Tip

This is the documentation for the 24.06 version. Looking for the documentation of the latest version? Have a look here.

TNSR 20.08 Release Notes¶

About This Release¶

This is a regularly scheduled TNSR release including new features and bug fixes.

Warning

While Netgate has tested common update scenarios, updating in-place from previous versions of TNSR may not work in all installations.

Installing TNSR 20.08 directly and then restoring the TNSR configuration data is a safer approach. However, that method requires physical access or equivalent out-of-band access and is potentially more time consuming. See Upgrading by Redeploying TNSR for details.

Significant Architectural Changes¶

Network Namespaces¶

TNSR version 20.08 introduces network namespaces which provide isolation between host OS and dataplane networking environments. The dataplane namespace is for the networking environment managed by TNSR, and the host namespace is for the networking environment managed by the host operating system. This is a significant shift in behavior for various areas of TNSR. [3744]

Dataplane/Router Integration¶

TNSR version 20.08 also shifts from the VPP dataplane router plugin to the new linux-cp plugin. These plugins enable daemons such as FRR and strongSwan to work together with the dataplane to manage routing and perform necessary tasks. [3617]

The combination of linux-cp and isolated namespaces provides increased security and numerous user experience improvements.

Virtual Routing and Forwarding¶

TNSR 20.08 also adds Virtual Routing and Forwarding (VRF) support. Previous versions of TNSR supported multiple routing tables which could be used to direct traffic on various interfaces, but that function has been replaced with a VRF implementation which provides more features, such as integration with dynamic routing. Existing non-default routing tables are automatically converted to VRF entries on upgrade.

Warning

Implementing this feature has resulted in significant CLI syntax changes for static and dynamic routing functions. Consult the documentation for any routing features currently in use for more details, along with the CLI Command Reference

General¶

Updated CentOS to 8.2 [4499]
Updated VPP to 20.01-1621 [3649]
Updated FRR 7.3.1 [2953]
Updated strongSwan to 5.8.4 [3935]
Updated clixon to 4.5.0
Updated Kea to 1.7.7 [3934]
Package management changed from yum to dnf [4637]
Fixed VMXNET3 interface initialization with a single RX queue for TNSR instances on VMware configured for VM Hardware Compatibility with ESX 6.7 (VM Version 14 or later) [2576]
Added dmidecode and lshw as dependencies of tnsr-diag [3613]
Added tnsrctl utility to control TNSR services from the shell [4654]

Configuration Changes¶

Static routes no longer require an interface name. TNSR can now resolve the next hop properly by IP address alone.
Static route next-hop interfaces, if present, must be correct in TNSR 20.08 configurations.

Warning

Previous versions of TNSR may have allowed a route to be defined for an interface and next hop gateway which did not match (e.g. The interface does not share a subnet with the gateway). These invalid route combinations are now rejected, which may result in an error loading the configuration after the upgrade. Ensure static route next-hop interfaces are correct, or removed, before upgrading to TNSR 20.08.
Dynamic routing configuration changed in various ways when Virtual Routing and Forwarding support was added.
Configurations with multiple routing tables are automatically migrated to VRFs when the configuration is upgraded. This may result in name changes to route tables as the names for VRF entries have tighter restrictions. For example, names longer than 15 characters will be shortened and invalid characters will be replaced [4793]
If the configuration database fails to load, a failsafe database is loaded instead of exiting with an error [3833]
The default names for interfaces using the ixgbe PMD may change on upgrade. Previous versions of the ixgbe PMD in DPDK erroneously indicated 10 Gbit/s capabilities in all devices, even if the devices were not capable of that speed. TNSR 20.08 includes a new version of DPDK with a corrected driver which now properly reflects the speed capability of the port in the interface name.

Warning

Affected hardware which has ports without 10Gbit/s capability, such as the Netgate 5100, will change interface names when upgrading to TNSR 20.08. For example, names will change from TenGigabitEthernetX/Y/Z to their true speed, GigabitEthernetX/Y/Z. The configuration database will need manual adjustments to use the correct names. This does not affect configurations using custom interface names. For assistance, please contact Netgate TAC.

