Microsoft®, Windows®, and Windows NT® are US registered trademarks of Microsoft Corporation.
Adobe® and Acrobat® are trademarks of Adobe Systems Incorporated. Java™ is a US trademark of Sun Microsystems, Inc.
Software Credits
SSH on HP Networking Switches is based on the OpenSSH software toolkit. This product includes software developed by the OpenSSH Project for use in
the OpenSSH Toolkit. For more information on OpenSSH, visit
www.openssh.com
SSL on HP Networking Switches is based on the OpenSSL software toolkit. This product includes software developed by the OpenSSL Project for use in the
OpenSSL Toolkit. For more informatio
n on OpenSSL, visit
www.openssl.org
This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes software written by Tim Hudson
(tjh@cryptsoft.com).
Disclaimer
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained
herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material.
The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein
should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.
Hewlett-Packard assumes no responsibility for the use or reliability of its software on equipment that is not furnished by Hewlett-Packard.
Warranty
See the Software End User License Agreement and Hardware Limited Warranty booklet, available through www.hp.com/networking/support.
A copy of the specific warranty terms applicable to your Hewlett-Packard products and replacement parts can be obtained from your HP Sales and Service
Office or authorized dealer.
HP Security Policy and Release Notes
Per HP policy, a Security Bulletin must be the first published notification of a security defect. Fixes to security defects are not documented in release notes,
also by HP policy.
The official communication for security defect fixes will always be through HP Security Bulletins. For more information on security bulletins, and information
on how to subscribe to them, please see http://bizsupport2.austin.hp.com/bc/docs/support/SupportManual/c02645131/c02645131.pdf.
Visit the HP Networking Web site for more information on security and HP Networking products:
KA.15.09.0003 was the first KA.15.09 software version for the HP 3800 switches. KA.15.09 includes many enhancements not
found in KA.15.03 software, listed below.
Version KA.15.09
Authentication
Dynamic Port Access Auth via RADIUS
■Enhancement (PR_0000060972)—Enables configuration of RADIUS attributes for downstream supplicant
devices. This allows a common port policy to be configured on all access ports by creating new RADIUS HP vendorspecific attributes (VSAs) that will dynamically override the authentication limits. For more information, see the
chapter “RADIUS Authentication, Authorization, and Accounting” in the Access Security Guide for your switch.Fields
Added to Authentication Requests
Fields Added to Authentication Requests
■Enhancement (PR_0000063932) —For improved interoperability with Cisco ACS, fields are now added in
authentication requests for management TELNET, SSH, and HTTP service. For more information, see the chapter
“RADIUS Authentication, Authorization, and Accounting” in the Access Security Guide for your switch.
BGP
BGPv4
■Enhancement (PR_0000073705)—Border Gateway Protocol (BGP) support has been added. For more
information, see the “BGP (Border Gateway Protocol)” chapter in the Multicast and Routing Guide for your switch.
BGP MD5 Authentication
■Enhancement (PR_0000073738, CR_0000078395)—Adds support for BGP MD5 authentication. See “BGP
(Border Gateway Protocol)” in the Multicast and Routing Guide.
BGP Route Maps
■Enhancement (PR_0000065723, CR_0000072572)—Adds support for BGP route maps. See “BGP (Border
Gateway Protocol)” in the Multicast and Routing Guide.
BGP Route Filtering and Peer Restart Time Display
■Enhancement (PR_0000102845, CR_0000102845)—Adds support for filtering BGP routes by adding the option
bgp to show ip route, and for displaying the BGP peer's graceful restart time with show ip route bgp neighbor. See “BGP
(Border Gateway Protocol)” in the Multicast and Routing Guide.
CDP
Accept CDP/LLDP Packets Tagged for VLAN 1
■Enhancement (PR_0000065164) —Allows incoming CDP and LLDP packets tagged for VLAN 1 to be processed
even if VLAN 1 does not contain any ports. For more information, see the chapter “Configuring for Network
Management Applications” in the Management and Configuration Guide for your switch.
4
Page 7
CDPv2 Transmit Capability
■Enhancement (CR_0000107011) - When a Cisco VoIP phone boots up (or sometimes periodically), it queries the
switch and advertises information about itself using CDPv2. The switch receives the VoIP VLAN Query TLV (type
0x0f) from the phone and then immediately sends the voice VLAN ID in a reply packet to the phone using the VLAN
Reply TLV (type 0x0e). The phone then begins tagging all packets with the advertised voice VLAN ID.
CLI
Comware CLI Commands in ProVision Software
■Enhancement (CR_0000106070)—The is the first of several phases that allows a Comware CLI proficient user to
use their Comware CLI knowledge to generate equivalent ProVision software CLI commands to manage and configure
ProVision software switches. This preliminary offering adds 21 simple Comware Display commands directly to the
ProVision CLI, with additional troubleshooting and management commands planned for future software versions.
See the Comware CLI Commands in ProVision Software manual for more details.
Comware CLI Commands in ProVision Software (Phase 2)
■Enhancement (CR_0000114497) - This is the second of several phases that allows a Comware CLI proficient user
to use their Comware CLI knowledge to effectively manage and configure ProVision software switches. This phase
adds 112 additional Comware display commands to the ProVision software CLI.
Terminal Line Width and Length
■Enhancement (CR_0000074537) - For console/serial link and inbound telnet sessions, the switch output:
•Uses whatever width is set by the terminal program. If width is not specified, 80 characters is the default.
•Automatically wraps on word boundaries (such as spaces) for non-columnar output
•Automatically wraps on column boundaries for columnar output
HP recommends that you do not set your terminal width (terminal width <y>) above 150 columns.
Config
Customized Commands for Local User Accounts
■Enhancement (PR_0000069000)—Provides additional control over user access to the switch by creating local
user accounts that are authorized to use a customized set of commands. See “RADIUS Authentication, Authorization,
and Accounting” in the Access Security Guide.
Custom Default Configuration
■Enhancement (PR_0000045685)—Allows creation of a custom default configuration for the switch. For more
information, see the chapter “Switch Memory and Configuration” in the Basic Operation Guide for your switch.
Mesh ID
■Enhancement (PR_0000093199, CR_0000093199)—Adds the ability to configure a mesh ID. See the Advanced
■Enhancement (PR_0000071901)—When executing the show config or show running-config commands, interfaces
that have configuration settings are displayed together in order,only once, containing all the configuration commands
for that interface. For more information, see the chapter “Switch Memory and Configuration” in the Basic OperationGuide for your switch.
5
Page 8
Structured Config File Display
■Enhancement (CR_0000106090)—The structured option is an additional parameter for the show running-config and
show config commands. Using the structured option, the command output is grouped together in a more logical manner.
For more information, see the chapter “Switch Memory and Configuration” in the Basic Operation Guide for your
switch.
Encoded Version Information Added to Config File
■Enhancement (PR_0000061695) —Adds encoded version information to the config file, (for example,
Ver#01:00:01), to allow the switch to move between software versions that have different configuration options. The
user should not modify this string. For more information on displaying the switch configuration, see the chapter
“Switch Memory and Configuration” in the Basic Operation Guide for your switch.
Encrypt Credentials
■Enhancement (PR_0000068734)—Adds the ability to include and encrypt passwords and authentication keys in
the config file. After enabling this feature, the resulting config file cannot be used by older software versions. Before
enabling this feature, please see "Best Practices for Software Updates” in the Basic Operation Guide for your switch.
For more information about the feature, see the chapter “Configuring Username and Password Security” in the AccessSecurity Guide for your switch.
Include RADIUS and TACACS Only Credentials
■Enhancement (PR_0000064186) —The include-credentials feature is enhanced to provide a radius-tacacs-only
option to the command. For more information, see the chapter “Configuring Username and Password Security” in
the Access Security Guide for your switch.
DHCP
DHCP Client DNS Support
■Enhancement (PR_0000073284, CR_0000078031)—Allows the configuration of the Domain Name Server (DNS)
with DHCP. See the Management and Configuration Guide, Appendix C “Troubleshooting”.
