Cisco Application Policy Infrastructure Controller Release Notes, Release 5.1(1)

May 1, 2024

In the Miscellaneous Compatibility Information section, removed the older CIMC releases to reduce the clutter.

August 1, 2022

In the Miscellaneous Compatibility Information section, added:

■        4.2(2a) CIMC HUU ISO (recommended) for UCS C220/C240 M5 (APIC-L3/M3)

■        4.1(2k) CIMC HUU ISO (recommended) for UCS C220/C240 M4 (APIC-L2/M2)

June 30, 2022

In the section Miscellaneous Compatibility, added information about Cisco Nexus Dashboard Insights creating the cisco_SN_NI user.

March 21, 2022

In the Miscellaneous Compatibility Information section, added:

■        4.1(3f) CIMC HUU ISO (recommended) for UCS C220/C240 M5 (APIC-L3/M3)

February 23, 2022

In the Miscellaneous Compatibility Information section, added:

■        4.1(2g) CIMC HUU ISO (recommended) for UCS C220/C240 M4 (APIC-L2/M2)

November 15, 2021

In the Open Issues section, added bug CSCvy17504.

November 2, 2021

In the Miscellaneous Compatibility Information section, added:

■        4.1(3d) CIMC HUU ISO (recommended) for UCS C220/C240 M5 (APIC-L3/M3)

July 28, 2021

In the Changes in Behavior section, added:

■        The SQL database is no longer persistent during ungraceful reloads of the switches. Examples of ungraceful reload include kernel panics and forced power cycles. In the event of an ungraceful reload, the switch will reboot as stateless and must re-download its policies from the Cisco APIC. Graceful reloads, such as manual reloads and hap-resets, are still stateful and the switch will main-tain its database across the reload.

July 26, 2021

In the Miscellaneous Compatibility Information section, the CIMC 4.1(3c) release is now recommended for UCS C220/C240 M5 (APIC-L3/M3).

May 17, 2021

In the Changes in Behavior section, added:

When the same subnet is configured under both a bridge domain and an EPG, the scope such as "Advertised Externally" and "Shared between VRFs" must match. Configurations with a mismatched scope are rejected beginning in releases 4.2(6d) and 5.1(1).

March 11, 2021

In the Miscellaneous Compatibility Information section, for CIMC HUU ISO, added:

■        4.1(3b) CIMC HUU ISO (recommended) for UCS C220/C240 M5 (APIC-L3/M3)

Changed:

■        4.1(2b) CIMC HUU ISO (recommended) for UCS C220/C240 M4 (APIC-L2/M2) and M5 (APIC-L3/M3)

To:

■        4.1(2b) CIMC HUU ISO (recommended) for UCS C220/C240 M4 (APIC-L2/M2

March 9, 2021

In the New Software Features section, added:

UCSC-PCIE-IQ10GC Intel X710 Quad Port 10GBase-T network interface card support

February 3, 2021

In the Miscellaneous Compatibility Information section, for CIMC HUU ISO, added:

■        4.1(2b) CIMC HUU ISO (recommended) for UCS C220/C240 M4 (APIC-L2/M2) and M5 (APIC-L3/M3)

December 15, 2020

In the Changes in Behavior section, added the following text:

The "ip" attribute of the fvCEp class has been deprecated. IP addresses are now represented as fvIp children of fvCEp.

October 22, 2020

Release 5.1(1h) became available.

Enhancements to the upgrade process through the GUI when upgrading the APIC or switch software.

The upgrade process for the APIC and switch software through the GUI has been enhanced.

For more information, see the Cisco APIC Installation, Upgrade, and Downgrade Guide.

None.

IGMP snooping querier version 2 support

IGMP snooping querier version 2 is now supported.

For information about the IGMP snooping querier, see the Cisco APIC Layer 3 Networking Configuration Guide, Release 5.1(x).

None.

SSD write optimization

The SSD write strategy is optimized for improved performance and longer SSD life.

None.

