Sensor Management 25.07.1-LTS Docker Release Notes

Overview

Cisco is pleased to announce the 25.07.1-LTS Docker release of Sensor Management (formerly Legacy Orchestrator). These release notes cover the new features and corrected issues for this release. Read the release notes before installing this version.

For further information, questions, or clarifications regarding this release, please contact the Technical Assistance Center (TAC) at https://mycase.cloudapps.cisco.com/case.

The following topics are addressed in this document:

• New Features and Enhancements: Covers the new features and enhancements introduced in this release.
• Corrected Issues: Lists issues that have been corrected in this version of the software.
• Technology Support: Covers the applicable product information.
• Migration Considerations: Details the supported migration paths for this release.
• Operational Considerations: Covers general limitations of the current release.
• Lifecycle: Lists the planned lifecycle dates of this software release.

For more information, see the Sensor Management documentation.

New Features and Enhancements

Sensor Management 25.07.1-LTS Docker introduces the following features and enhancements.

NBAPI Now Accessible via HTTPS Only

Sensor Management 25.07.1-LTS Docker no longer supports HTTP on port 9080 for the Northbound API (NBAPI). NBAPI is now accessible exclusively over HTTPS on port 9081.

Mandatory Password Change on First Login

After a fresh installation, the admin and view user accounts are required to change their passwords on first login through the web interface. CLI and REST API access for these accounts is unavailable until the password change is completed.

Security Hardening for Critical Data Protection

Sensor Management 25.07.1-LTS Docker introduces the following enhancements to protect critical configuration data:

• The SFTP key in the web interface is now visible only to users with the admin role.
• Database backup files are now encrypted and decrypted using a public/private key pair.

X.509 Certificate Validation

Sensor Management 25.07.1-LTS Docker now validates X.509 certificates in the following contexts:

• Authentication: The Zitadel server certificate is validated before users are redirected to the login page.
• Reverse proxy: The device server certificate is validated when using the reverse proxy feature.

Zitadel Authentication Support

The Sensor Management web user interface supports ZITADEL-based user authentication.

See Configure User Authentication on Docker for details.

STIG CAT-I Syslog Transfer

Sensor Management 25.07.1-LTS Docker supports dual-destination syslog transfer in compliance with Security Technical Implementation Guide (STIG) Category I (CAT-I) requirements.

FIPS Mode Support

Sensor Management 25.07.1-LTS Docker supports Federal Information Processing Standards (FIPS) mode, enabling deployment in security-restricted environments that require FIPS-validated cryptographic modules.

Support for Legacy Device Versions

Sensor Management 25.07.1-LTS Docker supports legacy device versions 7.9.6 and earlier when FIPS mode is disabled.

Updated User Interface Branding

The Sensor Management web interface has been updated to reflect the Cisco Crosswork Assurance brand name.

Support for Ubuntu 24.04 LTS and RHEL 9.6 Host Operating Systems

Sensor Management 25.07.1-LTS Docker supports Ubuntu 24.04.4 LTS and Red Hat Enterprise Linux (RHEL) 9.6 as qualified host operating systems.

Optimized Connection Termination (UI, API, CLI)

Users can configure session timeout settings for the Web UI, API, and CLI directly within the Sensor Management Web UI to better align with your security and resource management requirements.

• Web UI, API, and CLI sessions will automatically log out after 5 minutes of inactivity.
• The default session timeout in Sensor Management is 5 minutes.
• Users can change the timeout value to 30, 60, 90, or 120 minutes from the Sensor Management Web UI.

Note: Users must log out and log back in for the new timeout value to take effect.

See Manage User Accounts for more information.

Crosswork Assurance Sensor Compatibility

Sensor Management 25.07.1-LTS Docker has been enhanced to be backward compatible with Crosswork Assurance Sensors, including release 25.07.4 for Cisco GT/GT-S, LT-S, and LX-S.

See the Cisco GT/GT-S, LT-S, and LX-S 25.07.4 Release Notes for more information.

Crosswork Assurance Sensor Control Compatibility

Sensor Management 25.07.1-LTS Docker has been enhanced to operate with Sensor Control, including release 25.07.4.

See the Assurance Sensor Control 25.07.4 Release Notes for more information.

Corrected Issues

The following key issues have been addressed in Sensor Management 25.07.1-LTS Docker.

Measurements and Sessions Omitted from CSV When Roundtrip Delay Is Enabled

When a TWAMP Light Stateful session used the Roundtrip (RT) delay feature and the reflector became unavailable (error 3307, Zero packets received), Sensor Management stopped exporting that session to CSV output. The session now correctly appears in CSV with 100% packet loss measurements.

CSV Export File Names Now Include UTC Timezone Indicator

CSV export file names previously used a timestamp with no timezone indicator, which caused ambiguity when the host ran a non-UTC timezone. File names now append a Z suffix to explicitly indicate UTC (for example, _09h35m01sZ_), consistent with ISO 8601 format.

Technology Support

Software files are available from the Cisco Software Download page. You must sign in with valid customer credentials to access the page.