IPv6
6in4 Tunneling
■Enhancement (PR_0000072668)—IPv6 over IPv4 tunneling is a way to establish point-to-point tunnels by
encapsulating IPv6 packets within IPv4 headers so that they can be carried over the IPv4 routing infrastructure. IPv6
over IPv4 tunneling provides a mechanism for utilizing the existing IPv4 routing infrastructure to carry IPv6 traffic
between IPv6 networks. For information on configuring tunnels, see the “IPv6 Tunneling Over IPv4 Using Manually
Configured Tunnels” chapter in the IPv6 Configuration Guide.
sFlow IPv6
■Enhancement (PR_0000069433, CR_0000074736)—Adds support for sFlow using IPv6. See the Management
and Configuration Guide, “Network Management” chapter.
DHCPv6 Client Authentication Options Added
■Enhancement (PR_0000060667) —Adds DHCPv6 client authentication options. For more information, see the
“DHCPv6 Client Authentication” section in the IPv6 Configuration Guide for your switch.
6
Page 9
Router Advertisement (RA) Guard
■Enhancement (PR_0000072298, CR_0000077209)—The RA Guard feature restricts the ports (or trunks) that can
accept IPv6 Router Advertisements (RAs). Additionally, ICMPv6 router redirects are blocked on the configured ports.
Link
Uplink Failure Detection
■Enhancement (PR_0000070161)—Uplink Failure Detection (UFD) is a network path redundancy feature that
works in conjunction with NIC teaming functionality. For more information, see the “Port Status and Configuration”
chapter in the Management and Configuration Guide for your switch.
Logging and Recording
Flight Data Recorder Log
■Enhancement (PR_0000071572)—Flight Data Recorder (FDR) logs information that is “interesting” at the time of
the crash as well as when the switch is misbehaving, but not crashed. The crash-log and crash-data files now maintain
data for the last 4 crashes instead of just the most recent. For more information about this feature, see the “File
Transfers” and “Troubleshooting” appendices in the Management and Configuration Guide for your switch.
Flight Data Recorder Phase 2
■Enhancement (CR_0000106140) - The Flight Data Recorder provides a way to capture and preserve data that is
related to a crash event. Phase 2 adds the capture and preservation of protocol and subsystem-specific information.
Reporting Config Changes
■Enhancement (PR_0000069196, CR_0000074531)—This feature provides the ability to track and report
information about switch management processes on a per-user, per-session basis. Syslog or RADIUS will be used for
logging the information.
MAC Limit Notify
■Enhancement (PR_0000073085, CR_0000077875)—The MAC Address Count feature provides a way to notify
the switch management system when the number of MAC addresses learned on a switch port exceeds the permitted
configurable number.
Outbound Queue Monitor
■Enhancement (PR_0000054042)—Adds the ability to monitor egress queues for dropped packets when QoS is
configured. For more information, see the chapter “Quality of Service: Managing Bandwidth More Effectively” in the
Advanced Traffic Management Guide for your switch.
Logging for Routing ACLs
■Enhancement (PR_0000055367)—Adds the ability to log ACL permit entries in the same manner that ACL deny
entries are currently logged. For more information, see the chapter “IPv4 Access Control Lists (ACLs)” in the AccessSecurity Guide for your switch.
Show IP Route Summary
■Enhancement (PR_0000065586, CR_0000072508)—Displays the aggregate count of routes per routing protocol.
See the Multicast and Routing Guide, “IP Routing” chapter.
7
Page 10
Syslog via TCP
■Enhancement (PR_0000058564)—Adds the ability to send syslog messages via TCP. For more information, see
“Debug/Syslog Operation” in the “Troubleshooting” appendix of the Management and Configuration Guide for your
switch.
Set sFlow Agent Address
■Enhancement (PR_0000073083, CR_0000077874)—This feature adds sflow as an option to the existing ip source-
interface command, which provides the ability to specify the sFlow source agent address that is included in the packets
sent from the switch to the sFlow collection nodes.
Multicast
Support for Additional RPs and Multicast Groups
■Enhancement (PR_0000070869)—The administrator is now able to configure 8 static Rendezvous Points (RPs)
and 8 multicast group ranges per static RP in PIM-SM mode. For more information, see the “PIM-SM” chapter in the
Multicast and Routing Guide for your switch.
MLDv2
■Enhancement (PR_0000071588)—IGMP v3 and MLD v2 capabilities were added to the switch. For more
information, see the “Multicast Listener Discovery (MLDv1 and MLDv2)” chapter in the IPv6 Configuration Guide
for your switch.
Override Reverse Path Forward (RPF) Lookup
■Enhancement (PR_0000066432)—Adds the ability to override the normal Reverse Path Forward (RPF) lookup
mechanism so the router can accept multicast traffic on an interface other than that which would be normally selected.
See “PIM-SM (Sparse Mode)” in the Multicast and Routing Guide.
PIM CLI enhancements
■Enhancement (PR_0000068123)—Enhanced the router pim command. For more information, see the “PIM-DM
(Dense Mode)” and “PIM-SM (Sparse Mode)” chapters in the Multicast and Routing Guide for your switch.
OSPF
OSPF Neighbor Shutdown Notification
■Enhancement (PR_0000065022)—Provides a way to gracefully shut down OSPF routing on HP switches without
losing packets that are in transit. For more information, see the chapter “IP Routing Features” in the Multicast andRouting Guide for your switch.
Define Cost of LSA Type 3 Summarized Prefix
■Enhancement (PR_0000065218) —Provides a way to define a fixed, user-assigned cost of an OSPF LSA type 3
summarized prefix. For more information, see the section “Configuring OSPFv3 on the Routing Switch” in the IPv6Configuration Guide for your switch.
OSPF LSA Type 3 Summarized Prefix Cost
■Enhancement (PR_0000071947)—Define OSPF LSA Type 3 Summarized Prefix Cost for OSPF v3. For more
information, see the “Introduction to OSPFv3” chapter in the IPv6 Configuration Guide for your switch.
8
Page 11
OSPF Stub Router Advertisement for OSPF v3
■Enhancement (PR_0000071946)—OSPF Stub Router Advertisement for OSPF v3 - renamed to better reflect the
feature. For more information, see the “Introduction to OSPFv3” chapter in the IPv6 Configuration Guide for your
switch.
Show OSPF Neighbor Timers
■Enhancement (PR_0000054055)—This enhancement provides the ability to display OSPF neighbor timer
information. For more information, see the chapter “IP Routing Features” in the Multicast Routing Guide for your
switch.
OSPFv2 Range Metrics
■Enhancement (PR_0000067641, CR_0000073680)—Adds NSSA range metrics to OSPFv2. See the Multicast and
Routing Guide, “IP Routing” chapter.
SPF Throttling
■Enhancement (PR_0000072987, CR_0000077793)—SPF scheduling (throttling) allows the switch to delay SPF
calculations when the network is unstable or there is a change in topology. See the IPv6 Configuration Guide,
“OSPFv3 Routing” chapter, or the Multicast and Routing Guide, “IP Routing” chapter.
OSPFv2 Logging Commands and Command Output
■Enhancement (PR_0000052548)—Adds improved logging, commands, and command output for OSPFv2
troubleshooting. See the “IP Routing Features” chapter in the Multicast and Routing Guide for your switch.
OSPFv3 over 6in4 Tunnels
■Enhancement (PR_0000072702)—Both VLANS and tunnels can be assigned to areas and may be collectively
referred to as an IP routing interface. For information on configuring tunnels, see the “IPv6 Tunneling Over IPv4 Using
Manually Configured Tunnels” chapter in the IPv6 Configuration Guide.
Routing
Policy Based Routing (PBR)
■Enhancement (PR_0000072658)—PBR provides the ability to manipulate a packet’s path based on attributes of
the packet. Traffic with the same destination can be routed over different paths, so that different types of traffic, such
as VoIP or traffic with special security requirements, can be better managed. For more information, see the “ClassifierBased Software Configuration” chapter in the Advanced Traffic Management Guide for your switch.
Concurrent Meshing and Routing
■Enhancement (PR_0000068493, CR_0000074060) - Meshing and routing now can be configured simultaneously.
A packet can be routed into a mesh, or be switched through a mesh and then routed. Two routers can be connected
by mesh links, which offers additional network topologies between routers and switches. Concurrent meshing and
routing makes it possible to implement meshing throughout a broadcast domain without the need for additional
switches or the use of another Layer 2 technology such as Spanning Tree to connect meshing domains with routing
switches.
