Cisco Application Policy Infrastructure Controller Release Notes, Release 6.1(3)

July 16, 2025

Release 6.1(3g) became available. Defect CSCwp14876 was added to the Resolved Issues list.

June 11, 2025

The Miscellaneous Compatibility Information table was updated to indicate support for 4.3.2.250016 CIMC HUU ISO for UCS C220/C240 M5 (APIC-L3/M3).

April 4, 2025

Release 6.1(3f) became available.

Base Functionality

Remote leaf resiliency

Remote leaf resiliency is achieved by creating a group consisting of multiple RLs. When this group is created, RLs within the group form a fully meshed BGP EVPN session to exchange endpoint and external prefix information. Any failure in the WAN or the main POD does not affect traffic within the group.

In the remote leaf resiliency deployment, RLs in the group communicate using an EVPN-based standard approach instead of a Cisco proprietary protocol.

For more information, see the Cisco APIC Layer 3 Networking Configuration Guide, Release 6.1(x)

Support for virtual APIC as standby node

Support for APIC clusters wherein the standby node can be a physical or virtual node.

For more information, see the Cisco APIC Getting Started Guide, Release 6.1(x).

Support for 32 interfaces in a single port-channel

Using the lacp min-links configuration, you can now configure 32 minimum number of links to be active for the port-channel to be active. The FEX and SAN port-channel will continue to support only 16 members.

For more information, see the Cisco APIC Layer 2 Networking Configuration Guide, Release 6.1(x).

Support for Precision Time Protocol (PTP) on new hardware

PTP is now supported on N9K-C9408 with N9K-X9400-16W line card extension module (only on fabric links).

For more information, see the Cisco APIC System Management Configuration Guide, Release 6.1(x).

Fault squelch updates

Prior to APIC release 6.1(3), when you squelch a fault, it was applicable to all the switches and controllers across the fabric that displayed the fault code. Beginning with release 6.1(3), you have the option of choosing the switch on which you need to squelch the fault by creating a fault squelch policy. You can further narrow it down, such as a specific interface, by using a DN (Distinguished Name) filter.

For more information, see the Cisco APIC Faults, Events, and System Messages Management Guide.

Interoperability

Cisco APIC-ISE integration

Enhanced APIC GUI for the APIC-ISE integration tab for better look-and-feel, and enhanced customer experience.

For details about the Cisco APIC and ISE integration, see the Cisco APIC and Cisco ISE Integration document.

Ease of use

GUI enhancements

·         Simplification of AEP attachment to EPGs - for more information, see the Cisco APIC Layer 2 Networking Configuration Guide, Release 6.1(x)

·         Add Node and RMA UI enhancements – for more information, see the Cisco APIC Getting Started Guide, Release 6.1(x).

·         NGINX UI enhancements - for more information, see the Cisco APIC support for NGINX Rate Limit document.

Security

FIPS 140-3 compliance

The Cisco APIC is now FIPS 140-3 compliant.

For details about the FIPS-140 see FIPS 140 page.

CSCwm38976

EP behind a Remote Leaf accessing the server behind a non anchor node in floating L3out in the main pod. It fails because the BL in the main pod uses PTEP for non anhor nodes instead of Routable TEP. We do not allocate a Routable TEP for a leaf if it is configured as a nonanchor node in floating L3out and does not have a regular L3out.

This is a baseline issue.

6.1(3f) and later

CSCvt99966

A SPAN session with the source type set to "Routed-Outside" goes down. The SPAN configuration is pushed to the anchor or non-anchor nodes, but the interfaces are not pushed due to the following fault: "Failed to configure SPAN with source SpanFL3out due to Source fvIfConn not available".

6.1(3f) and later

CSCwf48875

When using two different host profiles (for example UCS C-Series and UCS B-Series) to deploy NSX, the uplink policy will be different for the host profiles. In this case, using one uplink profile with two policies might cause traffic disruption for a non-default teaming policy.

6.1(3f) and later

CSCwn54329

Capacity Dashboard page load throws "server is temporarily busy" error when there is a high-volume requests on nginx especially in bigger scale setups.

