Cisco Application Policy Infrastructure Controller Release Notes, Release 5.2(7)

February 21, 2023

Release 5.2(7g) became available. Added the open and resolved bugs for this release.

January 11, 2023

In the Hardware Compatibility Information section, removed APIC-M1 and APIC-L1. The last date of support was October 31, 2021.

November 29, 2022

In the Known Issues section, added:

November 18, 2022

In the Open Issues section, added bug CSCwc66053.

November 16, 2022

In the Open Issues section, added bug CSCwd26277.

November 9, 2022

Release 5.2(7f) became available.

Cisco Nexus Cloud support

This release adds support for Cisco Nexus Cloud, which enables telemetry collection from the Cisco Nexus switches.

For more information, see the Cisco Nexus Cloud documentation.

CSCwd88076

This issue is seen when Syslog is configured with CA signed certificates.The TLS connection was terminated due to certificate validation failure. This is not correct behavior and TLS connection should be established for CA signed certificates too.

5.2(7g) and later

CSCwd90130

After performing an interface migration from the old selector-based style to the new per-port configuration, an interface with an active override might not work as before the migration.

5.2(7g) and later

CSCwe25534

When an IPv6 address is added as the BGP peer address, the APIC does not validate the IPv6 address if the address contains any letters.

5.2(7g) and later

CSCwe39988

The Cisco APIC GUI becomes unresponsive when there is large configuration for given tenant and VRF instance.

5.2(7g) and later

CSCwf16927

The system time does not reflect the daylight saving adjustments done in Egypt for releases prior to 5.3.1 and 6.0.4

5.2(7g) and later

CSCwf29094

The error "Error:Server did not return JSON response" occurs in Nexus Cloud Connectivity in any of the Cisco APICs.

5.2(7g) and later

CSCwf92312

Whenever the 'server monitoring' feature is enabled on Cisco APIC and there is a complex password that includes more than one special character, all the RADIUS users that have access to the APICs cannot log in. Users receive the following error: 'Failed to populate authentication data snapshot - AAA Servers are unreachable'. Fault F0021 is raised on all Cisco APICs of the cluster, which says that 'the RADIUS provider is not reachable anymore'.

5.2(7g) and later

CSCwh18649

Inter-pod/Inter-site BGP peer is incorrectly marked as "manual,wan" under the BGP for the peer managed object of a spine switch.

5.2(7g) and later

CSCwh28834

The "show running config" command does not work in the APIC CLI and generates the following errors:

Error while processing mode: interface

Error while processing mode: leaf

Error while processing mode: configure

Error: ERROR occurred: <class 'xml.etree.ElementTree.ParseError'>, not well-formed (invalid token): line 1, column 51242,   File "/mgmt/opt/controller/yaci/yaci/_cfg.py", line 18, in _execute_func

    subCmd.runningConfig(ctx, **kwargs)

5.2(7g) and later

CSCwh47794

The ACI VMM Tags tab returns "the server returned unintelligible response" message even though the tag is retrievable using the CLI.

5.2(7g) and later

CSCwh53706

In scale setups, when there are more than the usual number of objects and if the user tries to load the Capacity Dashboard page, the page times out. A few queries that are hit from the browser and the page become stuck for few seconds.

5.2(7g) and later

CSCwh75348

Decommission an APIC causes the message "the node configuration will be wiped out from controller" to display even though the controllers still retain the user configuration.

5.2(7g) and later

CSCwh77285

OpFlex OOM crashes in leaf switches.

5.2(7g) and later

CSCwh78409

The SNMPD service failed on all Cisco APICs after configuring SNMPv3.

5.2(7g) and later

CSCwh87245

An edmManagedNic or compManagedNic object may be mapped to the wrong server (compHv).

5.2(7g) and later

CSCwh87458

Search Filters in Endpoint - Operational - Client Endpoints do not show up in the endpoint learning filter.

5.2(7g) and later

CSCwh95573

Fault "F4142" is raised when there is inconsistency in FNV and the idmgr database. Even though the addrAssigner in FNV is set to 0 and the corresponding "identContextElement" managed object is missing from the idmgr database, the fault gets raised.

