Allied Telesis 86251-05 Instruction Manual

Simply connecting the world
Patch Release Note
Patch 86251-05
For Rapier Switches and AR800 Series
Modular Switching Routers
Introduction
This patch release note lists the issues addressed and enhancements made in
patch 86251-05 for Software Release 2.5.1 on existing models of Rapier L3
managed switches and AR800 Series L3 modular switching routers. Patch file
details are listed in Table 1.
This release note should be read in conjunction with the following documents:
■Release Note: Software Release 2.5.1 for Rapier Switches, and AR800 Series
Modular Switching Routers (Document Number C613-10354-00 Rev A)
available from www.alliedtelesyn.co.nz/documentation/documentation.html.
■Rapier Switch Documentation Set for Software Release 2.5.1 available on
the Documentation and Tools CD-ROM packaged with your switch, or
from www.alliedtelesyn.co.nz/documentation/documentation.html.
WARNING: Using a patch for a different model or software release may cause
unpredictable results, including disruption to the network. Information in this
release note is subject to change without notice and does not represent a
commitment on the part of Allied Telesyn International. While every effort has
been made to ensure that the information contained within this document and
the features and changes described are accurate, Allied Telesyn International
can not accept any type of liability for errors in, or omissions arising from the
use of this information.
Table 1: Patch file details for Patch 86251-05.
Base Software Release File 86s-251.rez
Patch Release Date 15-May-2003
Compressed Patch File Name 86251-05.paz
Compressed Patch File Size 320764 bytes

2Patch Release Note
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
Some of the issues addressed in this Release Note include a level number. This
number reflects the importance of the issue that has been resolved. The levels
are:
Features in 86251-05
Patch 86251-05 includes all issues resolved and enhancements released in
previous patches for Software Release 2.5.1, and the following enhancements:
UDP packets passed through the firewall by a reverse enhanced NAT rule
were getting an incorrect IP checksum. This caused IP to discard the
packets. This issue has been resolved.
SMTP proxy was falsely detecting third party relay under some
circumstances. This issue has been resolved.
DHCP policies are no longer stored in alphabetical order in the DYNAMIC
CONFIGURATION script because this did not work when the DHCP
INHERIT parameter was used.
If the Gratuitous ARP feature was enabled on an IP interface, and an ARP
packet arrived, (either ARP request, or reply) that had a Target IP address
that was equal to the SenderIP address, then the ARP cache was not
updated with the ARP packet’s source data. This issue has been resolved.
Deleting an IP MVR group range would only delete the last IP address of
the range from the multicast table, not the entire range. This issue has been
resolved.
RIPng was receiving invalid routes and packets. This issue has been
resolved.
When deleting a list associated with a policy, all rules were being deleted.
Now only the rules associated with the policy and list are deleted.
Level 1 This issue will cause significant interruption to network services, and
there is no work-around.
Level 2 This issue will cause interruption to network service, however there
is a work-around.
Level 3 This issue will seldom appear, and will cause minor inconvenience.
Level 4 This issue represents a cosmetic change and does not affect network
operation.
PCR: 02583 Module: FIREWALL Level: 2
PCR: 03059 Module: FIREWALL Level: 2
PCR: 03095 Module: DHCP Level: 2
PCR: 03148 Module: IPG Level: 3
PCR: 03177 Module: IPG Level: 3
PCR: 03199 Module: IPV6 Level: 3
PCR: 03241 Module: FIREWALL Level: 3

Patch 86251-05 For Rapier Switches and AR800 Series Modular Switching Routers 3
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
The inter-packet gap has been reduced by 4 bytes on the Rapier 48istacking
link. This allows for non-blocking operation with tagged packets.
Under some circumstances, ISAKMP suffered a fatal error if more than 8 SA
proposals were presented. This issue has been resolved.
Layer 3 filters that matched TCP or UDP port numbers were being applied
to the second and subsequent fragments of large fragmented packets. This
issue has been resolved.
The SET FIREWALL POLICY RULE command was not accepting the value
24:00 (midnight) for the BEFORE parameter. This issue has been resolved.
A minimum lease time can no longer be specified when creating a DHCP
policy. This complies with RFC 2131.
If there were a large number of routes in the route table, and the SHOW IP
ROUTE command was executed, the device stopped operating. This issue
has been resolved.
Occasionally a fatal error occurred when the GUI browser started or a page
was refreshed. This issue has been resolved.
IPV4 is the default for the IPVERSION parameter in the CREATE IPSEC
POLICY and CREATE ISAKMP POLICY commands. This default was
unnecessarily displayed in the SHOW CONFIGURATION DYNAMIC
command output. This issue has been resolved.
The amount of time that BGP peers ‘back off’ for after changing from the
ESTABLISHED state to the IDLE state has been changed. Previously, this
‘back off‘ time grew exponentially and never decayed. The ‘back off‘ time is
now always one second.
Some memory was lost on the AT-AR022 ETH PIC when hotswapping. This
issue has been resolved.
Sometimes SSL did not allow its TCP session to close properly. This
happened if the Fin packet was not piggy-backed on a data packet, or if the
SSL Handshake was never completed with the far end. This meant that the
closing Alert was not sent, so the session could not close. Also, SSL leaked
memory when it received invalid SSL records. These issues have been
resolved.
PCR: 03270 Module: SWI Level: 3
PCR: 03299 Module: IKMP Level: 2
PCR: 03314 Module: SWI Level: 2
PCR: 03354 Module: FIREWALL Level: 3
PCR: 03371 Module: DHCP Level: 3
PCR: 03383 Module: IPG Level: 2
PCR: 03390 Module: HTTP Level: 2
PCR: 03392 Module: IPSEC, IKMP Level: 3
PCR: 03395 Module: BGP Level: 3
PCR: 03396 Module: ETH Level: 3
PCR: 03400 Module: SSL Level: 3