Static Summary Route to RIP
■Enhancement (PR_0000058804)—Allows the redistribution into RIP of static black hole or reject routes. For more
information, see the “IP Routing Features” chapter in the Multicast Routing Guide for your switch.
9
Page 12
SNMP
SNMP Trap Upon Addition or Deletion of Port MAC Addresses
■Enhancement (PR_0000045796) —Adds the ability to enable SNMP traps when MAC addresses are added to or
deleted from a port. For more information, see the chapter “Configuring for Network Management Applications” in
the Management and Configuration Guide for your switch.
SNMP Trap and Log Message When Startup Config Updated
■Enhancement (PR_0000052266)—Adds the ability to enable an SNMP trap when the switch's startup configuration
is changed. A log message is always generated for such changes. For more information, see the chapter “Configuring
for Network Management Applications” in the Management and Configuration Guide for your switch.
SNMP Trap on Running Configuration Changes
■Enhancement (PR_0000058798)—Adds the ability to enable an SNMP trap for any configuration change made in
the switch's running configuration file. For more information, see the chapter “Configuring for Network Management
Applications” in the Management and Configuration Guide for your switch.
MSTP Standards Compliant Based MIB
■Enhancement (PR_0000060335)—This enhancement implements full compliance with the IEEE standard for the
SNMP MIB object ieee8021MstpMib. For more information, see the “Multiple Instance Spanning-Tree Operation”
chapter in the Advanced Traffic Management Guide for your switch.
MSTP Standards Compliant Based MIB (part 2)
■Enhancement (CR_0000105360) - This enhancement is a follow-on to PR_0000060335, which implements full
compliance with the IEEE standard for the SNMP MIB object ieee8021MstpMib. This CR_0000105360 adds Single
Instance STP information to the MIB.
Spanning Tree
RPVST+
■Enhancement (PR_0000070948, CR_0000075993) - RPVST+ is a proprietary spanning tree implementation that
extends RSTP (802.1w) to run a separate spanning tree for each VLAN on the switch, and ensures that only one active,
loop-free path exists between any two nodes on a given VLAN.
Spanning Tree Loop Guard
■Enhancement (PR_0000069073)—Adds the Spanning Tree loop guard feature, which prevents network loops when
BPDUs are not received on a blocking port for various reasons (“BPDU starvation”). See “Multiple Spanning Tree
Operation” in the Advanced Traffic Management Guide for your switch.
SSH
SSH Client
■Enhancement (PR_0000060779) —Allows the switch to act as an SSH client to connect to another HP switch. Also
enhances SFTP to allow bidirectional secure copying of files between a switch and an SFTP server, initiated from the
switch with the copy command. For more information, see the chapter “Configuring Secure Shell (SSH)” in the AccessSecurity Guide for your switch. Additional information for IPv6 configuration can be found in the chapter “IPv6
Management Security Features” in the IPv6 Configuration Guide for your switch.
10
Page 13
Transceivers
10m and 15m Direct Attach Cables (DACs)
■Enhancement (PR_0000067349) - Adds support for the J9286B 10m and J9287B 15m Direct Attach Cables (DACs).
Display Transceiver Command
■Enhancement (PR_0000066341, CR_0000072917)—Adds the ability to view diagnostic monitoring information
for transceivers with Diagnostic Optical Monitoring (DOM) support. See “Troubleshooting” in the Management andConfiguration Guide.
Transceiver Diagnostics
■Enhancement (PR_0000070797)—Adds the ability to view diagnostic monitoring information for copper
transceivers with Virtual Cable Test (VCT) support. For more information, see the "Troubleshooting" appendix in the
Management and Configuration Guide for your switch.
Trunking
Distributed Trunking Switch-to-Switch
■Enhancement (PR_0000063613)—Adds support for switch-to-switch Distributed Trunking. See “Port Trunking”
in the Management and Configuration Guide.
LACP Enhancements
■Enhancement (PR_0000069334)—Includes three LACP enhancements:
1. LACP Key - The lacp key option provides the ability to control dynamic trunk configuration. Ports with the same
key will be aggregated as a single trunk. For more information see the "Port Tunking" chapter in the Managementand Configuration Guide for your switch.
2.LACP Debug Logging and Show Commands - The show lacp, show lacp peer, and show lacp counters commands are
added or modified. For more information see the "Port Tunking" chapter and the "Troubleshooting" appendix in
the Management and Configuration Guide for your switch.
3.Displaying Information about LACP Trunk Load Balancing. The show trunks load-balance interface command
displays the port on which the information will be forwarded out for the specified traffic flow with the specified
source and destination address. For more information see the "Port Tunking" chapter and the "Troubleshooting"
appendix in the Management and Configuration Guide for your switch.
Trunk Load Balancing Using L4 Ports
■Enhancement (PR_0000058115)—Allows the use of TCP/UDP source and destination port number for trunk load
balancing. For more information, see the chapter “Port Trunking” in the Management and Configuration Guide for
your switch.
VLANs
VLAN Multicast Filter Global Configuration
■Enhancement (PR_0000053047)—Adds a global configuration option that allows each VLAN to have a multicast
filter. See the “Multimedia Traffic Control with IP Multicast (IGMP)” chapter in the Multicast and Routing Guide for
your switch.
11
Page 14
MAC-Based VLANs
■Enhancement (PR_0000064722)—Adds support for MAC-Based VLANs. See “MAC-Based VLANs” in the Access
Security Guide.
IP Enable/Disable for All VLANs
■Enhancement (PR_0000054183)—This enhancement provides the ability to disable the IP addresses on specified
VLANs, without deleting the configured IP addresses or the other Layer 3 configuration. For more information, see
the “Static Virtual LANs (VLANs)” chapter in the Advanced Traffic Management Guide for your switch.
Wake-on-LAN Support Across VLANs
■Enhancement (PR_0000058512)—Adds Wake-on-LAN support across VLANs. For more information, see the “IP
Routing Features” chapter in the Multicast Routing Guide for your switch.
Show MAC with VLAN
■Enhancement (PR_0000052738)—Adds VLAN information to the output of the show mac-address commands. For
more information, see the appendix “Monitoring and Analyzing Switch Operation” in the Management and
Configuration Guide for your switch, and the chapter “Configuring and Monitoring Port Security” in the Access
Security Guide for your switch.
Version KA.15.10.0003
MIB to Check Load of Module Slots
■Enhancement (PR_0000073100, CR_0000077888) - This feature provides SNMP read access to the CPU
utilization of the modules. Currently the only method to retrieve the module CPU utilization is the CLI command show cpu slot <slot | all>. A new MIB table is created to facilitate the reading of information related to the module and its
CPU utilization statistics.
AAA Authorization on HTTPS
■Enhancement (CR_0000103497) - When using Commands authorization, the Web Agent windows may show or
hide fields, or allow or deny configuration steps, based on the access or deny list (VSA filtering) for the authenticated
user. For more information, see the chapter "RADIUS Authentication, Authorization, and Accounting" in the AccessSecurity Guide for your switch.
IPv6 DNS via RA Options
■Enhancement (CR_0000107183) - IPv6 Router Advertisements allow IPv6 routers to advertise a list of recursive
DNS Server (RDNSS) addresses and a DNS Search List (DNSSL) to IPv6 hosts. The new command options are ipv6 nd suppress-ra-dns, which is executed in the global config context, and ipv6 nd ra suppress-dns, which is executed in
the VLAN context. For more information, see the chapter "IPv6 Router Advertisements" in the IPv6 ConfigurationGuide for your switch.
Reinterpret CDP Info When Using IP Phones
■Enhancement (CR_0000108063) - Prevents MAC addresses from being learned on the specified ports when the
VLAN is untagged and the destination MAC address is 01000c-CCCCCC (CDP), 0180c2-00000e (LLDP), or 0180c2000003 (EAPOL). The feature is configured per-port by using the ignore-untagged-mac <port-list> command. For more
information, see the chapter "Configuring for Network Management" in the Management and Configuration Guide
for your switch.
12
Page 15
Secure Mode
■Enhancement (CR_0000108494) - Secure Mode is now supported on the HP 3800 switches. Secure Mode allows
the transition between standard secure mode and enhanced secure mode for several security functions. Standard
secure mode is the existing, default security mode on the switch. Enhanced secure mode provides an additional level
of switch security. For more information, see the chapter "Secure Mode" in the Access Security Guide for your switch.