5.2(7g) and later

CSCwi06427

Navigating to FABRIC -> Inventory -> Pod1 -> Operational -> Routes -> IPv6 learned routes results in the following error message:Value is not specified for the argument 'undefined'

5.2(7g) and later

CSCwi09894

In a mini ACI fabric, the physical APIC does not join the cluster after power cycling the entire setup.

5.2(7g) and later

CSCvg81020

For strict security requirements, customers require custom certificates that have RSA key lengths of 3072 and 4096.

5.2(7f) and later

CSCvm56946

Support for local user (admin) maximum tries and login delay configuration.

5.2(7f) and later

CSCvt99966

A SPAN session with the source type set to "Routed-Outside" goes down. The SPAN configuration is pushed to the anchor or non-anchor nodes, but the interfaces are not pushed due to the following fault: "Failed to configure SPAN with source SpanFL3out due to Source fvIfConn not available".

5.2(7f) and later

CSCvy40511

Traffic from an endpoint under a remote leaf switch to an external node and its attached external networks is dropped. This occurs if the external node is attached to an L3Out with a vPC and there is a redistribution configuration on the L3Out to advertise the reachability of the external nodes as direct-attached hosts.

5.2(7f) and later

CSCvz72941

While performing ID recovery, id-import gets timed out. Due to this, ID recovery fails.

5.2(7f) and later

CSCvz83636

For a health record query using the last page and a time range, the GUI displays some health records with a creation time that is beyond the time range (such as 24h).

5.2(7f) and later

CSCwa58709

The GIPo address is only visible on APIC 1 when using the command "cat /data/data_admin/sam_exported.config". The command output from the other APICs outputs do not show the GIPo address.

5.2(7f) and later

CSCwa90058

When a VRF-level subnet <fvRtSummSubnet> and instP-level subnet <l3extSubnet> with a summary policy is configured for an overlapping subnet, the routes will get summarized by the configuration that was added first. But, the fault on the configuration that was added last will not be shown in the Cisco APIC GUI.

5.2(7f) and later

CSCwa90084

- Traffic disruption across a vPC pair on a given encapsulation.

OR

- EPG flood in encap blackholing on a given encapsulation.

OR

- STP packets received on an encapsulation on a given port are not forwarded on all the leaf switches where the same EPG/same encapsulation is deployed.

5.2(7f) and later

CSCwc11570

In certain configuration sequences, bridge domain routes (and consequently, host routes) are not advertised out of GOLF and ACI Anywhere L3Outs.

5.2(7f) and later

CSCwc66053

Preconfiguration validations for L3Outs that occur whenever a new configuration is pushed to the Cisco APIC might not get triggered.

5.2(7f) and later

CSCwd26277

This issue is observed when you enter or edit the bridge domain name in the consumer connector field. After this, the provider connector will only list the bridge domain that is selected by the consumer connector field.

5.2(7f) and later

CSCwd26277

When deploying a service graph, the dialog does not list all bridge domains for the provider connector. This issue is observed when you enter or edit the bridge domain name in the consumer connector field. After this, the provider connector will only list the bridge domain that is selected by the consumer connector field.

5.2(7f) and later

CSCwd44827

APIC fails to update standalone Layer3 controller subnet on its fabric.The following fault is raised.

F609478 - [FSM:FAILED]: Update Standalone Controller Subnet(TASK:ifc:policymgr:FabricCtrlrConfigPUpdatePodConnPDef)

5.2(7f) and later

CSCwe09859

The OpFlex agent on a hypervisor randomly disconnects, impacting VM traffic.

5.2(7f) and later

CSCwe19885

The Nexus Insights application cannot stream the telemetry data to NDI, even though the Cisco ACI site is registered and active.

5.2(7f) and later

CSCwe52465

The NICC app image fails to load.

5.2(7f) and later

CSCwe64159

Podman is unstable, and gets restarted every 5 seconds, even after running the podman_cleanup.py script. The scheduler services show all the services are running on all the Cisco APICs.

5.2(7f) and later

CSCwe66712

For a customer using America/Mexico_City time, the DST time change will still happen on APIC in the year 2023.

5.2(7f) and later

CSCwe92155

After configuring syslog using TCP on port 59500, the logit was sent out normally and netstat showed that it was established. However, after aborting the connection from the syslog server side, the TCP connection went from ESTABLISHED to CLOSE_WAIT and disappeared from the APIC side.