4Patch Release Note
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
IP routes deleted from the route cache occasionally caused a fatal error. This
issue has been resolved.
The reconnection to the stream printing TCP port failed after a single
successful connection was made. This issue has been resolved.
The default for the PROXYARP parameter in the SET IP INTERFACE
command for a VLAN interface was OFF. The default is now ON.
If a patch was running with a major software release, after a VLAN was
added at the command line, the VLAN was not shown as UP. This issue has
been resolved.
FTP data transfers did not succeed for some types of NAT. Also, the
presence of flow control TCP flags meant that some TCP control packets
were not recognised. These issues have been resolved.
BGP was updated according to the most recently added route. BGP now
updates to reflect the best available route, regardless of when it was added.
When using a policy routing rule, the firewall did not translate the source
IP address of a broadcast packet correctly. This issue has been resolved.
Previously, the ADD SWITCH L3FILTER MATCH command was accepted
if the TYPE parameter was not specified. This command now requires the
TYPE parameter, and an error message will be returned if the TYPE
parameter is not specified.
When static DHCP was set to the first IP address in a range, that range
would stay in the Reclaim mode. This issue has been resolved.
If the valid and preferred lifetimes of an IPv6 address for a given interface
were set to infinity, they were not included in the dynamic configuration.
This issue has been resolved.
The SHOW VLAN command was displaying a port that did not exist. This
issue has been resolved.
PCR: 03402 Module: IPG Level: 2
PCR: 03405 Module: STREAM Level: 2
PCR: 03407 Module: IPG Level: 3
PCR: 03410 Module: VLAN, CORE Level: 3
PCR: 03412 Module: FIREWALL Level: 3
PCR: 03413 Module: BGP Level: 2
PCR: 03415 Module: FIREWALL Level: 2
PCR: 03416 Module: SWI Level: 3
PCR: 03424 Module: DHCP Level: 2
PCR: 03426 Module: IPV6 Level: 3
PCR: 03429 Module: SWI, VLAN Level: 3

Patch 86251-05 For Rapier Switches and AR800 Series Modular Switching Routers 5
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
BGP traps were sent incorrectly when a BGP peer became Established, or
moved into a lower state. This issue has been resolved.
STP settings were not retained when a port was deleted from the VLAN that
the STP belongs to. This issue has been resolved.
When the device was acting as a DHCP client and the DHCP server
provided a gateway address, a statically configured default route was
deleted and replaced with a default route with the provided gateway
address. The correct behaviour is to only delete a dynamic default route in
this situation. This issue has been resolved; the correct behaviour is now
applied.
The IPX traffic filter match counter was not incremented if a route was
cached. This issue has been resolved.
PPP configured on a L2TP access concentrator (LAC) should be dynamic. If
PPP was incorrectly configured to be static, the static PPP was destroyed
when the L2TP tunnel was formed so that only the first connection
succeeded. This issue has been resolved so that an L2TP tunnel is not
created if the PPP is static.
When a DHCP entry expired while other DHCP entries in the range were in
Reclaim mode, unnecessary ARP packets were generated causing an ARP
storm. This issue has been resolved.
The CIR and CIRLIMITED parameter in the SET FRAMERELAY DLC
command now regulates the behaviour of the transmission rate. Previously,
the transmission rate did not reflect changes to the CIR setting if the new
CIR was higher than the old CIR (provided that the new CIR is within the
physical maximum of the network and the hardware), or changes to the
CIRLIMITED setting if CIRLIMITED was turned ON then OFF. This issue
has been resolved.
After unplugging a fibre uplink cable and then plugging it back in, a short
Ping timeout occurred. This issue has been resolved.
Receiving PIM State Refresh messages now creates and/or maintains PIM
forwarding information.
The dropped packets counter for the firewall was not incrementing
correctly. This issue has been resolved.
PCR: 03430 Module: BGP Level: 3
PCR: 03432 Module: STP Level: 2
PCR: 03436 Module: IP, DHCP Level: 2
PCR: 03439 Module: IPX Level: 3
PCR: 03441 Module: L2TP Level: 2
PCR: 03443 Module: DHCP Level: 3
PCR: 03444 Module: FR Level: 3
PCR: 03446 Module: SWI Level: 3
PCR: 03450 Module: PIM, PIM6 Level: 2
PCR: 03453 Module: FIREWALL Level: 3

