This product bulletin contains content and delivery information for Cisco IOS® Software Release 15.0(2)SE.
There are no new memory requirements to upgrade from Release 15.0(1)SE to Release 15.0(2)SE, and the same software update policy is applicable for Cisco® Catalyst® 2K and 3K products as at http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps4324/product_bulletin_c25-696974_ps10745_Products_Bulletin.html.
Note that the following models (which have reached end of sale) are no longer supported in this release, Release 15.0(1)SE, and Release 12.2(58)SE1: WS-C3550-24-DC-SMI, WS-C3560-24TS, WS-C3560-24PS, WS C3560-48PS, WS-C3560-48TS, WS-C3750-24PS, WS-C3750-24TS, WS-C3750-48PS, WS-C3750-48TS, WS-C3750G-24TS, and WS-C3750G-16TD. The Cisco Catalyst 2350 Series has also reached end of sale and is no longer supported in this release. Moreover, the following models and series are no longer supported in this release: Cisco Catalyst 2975, WS-C3750G-24T (16 MB flash), and WS-C3750G-12S (16 MB flash). For ongoing maintenance rebuilds for these products, refer to Cisco IOS Software Release 12.2(55)SE.
Cisco IOS Software Release 15.0(2)SE is the base releases for new extended maintenance trains delivering leading borderless network services in campus access. Release 15.0(2)SE is an extension of the Cisco IOS Software Release 15.0(1)SE code base and thus inherits all the features from Release 15.0(1)SE and adds support for new services in Cisco TrustSec® technology, IPv6, and Cisco EnergyWise™ areas. For train continuity and release migration information, see the “Software Image Migration Guide” section later in this bulletin.
SGT/SGACL: This release enhances Cisco TrustSec technology on Cisco Catalyst 3750-X and 3650-X Series Switches with advanced features geared to improve deployment of the overall Cisco TrustSec solution. Cisco TrustSec uses a combination of Source Security Group Tag (SGT) and Destination Group Tag (DGT).[1]
With Cisco IOS Software Release 15.0(2)SE, the following features are available to get the SGT and DGT of a packet:
● Cisco TrustSec VLAN to SGT mapping: Look up the source SGT based on the source VLAN. This makes sure of compatibility with VLAN segmented environments and to deploy SGT with equipment (wireless controllers, access points, and legacy switches) that is not capable of SGT tagging but is VLAN capable.
● IP address to SGT mapping: As with the VLAN-SGT mapping, IP addresses to SGT mapping (with appropriate SGACL enforcement) can be accomplished. It is relevant for resources with static IP addresses, which can be mapped to an SGT group without requiring 802.1X authentication or MAC Authentication Bypass (MAB).
● Port to SGT mapping: This feature allows you to statically map all traffic from a particular port to be tagged with a certain SGT. Note that only SGT on port-to-SGT mapping is supported in this release. The port-to-SGT mapping-based SGACL does not get applied based on this configuration for egress traffic on the port.
● Configurable username and password for MAB: This feature allows the user to configure the format of the MAC address used in the username and password fields in the RADIUS Access-Request packet for MAB authentication. This allows easy interoperability with RADIUS servers or MAC databases, which expect the MAC address in a different format than provided by the switch as default.
● Cisco SGT Exchange Protocol (SXP) support on Cisco Catalyst 2960S Series Switches: SXP is used to propagate SGTs across network devices that do not have hardware support for Cisco TrustSec. With Cisco IOS Software Release 15.0(2)SE, SXP will be supported on 2960S in LAN Base feature set. Starting with 15.0(2)SE, support for SXP on 3560-X and 3750-X is extended from IP Base to LAN Base feature set.
IPv6
IPv6 First Hop Security: With enterprises moving to larger Layer 2 domains and IPv4 addresses running out, IPv6 has been gaining momentum. Cisco has been providing integrated security features for L2 networks. A similar set of characteristics has now been added to address similar characteristics of the IPv6 protocol.