6.1(3f) and later

CSCwo08936

After DR promotion with Inband, it is seen that, even though the APIC Connectivity is set to OOB, the MO is updated, but the default route still points to Inband, making it unable to reach any external nw following this action.

6.1(3f) and later

CSCwo27162

When non-default https port is configured and user is trying to do RMA or Add node workflow from the incoming new node, the workflow might not be able to reach the cluster to fetch details.

6.1(3f) and later

CSCwp14876

Return PBR traffic dropped on Service Leaf after APIC upgrade due to actrlRule missing to allow traffic.

6.1(3f)

CSCwp14876

Return PBR traffic dropped on Service Leaf after APIC upgrade due to actrlRule missing to allow traffic.

6.1(3g)

CSCwm89312

Opflex-proxy reload due to segfault.

6.1(3f)

CSCwn18043

Unable to log in to APIC via console using a local user after upgrading from version 5.2(7g) to 6.0(7e), even with the configuration console default authentication local. we have to use the fallback domain format to log in, such as apic#fallback\\username. For versions prior to 5.2(8i), the fallback domain was not required.

6.1(3f)

CSCwn34813

Vlans will not be updated. Similar Controller log message may be found:

time="2024-11-20T08:22:28Z" level=error msg="Could not update dn uni/infra/vlanns-[vlanpoolname]-static"

6.1(3f)

CSCwn45502

Core Seen on Apic3, during upgrade. When it gets firmwareFirmwareTask for NIBase from Apic1 during upgrade issue.

Upgrade gets stuck on Apic3 to do dataconvert and does not get completed/fails.

6.1(3f)

CSCwn48779

When deleting L4-L7 Devices or Tenant including L4-L7 Devices setting, curr vlaue of globalPolCounts-[uni/fabric]/count-vnsCDev is not counted correctly.

On the other hand, the number of class: vnsCDev entries changes correctly.

6.1(3f)

CSCwn50369

When attempting to save the filter as XML/JSON from the following menu, the GUI becomes unresponsive: Path: Tenant > Contracts > Filter > Right Panel > Click on the Down Arrow.

6.1(3f)

CSCwn58757

When using the remote leaf wizard to add a new remote leaf with a new l3out, the default ospf interface policy under the infra tenant (uni/tn-infra/ospfIfPol-default) is modified without user input. Even if the policy itself is not used for the remote leaf l3out. This can cause an outage in scenarios where this policy is used for inter-pod/inter-site l3out and they introduce new remote leaves.

6.1(3f)

CSCwn59662

After upgrading an ACI leaf, the GBP cache may miss some contracts, which can cause traffic disruptions for the affected EPGs. On the OSP/compute node, this issue may manifest as policy miss drops in OVS, specifically indicated by POL_TABLE MISS.

6.1(3f)

CSCwn65269

When scheduling a device upgrade, the pre-upgrade storage validation from the APIC GUI might incorrectly state there are enough space left on the device. This will lead to download progress looping between 0% to X%

6.1(3f)

CSCwn76568

Endpoints capacity data mentioned in summary is not shown in new capacity dashboard. This will not effect the old UI's capacity dashboard view.

6.1(3f)

CSCwn81692

After the leaf upgrade to 6.0.6c, infraAccPortP and infraAccBndlGrp failed to program the interfaces. This happened due to the "pres.Listener" missing object in the APIC after the apic upgrade 6.0.6c.

6.1(3f)

CSCwo39283

"Time Range" when generating ACI Tech Support does not make clear that filtering is based on file modification and risk of losing available log data for analysis.

6.1(3f)

CSCwc50398

Licensemgr process crashes on node-1, with Smart license mode being "Direct connection to CSSM” under smart license settings.

6.1(3f)

CSCwk37514

An external EPG in an L3Out that is used to connect to the campus is missing even though the corresponding service graph in the outbound filter still exists.