ACLs¶

Added ACL sequence numbers to show interface access-lists output [4355]
Fixed incomplete output when viewing IPv6 ACLs [4791]

Bridge¶

Fixed spurious error messages when deleting a bridge domain with ARP entries [3559]

CLI¶

Fixed issues which caused excessive delays when displaying the contents of large route tables [3899]
Fixed issues which caused excessive memory consumption when displaying the contents of large route tables [3889]
Improved handling of configuration changes so they are only applied when necessary [3832]
Fixed issues displaying command output containing non-XML-safe data [3785]
Added CLI commands to initiate a reboot of the TNSR device [3396]
Improved handling of unknown elements in the configuration database, so that errors may be corrected in the CLI rather than by editing the configuration [4638]
Fixed an issue where the CLI could crash when typing ? in a description field [4734]

Dataplane¶

Fixed handling of UIO driver changes such that they are now reflected properly on interfaces which are already in use [3209]
Added configuration option to set a default Ethernet MTU in the dataplane [4397]
Fixed a problem where removing all CPU settings left an empty <cpu/> tag in the configuration [3936]
Added validation to prevent configuring workers and corelist or coremask at the same time [3849]
Fixed explicit assignment of core 0 [3630]

Warning

Read CPU Workers and Affinity for important information on core 0 behavior and usage.
Removed dependency relationship between the vpp and clixon-backend services in systemd to prevent a dataplane issue from making the CLI unusable, so that the CLI may be used to correct the problem. [3828, 3040]

Note

When starting services manually, the vpp service must now be manually started before clixon-backend. This change has been reflected throughout the documentation. If any scripts or shell aliases on a TNSR install manage services directly, they should be updated accordingly.
Initialization of dataplane DPDK cryptographic devices changed so that placement of devices on queue pairs is optimized for better performance [4788, 2267]
Added commands to configure dataplane logging behavior [4640]
Added commands to configure DPDK Logging level [4680]
Added commands to configure DPDK transmit checksum offloading of TCP/UDP for network devices [4680]
Added commands to configure DPDK decimal interface name behavior [4680]
Added commands to configure DPDK default interface parameters [4680]

DHCP¶

Changed DHCP lease database output to use human-readable dates [4394]
Added RESTCONF query to retrieve DHCP leases [4375]
Improved DHCP option removal validation to prevent invalid commands [2667]
Changed how the DHCP server daemon is launched so that it will recover after a clixon-backend failure [4489]

Diagnostics¶

Changed ping and traceroute so they can run in either the host or dataplane namespace [3747]

DNS¶

Added commands to configure DNS resolution behavior host and dataplane namespaces (System DNS Resolution Behavior) [3754]

GRE¶

Fixed validation failure at startup when using a non-default routing table on a GRE interface [4732]

Host¶

Fixed issues which prevented displaying complete information for host interfaces [4351]
Removed unnecessary host ACLs (nftables) for dataplane services [3753]
Added commands to display host ACLs (show host acl) [1565]
Fixed incorrect validation error when matching via port range in host ACLs [4746]
Fixed DHCP client on host interface giving up if a response is not received in a timely manner (Service = Failed) [3015]

Interfaces¶

Changed Interface DHCP clients to use Linux dhclient instead of the native dataplane (VPP) DHCP client [4464]
Allowed unattached or preconfigured interfaces to remain in the configuration database, to prevent the configuration from failing to load in situations where interfaces may have changed. [3829]

This way administrations can utilize the CLI to correct these situations, rather than requiring them to edit the configuration database directly.
Added support for configuring L3 interface MTU values (IPv4, IPv6) [3426]
Fixed assignment of RX queues to specific workers [3025]
Fixed issues with deleting memif sockets after they have been removed from memif entries [3661]
Improved error messages generated when attempting to create a memif with a socket which is already in use [3637]
Fixed incorrect memif role in state data [4453]
Added TNSR interface names to Linux kernel interfaces as aliases [4425]
Improved validation of loopback interface names [3615]
Fixed adding a DHCP client hostname to an existing DHCP client [2557]
Fixed re-enabling loopback interfaces breaking packet forwarding until the dataplane was restarted [2828]
Fixed IPv6 addresses on IPsec or GRE interfaces not displaying in show command output [2425]

IPsec¶

Fixed session establishment behavior of IPsec tunnels which were removed and then added back [1313]
Fixed issues with SA ordering preventing IPsec traffic from passing if both endpoints attempted to establish a tunnel at the same time [2391]
Fixed validation when deleting configuration for IPsec tunnels [3456]
Added support for using an FQDN as the remote address for an IPsec tunnel [4401]
Eliminated excess logging when DPDK decrypts ESP [4366]
Improved error messages presented to the user when attempting to create invalid IKE authentication or identity configurations [3885]
Added IPsec SA statistics counters [3883]
Added support for IPsec NAT-T (UDP Encapsulation) [3496]
Fixed issues with IPsec tunnels being initiated from host interfaces in certain circumstances [3451]
Fixed improper IPsec tunnel initialization when using a hostname for the remote address of the tunnel [4726]
Changed how IPsec ipip interfaces are initialized so they are no longer automatically enabled when an IPsec tunnel is established [4481]

As a consequence, ipip interfaces for IPsec tunnels must now be manually enabled when created.

