Allied Telesis SB251-13 Instruction Manual

Simply connecting the world
Patch Release Note
Patch SB251-13
For SwitchBlade 4000 Series Switches and
AT-9800 Series Switches
Introduction
This patch release note lists the issues addressed and enhancements made in
patch SB251-13 for Software Release 2.5.1 on existing models of SwitchBlade
4000 Series Switches and AT-9800 Series Switches. Patch file details are listed in
Table 1.
This release note should be read in conjunction with the following documents:
■SwitchBlade Documentation Set for Software Release 2.5.1 (Document
Number C613-03057-00 Rev A).
■AT-9800 Series Switches Documentation Set for Software Release 2.5.1
(Document Number C613-03056-00 Rev A)
■Release Note for Software Release 2.5.1 for SwitchBlade 4000 Switches and
AT-9800 Series Switches (Document Number C613-10354-00 Rev D)
available on the Documentation and Tools CD-ROM packaged with your
switch, or from www.alliedtelesyn.co.nz/documentation/documentation.html.
WARNING: Using a patch for a different model or software release may cause
unpredictable results, including disruption to the network. Information in this
release note is subject to change without notice and does not represent a
commitment on the part of Allied Telesyn International. While every effort has
been made to ensure that the information contained within this document and
the features and changes described are accurate, Allied Telesyn International
can not accept any type of liability for errors in, or omissions arising from the
use of this information.
Table 1: Patch file details for Patch SB251-13.
Base Software Release File sb-251.rez
Patch Release Date 08-Oct-03
Compressed Patch File Name sb251-13.paz
Compressed Patch File Size 525044

2Patch Release Note
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
Some of the issues addressed in this Release Note include a level number. This
number reflects the importance of the issue that has been resolved. The levels
are:
Features in SB251-13
Patch SB251-13 includes all issues resolved and enhancements released in
previous patches for Software Release 2.5.1, and the following
enhancements:
MLD snooping is now supported on AT-9800 Series Switches. It is not
available on the SwitchBlade. Refer to the section, Multicast Listener
Discovery (MLD) Snooping For SwitchBlade and AT-9800 Series Switches shown
at the end of the SB251-13 features.
Sometimes IP flows were not deleted correctly when both directions of the
flow were in use. This issue has been resolved.
OSPF was disabling RIP unless RIP was activated using the SET OSPF RIP
command. This issue has been resolved.
Running the PURGE IP command with a multicast address and multiple
sources was causing a fatal error. This issue has been resolved.
The value specified for the IP parameter in the ADD FIREWALL POLICY
PROXY command was not being used by the HTTP proxy. This issue has
been resolved.
After about 250 days, commands such as SHOW BRIDGE COUNT were not
displaying the correct number of seconds for Uptime and Last Change At.
days. This issue has been resolved.
Level 1 This issue will cause significant interruption to network services, and
there is no work-around.
Level 2 This issue will cause interruption to network service, however there
is a work-around.
Level 3 This issue will seldom appear, and will cause minor inconvenience.
Level 4 This issue represents a cosmetic change and does not affect network
operation.
PCR: 02414 Module: IPV6, SWI, IPG, VLAN Level: 2
PCR: 03040 Module: IPG Level: 3
PCR: 03524 Module: OSPF, IPG Level: 2
PCR: 03530 Module: IPG Level: 2
PCR: 03542 Module: HTTP Level: 3
PCR: 03598 Module: ETH, IPG, IPv6, IPX,
PORT, PPP.
Level: 3

Patch SB251-13 For SwitchBlade 4000 Series Switches and AT-9800 Series Switches 3
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
Ports on the SwitchBlade and AT-9800 are now initialised to advertise
pausing as disabled.
BGP and UPNP were not informed when an ETH interface went up or
down. This issue has been resolved.
The IP route filter did not always work correctly for OSPF. This issue has
been resolved.
HTTP proxy did not discard cookies nor allow/deny access to URLs when
a second pass on the URL was performed. This issue has been resolved.
In a network with a large number of L1 intermediate systems (L1-ISs) a fatal
error occurred after approximately 10 minutes. This issue has been
resolved.
Directed IPv6 PING messages were being transmitted from other interfaces
if the specified interface was down. This issue has been resolved.
When CAM segments were full, the CAM entries were not being moved
correctly, and occasionally corrupting on compaction. This issue has been
resolved.
The SHOW SYS SYSR SLAVE command did not return a list of valid
features. This issue has been resolved.
Entering the SHOW IPX CACHE command on the SwitchBlade or AT-9800
Series switches, was displaying a message stating that IPX route caching is
not supported.
This PCR, when introduced in Patch 12, resulted in the Master and Slave
controller cards restarting whenever the bootscript contained more than
2000 VLANs. This issue has been resolved.
The VLAN table was corrupting during a hot swap if a protocol or subnet
VLAN had previously been created.
PCR: 03603 Module: SWCX, SWI. Level: 3
PCR: 03606 Module: IPG Level: 2
PCR: 03609 Module: OSPF, IPG Level: 1
PCR: 03617 Module: FIREWALL Level: 2
PCR: 03643 Module: CLNS/OSI Level: 3
PCR: 03645 Module: OSPF, IPG Level: 2
PCR: 03663 Module: SWCX Level: 2
PCR: 03668 Module: SYSR Level: 2
PCR: 03686 Module: IPX Level: 3
PCR: 03688 Module: SYSR Level: 3
PCR: 03714 Module: VLAN Level: 2