6.1(3f) and later

CSCwn21313

snmptrapd service runs only on the leader APIC. If snmp is not enabled in snmp policy attached to pod containing leader apic, snmp traps will not get forwarded to the external server.

6.1(3f) and later

CSCvy40511

Traffic from an endpoint under a remote leaf switch to an external node and its attached external networks is dropped. This occurs if the external node is attached to an L3Out with a vPC and there is a redistribution configuration on the L3Out to advertise the reachability of the external nodes as direct-attached hosts.

6.1(3f) and later

CSCwj60150

The configuration (EPGs, Contracts, External EPGs etc) is out-of-sync between APIC and ISE.

6.1(3f) and later

CSCwi86409

SGT bindings missing on ACI.

6.1(3f) and later

CSCwf78521

A GOLF spine switch advertises the bridge domain prefixes to a GOLF peer in multiple VRF instances.

6.1(3f) and later

CSCwn30213

If user configures a ongoing atomic counter policy, they may see faults related to packet loss (F1545 and F1547) raised against nodeToVpc paths involving Border Gateways.

6.1(3f) and later

CSCvj26666

The "show run leaf|spine <nodeId>" command might produce an error for scaled up configurations.

6.1(3f) and later

CSCvj90385

With a uniform distribution of EPs and traffic flows, a fabric module in slot 25 sometimes reports far less than 50% of the traffic compared to the traffic on fabric modules in non-FM25 slots.

6.1(3f) and later

CSCvr89603

The CRC and stomped CRC error values do not match when seen from the APIC CLI compared to the APIC GUI. This is expected behavior. The GUI values are from the history data, whereas the CLI values are from the current data.

6.1(3f) and later

CSCvs19322

Upgrading Cisco APIC from a 3.x release to a 4.x release causes Smart Licensing to lose its registration. Registering Smart Licensing again will clear the fault.

6.1(3f) and later

CSCvx75380

svcredirDestmon objects get programmed in all of the leaf switches where the service L3Out is deployed, even though the service node may not be connected to some of the leaf switch.

There is no impact to traffic.

6.1(3f) and later

CSCvx78018

A remote leaf switch has momentary traffic loss for flushed endpoints as the traffic goes through the tglean path and does not directly go through the spine switch proxy path.

6.1(3f) and later

CSCvy07935

xR IP flush for all endpoints under the bridge domain subnets of the EPG being migrated to ESG. This will lead to a temporary traffic loss on remote leaf switch for all EPGs in the bridge domain. Traffic is expected to recover.

6.1(3f) and later

CSCvy10946

With the floating L3Out multipath recursive feature, if a static route with multipath is configured, not all paths are installed at the non-border leaf switch/non-anchor nodes.

6.1(3f) and later

CSCvy45358

The file size mentioned in the status managed object for techsupport "dbgexpTechSupStatus" is wrong if the file size is larger than 4GB.

6.1(3f) and later

CSCvz06118

In the "Visibility and Troubleshooting Wizard," ERSPAN support for IPv6 traffic is not available.

6.1(3f) and later

CSCvz84444

While navigating to the last records in the various History sub tabs, it is possible to not see any results. The first, previous, next, and last buttons will then stop working too.

6.1(3f) and later

CSCvz85579

VMMmgr process experiences a very high load for an extended period of time that impacts other operations that involve it.

The process may consume excessive amount of memory and get aborted. This can be confirmed with the command "dmesg -T | grep oom_reaper" if messages such as the following are reported:

         oom_reaper: reaped process 5578 (svc_ifc_vmmmgr.)

6.1(3f) and later

CSCwa78573

When the "BGP" branch is expanded in the Fabric > Inventory > POD 1 > Leaf > Protocols > BGP navigation path, the GUI freezes and you cannot navigate to any other page.

This occurs because the APIC gets large set of data in response, which cannot be handled by the browser for parts of the GUI that do not have the pagination.

6.1(3f) and later

CSCwe18213

The logical switch created for the EPG remains in the NSX-T manager after the EPG is disassociated from the domain, or the logical switch does not get created when the EPG is associated with the domain.