6Patch Release Note
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
Occasionally, removing the cable from an IPv6 interface caused the device
to stop responding. This issue has been resolved.
A VLAN interface receiving a PIM Prune message on a port stopped
forwarding multicast data to that port too early. This could cause multicast
data to arrive after a PIM Prune, so an override PIM Join message was not
sent, leading to a loss of multicast data. This issue has been resolved.
Disabling OSPF caused a fatal error if there was a large routing table. This
issue has been resolved.
A fatal error sometimes occurred when packets were forwarded via an IPv6
interface, and IPv6 flows were disabled. This issue has been resolved.
The ENABLE IP MVR DEBUG=ALL command was erroneously shown in
the output of the SHOW CONFIG DYNAMIC=IP command. This SHOW
output no longer includes the ENABLE IP MVR DEBUG=ALL entry.
PIM Graft and Graft-Ack counters were not incrementing. This issue has
been resolved.
The IPMTU parameter in the ADD DHCP POLICY command was
accepting values in the range 0-4294967295. This parameter now accepts
values in the correct range of 579-65535.
PIM-SM Null register messages did not update the register counter
correctly, and did not trigger Register debug messages. This issue has been
resolved.
PIM-SM Null register messages for non-PIM-SM domain sources did not
have the Border bit set. This issue has been resolved.
An invalid message appeared when the PORT parameter was specified for
the ADD IP ROUTE command. This issue has been resolved.
A fatal error sometimes occurred when forwarding traffic over an IPv6
tunnel. This issue has been resolved.
PCR: 03454 Module: IPV6 Level: 3
PCR: 03456 Module: PIM Level: 2
PCR: 03457 Module: OSPF Level: 2
PCR: 03459 Module: IPV6 Level: 2
PCR: 03461 Module: IPG Level: 3
PCR: 03462 Module: PIM, PIM6 Level: 3
PCR: 03465 Module: DHCP Level: 3
PCR: 03463 Module: PIM, PIM6 Level: 3
PCR: 03464 Module: PIM, PIM6 Level: 3
PCR: 03467 Module: IPG Level: 3
PCR: 03471 Module: IPV6 Level: 2

Patch 86251-05 For Rapier Switches and AR800 Series Modular Switching Routers 7
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
The SET LAPD MODE=NONAUTOMATIC command did not change the
LAPD mode from automatic to non-automatic. This issue has been
resolved.
The SMTP proxy did not correctly allow outgoing (private to public) SMTP
sessions when the DIRECTION parameter was set to OUT or BOTH in the
ADD FIREWALL PROXY command. This issue has been resolved.
The PURGE NTP command did not change the UTC offset to the initialised
value. This issue has been resolved.
RIPng was showing routes to interfaces that were DOWN as being UP. This
issue has been resolved.
The message format for PIM-SM periodic (*,*,RP) Join messages was
incorrect when the message contained more than one joined RP address.
This issue has been resolved.
The firewall was not denying an ICMP packet, even if ICMP Forwarding
was disabled when using Standard NAT. This issue has been resolved.
Some memory loss occurred when loading a file via HTTP. This issue has
been resolved.
If the firewall was enabled when BGP was in use outgoing BGP data packets
would have IP header errors and incorrect checksums. This problem has
now been fixed.
In a network with an alternative path, if the link connected to the interface
where a Candidate Rendezvous Point (CRP) advertised its RP candidacy
was down, the CRP did not re-advertise its RP candidacy on other available
interfaces (the alternative path). This meant that the CRP did not update its
PIM routes, which was necessary to re-establish the PIM tree in order for
multicast data to flow again. This issue has been resolved.
The SHOW SWITCH FDB command showed a number of irrelevant entries.
This issue has been resolved.
PCR: 03473 Module: PIM, PIM6 Level: 3
PCR: 03474 Module: FIREWALL Level: 3
PCR: 03475 Module: NTP Level: 3
PCR: 03476 Module: IPV6 Level: 3
PCR: 03478 Module: PIM, PIM6 Level: 3
PCR: 03484 Module: FIREWALL Level: 3
PCR: 03492 Module: HTTP, LOAD Level: 2
PCR: 03494 Module: BGP, FIREWALL Level: 2
PCR: 03497 Module: PIM, PIM6 Level: 2
PCR: 03498 Module: SWI Level: 3

8Patch Release Note
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
The ENTRY parameter from the ADD IP FILTER command was not
included in the output of the SHOW CONFIG DYNAMIC command. This
issue has been resolved.
An enhancement allows for the creation of static IGMP group memberships
that do not time out. For details on this feature, see “Static IGMP” on
page 24.
DHCP was offering network and broadcast addresses to clients. This issue
has been resolved.
An error was not returned if the SET FIREWALL POLICY RULE command
was executed with PROTOCOL=1 when ICMP forwarding was turned on.
This issue has been resolved so that an error is now displayed.
In some circumstances the checksum for the TCP header was set to zero.
This issue has been resolved.
The Switch MIB did not show the correct dot1StpPriority value. This issue
has been resolved.
After creating a trunk group, the activity LEDs did not flash unless the
configuration was used at reboot. This issue has been resolved so that the
LEDs flash correctly whenever a trunk group is created.
The source IP address in a PIM Register message was not the DR interface’s
IP address. This issue has been resolved.
A forwarded PIM-DM state Refresh message did not update the metric and
preference values. This issue has been resolved.
IGMP Query messages were not sent after IGMP was disabled and then re-
enabled. This issue has been resolved.
PCR: 03502 Module: IPG Level: 3
PCR: 03513 Module: IPG Level: 3
PCR: 03515 Module: DHCP Level: 3
PCR: 03517 Module: FIREWALL Level: 3
PCR: 03523 Module: FIREWALL Level: 2
PCR: 03526 Module: SWI Level: 3
PCR: 03531 Module: SWI Level: 3
PCR: 03468 Module: PIM Level: 3
PCR: 03533 Module: PIM Level: 3
PCR: 03535 Module: IPG Level: 2