4Patch Release Note
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
The SET VLAN BCLIMIT command did not work when executed from
start-up in a configuration script. This issue has been resolved.
New static routes cannot be added to the forwarding database until ARP
has resolved the routes' next hop MAC address. In the meantime, selecting
the best alternative route was sometimes causing incorrect forwarding and
loops. To avoid this situation, packets destined for dead-end routes are now
forced to the CPU. The CPU then creates an ICMP_Redirect message to the
source of the unforwardable packet to remove the previous hop from its
routing table.
In order to force packets back to the CPU, the hardware MAC table contains
a special entry for each VLAN that maps the unused MAC address
55.55.55.55.55.55.55.55 to the Multicast Group ID 4096. When the switch
encounters an unknown next hop MAC address, it now sends the packet to
the L2MC Group 4096. Because this group does not exist, the packet is
forwarded to the CPU. Note that this process will increment the SHOW
SWITCH COUNTER command’s L2MCGroupSoesntExist counter.
When a user logged on twice, thus creating two sessions, the user log on
time for the second session was overwriting the value recorded for the first.
This issue has been resolved by displaying the log on times as two separate
sessions.
Previous STP ports were not being deleted correctly when line cards were
hot swapped. Also STP ports were not initialising correctly when STP was
not enabled. These issues have been resolved.
With static multicasting enabled on two VLANs, only the first few multicast
packets of a stream were L3 forwarded. This issue has been resolved.
The copying of switch routes between internal components was causing
processing delays. This issue has been resolved.
Although the SwitchBlade hardware is capable of forwarding jumbo
frames, sending these to the CPU was causing a variety of issues. These
issues have been resolved.
Attempts to disable BGP debug were, depending on configuration,
resulting in either a system failure, or the debug messages continuing to
appear after debug had been disabled. This issue has been resolved.
PCR: 03524 Module: OSPF, IPG Level: 2
PCR: 03717 Module: IP, SWCX Level: 2
PCR: 03726 Module: TTY, USER Level: 3
PCR: 03727 Module: SWI, STP Level: 2
PCR: 03734 Module: IPG Level: 2
PCR: 03736 Module: IPG Level: 3
PCR: 03739 Module: SWI Level: 2
PCR: 03746 Module: BGP Level: 3

Patch SB251-13 For SwitchBlade 4000 Series Switches and AT-9800 Series Switches 5
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
An unknown interface log message was returned for VRRP if there was an
interface UP or interface DOWN event due to a mismatch between a
monitored interface index and the corresponding interface instance. This
issue has been resolved.
The MLD snooping entries registered on a port were not removed when the
port went down or was unplugged. This issue has been resolved.
The IP multicast counter did not increment when IGMP, DVMRP and PIM
packets were transmitted and received. This issue has been resolved.
An error occurred in the GUI if it had been in operation for more than 20
days. This issue has been resolved.
Files used during start up were backed up from NVS to FLASH even if they
were already present in FLASH. This used up FLASH memory
unnecessarily. This issue has been resolved so that files are only backed up
when a copy does not already exist in FLASH.
If a configuration file had a long file name, the SHOW CONFIG command
displayed the file name using the shortened DOS 8.3 format (where file
names are 8 characters long, with extensions of 3 characters). This issue has
been resolved so that long configuration file names are now displayed using
the DOS 16.3 format (where file names are up to 16 characters long).
The TIMEOUT and SIZE parameters are only valid for the SET IP DNS
CACHE command, but no error message was returned if either parameter
was specified for the SET IP DNS command. This issue has been resolved.
Fragmentation of IPv6 packets now complies with RFC 2460’s requirement
to align packet sizes to 8 octets.
Disabled copper ports on AT-SB4411 8-Port (RJ-45) Gigabit Ethernet Line
Cards and AT-SB4441 8-GBIC Line Cards were not disabled on reboot. This
issue has been resolved.
The ENABLE RSVP INTERFACE command did not succeed if IP was
enabled after the RSVP interface had been created. Now, ENABLE RSVP
INTERFACE will succeed regardless of when IP is enabled as long as an IP
interface exists.
PCR: 03747 Module: VRRP Level: 3
PCR: 03751 Module: MLDS Level: 3
PCR: 03764 Module: IPG Level: 3
PCR: 03769 Module: SWI Level: 2
PCR: 03778 Module: FILE, INSTALL, SCR Level: 2
PCR: 03780 Module: INSTALL Level: 3
PCR: 03783 Module: IPG Level: 3
PCR: 03784 Module: IPV6 Level: 3
PCR: 03791 Module: SWCX Level: 2
PCR: 03793 Module: RSVP Level: 3

