Conventions	Conventions used in this document.
Feature Support in Cisco IOS Release 15.2(4)EA5	Lists all features supported in Release 15.2(4)EA5.
System Requirements	System requirements for Release 15.2(4)EA5.
Upgrading the Switch Software	Procedures for downloading software.
Limitations and Restrictions	Known limitations in this release.
Caveats	Open and resolved caveats in Release 15.2(4)EA5.
Documentation Updates	Updates to the IE switch product documentation.
Related Documentation	Links to the documentation for the hardware platforms associated with this release.
Obtain Documentation and Submit a Service Request	Link to information about Cisco documentation.

Conventions	Indication
bold font	Commands and keywords and user-entered text appear in bold font.
italic font	Document titles, new or emphasized terms, and arguments for which you supply values are in italic font.
[ ]	Elements in square brackets are optional.
{x | y | z }	Required alternative keywords are grouped in braces and separated by vertical bars.
[ x | y | z ]	Optional alternative keywords are grouped in brackets and separated by vertical bars.
string	A nonquoted set of characters. Do not use quotation marks around the string or the string will include the quotation marks.
courier font	Terminal sessions and information the system displays appear in courier font.
< >	Nonprinting characters such as passwords are in angle brackets.
[ ]	Default responses to system prompts are in square brackets.
!, #	An exclamation point (!) or a pound sign (#) at the beginning of a line of code indicates a comment line.

Table 1 New Feature Summary for Cisco IOS Release 15.2(4)EA1

Feature	Platform	Description	Related Documentation
NTP to PTP Translation (Time Services)	IE 5000	This time service enhancement allows the IE switches to act as Grandmaster clocks to the PTP hierarchy with NTP as the time source. The NTP time source ties the PTP working clock to the everyday “wall clock.” This allows the customer to use PTP and NTP generated timestamps together during troubleshooting and analysis. In addition, NTP is more cost effective and robust than GPS for applications that only need ~1 second precision for wide-area synchronization.	■ Precision Time Protocol Software Configuration Guide for IE 4000 and IE 5000 Switches ■Device Manager Online Help
Media Redundancy Protocol (MRP) and PROFINET Enhancements	IE 4000	MRP (Media Redundancy Protocol), an open standard industrial protocol, can support up to 50 nodes with maximum recovery time up to 200ms. MRP operates at the MAC layer and is commonly used in conjunction with the PROFINET standard for industrial networking in manufacturing. This release supports MRP manager and client and includes the following enhancements to PROFINET: ■PROFINET stack upgrade to version 2.31. ■PROFINET support for MRP Manager (MRM) and Client (MRC) functionality. PROFINET (PNIO) Certification with v2.3	■ Media Redundancy Protocol Configuration Guide for IE 2000 and IE 4000 Switches ■Device Manager Online Help
Hardware Watchdog Reset	IE 4000 IE 5000	The Hardware Watchdog Reset feature causes the switch to reload if IOS software is unresponsive for a certain period of time (5 minutes). The CPU Hardware Watchdog ensures that the switch reloads if software is hung for whatever reason.	Hardware Watchdog Reset
MACsec (IEEE 802.1AE)	IE 5000	MACsec is the IEEE 802.1AE standard for providing strong cryptographic protection at Layer 2. MACsec provides secure (encryption and authentication) MAC Service on a frame-by-frame basis. MACsec provides secure communications between stations that are attached to the same LAN. MACsec is only supported on 1G uplinks. Note You must have the IP Service license installed to support the MACsec feature.	Configuring MACsec Encryption
Express Setup enhancements with CIP support for IE Switches	IE 5000	This feature enhances Express Startup to limit manual switch intervention. There are three options for using Express Setup: ■You must configure a new in the box (NIB) switch that has no configuration file loaded (config.text / vlan.dat) directly via a console cable. ■You can configure the switch with the existing Express Setup method. The existing Express Setup behavior is enhanced to improve the failure LED indication behavior. ■You can have an IP address assigned to the switch without using Device Manager if you installed the switch in an already running environment with certain services available (DHCP).	■Device Manager Online Help ■Express Setup Enhancements ■For details on Express Setup documentation for all IE switches, see the Express Setup Program entry in Methods for Assigning IP Information
Locate Switch	IE 5000	When enabled, Locate Switch causes all possible LED to glow in ALT_RED and GREEN once the locate switch is enabled with a specific time. This performance varies from previous releases. (CSCux75707) The Locate Switch time setting has been changed from <9-255> to <0-255> time in seconds: 0: Stop Blink 9-255: Blink LED Enter the following show command to verify your settings: Switch# sh locate-switch Locate Switch enabled!! total time: 255 sec time left: 249 sec	■Device Manager Online Help
Device Manager (DM) Enhancements	IE 4000, IE 5000	■Ability to launch Device Manager in Express Setup medium press mode (as well as previously supported short press mode).	■Device Manager Online Help

