Cisco IOS Software Release 12.4T Features and Hardware Support [Cisco IOS Software Releases 12.4 T]

Cisco IOS® Software is the world's premiere network infrastructure software, delivering seamless integration of technology innovation, business-critical services, and hardware support. Currently operating on millions of active systems, from small home office routers to the core systems of the world's largest service provider networks, Cisco IOS Software is the most widely leveraged network infrastructure software in the world.

Cisco IOS® Software Release 12.4T integrates a comprehensive portfolio of new capabilities, including security, voice, and IP services, with powerful hardware support to deliver advanced services for Enterprise and access customers.

Release 12.4(20)T adds significant embedded management enhancement, category-based productivity and security ratings support, multi-level Quality of Service (QoS) scheduling, and support for Cisco 860, 880, and 1861 Routers.

Release 12.4(15)T streamlined the Cisco IOS Software upgrade process, provided sub-second link failure detection and faster convergence, delivered next-generation Layer 2-7 flexible packet classification, enhanced intrusion protection (IPS) and SSLVPN capabilities, and support for the new Cisco 7201 Router.

Release 12.4(11)T delivered new Layer 2 VPN transport over MPLS capabilities, enhanced MPLS management, mobile IPv6 authorization and identity support, and support for the high performance Network Processing Engine G2 (NPE-G2) and VPN Service Adapter (VSA) for the Cisco 7200 Series Router.

Release 12.4(9)T delivered improved manageability, integrated IP communications capability, enhanced HTTP and P2P security, and faster routing protocol convergence.

Release 12.4(6)T delivered highly available firewalls, comprehensive endpoint and network security for SSL VPN environments, and optimized bandwidth management for improved VoIP call quality.

Release 12.4(4)T enhanced threat protection against malicious worm and virus attacks, improved performance monitoring of VoIP networks, and extended support for secure concurrent services on the Cisco 1800 Series Router.

1.1) Migration Guide

Cisco recommends that customers running Release 12.3T or 12.3 (or prior) releases upgrade to the latest supported version of Release 12.4T or Release 12.4.

Note: Release 12.3T reached End of Software maintenance on March 15, 2008. For additional information please visit: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8802/ps6947/ps5187/prod_end-of-life_notice0900aecd8052e110.html

Figure 1 illustrates the current migration path from Cisco IOS Release 12.3T and Release 12.3 (or prior) into Release 12.4T or Release 12.4.

Figure 1. Release 12.4T Migration Plan

Customers interested in upgrading to Release 12.4T or Release 12.4 (or successor releases when they become available) should determine their functionality needs and choose the appropriate release.

Note: Cisco IOS Software Release 12.4(20)T and later IOS T releases will not support several Cisco hardware platforms that were supported in prior Release 12.4T releases. These platforms will be supported by Release 12.4(15)T via regularly scheduled software maintenance rebuilds and bug fix support until the end of software maintenance date for the respective platform is reached.

• Cisco SOHO 90 Series

• Cisco 831, 836, and 837 Series

• Cisco 1701, 1711, 1712, 1721, 1751, 1751-V, and 1760 Series

• Cisco 2610XM-2611XM, 2620XM-2621XM, 2650XM-2651XM, and 2691 Series

• Cisco 3631 and 3660 Series

• Cisco 3725 and 3745 Series

• Cisco 7400 Series

• Cisco AS5850 Universal Gateway

For more information refer to the following product bulletin: http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8802/ps6968/ps6441/product_bulletin_c25_466578.html

Figure 2 below illustrates the relationship between Release 12.4T and Release 12.4

Figure 2. New Technology (T) and Maintenance Release Relationship

The Cisco release delivery process, rigorous software testing, and regularly scheduled software maintenance results in significant incremental enhancements and improvement to the quality, stability, and resiliency of Cisco IOS Software Release 12.4T and Release 12.4.

1.2) Release 12.4T Additional Information

• Release 12.4T

Cisco IOS Software Releases 12.4 T-Products & Services-Cisco Systems

• Cisco IOS Software Product Lifecycle Dates & Milestones, Product Bulletin No. 2214

http://www.cisco.com/en/US/products/ps6441/prod_bulletin0900aecd801eda8a.html

• Changes to Cisco IOS Software Product Support in Release 12.4T, Product Bulletin No. 3000

http://www.cisco.com/go/124thardware/

• Cisco IOS Software Download Center

Download Cisco IOS Software releases and access software upgrade planners.

http://www.cisco.com/public/sw-center/sw-ios.shtml

• Cisco Feature Navigator

A web-based application that allows you to quickly match Cisco IOS Software releases to features, to hardware.

http://www.cisco.com/go/fn/

• Cisco Software Advisor

Determine the minimum supported software for selected hardware.

http://tools.cisco.com/Support/Fusion/FusionHome.do

• Cisco IOS Upgrade Planner

View all major releases, hardware, and software features from a single interface.

