The TYPE parameter:
TYPE={802|ETHII|SNAP}
has been added to the following commands:
ADD SWITCH L3FILTER ENTRY
ADD SWITCH L3FILTER MATCH
SET SWITCH L3FILTER ENTRY
SET SWITCH L3FILTER MATCH
SHOW SWITCH L3FILTER
Base Software Release File 86s-222.rez
Patch Release Date 18-Jan-2001
Compressed Patch File Name 86222-12.paz
Compressed Patch File Size 328528 bytes
PCR: 01223 Module: IPG Network affecting: No
PCR: 01257 Module: DHCP Network affecting: No
PCR: 01261 Module: IPG/VRRP Network affecting: No
PCR: 01263 Module: FIREWALL Network affecting: No
PCR: 01268 Module: SWI Network affecting: No
PCR: 01269 Module: SWI Network affecting: No

Patch 86222-21 For Rapier Switches and AR800 Series Modular Switching Routers 15
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
A physical port could not be re-enabled once disabled when STP was active.
This issue has been resolved.
The CREATE CONFIG command now includes the STPFORWARDING
parameter in generated scripts. The SHOW SWITCH command now
displays the setting of STPFORWARDING.
Refinements were made to the switch chip register settings improving CoS
provision with the newer revision of switching silicon on the Rapier 16,
Rapier 24 and Rapier 48.
The firewall was incorrectly forwarding multicast packets originating from
a private address in cases where a matching route was defined. This issue
has been resolved.
When the speed of one or more switch ports was forced to a half duplex
setting and the ports were then added to a trunk group configured for full
duplex operation, the port settings were not overridden by the trunk group
speed setting. The trunk group speed setting will now take precedence over
the port speed setting.
Configuring IP route filters did not stop flooding of AS external LSAs to
neigbours at startup. The result was that the neigbour received the AS LSAs
and added the corresponding routes into its own routing table. However,
after some time (e.g. 1 hour), the AS external LSAs in the neigbour’s
database disappeared, but the corresponding routes were still in its routing
table. This issue has been resolved.
The checksum in VRRP advertisements was not being calculated correctly.
The calculation was not compatible with the RFC. This issue has been
resolved.
When PPP was running over Ethernet to a client from another vendor, the
Maximum Transmission Unit value for the link was not adjusted from the
PPP default of 1500 to 1492. This issue has been resolved.
IGMP did not send the Start Up Query, and the Other Querier Present Timer
did not change the Time Out value accordingly if Query Interval was
changed. IGMP did not notify other registered parties (PIM and DVMRP)
when a port was deleted from a membership group. IGMP reported a
membership leave to other parties while it was still waiting for a reply to a
group specific query from a leaving member. These issues have been
resolved.
PCR: 01272 Module: SWI Network affecting: No
PCR: 01273 Module: SWI Network affecting: No
PCR: 01274 Module: SWI Network affecting: No
PCR: 01275 Module: FIREWALL Network affecting: No
PCR: 01276 Module: SWI Network affecting: No
PCR: 01287 Module: OSPF Network affecting: No
PCR: 01289 Module: VRRP Network affecting: No
PCR: 01290 Module: PPP Network affecting: No
PCR: 01291 Module: IPG(IGMP) Network affecting: No

16 Patch Release Note
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
The timeout value for ICMP session entries in the firewall can now be
adjusted via the OTHERTIMEOUT parameter of the SET FIRE POLICY
command. Note: if the value for OTHERTIMEOUT is set to more than 10
minutes the timeout used for ICMP sessions will default to 10 minutes.
When a DHCP server received a DHCP DISCOVERY packet passed by a
relay agent, requesting an IP address that did not belong to the subnet the
client and the relay agent were attached to, it offered the requested address
if it was available. The DHCP server will now only offer an IP address from
the subnet that connects the client and the relay agent.
The first periodic after day trigger boundary (i.e. midnight) did not occur.
A range check error occurred due to an incorrect comparison. These issues
have been resolved.
Stopping a trace route using STOP TRACE occasionally caused a fatal error.
This issue has been resolved.
IGMP reflooded packets with VLAN tagging were not processed correctly.
This issue has been resolved.
Features in 86222-11
Patch file details for Patch 86222-11 are listed in Table 10.
Table 10: Patch file details for Patch 86222-11.
Patch 86222-11 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancements:
When a Rapier CPU was handling a large amount of traffic and a busy
egress port went down, it was possible for the transmission of packets by
the CPU to cease. This issue has been resolved.
When trunking was in operation, in some instances the switch transmitted
tagged packets on untagged trunk ports. This issue has been resolved.
PCR: 02003 Module: FIREWALL Network affecting: No
PCR: 02007 Module: DHCP Network affecting: No
PCR: 02008 Module: TRIGGER Network affecting: No
PCR: 02011 Module: PING Network affecting: No
PCR: 02012 Module: IPG, VLAN, SWI Network affecting: No
Base Software Release File 86s-222.rez
Patch Release Date 19-Dec-2001
Compressed Patch File Name 86222-11.paz
Compressed Patch File Size 296244 bytes
PCR: 01243 Module: SWI Network affecting: No
PCR: 01265 Module: SWI Network affecting: No