5.2(7f) and later

CSCwe96230

The Appliance Element (AE) service gets restarted several times by the cgroup process (oom-killer).

5.2(7f) and later

CSCwf19660

Major fault F3083 ("IP detected on multiple MACs") is raised under a uEPG and ESG when an EPG selector is configured in the ESG.

5.2(7f) and later

CSCwf54771

User configuration is missing on APICs and switches following an ungraceful reload or power outage.

5.2(7f) and later

CSCwf61646

Adding wildcard entry (entry with etherType=unspecified) to a filter that has more specific entries (specific ethertype/protocol/etc) can cause SDKHAL to crashSwitch will crash constantly and eventually may come up with either a different image (golden image)

5.2(7f) and later

CSCwh17898

The "panic: runtime error: invalid memory address or nil pointer dereference." Error occurred and then F1419 (Service kron failed on apic) was raised.

5.2(7f) and later

CSCwh41865

When upgrading an APIC, the "from" version is displayed as "to" version in the event record.

5.2(7f) and later

CSCwh47921

Numerous files that are in the deleted state, but are still being used by multiple processes, are not allowing the files to be removed from the file system. This causes the Cisco APIC storage to surpass the 90% threshold of log rotation.

5.2(7f) and later

CSCwh56716

When the Cisco APICs use Direct Connect to CSSM, running the "show license usage" command on APIC 1, 2, or 3 shows ACI_LEAF_ESS_10G 6 in use. When APICs 2 and 3 are restarted, this output is unchanged. When APIC 1 is restarted, the output becomes "No Licenses in use" on APICs 1, 2, and 3. The "Registering for Smart Licensing with Direct Connect to CSSM Using the GUI" process has to be done again.This was tested in the lab with Cisco APIC releases 5.2(6g), 5.2(7g), and 6.0(2j)

5.2(7f) and later

CSCwh67428

The GUI does not display maxSpeed and direction information in the equipment view.

5.2(7f) and later

CSCwh74484

ACI pushes the VLANs from the old VLAN pool after changing the vNIC template in the UCSM

5.2(7f) and later

CSCwh81272

The system resets due to a policyelem high availability policy reset.

5.2(7f) and later

CSCwh83273

A Cisco APIC cannot be added to the cluster because the GUI rejects the ID if is not within the range of 1-7.The Initial Setup Configuration states that the fabric ID valid range is 1-128.

5.2(7f) and later

CSCwh98712

When running "show running-config" from API CLI, the command takes several minutes to complete. Several thousand API requests are seen in access.log querying ptpRsProfile on every static path.

5.2(7f) and later

CSCwi01316

In the following topology:

Tenant 1:

VRF 1 > EPG A, EPG B.  There is an any-to-any Intra VRF instance contract and EPG A and B are providers for an inter-VRF instance contract.

VRF 2 > L3Out or EPG. The VRF instance consumes the inter-VRF instance contract.

Traffic will unexpectedly get sent to the wrong rule when inter-VRF instance traffic is flowing.

5.2(7f) and later

CSCwi34095

App installation fails on the Cisco APIC with the error "Unable to add elasticsearch credentials".

This is seen for any app making use of Elasticsearch, such as Nexus Insight Cloud Connector.

5.2(7f) and later

CSCwi40671

In a remote leaf switch, when the initial policy download happens, nginx generates a core. The process recovers by itself after a restart. This issue does not have any major functionality impact.

5.2(7f) and later

CSCwd94266

Opflexp DME crashes continuously in leaf switches.

5.2(7f)

CSCwd94266

Opflexp DME crashes continuously in leaf switches.

5.2(7g)

CSCwa53478

After migrating a VM between two hosts using VMware vMotion, EPG does not get deployed on the target leaf node. When affected, the fvIfConn managed object corresponding to the missing EPG can be seen on APIC, but it would be missing from the target leaf node when queried.

5.2(7f)

CSCwc47735

There is no feedback to the user in case of an unexpected signal interruption.

5.2(7f)

CSCwc49449

When a maintenance policy has multiple switch nodes, such as vPC pair nodes, an SMU's uninstallation gets stuck in the "queued" state for one of the nodes.

