Cisco Field Notice: Wi-Fi Protected Setup PIN Brute Force Vulnerability

Note the WPS vulnerability is with home and soho devices and not with Cisco enterprise gear. Note the models below:

Cisco Response

On December 27th, 2011 US-CERT released VU#723755 available here: http://www.kb.cert.org/vuls/id/723755

The US-CERT Vulnerability Note describes a vulnerability that exists in the Wi-Fi Alliance Wi-Fi Protected Setup (WPS) protocol, also known as Wi-Fi Simple Config, when devices are operating in PIN External Registrar (PIN-ER) mode.  Devices operating in PIN-ER mode allow a WPS capable client to supply only the correct WPS PIN to configure their client on a properly secured network.  A weakness in the protocol affects all devices that operate in the PIN-ER mode, and may allow an unauthenticated, remote attacker to brute force the WPS configuration PIN in a short amount of time.

The vulnerability is due to a flaw that allows an attacker to determine when the first 4-digits of the eight-digit PIN are known.  This effectively reduces the PIN space from 10⁷ or 10,000,000 possible values to 10⁴ + 10³ which is 11,000 possible values. The eighth digit of the PIN is utilized as a checksum of the first 7 digits and does not contribute to the available PIN space. Because the PIN space has been significantly reduced, an attacker could brute force the WPS pin in as little as a few hours.

While the affected devices listed below implement the WPS 1.0 standard which requires that a 60-second lockout be implemented after three unsuccessful attempts to authenticate to the device, this does not substantially mitigate this issue as it only increases the time to exploit the protocol weakness from a few hours to at most several days.  It is our recommendation to disable the WPS feature to prevent exploitation of this vulnerability.

Vulnerable Products:

Product Name	Is the WPS feature enabled by default?	Can the WPS feature be permanently disabled?
Access Points
Cisco WAP4410N	Yes	Yes
Unified Communications
Cisco UC320W	Yes	No
Wireless Routers/VPN/Firewall Devices
Cisco RV110W	Yes	Yes
Cisco RV120W	No	Yes
Cisco SRP521W	Yes	Yes
Cisco SRP526W	Yes	Yes
Cisco SRP527W	Yes	Yes
Cisco SRP541W	Yes	Yes
Cisco SRP546W	Yes	Yes
Cisco SRP547W	Yes	Yes
Cisco WRP400	Yes	Yes

Note: The Cisco Valet product line is maintained by the Cisco Linksys Business Unit. Information concerning the Cisco Valet line as well as information on Linksys by Cisco products will be forthcoming.

Products Confirmed Not Vulnerable:

Product Name	Not Affected Reason
Access Points/Wireless Bridges
Cisco AP541N	Does not support WPS
Cisco WAP200	Does not support WPS
Cisco WAP200E	Does not support WPS
Cisco WAP2000	Does not support WPS
Cisco WET200	Does not support WPS
Unified Communications
Cisco UC500 Series	Does not support WPS
Wireless Cameras
Cisco WVC210	Does not support WPS
Cisco WVC2300	Does not support WPS
Wireless Routers/VPN/Firewall Devices
Cisco SA520W	WPS not enabled by default Does not support PIN-ER configuration Mode
Cisco RV220W	Does not support WPS
Cisco WRV210	Does not support WPS
Cisco WRVS4400N	Does not support WPS

Additional Information

Workarounds:

Disable the Wi-Fi Protected Setup feature on devices that allow the feature to be disabled, as listed in the Vulnerable Products table.  Cisco Systems has verified that the products that support disabling the WPS feature do indeed disable it and are not vulnerable once the feature has been disabled from the management interface.

Fixed Software:

Product Name	Fixed Software
Cisco WAP4410	To Be Released
Cisco RV110W	To Be Released
Cisco RV120W	To Be Released
Cisco UC320W	To Be Released
Cisco SRP521W	To Be Released
Cisco SRP526W	To Be Released
Cisco SRP527W	To Be Released
Cisco SRP541W	To Be Released
Cisco SRP546W	To Be Released
Cisco SRP547W	To Be Released
Cisco WRP400	To Be Released

Note: The Cisco Valet product line is maintained by the Cisco Linksys Business Unit. Information concerning the Cisco Valet line as well as information on Linksys by Cisco products will be forthcoming.

Exploitation and Public Announcements:

Exploit code and functional attack tools that exploit the weakness within the WPS protocol have been released.

This vulnerability was discovered by Stefan Viehböck and Craig Heffner.

Status of this Notice: Final

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.

Revision History

 Revision	 Date	 Notes
1.0	01-11-2012	Initial Public Release

792x phone may not reconnect when invalid 5 GHz beacon received : CSCtk58591

A more recent bug found on 1.4(1) 792x handset code. Something to take note if you're on this code and using voice on 802.11a

CSCtk58591 Bug Details

792x phone may not reconnect when invalid 5 GHz beacon received
Symptom: 792x phone may not reconnect when invalid 5 GHz beacon received. Conditions: 792x phone going out of range then comes back in range when set to scan 5 GHz. Workaround: Power cycle the phone. Use 802.11b/g only mode.	Status Open Severity 3 - moderate Last Modified In Last 3 Days Product Cisco Unified IP Phone 7900 Series Technology Wireless, Mobile 1st Found-In 1.4(1)
Interpreting This Bug Bug Toolkit provides access to the latest raw bug data so you have the earliest possible knowledge of bugs that may affect your network, avoiding un-necessary downtime or inconvenience. Because you are viewing a live database, sometimes the information provided is not yet complete or adequately documented. To help you interpret this bug data, we suggest the following: This bug has a Moderate severity 3 designation. Things fail under unusual circumstances, or minor features do not work at all, or things fail but there is a low-impact workaround. This is the highest level for documentation bugs. (Bug Toolkit may not provide access to all documentation bugs.) Severity levels are designated by the engineering teams working on the bug. Severity is not an indication of customer priority which is another value used by engineering teams to determine overall customer impact. Bug documentation often assumes intermediate to advanced troubleshooting and diagnosis knowledge. Novice users are encouraged to seek fully documented support documents and/or utilize other support options available.