6Patch Release Note
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
Browsing the dot1dTpFdbPort table with SNMPv2c sometimes gave
incorrect output. This issue has been resolved.
Setting RSTPTYPE to NORMAL, when normal has already been set, sets all
ports to the “sending RSTP” state process. This is referred to in IEEE 802.1w
as mCheck.
When RSTPTYPE was changed from STPCOMPATIBLE to NORMAL with
the SET STP command, the STP instance continued to send STP BPDUs
until an mCheck was performed by entering the SET STP
RSTPTYPE=NORMAL command again. This issue has been resolved so
that when RSTPTYPE is set to NORMAL an mCheck is performed, causing
the STP to start sending RSTP BPDUs immediately.
If a DNS lookup failed when using the UPLOAD command to load a file
with a host name, the file was sometimes deleted from FLASH. This issue
has been resolved.
MLD and MLD Snooping accepted MLD Query packets with a hop limit
greater than 1. Duplicate packets were forwarded when the hop limit was
not 1 and the payload was 0::0. This issue has been resolved. MLD and MLD
Snooping now require the hop limit to be 1.
Packets with bad ACK numbers were sometimes generated by the firewall
as part of the proxy TCP setup process. These packets sometimes caused
TCP sessions from the public side of the firewall to fail. This issue has been
resolved.
After the SHOW VRRP command was executed, incorrect trigger messages
were entered into the log. This issue has been resolved.
A fatal error sometimes occurred when using hardware filters if DMA
debug was enabled. This issue has been resolved.
Rate limiting sometimes prevented IGMP snooping and MLD snooping
from operating correctly. This issue has been resolved.
A fatal error occasionally occurred because of an error with internal
processing of the control blades. This issue has been resolved.
The SHOW SWITCH HOTSWAP command output displayed more than 4
blades on a 4 blade chassis. This issue has been resolved.
PCR: 03795 Module: SWI Level: 3
PCR: 03796 Module: STP Level: 2
PCR: 03800 Module: LOAD Level: 2
PCR: 03801 Module: MLDS Level: 2
PCR: 03802 Module: FIREWALL Level: 1
PCR: 03806 Module: VRRP Level: 4
PCR: 03811 Module: UTILITY Level: 2
PCR: 03813 Module: SWI Level: 2
PCR: 03814 Module: SWI Level: 1
PCR: 03815 Module: SWI Level: 3

Patch SB251-13 For SwitchBlade 4000 Series Switches and AT-9800 Series Switches 7
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
A fatal error occurred when IPv6 fragmented a packet. Also, when a large
fragmented ICMP echo request packet was received, the reply may not have
been fragmented and so may have exceeded the MTU for the interface it
was sent on. These issues have been resolved.
Previously, Multicast Storm Protection limited broadcast packets when
Broadcast Storm Protection was not enabled. This has been changed so that
only multicast packets are limited when Multicast Storm Protection is
enabled, and only broadcast packets are limited when Broadcast Storm
Protection is enabled.
If a 10MB half-duplex link was connected to a port, the maximum
bandwidth shown in the SHOW SWITCH TABLE command output was not
updated. This issue has been resolved.
If the last port in a VLAN went down, that port was not automatically
deleted from IGMP groups. This issue has been resolved.
A multihomed interface sometimes sent duplicate multicast packets. This
issue has been resolved.
The incorrect logical interface was selected for broadcast packets received
with a subnet mask that differed from the class mask. This issue has been
resolved.
When BGP imported routes from IP with the ADD BGP IMPORT command,
and there were multiple import choices, the best IP route was not always
imported. This issue has been resolved.
The MTU value for IPv6 PPP interfaces was always set to 1280 bytes. This
MTU value is now correctly set to 1500 bytes, and 1492 bytes for PPP over
Ethernet (PPPoE).
The value of the ifInErrors counter in the SHOW INTERFACE=interface
command incorrectly showed the number of packets received with bytes in
the normal range. This issue has been resolved. The ifInErrors counter now
correctly shows the number of packets received that had errors.
PCR: 03817 Module: IPV6 Level: 2
PCR: 03819 Module: SWCX Level: 3
PCR: 03821 Module: SWCX Level: 3
PCR: 03823 Module: VLAN Level: 2
PCR: 03824 Module: IPG Level: 3
PCR: 03825 Module: IPG Level: 2
PCR: 03826 Module: BGP Level: 2
PCR: 03828 Module: IPV6 Level: 2
PCR: 03829 Module: SWCX Level: 3