6.1(3f) and later

CSCwf71934

Multiple duplicate subnets are created on Nutanix for the same EPG.

6.1(3f) and later

CSCwh74888

With the addressing of CSCwe64407, a release that integrates that bug fix can the reference of a static VLAN pool in a VMM domain, which before was not possible. However, if the VMM domain is used by Layer 4 to Layer 7 virtual services and the VMM domain is referencing a static VLAN pool, the services do not work and a fault is raised.

6.1(3f) and later

CSCwh92539

After upgrading a Cisco APIC from a release before 5.2(8) to release 6.1(1) or later, there is a loss of out-of-band management connectivity over IPv6 if the APIC has dual stack out-of-band management. However, IPv4 connectivity remains intact. This issue does not occur if the out-of-band management is only IPv4 or only IPv6.

6.1(3f) and later

N/A

Beginning in Cisco APIC release 4.1(1), the IP SLA monitor policy validates the IP SLA port value. Because of the validation, when TCP is configured as the IP SLA type, Cisco APIC no longer accepts an IP SLA port value of 0, which was allowed in previous releases. An IP SLA monitor policy from a previous release that has an IP SLA port value of 0 becomes invalid if the Cisco APIC is upgraded to release 4.1(1) or later. This results in a failure for the configuration import or snapshot rollback.

The workaround is to configure a non-zero IP SLA port value before upgrading the Cisco APIC, and use the snapshot and configuration export that was taken after the IP SLA port change.

6.1(3f) and later

N/A

In a multipod configuration, before you make any changes to a spine switch, ensure that there is at least one operationally "up" external link that is participating in the multipod topology. Failure to do so could bring down the multipod connectivity. For more information about multipod, see the Cisco Application Centric Infrastructure Fundamentals document and the Cisco APIC Getting Started Guide.

6.1(3f) and later

N/A

A query of a configurable policy that does not have a subscription goes to the policy distributor. However, a query of a configurable policy that has a subscription goes to the policy manager. As a result, if the policy propagation from the policy distributor to the policy manager takes a prolonged amount of time, then in such cases the query with the subscription might not return the policy simply because it has not reached policy manager yet.

6.1(3f) and later

N/A

When there are silent hosts across sites, ARP glean messages might not be forwarded to remote sites if a leaf switch without -EX or a later designation in the product ID happens to be in the transit path and the VRF is deployed on that leaf switch, the switch does not forward the ARP glean packet back into the fabric to reach the remote site. This issue is specific to transit leaf switches without -EX or a later designation in the product ID and does not affect leaf switches that have -EX or a later designation in the product ID. This issue breaks the capability of discovering silent hosts.

6.1(3f) and later

N/A

Typically, faults are generally raised based on the presence of the BGP route target profile under the VRF table. However, if a BGP route target profile is configured without actual route targets (that is, the profile has empty policies), a fault will not be raised in this situation.

6.1(3f) and later

N/A

MPLS interface statistics shown in a switch's CLI get cleared after an admin or operational down event.

6.1(3f) and later

N/A

MPLS interface statistics in a switch's CLI are reported every 10 seconds. If, for example, an interface goes down 3 seconds after the collection of the statistics, the CLI reports only 3 seconds of the statistics and clears all of the other statistics.

6.1(3f) and later

Microsoft Hyper-V

N/A

VMM Integration and VMware Distributed Virtual Switch (DVS)

6.5, 6.7, 7.0 and 8.0.

Note: vSphere 8.0 does not support the vCenter Plug-in and Cisco ACI Virtual Edge (AVE). If you need to continue to use the vCenter Plug-in and Cisco AVE, use vSphere 7.0.