Express Setup Requirements

This section summarizes the hardware and software requirements for the Windows platform.

For a listing of Express Setup documentation, see New Feature Summary for Cisco IOS Release 15.2(4)EA1.

Hardware

■1 gigahertz (GHz) or faster 32-bit (x86) or 64-bit (x64) processor

■1 gigabyte (GB) RAM (32-bit) or 2 GB RAM (64-bit)

■16 GB available hard disk space (32-bit) or 20 GB (64-bit)

Software

■PC with Windows 7, or Mac OS 10.6.x

■Web browser (Internet Explorer 9.0, 10.0, and 11.0, or Firefox 32) with JavaScript enabled

■Straight-through or crossover Category 5 or 6 cable

Express Setup verifies the browser version when starting a session, and it does not require a plug-in.

Finding the Software Version and Feature Set

The Cisco IOS image is stored as a bin file in a directory that is named with the Cisco IOS release. A subdirectory contains the files needed for web management. The image is stored on the compact flash memory card.

You can use the show version privileged EXEC command to see the software version that is running on your switch. The second line of the display shows the version.

You can also use the dir filesystem : privileged EXEC command to see the directory names of other software images stored in flash memory. For example, use the dir flash: command to display the images in the flash memory.

Deciding Which Files to Use

The upgrade procedures in these release notes describe how to perform the upgrade by using a combined tar file. This file contains the Cisco IOS image file and the files needed for the embedded device manager. You must use the combined tar file to upgrade the switch through Express Setup. To upgrade the switch through the command-line interface (CLI), use the tar file and the archive download-sw privileged EXEC command.

Cisco IOS Software Image Files lists the filenames for this software release.

 

Archiving Software Images

Before upgrading your switch software, make sure that you archive copies of both your current Cisco IOS release and the Cisco IOS release to which you are upgrading. Keep these archived images until you have upgraded all devices in the network to the new Cisco IOS image and verified that the new Cisco IOS image works properly in your network.

Cisco routinely removes old Cisco IOS versions from Cisco.com. See Product Bulletin 2863 for information:
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8802/ps6969/ps1835/prod_bulletin0900aecd80281c0e.html

You can copy the bin software image file on the flash memory to the appropriate TFTP directory on a host by using the copy flash: tftp: privileged EXEC command.

Note: Although you can copy any file on the flash memory to the TFTP server, it is time consuming to copy all of the HTML files in the tar file. We recommend that you download the tar file from Cisco.com and archive it on an internal host in your network.

You can also configure the switch as a TFTP server to copy files from one switch to another without using an external TFTP server by using the tftp-server global configuration command.

Upgrading a Switch by Using the CLI

This procedure is for copying the combined tar file to the switch. You copy the file to the switch from a TFTP server and extract the files. You can download an image file and replace or keep the current image.

Note: Make sure that the compact flash card is in the switch before downloading the software.

To download software, follow these steps:

1. Use Cisco IOS Software Image Files to identify the file that you want to download.

2. Download the software image file. If you have a SMARTNet support contract, go to this URL, and log in to download the appropriate files:

http://software.cisco.com/download/navigator.html

For example, to download the image for an IE 4000 switch, select Products > Switches > Industrial Ethernet Switches > Cisco Industrial Ethernet 4000 Series Switches, then select your switch model. Select IOS Software for Software Type, then select the image you want to download.