8Patch Release Note
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
Hardware filters using classifiers that specified IP addresses were not
accepted by the ADD SWITCH HWFILTER command when added in a
particular order. This issue has been resolved.
If either the MCLIMIT or BCLIMIT parameter in the SET VLAN MCLIMIT
BCLIMIT command was set to NONE, the other parameter was sometimes
incorrectly set to NONE as well. This issue has been resolved.
OSPF sometimes chose routes with an infinite metric over routes with a
finite metric when selecting the best local route. This issue has been
resolved.
When browsing the ifInNUcastPkt MIB counter, the value was not correctly
incremented because only broadcast packets were counted. This issue has
been resolved.
A fatal error sometimes occurred when an IPv6 ping packet length
exceeded 1453 bytes. This issue has been resolved.
A fatal error occurred when the PIM path was recovering. This issue has
been resolved.
MLD startup query packets were not being sent correctly due to IPv6 MLD
being unaware of the IPv6 interfaces it was running on. This issue has been
resolved.
When some DHCP entries were in Reclaim mode, and all interface links
related to the range of these entries went down, these DHCP entries were
stuck in Reclaim mode. This issue has been resolved.
An STP blocking port did not discard SNAP encapsulated packets with
TYPE=00BB (ESRP packets). This caused a loop in the network. This issue
has been resolved.
The GUI install file was not copied to the slave controller card after
executing the SET INSTALL=GUI command. This issue has been resolved.
PCR: 03834 Module: SWCX Level: 2
PCR: 03835 Module: VLAN Level: 3
PCR: 03836 Module: OSPF Level: 2
PCR: 03837 Module: VLAN Level: 3
PCR: 03839 Module: IPV6 Level: 2
PCR: 03841 Module: IPG Level: 2
PCR: 03842 Module: IPG Level: 3
PCR: 03843 Module: DHCP Level: 2
PCR: 03846 Module: SWCX Level: 2
PCR: 03849 Module: SYSR Level: 2
PCR: 03850 Module: FFS Level: 3

Patch SB251-13 For SwitchBlade 4000 Series Switches and AT-9800 Series Switches 9
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
Files were not displayed in the SHOW FFILE command output, after
entering “Q” at the CLI to quit from a previous prompt. This issue has been
resolved.
Multicast packets were not forwarded between switch instances on
SwitchBlade series switches. This issue has been resolved.
Previously, an IP multicast stream destined for an IP multicast group was
forwarded out ports in the All Groups IGMP snooping entry even after this
entry had timed out. This issue has been resolved.
When a GBIC port had its speed and duplex configured as part of a
configuration script, the settings were not applied to the hardware. This
issue has been resolved.
The speed on copper GBIC ports can no longer be manually set.
When linking up a single interface.
When a connector was plugged into one physical interface, the RIPng
request packet was erroneously transmitted from all interfaces on the
switch. This issue has been resolved.
BGP sent Update packets when the local host route table changed but did not
affect BGP. Also, BGP did not send Withdrawn packets when there was a
change in the best route. These issues have been resolved.
When dual firewall policies were defined, public to private passive mode
FTP transfers sometimes failed. This issue has been resolved.
BGP sometimes chose routes with an infinite metric over routes with a finite
metric when selecting the best local route. This issue has been resolved.
CompactFlash™ cards formatted to FAT16 by Windows XP were not
recognised correctly. This was because Windows XP reserved a number of
sectors. This issue has been resolved.
PCR: 03853 Module: SWCX Level: 2
PCR: 03855 Module: IPG Level: 2
PCR: 03857 Module: SWCX Level: 1
PCR: 03859 Module: SWI Level: 2
PCR: 03861 Module: SWI Level: 2
PCR: 03861 Module: IPV6 Level: 2
PCR: 03864 Module: BGP Level: 2
PCR: 03865 Module: FIREWALL Level: 2
PCR: 03867 Module: BGP Level: 2
PCR: 03869 Module: CFLASH Level: 3

10 Patch Release Note
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
When typing “?” at the command line after SET SWITCH PORT,
INGRESSLIMIT was incorrectly displayed as a valid option. This issue has
been resolved.
A memory leak was occurring with DHCP. This issue has been resolved.
Uplugging the remote receive port on the 32FX card (AT-SB4352) was
causing the switch to lock-up. This issue has been resolved.
When the speed and duplex settings of a port were configured with the SET
SWITCH PORT SPEED command, the port sometimes erroneously
advertised auto-negotiation capabilities, usually when ports were
configured with a startup script. This issue has been resolved so that switch
ports will not advertise any capabilities when configured with fixed speed
and duplex settings.
When the device was configured as a DHCP server, a fatal error sometimes
occurred when a Telnet session to the device was closed while DHCP was
reclaiming IP addresses. Also, a Telnet error message displayed an incorrect
value when a telnet command line parameter was repeated (for example,
SHOW TELNET TELNET). These issues have been resolved.
Packets were not routed when an IPv6 flow was enabled. This issue has
been resolved.
The switch was adding a router port for multicast packets to destinations
with an address in the range 224.0.0.x. Switch port entries are now only
created for special router multicast addresses.
When the configurable temperature threshold had not been set, its value
should show as “Undefined” in the output of the SHOW SYSTEM
command, but it showed the same value as the fixed temperature threshold.
This issue has been resolved.
A fatal error sometimes occurred during persistent hotswapping of line
cards if the cards were inserted or removed before waiting for a message
like the following examples to appear:
Info (1034266): Board AT-SB4411 8-1000T(RJ45) hot-inserted
Info (1034268): Board AT-SB4411 8-1000T(RJ45) hot-swapped out
This issue has been resolved.
PCR: 03872 Module: SWI Level: 3
PCR: 03879 Module: DHCP Level: 2
PCR: 03880 Module: SWICX, SWI Level: 2
PCR: 03887 Module: SWCX Level: 2
PCR: 03888 Module: DHCP, TELNET Level: 2
PCR: 03889 Module: IPV6 Level: 2
PCR: 03890 Module: IGMP, SWI Level: 2
PCR: 03891 Module: CORE Level: 3
PCR: 03899 Module: CORE Level: 2