Installations of TNSR upgraded from previous versions will have the ipip interfaces enabled automatically during the configuration upgrade process.
Fixed IPsec packet padding. In previous versions, IPsec packets could contain an invalid 15th byte of padding, which led to such packets being dropped by peers. Only affected packets which contained 15 bytes of padding [4796]

LACP¶

Fixed synchronization of MAC addresses between the dataplane and host tap interfaces when a bond interface does not have a MAC address explicitly configured [2126]

LLDP¶

Fixed validation of LLDP parameter values [3459]

MAP¶

Fixed generation of ICMPv6 unreachable messages when a packet fails to match a MAP domain on a MAP BR [1869]
Fixed pre-resolve with MAP-T mode [1871]
Fixed handling of initial fragment of UDP and ICMP6 packets on MAP-T border routers when it receives fragments from an IPv6 network [3412]
Fixed a spurious console error when querying MAP data via RESTCONF [4524]
Improved handling of “Packet Too Big” ICMP replies when packets exceed the MTU inside MAP [2987]
Improved handling of “Hop Limit Expires” ICMP replies when packets expire outside of the MAP-T domain [2986]
Improved handling of “Hop Limit Expires” ICMP replies when packets expire at the MAP BR [2984]
Improved handling of “TTL Expires” ICMP replies when packets expire in MAP domain [2985]
Improved handling of “TCP or UDP Packet Outside Allowed Port Range” which now sends ICMP Type 1, Code 5 replies when the source port on a packet is outside of the allowed range [2985]

NACM¶

Fixed default parameters rule for NACM node access-operation and module which now work without explicit settings [2514]
Added NACM support for access restrictions based on path [3523]

NAT¶

Added validation to prevent the use of deterministic nat with incompatible options, such as a pool of IP addresses for NAT [3257]
Fixed dataplane usage of NAT timeouts per protocol [4598]
Fixed handling of icmp protocol in NAT rules [3924]

Warning

Static NAT rules which had local and remote port incorrectly set to 0 would NAT any protocol rather than only being restricted to the protocol on the rule. On upgrade, that behavior will be retained for Non-ICMP rules but the rule will be altered to correctly reflect the protocol of the rule as any. Inspect all static NAT rules after upgrade and correct any rules which do not match their intended configuration.
Improved behavior of NAT session scavenging [3488]
Fixed a dataplane crash when NAT forwarding is enabled in combination with multiple worker threads [3860, 3627]

Neighbors¶

Added validation to prevent configuring neighbors on ipip and gre interfaces which are L3 only [4505, 4552]

Note

Neighbor entries on these interfaces are removed from the configuration database automatically when upgrading the configuration.
Fixed display of IPv6 neighbors [3884]
Added age of neighbor entries to state data [3454, 3241]
Fixed a problem where replacing a dynamic neighbor entry with a static neighbor entry would not properly reflect the change [3807]

NTP¶

Fixed deletion of NTP server default restriction list entries [3413]

RESTCONF¶

Improved RESTCONF responses for leaf nodes with a value of an empty string ("") which now conform to RFC 7951. [3450]
- Empty values of yang type empty are encoded as: {"x":[null]}
- Empty string values are encoded as: {"x":""} (changed from null in clixon 4.0 and [null] in clixon 4.3)
- Empty containers are encoded as: {"x":{}}
- Empty elements in unknown/anydata/anyxml encoded as: {"x":{}} (changed from {"x":null})
Fixed RESTCONF responses containing IETF error types such as application errors so they no longer contain unexpected additional rpc-error JSON keys [3455]
Fixed deleting ACL rule via RESTCONF [2841]
Removed unnecessary system state file operations when performing RESTCONF queries [4469]
Added RESTCONF query to enumerate network and crypto devices available to the dataplane [3463]
Added validation to prevent invalid usage of unspecified list entries [3457]
Fixed a memory leak when querying /restconf/data repeatedly [4507]
Fixed missing interface data when querying /restconf/data [4507]
Fixed adding MACIP rule via RESTCONF [2844]

Services¶

Added commands to separately configure management service instances for host and dataplane namespaces (TNSR Service Namespaces) [3752]
Modified services which support the dataplane to run in the dataplane namespace [3746]

SNMP¶

Fixed spurious cache expired errors from SNMP in messages log [4426]
Added support for enabling coredumps from the SNMP daemon [3879]
Corrected value of sysObjectID to reflect the Netgate OID [3946]

Static Routing¶

Fixed handling of packets when an output interface configured in the routing table is disabled when there are other usable paths to the same destination present [3359]
Added validation to prevent specifying an invalid weight of 0 on static route next hops [4595]
Moved static route next-hop preference to a per-route priority to align with what is supported by host OS routing tables [4479]
Added route lookup function to show route which locates the route TNSR will use to reach a given destination [535]
Fixed IPv6 packet loss observed between TNSR instances [2382]

Dynamic Routing¶

Fixed configuration of dynamic routing debug logging via TNSR CLI [3199, 3939]

Note: Use an absolute path to a log file with the log file command, not a relative path. The file must be writable by the frr user.