Patch 86251-05 For Rapier Switches and AR800 Series Modular Switching Routers 9
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
Features in 86251-04
Patch file details are listed in Table 2:
Patch 86251-04 includes all issues resolved and enhancements released in
previous patches for Software Release 2.5.1, and the following enhancements:
A fatal error occurred if the IP module was reset after the ADD IP EGP
command was executed. This issue has been resolved.
The ability to log MAC addresses whenever the ARP cache changes has
been added. To enable this, use the command:
ENABLE IP ARP LOG
To disable it, use the command:
DISABLE IP ARP LOG
The logging of MAC addresses is disabled by default. Use the SHOW LOG
command to view the MAC addresses that have been logged when the ARP
cache changes.
A buffer address was incrementing and not returning buffers for reuse
when the command line interface was accessed via the GUI interface. This
issue has been resolved.
During route flapping, peers were sometimes not told about routes to the
same destinations as the flapping routes. This issue has been resolved.
If a port belongs to an enabled STP instance, but the port has been disabled
from STP operation with the DISABLE STP PORT command, the port will
not respond to ARP requests. This patch implements a workaround that
allows disabled STP ports to respond to ARP requests.
The SET SYSTEM NAME command was accepting character strings greater
than the limit of 80 characters. This issue has been resolved.
The VLAN membership count for STP ports was incorrect in the default
configuration. This issue has been resolved.
Table 2: Patch file details for Patch 86251-04.
Base Software Release File 86s-251.rez
Patch Release Date 15-April-2003
Compressed Patch File Name 86251-04.paz
Compressed Patch File Size 240936 bytes
PCR: 02571 Module: IP Level: 3
PCR: 02577 Module: IPG, LOG Level: 4
PCR: 03025 Module: GUI Level: 2
PCR: 03044 Module: BGP Level: 2
PCR: 03048 Module: STP Level: 2
PCR: 03089 Module: CORE Level: 4
PCR: 03094 Module: STP, VLAN Level: 3

10 Patch Release Note
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
OSPF and RIP Hello packets were being sent out all trunked ports. Now
these Hello packets are only sent out the master port of the trunked group.
A device could not Telnet to a device outside its own subnet. This issue has
been resolved.
When multicasting in hardware, the switch would not forward packets
from a VLAN ingress interface to a non-VLAN interface downstream. This
issue has been resolved.
Incorrect handling of TCP sessions, and poor load balancing performance
could be caused by TCP virtual balancers not selecting a new resource if
required. This issue has been resolved.
A log was only partially created if there was insufficient NVS memory for
log creation on the router. A change has been made so that a log is not
created if there is insufficient memory, and a warning message is displayed.
An error occurred with the ADD IP MVR command. This issue has been
resolved. Also, this command accepted any IP addresses for the GROUP
parameter, but now only accepts multicast addresses.
TCP sessions could fail if the public side of the firewall was using Kerberos
and the private side had a very slow connection to the firewall. This issue
has been resolved.
The SHOW CONFIG DYNAMIC=PING command was giving an incorrect
port number. This issue has been resolved.
An error sometimes occurred in the firewall module under heavy FTP or
RTSP traffic loads. This issue has been resolved.
The TCP sequence numbers are no longer altered through the firewall when
TCPSETUP is disabled with the DISABLE FIREWALL POLICY command.
TCP source and TCP destination ports were swapped when viewed in the
GUI. This issue has been resolved.
PCR: 03096 Module: VLAN Level: 2
PCR: 03097 Module: IPV6 Level: 3
PCR: 03098 Module: PIM, DVMRP, IPG Level: 2
PCR: 03105 Module: FIREWALL Level: 3
PCR: 03109 Module: LOG Level: 3
PCR: 03110 Module: IPG Level: 3
PCR: 03111 Module: FIREWALL Level: 1
PCR: 03115 Module: PING Level: 3
PCR: 03116 Module: FIREWALL Level: 2
PCR: 03117 Module: FIREWALL Level: 1
PCR: 03119 Module: CLASSIFIER Level: 4