Patch 86222-21 For Rapier Switches and AR800 Series Modular Switching Routers 17
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
When a switch port was forced to half duplex mode and the link partner
was forced to full duplex mode, it was possible for the switch to enter a state
where it was unable to transmit packets. This issue has been resolved.
Features in 86222-10
Patch file details for Patch 86222-10 are listed in Table 11.
Table 11: Patch file details for Patch 86222-10.
Patch 86222-10 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancement:
Some switch chip register settings have been optimised to improve the
provision of CoS with the newer revision of switching silicon.
Features in 86222-09
Patch file details for Patch 86222-09 are listed in Table 12.
Patch 86222-09 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancements:
A new feature, STP forwarding, has been added. STP forwarding can be
enabled and disabled using the commands:
ENABLE SWI STPFORWARD
DISABLE SWI STPFORWARD
When STP forwarding is enabled, all STP forwarding is ignored and all
BDPUs received on a port are forwarded on all other ports.
PCR: 01288 Module: SWI Network affecting: No
Base Software Release File 86s-222.rez
Patch Release Date 29-Nov-2001
Compressed Patch File Name 86222-10.paz
Compressed Patch File Size 295536 bytes
PCR: 01264 Module: SWI Network affecting: No
Table 12: Patch file details for Patch 86222-09.
Base Software Release File 86s-222.rez
Patch Release Date 27-Nov-2001
Compressed Patch File Name 86222-09.paz
Compressed Patch File Size 295444 bytes
PCR: 01189 Module: STP, SWI Network affecting: Yes

18 Patch Release Note
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
The switch now delays sending link traps immediately after a restart to give
the link to the trap host time to come up. A similar change has been made
for the cold start trap. After a 10s delay, all interfaces which are UP have a
link trap generated for them. After that, link traps are sent as normal.
Processing invalid UDP packets caused a memory leak. This issue has been
resolved. Additional debugging facilities were added.
The default setting for the switch port parameter INFILTERING is now OFF,
as specified in IEEE802.1Q. A VLAN will still reject these packets if they are
not from valid VLAN member ports.
The IGMP snooping forwarding process now correctly selects outgoing
ports when DVMRP is managing the multicast routing information.
A configuration problem prevented trunking of gigabit ports at 100Mbit
speeds. This issue has been resolved. The A39 gigabit copper uplink
reverted to autonegotiation after a restart, even if it was configured to a
fixed speed. This issue has been resolved. When the port has been
configured for a fixed speed, the mode is now set to MDIX, not MDI.
When an M2 version of the AR020 PRI E1/T1 PIC was installed in a AR040
NSM it was not possible to select the T1 mode of operation regardless of the
jumper setting. This issue has been resolved.
A fatal error occurred when the firewall discarded disallowed multicast
packets. This issue has been resolved.
Features in 86222-08
Patch file details for Patch 86222-08 are listed in Table 13.
Patch 86222-08 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancements:
PCR: 01242 Module: CORE, SNMP Network affecting: No
PCR: 01244 Module: SWI, CORE, IPG Network affecting: No
PCR: 01246 Module: SWI Network affecting: No
PCR: 01247 Module: IPG Network affecting: No
PCR: 01248 Module: SWI Network affecting: No
PCR: 01254 Module: PRI Network affecting: No
PCR: 01256 Module: Firewall Network affecting: No
Table 13: Patch file details for Patch 86222-08.
Base Software Release File 86s-222.rez
Patch Release Date 09-Nov-2001
Compressed Patch File Name 86222-08.paz
Compressed Patch File Size 291012 bytes

