Allied Telesis AT-9900 Series Instruction Manual

Software Maintenance Release Note
Version 276-03
for AT-8900 and AT-9900 series switches
This software maintenance release note lists the issues addressed and enhancements made in Maintenance Version 276-03 for Software Release 2.7.6. Release
details are listed in the following table:
Caution: Using a maintenance version on the wrong model may cause unpredictable results, including disruption to the network.
This maintenance release note should be read in conjunction with the following documents:
■Release Note for Software Version 2.7.6 for AT-8800, Rapier i, AT-8700XL, AT-8600, AT-9900, AT-8900 and AT-9800 Series Switches and AR400 and AR700
Series Routers (document number C613-10462-00 Rev A)
■your switch’s Document Set for Software Release 2.7.5. This document set is available on the CD-ROM that shipped with your switch, or from:
www.alliedtelesyn.co.nz/documentation/documentation.html
Caution: Information in this release note is subject to change without notice and does not represent a commitment on the part of Allied Telesis Inc. While every
effort has been made to ensure that the information contained within this document and the features and changes described are accurate, Allied Telesis Inc. can
not accept any type of liability for errors in, or omissions arising from the use of this information.
Models Series Release File Date Size (bytes) GUI file
AT-8948 AT-8900 89276-03.rez 4 August 2006 4572948 —
AT-9924T, AT-9924SP, AT-9924T/4SP AT-9900 89276-03.rez 4 August 2006 4572948 d9924e27.rsc

Enabling and Installing this Release 2
Version 276-03
C613-10474-00 REV B
Enabling and Installing this Release
To use this maintenance release you must have a base release license for Software Release 2.7.6. Contact your distributor or reseller for more information. To
enable this release and install it as the preferred release, use the commands:
enable rel=89276-03.rez num=2.7.6
set install=pref rel=89276-03.rez
Levels
Some of the issues addressed in this Maintenance Version include a level number. This number reflects the importance of the issue that has been resolved. The
levels are:
Level 1 This issue will cause significant interruption to network services, and there is no work-around.
Level 2 This issue will cause interruption to network service, however there is a work-around.
Level 3 This issue will seldom appear, and will cause minor inconvenience.
Level 4 This issue represents a cosmetic change and does not affect network operation.

Features in 276-03 3
Version 276-03
C613-10474-00 REV B
Features in 276-03
Software Maintenance Version 276-03 includes all resolved issues and enhancements in earlier versions, and the resolved issues and enhancements in the
following tables. In the tables, for each product series:
■“Y” indicates that the resolution is available in Version 276-03 for that product series.
■“-” indicates that the issue did not apply to that product series.
Level 1
Level 2
No level 2 issues
Level 3
No level 3 issues
Level 4
No level 4 issues
Enhancements
No enhancements
CR Module Level Description
AR44x / AR450 AR7x5 AR750S Rapier i AT-8800 AT-8600 AT-8700XL AT-8948 AT-9900 AT-9800
CR00012654
CR00013388
Switch 1 Under heavy CPU utilisation, particularly when many SFPs were installed,
AT-9924SP switches sometimes did not correctly detect the installed status of
SFPs or reflect the correct link state.
This issue has been resolved. The switch now reports the correct state once the
heavy load is removed.
--------Y-