OpenFlow
■Enhancement (CR_0000109154) - OpenFlow is a programmable open-standard network protocol that uses flexible
matching rules to classify and manage network traffic into flows. For more information, see the OpenFlowConfiguration Guide.
Comware CLI Commands in ProVision Software (Phase 3)
■Enhancement (CR_0000115963) - This is the third of four phases that allows a Comware CLI proficient user to
use their Comware CLI knowledge to effectively manage and configure ProVision software switches. This phase adds
97 additional Comware display commands to the ProVision software CLI. With this addition there are now 230
Comware display commands in the ProVision software CLI.
13
Page 16
Prerequisites
Operating System and Web Browser Compatibility
The switch Web agent supports the following combinations of OS browsers:
Operating SystemSupported Web Browsers
Windows XP SP3Internet Explorer 7, 8
Firefox 3.5
Windows Vista SP2Internet Explorer 8, 9
Firefox 10, 11
Windows 7Internet Explorer 8, 9
Firefox 12
Chrome 19
Windows Server 2008 SP2Internet Explorer 8, 9
Firefox 12
MAC OSFirefox 12
ROM Updates Required!
BootROM updates are needed to be able to boot specified switch software versions. In most cases, selected software versions
are used to automatically update the BootROM.
This software includes an update to BootROM KA.15.09. If your switch has an older version of BootROM, the BootROM will
be updated with this KA.15.10.0022 software. During the software update, the switch will automatically boot twice, first to
update the BootROM to the proper version, and then to load the system software. After the switch flash memory is updated
and the final boot is initiated, no additional user intervention is needed. Do not interrupt power to the switch during this
important update.
Installation Instructions
The Basic Operation Guide for your switch provides software installation and management information on the following
topics:
■downloading switch documentation and software from the Web
■saving configurations while using the CLI
■best practices for software updates
To access the guide, visit the HP Networking manuals web page. (Refer to “Description” on page 3.)
Issues and Suggested Actions
RADIUS Server Authentication Issue
Because of an inconsistency between the Windows XP 802.1x supplicant timeout value and the switch default timeout value,
which is 5, when adding a backup RADIUS server, set the radius-server timeout value to 4 on the switch. Otherwise, the switch
may not failover properly to the backup RADIUS server.
14
Page 17
Fixes
Software fixes are listed in chronological order, from oldest to newest software version. Unless otherwise noted, each new
software version includes all the software fixes added in previous versions.
KA.15.03.3004 was the initial software version for the HP 3800 switches.
Version KA.15.03.3005
Status: Released and fully supported, but not posted on the Web.
The following problems were resolved in software version KA.15.03.3005.
■CLI (PR_0000072869, CR_0000077695) - The switch does not allow the use of a dash or an underscore ("-" or "_")
in an unauth-redirect URL.
■Crash (PR_0000072341, CR_0000077244) - With a client connected to a port configured for MAC-based
authentication and unauth-redirect, if that client fails authentication the switch might reboot unexpectedly with a
message similar to the following.
Software exception at hwBp.c:211 -- in 'fault_handler', task ID = 0xaa3d1c0
■Crash (PR_0000103369, CR_0000103369) - A switch configured with the command web-management ssl might
reboot unexpectedly with a message similar to the following.
Software exception at http_init.c:543 -- in 'tHttpd', task ID = 0xa984d80
■Port Crash (PR_0000103236, CR_0000103236) - Although rare, a group of ports on the 48-port switch might
reboot unexpectedly. The ports will not recover until the switch is rebooted. The affected ports are 1-24 and 49-50.
The event log will display a message similar to the following.
TCAM, parity recovery 0x80000000 0x00000000 appears in the event log.
■Management (CR_0000106958) - After multiple TELNET and SSH sessions are opened and then closed in rapid
succession, the switch might not allow a new management connection to open even though there are available
sessions, responding with the error message: Sorry, the maximum number of sessions are active.Try again later.
■Stacking (CR_0000111105) - The output of show tech does not include information about stack members.
■Stacking (CR_0000111563) - The output of show tech does not include adequate information about the stacking
link between stack members.
■Switch Hang (CR_0000109565) - The switch might fail to boot fully, requiring a power-cycle to recover.
Version KA.15.03.3010
Status: Released and fully supported, but not posted on the Web.
The following problem was resolved in software version KA.15.03.3010.
■Switch Hang (CR_0000112490) - The switch becomes unresponsive during output of the show tech all command.
Output halts after issuing the stackingshowtech command on a Member.
16
Page 19
Version KA.15.03.3011
Status: Never released.
The following problems were resolved in software version KA.15.03.3011.
■EEE (CR_0000110739) - Energy Efficient Ethernet (EEE) is enabled by default on HP 3800 switches with software
versions KA.15.03.3010 and earlier. On early hardware versions of the 3800 switches, 1-Gigabit Ethernet ports toggle
offline/online intermittently when connected to a device that also has EEE enabled due to a problem with a rev.
A0 PHY chip. (This PHY hardware issue is now resolved with a version A1 PHY on the 3800 switch.) With this software
fix, a switch that has version A0 PHYs will have EEE disabled permanently, and a switch that has version A1 PHYs
will have EEE disabled by default. If desired, the user can enable EEE on switches with A1 PHYs.
■Switch Hang (CR_0000112490b) - The switch becomes unresponsive during output of the show tech all command.
Output halts after issuing the stackingshowtech command on a Member. This improves the original CR_0000112490
fix documented in KA.15.03.3010.
Version KA.15.03.3012
Status: Released and fully supported, but not posted on the Web.
No problems were resolved in software version KA.15.03.3012.
Version KA.15.03.3013
Status: Never released.
The following problems were resolved in software version KA.15.03.3013.
■Config (PR_0000069007, CR_0000074368) - After downloading from a TFTP server,theoobm keyword is removed
from a config file that has an sntp server command with the oobm parameter.
■Crash (PR_0000073144, CR_0000077919) - During processing of the show tech all command, if event log messages
are being received at a very high rate, the switch might reboot unexpectedly with a message similar to the following:
■Self Test (CR_0000113055) - The switch might report a self test port failure after rebooting, on ports with active
devices. This affects ports that are connected at 100 Mbps. Workarounds: either unplug and then reconnect the
network cable, or disable and then enable the port.
■Stacking (CR_0000111533) - When the Commander is powered off or fails over, SFP ports on the Standby lose
link and do not recover. This only affects SFP ports (not SFP+ ports), so this is only an issue when the Standby is a
J9584A HP 3800-24SFP-2SFP+Switch.
■Switch Hang (CR_0000113858) - After issuing the redundancy switchover command from a TELNET or SSH session,
the Standby hangs with all LEDs on. Workaround: press and hold the Reset button on the hung switch for 5 seconds,
then release.
■Switch Hang (CR_0000114060) - After issuing the boot system command, the switch hangs with all LEDs on.
Workaround: press and hold the Reset button on the hung switch for 5 seconds, then release.
17
Page 20
Version KA.15.03.3014
Status: Never released.
The following problems were resolved in software version KA.15.03.3014.
■Crash (CR_0000114460) - After issuing the redundancy switchover command, the switch might reboot unexpectedly
■Port Communication (CR_0000114387) - The switch ports might connect at 10 Mbps full-duplex instead of Gigabit
full-duplex. This issue only affects switches with the letters DL and DM in the middle of the serial number (for example,
SG21DM9876).
Version KA.15.03.3015
Status: Released and fully supported, and posted on the Web.
The following problem was resolved in software version KA.15.03.3015.
■Switch Hang (CR_0000114699) - The CLI command copy command-output ‘show tech all’ tftp causes the switch to
become unresponsive.
Version KA.15.09.0003
Status: Released and fully supported, but not posted on the web.
The following problems were resolved in software version KA.15.09.0003.
■BootROM (CR_0000108445) - This software version includes a BootROM update to BootROM version KA.15.06.