Patch 86251-05 For Rapier Switches and AR800 Series Modular Switching Routers 11
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
The SHOW IP INTERFACE command was showing ETH interfaces as up at
startup, when SHOW INTERFACE and SHOW ETH STATE had them as
down. This issue has been resolved.
The SHOW IPv6 COUNTER command now shows the outAdvert messages
in the Total Out Messages counter field.
Classifiers that were added to hardware filters were not applied to the
hardware. This issue has been resolved.
The SHOW IPV6 INTERFACE command was not displaying the link layer
address and EUI when the interface was down. This issue has been
resolved.
Static ARPs were deleted when a port went down. This issue has been
resolved.
Users with either USER or MANAGER level privilege can now execute the
STOP PING and STOP TRACE commands. Previously, MANAGER
privilege was needed to execute these commands.
The SET IP ROUTE FILTER command was not processing some parameters.
This issue has been resolved.
The PAGE parameter in the SET ASYN command now only accepts
numeric values between 0 and 99, ON or OFF, and TRUE or FALSE.
When the DISABLE BGP DEBUG command was used, debugging messages
were still being displayed by the BGP module. This issue has been resolved.
When the Layer 3 Filter Match entry IMPORT was created, EPORT could be
set on the filter entry. If the Layer 3 Filter Match entry EMPORT was created,
then IPORT could be set on the filter entry. Setting parameters that did not
match could cause undesirable results. This issue has been resolved.
The CREATE FIREWALL POLICY command was not checking for valid
name entries, so invalid printing characters could be used for policy names.
This issue has been resolved.
PCR: 03120 Module: ETH, IPG Level: 4
PCR: 03124 Module: IPV6 Level: 4
PCR: 03132 Module: SWITCH Level: 2
PCR: 03139 Module: IPV6 Level: 3
PCR: 03140 Module: IPG, SWI Level: 2
PCR: 03144 Module: CURE Level: 4
PCR: 03145 Module: IPG Level: 4
PCR: 03146 Module: PORT Level: 4
PCR: 03147 Module: BGP Level: 4
PCR: 03149 Module: SWITCH Level: 3
PCR: 03150 Module: FIREWALL Level: 3

12 Patch Release Note
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
An additional check has been added to validate the MASK specified in an
ADD IP ROUTE command. The check tests that the mask is contiguous.
The SHOW CONFIG=ACC command was not showing the rscript file. This
issue has been resolved.
The SHOW IP MVR command output was showing dynamic members in
the incorrect column. This issue has been resolved.
The SHOW FFILE command output has changed. The first column that
listed where the file was stored has been removed. The title of the original
second column (now the first column) has been changed from “creator” to
“module”. The file format specifier has been altered from:
DDDD:MMMM\NNNNNNNN.TTT
to:
MMMM\NNNNNNNN.TTT
When changing the ACTION parameter between INCLUDE and
EXCLUDE on IPV6 filters the interface information was not preserved
between changes. The interface information is now preserved.
Switch trunk speed checks only checked for gigabit settings, not speed
capabilities. It is now possible for uplink modules which support 10, 000
and gigabit speed to attach to trunks where speeds are 10Mb/s or 100Mb/s.
The performance of IPv6 has been improved by introducing IPv6 flows.
IGMP Snooping did not use DVMRP messages to identify a port. This issue
has been resolved.
The output of the SHOW IP IGMP COUNTER and SHOW
IGMPSNOOPING COUNTER commands was incorrect. This issue has
been resolved.
When multicasting to a VLAN interface, if more than 2 DVMRP neighbours
existed on a single port, and any one of those neighbours was pruned, the
multicast data would stop flowing to the port. This happened even though
it was still required for the remaining DVMRP neighbours. This issue has
been resolved.
PCR: 03152 Module: IPG Level: 3
PCR: 03153 Module: ACC Level: 4
PCR: 03154 Module: PCI Level:
PCR: 03155 Module: FFS Level: 4
PCR: 03157 Module: IPV6 Level: 3
PCR: 03159 Module: SWI Level: 2
PCR: 03162 Module: IPV6 Level: 3
PCR: 03163 Module: IPG Level: 3
PCR: 03166 Module: IPG Level: 4
PCR: 03167 Module: DVMRP Level: 2

Patch 86251-05 For Rapier Switches and AR800 Series Modular Switching Routers 13
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
Duplicate Address Detection (DAD) was not sent on VLAN interfaces. This
issue has been resolved.
If all 32 VLAN interfaces had IP addresses attached, only 31 VLANs could
be multihomed. Now all 32 VLAN interfaces with IP addresses can be
multihomed.
When the QUIT option was chosen after the SHOW DEBUG command was
executed, the output did not immediately stop. This issue has been
resolved, but there may be a short delay before the command prompt
reappears.
SNMP linkup traps were not all appearing due to too many outstanding
ARP requests. This issue has been resolved. IP now does not limit the
number of outstanding ARP requests.
A fatal error occurred for the load balancer when there were no UP
resources in a resource pool. This issue has been resolved. Load balanced
TCP connections will now only retry SYNs once after 5 seconds. The round
robin selection algorithm will now select an UP resource in a resource pool
with only one UP resource, even if it was used for the last successful
connection.
Sometimes healthcheck pings were not sent to the load balancer resources.
This issue has been resolved.
When a user was logged in as MANAGER, and Telnet was set to OFF, and
the CREATE CONFIGURATION command was executed, Telnet would be
reset to ON on startup. This issue has been resolved.
The system became unstable if the ADD IPV6 TUNNEL command failed.
This instability was caused by the partially created tunnel entry not being
properly removed from the tunnel database. The tunnel entry is now
completely removed.
The PRI interface would occasionally take a long time for the ifOperStatus
of the interface to become UP. This issue has been resolved.
RIPng was not sending a response back to a RIP request message. This issue
has been resolved.
PCR: 03169 Module: IPV6 Level: 2
PCR: 03180 Module: IPG Level: 3
PCR: 03186 Module: CORE, FFS, TTY Level: 3
PCR: 03187 Module: IPG Level: 3
PCR: 03189 Module: FIREWALL, LB Level: 3
PCR: 03194 Module: LB Level: 3
PCR: 03195 Module: USER Level: 3
PCR: 03196 Module: IPV6 Level: 3
PCR: 03198 Module: PRI Level: 3
PCR: 03203 Module: IPV6 Level: 3