Features in 276-02 4
Version 276-03
C613-10474-00 REV B
Features in 276-02
Software Maintenance Version 276-02 includes all resolved issues and enhancements in earlier versions, and the resolved issues and enhancements in the
following tables. In the tables, for each product series:
■“Y” indicates that the resolution is available in Version 276-02 for that product series.
■“-” indicates that the issue did not apply to that product series.
Level 1
CR Module Level Description
AR44x / AR450 AR7x5 AR750S Rapier i AT-8800 AT-8600 AT-8700XL AT-8948 AT-9900 AT-9800
CR00011691 Switch 1 Previously, if trunk ports were configured and/or STP was enabled, the CPU
flooded GARP frames in an incorrect manner, which could cause network loops.
This issue has been resolved. GMRP frames are (correctly) flooded, and GVRP
frames are now only flooded if GARP is disabled.
---YYYYYY-
CR00011694 Core,
Switch
1If the switch had learned a very large number of routes from BGP and the
interface went down, IP ran out of memory when recalculating the best routes
to use. This was exacerbated when the high memory usage triggered the BGP
backoff mechanism which in turn disabled the BGP peers, which caused IP to
recalculate even more routes. The switch eventually rebooted due to memory
exhaustion.
This issue has been resolved by improvements to memory allocation and IP route
queuing, and by enforcing limits on the number of IP routes.
---YY--YYY
CR00012097 Switch 1 When PIM6 was configured on the switch, and it received an IPv6 multicast
stream for which it had no downstream interface to forward the stream to, a
reboot could occur.
This issue has been resolved.
---YY--YYY

Features in 276-02 5
Version 276-03
C613-10474-00 REV B
Level 2
CR Module Level Description
AR44x / AR450 AR7x5 AR750S Rapier i AT-8800 AT-8600 AT-8700XL AT-8948 AT-9900 AT-9800
CR00000529 IPv6,
PIM6
2When a better route for multicast traffic became available, PIM for IPv6 did not
recalculate the route and switch the traffic to use it.
This issue has been resolved.
YYYYY- - YYY
CR00006475 IP Gateway,
PIM
2When PIM-DM or PIM-SM was forwarding traffic through the CPU at high data
rates and an SG entry was deleted, it was possible for the router or switch to
reboot.
This issue has been resolved.
YYYYY- - YYY
CR00007522 IP Gateway 2 The switch’s hardware IP route table occasionally did not contain the most
optimal route to a destination. This meant packets were sometimes sent via sub-
optimal routes. An additional effect was that when multiple equal-cost routes
existed a less than complete set of those routes would be utilised.
This issue has been resolved, so that the switch forwards packets via the best IP
route(s) available.
---YYYYYYY
CR00007741 TCP,
TPAD
2TPAD TCP sessions now have a keepalive timer applied to them. If a TPAD TCP
session is inactive and therefore there is no response to the TCP keepalives, then
after 3 keepalive attempts, 10 seconds apart, the TPAD TCP session is closed. This
frees up the TCP listen port to allow subsequent TPAD transactions via that TCP
port. This TCP keepalive facility only applies to TPAD-related TCP traffic.
YYYY------
CR00007950 SSH 2 When a user is logged into the router or switch via an ASYN port and uses the
SSH client to send a command to a remote SSH server, the server sends the
response and the SSH session is closed as expected. However, the tail end of the
response was sometimes not received by the user logged into the ASYN port.
This issue has been resolved.
YYYYYYYYYY

Features in 276-02 6
Version 276-03
C613-10474-00 REV B
CR00008699 Switch 2 Previously, when 300 MAC address filters were added to a port and the port was
reset, the CPU became 100% utilised.
This issue has been resolved.
---YYYY- - -
CR00008992 IPv6 2 The router or switch sometimes unexpectedly stopped forwarding IPv6 multicast
traffic if the multicast’s upstream path changed. This could occur, for example,
when the path changed because an interface went down.
YYYYY- - YYY
CR00009201 ARP 2 An ARP timeout caused the removal of the ARP entry, resulting in packet loss until
the entry was re-added.
This issue has been resolved.
YYYYYYYYYY
CR00009280 ATM 2 When the router was using IPsec and either IPoEoA or IPoA, and it received traffic
from a VLAN at a higher rate than it could transmit over the ADSL link, eventually
the ATM interface would intermittently stop transmitting traffic.
This issue has been resolved.
Y---------
CR00009283 Switch 2 If a 48-port switch learned many thousands of MAC addresses, it rebooted when
the addresses timed out.
This issue has been resolved.
---YYYY- - -
CR00009539 IP Gateway 2 The IP DNS cache feature was not designed to include MX (Mail Exchange) DNS
records. In some circumstances, MX DNS entries were added to the IP DNS cache
and the name of a DNS record was incorrectly associated with the IP address of
the MX entry. This stopped the router or switch from correctly resolving A-record
requests for the affected domain name.
This issue has been resolved by ensuring that MX entries are never added to the
IP DNS cache.
YYYYYYYYYY
CR00010265 Switch 2 When the ingress and egress port were defined in an Layer 3 filter with an action
of deny, the filter denied the traffic to be sent out all the egress ports and not
just the egress port specified in the filter.
This issue has been resolved.
---YYYY- - -
CR Module Level Description
AR44x / AR450 AR7x5 AR750S Rapier i AT-8800 AT-8600 AT-8700XL AT-8948 AT-9900 AT-9800