3. Copy the image to the appropriate TFTP directory on the workstation, and make sure that the TFTP server is properly configured.

For more information, see the “Assigning the Switch IP Address and Default Gateway” chapter in the applicable document for your switch as listed in Methods for Assigning IP Information.

4. Log into the switch through the console port or a Telnet session.

5. (Optional) Ensure that you have IP connectivity to the TFTP server by entering this privileged EXEC command:

For more information about assigning an IP address and default gateway to the switch, see Methods for Assigning IP Information.

6. Download the image file from the TFTP server to the switch.

If you are installing the same version of software that currently exists on the switch, overwrite the current image by entering this privileged EXEC command:

The command above untars/unzips the file.The system prompts you when it completes successfully.

–The /overwrite option overwrites the software image in flash memory with the downloaded one.

If you specify the command without the /overwrite option, the download algorithm verifies that the new image is not the same as the one on the switch Flash device. If the images are the same, the download does not occur. If the images are different, the old image is deleted, and the new one is downloaded. If there is not enough space to install the new image and keep the current running image, the download process stops, and an error message displays.

–The /reload option reloads the system after downloading the image unless the configuration has been changed and not saved.

–For // location, specify the IP address of the TFTP server. or hostname.

–For / directory / image-name .tar, specify the directory and the image to download. Directory and image names are case sensitive. The directory is for file organization and it is generally a tftpboot/user-ID path.

This example shows how to download an image from a TFTP server at 198.30.20.19 and to overwrite the image on the switch:

You can also download the image file from the TFTP server to the switch and keep the current image by replacing the /overwrite option with the /leave-old-sw option. If there is not enough space to install the new image and keep the current running image, the download process stops, and an error message displays.

Installation Notes

You can assign IP information to your switch using the methods shown in Methods for Assigning IP Information.

 

Open Caveats

■ CSCux94263

Symptom MRP licenses are not portable via SD card for IE 2000 and IE 4000.

Conditions An attempt to port an MRP license to a IE 4000 switch using a SD card did not work. Issue occurs during a device replacement. The MRP license stays on the replaced device and does not 'travel' with the SD flash to the replacement device.

Workaround Upgrade to 15.2(5)E1. Activate MRP Licenses again using command line interface. See the “Right to Use (RTU) Licenses” chapter in the Cisco Industrial Ethernet 4000 Series Switch Software Configuration Guide.

■ CSCuy41805

Symptom If the RX fiber is removed from the impacted IE switch when using a FE single mode optic, the remote switch will not be notified of the problem and the remote link will stay in an up state preventing fast network recovery.

Conditions Always will happen when using single mode FE optics when the RX strand is disconnected/broken when connected to an IE 4000 or IE 5000 switch.

Workaround No workaround to fix FEFI but impact could be lessened by using a higher level protocol to detect link failure such as BFD or by protocol timers.

■ CSCuz56456

Symptom Interface vlan in the range of 25 to 32 can disappear after reload on an IE 5000.

Conditions IE 5000 running 15.2(2)EB, 15.2(2)EB1 or 15.2(4)EA1 software.

Workaround Upgrade to 15.2(5)E1. Or, do not use interface VLANs in the range 25 to 32 on IE 5000.

■ CSCvc64429

Symptom Device Manager is not working in 15.2(5)E1 with an unsupported locale selected in browser. This symptom occurs when you select the language, locale as nl-nl, and then launch the Device Manager.

Conditions The browser language setting is other than German, Spanish (LatAm), French, Japanese, Simplified Chinese, Traditional Chines, and English.

Workaround Select en-us as locale in the browser, and restart the browser.

■ CSCvc68149

Symptom MRP: License request for feature mrp-manager 1.0 failed during bootup.

Conditions The following error messages appear on the console:

Workaround There is no work around if the MRP functionality is not required for the deployment. If MRP is required for deployment, the message will not be seen once the MRP license is activated on the device.

■ CSCvd25567

Symptom Inserting GLC-FE-T-I SFP puts FE ports of IE2000 unit in err-disable state.