End-of-Sale and End-of-Life Announcement for the Cisco 2100 Series Wireless LAN Controllers

End-of-Sale and End-of-Life Announcement for the Cisco 2100 Series Wireless LAN Controllers
Url: http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/ps7206/ps7221/end_of_life_notice_c51-691053.html
Description: Cisco announces the end-of-sale and end-of-life dates for the Cisco 2100 Series Wireless LAN Controllers. The last day to order the affected product(s) is May 2, 2012. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.
Date: 2011-11-04 16:30:00.0

End-of-Sale and End-of-Life Announcement for the Cisco Aironet 1520 Series

Title: End-of-Sale and End-of-Life Announcement for the Cisco Aironet 1520 Series
Url: http://www.cisco.com/en/US/prod/collateral/wireless/ps5679/ps8368/end_of_life_notice_c51-688859.html
Description: Cisco announces the end-of-sale and end-of-life dates for the Cisco Aironet 1520 Series. The last day to order the affected product(s) is March 30, 2012. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.
Date: 2011-09-30 15:05:00.0

End-of-Sale and End-of-Life Announcement for the Cisco Aironet 1400 Series

Title: End-of-Sale and End-of-Life Announcement for the Cisco Aironet 1400 Series
Url: http://www.cisco.com/en/US/prod/collateral/wireless/ps5679/ps5279/end_of_life_notice_c51-689032.html
Description: Cisco announces the end-of-sale and end-of-life dates for the Cisco Aironet 1400 Series. The last day to order the affected product(s) is December 30, 2011. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.
Date: 2011-10-20 12:53:00.0

Cisco Security Advisory: Cisco Wireless LAN Controllers Denial of Service Vulnerability

DONT PING YOUR CISCO WLCs! LOL

Document ID: 112916

Advisory ID: cisco-sa-20110427-wlc

http://www.cisco.com/warp/public/707/cisco-sa-20110427-wlc.shtml

Revision 1.0

For Public Release 2011 April 27 1600 UTC (GMT)

---

Contents

Summary
Affected Products
Details
Vulnerability Scoring Details
Impact
Software Versions and Fixes
Workarounds
Obtaining Fixed Software
Exploitation and Public Announcements
Status of this Notice: FINAL
Distribution
Revision History
Cisco Security Procedures

---

Summary

The Cisco Wireless LAN Controller (WLC) product family is affected by a denial of service (DoS) vulnerability where an unauthenticated attacker could cause a device reload by sending a series of ICMP packets.

Cisco has released free software updates that address this vulnerability.

There are no available workarounds to mitigate this vulnerability.

This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20110427-wlc.shtml.

[Expand all sections]     [Collapse all sections]

Affected Products

Vulnerable Products

This vulnerability affects Cisco WLC software versions 6.0 and later. The following products are affected by the vulnerability described in this Security Advisory:

• Cisco 2100 Series Wireless LAN Controllers
• Cisco WLC526 Mobility Express Controller (AIR-WLC526-K9)
• Cisco NME-AIR-WLC Modules for Integrated Services Routers (ISRs)
• Cisco NM-AIR-WLC Modules for Integrated Services Routers (ISRs)

Note: The Cisco NM-AIR-WLC have reached End-of-Life and End-of-Software Maintenance. Please refer to the following document for more information:

http://www.cisco.com/en/US/prod/collateral/modules/ps2797/prod_end-of-life_notice0900aecd806aeb34.html



Cisco Wavelink (Avalanche) Bug:CSCtb45669 Code 1.3(3)

We are deploying thosands of Cisco 7925 handsets with Wavelink. After extensive testing I discovered that I could not get the phone to reboot after a profile push. I reached out to Wesley Terry (Cisco's Escalation Team) and BAM! He delivers for me ... Thanks Wesley !

792x is not reprovisioning after receiving Wavelink package

Symptom: 792x is not reprovisioning after receiving Wavelink package. If updating profile 1 or switching from profile 2, there is no provisioning trigger occurring, but the network profile config is updated. The phone stays connected with the previous network profile information even if not existing in the network profiles. Condition: Pushing a package to the 792x via Wavelink. Workaround: Power cycle the phone This is resolved in code 1.3(4)



Cisco WLC WLAN Summary Display Bug: CSCth52309 - 7.0.98.0

I was working with a colleague when I noticed the WLAN Summary Display on the WLC showed NO clients, when we knew there was indeed clients. In fact when you hit the client page there was over 100 clients on the controller.

After looking at another controller the WLAN Summary Display showed 30,000+ clients, again we knew this wasn't accurate. After speaking with a Cisco SE we discovered there is a bug in 7.0.98.0, "WLAN summary display defect causing wrong count to be displayed, defect number CSCth52309" 

This bug is fixed in 7.0.114.51 or greater.

As of this post this BUG was not in the bug tool kit. However it comes from a very reliable Cisco SE.