Patch SB251-13 For SwitchBlade 4000 Series Switches and AT-9800 Series Switches 11
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
The CREATE CONFIG command did not generate the TYPE parameter for
ADD IPV6 INTERFACE commands. This issue has been resolved.
A fatal error occurred with NVS when the log contained too many debug
log messages. These messages were added with PCR 03701. This issue has
been resolved.
The switch was previously responding to ARP request packets received
with invalid (i.e. broadcast or multicast) source MAC or IP addresses. This
issue has been resolved so that ARP packets received with broadcast or
multicast MAC or IP addresses will be discarded.
The SET PIM INTERFACE command did not succeed when the
HELLOTIMER parameter was specified. This issue has been resolved.
The AT-SB2415 Bandwidth Expander line card displayed an incorrect ID
name in the output of the SHOW SYSTEM command. This issue has been
resolved.
Incorrect debug information was returned when an ICMPv6 PacketTooBig
message was received. This issue has been resolved.
The IPSec configuration was not created correctly when the RADDRESS
and LNAME parameters in the CREATE IPSEC POLICY command were
used together. This issue has been resolved.
The CREATE IPSEC POLICY command failed if the interface specified with
the INTERFACE parameter did not have a global IPv6 interface defined.
This PCR implements a workaround by using the interface’s link-local IPv6
address if no other IPv6 address can be found.
ISAKMP debug messages now correctly outputs IPv6 addresses when
using IPv6, and IPv4 addresses when using IPV4.
When a NeighbourAdvert message containing an anycast target address was
received, the device incorrectly performed Duplicate Address Detection.
This issue has been resolved.
PCR: 03907 Module: IPV6 Level: 2
PCR: 03913 Module: SWCX Level: 2
PCR: 03921 Module: IP, ARP Level: 2
PCR: 03922 Module: PIM Level: 3
PCR: 03923 Module: CORE Level: 3
PCR: 03925 Module: IPV6 Level: 3
PCR: 03931 Module: IPSEC Level: 3
PCR: 03934 Module: IPSEC Level: 2
PCR: 03935 Module: IPV6 Level: 3
PCR: 03939 Module: IPV6 Level: 2
PCR: 03954 Module: IPV6 Level: 2

12 Patch Release Note
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
Prefixes of Anycast addresses could not be shared on the same port. This
issue has been resolved.
On an AT-9800 with certain third party GBICs, running the restart reboot
command would cause the switch to lock-up. However the problem did not
occur when using the Reset button. This issue has been resolved by
disabling all ports before performing a RESTART REBOOT.
IPv6 was using the same SA (security association) soft expiry timer at both
ends of link. This was wasting CPU and memory resources. This issue has
been resolved.
A multicast listener discovery (MLD) snooping entry was incorrectly added
to the SwitchBlade’s layer two multicast address table.
The AT-9800 was not adding layer two MLD Snooping when additional
VLANs were created.
The failure of a SwitchBlade port was causing restarts due to the switch
attempting to remove the port from a “non existent” MLD Snooping list.
These three issues have been resolved.
Large routing areas, containing many hosts and interfaces, were causing
fatal errors due to the excessive number of link state advertisements
generated. This issue has been resolved by limiting the combined number
of routers and hosts within each area to 100.
The IP option field for trace route was not being filled correctly when equal
cost multipath routes were used. This has now been fixed.
Route flapping was occurring when an interface went down and there was
another path to the next hop. This issue has been resolved.
A fatal error would occur if a file whose name contained Japanese
characters was deleted from compact flash. This issue has been resolved.
In configurations containing many VLANs, temporary lockups were
frequently occurring while the hardware tables were being updated. This
patch substantially reduces the severity of these lockups.
Running the SHOW IP IGMP COUNTER command was displaying zero
values for the outQuery and outTotal counters. This issue has been resolved.
PCR: 3956 Module: SWI, CORE Level: 2
PCR: 03965 Module: IPSEC Level: 2
PCR: 03966 Module: MLDS Level: 2
PCR: 03968 Module: OSPF Level: 2
PCR: 03973 Module: SWI Level: 3
PCR: 03986 Module: BGP, IPG Level: 2
PCR: 03991 Module: CFLASH Level: 2
PCR: 03991 Module: SWCX, SWI Level: 2
PCR: 031000 Module: SWCX, SWI Level: 3