Patch 86222-21 For Rapier Switches and AR800 Series Modular Switching Routers 19
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
Tunnel creation failed when attempting to establish a point-to-point tunnel
from an ATR router (tunnel originator) to another vendor’s router. This
issue has been resolved.
When IGMP snooping was enabled, if a member left a group on a port, it
could not re-join the group on that port. This issue has been resolved.
Substantial changes have been made to PIM in more recent code releases.
These have been retrofitted to 2-2-2 in the patch. Note: these changes have
incorporated PCRs 01159 and 01190.
The PPPoE access concentrator did not stop RADIUS accounting when a
PADT termination was received without receiving a proper PPP
termination first. This issue has been resolved.
The dot1dBridge MIB implementation now complies with RFC1493.
Features in 86222-07
Patch file details for Patch 86222-07 are listed in Table 14:
Table 14: Patch file details for Patch 86222-07
Patch 86222-07 includes all issues resolved and enhancements released in
previous patches for Software Release 2.2.2, and the following enhancements:
DHCP now correctly handles request messages containing request list
options not supported by the router.
The router would accept TCP sessions with destination address the same as
the subnet broadcast address for one of the router’s interfaces. Firewall-
generated packets destined for a subnet broadcast address on one of the
routers interfaces would cause a fatal error. These issues have been
resolved.
PCR: 01201 Module: L2TP Network affecting: Yes
PCR: 01233 Module: PIM Network affecting: No
PCR: 01236 Module: PPP Network affecting: No
PCR: 01237 Module: SWI Network affecting: No
Base Software Release File 86s-222.rez
Patch Release Date 26-Oct-2001
Compressed Patch File Name 86222-07.paz
Compressed Patch File Size 250468 bytes
PCR: 01018 Module: DHCP Network affecting: No
PCR: 01160 Module: IPG,FIREWALL Network affecting: No

20 Patch Release Note
Patch 86222-21 for Software Release 2.2.2
C613-10319-00 REV T
A watchdog timout occurred when the router received an HTTP message
with an over-length header. Normal HTTP requests would also occasionally
cause watchdog timeouts. These issues have been resolved.
The OSPF route filter was not filtering out external routes. This issue has
been resolved.
MD5 Authentication now works correctly with RIP packets.
The SET IP LOCAL command caused a fatal error if the router was
configured with a default route over an L2TP tunnel, because there was no
valid route to the remote IP address of the tunnel. This issue has been
resolved.
Debug messages are no longer generated when a Q.931 Advise of Charge
Notification message is received.
TCP sessions would get stuck in the FINWAIT2 state if the remote host did
not send a FIN message when required. The router now starts a timer when
a TCP session enters the FINWAIT2 state and will automatically close the
session if the timer expires.
The SET IP FILTER command was not correctly handling the ICMPTYPE
and ICMPCODE parameters. This issue has been resolved.
The router will now accept DHCP messages that are greater than or equal
to 576 bytes in size, and reject any message smaller than 576 bytes. This
operation conforms to RFC 1541.
ISAKMP quick mode exchanges are now committed if any traffic is received
over the newly generated SA. This improves stability in very lossy networks
where the commit message may get lost.
ISAKMP debugging caused a fatal error when the debugging mode was set
to ALL and PFS was enabled. This issue has been resolved.
PPPoE interfaces with IDLE set to ON would not retry active discovery
when more data was received if active discovery had previously failed. This
issue has been resolved.
PCR: 01168 Module: HTTP Network affecting: No
PCR: 01182 Module: OSPF Network affecting: No
PCR: 01193 Module: IPG Network affecting: No
PCR: 01194 Module: L2TP, IPG Network affecting: No
PCR: 01197 Module: Q931 Network affecting: No
PCR: 01198 Module: TCP Network affecting: No
PCR: 01199 Module: IPG Network affecting: No
PCR: 01202 Module: DHCP Network affecting: No
PCR: 01203 Module: ISAKMP Network affecting: No
PCR: 01204 Module: ISAKMP Network affecting: No
PCR: 01205 Module: PPP Network affecting: No