BGP¶

Fixed BGP maximum-path option for eBGP and iBGP so they can now be configured simultaneously [2879]
Fixed clixon-backend loading a BGP configuration with 150k advertised prefixes [2784]
Fixed CLI configuration of BGP IPv4/IPv6 multicast address family [3038]
Fixed CLI configuration of BGP dampening values [3057]
Fixed CLI configuration of BGP write-quanta values [3087]
Fixed CLI configuration of BGP confederation identifiers [3210]
Fixed restoration of static routes after failing over to a BGP route [3543]
Added method to specify multiple communities in a single route map [3718]
Fixed missing routes when running BGP over IPsec [3610]
Moved BGP option enforce-first-as from BGP router to BGP neighbor to match the updated location expected by FRR [4520]
Fixed an issue with BGP connections not being re-established after a dataplane restart [4406]
Fixed incorrectly duplicated next-hop entries for multipath routes received via BGP [2935]
Fixed IPv6 BGP session establishing over IPsec or GRE [2429]

OSPF¶

Fixed OSPF default-information originate so that it works with static route 0.0.0.0/0 as default route [2477]
Fixed handling of changes in redistributed kernel routes triggering addition/removal of corresponding OSPF Type-5 LSAs [2389]
Fixed OSPF ignoring interface MTU changes [4442]
Fixed route map configuration to filter redistributed routes into OSPFv3 [3618]
Fixed routing information in the forwarding table not being updated correctly when a static route which overlaps a route received via OSPF was removed [2320]

RIP¶

Fixed CLI tab completion displaying incorrect choices when deleting RIP offset lists [3395]
Fixed key-chain string not being applied in the routing daemon if configured after RIP was enabled [2878]

Updates¶

Added a command to clear the package cache [3530]
Added a command to reinstall a package [2976]
Added parameter expansion to package commands [3529]

VRRP¶

Fixed backup processing of priority 255 advertisements [3782]

VXLAN¶

Fixed VXLAN and OSPF compatibility issues with configuration ordering [2511]

Known Limitations¶

Configuration¶

Restoring a configuration with named interfaces may fail [3913]

Workaround: Configure interface names and restart the dataplane, then restore the configuration.
Removing the startup configuration may retain some active settings, including custom interface names, users added to the operating system, and PKI files [3723]
Configurations from TNSR 19.12 or before with BGP may fail to upgrade properly [3593]

ACLs¶

ACLs used with access-list output do not work on traffic sent to directly connected hosts [2057]

BFD¶

Unable to set delayed option on an existing BFD session [2709]

CLI¶

CLI does not return from shell in certain situations [2651]

Dataplane¶

Systems with multiple CPU sockets using NUMA may experience dataplane issues at startup or when the dataplane is restarted manually [2383]
CLI does not prevent the user from configuring a custom interface name which uses reserved keywords which may cause the dataplane to fail (e.g. span) [3234]
Dataplane may crash on Azure when IPsec peer restarts while an IPsec tunnel is connected [4790]
Dataplane service crashes on attempt to connect to Azure TNSR VM or perform a REST request [3850]
CLI does not prevent a dataplane configuration not supported by certain virtual environments [3674]

Workaround: Enable the desired behavior in the host before attempting to use it in TNSR.
DPDK does not function with Mellanox ConnectX-3 drivers [3781]

GRE¶

Unable to modify GRE tunnel settings [2698]

Host ACLs¶

Sequence numbers displayed in host ACL state data do not match configured values [4789]

Host Interfaces¶

Configuration of host OS interface clears TNSR TAP interface configuration [2640]

Workaround: Remove and reconfigure the TAP interface.
Cannot remove an IP address assigned to a host interface during the installation process from within the TNSR CLI [3013]
Cannot add default gateway or other routes to host routing table from the TNSR CLI [3702]

HTTP Server¶

HTTP server retains old configuration after TNSR services restart [2453]
SSL certificate error when the HTTP server is configured with a certificate that uses md5 digest [2403]

Installer¶

TNSR Install over OOB Management GUI may appear to fail due to the screen saver activating before installation is completed. [3182]

This affects installation using a console such as iDRAC Virtual Media redirector.

Workarounds: Press tab when the screensaver activates. Alternately, use vFlash instead of iDRAC for better performance.