Patch SB251-13 For SwitchBlade 4000 Series Switches and AT-9800 Series Switches 13
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
The SET QOS VLANREMAP command was incorrectly saving
configuration files. This was resulting in errors occurring when the file was
executed. This issue has been resolved so that the file is saved in the correct
form.
CAM errors were appearing when the ENABLE SWITCH BIST command
was run multiple times. This issue has been resolved.
When line cards were hotswapped, the card’s STPs were not being correctly
reset to indicate that the card had been exchanged. This sometimes resulted
in a failure to select the preferred link, during the link re-establishment
phase. This issue has been resolved.
On the AT-9800, files with no extension were causing fatal errors when
stored on compact flash cards. This issue has been resolved to ensure that
these files are handled correctly.
On the AT-9800, the configuration file could be set from compact flash files
held in directories other than the root. This issue has been resolved by
preventing the configuration being set from files other than those located in
the root directory.
The prune time limit was not being cancelled when an IGMP join was
received by the switch. This was forcing the switch to send a Graft message
in the upstream direction. This issue has been resolved by cancelling the
prune time limit whenever an IGMP join is received.
When the SWITCH PORT command parameters, 10HMAUTO,
10MFAUTO, 100MHAUTO etc, were used to set a port to auto negotiate at
a particular speed, the port speed would not be retained following a card
hot swap. This issue has been resolved.
The PORT and PORTPRIORITY parameters of the STP PORT command
were not always updating switch instances on ports that are members of
multiple STP instances. This issue has been resolved.
When the switch received a generation ID change message, it was not
responding by sending a PIM HELLO message. This issue has been
resolved.
PCR: 031003 Module: QOS Level: 3
PCR: 031005 Module: SWCX Level: 3
PCR: 031006 Module: STP SWI Level: 2
PCR: 031007 Module: CFLASH Level: 2
PCR: 031008 Module: CFLASH INSTALL Level: 2
PCR: 031012 Module: PIM Level: 2
PCR: 031014 Module: SWCX Level: 2
PCR: 031015 Module: STP Level: 2
PCR: 031020 Module: PIM Level: 2
PCR: 031030 Module: SWCX Level: 3

14 Patch Release Note
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
BIST failures were occurring because the software was not full supporting
the SwitchBlade 8 port 1000BASE-LX line card 1 (AT-SB4462). This issue has
been resolved.
STP was not being handled correctly when hot swapping line cards. This
resulted in links other than the preferred link being selected.
Also, when a layer two data stream was forwarded from one line card (the
source card) to another (the destination card) via the preferred STP link, if
the destination card had been swapped out, and the backup link was via the
source card, then the data stream would not be forwarded correctly over the
backup link.
These issues have been resolved.
PCR: 031033 Module: Level: 2

Patch SB251-13 For SwitchBlade 4000 Series Switches and AT-9800 Series Switches 15
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
Multicast Listener Discovery Snooping
Multicast Listener Discovery (MLD) snooping enables the switch to forward IPv6
multicast traffic intelligently, instead of flooding it out all ports in the VLAN.
Without MLD snooping, multicast group membership for VLAN aware
devices is on a per-VLAN basis, because MLD is an IPv6-based protocol. If at
least one port in the VLAN is a member of a multicast group, and MLD
snooping is not used, IPv6 multicast packets will be flooded onto all ports in
the VLAN. With MLD snooping, the switch passively listens to MLD joins /
reports and leaves / done messages, to identify the switch ports that have
received joins and/or leaves from devices attached to them. Multicast traffic
will only be forwarded to those ports. MLD snooping will also identify ports
that are connected to another router or switch and forward messages out those
ports appropriately.
MLD snooping is performed at Layer 2 on VLAN interfaces automatically. By
default, the switch will only forward traffic out those ports with routers or IPv6
multicast listeners, therefore it will not act as a simple hub and flood all IPv6
multicast traffic out all ports. MLD snooping is independent of the MLD and
Layer 3 configuration, so an IPv6 interface does not have to be attached to the
VLAN, and MLD does not have to be enabled or configured. MLD is described
in the “IPv6 Multicasting” chapter of the AT-9800 Series Switch Software
Reference.
MLD snooping will not generate MLD query messages, but will relay MLD
queries from other routers or switches attached to one of its ports to other ports
in the same VLAN.
MLDv2 supports Multicast Address and Source Specific messages. These
messages enable a host to listen to traffic from a particular source to a
particular multicast address, instead of all traffic for the group. MLD snooping
cannot snoop these messages, because the address information is contained
within the packet’s IPv6 Layer 3 header. These messages will be flooded to all
ports in the VLAN. The switch will snoop MLDv1 message types 130 (Query),
131 (Listener Report) and 132 (Listener Done), as specified in RFC 2710,
Multicast Listener Discovery (MLD) for IPv6, October 1999.
Multicast group membership registration entries on the switch will time out
after no data or messages have been received for that group on that port for 270
seconds.
The following multicast addresses are used by IPv6 for special purposes, and
will always be flooded:
FF02::1 (All nodes)
FF02::2 (All routers)
FF02::4 (DVMRP)
FF02::5 (OSPFIGP)
FF02::6 (OSPFIGP Designated routers)
FF02::9 (RIPv2)
FF02::d (PIM)
FF02::f (CBT)
FF02::12 (VRRP)