CISCO ACS 5.x RADIUS EAP-PEAP MS-CHAPv2 BUG WITH A “BIG BITE”: CSCth66302

If you are using Cisco ACS 5.1 or 5.2 and you use EAP-PEAP with MSCHAP v2 you should be aware of bug CSCth66302. It’s nasty and could impact your wireless network.

If you leverage EAP-PEAP MS-CHAPv2 in your environment and you are using Cisco ACS version 5.1 or 5.2 you need to be aware of this bug!

The bug we hit was CSCth66302 and it wasn’t pretty. As wireless clients attempted to authenticate the Cisco ACS responded with client failures, thus not authenticating the clients. When you looked at the ACS logs you would immediately see “Radius Authentication Request Rejected due to critical logging error”   in nice big red letters! When you looked at the WLC the logs showed all the EAP-PEAP clients failing authentication.

Interestingly enough, the Cisco WLC NEVER moved to the back up ACS, which was configured under the WLAN. Why? Because the local ACS sever (which was failing) still responded to the client via the WLC. As far as the WLC was concerned, the ACS responded and life was good!

 The Temporary Work Around from TAC

If you still get these messages the workaround is to restart ACS runtime service from the CLI:-

# acs stop runtime
# acs start runtime

Fix Coming in Release 5.3

Cisco TAC stated a fix will be released in ACS 5.3, which is yet to be released.

BUG Information 

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.2/release/notes/acs_52_rn.html  

CSCth66302

RADIUS authentication request rejected because of a critical logging error. Symptom: Running stress PEAP MS-CHAPV2 against primary ACS machine fails with the following error message: Radius Authentication Request Rejected due to critical logging error Conditions: This problem occurs when there is a large deployment setup with one primary connected to seven secondary machines. Workaround: None.

End-of-Sale and End-of-Life Announcement for the Cisco 3350 Mobility Services Engine

Title: End-of-Sale and End-of-Life Announcement for the Cisco 3350 Mobility Services Engine

Url: http://www.cisco.com/en/US/prod/collateral/wireless/ps9733/ps9742/end_of_life_notice_c51-643839.html

Description: Cisco announces the end-of-sale and end-of-life dates for the Cisco® 3350 Mobility Services Engine. The last day to order the affected product(s) is June 5, 2011. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.
Date: 2011-03-07 09:00:00.0

End-of-Sale and End-of-Life Announcement for the Cisco Catalyst 3750 Series Integrated Wireless LAN Controllers

Title: End-of-Sale and End-of-Life Announcement for the Cisco Catalyst 3750 Series Integrated Wireless LAN Controllers

Description: Cisco announces the end-of-sale and end-of life dates for the Cisco Catalyst 3750 Series Integrated Wireless LAN Controllers. The last day to order the affected product(s) is June 13, 2011. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin.

Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement. For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.
Date: 2010-12-13 09:00:00.0

http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps7185/ps6915/end_of_life_notice_c51-634675.html

End-of-Sale and End-of-Life Announcement for the Cisco 4400 Series Wireless LAN Controllers

Here is the official announcement from Cisco on the EOS / EOL of the Cisco 4400 controller

Title: End-of-Sale and End-of-Life Announcement for the Cisco 4400 Series Wireless LAN Controllers

Description: Cisco announces the end-of-sale and end-of life dates for the Cisco 4400 Series Wireless LAN Controllers.

The last day to order the affected product(s) is June 13, 2011. Customers with active service contracts will continue to receive support from the Cisco Technical Assistance Center (TAC) as shown in Table 1 of the EoL bulletin. Table 1 describes the end-of-life milestones, definitions, and dates for the affected product(s). Table 2 lists the product part numbers affected by this announcement.

For customers with active and paid service and support contracts, support will be available until the termination date of the contract, even if this date exceeds the Last Date of Support shown in Table 1.
Date: 2010-12-13 09:00:00.0

http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/ps6366/end_of_life_notice_c51-634665.html

Cisco WiSM Config Practice Opens SVI Vulnerability

Cisco’s recommend WiSM configuration practice will make you vulnerable – by George Stefanick

I was asked, “The WiSM Config Practice has been out for years, how did you find this ?” The devil is in the details.... 

WiSM Configuration Practice

The initial steps in configuring a Cisco WiSM is what I like to call a “configure-and-forget” step. This is because once the WiSM is configured and married to the backplane of the Sup720 via the “service port” its rare one would need to revisit this procedure again.

There are a number of Cisco WiSM Configuration guides available at cisco.com explaining this process. We will get into these in a bit… 

What is the WiSM “service port”?

First lets understand what the service port interface is and the purpose of the service port. The WiSM service port is one of many ports on a Cisco WiSM. They include the management, ap manager, virtual, service and the operator dynamic interfaces.

•  Management interface (pre-defined and mandatory)
•  AP-Manager interface (pre-defined and mandatory)
•  Virtual interface (pre-defined and mandatory)
•  Service-port interface (pre-defined and mandatory)
•  Operator-defined interface (user-defined)

Cisco’s 4400 and 5500 model controller’s service port is used for out-of-bandwidth management. The service port is a physical port supported on these models, whereby allowing you physical access with a console / null modem cable.

Contrary to the service port on the 4400 and  5500’s models. The WiSM service port is NOT used for out-of-bandwidth management. Rather it is used to synchronize the supervisor engine (720) and the WiSM. 

How does the “service port” on the Cisco WiSM connect to the Sup720?

Once the WiSM is installed, you enter the Sup720 and create a local vlan for the purpose of communications between both the WiSM and the Sup720.  Cisco references vlan 192 in their WiSM config documents, but of course any vlan number can be used. 