Conditions Conditions The issue affects certain IE2000 SKU types on which the issue is always present. There are no pre-conditions.

Affected Cisco SKUs:

IE-2000-4TS-L (on uplinks)

IE-2000-4TS-B (on uplinks)

IE-2000-8TC-L (on uplinks)

IE-2000-8TC-B (on uplinks)

IE-2000-16TC-L (on both uplink and downlink)

IE-2000-16TC-B (on both uplink and downlink)

IE-2000-16TC-G-L (on downlink)

IE-2000-16TC-G-E (on downlink)

IE-2000-16TC-G-E-U (on downlink)

IE-2000-16TC-G-X (on downlink)

IE-2000-16TC-G-N (on downlink)

Workaround There is no workaround.

Resolved Caveats

■ CSCux66005

Cisco has released software updates that address this vulnerability. A workaround to mitigate this vulnerability is available.

The Security Advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160928-frag

Workaround This issue is resolved in Cisco IOS Release 15.2(4)EA5.

■ CSCuy76740

Symptom A vulnerability in processing of crafted ARP packets of Cisco CGS-2520 switches could allow an unauthenticated, adjacent attacker to cause high CPU condition on the affected device that may eventually cause loss of BPDU frames and thus turn the device into a STP root.

The vulnerability is due to insufficient logic in processing of certain crafted ARP packets, causing them to be handled by the CPU. An attacker could exploit this vulnerability by sending a flood of crafted ARP packets to be processed by an affected device. An exploit could allow the attacker to cause high CPU condition on the affected device that may eventually cause loss of BPDU frames and thus turn the device into a STP root.

Conditions When invalid ARP packet with all zero destination mac address in it.

Further Problem Description:

PSIRT Evaluation:

The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 2.9/2.8:

http://tools.cisco.com/security/center/cvssCalculator.x?vector=AV:A/AC:M/Au:N/C:N/I:N/A:P/E:F/RL:U/RC:C&version=2.0

No CVE ID has been assigned to this issue.

Additional information on Cisco's security vulnerability policy can be found at the following URL:

http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html

Workaround This issue is resolved in Cisco IOS Release 15.2(4)EA5.

■ CSCuz48728

Symptom Encountered crash on IE-4000-4T4P4G-E running 15.2(4)EA or EA1 if the IE-4000-4T4P4G-E is uplinked to cat2k (in this case) via port-channel and then user connects downlink fa1/5.

Conditions IE-4000-4T4P4G-E running 15.2(4)EA or EA1, uplink port-channel and connected, then connect to fa1/5 = crash

Workaround This issue is resolved in Cisco IOS Release 15.2(4)EA5.

■ CSCuz56319

Symptom Powered devices (PDs) do not reliably auto backup if power inline auto max is 15400.

Conditions Issue seen on IE3k w/ IEM-3000-4PC, 15.0(2)EY3, class 3 & 4 PDs.

Workaround This issue is resolved in Cisco IOS Release 15.2(4)EA5.

■ CSCuz81292

The Security Advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160525-ipv6

Workaround This issue is resolved in Cisco IOS Release 15.2(4)EA5.

■ CSCva44428

Symptom IE 5000 is currently throwing ALERT-2-HARDWARE_THERMAL_ERROR error & reporting SYSTEM TEMPERATURE IS FAULTY when reaching 70 degrees C.

#sh env all

SYSTEM TEMPERATURE is FAULTY

System Temperature Value: 70 Degree Celsius

Conditions Issue is seen on the IE 5000 when System Temperature Value is 70 Degree Celsius or above.

Workaround This issue is resolved in Cisco IOS Release 15.2(4)EA5.

■ CSCva68230

Symptom POE stopped working and Powered Devices (PDs) dropped and did not re-connect once the 48VDC input recovered, the 24VDC remained the primary PSU and POE remained down.