Support for associating a Layer 3 EPG from the in-band management tenant with a NetFlow exporter

You can now associate an EPG or L3Out from the in-band VRF under the management tenant with a NetFlow exporter.

For information about NetFlow, see the Cisco APIC and NetFlow document.

None.

Support for SNMPv3 and SHA-2

SNMPv3 trap aggregation and forwarding is now supported. SNMPv3 supports the Secure Hash Algorithm-2 (SHA-2) authentication type.

For information about SNMP, see the Cisco APIC Basic Configuration Guide, Release 5.1(x).

None.

UCSC-PCIE-IQ10GC Intel X710 Quad Port 10GBase-T network interface card support

You can now use the UCSC-PCIE-IQ10GC Intel X710 Quad Port 10GBase-T network interface card in the Cisco APIC M3/L3 servers for 10GBase-T connectivity to Cisco ACI leaf nodes.

None.

VMware NSX-T data center integration with Cisco ACI

You can integrate VMware NSX-T Data Center with Cisco ACI. Integration enables you to use Cisco APIC to create and work with VMware NSX-T Data Center network constructs.

For more information, see the Cisco ACI and VMware NSX-T Data Center Integration document.

None.

CSCvg81020

For strict security requirements, customers require custom certificates that have RSA key lengths of 3072 and 4096.

5.1(1h) and later

CSCvm56946

Support for local user (admin) maximum tries and login delay configuration.

5.1(1h) and later

CSCvq54761

The application EPG or the corresponding bridge domain's public subnet may be advertised out of an L3Out in another VRF instance without a contract with the L3Out under certain conditions.

5.1(1h) and later

CSCvs47602

A bridge domain route is not leaked on the service ToR switch after re-triggering the  service graph.

5.1(1h) and later

CSCvs97029

All the external prefixes from VRF-A could be leaked to VRF-C even when an inter-VRF ESG leak route is configured for a specific prefix.

5.1(1h) and later

CSCvt99966

A SPAN session with the source type set to "Routed-Outside" goes down. The SPAN configuration is pushed to the anchor or non-anchor nodes, but the interfaces are not pushed due to the following fault: "Failed to configure SPAN with source SpanFL3out due to Source fvIfConn not available".

5.1(1h) and later

CSCvv69041

There is traffic loss on SDA after deleting an overlapping subnet.

5.1(1h) and later

CSCvw12766

In a setup where there is already existing MDP confguration (spine and leaf nodes), after having deleted an MDP spine node, MDP tunnels and traffic might still be directed to that spine node. In the case of a new MDP spine node, the traffic might not get directed to the new spine node.

5.1(1h) and later

CSCvw69692

If a service graph gets attached to the inter-VRF contract after it was already attached to the intra-VRF contract, the pctag for the shadow EPG gets reprogrammed with a global value. The zoning-rule entries that matched the previous pctag as the source and EPG1 and EPG2 as the destination do not get reprogrammed and they remain in a stale status in the table.

Traffic between EPG1 and EPG2 gets broken as the packets flowing from the PBR get classified with the new global pctag.

5.1(1h) and later

CSCvx10921

A standby APIC disappears from the GUI after cluster convergence.

5.1(1h) and later

CSCvy17504

When the OpFlexAgent moved from one vPC pair leaf switches to a new vPC pair, it may take up to 20 minutes for the OpFlexAgent detected the movement, and reconnect the OpFlex channel.  Ideally, this should be completed within a few seconds.

5.1(1h) and later

CSCwa58709

The GIPo address is only visible on APIC 1 when using the command "cat /data/data_admin/sam_exported.config". The command output from the other APICs outputs do not show the GIPo address.

5.1(1h) and later

CSCwh98712

When running "show running-config" from API CLI, the command takes several minutes to complete. Several thousand API requests are seen in access.log querying ptpRsProfile on every static path.

5.1(1h) and later

CSCwi01316

In the following topology:

Tenant 1:

VRF 1 > EPG A, EPG B.  There is an any-to-any Intra VRF instance contract and EPG A and B are providers for an inter-VRF instance contract.