The following table lists key functionality of Crosswork Assurance Sensors, Sensor Control, Cisco Assurance Modules, and Cisco Assurance SFPs supported by Sensor Management 25.7.

Supported in Sensor Management Version 25.07.1-LTS

* CLI step support for Device Commissioning

Migration Considerations

Sensor Management 25.07.1-LTS Docker does not support in-place upgrades from previous releases. You must perform a fresh installation on Ubuntu 24.04 or RHEL 9.6 and migrate your data from the existing system.

The following migration paths are supported:

• VM 23.12.3 or 23.12.4 → Docker 25.07.1-LTS
• Docker 24.09 or 24.09.1 → Docker 25.07.1-LTS

For detailed migration procedures, see Migrating Sensor Management.

Operational Considerations

Docker Environment Guidelines

The engineering guidelines of the product must be respected. The Docker host must meet the requirements stated in Sensor Management Docker Deployment.

Failure to respect these engineering settings can lead to application downtime and possible data loss.

The Docker host configuration related to interface IP addresses, hostname, NTP server, additional disks (add, format, mount), is configured via standard command of Ubuntu without any procedure or script to support them.

Device Interoperability

The following section details the firmware releases that are known to interoperate with this release of Sensor Management. Please refer to the Sensor Management Administrative Operations documentation for a listing of supported functions for each firmware version.

For the releases mentioned below, support for maintenance releases is also included.

FIPS Mode Enabled

FIPS Mode Disabled

Note: Sensor Management 25.07.1-LTS Docker cannot manage Flex 25 and Flex 100 devices due to SSH key exchange algorithm incompatibility.

Reverse Proxy Access for Older Devices on Non-FIPS Systems

On non-FIPS systems, reverse proxy access to older devices (TE, NE, VFS, VFS10G, and GT/LT/GX version 7.2 and earlier) may fail due to certificate compatibility issues. Manual certificate configuration is required to restore access.

For more information, see Enable Reverse Proxy Access for Older Devices.

HTTP Interface Deprecation

The HTTP interface for Sensor Management is no longer supported for GUI operations or REST and XML APIs. Web service clients must transition to the secure HTTPS protocol.

Customers currently using HTTP on port 6080 will be automatically redirected to HTTPS on the same port, meaning no firewall changes are required. To ensure a secure and seamless experience, access Analytics directly via the Open Crosswork Assurance button located within the Sensor Management interface. Please update any existing bookmarks or client applications to utilize the HTTPS protocol to maintain full security and functionality.

Disk Sizing for New Installations

The default image size for is 150 GiB. This image is large enough to support small networks of under 100 network elements and 1,000 performance sessions. For larger networks, the disk size of the image must be increased. This can be achieved via VMware and KVM management tools.

Example disk sizing:

• For 5,000 elements and 20,000 performance sessions with Round trip delay mode disabled: 370 GiB is recommended
• For 5,000 elements and 20,000 performance sessions with Round trip delay mode enabled: 430 GiB is recommended
• For 52,000 performance sessions with Round trip delay mode disabled: 482 GiB is recommended
• For 52,000 performance sessions with Round trip delay mode enabled: 638 GiB is recommended
• For 125,000 performance sessions with Round trip delay mode disabled: 920 GiB is recommended
• For 125,000 performance sessions with Round trip delay mode enabled: 1295 GiB is recommended

Please consult the Sensor Management documentation for sizing guidelines and for procedures on how to increase the disk size.

IPv4 Addresses for Hot Standby

The hot standby feature requires the use of IPv4 addresses for its configuration. For planning purposes, it should also be noted that hot standby configuration requires three (3) distinct subnets for the management, data replication, and heartbeat functions.

IPv6 addresses can be used in addition to these IPv4 interfaces for connectivity to the application interfaces (web and REST APIs) and devices being managed. IPv4 addresses are only required strictly for the hot standby functions.

If you wish to make use of this feature, please contact your Solution Engineering representative to initiate network planning activities.

Telnet Support

Telnet support has been removed from the product. Existing Telnet sessions must be migrated to SSH before upgrading.

REST API Endpoint Deprecation

The /nbapiemswsweb/rest/perf-sessions REST API endpoint has been deprecated. This endpoint provided access to a list of active performance sessions as seen by the Legacy Orchestrator.

This endpoint is to be considered capped. Any new features pertaining to performance session management will be implemented using the /nbapiemswsweb REST endpoint in future releases.

CLI Additions and Changes

The CLI command set of the appliance monitor interface was enhanced to duplicate the mgr-commands that are present in the SkyLIGHT Director Manager module.

These commands were preserved in a backwards compatible fashion to allow customers familiar with the Manager Module command set to migrate to the Legacy Orchestrator.

This command set is to be considered capped; no new features will be developed on the CLI functionality.

Browser Support Limitations

The minimum recommended screen resolution to operate Sensor Management is 1360 x 768. Lower resolutions will not provide an optimal experience.

Performing a zoom on your display is not recommended due to incompatible implementations with browsers. If a zoom must be applied, please use a Firefox browser as it has the most standard support for this function.