14 Patch Release Note
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
The following issues with DHCP have been resolved:
• DHCP assigned an incorrect IP address to clients shifting from a relayed
to a non-relayed range. Gateway checks have been added to resolve this
issue.
• DHCP clients shifting between relayed ranges were not always
recognised, and were occasionally allocated incorrect addresses.
• DHCP offered entries did not time out after a NAK on a bad lease time
request.
IPv4 filters now behave like IPv6 filters.
When the configuration script was created using the CREATE CONFIG
command, the GBLIP parameter in the ADD FIREWALL POLICY
command was listed twice. This caused the command to fail when the
device was restarted. This issue has been resolved.
When the MARL table had been fully populated, the addition of another
multicast group caused an entry to be deleted, and the new entry was not
added. This issue has been resolved so that no more groups can be added
when the table is full.
The TRACE command was not working when using an ipv6 link-local
address. This issue has been resolved.
A memory leak occurred when some IPSEC processes failed. This issue has
been resolved.
PIM4 and PIM6 were not sending Hello packets if the HELLOINTERVAL
was not a multiple of 10. This is set with the ADD PIM INTERFACE, ADD
PIM6 INTERFACE, SET PIM INTERFACE, and SET PIM6 INTERFACE
commands. This issue has been resolved.
If the RP candidate advertising time was set to a non-default value with the
ADVINTERVAL parameter in the SET PIM command, the hold time in the
message was not being updated correctly. This issue has been resolved.
Zmodem was not naming some loaded files. This issue has been resolved.
PCR: 03205 Module: DHCP Level: 2
PCR: 03206 Module: IPG Level: 3
PCR: 03208 Module: FIREWALL Level: 2
PCR: 03211 Module: SWI Level: 2
PCR: 03212 Module: IPV6 Level: 3
PCR: 03213 Module: IPSEC Level: 3
PCR: 03216 Module: PIM, PIM6 Level: 2
PCR: 03222 Module: PIM, PIM6 Level: 2
PCR: 03229 Module: LOAD Level: 3

Patch 86251-05 For Rapier Switches and AR800 Series Modular Switching Routers 15
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
Values for the KEEPALIVE and HOLDTIME parameters in the ADD BGP
PEER and SET BGP PEER commands were not interacting correctly. This
issue has been resolved.
The PURGE IP command did not remove ENABLE IP IGMP from the
configuration. This issue has been resolved.
IGMP queries were being sent after IGMP was disabled. This issue has been
resolved.
RIP Request packets for IPv4 were not being transmitted when the link came
up or when the switch restarted. This issue has been resolved.
When RIP interfaces were deleted, the IP routes learned through those
interfaces were not timing out correctly. Now, all IP routes learned though
a RIP interface are removed when the RIP interface is deleted, and no
timeouts occur.
QoS Traffic Class maximum bandwidth limiting was being overwritten by
the port or trunk maximum bandwidth value. This should only happen
when the Traffic Class maximum bandwidth has not been set manually with
the CREATE QOS TRAFFICCLASS MAXBANDWIDTH parameter. This
issue has been resolved.
A fatal error occurred when OSPF was under high load. This issue has been
resolved.
Multicast streams would not commence forwarding immediately due to
IGMP packets initiated but not sent while a VLAN was changing from the
DOWN to UP state. Also, multicast streams could be received while the
VLAN was changing from DOWN to UP, causing a PIM Reverse Path
Forwarding unicast route lookup failure. This was due to the unicast route
being unusable as the VLAN was still considered down. These issues have
been resolved.
The Joins and Leaves counters in the SHOW IP MVR COUNTER command
output did not count subsequent join or leave requests after the first join or
leave. This issue has been resolved.
The DELETE SWITCH FILTER command did not work properly when the
ENTRY parameter was assigned a range with hyphen (“-”). This issue has
been resolved.
PCR: 03232 Module: BGP Level: 3
PCR: 03234 Module: IPG Level: 3
PCR: 03236 Module: IPG Level: 3
PCR: 03237 Module: IPG Level: 2
PCR: 03238 Module: SWI Level: 2
PCR: 03239 Module: QOS Level: 2
PCR: 03240 Module: OSPF Level: 2
PCR: 03245 Module: SWI, IPG, PIM Level: 2
PCR: 03247 Module: MVR Level: 4
PCR: 03250 Module: SWI Level: 4