16 Patch Release Note
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
MLD snooping on the switch uses the last 4 bytes of the IPv6 address to
distinguish multicast addresses. It is therefore unable to distinguish different
multicast addresses that end with the same 4 bytes. Creating an entry for a
multicast group will have the effect of creating an entry for all groups with
addresses that end with the same 4 bytes as that group’s address. For example,
traffic for the groups:
ffxx xxxx xxxx xxxx xxxx xxxx 1234 5678 and
ffyy yyyy yyyy yyyy yyyy yyyy 1234 5678
will be forwarded out the same set of ports, irrespective of the values of x and
y. Therefore, if MLD snooping is used, no two groups within the multicast
domain should be given an address that ends in the same 4 bytes.
Similarly, all addresses beginning with ff02 and ending with any of:
0000:0001, 0000:0002, 0000:0004, 0000:0005, 0000:0006,
0000:0009, 0000:000d, 0000:000f or 0000:0012
will be flooded out all ports in the VLAN, because MLD snooping cannot
distinguish them from IPv6 special addresses. These addresses should be
avoided if MLD snooping is used.
MLD snooping is enabled by default. To disable it, use the command:
DISABLE MLDSNOOPING
Note that IPv6 multicast packets will flood the VLAN when MLD snooping is
disabled. Disabling MLD snooping may be useful on Rapier i Series Switches if
filters are used extensively, because MLD snooping uses a Layer 3 filter. When
MLD snooping is disabled, this filter becomes available. See “Hardware Packet
Filters” in the Switching chapter of the Software Reference for information
about filters.
To enable MLD snooping, use the command:
ENABLE MLDSNOOPING
MLD snooping can only be enabled if a free filter entry is available.
To display debugging information, use the command:
ENABLE MLDSNOOPING DEBUG
This command displays the ports that are currently receiving MLD packets and
the ports that are being added or taken off the switch’s multicast group
membership registration.
To disable debugging, use the command:
DISABLE MLDSNOOPING DEBUG
To display information about MLD snooping, use the command:
SHOW MLDSNOOPING [COUNTER]
Example output from the SHOW MLDSNOOPING command is described in
Figure 1 on page 17 and Table 1 on page 18. Example output from the SHOW
MLDSNOOPING COUNTER command is described in Figure 2 on page 18
and Table 2 on page 18.

Patch SB251-13 For SwitchBlade 4000 Series Switches and AT-9800 Series Switches 17
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
Figure 1: Example output from the SHOW MLDSNOOPING command.
MLD Snooping
--------------------------------------------------------------------------------
Status ........................ ENABLED
Debugging ..................... DISABLED
Group Timeout ................. 270 Secs
Interface: vlan1
--------------------------------------------------------------------------------
Multicast Address ................ ff05:2222:3333:4444:5555:6666:7777:1111
Ports ............................ 1,2,4-6
Entry Timeout .................... 120 Secs
Multicast Address ................ All routers group
Ports ............................ 5
Entry Timeout .................... 208 Secs
Interface: vlan4
--------------------------------------------------------------------------------
Multicast Address ................ ff01:1234:1234:5678:5678:2222:1111:3333
Ports ............................ 12,13,14
Entry Timeout .................... 56 Secs

18 Patch Release Note
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
Figure 2: Example output from the SHOW MLDSNOOPING COUNTER command.
Table 1: Parameters displayed in the output of the SHOW MLDSNOOPING
command.
Parameter Meaning
Status The status of MLD snooping; one of ENABLED or DISABLED.
Debugging The status of MLD snooping debugging; one of ENABLED
or DISABLED.
Group Timeout The switch’s timeout period for multicast group registration
(270 seconds). If no MLD listener joins are received during
this period of time, the group registration will be deleted.
Interface The interface for which multicast registrations are
displayed.
Multicast Address The IPv6 multicast group address registered for a particular
VLAN interface.
Ports The member ports for the multicast group.
Entry Timeout The number of seconds remaining until this multicast
registration will be deleted if no listener joins are received.
MLD Snooping Counters
--------------------------------------------------------------------------------
InMessages ........................ 52
InDiscards ........................ 2
InGenQueries ...................... 10
InSpecQueries ..................... 4
InJoins ........................... 20
InDones ........................... 16
--------------------------------------------------------------------------------
Table 2: Parameters displayed in the output of the SHOW MLDSNOOPING
COUNTER command.
Parameter Meaning
InMessages The number of MLD messages received by the CPU on the
switch.
InDiscards The number of MLD messages received by the CPU on the
switch but discarded, for example, because the packets
were malformed.
InGenQueries The number of MLD general query messages received the
CPU on the switch.
InSpecQueries The number of MLD specific query messages received the
CPU on the switch.
InJoins The number of MLD listener joins messages received the
CPU on the switch.
InDones The number of MLD listener done messages received by the
CPU on the switch.