■Config (CR_0000104888) - The IPv6 nd ra prefix command requires configuration of valid lifetime and preferred
lifetime values before the user can add the parameters off-link and no-autoconfig. If the configured lifetime settings
are the default values (valid = 2592000 and preferred = 604800), the off-link and no-autoconfig parameters are not listed
in the config file. When the switch is rebooted, the parameters function properly even though they are not listed in
the config file. However, if the config file is saved to a TFTP server, then loaded onto a switch, the configuration will
not operate as expected because the parameters are missing.
■Crash (CR_0000108146) - After a large amount of querier elections the switch might reboot unexpectedly with a
■DHCP (CR_0000113976) - DHCP addresses are not properly assigned when Web Authentication or MAC
Authentication clients fail authentication and are redirected at a high rate.
■DHCP Snooping (CR_0000108666) - When a PXE protocol DHCP-offer packet is sent from a boot server through
a trusted port, the switch drops the packet.
■Distributed Trunking (CR_0000106804) - With Distributed Trunking enabled and a large number of MAC
addresses learned by the switch (on the order of several thousand addresses), the switch experiences a gradual loss
of free memory.
■Port Communication (CR_0000114548) - When port 14 is configured for tagged packets only, untagged packets
including STP BPDUs are not received by that port. Workaround: configure an untagged VLAN on port 14.
18
Page 21
■VRRP (CR_0000113863) - After a reboot, the VRRP Master configured with a preempt delay timer sends a gratuitous
ARP from the switch's physical MAC address instead of the VRRP virtual MAC address. This causes routing to fail
until the preempt delay timer expires.
Version KA.15.09.0004
Status: Released, but removed from the web due to CR_0000124276.
This software is recalled and no longer recommended.
■CLI (CR_0000115515) - The switch does not allow configuration changes via the CLI, responding with the error
message inconsistent value. This has been observed when the configuration includes snmpv3 targetaddress TARGETADDRESS with a TARGETADDRESS string longer than 24 characters.
■Config (CR_0000117518) - A switch configured with a username and password and with include-credentials cannot
be accessed after updating software, because the username is wrongly removed from the config file during the
software update.
■Crash (CR_0000115929) - With very large key sizes, the command show crypto host-cert might cause the switch to
reboot unexpectedly with a message similar to the following.
■Crash (CR_0000116647) - It is possible for the switch to reboot unexpectedly with a message similar to the
following.
Software exception in kernel context at ghsException.c:1101
-> Internal system error
■Module Crash (CR_0000113992) - In a rare situation, a switch module or port bank might reboot unexpectedly
with a message similar to the following.
chassis: Slot H Read Error Restr Mem Access HW Addr=0xffaaaaf0
IP=0x1a10d64 Task='mIpAdMUpCt' Task ID=0x1b1e2300
Bus Error Data=0x00000000 Status=0x00000400
■Module Crash (CR_0000116226) - In a rare situation, a switch module or port bank might reboot unexpectedly
with a message similar to the following. This improves the original Module Crash fix (CR_0000113992), also in
KA.15.09.0004.
chassis: Slot H Read Error Restr Mem Access HW Addr=0xe5911000
IP=0x1a10da8 Task='mIpAdMUpCt' Task ID=0x1b1e4c80
Bus Error Data=0x00000000 Status=0x00000400
■Power (CR_0000112424) - When the switch is exposed to AC power fluctuations and the voltage drops too low,
the switch reboots and generates an incorrect error message saying the switch crashed. With this fix, the error
message is changed to Switch rebooting due to temporary loss of power or low voltage.
■SSL (CR_0000115933) - Under certain conditions, the VLAN -> VLAN Mgmt page on the switch cannot be accessed
via an SSL connection to the web user interface.
■Web Management (CR_0000108339) - The switch's web user interface cannot be accessed via the fully-qualified
domain name in some situations. Workaround: Use the IP address to access the switch's web user interface.
19
Page 22
Version KA.15.10.0003
Status: Released, but removed from the web due to CR_0000124276.
This software is recalled and no longer recommended.
■BootROM (CR_0000119469) - This software version includes a BootROM update to BootROM version KA.15.09.
■Crash (CR_0000114674) - A stack member might reboot unexpectedly with a message similar to the following,
after the user enters the command show tech stacking member X where X is not the commander number.
■Crash (CR_0000116647) - It is possible for the switch to reboot unexpectedly with a message similar to the
following.
Software exception in kernel context at ghsException.c:1101
-> Internal system error
■Crash (CR_0000116912) - With OSPF routing and MSTP enabled, it is possible for the switch to reboot unexpectedly
with a message similar to the following.
Software exception at rt_table.c:4453 -- in 'eRouteCtrl', task ID = 0xa95e140
-> Routing Stack: Assert Failed
■Crash (CR_0000118474) - The switch experiences a gradual loss of free memory when clients that use a RADIUS-
assigned ACL reauthenticate. This can cause the switch to reboot unexpectedly.
■Distributed Trunking (CR_0000103240) - With Distributed Trunking enabled, applying the command clear mac-
address to the VLAN of the InterSwitch-Connect (ISC) on one switch can cause the peer switch to drop packets that
should be forwarded across the ISC.
■Distributed Trunking (CR_0000115557) - Multicast hosts might be temporarily dropped from the multicast
stream, in a topology with Distributed Trunking where a Group-Specific Host Membership Query should be forwarded
across the Inter-Switch Connection (ISC).
■Distributed Trunking (CR_0000118526) - In a switch-to-switch Distributed Trunkingtopologywith IGMP enabled,
multicast streams learned on one Distributed Trunking switch might not be known to the other Distributed Trunking
switch. The result is multicast streams that cannot be joined by clients on one switch.
■Distributed Trunking (CR_0000118663) - The standby switch periodically reports Out of pkt buffers,on
a stack with redundant management configured for Distributed Trunking. This can lead to an unexpected reboot of
the standby switch.
■Enhancement (PR_0000073100, CR_0000077888) - This feature provides SNMP read access to the CPU
utilization of the modules. Currently the only method to retrieve the module CPU utilization is the CLI command show cpu slot <slot | all>. A new MIB table is created to facilitate the reading of information related to the module and its
CPU utilization statistics.
■Enhancement (CR_0000103497) - When using Commands authorization, the Web Agent windows may show or
hide fields, or allow or deny configuration steps, based on the access or deny list (VSA filtering) for the authenticated
user. For more information, see the chapter "RADIUS Authentication, Authorization, and Accounting" in the AccessSecurity Guide for your switch.
20
Page 23
■Enhancement (CR_0000107183) - IPv6 Router Advertisements allow IPv6 routers to advertise a list of recursive
DNS Server (RDNSS) addresses and a DNS Search List (DNSSL) to IPv6 hosts. The new command options are ipv6 nd suppress-ra-dns, which is executed in the global config context, and ipv6 nd ra suppress-dns, which is executed in
the VLAN context. For more information, see the chapter "IPv6 Router Advertisements" in the IPv6 ConfigurationGuide for your switch.
■Enhancement (CR_0000108063) - Prevents MAC addresses from being learned on the specified ports when the
VLAN is untagged and the destination MAC address is 01000c-CCCCCC (CDP), 0180c2-00000e (LLDP), or 0180c2000003 (EAPOL). The feature is configured per-port by using the ignore-untagged-mac <port-list> command. For more
information, see the chapter "Configuring for Network Management" in the Management and Configuration Guide
for your switch.
■Enhancement (CR_0000108494) - Secure Mode is now supported on the HP 3800 switches. Secure Mode allows
the transition between standard secure mode and enhanced secure mode for several security functions. Standard
secure mode is the existing, default security mode on the switch. Enhanced secure mode provides an additional level
of switch security. For more information, see the chapter "Secure Mode" in the Access Security Guide for your switch.
■Enhancement (CR_0000109154) - OpenFlow is a programmable open-standard network protocol that uses flexible
matching rules to classify and manage network traffic into flows. For more information, see the OpenFlowConfiguration Guide.
■Enhancement (CR_0000115963) - This is the third of four phases that allows a Comware CLI proficient user to
use their Comware CLI knowledge to effectively manage and configure ProVision software switches. This phase adds
97 additional Comware display commands to the ProVision software CLI. With this addition there are now 230
Comware display commands in the ProVision software CLI.
■File Transfer (CR_0000106249) - A configuration file that has loop protection enabled on a trunk cannot be
downloaded to the switch, if the trunk does not exist in the currently-running configuration.