http://www.cisco.com/pcgi-bin/Software/Iosplanner/Planner-tool/iosplanner.cgi

1.3) Cisco IOS Packaging

Figure 3. Cisco IOS Packaging for Cisco Routers

2) Release 12.4(20)T Highlights

Table 1. Release 12.4(20)T Feature Highlights

2.1) Cisco IOS Security

2.2) Cisco IOS Infrastructure

2.3) MPLS

2.4) Quality of Service

2.1.1) Group Encrypted Transport VPN (GET VPN) Support for the Cisco VPN Services Adapter (VSA) for Cisco 7200 NPE-G2 Series Routers

2.1.2) Cisco IOS Content Filtering

2.1.3) VRF-Aware Cisco IOS Intrusion Prevention System (IPS)

2.1.4) User-based Cisco IOS Firewall

2.1.5) Application Inspection and Control for Simple Mail Transfer Protocol (SMTP)

2.1.6) Cisco IOS Firewall Support for Skinny Local Traffic

2.1.7) Cisco IOS Firewall Session Initiation Protocol (SIP) Application Layer Gateway (ALG) Enhancements

2.1.8) Cisco IOS Firewall H.323 Version 3 (v3) and Version 4 (v4) Support

2.1.9) Instant Messaging Blocking Support in Cisco IOS Firewall for "I Seek You" (ICQ) and Windows Messenger

2.1.10) Object Groups for Access Control Lists (ACLs)

2.1.11) Cisco IOS SSL VPN Access Control Enhancements

2.1.12) Cisco IOS SSL VPN AnyConnect Client Support

2.1.13) Cisco IOS SSL VPN Back End HTTP Proxy

2.1.14) Cisco IOS SSL VPN Full-Tunnel Performance Enhancements

2.1.15) Cisco IOS SSL VPN URL Split Rewrite Support

2.1.16) Next Hop Resolution Protocol (NHRP) MIB for Dynamic Multipoint VPN (DMVPN)

2.1.17) IPv6 Over Dynamic Multipoint VPN (DMVPN) Support

2.1.18) Group Encrypted Transport (GET) VPN Support for VRF-Lite

2.1.19) Cisco Tunnel Control Protocol (cTCP) Support on Easy VPN Hardware Clients

2.1.20) IPSec Usability Enhancements

2.1.21) Secure Shell Protocol Version 2 (SSHv2) Feature Enhancements

2.1.22) Command Line Interface (CLI) for Displaying Certificates

2.1.23) CLI to Control Certification Revocation List (CRL) Cache

2.1.24) Secure Device Provisioning (SDP) Connect Template

2.2.1) Cisco Express Forwarding Scalability and Selective Rewrite (CSSR)

2.2.2) Network Time Protocol (NTP) Version 4

2.3.1) Cisco IOS MPLS Label Distribution Protocol (LDP) Enhancements

2.3.2) Cisco IOS MPLS Traffic Engineering and Resource Reservation Protocol (TE/RSVP)

2.4.1) Cisco IOS QoS: Hierarchical Queuing Framework (HQF)

2.4.2) Resource Reservation Protocol (RSVP) Penultimate Hop Overwrite

2.5) IP Version 6

2.6) Embedded Management

2.7) Hardware

2.8) Voice

2.5.1) IPv6 VPN Provider Edge Router (6VPE) over MPLS

2.5.2) IPv6 Access Control List (ACL) enhancements for IPv6 IPSec Authentication Header (AH)

2.5.3) Mobile Network v6-Basic NEMO Support

2.6.1) Cisco IOS Service Diagnostics

2.6.2) Embedded Event Manager Version 2.4

2.6.3) Cisco IOS Embedded Packet Capture

2.6.4) Flexible NetFlow (FNF) Exporter-Outgoing Features Support

2.6.5) Flexible NetFlow for IPv6

2.6.6) Deprecating NetFlow for IPv6 Record

2.7.1) Cisco 1861 Integrated Services Router

2.7.2) Intrusion Prevention System (IPS) Advanced Integration Module

2.7.3) Cisco 860 and 880 Series Routers

2.7.4) Cisco Business-Class IAD880 Series Integrated Access Devices

2.8.1) Communications Manager Express (CME) 7.0 Voice Features

2.8.2) Survivable Remote Site Telephony 7.0 Voice Features

2.8.3) Cisco Unified Border Element (CUBE) 1.2

2.8.4) Voice Quality Improvements on Cisco VoIP Gateways

2.1) Cisco IOS Security

2.1.1) Group Encrypted Transport VPN (GET VPN) Support for the Cisco VPN Services Adapter (VSA) for Cisco 7200 NPE-G2 Series Routers

Cisco IOS Release 12.4(20)T adds GET VPN support for the Cisco VSA, the latest high-performance encryption and key-generation services module for IPSec VPN applications on Cisco 7200 NPE-G2 Series Routers.

GET VPN offers a new standards-based IP Security (IPSec) security model that is based on the concept of "trusted" group members. Trusted member routers use a common security methodology that is independent of any point-to-point IPSec tunnel relationship. GET VPN simplifies securing large Layer 2 or MPLS networks requiring partial or full-mesh connectivity.

Benefits

The VSA offers increased IPSec performance over the Cisco VPN Acceleration Module 2+ (VAM2+) module.