Cisco’s WiSM Configuration documentation goes a step further and states to create an SVI interface. An SVI interface is a gateway to bridge traffic. (Here in lies the problem. I will cover in more detail in the next section.)

(See below reference and links to Cisco WiSM configuration Guides, note the SVI interface recommendations and the lack of an ACL) 

The Vulnerability

The Cisco WiSM Configuration Guides detail the creation of an SVI interface for the purpose of the service port interface. For example;

Sup720(config)# interface Vlan 192
Sup720(config-if)# ip address 192.168.10.1 255.255.255.0
Sup720(config-if)# no shutdown
Sup720(config-if)# exit

The Cisco WiSM Guides makes no reference to an ACL which would restrict traffic access to the service port SVI interface. By creating the SVI interface you have a “connected route” from users who terminate to the 6500 to reach the SVI interface. This would include wired and wireless users. Essentially, inside users have access to the WiSM service port. This would also include wireless guest!

Lets follow the packet:

1)     Wireless client pings 192.168.10.1

2)     The packet egresses the wireless client and 802.11 headers are applied

3)     The packet travels via RF

4)     Packet reaches Access Point

5)     Access points encapsulates the packet in a LWAPP/CAPWAP headers

6)     The packet is then sent to the Cisco WiSM / Controller

7)     The WiSM removes the LWAPP/CAPWAP encapsulation and adds 802.3 headers

8)     The WiSM places the packet on the wired

9)     The packet transverses the router to the connected 192.168.10.1 SVI interface

I’m positive this is an oversight by Cisco. Recent conversations with Cisco SE’s, Cisco TAC and other peers agree this is an issue on many levels.

Engineers and Admins who configure the WiSM for the first time or perhaps engineers who have little knowledge would follow the Cisco WiSM Configuration Guide step by step. Not understanding that an ACL needs to be applied to the SVI interface for the WiSM service port. 

Real World Examples:

Lets cover why this is an issue with some real world examples:

Example#1 –

Your inside networks are 10.x.x.x and 172.x.x.x. Your service port on the WiSM is configured for 192.168.10.x network. Users who terminated to the cat / Sup 720 that houses the WiSM has access to the SVI interface 192.168.10.x. Why, because it is a connected route. The traffic will bridge over from 10 / 172  to the 192 network.

Example#2 –

Suppose you don’t have a Cisco WLC to anchor guest traffic. Your wireless guest traffic terminates to the  cat / Sup720 that houses the WiSM. Let suppose you ACL your "GUEST" SVI interface denying your known inside networks. You think you are done and call it a day.

DENY 10.0.0.0 (inside network)

But did you remember to deny 192.168.10.x? If you didn’t your wireless guest now have access to your service port

How to Fix it:

If you configured an SVI interface. Simply ACL the SVI not to allow ANY network access to this SVI interface.  

Conclusion:

I admit this isn’t a five-alarm hole. You don’t have to drop everything you are doing.  But it is one that needs to be addressed if you followed Cisco WiSM Configuration Guides.

Cisco links to WiSM Config

http://www.cisco.com/en/US/docs/wireless/technology/wism/technical/reference/appnote.html

! - Create a vlan in the Supervisor 720, this vlan is local to the chassis and is used for

communication between Cisco WiSM and Catalyst Supervisor 720 over a Gigabit interface on

the Supervisor and service-port in the Cisco WiSM. 

Sup720(config)# vlan 192 

! -- Assign an appropriate IP address and subnet mask for VLAN 192 

Sup720(config)# interface Vlan 192

Sup720(config-if)# ip address 192.168.10.1 255.255.255.0

Sup720(config-if)# no shutdown

Sup720(config-if)# exit

http://www.cisco.com/en/US/products/hw/modules/ps2706/products_tech_note09186a00808330a9.shtml

Create the WiSM Service Port Gateway and assign the IP address.

Create a VLAN in the Supervisor 720. This VLAN is local to the chassis and is used for communication between Cisco WiSM and Catalyst Supervisor 720 over a Gigabit Interface on the Supervisor and a service port in the Cisco WiSM.

interface Vlan192 

Description WiSM Service Port Gateway or Management Interface on CAT6K

ip address 192.168.10.1 255.255.255.0 

Cisco WCS SQL Injection Vulnerability: CSCtf37019

  

Cisco released a WCS vulnerability last week

Cisco WCS devices running software 6.0.x are affected by this vulnerability.

Note: Cisco WCS software release 7.0 is not affected by this vulnerability. Cisco WCS version 7.0.164.0 (which is the first 7.0 version) already contains the fix for this vulnerability. Cisco WCS software releases prior to 6.0 are not affected by this vulnerability.

The version of WCS software installed on a particular device can be found via the Cisco WCS HTTP management interface. Choose Help > About the Software to obtain the software version.

Cisco WCS enables an administrator to configure and monitor one or more WLCs and associated access points.

A SQL injection vulnerability exists in Cisco WCS. Exploitation could allow an authenticated attacker to modify system configuration; create, modify and delete users; or modify the configuration of wireless devices managed by WCS.

This vulnerability is documented in Cisco bug ID CSCtf37019 ( registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2010-2826.

Read more about this field notice: 

http://www.cisco.com/warp/public/707/cisco-sa-20100811-wcs.shtml

Cisco 6.0.199.0 - Reported Vocera Issues

  

Vocera is reporting connectivity issues on 6.0.199.0. They went as far as to release a Technical Advisory to customers. Its not clear what the issue is at the moment. 