VRF 2 > L3Out or EPG. The VRF instance consumes the inter-VRF instance contract.

Traffic will unexpectedly get sent to the wrong rule when inter-VRF instance traffic is flowing.

5.1(1h) and later

CSCvu18502

The Layer 3 health group destination has both the old and new entry after a service bridge domain is moved from one VRF table to another VRF table.

5.1(1h) and later

CSCvu76494

User is logged into one tab and is trying to log in to another one using same credentials. Login page will show for less than a minute and then user will get redirected to main page.

5.1(1h) and later

CSCvt18145

The routemap becomes missing in the shared service routemap.

5.1(1h)

CSCvt92062

The Cisco APIC CLI does not have commands for the following functionality:

1. ESG show commands

2. ESG inter-VRF route leak configuration

5.1(1h)

CSCvt98140

A custom QoS policy is not supported on the logical interface profile of non-anchor leaf nodes that are part of a floating L3Out.

5.1(1h)

CSCvt99928

An egress/ingress data plane policer policy is not supported on the logical interface profile of non-anchor nodes that are part of a floating L3Out.

5.1(1h)

CSCvj26666

The "show run leaf|spine <nodeId>" command might produce an error for scaled up configurations.

5.1(1h) and later

CSCvj90385

With a uniform distribution of EPs and traffic flows, a fabric module in slot 25 sometimes reports far less than 50% of the traffic compared to the traffic on fabric modules in non-FM25 slots.

5.1(1h) and later

CSCvq39764

When you click Restart for the Microsoft System Center Virtual Machine Manager (SCVMM) agent on a scaled-out setup, the service may stop. You can restart the agent by clicking Start.

5.1(1h) and later

CSCvq58953

One of the following symptoms occurs:

■        App installation/enable/disable takes a long time and does not complete.

■        Nomad leadership is lost. The output of the acidiag scheduler logs members command contains the following error:

Error querying node status: Unexpected response code: 500 (rpc error: No cluster leader)

5.1(1h) and later

CSCvr89603

The CRC and stomped CRC error values do not match when seen from the APIC CLI compared to the APIC GUI. This is expected behavior. The GUI values are from the history data, whereas the CLI values are from the current data.

5.1(1h) and later

CSCvs19322

Upgrading Cisco APIC from a 3.x release to a 4.x release causes Smart Licensing to lose its registration. Registering Smart Licensing again will clear the fault.

5.1(1h) and later

CSCvs77929

In the 4.x and later releases, if a firmware policy is created with different name than the maintenance policy, the firmware policy will be deleted and a new firmware policy gets created with the same name, which causes the upgrade process to fail.

5.1(1h) and later

CSCvs92309

A custom QoS policy at the LifP-level configuration is not supported for an MPLS L3Out.

5.1(1h) and later

CSCvt56254

Stats that should update every 15 minutes instead get updated after between 15 minutes and 20 minutes.

5.1(1h) and later

CSCvt85167

A Service graph that has service EPGs with vzAny as the consumer and provider gets the Global PCTag with EPGs/ESGs.

5.1(1h) and later

N/A

Beginning in Cisco APIC release 4.1(1), the IP SLA monitor policy validates the IP SLA port value. Because of the validation, when TCP is configured as the IP SLA type, Cisco APIC no longer accepts an IP SLA port value of 0, which was allowed in previous releases. An IP SLA monitor policy from a previous release that has an IP SLA port value of 0 becomes invalid if the Cisco APIC is upgraded to release 4.1(1) or later. This results in a failure for the configuration import or snapshot rollback.

The workaround is to configure a non-zero IP SLA port value before upgrading the Cisco APIC, and use the snapshot and configuration export that was taken after the IP SLA port change.

5.1(1h) and later

N/A

If you use the REST API to upgrade an app, you must create a new firmware.OSource to be able to download a new app image.