Hardware

Routers

• Cisco 7200 NPE-G2 Series Routers

Additional Information:

http://www.cisco.com/go/vsa

http://www.cisco.com/go/getvpn

Product Management Contact: ask-stg-ios-pm@cisco.com

2.1.2) Cisco IOS Content Filtering

Cisco IOS Content Filtering offers category-based productivity and security ratings. Content-aware security ratings protect against malware, malicious code, phishing attacks, and spyware. URL and keyword blocking help to ensure that employees are productive when accessing the Internet. This is a subscription-based hosted solution that leverages Trend Micro's global TrendLabs™ threat database, and is closely integrated with Cisco IOS Software. It is supported on routers running the Advanced Security image. Feature licenses can be purchased directly from the Cisco.com ordering tool or through your Cisco partner/account team.

Figure 4. IOS Content Filtering Use Case Scenario

Benefits

• Secures Internet access to branch, without the need for additional devices

• Controls spyware and malware at the remote site; conserves WAN bandwidth

• Improves employee productivity and protects network resources by enabling content filtering

Hardware

Routers

• Cisco 800, 1800, 2800, and 3800 Series Routers

Additional Information: http://www.cisco.com/go/ioscontentfiltering

Product Management Contact: ask-stg-ios-pm@cisco.com

2.1.3) VRF-Aware Cisco IOS Intrusion Prevention System (IPS)

VRF-Aware Cisco IOS IPS allows Enterprises or service providers to put different groups of users or network segments into separate Virtual Routing and Forwarding (VRF) groups and to configure IPS on only certain VRFs or to configure IPS differently on each VRF. Divisions or functional groups separated by VRF segments may have different threat protection needs. Examples include:

• Vendor-provided applications vs. native applications

• Administrative users vs. regular employees vs. contractors/guests

• Vendor (photo shop, deli, pharmacy, etc.) network vs. point-of-sale network

• Students vs. faculty members vs. school administration

VRF-aware Cisco IOS IPS will also enable network security operators to distinguish between the IPS event alarms generated within each user group or network segment based on their VRF ID.

Figure 5. Typical Use Case for VRF Aware Cisco IOS IPS

Benefits

• Allows the configuration of IPS on only certain virtual network segments (VRFs) or in a different way on each VRF

• Distinguishes between IPS alarms/events generated within each group (VRF segment) based on VRF ID

• Supports IPS on VRF interfaces in addition to physical interfaces with or without overlapping IP addresses

Hardware

Routers

• Cisco 800, 1800, 2800, 3800, and 7200 Series Routers

Additional Information: http://www.cisco.com/go/iosips

Product Management Contact: ask-stg-ios-pm@cisco.com

2.1.4) User-based Cisco IOS Firewall

Cisco IOS Firewall offers the ability to deploy secure access policies at all network interfaces: Internet perimeter, remote-site connectivity, business-partner access, and telecommuter connections. User-based Cisco IOS Firewall dynamically binds unique zone-based firewall policies to a group where members, regardless of IP address entry point, are authorized using authentication proxy or Network Admission Control (NAC).

Figure 6. User based Cisco IOS Firewall Example

Benefits

• Facilitates the support of Enterprise mobile workers where user access is dynamic, while maintaining source IP address and user group associations

• Secures granular access to the branch, without the need for additional devices

• Enforces non-intrusive, per-user security policies

Hardware

Routers

• Cisco 800, 1800, 2800, 3800, 7200 Series, 7301 Routers

Additional Information: http://www.cisco.com/go/iosfw

Product Management Contact: ask-stg-ios-pm@cisco.com

2.1.5) Application Inspection and Control for Simple Mail Transfer Protocol (SMTP)

Cisco IOS Firewall Application Inspection and Control (AIC) has expanded the SMTP capability to support a more detailed inspection, providing more control over how SMTP inspection is performed.

Benefits

• Inspects SMTP at a more granular level

• Scans actual e-mail data like attachment types and encoding types

• Detects a limited number of attack signatures

• Ability to use signatures in SYSLOG message alerts to warn of a possible attack, such as the detection of illegal SMTP commands in a packet

Hardware

Routers

• Cisco 800, 1800, 2800, 3800, 7200, and 7301 Series Routers

Additional Information: http://www.cisco.com/go/iosfw

Product Management Contact: ask-stg-ios-pm@cisco.com

2.1.6) Cisco IOS Firewall Support for Skinny Local Traffic

Cisco IOS Firewall enhances Skinny Local Traffic support. This feature offers inspection for locally generated and locally terminated SKINNY protocol data in two main deployment scenarios:

1. Cisco Call Manager Express (CME) is enabled on the Cisco IOS Firewall and manages the VoIP phones using SCCP over intranet or Internet.

2. Analog and VoIP phones are connected and managed by the Cisco IOS Firewall-enabled CME router.

Benefits

• Improves user groups SCCP locally generated traffic support

• Provides inspection of CME using SCCP over the intranet/Internet

Hardware

Routers

• Cisco 800, 1800, 2800, 3800, 7200, and 7301 Series Routers

Additional Information:

Hierarchical Navigation

Cisco IOS Software Releases 12.4 T

Cisco IOS Software Release 12.4T Features and Hardware Support

Downloads