The Vocera Advisory states:

Vocera is aware of an issue that customers are experiencing after moving to Cisco WLC version 6.0.199 that manifests itself in a substantial increase in difficulty with badge communications to the Vocera Application Server over the network. Badges will display "Searching For Server" or "Searching For AP."

Vocera is working closely with Cisco and its mutual customers on the problem.

Please consult with Vocera Technical Support and Cisco TAC before upgrading to 6.0.199.

Cisco 6.0.199.0 Controller Code Release - Potential MD / AW release

  

Cisco released a new rev in the 6.0 track, 6.0.199.0. Note: this has potential to be MD / AW tagged. Although, I will wait and see what fall out there is based on the previous releases in the 6.0. track.

Look at the resolved caveats. There are some BIG problems resolved with this reelase. 

Note:6.0 is a MD train and 6.0.199.0 is a potential MD / AW release. 6.0.199.0 release will be marked with MD / AW Tag after few weeks of customer adaptation and completion of AW release certification

Table 5 Resolved Caveats 

ID Number	Caveat Title
CSCtf63030	Radio get stuck when it is in the RESET or DOWN state.
CSCta91358	HREAP is locking up due to a wedge input queue on the radio interface.
CSCtb02136	AP1252 with AP groups and HREAP do not broadcast SSIDs.
CSCth05209	An OEAP configuration option needs to be removed in an unsupported platform.
CSCth02673	Errors occur when you apply the WLAN template with security as the WEP.
CSCtg93517	The wrong error message appeared while the H-REAP access point was added to a different H-Group.
CSCsx62302	REAP VLAN support mapping on an access point is lost when you upgrade from 4.2.176 to 6.0.182.
CSCtg93928	A traceback occurred on the mesh access point.
CSCsy90434	The controller command line displays that diversity was enabled for the 1522a radio.
CSCtg94715	Lock Assert dtlARPTask has caused the Cisco 5500 Series Controller to crash.
CSCtg74904	The Cisco 1142 Access Point stopped transmitting and receiving on its radio.
CSCth11525	A WLAN gets disabled after you add a new SSID to an existing access point group.
CSCsy93463	Debug the output through Telnet and SSH sessions.
CSCsy99905	RLDP constantly finds wired threats only when manually used.
CSCth09687	The controller GUI has a problem when configuring new ACL rules.
CSCsz19203	The controller crashes at SSHpmMainTask.
CSCsz37520	Noise was not factored in Channel Util calculations for AP1140.
CSCsz38828	AMAC radio core dumps: the transmitter has stopped working.
CSCsz40659	Need to reboot the wireless controller after an upgrade.
CSCsz42048	An inconsistency has occurred in the neighbor RSSI measurements.
CSCsz84895	An association response has the wrong set of supported rates for the 11b device.
CSCta04008	The call station type on the controller does not state that it is applicable to non-802.1X devices only.
CSCta13941	An access point is rejecting the association request with the status code 13.
CSCta34765	The controller console displays that invalid behavior occurred when you entered the config mirror port command.
CSCta41584	The backup port was not active when the primary port was disabled on the controller.
CSCta49375	The Cisco 4404 Controller crashes when you restart the sig11 at nPCSL_timer.
CSCta58642	LAP1252-P seems to have violated the maximum power levels in the regulatory domain.
CSCta71448	Reduce the severity of the error msg: %APF-1-CHANGE_ORPHAN_PKT_IP.
CSCtb20125	CCMP displays errors when the radio configuration is changed.
CSCtb34971	When the Controller WISM loads third-party certificates for web authentication, HTTPS port 443 is disabled.
CSCtb39368	The webauth custom page fails with some file extensions.
CSCtb39612	The WGA two device solution displays the "Cannot find MSCB for NPU SCB on console" message.
CSCtb42260	Enabling broadcast forwarding versus multicast forwarding through the controller CLI.
CSCtb44059	The controller should send the DHCP packets to the proper DHCP server.
CSCtb45178	Insufficient memory or a traceback occurred on AP1130 and AP1232.
CSCtb63297	A file read error message was reported in message log.
CSCtb69778	The output of the show log ip-port hash command was not correct in Telnet or SSH sessions. Instead, the output displayed results in the console window.
CSCtb92872	The WiSM with no access points crashed and the controller is unresponsive and you have to reset the hardware module to bring it up.
CSCtc01748	The Controller 2106 kernal panic crashed and hung while running combination stress test.
CSCtc13337	Even after the clients are associated to the controller, the message log displays an error saying no ACLS was defined on the controller.
CSCtc13378	The Cisco 5508 Controller crashed on the apfProbeThread.
CSCtc22661	An MFP anomaly was detected on deauthenticated frames.
CSCtc23210	MC2UC: Fragmentation has caused fewer clients to connect.
CSCtc23277	Radio driver is consuming all of the WLAN pool buffers.
CSCtc23789	The AP 1140 and 1250 radios were down and the interface was stuck in the reset state.
CSCtc29509	A predownload of the image has stopped after completing 18 out of the 230 access points on the controller.
CSCtc41797	RLDP does not work for G-only APs.
CSCtc44480	The access points were still transmitting ad-hoc deauths even after auto-contain was disabled.
CSCtc50424	The Cisco 5500 controller crashes and an error message "cond pbuf->dataLen <= 2048 failed" appears in the crashlog.
CSCtc51076	The "config spanningtree port mode off" settings are not saved in the backup configuration file.
CSCtc57611	Delay in Music on Hold on 7925 with HREAP AP.
CSCtc67372	On the controller with some access points, the SSH/Telnet session hangs with sh run output with paging disabled.
CSCtc73503	The radios are showing a Tx power level of 0.
CSCtc73527	Low latency MAC is not supported on the 802.11n APs.
CSCtc90985	The DMA input queue is overrun by fast Ethernet bursts.
CSCtc95434	An FTP transfer does not work on Cisco 2100 Controllers.