5.2(7f)

CSCuu11416

An endpoint-to-endpoint ACI policy that uses Layer 2 traffic with an IPv6 header does not get counted within or across ESGs/EPGs.

5.2(7f) and later

CSCvj26666

The "show run leaf|spine <nodeId>" command might produce an error for scaled up configurations.

5.2(7f) and later

CSCvj90385

With a uniform distribution of EPs and traffic flows, a fabric module in slot 25 sometimes reports far less than 50% of the traffic compared to the traffic on fabric modules in non-FM25 slots.

5.2(7f) and later

CSCvq39764

When you click Restart for the Microsoft System Center Virtual Machine Manager (SCVMM) agent on a scaled-out setup, the service may stop. You can restart the agent by clicking Start.

5.2(7f) and later

CSCvq58953

One of the following symptoms occurs:

App installation/enable/disable takes a long time and does not complete.

Nomad leadership is lost. The output of the acidiag scheduler logs members command contains the following error:

Error querying node status: Unexpected response code: 500 (rpc error: No cluster leader)

5.2(7f) and later

CSCvr89603

The CRC and stomped CRC error values do not match when seen from the APIC CLI compared to the APIC GUI. This is expected behavior. The GUI values are from the history data, whereas the CLI values are from the current data.

5.2(7f) and later

CSCvs19322

Upgrading Cisco APIC from a 3.x release to a 4.x release causes Smart Licensing to lose its registration. Registering Smart Licensing again will clear the fault.

5.2(7f) and later

CSCvs77929

In the 4.x and later releases, if a firmware policy is created with different name than the maintenance policy, the firmware policy will be deleted and a new firmware policy gets created with the same name, which causes the upgrade process to fail.

5.2(7f) and later

CSCvx75380

svcredirDestmon objects get programmed in all of the leaf switches where the service L3Out is deployed, even though the service node may not be connected to some of the leaf switch.

There is no impact to traffic.

5.2(7f) and later

CSCvx78018

A remote leaf switch has momentary traffic loss for flushed endpoints as the traffic goes through the tglean path and does not directly go through the spine switch proxy path.

5.2(7f) and later

CSCvy07935

xR IP flush for all endpoints under the bridge domain subnets of the EPG being migrated to ESG. This will lead to a temporary traffic loss on remote leaf switch for all EPGs in the bridge domain. Traffic is expected to recover.

5.2(7f) and later

CSCvy10946

With the floating L3Out multipath recursive feature, if a static route with multipath is configured, not all paths are installed at the non-border leaf switch/non-anchor nodes.

5.2(7f) and later

CSCvy34357

Starting with the 5.2(7) release, the following apps built with the following non-compliant Docker versions cannot be installed nor run:

·         ConnectivityCompliance 1.2

·         SevOneAciMonitor 1.0

5.2(7f) and later

CSCvy45358

The file size mentioned in the status managed object for techsupport "dbgexpTechSupStatus" is wrong if the file size is larger than 4GB.

5.2(7f) and later

CSCvz06118

In the "Visibility and Troubleshooting Wizard," ERSPAN support for IPv6 traffic is not available.

5.2(7f) and later

CSCvz84444

While navigating to the last records in the various History sub tabs, it is possible to not see any results. The first, previous, next, and last buttons will then stop working too.

5.2(7f) and later

CSCvz85579

VMMmgr process experiences a very high load for an extended period of time that impacts other operations that involve it.

The process may consume excessive amount of memory and get aborted. This can be confirmed with the command "dmesg -T | grep oom_reaper" if messages such as the following are reported:

         oom_reaper: reaped process 5578 (svc_ifc_vmmmgr.)

5.2(7f) and later

CSCwa78573

When the "BGP" branch is expanded in the Fabric > Inventory > POD 1 > Leaf > Protocols > BGP navigation path, the GUI freezes and you cannot navigate to any other page.

This occurs because the APIC gets large set of data in response, which cannot be handled by the browser for parts of the GUI that do not have the pagination.

5.2(7f) and later

CSCwd45200

Hosting server details for AVE endpoints at the operational tab under the EPG is not updated after VM migration.