■Module Crash (CR_0000110845) - With MSTP enabled on the switch, a port configured for MAC authentication
and loop protection does not detect a loop on a downstream switch. This can lead to CPU utilization of 90-100%, and
the switch module or port bank might reboot unexpectedly with a message similar to the following.
Software exception in ISR at ngDmaRx.c:1660
■Module Crash (CR_0000116784) - If a MAC address moves between three Distributed Trunks repeatedly, the
switch modules or port banks where the MAC address is seen experience a gradual loss of free memory that can lead
to a module or port bank crash.
■OSPF (CR_0000117192) - When an OSPF neighbor is in the INIT state and the router receives a one way hello from
that neighbor, the event log generates a message that the switch received an invalid one way hello. OSPF routing
functions properly but this message should not be generated. This fix removes that erroneous message.
■sFlow (CR_0000110640) - When sFlow sends a sample that was routed, the switch does not have information to
display the port on which the packet was received. With this fix, the sFlow sample will show zero as the received
interface index instead of 0x3fffffff.
■Switch Hang (CR_0000114815) - If any of the parameters in the command snmpv3 targetaddress includes a space,
when the config is saved and the switch is rebooted the switch will hang and fail to boot fully.
■Web Management (CR_0000108339) - The switch's web user interface cannot be accessed via the fully-qualified
domain name in some situations. Workaround: Use the IP address to access the switch's web user interface.
Version KA.15.10.0004
Status: Never released.
No problems were resolved in software version KA.15.10.0004.
21
Page 24
Version KA.15.10.0005
Status: Released and fully supported, but not posted on the web.
The following problems were resolved in software version KA.15.10.0005.
■ACLs (CR_0000119956) - Removing an ACL entry (ACE) that is a comment (a "remark") causes undesired changes
to the ACL.
■BGP (CR_0000122109) - When configuring a BGP neighbor, the switch does not accept IP addresses that would be
broadcast or network addresses in a classful addressing scheme. For example, the switch does not allow the neighbor
addresses 15.255.255.255 or 15.0.0.0.
■CLI (CR_0000115033) - With stacking disabled and SSH file transfer enabled, the switch does not allow the user
to "copy" the crash-data, crash-log, or coredump files via SFTP.
■Counters (CR_0000119114) - The output of the show system temperature command gives incorrect values.
■Display Issue (CR_0000121028) - Some MAC addresses are displayed incorrectly in the output of CLI commands
show lldp info remote-device and display lldp neighbor-information list.
■Routing (CR_0000120907) - A switch that has a default gateway or less-specific route configured does not allow
users to connect to the switch's IP loopback address. The packets are routed instead of being accepted by the switch.
■SNMP (CR_0000120223) - The Entity MIB lists the stacking module as available hardware even if no stacking
module is inserted in the switch.
■TFTP (CR_0000119184) - The switch experiences a loss of free memory each time command output is copied to
a TFTP server. When memory is no longer available, the TFTP will fail with a message similar to
TFTP download in progress. Failed to allocate a new TFTP client. 00000K Request failed.
Version KA.15.10.0006
Status: Released and fully supported, but not posted on the web.
The following problems were resolved in software version KA.15.10.0006.
■802.1X (CR_0000122837) - Clients have issues with authentication when 802.1X and MAC Authentication are both
configured on a port.
■Crash (CR_0000117378) - When a stack member crashes, that member might reboot continuously instead of
rejoining the stack.
■Distributed Trunking (CR_0000120627) - Some traffic is lost when a member of a Distributed Trunk pair is
rebooted.
■IPv6 (CR_0000122825) - IPv6 packets with a mask of /65 to /127 are routed to the default route instead of the
intended destination.
■PIM-DM (CR_0000122264) - Some PIM-DM multicast streams fail when a default route is configured on the switch.
■Spanning Tree (CR_0000110052) - In a topology with multiple MSTP regions and multiple same-cost links
connecting the regions, the CST root port might change to a CST alternate port, and MSTP instances might be blocked
on region boundary ports.
■SSH (CR_0000122795) - SSH session disconnects when the SSH key re-exchange takes place.
■Switch Hang (CR_0000124001) - In a 3800 stack with CDP passthrough configured, the standby will hang when
the commander goes down.
22
Page 25
Version KA.15.10.0007
Status: Released and fully supported, but not posted on the web.
The following problems were resolved in software version KA.15.10.0007.
■Authentication (CR_0000122439) - With multiple certificates installed on the switch, PEAP-MSCHAPv2
authentication fails when using Windows Server 2008 R2 Network Policy Server (NPS).
■Crash (CR_0000122225) - The switch might reboot unexpectedly when using VRRP with a message similar to
Software exception in ISR at btmDmaApi.c:378.
■Crash (CR_0000124443) - Rarely, when ports go offline, then back online while voice VLAN requests are being
sent, the switch might reboot unexpectedly with a message similar to
Software exception at sw_sem.c:1036 -- in 'mSnmpCtrl' -> Deadlock found!.
■IGMP (CR_0000105902) - IGMPv2 LEAVE processing functionality no longer works for a multicast group after
receipt of IGMPv1 group specific membership query (GSMQ) packet when operating in IGMPv2 mode, even when ip igmp forcedfastleave 1-24 is enabled.
■SNMP (CR_0000124187) - With stacking enabled, the time-stamps in SNMP traps do not match sysUptime on the
switch.
■SNMP (CR_0000124375) - A switch configured to send syslog messages to a server also sends incorrect SNMP
traps, causing unknown trap messages in the syslog server.
■TFTP (CR_0000124276) - The switch experiences a loss of free memory each time the CLI command copy running-
config tftp is issued by a user or by a network management platform. When memory is depleted on the commander,
the switch will respond to CLI commands such as show run with the error message Translator Failed. In that
state, stack configuration changes might cause 3800 stack members to reboot repeatedly with a message similar to
Reboot of Member ID 2, RFS Error reboot.
Version KA.15.10.0008
Status: Released and fully supported, but not posted on the web.
The following problems were resolved in software version KA.15.10.0008.
■Authentication (CR_0000114307) - The switch does not allow users to login when the configured authentication
method is peap-mschapv2.
■Crash (CR_0000126636) - It is possible for the switch to reboot unexpectedly, under conditions of very high traffic
volumes and high CPU utilization.
Version KA.15.10.0009
Status: Released and fully supported, and posted on the web.
The following problems were resolved in software version KA.15.10.0009.
■ACLs (CR_0000122535) - When configuring an ipv4 or ipv6 prefix-list, it is not possible to add an entry to permit/
deny 'any'.
■CLI (CR_0000125980) - After configuring debug ip pbr, the output of show debug does not include pbr in the list of
enabled debug types.
■CLI (CR_0000127335) - Using the CLI command show tech all can cause the system to reboot unexpectedly.
■Crash (CR_0000120116) - With OSPF configured, in a rare situation the switch might reboot unexpectedly with a
message similar to
Software exception at rt_table.c:4453 -- in 'eRouteCtrl', task ID = 0xa9c4c00 ->
Routing Stack: Assert Failed.
23
Page 26
■Crash (CR_0000126799) - Under unusual stress conditions, the switch might reboot unexpectedly with a message
similar to
Software exception at fileTransfer.c:1144 -- in 'tHttpd', task ID = 0xa9389c0 -> Could
not open file.
■DHCP Snooping (CR_0000126311) - The CLI entry dhcp-snooping option 82 untrusted-policy keep is not included in
the config file if no dhcp-snooping option 82 is also configured. If the config file is saved to a TFTP server, it will not
function properly when subsequently loaded on a switch.
■Distributed Trunking (CR_0000124473) - The switch does not allow DHCP server responses to cross the Inter-
Switch Connection (ISC).
■Distributed Trunking (CR_0000125623) - After rebooting a switch participating in a distributed LACP trunk, a
distributed trunk port that is disconnected will not link after it is connected.
■Distributed Trunking (CR_0000127096) - When the Inter-Switch Connection (ISC) is brought down, clients
connected via Distributed Trunk links cannot be reached from one of the Distributed Trunking switches.
■Include Credentials (CR_0000127700) - With include credentials enabled, a config file that is saved to a TFTP
server does not contain the SNMPv3 credentials.
