Re: Getting Off the Patch

[Valdis.Kletnieks () vt edu]

On Thu, 20 Jan 2011 13:06:16 +1100, Pete Smith said:
> Can anyone seriously say that they patch every time Cisco releases a new
> version of IOS?

Running the latest-and-greatest IOS in production is pretty much a sign that
you're not a very large network provider, or don't intend on staying a large
network provider.

IOS is generally acknowledged to be a steaming morass of bugs, so most sane
users of Cisco gear will find a version that provides most of the features they
need and the least number of SLA-invoking issues, stick with it, and pray.  By
the time you fight through all the "this version won't boot on a 6509 with a
SUP2, and this other version will boot with a SUP2 but won't do MPLS to a Juniper at
the other end unless the line card is between EC levels x and y, except if you
turn on IPv6, in which case you need to be between EC levels y and z *and* have
at least 32M more space available on the itty-bitty flash card and an
additional 64M of RAM if you have a full BGP feed, but 4M additional RAM if you
don't", your eyes are glazed over and you're actually glad when you see that
a security fix is only shipping on the T train and not the S train, so you have a
legitimate reason to not try to get it to run on your S-train boxes....

(You think I'm kidding? Look at the thread starting here:
http://www.mail-archive.com/cisco-nsp () puck nether net/msg29241.html

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/