Due to issues with browser compatibility mode and web sockets, Internet Explorer is no longer supported. Please use Google Chrome (version 70 or higher) or Firefox (version 52 or higher) to access the Sensor Management web interface.

For Windows users, it is also recommended to leave the scale and layout option of the Display settings at a value of 100%.

Restoring Virtual Machine Configuration Backups

Configuration backups of the virtual machine (done via the configuration export command) are not portable from release to release. That is to say, a configuration backup from a 1.6 system should not be used to restore a 19.12 system. Unexpected behavior may occur.

Please ensure that configuration backups are restored on systems running the same release from which the backup was taken.

Metrics Collection CSV Filename Timestamp

In order to align with the CSV filename convention of all other Crosswork Assurance products (Sensor Control and Crosswork Assurance Sensors), this naming strategy is changed in Legacy Orchestrator. The timestamp in the CSV filename represents the time when the file was created.

In all cases, the timestamps of the metrics themselves (present within the content of the file) represent the time of when the metric was produced. Only the timestamp contained in the CSV filename is impacted by this change.

Vision Collect Streaming Limitations on 6.4.1.2 and 6.4.2

When using release firmware 6.4.1.2 with Vision Collect, a disconnection from Legacy Orchestrator may incur data loss. The data retention periods are not respected and data loss can occur after a few seconds of disconnection.

When using firmware release 6.4.2 in Skylight elements in high resolution mode with packet loss greater than 10% of the management network, some reporting periods may be lost. Please ensure a reliable management network is in place.

These issues are corrected in Skylight element firmware releases 6.4.3 and higher.

The First Result Records for a New Session Are Skipped by CSV Export

When the CSV producer detects a new performance session, it marks its data for extract from the first time it views the session. If the CSV producer is configured to run every five (5) minutes, this can mean that the first five minutes of result data for a new session will not be exported.

This is expected behavior; all performance data after this initial detection phase will be captured by the CSV producer.

Number of Acceptable Firmware Loads

Before upgrading or starting app_server, you must validate the number of acceptable firmware loads based on the specific profile of the system and upgrade version.

Legacy Orchestrator Profile and Acceptable Firmware Loads

Note: When the requirements from the table above are met, the upgrade can be performed and the system will restart. After the system restarts, the partition can be checked. The partition must have at least 1 GB of free space remaining.

For more information, see Sensor Management Docker Deployment Profile Configuration.

Result Records for Sync Sessions Are Not Exported in Real Time

Sync sessions are not properly aligned with CSV export. Results are not being exported in real time as Sensor Control is delivering measurement results and Legacy Orchestrator is generating CSV files at the exact same time.

If the CSV producer is configured to run every five (5) minutes and sync session has five (5) minute interval, this can indicate that result data for that session will be exported five minutes late.

Memory Limitations

In the event of an excessive number of simultaneous commands being executed, it is recommended that JVM memory be increased.

FTP Support

Support for the FTP transfer method has been removed for the functions below:

• CSV export
• Inventory export

Please ensure the FTP export method is not used on Inventory Export and CSV Export before upgrading.

Device Password Management Considerations

When supporting or upgrading devices, be aware of password management requirements and potential limitations that may affect device access and integration.

• When supporting Sensor Control 24.09 or later and Crosswork Assurance Sensors 24.07 or later, users may not be aware when a device password change is required. As a result, the device may remain in-service but not function properly because most commands are disabled in Sensor Management. To change the password, users must either manually access the device(s) via Web GUI or CLI or follow the procedure in Changing Default Password for Devices to update the password via CLI set on Sensor Management.
• When either Sensor Control or Crosswork Assurance Sensors running version 25.07 or later has an expired password, the device will be out of service, and users may not be notified in advance. To change the password, access the device directly (via Web GUI or CLI). Alternatively, you can disable the password policy. Disabling the policy prevents password expiry for the credential being used to manage the device on Sensor Management.
• It is not possible to change the password for Sensor Control or Crosswork Assurance Sensors running version 25.07 or later during the first login if accessing through a reverse proxy. To change the password, access the device directly (via Web GUI or CLI) or follow the procedure in Changing Default Password for Devices to update the password via CLI set on Sensor Management.

Device Onboarding Limitation

When onboarding devices with firmware version 25.7 or later, do not onboard more than 200 devices at a time. Onboarding more than 200 devices concurrently may result in intermittent failures for some of these devices. To avoid issues, split large onboarding operations into batches of 200 devices or fewer.

Data Rewinds

When performing a data rewind operation in Sensor Management, ensure that Analytics has fully processed the current data before initiating another rewind.

For optimal results, avoid performing multiple large rewinds in quick succession.

For small deployments, it is recommended to limit rewinds to a single 7-day period at a time as this helps ensure system stability.

Refer to the Sensor Management Docker Deployment documentation for sizing guidelines.

Authentication and Session Management

When a session timeout occurs, the authentication token may not be properly released. If you reload the page, you may still be logged in.

To ensure session termination and maintain system security, always log out before leaving your workstation unattended.

Lifecycle

This section lists the planned lifecycle dates of this software release. See the table below outlining the following milestones: