There are no new features in this release. This release provides a fix for CSCwh87343: Cisco IOS XE Software Web UI Privilege Escalation Vulnerability. For more information, see Security Advisory: cisco-sa-iosxe-webui-privesc-j22SaA4z.

• Cisco StackWise Virtual - Supported and Unsupported Features

• Unsupported Features

• Complete List of Supported Features

• Accessing Hidden Commands

• Default Behaviour

Accessing Hidden Commands

Starting with Cisco IOS XE Fuji 16.8.1a, as an improved security measure, the way in which hidden commands can be accessed has changed.

Hidden commands have always been present in Cisco IOS XE, but were not equipped with CLI help. That is, entering a question mark (?) at the system prompt did not display the list of available commands. These commands were only meant to assist Cisco TAC in advanced troubleshooting and were not documented either.

Starting with Cisco IOS XE Fuji 16.8.1a, hidden commands are available under:

• Category 1—Hidden commands in privileged or User EXEC mode. Begin by entering the service internal command to access these commands.

• Category 2—Hidden commands in one of the configuration modes (global, interface and so on). These commands do not require the service internal command.

Further, the following applies to hidden commands under Category 1 and 2:

• The commands have CLI help. Enter enter a question mark (?) at the system prompt to display the list of available commands.

  Note: For Category 1, enter the service internal command before you enter the question mark; you do not have to do this for Category 2.

• The system generates a %PARSER-5-HIDDEN syslog message when a hidden command is used. For example:

  *Feb 14 10:44:37.917: %PARSER-5-HIDDEN: Warning!!! 'show processes memory old-header ' is a hidden command. 
  Use of this command is not recommended/supported and will be removed in future.
  
  

Apart from category 1 and 2, there remain internal commands displayed on the CLI, for which the system does NOT generate the %PARSER-5-HIDDEN syslog message.

Important

We recommend that you use any hidden command only under TAC supervision. If you find that you are using a hidden command, open a TAC case for help with finding another way of collecting the same information as the hidden command (for a hidden EXEC mode command), or to configure the same functionality (for a hidden configuration mode command) using non-hidden commands.

The following table provides software compatibility information between Cisco Catalyst 9400 Series Switches, Cisco Identity Services Engine, Cisco Access Control Server, and Cisco Prime Infrastructure.

The following subsections list the hardware and software required to access the Web UI:

This section covers the various aspects of upgrading or downgrading the device software.

Note	You cannot use the Web UI to install, upgrade, or downgrade device software.

This section provides information about the licensing packages for features available on Cisco Catalyst 9000 Series Switches.

For information about feature scaling guidelines, see these datasheets for Cisco Catalyst 9400 Series Switches:

https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-9400-series-switches/nb-06-cat9400-ser-data-sheet-cte-en.html

https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-9400-series-switches/nb-06-cat9600-series-line-data-sheet-cte-en.html

https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-9400-series-switches/nb-06-cat9400-ser-sup-eng-data-sheet-cte-en.html

• Control Plane Policing (CoPP)—The show run command does not display information about classes configured under system-cpp policy, when they are left at default values. Use the show policy-map system-cpp-policy or the show policy-map control-plane commands in privileged EXEC mode instead.

• Cisco TrustSec restrictions—Cisco TrustSec can be configured only on physical interfaces, not on logical interfaces.

• Flexible NetFlow limitations

  • You cannot configure NetFlow export using the Ethernet Management port (GigabitEthernet0/0).

  • You can not configure a flow monitor on logical interfaces, such as layer 2 port-channels, loopback, tunnels.

  • You can not configure multiple flow monitors of same type (ipv4, ipv6 or datalink) on the same interface for same direction.

• Hardware limitations—When you use Cisco QSFP-4SFP10G-CUxM Direct-Attach Copper Cables, autonegotiation is enabled by default. If the other end of the line does not support autonegotation, the link does not come up.

• Interoperability limitations—When you use Cisco QSFP-4SFP10G-CUxM Direct-Attach Copper Cables, if one end of the 40G link is a Catalyst 9400 Series Switch and the other end is a Catalyst 9500 Series Switch, the link does not come up, or comes up on one side and stays down on the other. To avoid this interoperability issue between devices, apply the the speed nonegotiate command on the Catalyst 9500 Series Switch interface. This command disables autonegotiation and brings the link up. To restore autonegotiation, use the no speed nonegotiation command.