Conditions IE-4000-4GC4GP4G-E w/ 2 PSU's = 24VDC + 48VDC & providing POE to 2 AIR-CAP2702I-E-K9

Expected behavior = for 48VDC to act as the primary PSU per IE4K Cisco Documentation (the Switch will select the highest input voltage as the primary source)

This was the case until the 48VDC input source faced a couple of seconds interruption, which resulted in the 24VDC PSU taking over as the primary PSU (OK/good, as expected).

Workaround This issue is resolved in Cisco IOS Release 15.2(4)EA5.

■ CSCva96583

Symptom Changes to remove PRP packet duplication weakness introduced delay/jitter

Conditions PRP duplication failure to remove percentage is reaching 100 percent when introduced delay is 3 ms for two flows, also PRP duplication failure to remove percentage is 32.9 percent when introduced jitter is 3 ms even for single flow.

Workaround This issue is resolved in Cisco IOS Release 15.2(4)EA5.

■ CSCvb16274

Symptom A vulnerability in the Point-to-Point Tunneling Protocol (PPTP) server feature on Cisco IOS Software could allow an unauthenticated, remote attacker to obtain data from a previously used packet buffer.

The vulnerability is due to the reuse of a previously used packet buffer without clearing the memory contents. An attacker could exploit this vulnerability by starting a PPTP connection request towards a Cisco IOS device configured for PPTP server functionality. An exploit could allow the attacker to obtain up to 63 bytes of memory previously used for a packet either destined TO the device or generated by the device. It would not allow an attacker to access packet data from transit traffic. It would not allow an attacker to access memory locations of the attacker's choosing.

Conditions A Cisco IOS device configured as a PPTP server. The PPTP server functionality is NOT enabled by default on any Cisco IOS release.

Workaround Configuring a 64-character local name on any VPDN group enabled for PPTP will prevent any memory contents from being leaked. The local name has to be exactly 64 characters in length. The following example shows a local name comprised of 64 hash marks:

vpdn-group 1

accept-dialin

protocol pptp

virtual-template 1

<b>local name ################################################################</b>

Additional information on the “local name” VPDN command can be found at the following URL:

http://www.cisco.com/c/en/us/td/docs/ios/vpdn/command/reference/vpd_book/vpd_l1.html#wp1045807

Further Problem Description:

PSIRT Evaluation:

The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 5/4.5:

http://tools.cisco.com/security/center/cvssCalculator.x?vector=AV:N/AC:L/Au:N/C:P/I:N/A:N/E:F/RL:W/RC:C&version=2.0

Additional information on Cisco's security vulnerability policy can be found at the following URL:

http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html

Workaround This issue is resolved in Cisco IOS Release 15.2(4)EA5.

■ CSCvb54977

Symptom Third party PRP RedBox devices when connected to an IE-2000U running IOS 15.0(2)EK1 in Redbox configuration may suffer loss of traffic. FPGA fix that makes the default forget time 400ms, changes duplicate send algorithm (Perris FPGA Release 3.0A).

No software changes (forget time not configurable via test command).

Conditions The behavior is seen with a third party PRP driver software/hardware as remote side Redbox connecting the two LANs.

Further Problem Description:

Different vendor's PRP implementations may differ in behavior with respect to specific timers controlling Duplicate Discard Algorithm.

When duplicating traffic for a particular destination mac, Cisco implementation clears the mac entry and the associated sequence number after 30ms on 1Gbps links. If traffic is sent with more than 30ms inter-packet gap, this will result in resetting sequence numbers so that each packet has sequence number 1. On the receiving side, if the discard algorithm forget time is > 30ms, the receiver will identify these packets as duplicate and discard them. Hirshmann RSP35 timer appears to be 400ms thus any packet stream with 30ms < inter-packet gap < 400ms will experience loss. Streams with < 30ms OR > 400ms will not.

Workaround This issue is resolved in Cisco IOS Release 15.2(4)EA5.

■ CSCuz86976

Symptom REP functionality is broken on IE 5000 1G Uplink ports.

Conditions When any of the IE 5000 1G uplink ports are part of REP ring, it does not work. Whereas, it works fine on IE 5000 downlink ports as well as IE 5000 10G uplink ports. REP functionality issues are only seen on IE 5000 1G Uplink ports.