5.1(1h) and later

N/A

In a multipod configuration, before you make any changes to a spine switch, ensure that there is at least one operationally "up" external link that is participating in the multipod topology. Failure to do so could bring down the multipod connectivity. For more information about multipod, see the Cisco Application Centric Infrastructure Fundamentals document and the Cisco APIC Getting Started Guide.

5.1(1h) and later

N/A

With a non-english SCVMM 2012 R2 or SCVMM 2016 setup and where the virtual machine names are specified in non-english characters, if the host is removed and re-added to the host group, the GUID for all the virtual machines under that host changes. Therefore, if a user has created a micro segmentation endpoint group using "VM name" attribute specifying the GUID of respective virtual machine, then that micro segmentation endpoint group will not work if the host (hosting the virtual machines) is removed and re-added to the host group, as the GUID for all the virtual machines would have changed. This does not happen if the virtual name has name specified in all english characters.

5.1(1h) and later

N/A

A query of a configurable policy that does not have a subscription goes to the policy distributor. However, a query of a configurable policy that has a subscription goes to the policy manager. As a result, if the policy propagation from the policy distributor to the policy manager takes a prolonged amount of time, then in such cases the query with the subscription might not return the policy simply because it has not reached policy manager yet.

5.1(1h) and later

N/A

When there are silent hosts across sites, ARP glean messages might not be forwarded to remote sites if a leaf switch without -EX or a later designation in the product ID happens to be in the transit path and the VRF is deployed on that leaf switch, the switch does not forward the ARP glean packet back into the fabric to reach the remote site. This issue is specific to transit leaf switches without -EX or a later designation in the product ID and does not affect leaf switches that have -EX or a later designation in the product ID. This issue breaks the capability of discovering silent hosts.

5.1(1h) and later

N/A

Typically, faults are generally raised based on the presence of the BGP route target profile under the VRF table. However, if a BGP route target profile is configured without actual route targets (that is, the profile has empty policies), a fault will not be raised in this situation.

5.1(1h) and later

N/A

MPLS interface statistics shown in a switch's CLI get cleared after an admin or operational down event.

5.1(1h) and later

N/A

MPLS interface statistics in a switch's CLI are reported every 10 seconds. If, for example, an interface goes down 3 seconds after the collection of the statistics, the CLI reports only 3 seconds of the statistics and clears all of the other statistics.

5.1(1h) and later

Microsoft Hyper-V

■        SCVMM 2019 RTM (Build 10.19.1013.0) or newer

■        SCVMM 2016 RTM (Build 4.0.1662.0) or newer

■        SCVMM 2012 R2 with Update Rollup 9 (Build 3.2.8145.0) or newer

N/A

VMM Integration and VMware Distributed Virtual Switch (DVS)

6.5, 6.7, and 7.0

Cisco ACI Virtualization Guide, Release 5.0(x)

APIC-L1

Cisco APIC with large CPU, hard drive, and memory configurations (more than 1000 edge ports)

APIC-L2

Cisco APIC with large CPU, hard drive, and memory configurations (more than 1000 edge ports)

APIC-L3

Cisco APIC with large CPU, hard drive, and memory configurations (more than 1200 edge ports)

APIC-M1

Cisco APIC with medium-size CPU, hard drive, and memory configurations (up to 1000 edge ports)

APIC-M2

Cisco APIC with medium-size CPU, hard drive, and memory configurations (up to 1000 edge ports)

APIC-M3

Cisco APIC with medium-size CPU, hard drive, and memory configurations (up to 1200 edge ports)

Cisco UCS M4-based Cisco APIC

The Cisco UCS M4-based Cisco APIC and previous versions support only the 10G interface. Connecting the Cisco APIC to the Cisco ACI fabric requires a same speed interface on the Cisco ACI leaf switch. You cannot connect the Cisco APIC directly to the Cisco N9332PQ ACI leaf switch, unless you use a 40G to 10G converter (part number CVR-QSFP-SFP10G), in which case the port on the Cisco N9332PQ switch auto-negotiates to 10G without requiring any manual configuration.