• In-Service Software Upgrade (ISSU)

  • ISSU from Cisco IOS XE Fuji 16.9.x to Cisco IOS XE Gibraltar 16.10.x or to Cisco IOS XE Gibraltar 16.11.x is not supported. This applies to both a single and dual supervisor module setup.

  • While performing ISSU from Cisco IOS XE Fuji 16.9.x to Cisco IOS XE Gibraltar 16.12.x, if interface-id snmp-if-index command is not configured with OSPFv3, packet loss can occur. Configure the interface-id snmp-if-index command either during the maintenance window or after isolating the device (by using maintenance mode feature) from the network before doing the ISSU.

  • While ISSU allows you to perform upgrades with zero downtime, we recommend you to do so during a maintenance window only.

  • If a new feature introduced in a software release requires a change in configuration, the feature should not be enabled during ISSU.

  • If a feature is not available in the downgraded version of a software image, the feature should be disabled before initiating ISSU.

• M.2 SATA SSD drive: With bootloader version 16.6.2r, you cannot access the M.2 SATA SSD drive at the ROMMON prompt (rommon> dir disk0). The system displays an error message indicating that the corresponding file system protocol is not found on the device. The only way to access the drive when on bootloader version 16.6.2r, is through the Cisco IOS prompt, after boot up.

• No service password recovery—With ROMMON versions R16.6.1r and R16.6.2r, the 'no service password-recovery' feature is not available.

• QoS restrictions

  • When configuring QoS queuing policy, the sum of the queuing buffer should not exceed 100%.

  • For QoS policies, only switched virtual interfaces (SVI) are supported for logical interfaces.

  • QoS policies are not supported for port-channel interfaces, tunnel interfaces, and other logical interfaces.

  • Stack Queuing and Scheduling (SQS) drops CPU bound packets exceeding 1.4 Gbps.

• Redundancy—The supervisor module (hardware) supports redundancy. Software redundancy is supported starting with Cisco IOS XE Everest 16.6.2. However, the associated route processor redundancy (RPR) feature is not supported.

  Before performing a switchover, use the show redundancy , show platform , and show platform software iomd redundancy commands to ensure that both the SSOs have formed and that the IOMD process is completed.

  In the following sample output for the show redundancy , note that both the SSOs have formed.

  Switch# show redundancy
  Redundant System Information :
  ------------------------------
  Available system uptime = 3 hours, 30 minutes
  Switchovers system experienced = 2
  Standby failures = 0
  Last switchover reason = active unit removed
  
  Hardware Mode = Duplex
  Configured Redundancy Mode = sso
  Operating Redundancy Mode = sso
  Maintenance Mode = Disabled
  Communications = Up
  
  Current Processor Information :
  -------------------------------
  Active Location = slot 3
  Current Software state = ACTIVE
  Uptime in current state = 2 hours, 57 minutes
  Image Version = Cisco IOS Software [Fuji], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 16.8.1, RELEASE SOFTWARE (fc3)
  Technical Support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2018 by Cisco Systems, Inc.
  Compiled Tue 27-Mar-18 13:43 by mcpre
  BOOT = bootflash:packages.conf;
  CONFIG_FILE =
  Configuration register = 0x1822
  
  Peer Processor Information :
  ----------------------------
  Standby Location = slot 4
  Current Software state = STANDBY HOT
  Uptime in current state = 2 hours, 47 minutes
  Image Version = Cisco IOS Software [Fuji], Catalyst L3 Switch Software (CAT9K_IOSXE), Version 16.8.1, RELEASE SOFTWARE (fc3)
  Technical Support: http://www.cisco.com/techsupport
  Copyright (c) 1986-2018 by Cisco Systems, Inc.
  Compiled Tue 27-Mar-18 13:43 by mcpre
  BOOT = bootflash:packages.conf;
  CONFIG_FILE =
  Configuration register = 0x1822
  
  

  In the following sample output for the show platform software iomd redundancy command, note that both SSOs have formed and the HA_STATE field is ready.

  Switch# show platform software iomd redundancy
  Configured Redundancy Mode = sso
  Operating Redundancy Mode = sso
  Local RF state = ACTIVE
  Peer RF state = STANDBY HOT
   
  slot  PSM STATE   SPA INTF   HA_STATE HA_ACTIVE
     1     ready   started     ready    00:01:16
     2     ready   started     ready    00:01:22
     3     ready   started     ready    00:01:27 ***active RP
     4     ready   started     ready    00:01:27
  <output truncated>

  In the following sample output for the show platform command, note that the State for all the linecards and supervisor modules is ok. This indicates that the IOMD processes are completed.