CSCtc97144	The 1800-seconds session that occurs after the session timeout has been fixed when H_REAP is in the standalone mode.
CSCtc97595	Only one of many gratuitous ARP packets is forwarded to the client.
CSCtd04572	Video metrics fixes and enhancements.
CSCtd06186	Directed broadcast does not work when IGMP snooping is enabled.
CSCtd21859	WLAN CKIP PSK is deleted when the Apply button is applied.
CSCtd23497	1242 AP HREAP Mode crashes after%CAPWAP-5-CHANGED the state to Join.
CSCtd26168	Incorrect source MAC address in the ARP request when the controller is in lag mode.
CSCtd26794	5508 DP was crashing and fragmentation consumes all pbufs.
CSCtd28542	The controller was crashing on EmWeb due to an access point configuration change.
CSCtd28757	The LDAP user password length needs to be increased.
CSCtd30669	WLAN security settings and session timeouts are changed after restoration.
CSCtd59231	The master bit configuration was not saved in xml.
CSCtd60522	The configuration backup adds the wrong 802.11a channel list.
CSCtd72649	The Cisco 4400 Controller crashes at osapi_task.c:3660.
CSCtd74472	The Cisco 5500 Controller crashes with the OSAPI reaper task and throws a null tunnel pointer exception.
CSCtd75089	The controller needs to have the "devshellsysapiDumpMbufStatus" command to show mbuf usage.
CSCtd75094	The access point crashed while clearing the CAPWAP MGIDs for the new client.
CSCtd86901	The mobility anchor configuration for WLAN is lost while copying the configuration through auto installation.
CSCtd92105	The controller reloads and the DHCP task reaper is reset.
CSCtd97011	When the AMAC radio core dump is observed, the neighbor discovery frames are stuck.
CSCtd99288	The client authentication trapflag cannot be configured through the CLI.
CSCtd99659	An SNMP agent inserts null data during the mesh link test.
CSCte08090	A TFTP upload fails while trying to upload a packet capture to the Windows TFTP server.
CSCte19262	The client is deauthenticated after the key exchange and displays an error message "Unable to locate AP 00:00:00:00:00:00".
CSCte27052	An inconsistency in the AAA Override feature occurred.
CSCte36493	The controller GUI displays a guest LAN error when the ingress is set to None on the anchor WLAN controller.
CSCte43508	5508 DP CRASH: buffer leaks due to ARP storm.
CSCte51177	The SNMP TRAP port number is not reflected in the configuration file of the controller.
CSCte55458	The web authentication page takes a long time to display under a heavy load.
CSCte62815	The Cisco 5508 Controller is not passing OSPF multicast traffic.
CSCte74879	The controller 5508 agentSwitchInfoPowerSupply MIB was not working.
CSCte76854	Unable to enable a WLAN on the Cisco 5508 Controller.
CSCte78472	An invalid PHY rate is returned on an ADDTS response.
CSCte79131	Containment details for the ad-hoc rogue is incorrect in the controller GUI.
CSCte79305	Auto containment for wired rogue access points does not contain wired rogues.
CSCte81420	When the access point crash was in process, the message "Dot11 driver" dot11_rate_is_allowed appears.
CSCte89891	The radio stops transmitting beacons periodically.
CSCte90918	WiSM locks-up during the upgrade with a full load of access points and clients.
CSCte92365	The auto immune attacks fix does not cover the incorrectly formatted association request.
CSCte95626	The Cisco 5508 Controller was not forwarding 100% of packets for the Gigabit line burst.
CSCte96140	Ethernet bridging breaks when the Ethernet interface of AP 1242 is flapped.
CSCtf03121	An optical SFP misconnect causes the Cisco 5508 Controller to disable its ports.
CSCtf03958	The WLAN Load Balance and Band Select should display Global Disabled as apply.
CSCtf06314	The WCS access point current associate client list is not up to date.
CSCtf06931	The controller emWeb crashes while running the ewaFormSubmit_blacklistclient_list.
CSCtf08553	The system log is not sent to the server that is on the same subnet as the dynamic interface.
CSCtf23682	An access point cannot join with the multicast MAC address as the gateway (checkpoint).
CSCtf27580	The Ethernet interface input queue wedge is from the broadcast/uniGRE traffic.
CSCtf28217	An access point unexpectedly joins the controller in bridge mode instead of local mode or H-REAP.
CSCtf33859	The client state is run with no IP address.
CSCtf34858	The client cannot transmit the traffic if it reassociates to an access point within 20 seconds.
CSCtf36051	The CPU ACL is not filtering after a reload.
CSCtf50921	Acct-Input-Octets counters do not reset for every accounting stop.
CSCtf53521	Directed broadcast does not work when the IGMP snooping is enabled.
CSCtf71637	The username entry in the accounting stop did not match the accounting start.
CSCtf94670	emWeb task crashed at usmWebGetSfpType.
CSCtf94679	The used memory increases by 25-MB immediately after bootup.
CSCtg10321	The Cisco 5500 controller crashes when all ports are disabled.
CSCtg34627	The video queue constrain limit allows only 9 to 10 clients of the 5-Mb stream.
CSCtg55102	AssocFailPayload causes a payload error at the controller.
CSCtg98413	There is a discrepancy between the help on the CLI and the actual code.
CSCth00490	The Dyn-int template with secondary port of 7 is getting applied while applying a dynamic interface.
CSCth02608	RRM RF group Leader Election did not occur.
CSCte55219	AMC radio core dumps with reason "transmitter seems to have stopped" due to a large number of uplink frames in the inprog queue.
CSCtf69598	There is a memory leakage in the access point upon a CCKM failure.
CSCtg71658	Access point level resets to 0 while upgrading from 5.0 to 6.0.
CSCtf65636	The access points that are crashed from the data TLB misses exception.
CSCth16398	Downloadable logs should include primaries.
CSCtd43906	RAP, which is a mesh access point, does not recover after the radar was detected.
CSCtf84965	CCKM roam fails with OEAP.
CSCtg89404	Association response to client is sent with AID 0.