The 15.0(2)SE software release provides a combination of snoop and guard IPv6 First Hop Security features on Cisco Catalyst 2K and 3K switches* where the switch can inspect (snoop) ND traffic and block (guard) undesired traffic. The following set of IPv6 features are included:
● Block rogue advertisements from illegitimate routers and Dynamic Host Configuration Protocol (DHCP) servers with RA Guard and DHCPV6 Guard
● Monitor device address assignment with Binding Integrity Guard
● Maintain a trustworthy database of IPv6 devices and block illegitimate IPv6 data traffic with Source Guard
*Note: Not all features are supported by all devices. For more information on IPv6 First Hop security, refer to the Cisco IOS Software configuration guide.
● IPv6 multicast routing: Traditional IP communication allows a host to send packets to a single host (unicast transmission) or to all hosts (broadcast transmission). IPv6 multicast provides a third scheme, allowing a host to send a single data stream to a subset of all hosts (group transmission) simultaneously.
The following IPv6 enhancement features are also included in this release:
● IPv6 quality of service (QoS) on 2960-S and IPv6 QoS trust on 2960 series switches
● IKEv2, IPSecv3
● OSPFv3 Fast Convergence
● OSPFv3 Authentication
● Support for a maximum of 16 IPv6 static routes in LAN Base products
● Port-based ACL, allowing the definition of ACLs on defined Layer 2 ports
● Router ACL on SVI
Green
Cisco EnergyWise
Cisco EnergyWise is an energy management protocol based on Cisco IOS Software for monitoring, controlling and reporting the energy use of information technology (IT) and facilities equipment.
15.0(2)SE introduces Cisco EnergyWise 2.8 with the following software features:
● Cisco EnergyWise 2.8 allows PCs to be woken up without specifying the MAC address in the configuration. A level-10 Cisco EnergyWise query wakes up the PC. Also refer to http://www.cisco.com/en/US/docs/switches/lan/energywise/version2_8/ios/release/notes/ol23554.html#wp68072.
● Cisco EnergyWise SNMP Translator: Some IT devices such as printers might not support Cisco EnergyWise. Cisco EnergyWise SNMP Translator helps management of devices that do not run the Cisco EnergyWise agent natively as long as they are able to export their power information using SNMP MIBs. This is accomplished using an XML-based translator file.
● Cisco Compact 3560 and 2960 PD PSE switches are now Cisco EnergyWise supported (refer to Table 5).
Cisco Universal Power Over Ethernet™ (Cisco UPOE™) input on Cisco Catalyst 2960C and 3560C Series Switches: Cisco UPOE simplifies network infrastructures and delivers lower total cost of ownership for connected environments such as virtual desktop infrastructure (VDI), financial trading floor, enterprise workspace, conference rooms, hospitality guest suites, and retail.
Starting with Cisco IOS Software Release 15.0(2)SE, PoE powered compact switches can be powered by one (60W) Cisco UPOE uplink. The second uplink can be used for PoE redundancy for high-availability applications.
The following SKUs can be powered by Cisco UPOE:
● 2960CPD-8TT-L
● 2960CPD-8PT-L
● 3560CPD-8PT-S
Of these, 2960CPD-8PT-L and 3560CPD-8PT-S can provide PoE power to downstream PoE devices such as APs, phones, and cameras as well. When powering using Cisco UPOE uplinks, there is a 7.4W increase in PoE power budget compared to 2 PoE+ uplinks; see Table 1 for details.
Table 1. Compact Switches Power Budget
Model
|
C3560CPD-8PT-S
|
2960CPD-8PT-L
|
Available PoE power (2 x PoE+ uplinks)
|
Up to 15.4W
|
Up to 22.4W
|
Available PoE power (1 x Cisco UPOE uplink)
|
Up to 22.8W
|
Up to 30.8W
|
Cisco StackPower: Extending support for Cisco StackPower™: feature from IP Base to LAN Base feature set on Cisco Catalyst 3750-X.
Security Enhancements
● Support of PortSec on EtherChannels: Access switches uses port security with dynamically learned and static MAC addresses to restrict a port’s ingress traffic by limiting the MAC addresses that are allowed to send traffic into the port. This feature, once restricted to physical interfaces, from this release onward will be available on port-channel interfaces.
● Support of IP Source Guard on EtherChannels: IP Source Guard provides source IP address filtering on a Layer 2 port to prevent a malicious host from impersonating a legitimate host by assuming the legitimate host’s IP address. This feature, once restricted to physical interfaces, from this release onward will be available on port-channel interfaces.