Cisco UCS M5-based Cisco APIC

The Cisco UCS M5-based Cisco APIC supports dual speed 10G and 25G interfaces. Connecting the Cisco APIC to the Cisco ACI fabric requires a same speed interface on the Cisco ACI leaf switch. You cannot connect the Cisco APIC directly to the Cisco N9332PQ ACI leaf switch, unless you use a 40G to 10G converter (part number CVR-QSFP-SFP10G), in which case the port on the Cisco N9332PQ switch auto-negotiates to 10G without requiring any manual configuration.

N2348UPQ

To connect the N2348UPQ to Cisco ACI leaf switches, the following options are available:

■        Directly connect the 40G FEX ports on the N2348UPQ to the 40G switch ports on the Cisco ACI leaf switches

■        Break out the 40G FEX ports on the N2348UPQ to 4x10G ports and connect to the 10G ports on all other Cisco ACI leaf switches.

Note: A fabric uplink port cannot be used as a FEX fabric port.

N9K-C9348GC-FXP

This switch does not read SPROM information if the PSU is in a shut state. You might see an empty string in the Cisco APIC output.

N9K-C9364C-FX

Ports 49-64 do not support 1G SFPs with QSA.

N9K-C9508-FM-E

The Cisco N9K-C9508-FM-E2 and N9K-C9508-FM-E fabric modules in the mixed mode configuration are not supported on the same spine switch.

N9K-C9508-FM-E2

The Cisco N9K-C9508-FM-E2 and N9K-C9508-FM-E fabric modules in the mixed mode configuration are not supported on the same spine switch.

The locator LED enable/disable feature is supported in the GUI and not supported in the Cisco ACI NX-OS switch CLI.

N9K-C9508-FM-E2

This fabric module must be physically removed before downgrading to releases earlier than Cisco APIC 3.0(2).

N9K-X9736C-FX

The locator LED enable/disable feature is supported in the GUI and not supported in the Cisco ACI NX-OS Switch CLI.

N9K-X9736C-FX

Ports 29 to 36 do not support 1G SFPs with QSA.

Cisco NX-OS

15.1(1)

Cisco AVS

5.2(1)SV3(4.10)

For more information about the supported AVS releases, see the AVS software compatibility information in the Cisco AVS Release Notes, Release 5.2(1)SV3(4.10).

Cisco UCS Manager

2.2(1c) or later is required for the Cisco UCS Fabric Interconnect and other components, including the BIOS, CIMC, and the adapter

CIMC HUU ISO

The latest recommended releases are as follows:

■        4.2(3e) CIMC HUU ISO for UCS C220/C240 M5 (APIC-L3/M3) and UCS C225 M6 (APIC-L4/M4)

■        4.1(2m) CIMC HUU ISO for UCS C220/C240 M4 (APIC-L2/M2)

Network Insights Base, Network Insights Advisor, and Network Insights for Resources

For the release information, documentation, and download links, see the Cisco Network Insights for Data Center page.

For the supported releases, see the Cisco Day-2 Operations Apps Support Matrix.

Document

Description

Cisco ACI Virtual Edge Release Notes, Release 3.1(1)

The release notes for Cisco ACI Virtual Edge.

Cisco Application Centric Infrastructure Simulator Release Notes, Release 5.1(1)

The release notes for the Cisco ACI Simulator.

Cisco Nexus 9000 ACI-Mode Switches Release Notes, Release 15.1(1)

The release notes for Cisco NX-OS for Cisco Nexus 9000 Series ACI-Mode Switches.

Verified Scalability Guide for Cisco APIC, Release 5.1(1), Multi-Site, Release 3.1(1), and Cisco Nexus 9000 Series ACI-Mode Switches, Release 15.1(1)

This guide contains the maximum verified scalability limits for Cisco Application Centric Infrastructure (ACI) parameters for Cisco APIC, Cisco ACI Multi-Site, and Cisco Nexus 9000 Series ACI-Mode Switches.

Note: This document is not yet available, but will be soon.