  Switch# show platform
  Chassis type: C9407R             
   
  Slot      Type                State                 Insert time (ago)
  --------- ------------------- --------------------- -----------------
  1         C9400-LC-24XS       ok                    3d09h        
  2         C9400-LC-48U        ok                    3d09h        
  R0        C9400-SUP-1         ok, active            3d09h        
  R1        C9400-SUP-1         ok, standby           3d09h        
  P1        C9400-PWR-3200AC    ok                    3d08h        
  P2        C9400-PWR-3200AC    ok                    3d08h        
  P17       C9407-FAN           ok                    3d08h  
  <output truncated>

• Secure Shell (SSH)

  • Use SSH Version 2. SSH Version 1 is not supported.

  • When the device is running SCP and SSH cryptographic operations, expect high CPU until the SCP read process is completed. SCP supports file transfers between hosts on a network and uses SSH for the transfer.

    Since SCP and SSH operations are currently not supported on the hardware crypto engine, running encryption and decryption process in software causes high CPU. The SCP and SSH processes can show as much as 40 or 50 percent CPU usage, but they do not cause the device to shutdown.

• Smart Licensing Using Policy: Starting with Cisco IOS XE Amsterdam 17.3.2a, with the introduction of Smart Licensing Using Policy, even if you configure a hostname for a product instance or device, only the Unique Device Identifier (UDI) is displayed. This change in the display can be observed in all licensing utilities and user interfaces where the hostname was displayed in earlier releases. It does not affect any licensing functionality. There is no workaround for this limitation.

  The licensing utilities and user interfaces that are affected by this limitation include only the following: Cisco Smart Software Manager (CSSM), Cisco Smart License Utility (CSLU), and Smart Software Manager On-Prem (SSM On-Prem).

• TACACS legacy command: Do not configure the legacy tacacs-server host command; this command is deprecated. If the software version running on your device is Cisco IOS XE Gibraltar 16.12.2 or a later release, using the legacy command can cause authentication failures. Use the tacacs server command in global configuration mode.

• Uplink Symmetry—When a redundant supervisor module is inserted, we recommend that you have symmetric uplinks, to minimize packet loss during a switchover.

  Uplinks are said to be in symmetry when the same interface on both supervisor modules have the same type of transceiver module. For example, a TenGigabitEthernet interface with no transceiver installed operates at a default 10G mode; if the matching interface of the other supervisor has a 10G transceiver, then they are in symmetry. Symmetry provides the best SWO packet loss and user experience.

  Asymmetric uplinks have at least one or more pairs of interfaces in one supervisor not matching the transceiver speed of the other supervisor.

• USB Authentication—When you connect a Cisco USB drive to the switch, the switch tries to authenticate the drive against an existing encrypted preshared key. Since the USB drive does not send a key for authentication, the following message is displayed on the console when you enter password encryption aes command:

  Device(config)# password encryption aes
  Master key change notification called without new or old key

• MACsec is not supported on Software-Defined Access deployments.

• VLAN Restriction—It is advisable to have well-defined segregation while defining data and voice domain during switch configuration and to maintain a data VLAN different from voice VLAN across the switch stack. If the same VLAN is configured for data and voice domains on an interface, the resulting high CPU utilization might affect the device.

• YANG data modeling limitation—A maximum of 20 simultaneous NETCONF sessions are supported.

• Embedded Event Manager—Identity event detector is not supported on Embedded Event Manager.

• The File System Check (fsck) utility is not supported in install mode.

Caveats describe unexpected behavior in Cisco IOS-XE releases. Caveats listed as open in a prior release are carried forward to the next release as either open or resolved.

For the most up-to-date, detailed troubleshooting information, see the Cisco TAC website at this URL:

https://www.cisco.com/en/US/support/index.html

Go to Product Support and select your product from the list or enter the name of your product. Look under Troubleshoot and Alerts, to find information for the problem that you are experiencing.

Information about Cisco IOS XE at this URL: https://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-xe/index.html

All support documentation for Cisco Catalyst 9400 Series Switches is at this URL: https://www.cisco.com/c/en/us/support/switches/catalyst-9400-series-switches/tsd-products-support-series-home.html

Cisco Validated Designs documents at this URL: https://www.cisco.com/go/designzone

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: https://cfnng.cisco.com/mibs