Important Features
● Resilient Ethernet Protocol (REP): REP is a Cisco proprietary protocol that provides an alternative to Spanning Tree Protocol to control network loops, handle link failures, and improve convergence time. REP controls a group of ports connected in a segment, makes sure that the segment does not create any bridging loops, and responds to link failures within the segment. REP provides a basis for constructing more complex networks and supports VLAN load balancing.
● Smart install VLAN enhancements: The new capability allows the Smart Install Director to signal the management VLAN ID to the Smart Install clients using a new CDP TLV. This allows Smart Install to manage clients on a VLAN other than VLAN 1.
● Cisco SFP-10G-ER: Cisco SFP-10G-ER optics will be supported on 3750-X and 3560-X uplinks other than on 3750-E and 3560-E X2 ports equipped with Cisco OneX Converter module CVR-X2-SFP.
Product Support for New Features and Enhancements
Table 2 summarizes product support for new features of Cisco IOS Software Release 15.0(2)SE for the Cisco Catalyst 3750-X, 3750-E, 3560-X, and 3560-E Series Switches.
Table 2. New Features in Cisco IOS Software Release 15.0(2)SE for Cisco Catalyst 3750-X, 3750-E, 3560-X, and 3560-E Series Switches
IPv6 Multicast Routing
|
No
|
No
|
No
|
Yes
|
Yes
|
No
|
No
|
No
|
Yes
|
Yes
|
16 static IPv6 routes in LAN Base
|
Yes
|
-
|
-
|
-
|
-
|
Yes
|
-
|
-
|
-
|
-
|
IPv6 QoS support
IKEv2/IPSecv3
OSPFv3 Fast
Convergence/Authentication
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
16 static IPv6 routes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
V6 PortACL and IPv6 ACL on SVI
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
REP
|
No
|
Yes
|
Yes
|
Yes
|
Yes
|
No
|
Yes
|
Yes
|
Yes
|
Yes
|
No
|
Yes
|
No
|
Yes
|
No
|
No
|
Yes
|
No
|
Yes
|
No
| |
Configurable username and password for MAB
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Security enhancements
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
SmartInstall VLAN enhancement
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Cisco EnergyWise
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Table 3 summarizes product support for new features of Cisco IOS Software Release 15.0(2)SE for the Cisco Catalyst 3750G and 3560G Series and Cisco Catalyst 3750V2 and 3560V2 switches.
Table 3. New Features in Cisco IOS Software Release 15.0(2)SE for Cisco Catalyst 3750G and 3560G Series and Cisco Catalyst 3750V2 and 3560V2 Switches
IPv6 First Hop Security
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
IPv6 Multicast Routing
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
IPv6 QoS support
IKEv2/IPSecv3
OSPFv3 Fast
Convergence/Authentication
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
16 static IPv6 routes
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
V6 PortACL and IPv6 ACL on SVI
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
REP
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
No
|
No
| ||
Security enhancements
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Smart Install VLAN enhancement
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Cisco EnergyWise
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Yes
|
Table 4 summarizes product support for new features of Cisco IOS Software Release 15.0(2)SE for the Cisco Catalyst 2960 and 2960-S Series.
Table 4. New Features in Cisco IOS Software Release 15.0(2)SE for Cisco Catalyst 2960 and 2960-S Series
IPv6 QoS
|
No
|
No
|
Yes
|
No
|
IPv6 First Hop Security
|
No
|
No
|
RA Guard,
Binding Integrity Guard DHCPv6 Guard |
No
|
IPv6 QoS support
|
Yes (QoS Trust)
|
No
|
Yes
|
No
|
IPv6 enhancement features
|
No
|
No
|
No
|
No
|
16 static IPv6 routes in
|
Yes
|
No
|
Yes
|
No
|
V6 PACL and IPv6 ACL on SVI
|
No
|
No
|
Yes
|
No
|
Configurable username and password for MAB
|
Yes
|
Yes
|
Yes
|
No
|
SGT/SGACL
|
No
|
No
|
Yes
|
No
|
Smart Install VLAN enhancement
|
Yes
|
Yes
|
Yes
|
Yes
|
Cisco EnergyWise
|
Yes
|
Yes
|
Yes
|
Yes
|
Table 5 summarizes product support for new features of Cisco IOS Software Release 15.0(2)SE for the Cisco Catalyst 2960-C and 3560-C Series. The compact switches inherit all the features from Release 15.0(1)SE.
Table 5. New Features in Cisco IOS Software Release 15.0(2)SE for Cisco Catalyst 2960-C and 3560-C Series
Feature
|
Cisco Catalyst 2960-C Series LAN Lite Feature Set
|
Cisco Catalyst 2960-C Series LAN Base Feature Set
|
Cisco Catalyst 3560-C Series IP Base Feature Set
|
IPv6 QoS
|
-
|
-
|
WS-C3560C-8PC-S
WS-C3560C-12PC-S
|
IPv6 First Hop Security
|
-
|
RA Guard,
Binding Integrity Guard
DHCPv6 Guard
(Only supported in GE models)
|
RA Guard,
Binding Integrity Guard
DHCPv6 Guard
(Only supported in GE models)
|
OSPFv3 Fast Convergence/Authentication
|
-
|
-
|
All models
|
IKEv2/IPSecv3
|
-
|
-
|
All models
|
16 static IPv6 routes in LAN Base
|
-
|
All models
|
-
|
V6 PortACL and IPv6 ACL on SVI
|
-
|
WS-C2960CG-8TC-L
|
All models
|
Security enhancements
|
-
|
All models
|
All models
|
Powered by Cisco UPOE
|
-
|
WS-C2960CPD-8PT-L, 2960CPD-8TT-L
|
WS-C3560CPD-8PT-S
|
Smart Install VLAN enhancements
|
All models
|
All models
|
All models
|
Configurable username and password for MAB
|
All models
|
All models
|
All models
|
MACSec on uplinks
|
-
|
-
|
Only supported on GE models
|
Cisco EnergyWise
|
All models
|
All models
|
All models
|
Part Numbers for Supported Products
Table 6. Part Numbers for Cisco Catalyst Switches Software Licenses Supported by Cisco IOS Software Release 15.0(2)SE
Cisco Catalyst 3560-C Series IP Services Part Numbers
|
Cisco Catalyst 2960-C Series IP Services Part Numbers
| ||||
WS-C3560CG-8TC-S
WS-C3560CG-8PC-S
WS-C3560CPD-8PT-S
WS-C3560C-8PC-S
WS-C3560C-12PC-S
|
WS-C2960CPD-8TT-L
WS-C2960CPD-8PT-L
WS-C2960CG-8TC-L
WS-C2960C-8TC-L
WS-C2960C-8TC-S
WS-C2960C-8PC-L
WS-C2960C-12PC-L
| ||||
Additional Resources
● Cisco IOS Software upgrade planner: http://www.cisco.com/pcgi-bin/Software/Iosplanner/Planner-tool/iosplanner.cgi?majorRel=
You must purchase the IP Services (formerly called EMI) software upgrade kit when upgrading a switch from IP Base (formerly called SMI) to IP Services software. Downloads of IP Base and IP Services files are monitored for adherence to this requirement. The Cisco Catalyst 3750-X, 3560-X, 3750-E, and 3560-E Series Switches support the new Cisco IOS Software licensing infrastructure, which authorizes and enables the use of the existing Cisco IOS Software feature sets. A special file contained in the switch’s flash memory, called a license file, is examined by Cisco IOS Software when the switch is powered on. On the basis of the license type, Cisco IOS Software enables the appropriate Cisco IOS Software feature set (for more information on packaging and licensing, refer tohttp://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps6406/white_paper_c11-579326_ps10745_Products_White_Paper.html).
Note that the Advanced IP Services license has reached end-of-life status since Cisco IOS Software Release 12.2(50)SE. Because of export restrictions on strong cryptography software, a separate image is required for the cryptographic features (Secure Shell [SSH] Protocol, Simple Network Management Protocol Version 3 [SNMPv3], and Kerberos Protocol). These software images can be downloaded from the corresponding Triple Data Encryption Standard (3DES) area of the links provided in this section.
Cisco IOS Software Release 15.0(2)SE follows the standard Cisco support policy. For more information, visit http://www.cisco.com/en/US/products/products_end-of-life_policy.html.
Reference Links
沒有留言:
張貼留言