Special 6.0.196.159 WLC Build Available From TAC

  

Cisco has released a new Engineer Special for the 6.x WLC code; 6.0.196.159

You will have to request this code from Cisco TAC as you will not find this on CCO. Cisco TAC stated 6.x release is tagged as software advisory. They are not recommending this code and if you have it installed you should apply the latest Engineer Special release until the 6.x maintenance release is released. The 6.x maintenance release is expected end of July / early August.

If you have 6.x running today Cisco TAC has advised the following path:

1)      Down grade to 5.2.193.0 (ED)

2)      Upgrade to 7.0.98.0 (ED)

3)      Upgrade to 6.0.196.159 (ES) 

AS_4200_6_0_196_159 is a build from 6.0.196.0, and it is an engineering special that resolves the following additional caveats:

CSCta13941 - AP rejecting association request with status code 13

CSCtb02136 - AP with AP Groups and HREAP will not broadcast SSID

CSCtb20125 - CCMP errors on key rotation

CSCtc73503 - Radios are showing Tx power level 0

CSCtd28542 - WLC crash on emWeb due to AP config change

CSCtd97011 - Radio core dump: Neighbor Discovery frames stuck

CSCte19262 - Client Deauthenticated – “Unable to locate AP 00:00:00:00:00:00”

CSCte55219 - radio core dump due to large # of uplink frames in inprog queue

CSCte55458 - Web-Auth: Web page takes a long time to display under heavy load

CSCte62815 - 5508 not passing OSPF Multicast traffic

CSCte78472 - Invalid PHY rate returned on ADDTS response

CSCte81420 - Crash in process: "Dot11 driver "

CSCte89891 - AP doesn't transmit beacons

CSCte92365 - Auto Immune - AP side

CSCte93549 - The dot11a radio not able to pass traffic, tx queue getting filled.

CSCte96140 - Ethernet bridging breaks when the Ethernet interface of AP 1242 flapped

CSCtf23682 - 5508 - AP cannot join with Multicast MAC as gateway (checkpoint)

CSCtf34858 - Clients unable to pass broadcast traffic

CSCtf69598 - Memory leak in AP on CCKM Failure

CSCtc57611 - Delay in Music on Hold on 7925 with HREAP AP CSCtg45014 - CT5508 - CAPWAP Control traffic has incorrect DSCP marking.

CSCtg71658 - Ap power level reset to 0 when upgrading from 5.0 to 6.0.196.158

CSCtd43906 - J: RAP not transmitting after coming up; when shut due to radar

*ENGINEERING SPECIAL USE DISCLAIMER*

The Engineering Special fix supplied herewith is a Temporary Software Module which has undergone limited testing. This temporary software module is provided “AS-IS” without warranty under the terms of the END USER LICENSE FOR THIS PRODUCT. Please use this software at your own risk. The intention for this code fix is for you to use in your production environment until a released version is available.

Bugs: CSCtf34858 - Severity 1 - catastrophic (WLC Code Levels: 6.0.182.0, 6.0.188.0, 6.0.196.0)

  

Catastrophic isn't my words, but Cisco's.  Engineer's beware ...

Client can't transmit traffic if it reassociates to an AP within 20 sec

Symptom: Intermittently, when a client reassociates to an access point (within 20 seconds after having roamed away from that same AP), the AP will fail to forward any data received from that client, to the wired network. Other clients can associate to that same SSID on the same AP and work fine. If the SSID is configured to use encryption, then, at the time the problem is occurring, decrypt failures will be seen, when the following debugs are enabled on the affected radio: ap#no debug dot11 dot11radio0 print printf ap#debug dot11 dot11radio0 trace print clients keys Workaround: Resetting the AP radio, or rebooting the AP, can cause the problem temporarily to go away. This problem is not seen in 5.2.193.0 or earlier code, nor does it affect autonomous IOS APs. Base Code: 6.0.182.0, 6.0.188.0, 6.0.196.0 Special Build: Following options are available: 1.     Move to 7.0.98.0 Release posted on CCO. Please note, 7.0 is a new feature release. 2.     Contact TAC to get a 6.0 Special or Beta release with fixes for the bugs below.  3.     Wait for the CCO release of 6.0 MR3 (Maintenance Release), which is planned for July/August 2010  The code is designed for 2100 / 4400 / 5500 / WiSM / WLC3750 / WLCM This Software Advisory Notice is issued against all the above Wireless LAN Controller software versions due to the following bugs:

Cisco 4.2.209.0 Controller Code Release

  

Cisco released a new rev for the controllers, 4.2.209.0. I'm not really surprised Cisco is still supporting 4.2. There are a number of large healthcare systems still on the 4.2 rev. 

