Tip

This is the documentation for the 23.11 version. Looking for the documentation of the latest version? Have a look here.

TNSR 19.08 Release Notes¶

About This Release¶

Note

TNSR 19.08.1 installation images are identical to 19.08 except that they have the most recent (as of the time it was built) set of updates from CentOS applied instead of the base release version of CentOS 7.6.1810.

There is no need to reinstall 19.08 to reach 19.08.1 using these images as running an update from 19.08 will result in the same, or even newer, CentOS packages.

General¶

Fixed removal of SSH authorized-keys entries from user entries in the OS when they are removed from TNSR users [1162]
Cleaned up extraneous logging messages from the configuration backend [2230]

ACL¶

Fixed manual selection of ACL protocol value 0, and renamed it to any [2134]
Fixed setting type and code values for ICMP ACLs [2325, 2426]
Fixed issues with removing the protocol value from an ACL rule [2252, 2307]
Expanded TNSR ACL rule protocol choices to any protocol, specified by number [2224]
Improved performance and display of large ACL rulesets (e.g. 10,000+ ACLs) [2139]

BFD¶

Fixed editing unused BFD keys [1891]
Fixed the BFD delayed option [1885]
Added validation to prevent changing the BFD interface, local address, or peer address since this is not allowed by the dataplane. [1549]
Fixed administratively disabling BFD via CLI [1883]

CLI¶

Improved handling of resizing terminal dimensions [2214]
Added options to enable and disable command history as well as to set the history size to a given value [2011]

Counters¶

Added verbose counter information to show interface [<if-name>] counters output [2413]
Removed redundant show counters command [2377]

Dataplane¶

Improved memory handling with large ACL rulesets [2442]
Added dataplane configuration option for num-crypto-mbufs [2160]
Added dataplane configuration options for buffer parameters [2399]
Fixed service dataplane restart potentially causing clixon_backend to lose its configuration [1383]

DHCP¶

Removed invalid * DHCP logging category [1307]
Fixed DHCP reservation required value validation so entries cannot be created without a MAC address [1530]

DNS¶

Removed invalid allow_setrd value from Unbound access-control command [1747]
Fixed handling of local zone hostname and domain when forming A/AAAA and PTR entries [1384]
Added outgoing-interface command to config-unbound mode to control how TNSR will originate DNS requests to upstream DNS servers [1884]

GRE¶

Fixed routing IPv6 inner traffic over IPv4 outer GRE tunnel [2424]

Host ACLs¶

Expanded Host ACL rule protocol choices to any protocol, specified by number [2227]
Fixed host ACL ICMP rule matching [2217, 2226]
Fixed duplication of rules in the nftables ruleset when the dataplane restarts [2207]

HTTP Server / RESTCONF¶

Fixed handling of the HTTP daemon configuration file when the service is not enabled in TNSR [1153]
Added new default index and error pages to the HTTP daemon [1531]

Interfaces¶

Fixed loopback interfaces responding to ICMP echo requests when in the down state [850]
Added commands to enable and configure IP reassembly [1302, 1277]
Changed show interface subcommands to be more consistent with other areas of the CLI [2376]

Note

Only one output-limiting keyword may now be specified, and several keywords were renamed to match their corresponding configuration parameters.
Added the ability to remove a MAC address from an interface, which will return the MAC address back to the native address after a dataplane restart [2310]
Fixed a clixon crash while executing show interface lacp [2438]
Fixed MAC address change propagation from dataplane to host tap interfaces [1502]
Fixed QinQ VLAN termination [1550]
Added no mtu interface command to remove the MTU setting and revert to the default value [2021]

IPsec¶

Fixed IPv6 traffic traversing an IPv4 IKEv2 IPsec tunnel [2422]
Fixed IPsec Child SA failures with AES-GCM combined with DPDK cryptodevs (QAT or aesni vdev) [2309]
Fixed IPsec tunnels with a Child SA using MD5 integrity failing to establish [2505]
Fixed IPsec tunnels with a Child SA using 3DES encryption failing to establish [2476]
Added elliptic curve DH group 31 (curve25519, 256 bit) to IPsec proposal choices [2179]

MAP¶

Added input validation to enforce MAP ip6-src-prefix values [2087]

NACM¶

Added improved error messages showing failed paths when access is denied by NACM [2443]
Changes to interface-related validation now require that users with access to configure interface-related items must also be able to get /interfaces-state/interface to read the interface list [2443]

NAT¶

Added commands to manage NAT session timeout values [2232]
Fixed issues with static NAT mappings with defined ports occasionally leading to a clixon-backend crash when restarting [1103]
Added input validation to prevent deterministic NAT crashes in the dataplane due to incorrect user configuration [1856]

NTP¶

Fixed NTP configuration generated for restrict lists [1705]

RESTCONF¶

Improved information returned in queries for netgate-system:system-state [2324]
Fixed malformed requests causing the API to return unexpected errors for a few seconds while it restarts [2079]

Routing¶

Improved handling of route table display with large route tables [506]
Improved output of show route table [2229]
Fixed handling and display of IPv6 static neighbors [2005]
Fixed FIB lookup option for static routes [1280]
Fixed creating static routes with the same next-hop ID in multiple routing tables [2510]

Dynamic Routing¶

Warning

Commands for BGP and related dynamic routing functionality have been restructured so everything is under route dynamic. Changes are extensive and the documentation has been updated to reflect the new commands.

Added support for OSPF [1895]
Length of BGP neighbor passwords is now limited to 63 characters [1454]
Fixed removal of IPv6 next-hop peer address from a route map [2304]
Fixed BGP advertisement of connected routes after interface status changes [746, 2409]
Changed BGP status commands for summary, neighbors, and network to require an address family [2367]
Fixed handling of BGP debug commands [2385]
Fixed handling of BGP maximum-prefix configuration parameter [859]
Fixed session handling when maximum-prefix-limit is exceeded [858]
Fixed handling of IPv6 static routes in the dynamic routing manager (zebra) [2279]
Cleaned up commands for unsupported dynamic routing features [2312]
Fixed handling of BGP import-check [781]
Fixed handling of routes from aggregate-address via next-hop 0.0.0.0 [832]
Eliminated unnecessary restarts of the dynamic routing daemons when making changes [1758]
Fixed positive relative metric adjustments in route-maps [2493]
Fixed displaying specific IPv6 BGP networks by address [2479]
Fixed configuring a BGP IPv6 aggregate address with summary-only option [2509]

SNMP¶

Support for SNMP monitoring has been added, see Simple Network Management Protocol for implementation details [2286]

Updates¶

Fixed handling of igb_uio module during an upgrade which also updates the kernel [2216]

VRRP¶

Support for VRRP has been added, see Virtual Router Redundancy Protocol for implementation details and limitations [1894]

VXLAN¶

Fixed configuration of alternate VXLAN encapsulation routing tables [1872]

Known Limitations¶

Updates¶

The UIO drivers may not be present in the correct directory after a kernel upgrade. Since the UIO drivers are kernel-specific, they must be rebuilt after any change in the kernel [2216].

To work around this issue, force a reinstall of the DPDK package which will rebuild the UIO drivers and place them in the appropriate location for the updated kernel:
```
$ sudo yum -y reinstall dpdk
```
This procedure will not be necessary when upgrading to future releases from 19.08.

ACLs¶

ACLs used with access-list output do not work on traffic sent to directly connected hosts [2057]

BFD¶

BFD does not integrate with BGP [2106]

BGP¶

Changing update-source from an IP address to loop1 allows a session to establish but remote prefixes do not appear in the FIB until reboot [1104]