Hi, On Wed, Sep 23, 2009 at 01:06:40PM -0700, Wendy Garvin wrote: > Gert Doering wrote: > > What exactly does this mean? > > > > - there will never be a fixed 12.0, 12.1, 12.2 or 12.3 IOS, and we > > have to upgrade all routers to 12.4 IOS, which is very likely to > > require DRAM and Flash upgrades, and in many cases will mean "end of > > the affected device, forklift upgrade" (because there might not even > > *be* a 12.4 IOS)? > > Each of these releases life cycle is documented in our End of Life > announcements. [..]
Clear words. Unhappy customer.
(Going to 12.4 is painful enough, due to the necessary feature/bug testing
required. But what is much worse is "hardware replacements", due to
hardware that's no longer supported - like various NPEs chugging happily
along in our network. Spending money on forklift upgrades for *working*
hardware due to security bugs in the OS is just not going to make The
People That Make Decisions About Money very happy with This Vendor).
> 12.2 and 12.3 have reached their "End of Software Maintenance Release
> Date" which means we will no longer be releasing scheduled updates.
> However, they have not reached their last date of support, which means
> you can still call in and receive assistance from the TAC. If the TAC
> cannot assist you in deploying workarounds or upgrading to a supported
> version of software, they can work with your account team to request a
> rebuild of 12.2 or 12.3.
Been through that with 12.2S. Takes an eternity plus four months, and is
not a way to handle security issues.
[..]
> It doesn't have the same architecture or support for quality coding
> and secure features that the later releases have.
We *are* talking about IOS, are we? Monolithic, no memory protection,
no restartable processes, no software updates without reboots, helluva
lot of "surprise features" in 12.4T, etc.?
"quality coding", good joke.
[..]
> We are indeed listening. We will consider requests for 12.2 or 12.3
> software on a case by case basis, but we will not be releasing that
> software to a wide distribution. I urge you to work with support staff
> to move to a more current release.
See above. "Case by case" upgrades are just not good enough for such
a widespread bug that affects everything Cisco has ever built.
[..]
> The source and destination address must be the configured tunnel
> addresses. The source address does matter, but it is possible to spoof
> it. The destination address cannot be any address on the box, it must be
> the configured destination address. However, you must take into account
> that the source address could be spoofed.
Now *this* is certainly good news. Since the devices in question (which
can't easily be upgraded to 12.4) only have a single tunnel with a
tunnel destination that is inside our network, anti-spoofing ACLs to
"peers and upstreams" are already in place, and customers get uRPF
anyway.
So we're just not upgrading, and when the hardware breaks, we'll decide
what to buy as a replacement.
gert
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]
fax: +49-89-35655025 [email protected]
pgpIALKNxYe0m.pgp
Description: PGP signature
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