■LEDs (CR_0000115489) - After a PoE error is resolved, the switch turns off the PoE LED but continues to flash the
Fault LED.
■OSPF (CR_0000122980) - OSPF3 ECMP routes are not displayed in the IPv6 route table.
■Policy Based Routing (CR_0000125847) - After configuring a policy and applying it to a VLAN, the IP next-hop is
unreachable until the switch is rebooted.
■Routing (CR_0000123230) - The switch does not forward traffic to a host that has a static route configured with a
32-bit subnet mask. Traces show that the switch never sends an ARP request for that host.
■Routing (CR_0000128007) - ARP replies from a Microsoft Network Load Balancing (NLB) cluster operating in
multicast mode cause the switch to use software routing. This affects v2 zl modules and 3800 switches.
■sFlow (CR_0000128567) - The switch uses the IP address of the source VLAN as the sFlow packet source, instead
of the configured source-interface.
■SNMP (CR_0000122623) - After rebooting a switch configured for SNMP with the parameters operator unrestricted,
the switch does not allow the user to set any read/write MIB objects.
■SNMP (CR_0000125513) - The value stored in MIB object ospfNbrState (OID 1.3.6.1.2.1.14.10.1.6) is incorrect.
■Transceivers (CR_0000126801) - After booting a 3800 switch or a K-software switch with a v2 zl module, a J9054B/
C 100-FX SFP-LC transceiver that was already inserted (or is inserted during the boot process) will not link with the
remote end.
■Web Management (CR_0000125239) - After logging into the switch Web user interface, closing the tab on some
Web browsers does not log the user out of the Web session.
Version KA.15.10.0010
Status: Released, but no longer recommended due to CR_0000127868.
The following problems were resolved in software version KA.15.10.0010.
■IGMP (CR_0000127628) - In a topology where the host connects to a querier, the querier connects to a non-querier
switch, the non-querier switch connects to a router, and the multicast source is beyond the router, the host might not
receive the multicast stream. This happens because a "join" from the host that is received by the querier is not
forwarded by the non-querier switch.
24
Page 27
■IGMP (CR_0000127974) - If a switch receives a PIM packet while it is in the querier election state, the switch gives
up the querier role and does not forward multicast traffic.
Version KA.15.10.0011
Status: Released and fully supported, but not posted on the web.
The following problem was resolved in software version KA.15.10.0011.
■Uplink Failure Detection (CR_0000127868) - On a switch that is configured for uplink failure detection where
the link to monitor (LtM) or link to disable (LtD) is an LACP trunk, after reboot the link to monitor is listed as down
in the output of show uplink-failure-detection, and the link to disable is taken down by the switch.
Version KA.15.10.0012
Status: Released and fully supported, but not posted on the web.
The following problems were resolved in software version KA.15.10.0012.
■Config (CR_0000127108) - After downgrading from a newer software version to a 15.10 software version, the output
of show run lists an incorrect software build version in the Created on release statement.
■Config (CR_0000129797) - A config file that has the entry ipv6 ospf3 passive on a tunnel cannot be downloaded to
the switch.
■GVRP (CR_0000129917) - When the switch receives its own GVRP frames, it learns from them instead of dropping
the frames.
■GVRP (CR_0000130090) - After rebooting the switch, the configuration unknown-vlans disable does not work on
trunks.
■Link (CR_0000128466) - After booting a switch with a port configured for 100-full, if that port is changed to 10-half
it will not link with a remote device that runs at 10-half.
■QoS (CR_0000123663) - VRRP IPv4 DSCP is tagged as 0 and cannot be changed by remarking.
Version KA.15.10.0013
Status: Never released.
The following problems were resolved in software version KA.15.10.0013.
■Crash (CR_0000126777) - With a combination of interface state changes along with IPV6 address configuration
changes, it is possible for the switch to reboot unexpectedly with a message similar to SubSystem 0 went down:
■Dynamic ARP Protection (CR_0000132073) - When a VLAN is configured for dynamic ARP protection and also
DHCP snooping, ARP packets should be forwarded but are incorrectly dropped when the arp-protect configuration
does not include the validate ip option.
■Loop Protection (CR_0000127150) - Loop protection fails to detect a loop on a port configured for 802.1X
authentication, if 802.1X is not enabled globally.
■PIM (CR_0000128681) - After a large number of multicast streams are added and old streams time out, the switch
might get into a state where it is unable to add new multicast streams, responding with a message similar to
IpAddrMgr: Failed to allocate new SW IP multicast group, table full FIB entry.
Version KA.15.10.0014
Status: Never released.
The following problems were resolved in software version KA.15.10.0014.
25
Page 28
■Banner MOTD (CR_0000132198) - The login banner is not displayed if the user logs into the switch via the standby
or member switch instead of the active or commander switch.
■CLI (CR_0000128124) - The output of show monitor and show monitor <mirror_destination_number> displays
information for only mirror destination #1.
■Crash (CR_0000127791) - With OSPF configured, in a rare situation the switch might reboot unexpectedly with a
message similar to Software exception at rt_table.c:4453 -- in 'eRouteCtrl', task ID =0xa9c4c00 -> Routing Stack: Assert Failed. This improves the original Crash fix (CR_0000120116).
■Distributed Trunking (CR_0000132286) - When a MAC address moves from a Distributed Trunk port to a non-
Distributed-Trunk port, the switch MAC tables sometimes show that MAC address on the wrong port.
■Distributed Trunking (CR_0000132900) - With a switch configured for both Distributed Trunking and MSTP, a
MAC address learned on a VLAN that is not part of the Inter-Switch Connection (ISC) might not appear in the MAC
table, or might appear on the wrong port. This issue has been observed when all the Distributed Trunk ports are down
on the switch that learns the MAC address.
■Distributed Trunking (CR_0000133318) - Distributed trunk links might go down after a redundancy failover of
an 8200zl switch running in Nonstop Switching mode.
■Event Log (CR_0000127436) - After the switch uptime reaches 497 days, the timestamp entries in the event log
become erratic with gaps of several hours or days. In some cases the timestamps revert to previous months and years,
even though SNTP updates with those wrong timestamps report the correct date and time.
■Management (CR_0000134091) - Disabling write access to an SNMP community via the Web user interface might
cause the switch to become unresponsive to command input. The switch must be rebooted to regain management
access.
■MSTP (CR_0000129044) - In a high-availability environment, ports might be incorrectly blocked by STP.
■OpenFlow (CR_0000134471) - OpenFlow flows are not programmed correctly when RPVST+ is disabled on the
OpenFlow member VLAN.
■Passwords (CR_0000130921) - If the switch is configured with a username and password, changing the password
causes the username to also change. The username is changed to the default "manager" or "operator", depending on
which password is changed.
■Passwords (CR_0000134675) - The switch does not automatically create a default username of "manager" or
"operator" when a password is configured for those levels of access.
■PIM (CR_0000130353) - The switch might send duplicate multicast packets when sFlow is enabled and the multicast
packets are routed by software.
■SNMP (CR_0000123582) - Including the detail parameter in the command show ipv6 ospf3 link-state area-scope detail
might cause infinite output. This affects the show tech all command, which includes the detail parameter.
■SSL (CR_0000133153) - If the SSL option is enabled, and an external EWA server is configured, the switch
incorrectly uses an https (secure) redirect page when accessing a plain text URL.
■TFTP (CR_0000129475) - A switch config that has certain lines in the config file cannot be downloaded to the
switch via TFTP. For example, attempting to download a config file with the valid statement distributed-trunking peer-keepalive udp-port 6400 results in the error message UDP port 6400 is already in use.
■Transceivers (CR_0000132781) - Software does not allow the dual-speed J8177C Gigabit-copper transceiver to be
configured for 100 Mbps operation, responding with a message such as Value auto-100 is not applicableto port A21.
■Transceivers (CR_0000133023) - 100-Megabit transceivers might have one or more of these symptoms: 1) Link
LED is lit but link is down, 2) No Link after the transceiver is hot-swapped, 3) Transceiver fails self test.
26
Page 29
Version KA.15.10.0015
Status: Released and fully supported, but not posted on the web.
The following problems were resolved in software version KA.15.10.0015.