Features in 276-02 7
Version 276-03
C613-10474-00 REV B
CR00010886 IPv6,
IP Gateway,
PPP
2When a user enabled a Dial-on-Demand PPP interface, sometimes the router or
switch did not apply the associated IP route change. This meant that routes via
the Dial-on-Demand PPP interface were not available for use. When this
occurred, routed traffic failed to activate the associated Dial-on-Demand PPP
interface.
This issue has been resolved.
YYYYY- - YYY
CR00011060 IP Gateway,
PIM
2In networks with redundancies handled by protocols such as STP and trunking,
upstream PIM neighbours may move from one port to another. When this
happened, PIM-DM failed to re-establish multicast routes with all of its
downstream interfaces listed properly. This caused the switch to eventually stop
sending multicasts for that group via that route.
This issue has been resolved.
---YY--YYY
CR00011128 BGP 2 When running a BGP network using route reflectors, changing the cluster ID on
a router or switch could cause a restart of some of the BGP clients.
This issue has been resolved.
YYYYY- - YYY
CR00011304 VRRP 2 VRRP did not function correctly when the switch was configured with protected
VLANs.
This issue has been resolved.
---YYYY- - -
CR00011305 IPv6,
Utility
2RIPng (RIPv6) occasionally advertised sub-optimal routes to its neighbour when
the router or switch was placed in a looped network topology.
This issue has been resolved.
YYYYY- - YYY
CR00011338 ASYN 2 If a cable carrying a continuous stream of characters is connected to a port on an
4-port ASYN PIC, the ASYN port did not always receive the characters correctly.
This was because of a port synchronisation failure to the character stream.
This issue has been resolved. The port now detects the synchronisation failure
and continues to attempt synchronisation to the character stream until
successful.
YYYY------
CR Module Level Description
AR44x / AR450 AR7x5 AR750S Rapier i AT-8800 AT-8600 AT-8700XL AT-8948 AT-9900 AT-9800

Features in 276-02 8
Version 276-03
C613-10474-00 REV B
CR00011349 SYN 2 At low baud rates, a synchronous connection was unable to reach 100%
utilisation of the available bandwidth. The queueing mechanism has been
improved to allow 100% link utilisation. Flag sharing between back-to-back
HDLC frames is now supported for synchronous connections.
YYYY------
CR00011396 PIM on IPv6 2 When a user specified a static RP candidate and saved the configuration with the
create config command, the resulting configuration file did not include the RP
candidate. Therefore, rebooting the router or switch deleted the static RP
candidate entry.
This issue has been resolved.
YYYYY- - YYY
CR00011411 PoE 2 When multiple telnet sessions where open on the AT-8624PoE switch, and the
command show switch port was entered, the switch command line became
unresponsive for several minutes.
This issue has been resolved.
-----Y----
CR00011586 Switch 2 When a port is no longer a member of any VLAN as an untagged port, it would
discard received untagged BPDU packets.
Note that this issue only occurred on AT-8900 and AT-9900 switches; other
switches already correctly handled untagged frames on tagged ports when
required.
This issue has been resolved.
-------YY-
CR00011587 Switch 2 Previously, if a port was a tagged member of a VLAN, it was not able to transmit
untagged frames to that VLAN.
This issue has been resolved. When required, STP BPDUs can now to be sent
untagged out a port, even if the port is configured as a tagged member of a
VLAN.
-------YY-
CR00011645 Switch 2 After an AT-8800 series switch was powered down or rebooted, non auto-
negotiating copper GBICs did not correctly handle Ethernet PAUSE frames.
This issue has been resolved.
----Y-----
CR Module Level Description
AR44x / AR450 AR7x5 AR750S Rapier i AT-8800 AT-8600 AT-8700XL AT-8948 AT-9900 AT-9800

