Assurance Sensor Control Release Notes 24.11

These release notes cover the requirements, new features, changes, and corrected issues for the Assurance Sensor Control version 24.11. Read all release notes before installing this firmware version.

Requirements

This firmware version applies to Assurance Sensor Control.

Note: This firmware release includes the images needed to deploy the Assurance Sensor Control using a KVM or VMware Hypervisor, as well as the .afl upgrade file that is typically part of an Assurance Sensor Control release.

Assurance Sensor Control 24.11 requires Skylight orchestrator 23.12 or newer.

Important: In Sensor Control 24.11, remote device upgrades from firmware versions before the VCX 2.2 FWSuite (FWSUITE_VCX_2.2_10190) have been blocked to protect against a potential complete loss of connectivity/functionality that cannot be recovered. To upgrade a remote device from an older FWSuite version, an older version of Sensor Control must be used to first upgrade the remote device to FWSUITE_VCX_2.2_10190.

Upgrade Considerations

Upgrading the Sensor Control firmware version does not automatically upgrade the remote device firmware suite.

As of Sensor Control 22.12, you can use remote devices that have older firmware suite versions with the current release. For this release, the supported remote device firmware suite starts with version 22.06.

Caution: The upgrade process was hardened in VCX 2.7. Under specific circumstances, the remote device upgrade can still fail. This happens if the remote device management is lost, and the remote device performs an automatic rollback. The remote device can brick if the power is lost in a critical short period. This was seen in a lab environment only and never reported by a customer.

Before doing the upgrade, it is recommended to enable Extra Reconnection Delay with the previous release (refer to the Assurance Sensor Control user manual section “Adding Remote Devices” for more details on how to enable Extra Reconnection Delay).

The downgrade is still executed using the previous software that still has the update process deficiencies. The downgrade can still cause remote devices to fail and should be avoided at the exception of VCX 2.5.0.2 and VCX 2.6.0.1 for which the downgrade is supported without issue.

It is not recommended to change any other remote device configuration when operating with a different firmware version. Changing the configuration can result in unknown behavior. A factory reset using the Module Dock may be required in some cases. In a future release, Sensor Control software will prevent changing configuration for remote devices running a different firmware version.

For cases where all remote devices cannot be upgraded at the same time, it is recommended to run different Sensor Control instances with different software versions. Remote devices to be upgraded should be moved between Sensor Controls. When downgrading Sensor Control software, the remote devices firmware version shall also be downgraded. The downgrade process shall follow these steps to successfully downgrade Sensor Control software and remote devices firmware. Note that downgrades are not recommended (see Caution above).

Downgrade is not permitted for identical firmware suites. For example, the Sensor Control prevents downgrading the remote device firmware suite from version 24.11 to 24.09, as these versions are identical.

System Capabilities

The Sensor Control offers the following system capabilities:

New Features

This Assurance Sensor Control release introduces the following new features and enhancements.

Application and Interface Security

Cisco application and interface security requirements, including:

• Control debuggers (CT1127: SEC-CSP-NOCDBG-2)

• Use HTTP Strict Transport Security (CT1652: SEC-HTP-HSTS-2)

• Validate all input before processing it (CT1735: SEC-VAL-CLNIN)

• Protect command processors from injection vulnerabilities by preventing the execution of arbitrary commands or code (CT1750: SEC-VAL-INEVAL-2)

• Prevent CSRF Vulnerabilities (CT1742: SEC-WEB-CSRF-3)

• Disable Unused HTTP Methods (CT1553: SEC-WEB-HTTPMETH-2)

• Avoid Open Redirects (CT522: SEC-WEB-NOREDIR)

• Specify type and encoding in HTTP responses; disable type sniffing (CT1665: SEC-WEB-RESP-3)

• Pass sensitive information only in request body or headers (CT1710: SEC-WEB-URLPARM-2)

• Prevent cross-site scripting vulnerabilities (CT2120: SEC-WEB-XSS-4)

• Prevent Click-Jacking (CT1711: SEC-WEB-CLCKJACK-2)

• Use secure Session Tokens (session IDs/state tokens) (CT1935: SEC-WEB-ID-4)

• Do not permit undocumented ways of gaining access to the offering (CT1901: SEC-CRE-NOBACK-2 (Disable backdoors/debug shell)

Remote Device Port Index in CFM Down Trap for VCA VLAN

The Connectivity Fault Management (CFM) down trap for the VCA VLAN method now includes the remote device port index. This enhancement aids in identifying the specific port that experienced a connectivity issue.

Stream Reflector Show Config CLI

The stream reflector show config CLI command displays reflector configuration without any other session information.

Corrected Issues

This Assurance Sensor Control release corrects the following issues:

Unable to Change SFP Port Speed to 100Mbps

In releases prior to 24.09, there is a misleading option to set the SFP port speed to 100Mbps for the Sensor Module. Despite this setting, the port continued to operate at 1G.

The Sensor Module does not support 100Mbps on the SFP port. Attempting to set this speed via CLI now results in an error message indicating that the operation is not supported.

VCE Error Due to Remote Device Name Length

The Module Dock permits the configuration of a remote device name exceeding 25 characters. This results in the Sensor Control being unable to create a VCE with the specified remote device.

CLI Not Prompting for Change Password in Factory Default State

When logging in initially via CLI while the unit is in factory default state, the user is not prompted to change the default admin password.

Missing User Permission Checkbox on the Users page

When adding or editing a user in the Users page of the Management Web Interface, the checkbox for user permission does not display.

About Page Removed

The About page, when accessed via the Web Management Interface, shows outdated versions for OpenSSL and Dropbear. The About page has now been removed

VCE Gateway Not Displayed in Web Management Interface

When creating a VCE with an IPv6 address and default gateway, the Web Management Interface fails to display the gateway address.

Release 24.11 Lifecycle

This section lists the planned lifecycle dates for this release.