Workaround Ensure IE 5000 1G uplink ports are not part of REP nodes to ensure proper REP functionality.

■ CSCvc32200

Symptom When we run the command show usb device, it causes the Cisco Industrial Ethernet Series Switches (IE2K, IE3K, IE4K, IE5K) to crash.

Conditions Running show usb device.

Workaround This issue is resolved in Cisco IOS Release 15.2(4)EA5.

Accessing Bug Search Tool

You can use the Bug Search Tool to find information about caveats for this release, including a description of the problems and available workarounds. The Bug Search Tool lists both open and resolved caveats.

To access Bug Search Tool, you need the following items:

■Internet connection

■Web browser

■Cisco.com user ID and password

To access the Bug Search Tool, enter the following URL:

https://tools.cisco.com/bugsearch/search

To access the Bug Search Tool to search on a specific caveat, enter the following URL:

https://tools.cisco.com/bugsearch/search/<BUGID>

Enabling Logging Alarms for Syslog Messages

The following information is relevant to all IE Switches software releases from Release 12.2(58)SE onward (CSCvg26502).

On IE switches, there is an option to configure temperature alarm levels as noted in the “ Configuring the Switch Alarms: Associating the Temperature Alarms to a Relay ” section within IE Switch Software Configuration Guides.

However, configured alarms do not generate any syslogs until you set Major alarm logging alarm 2 and Minor alarm l ogging alarm 3 for temperature threshold alarms.

IMPORTANT: The logging alarm must be enabled to generate syslog messages.

Hardware Watchdog Reset

The expected behavior on the switch when there is an IOS software problem is for the switch to crash, save the information that helps software engineers debug the crash, and then reload. However, there can be rare occurrences of the switch hanging without crashing. Hangs are very hard to reproduce and even harder to fix because there is no trace of what caused the hang. Following are some of the symptoms when the switch hangs:

■Switch becomes totally unresponsive to the CLI

■Traffic forwarding stops

■LEDs stop blinking

■Switch does not save any crash information

■Switch does not reload

The switch not reloading is a very serious issue, especially for IoT deployments in remote and sometimes hard to reach locations where sending personnel to reload the box is expensive, time consuming, and leads to the system being rendered unusable for that time.

The Hardware Watchdog Reset feature causes the switch to reload if IOS software is unresponsive for a certain period of time (5 minutes). The CPU Hardware Watchdog ensures that the switch reloads if software is hung for whatever reason.

Configuring Hardware Watchdog Reset

This feature is enabled by default. The following CLI command disables and re-enables this feature:

This command requires a reboot to take effect.

The scheduler process-watchdog (software) remains in effect even after this feature is disabled.

Express Setup Enhancements

Express Setup has three options to meet the needs of different installer roles. You select an option based on how long you press the Express Setup button.

■Short press mode—You want to use the existing Express Setup method.

The existing Express Setup behavior has improved failure LED indication.

■Medium press mode—You are installing a switch into an already running environment with certain services available (DHCP) or you want to have the device receive an IP address without using Device Manager.

■Long press mode—You are confident and knowledgeable in the use of Cisco IOS CLI and can configure the switch directly using a console cable.

Express Setup Modes summarizes Express Setup for each mode.

 

Locate Switch

You can configure Locate Switch using CLI and the Device Manager.

When enabled, Locate Switch causes all possible LEDs to glow ALT_RED and GREEN (LEDs that are in one color blink) once the switch is enabled with a specific time. This performance varies from previous releases (CSCux75707).

The Locate Switch time setting has been changed from <9-255> to <0-255> time in seconds:

Enter the following show command to verify your settings:

The locate-switch command is a volatile command and will not be saved or displayed in running or startup configuration.

Table 5 Related Documentation

Device or Feature	Related Documents
Cisco Industrial Ethernet 4000 Series Switches	http://www.cisco.com/go/ie4000
Cisco Industrial Ethernet 5000 Series Switches	http://www.cisco.com/go/ie5000

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)

No combinations are authorized or intended under this document.

© 2016-2018 Cisco Systems, Inc. All rights reserved.