16 Patch Release Note
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
An assert storm sometimes occurred with PIM-DM. This issue has been
resolved.
The firewall doubled the IPSPOOF event timeout from 2 minutes to 4
minutes. This issue has been resolved.
MLD did not respond correctly when it was in exclude mode and it received
a request block. This issue has been resolved.
On a Rapier 24i, when large ping packets were forwarded through a port
with ingress limiting, the ping packets were dropped. This issue has been
resolved.
VLAN and IPG packet debugging has been restored.
The CREATE CONFIGUATION command adds the PPP TEMPLATE LQR
parameter when LQR is enabled. But the configuration script always used
“LQR=ON” even when the LQR value was not the default. This meant that
if a user entered LQR=40, the configuration would represent LQR=ON. This
issue has been resolved.
The handling of the upstream neighbour for a GraftACK message has been
corrected.
IGMP reports sometimes contained errors because of MVR. This issue has
been resolved.
ECMP routing was incorrectly selecting the first route of equal cost found
when retrieving routes that were not cached. This issue has been resolved.
IGMP Proxy can now forward IGMP Reports.
RIP packets can now contain up to 25 routes per packet instead of 24.
When a radius lookup performed by the L2TP Access Concentrator (LAC)
failed, the LAC attempted to disconnect the call from its tunnel. If the tunnel
had not been created, the device restarted. This issue has been resolved.
PCR: 03252 Module: PIM Level: 3
PCR: 03255 Module: FIREWALL Level: 3
PCR: 03256 Module: MLD Level: 3
PCR: 03259 Module: SWI Level: 4
PCR: 03261 Module: VLAN, IPG Level: 4
PCR: 03262 Module: PPP Level: 3
PCR: 03266 Module: PIM Level: 2
PCR: 03269 Module: IPG Level: 4
PCR: 03276 Module: IPG Level: 3
PCR: 03277 Module: IPG Level: 3
PCR: 03285 Module: IPG Level: 4
PCR: 03288 Module: L2TP Level: 2

Patch 86251-05 For Rapier Switches and AR800 Series Modular Switching Routers 17
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
A PAP authentication failure with PPPoE could cause a fatal error. This
issue has been resolved.
When adding static routes with the ADD IP ROUTE command, the order of
the route in the route table was the reverse of the order entered. This issue
has been resolved.
The MAXSESSION parameter of the SET PPP ACSERVICE command could
not be changed when the service was defined over a VLAN. This issue has
been resolved.
Broadcast TCP packets were being processed by the device, causing fatal
errors when firewall SMTP Proxy was configured. Non-unicast TCP packets
are now dropped by IP.
The SHOW FIREWALL POLICY was not showing the correct debugging
items, as set with the ENABLE FIREWALL POLICY DEBUG command.
This issue has been resolved.
Firewall rules were not being applied to broadcast packets received on a
public interface. This issue has been resolved.
Following a period of high traffic load, the CPU utilisation would
occasionally fail to drop below 40%. This issue has been resolved.
IGMP Proxy was setting a delay timer of 1-100 seconds when replying to an
IGMP query with a requested maximum delay of 10 seconds. This issue has
been resolved.
IGMP Proxy did not disable the DR status of an existing IGMP interface
when that interface became the IGMP Proxy Upstream. IGMP Proxy also
did not enable the DR status of an interface when it became anything other
than the IGMP Proxy Upstream. These issues have been resolved.
IGMP Proxy now sends an IGMP Leave message once all members have left
an IGMP group.
Enabling OSPF via the GUI sometimes caused a fatal error. This issue has
been resolved.
PCR: 03291 Module: PPP Level: 2
PCR: 03292 Module: IP Level: 3
PCR: 03293 Module: PPP Level: 3
PCR: 03296 Module: IPG Level: 2
PCR: 03298 Module: FIREWALL Level: 3
PCR: 03300 Module: FIREWALL Level: 3
PCR: 03302 Module: SWI Level: 3
PCR: 03306 Module: IPG Level: 3
PCR: 03307 Module: IPG Level: 3
PCR: 03308 Module: IPG Level: 3
PCR: 03317 Module: OSPF Level: 2