■Config (CR_0000135481) - After boot, a config file that has a trap destination community name with an open
parenthesis "(" or a close parenthesis ")" cannot be downloaded to the switch.
■Distributed Trunking (CR_0000135388) - When a MAC address moves from a Distributed Trunk port to a non-
Distributed-Trunk port, the switch MAC tables sometimes show that MAC address on the wrong port. This fix
improves the original Distributed Trunking fix (CR_0000132286).
Version KA.15.10.0016
Status: Released and fully supported, and posted on the web.
The following problems were resolved in software version KA.15.10.0016.
■IGMP (CR_0000132149) - Although the RFC requires that the switch with the lowest IP address becomes querier,
a switch that is acting as querier stops being querier when it receives a query from a switch with a higher IP address.
■IGMP (CR_0000135527) - A non-querier switch that receives a Join from the querier fails to send further Joins to
the querier, resulting in loss of multicast traffic.
■IGMP (CR_0000136013) - After the switch becomes querier, it does not update the table that defines the querier
port, and continues to forward IGMP packets out the port that previously led to the querier.
■Web Management (CR_0000135883) - The "Rx Errors" column is missing from the Web user interface.
Version KA.15.10.0017
Status: Released and fully supported, but not posted on the web.
The following problems were resolved in software version KA.15.10.0017.
■CLI (CR_0000137287) - The output of show run vlan <VLAN_ID> omits the no in the configuration entry no ip igmp
fastleave. Note that the output of show run gives correct information.
■Config (CR_0000129574) - After upgrading from 15.09 to 15.10 or 15.11 software, the RADIUS server key is
incorrectly removed from the configuration.
■Distributed Trunking (CR_0000135353) - With Distributed Trunking and VRRP enabled, when both the VRRP
master and backup routers reboot together, the VRRP master might not be reachable by the Distributed Trunking
switches.
■IGMP (CR_0000135527) - A non-querier switch that receives a Join from the querier fails to send further Joins to
the querier, resulting in loss of multicast traffic.
■LLDP (CR_0000132891) - When an IP phone is connected directly to the switch, the output of the command show
lldp info remote-device gives an incorrect value for the phone's IP address.
■MAC Authentication (CR_0000129991) - MAC Authentication fails when the peap-mschapv2 parameteris included
in the aaa authentication CLI command.
■OSPF (CR_0000123661) - OSPFv3 packets do not include the differentiated services information that should be in
the Traffic Class field of the IPv6 header.
■OSPF (CR_0000135171) - Using the Menu interface, if the user navigates to Switch Configuration -> IP
Configuration and selects Save without changing anything on that screen, any OSPF configuration will be removed
from every VLAN.
27
Page 30
■PIM-SM (CR_0000135871) - In some cases, a "join" from a remote host is not properly processed by the switch and
the multicast traffic is not forwarded. This has been observed after a host on the same subnet as the multicast source
has joined the stream, and a remote host leaves the multicast stream.
■sFlow (CR_0000128439) - When an sFlow-sampled inbound packet is to be routed, the sFlow data gives the wrong
output port on the switch.
Version KA.15.10.0018
Status: Released, but this software is recalled and no longer recommended due to CR_0000115372.
No problems were resolved in software version KA.15.10.0018.
Version KA.15.10.0019
Status: Released and fully supported, but not posted on the web.
The following problem was resolved in software version KA.15.10.0019.
■Crash (CR_0000115372) - The switch might reboot unexpectedly with a message similar to NMI event
Status: Released and fully supported, but not posted on the web.
The following problems were resolved in software version KA.15.10.0020.
■IGMP (CR_0000138408) - Joins sent by clients in response to a Group Specific Query are not forwarded by the
Querier, causing the clients to lose the stream.
■Multicast (CR_0000138817) - When a multicast stream is sent to a reserved multicast address, a General Query
might not be not forwarded by the switch, causing clients to be dropped from the multicast stream.
Version KA.15.10.0021
Status: Released and fully supported, but not posted on the web.
The following problem was resolved in software version KA.15.10.0021.
■IGMP (CR_0000140514) - After disabling IGMP forwarding on a port, multicast traffic incorrectly continues to flow
from that port.
Version KA.15.10.0022
Status: Released and fully supported, and posted on the web.
The following problems were resolved in software version KA.15.10.0022.
■Accounting (CR_0000133762) - If a Windows system is configured for both computer authentication and user
authentication, accounting might not function properly.
■Config (CR_0000138447) - After a switch software update, SNMP community access privileges are incorrectly
changed by the switch. The output of show snmp-server and the output of a "walkmib" command give different results,
and neither output represents how the switch actually behaves for Manager or Operator access. This issue was
introduced with CR_0000122623; if the access settings were configured on a switch without the CR_0000122623 fix,
after updating to software with the CR_0000122623 fix the settings are changed.
■Crash (CR_0000135900) - In some situations it is possible for the switch to reboot unexpectedly with a message
similar to Software exception at alloc_free.c:646 -- in 'eDrvPoll', task ID = 0xa9a7a80
-> buf already freed by 0x0A9A7D40, op=0x0006003E.
28
Page 31
■Crash (CR_0000138879) - After boot, a switch that has a syslog server and an IPv6 address configured might become
unresponsive to management, and after a period of time the switch might reboot repeatedly with a message similar
to NMI event SW:IP=0x001517d4 MSR:0x02029200 LR:0x0015178c cr: 0x28000400 sp:0x03aae0e0
■DHCP (CR_0000137877) - A switch acting as a DHCP relay agent sends two DHCP packets, one of which incorrectly
has the source MAC address of the client instead of the switch.
■ICMP (CR_0000134682) - The switch does not log an unsolicited ICMP reply unless it has first pinged some (any)
IP address. Also, unsolicited ICMP reply log messages are sometimes associated with the DEFAULT_VLAN instead
of the VLAN of the incoming unsolicited ICMP reply.
■Jumbo Frames (CR_0000137961) - When jumbo frames are enabled on any VLAN, OSPF fails to establish an
adjacency after a switch reboot, and RIP updates might not be accepted by the router.
■Jumbo Frames (CR_0000141474) - When jumbo frames are enabled on any VLAN, OSPF fails to establish an
adjacency after a switch reboot, and RIP updates might not be accepted by the router. This fix improves the original
Jumbo Frames fix (CR_0000137961).
■Mirroring (CR_0000134191) - IP connectivity to the mirror endpoint switch might be intermittent when remote
mirroring is configured on the management VLAN, and mirroring is configured for traffic in both directions.
■OSPF (CR_0000137616) - When the switch is configured as an OSPF neighbor, and the neighbor changes time,
OSPF adjacency will temporarily drop.
■PIM (CR_0000134883) - High CPU utilization from PIM message exchanges causes dropped multicast streams.
■sFlow (CR_0000134427) - sFlow sampling of multicast packets sometimes results in duplicate packets that can
cause pixelation of video or other degradation of the multicast stream.
■TFTP (CR_0000132721) - Certain lines in the configuration file are sometimes incorrectly changed when imported
via TFTP. For example, the configuration entry snmp-server community public unrestricted might have the unrestricted
parameter removed when the config file is downloaded via TFTP.
29
Page 32
HP Switch, Routing Switch, and Router Products Software Keys
Software Letter HP Products
ASwitch 2615-8-PoE and Switch 2915-8G-PoE
C1600M, 2400M, 2424M, 4000M, and 8000M
CYSwitch 8100fl Series (8108fl and 8116fl)
ESwitch 5300xl Series (5304xl, 5308xl, 5348xl, 5372xl, 5304xl-32G, and 5308xl-48G)
FSwitch 2500 Series (2512 and 2524), Switch 2312, and Switch 2324
GSwitch 4100gl Series (4104gl, 4108gl, 4140gl, 4148gl, and 4160gl)
HSwitch 2600 Series, Switch 2600-PWR Series: H.07.81 and earlier, or H.08.55 and greater,
Switch 2600-8-PWR requires H.08.80 or greater.
Switch 6108: H.07.xx and earlier
ISwitch 2800 Series (2824 and 2848)
JJ.xx.xx.biz Secure Router 7000dl Series (7102dl and 7203dl)
JJ.xx.xx.swi Switch 2520G Series (2520G-8-PoE, 2520G-24-PoE)