Cisco ACI Virtualization Guide, Release 6.0(x)

Nutanix

N/A

APIC-L2

Cisco APIC with large CPU, hard drive, and memory configurations (more than 1000 edge ports)

APIC-L3

Cisco APIC with large CPU, hard drive, and memory configurations (more than 1200 edge ports)

APIC-L4

Cisco APIC with large CPU, hard drive, and memory configurations (more than 1200 edge ports)

APIC-M2

Cisco APIC with medium-size CPU, hard drive, and memory configurations (up to 1000 edge ports)

APIC-M3

Cisco APIC with medium-size CPU, hard drive, and memory configurations (up to 1200 edge ports)

APIC-M4

Cisco APIC with medium-size CPU, hard drive, and memory configurations (up to 1200 edge ports)

Cisco UCS M4-based Cisco APIC

The Cisco UCS M4-based Cisco APIC and previous versions support only the 10G interface. Connecting the Cisco APIC to the Cisco ACI fabric requires a same speed interface on the Cisco ACI leaf switch. You cannot connect the Cisco APIC directly to the Cisco N9332PQ ACI leaf switch, unless you use a 40G to 10G converter (part number CVR-QSFP-SFP10G), in which case the port on the Cisco N9332PQ switch auto-negotiates to 10G without requiring any manual configuration.

Cisco UCS M5-based Cisco APIC

The Cisco UCS M5-based Cisco APIC supports dual speed 10G and 25G interfaces. Connecting the Cisco APIC to the Cisco ACI fabric requires a same speed interface on the Cisco ACI leaf switch. You cannot connect the Cisco APIC directly to the Cisco N9332PQ ACI leaf switch, unless you use a 40G to 10G converter (part number CVR-QSFP-SFP10G), in which case the port on the Cisco N9332PQ switch auto-negotiates to 10G without requiring any manual configuration.

N2348UPQ

To connect the N2348UPQ to Cisco ACI leaf switches, the following options are available:

Directly connect the 40G FEX ports on the N2348UPQ to the 40G switch ports on the Cisco ACI leaf switches

Break out the 40G FEX ports on the N2348UPQ to 4x10G ports and connect to the 10G ports on all other Cisco ACI leaf switches.

Note: A fabric uplink port cannot be used as a FEX fabric port.

N9K-C9348GC-FXP

This switch does not read SPROM information if the PSU is in a shut state. You might see an empty string in the Cisco APIC output.

N9K-C9364C-FX

Ports 49-64 do not support 1G SFPs with QSA.

N9K-C9508-FM-E

The Cisco N9K-C9508-FM-E2 and N9K-C9508-FM-E fabric modules in the mixed mode configuration are not supported on the same spine switch.

N9K-C9508-FM-E2

The Cisco N9K-C9508-FM-E2 and N9K-C9508-FM-E fabric modules in the mixed mode configuration are not supported on the same spine switch.

The locator LED enable/disable feature is supported in the GUI and not supported in the Cisco ACI NX-OS switch CLI.

N9K-C9508-FM-E2

This fabric module must be physically removed before downgrading to releases earlier than Cisco APIC 3.0(1).

N9K-X9736C-FX

The locator LED enable/disable feature is supported in the GUI and not supported in the Cisco ACI NX-OS Switch CLI.

N9K-X9736C-FX

Ports 29 to 36 do not support 1G SFPs with QSA.

Cisco NX-OS

16.1(3)

CIMC HUU ISO

Note: Install only the CIMC versions mentioned here in this table. Though other firmware versions may be supported on standard UCS C220/C225 servers, they are not supported on APIC and could lead to issues, including failure to boot.

Nexus Dashboard (ND)

See the ND and Services Compatibility Matrix.

Cisco Nexus 9000 ACI-Mode Switches Release Notes, Release 16.1(3)

The release notes for Cisco NX-OS for Cisco Nexus 9000 Series ACI-Mode Switches.

Verified scalability guide, Release 6.1(3)

This guide contains the maximum verified scalability limits for Cisco Application Centric Infrastructure (ACI) parameters for Cisco APIC and Cisco Nexus 9000 Series ACI-Mode Switches.

APIC REST API Configuration Procedures

This document resides on developer.cisco.com and provides information about and procedures for using the Cisco APIC REST APIs. The new REST API procedures for this release reside only here and not in the configuration guides. However, older REST API procedures are still in the relevant configuration guides.