5.2(7f) and later

CSCwd51537

After changing a VM's name, the name does not get updated for endpoints in the Operational tab of an EPG.

5.2(7f) and later

N/A

If you are upgrading to Cisco APIC release 4.2(6o), 4.2(7l), 5.2(1g), or later, ensure that any VLAN encapsulation blocks that you are explicitly using for leaf switch front panel VLAN programming are set as "external (on the wire)." If these VLAN encapsulation blocks are instead set to "internal," the upgrade causes the front panel port VLAN to be removed, which can result in a datapath outage.

5.2(7f) and later

N/A

Beginning in Cisco APIC release 4.1(1), the IP SLA monitor policy validates the IP SLA port value. Because of the validation, when TCP is configured as the IP SLA type, Cisco APIC no longer accepts an IP SLA port value of 0, which was allowed in previous releases. An IP SLA monitor policy from a previous release that has an IP SLA port value of 0 becomes invalid if the Cisco APIC is upgraded to release 4.1(1) or later. This results in a failure for the configuration import or snapshot rollback.

The workaround is to configure a non-zero IP SLA port value before upgrading the Cisco APIC, and use the snapshot and configuration export that was taken after the IP SLA port change.

5.2(7f) and later

N/A

If you use the REST API to upgrade an app, you must create a new firmware.OSource to be able to download a new app image.

5.2(7f) and later

N/A

In a multipod configuration, before you make any changes to a spine switch, ensure that there is at least one operationally "up" external link that is participating in the multipod topology. Failure to do so could bring down the multipod connectivity. For more information about multipod, see the Cisco Application Centric Infrastructure Fundamentals document and the Cisco APIC Getting Started Guide.

5.2(7f) and later

N/A

With a non-english SCVMM 2012 R2 or SCVMM 2016 setup and where the virtual machine names are specified in non-english characters, if the host is removed and re-added to the host group, the GUID for all the virtual machines under that host changes. Therefore, if a user has created a micro segmentation endpoint group using "VM name" attribute specifying the GUID of respective virtual machine, then that micro segmentation endpoint group will not work if the host (hosting the virtual machines) is removed and re-added to the host group, as the GUID for all the virtual machines would have changed. This does not happen if the virtual name has name specified in all english characters.

5.2(7f) and later

N/A

A query of a configurable policy that does not have a subscription goes to the policy distributor. However, a query of a configurable policy that has a subscription goes to the policy manager. As a result, if the policy propagation from the policy distributor to the policy manager takes a prolonged amount of time, then in such cases the query with the subscription might not return the policy simply because it has not reached policy manager yet.

5.2(7f) and later

N/A

When there are silent hosts across sites, ARP glean messages might not be forwarded to remote sites if a leaf switch without -EX or a later designation in the product ID happens to be in the transit path and the VRF is deployed on that leaf switch, the switch does not forward the ARP glean packet back into the fabric to reach the remote site. This issue is specific to transit leaf switches without -EX or a later designation in the product ID and does not affect leaf switches that have -EX or a later designation in the product ID. This issue breaks the capability of discovering silent hosts.

5.2(7f) and later

N/A

Typically, faults are generally raised based on the presence of the BGP route target profile under the VRF table. However, if a BGP route target profile is configured without actual route targets (that is, the profile has empty policies), a fault will not be raised in this situation.

5.2(7f) and later

N/A

MPLS interface statistics shown in a switch's CLI get cleared after an admin or operational down event.

5.2(7f) and later

N/A

MPLS interface statistics in a switch's CLI are reported every 10 seconds. If, for example, an interface goes down 3 seconds after the collection of the statistics, the CLI reports only 3 seconds of the statistics and clears all of the other statistics.