18 Patch Release Note
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
Debugging for DHCP and Q931 was not being disabled when a Telnet
session finished. This issue has been resolved.
A log message is now created when a user is forced to logout from an
asynchronous port when another user (i.e. someone connected via Telnet)
resets the asynchronous connection with the RESET ASYN command.
After VRRP was enabled, the link status of the switch ports was shown as
UP, even if there was no connection to the ports. This issue has been
resolved.
The SET IP MVR command now has extra error checking. This is to ensure
that if the IMTLEAVE parameter is not specified, the original range of ports
set by the CREATE IP MVR command are still contained within the newly
specified port range.
“AT-A42” was being incorrectly displayed as “AT-A42X-00” in the output
of the SHOW SYSTEM command. This issue has been resolved.
STP ignored some BPDU packets coming in on tagged ports. This issue has
been resolved. Now the VLAN tag is ignored on all devices except Rapier i
Series Switches with multiple STPs on the receiving port.
The RESET IP COUNTER=ALL command was not working correctly when
issued from the command line. This issue has been resolved.
Sometimes the Agent Address field in SNMP traps was not the same as the
IP source address. This meant that sometimes the NMS did not send an
alarm to the network manager when traps were received from switches.
This issue has been resolved.
The Uplink card sometimes unnecessarily changed its status from UP to
DOWN. This issue has been resolved.
When there were a large number of BGP routes, the SHOW BGP ROUTE
command sometimes caused an error. This issue has been resolved.
A fatal error occurred if an IP ARP route entry was deleted after an IP route
filter was added while the IP route was equal to zero. This issue has been
resolved.
PCR: 03321 Module: DHCP, Q931, TELNET Level: 4
PCR: 03332 Module: TTY Level: 2
PCR: 03333 Module: IPG Level: 3
PCR: 03334 Module: MVR Level: 3
PCR: 03336 Module: CORE Level: 4
PCR: 03341 Module: STP Level: 3
PCR: 03345 Module: IPG Level: 4
PCR: 03346 Module: SNMP Level: 4
PCR: 03348 Module: SWI Level: 3
PCR: 03349 Module: BGP Level: 3
PCR: 03350 Module: IP, SWI Level: 3

Patch 86251-05 For Rapier Switches and AR800 Series Modular Switching Routers 19
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
Several issues with the DHCP Server have been resolved.
The MRU parameter in the SET PPP command was incorrectly handled as
an interface parameter when the configuration script was generated. This
meant that the OVER parameter was omitted. The MRU parameter is now
correctly handled as a link parameter.
Dynamic interface details were added through the SET INTERFACE
command when the CREATE CONFIGURATION command was executed.
This caused errors on startup. This issue has been resolved.
Port numbers on a Rapier16fiwere incorrect. This issue has been resolved.
For details on checking the port numbers on a Rapier16 fi, see “Checking
the Port Map on Rapier16fi Switches” on page 32.
PIM will no longer accept obsolete commands.
TCP checksums in TCP packets passing through the firewall were being
recalculated incorrectly when the TCP setup proxy was disabled, and
enhanced NAT was in use. This issue has been resolved.
The output of the SHOW IP MVR COUNTER command has been corrected.
Also, the output of the SHOW IP MVR command has been modified. The
new output is shown in Figure 1:
Figure 1: Example output from the modified SHOW IP MVR command
PCR: 03351 Module: DHCP Level:
PCR: 03352 Module: PPP Level: 3
PCR: 03353 Module: PPP Level: 3
PCR: 03358 Module: SWI Level: 2
PCR: 03364 Module: PIM Level: 4
PCR: 03369 Module: FIREWALL Level: 2
PCR: 03370 Module: MVR Level: 4
Multicast VLAN
-------------------------------------------------------------------------------
VLAN Mode Imtleave Source Ports Receiver Ports
Current Members Group Address
--------------------------------------------------------------------------------
22 compatible 3 9,10 1-3, 6-7
1,6 235.1.1.1
2,7 234.1.1.1
3 compatible 8 12,13 4,5,8,9
4,8 255.1.1.1
--------------------------------------------------------------------------------

20 Patch Release Note
Patch 86251-05 for Software Release 2.5.1
C613-10356-00 REV F
When a RapieriSeries Switch was using layer 3 multicast protocols, IGMP
group members on the upstream interface for the multicast stream would
always be forwarded to, even if they left the group. This issue has been
resolved.
The HTTP proxy server terminated a session when uploading a large file.
This issue has been resolved.
The following issues with IPv6 have been resolved:
• Incorrect default values were set for the PREFERRED and VALID
parameters in the ADD IPV6 PPFEFIX command. The correct default
for PREFERRED is 604800 seconds (7 days), and the correct default for
VALID is 2592000 seconds (30 days).
• The PREFERRED and VALID parameters in the ADD IPV6 PPFEFIX
and SET IPV6 PREFIX commands were accepting values that could
make the preferred life time longer than the valid life time.
• The POISONREVERSE parameter in the ADD IPV6 RIP command was
not added to the automatic configuration.
If IPsec was using PPPoE, the initiator continued to keep the IPsec SA even
if the PPPoE session failed and the ISAKMP Heartbeat timer expired. This
issue has been resolved.
A memory leak occurred in IP or IPV6 if PIM-SM received IGMP or MLD
reports, and there was no Rendezvous Point for the reported group.
The DHCP lease Expiry time showed incorrectly in the SHOW DHCP
CLIENT command when the lease straddled across multiple months and
years. This issue has been resolved.
The allowable UDPPORT range has been changed from 1-5000 to 1-65535 in
the ENABLE ISAKMP command.
The SHOW SWITCH FDB command output was incorrect when using the
Protected VLAN feature. This issue has been resolved.
PCR: 03372 Module: IPG Level: 3
PCR: 03373 Module: HTTP Level: 3
PCR: 03375 Module: IPG Level: 2
PCR: 03379 Module: IPSEC Level: 3
PCR: 03387 Module: PIM, PIM6 Level: 2
PCR: 03388 Module: DHCP Level: 3
PCR: 03393 Module: ISAKMP Level: 3
PCR: 03397 Module: SWI Level: 3