Table 3 Resolved Caveats 

ID Number	Caveat Title
CSCtb31111	Memory Leak in EAP framework task
CSCsl22707	AP1250 Resets During Boot Using POE from 3550 Switch
CSCsm84048	AP1250 does not get 20 W power if switch is configure for trunk port
CSCso50723	WLC2106 EAP-FAST PAC provision failed due to slow DiffieHellman
CSCsq09933	Converted AP w/ static IP ignores DNS after downloading full image
CSCsv77658	AP reset from watchdog timer expired
CSCsw31160	Lobby Admin username can be used for webauthentication
CSCsx07150	Voice gap when phone roams, if CAC is not configured on APs
CSCsx50408	LWAP DOS Attack trap message does not record the source MAC address
CSCsx69535	AP on different subnet lost connetion with WLC
CSCsx70889	Crash due to stack corruption caused by recursive tunnels
CSCsx71175	WLC broadcast dhcp does not comply with RFC 1542
CSCsy06464	H-REAP AP obtains IP via DHCP on wrong interface
CSCsy06689	Memory leak on 3.2.210.0
CSCsy30722	Next hop address stored in capwap doesn't get updated on rcving GRAT ARP
CSCsy97077	WLC Controller 'show run-config' is truncated, not complete, incomplete
CSCsz03148	Talwar crashes @ EAP Framework
CSCsz14243	Unable to enable the WLAN while the APs are joining
CSCsz26858	WLC crash Task Name: dot11b (usmDbSnmpRrmProfileFailureTrapSend)
CSCsz32424	Rogue not detected on wire using the arp
CSCsz38828	AMAC radio core dumps: transmitter seems to have stopped
CSCsz48244	4.2 Mobility Control path flapping up/down
CSCsz48460	AP crashing on dot11_tx
CSCsz49863	WLC Local EAP auth periodically fails with 792x phone using EAP-FAST
CSCsz58995	Reaper reset crash on WLC with 1 monitor AP
CSCsz64049	WLC crash - nf_iterate causes kernel panic/exception
CSCsz72416	Unexpected vlan is assigned due to failed to aaa override
CSCsz76796	PMK cache isn't updated
CSCsz82548	Clients can communicate even though clients auth status is "No"
CSCsz88241	Per user bandwidth contracts stop functioning
CSCsz89606	AP unable to perform DNS based on given DHCP DNS options
CSCta09996	Sometimes LAP can't join to WLC via alternative port in port redundancy
CSCta13941	AP rejecting association request with status code 13
CSCta19001	AP1000 reboots continously when applying fix for CSCsl90630
CSCta29484	Radio stops beaconing for 10-second period
CSCta40160	Dropping primary discovery request from an AP already joined to the WLC
CSCta45156	Upgrade to 6.0.182.0 Webauth login page text views as one long sentence
CSCta93380	WLC on 4.2.205.0 drops bootp packet
CSCtb12031	1142 / 1252 inconsistently ACKs Vocera (gen1) badge
CSCtb29243	ARP storm on inter-controller NAC scenario for quarantined client
CSCtb34971	WLC WISM loading 3rd party cert for web-auth disables HTTPS port 443
CSCtb36010	Lightweight AP responds on port 22 when SSH is disabled
CSCtb52563	WLC 4.2.205.0 crashes at spam_CCM_decrypt+124
CSCtb58091	WLC CPU Spike with emWeb - Controller Not Responding - No crash
CSCtb64994	Intermittent Webadmin and Webauth access on WiSM running 5.2.193
CSCtb74239	WISM crashed on task sshpmMainTask System Crash
CSCtc03575	Controller fails to redirect web authentication to external server
CSCtc15346	AP1252 fails to retransmit missing AMPDU packet in response to block ack
CSCtc45090	Controller sends wrong mac in ARP response, can cause mobility flapping
CSCtc91431	ReadOnly local management user can change H-REAP VLAN mapping
CSCtc97595	Only one of many Gratitous ARP packets are forwarded to client
CSCtd01611	Important TLS/SSL security update
CSCtd16938	WLC crash after passing invalid arguments to emweb
CSCtd26408	WCS 4.2.110.0 cannot modify external web auth redirection URL for WLANs
CSCte40517	WLC2106 reboots at pemReceiveTask
CSCte55458	Web-Auth: Web page takes a long time to display under heavy load
CSCte89891	Radio may stop transmitting beacons periodically
CSCtf63030	Radio may get stuck in RESET or DOWN state

Special 7925/7921 (1.3.4.0.2) Build Available From TAC

  

Another special TAC release (1.3.4.0.2) this time for the Cisco 7921G and 7925G IP Phones. I'm told this release is a 'quick fix' for the battery issue discovered in release 1.3.4. 

Sources at TAC mentioned 1.3.5 could be out as early as end of May. Comments were also made that

 1.3.4.0.2, "has been through only basic testing to verify the power consumption issues"

Battery Life After Returning From Out of Range State

The Cisco Unified Wireless IP Phone may have a short battery life after returning from the out-of-range

state. The battery life can be two to four hours long if the IP phone travels out of range for up to three

to five seconds, and then returns in range of the configured network without rebooting the IP phone.

This may occur with IP phones using firmware release 1.3(4), but not with any earlier release. If your IP

phone experiences a short battery life after it has operated out-of-range for a few seconds, you can reboot the IP phone. The out-of-range alert may be enabled in Unified CM to provide a notification anytime the IP phone leaves the service area. For more information of the status of this operation, refer to CSCtf82507, using the Software Bug Toolkit.