Patch SB251-13 For SwitchBlade 4000 Series Switches and AT-9800 Series Switches 19
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
Features in SB251-12
Patch SB251-12 includes all issues resolved and enhancements released in
previous patches for Software Release 2.5.1, and the following enhancements:
After loading this software version, please check your alarm relay connections.
Refer to PCR 03209 for more information.
When configured with ACTION=NAT, the firewall was incorrectly
applying TCP port filtering. This issue has been resolved. Also, the
GBLPORT parameter of the commands, SET FIREWALL POLICY RULE
and ADD FIREWALL POLICY RULE is no longer applied when ACTION
is set to NAT.
RIP was learning routes from neighbours even when it was disabled. This
issue has been resolved.
Traffic that matched the internal system rules in the Packet Classifier tables
was not always being directed to the same internal traffic class. This issue
has been resolved.
In configurations using two switch controller cards, the system redundancy
feature (SYSR) could not locate and initialise the second switch control card.
This issue has been resolved.
ESRP™ packets received were being dropped and not forwarded. This issue
has been resolved.
When an oversize packet (PMTU) was received, an error message was not
returned, even when IPv6 flow was enabled. This issue has been resolved.
Entering the command PING 0.0.0.0 was not producing an error message.
Also, the TRACE function was not resolving local addresses correctly. These
issues have been resolved.
The IPv6 loopback address was used as a source address in ping packets,
causing ping to fail. This issue has been resolved.
The following issues have been resolved:
• IPv4 addresses x.x.x.0 or x.x.x.255 were not accepted for the IP
parameter in the ADD IPV6 6TO4 command.
PCR: 03287 Module: Firewall Level: 2
PCR: 03437 Module: IPV6 Level: 2
PCR: 03661 Module: SWCX Level: 2
PCR: 03688 Module: SYSR Level: 2
PCR: 03715 Module: SWI Level: 2
PCR: 03733 Module: IPV6 Level: 3
PCR: 03744 Module: IPG, SWCX Level: 3
PCR: 03750 Module: IPv6 Level: 3
PCR: 03756 Module: IPV6 Level: 2

20 Patch Release Note
Patch SB251-13 for Software Release 2.5.1
C613-10361-00 REV M
• IPv4 addresses x.x.x.0 or x.x.x.255 were not accepted for the LOCAL
parameter in the ADD IPV6 TUNNEL command.
• IPv6 addresses 2002:x:x::/48 were not accepted for the IPADDRESS
parameter in the ADD IPV6 INTERFACE command.
Changes have been implemented to prevent loss of connectivity between
line cards.
When port speeds were set using a configuration script, their capabilities on
line cards with CAM, were being incorrectly reported. This issue has been
resolved.
The SwitchBlade SB4108 chassis was failing the L3 Full Mesh test. This issue
has been resolved.
The SHOW SYSTEM command was not correctly displaying the Compact
Flash patch files.
Fatal errors were occasionally occurring when multicast forwarding was
updated. This issue has been resolved.
If a SET operation failed, the recovery process applied the default
MAXBANDWIDTH setting, regardless of either the configured value, or
the port speed capability. This was resulting in the MAXBANDWIDTH
value being too high. This issue has been resolved.
Additional messages will now advise the file transfer status as files are
transferred between compact flash and flash memory.
The SwitchBlade, SB4104 chassis, was failing the L3 Full Mesh test. This
issue has been resolved.
IPX routing did not work in certain circumstances. This issue has been
resolved.
For switches configured for VRRP, it was not possible to Ping the switch
operating in the Master state. This issue has been resolved.
A fatal error occurred in the load balancer when there were no UP resources
in a resource pool. This issue has been resolved. Load balanced TCP
PCR: 03760 Module: SWI Level: 1
PCR: 03763 Module: SWI Level: 2
PCR: 03770 Module: SWI Level: 2
PCR: 03773 Module: SWI Level: 3
PCR: 03775 Module: SWI Level: 2
PCR: 03777 Module: QOS Level: 2
PCR: 03782 Module: QOS Level: 3
PCR: 03794 Module: SWI Level: 2
PCR: 03797 Module: SWI Level: 1
PCR: 03188 Module: IPG, SWI, VRRP Level: 3
PCR: 03189 Module: FIREWALL, LB Level: 3