5.2(7f) and later

Microsoft Hyper-V

N/A

VMM Integration and VMware Distributed Virtual Switch (DVS)

6.5, 6.7, and 7.0

Cisco ACI Virtualization Guide, Release 5.2(x)

APIC-L2

Cisco APIC with large CPU, hard drive, and memory configurations (more than 1000 edge ports)

APIC-L3

Cisco APIC with large CPU, hard drive, and memory configurations (more than 1200 edge ports)

APIC-M2

Cisco APIC with medium-size CPU, hard drive, and memory configurations (up to 1000 edge ports)

APIC-M3

Cisco APIC with medium-size CPU, hard drive, and memory configurations (up to 1200 edge ports)

Cisco UCS M4-based Cisco APIC

The Cisco UCS M4-based Cisco APIC and previous versions support only the 10G interface. Connecting the Cisco APIC to the Cisco ACI fabric requires a same speed interface on the Cisco ACI leaf switch. You cannot connect the Cisco APIC directly to the Cisco N9332PQ ACI leaf switch, unless you use a 40G to 10G converter (part number CVR-QSFP-SFP10G), in which case the port on the Cisco N9332PQ switch auto-negotiates to 10G without requiring any manual configuration.

Cisco UCS M5-based Cisco APIC

The Cisco UCS M5-based Cisco APIC supports dual speed 10G and 25G interfaces. Connecting the Cisco APIC to the Cisco ACI fabric requires a same speed interface on the Cisco ACI leaf switch. You cannot connect the Cisco APIC directly to the Cisco N9332PQ ACI leaf switch, unless you use a 40G to 10G converter (part number CVR-QSFP-SFP10G), in which case the port on the Cisco N9332PQ switch auto-negotiates to 10G without requiring any manual configuration.

N2348UPQ

To connect the N2348UPQ to Cisco ACI leaf switches, the following options are available:

Directly connect the 40G FEX ports on the N2348UPQ to the 40G switch ports on the Cisco ACI leaf switches

Break out the 40G FEX ports on the N2348UPQ to 4x10G ports and connect to the 10G ports on all other Cisco ACI leaf switches.

Note: A fabric uplink port cannot be used as a FEX fabric port.

N9K-C9348GC-FXP

This switch does not read SPROM information if the PSU is in a shut state. You might see an empty string in the Cisco APIC output.

N9K-C9364C-FX

Ports 49-64 do not support 1G SFPs with QSA.

N9K-C9508-FM-E

The Cisco N9K-C9508-FM-E2 and N9K-C9508-FM-E fabric modules in the mixed mode configuration are not supported on the same spine switch.

N9K-C9508-FM-E2

The Cisco N9K-C9508-FM-E2 and N9K-C9508-FM-E fabric modules in the mixed mode configuration are not supported on the same spine switch.

The locator LED enable/disable feature is supported in the GUI and not supported in the Cisco ACI NX-OS switch CLI.

N9K-C9508-FM-E2

This fabric module must be physically removed before downgrading to releases earlier than Cisco APIC 3.0(1).

N9K-X9736C-FX

The locator LED enable/disable feature is supported in the GUI and not supported in the Cisco ACI NX-OS Switch CLI.

N9K-X9736C-FX

Ports 29 to 36 do not support 1G SFPs with QSA.

Cisco NX-OS

15.2(7)

Cisco UCS Manager

2.2(1c) or later is required for the Cisco UCS Fabric Interconnect and other components, including the BIOS, CIMC, and the adapter.

CIMC HUU ISO

* We do not recommend this CIMC release if you have the "SFP-10G-T-X" connector type on the Cisco APIC data link ports (eth2-1 and eth2-2). To see which connector type you have, enter commands as shown in the following example:

C220-WMP2704001H /chassis # scope adapter 1

C220-WMP2704001H /chassis/adapter # show ext-eth-if detail

Port 2:

MAC Address: 3C:26:E4:1D:BC:95

Link State: LinkUp

…

Connector Type: SFP-10G-T-X

…

Network Insights Base, Network Insights Advisor, and Network Insights for Resources

For the release information, documentation, and download links, see the Cisco Network Insights for Data Center page.

For the supported releases, see the Cisco Data Center Networking Applications Compatibility Matrix.

Cisco Nexus 9000 ACI-Mode Switches Release Notes, Release 15.2(7)

The release notes for Cisco NX-OS for Cisco Nexus 9000 Series ACI-Mode Switches.

Verified Scalability Guide for Cisco APIC, Release 5.2(7) and Cisco Nexus 9000 Series ACI-Mode Switches, Release 15.2(7)

This guide contains the maximum verified scalability limits for Cisco Application Centric Infrastructure (ACI) parameters for Cisco APIC and Cisco Nexus 9000 Series ACI-Mode Switches.