Features in 276-02 9
Version 276-03
C613-10474-00 REV B
CR00011665 PRI 2 When using an unstructured TDM group over an E1 mode PRI interface,
occasionally a high level of errors was experienced. This may have caused the link
to be unstable, or may have resulted in reduced data throughput.
This issue has been resolved.
YYYY------
CR00011746 BGP 2 If the router or switch failed to establish a BGP peer session because of
unsuccessful Open message exchanges, no further attempts to establish the peer
connection were made.
This issue has been resolved. The router or switch now continues to attempt to
establish the session, with 60 second intervals between attempts.
YYYYY- - YYY
CR00011780 BOOTP 2 Previously, if a user entered the command set bootp relay option82
port=portnum without also specifying one of the required subscriberid or
trusted parameters, the router or switch would incorrectly report “Operation
Successful”.
This issue has been resolved. The router or switch now reports that one of the
parameters subscriberid or trusted must also be specified as part of this
command.
YYYYYYYYYY
CR00011809 Firewall 2 The SIP application layer gateway (ALG) did not correctly handle SIP packets that
had an extension parameter added to the “From” field. In VoIP networks that
added this extension parameter, users telephoning out from the private network
could not hear the recipient talk, because the VoIP voice data was not passed
from the remote client to the client on the private side.
This issue has been resolved.
YYYYY----Y
CR00011844 IPv6 2 IPv6 interfaces did not work over a PPP link on switches or AR44x routers. When
the interface received IPv6 traffic, the router or switch rebooted.
This issue has been resolved.
Y--YY--YYY
CR Module Level Description
AR44x / AR450 AR7x5 AR750S Rapier i AT-8800 AT-8600 AT-8700XL AT-8948 AT-9900 AT-9800

Features in 276-02 10
Version 276-03
C613-10474-00 REV B
CR00011855 TCP,
UPnP
2TCP sessions would sometimes “hang” in the Close Wait state. This behaviour
occurred when a UPnP notification session was closed by the control point
(usually Windows XP, SP2), via a “200 OK” message that contained a
“Connection: close” field, that also had the TCP/FIN flag set.
Because these TCP sessions were not closing, eventually all available TCP
resources could be used up, preventing new TCP sessions from opening.
This issue has been resolved. Such TCP sessions now close correctly.
YYY- ------
CR00011940 Switch 2 Previously, if all configured IP interfaces were down or had been deleted,
broadcast frames were not sent to the switch’s CPU. This meant, for example,
that VLANs on the switch did not receive PPPoE traffic if all IP interfaces were
down.
-------YY-
CR00011991 WAN load
balancer
2An issue occurred when the router accessed multiple WAN load balancer
healthcheck hosts, and was configured as a firewall that performed enhanced
NAT. Instead of testing the health of each healthcheck host through every WAN
LB resource (and therefore over all relevant WAN interfaces), the router only
tested through one WAN LB resource. If that one WAN interface lost connectivity
to the Internet, the WAN LB incorrectly thought that all WAN LB resources had
become unavailable.
This issue has been resolved. The WAN LB now correctly checks the health of all
healthcheck hosts through all WAN LB resource interfaces.
YYY- ------
CR00011992 Firewall 2 When the firewall was enabled, it failed to process some RTSP packets, so clients
behind the firewall failed to load some web pages that used RTSP (TCP port
7070).
This issue has been resolved.
YYYYY----Y
CR Module Level Description
AR44x / AR450 AR7x5 AR750S Rapier i AT-8800 AT-8600 AT-8700XL AT-8948 AT-9900 AT-9800