Nexus Dashboard Release Notes, Release 4.3.1

August 22, 2026

Release 4.3.1.175 became available.

Ease of Use

VMware ESXi 9.0.2 deployment support

Deploy Nexus Dashboard on the latest supported VMware infrastructure with added support for VMware ESXi 9.0.2, giving teams greater flexibility to align Nexus Dashboard with current virtualization standards.

For more information, refer to the Cisco Nexus Dashboard Deployment and Upgrade Guide.

Upgrade

Secure, in-platform pre-upgrade validation

Run pre-upgrade health checks more securely and with less operational effort. The pre-upgrade validation utility is now delivered as a Cisco-signed Nexus Dashboard plugin (.ndp) that Nexus Dashboard validates and runs locally, eliminating the need to run a standalone Python script from an external host over SSH.

For more information, refer to the Cisco Nexus Dashboard Deployment and Upgrade Guide.

Ease of Use

Streamlined QCOW2 deployment for KVM environments

Deploy Nexus Dashboard more consistently across KVM-based environments, including RHEL and Nutanix. QCOW2 images now include a deployment validation and orchestration script that simplifies setup, validates compatibility, and promotes consistent deployment across supported platforms.

For more information, refer to the Cisco Nexus Dashboard Deployment and Upgrade Guide.

Ease of Use

Faster support with expanded Connected TAC

Accelerate issue resolution across LAN and SAN environments with expanded Connected TAC. The experience no longer depends on active software telemetry, can be managed centrally from System Settings > Fabric Management, and supports targeted diagnostic collection and secure, read-only command execution on Cisco N9000 switches through the Nexus Dashboard proxy.

For more information, refer to the Connected TAC section in Working with Cisco Tech Support.

Ease of Use

Deeper LLDP diagnostics for faster connectivity troubleshooting

Troubleshoot node connectivity issues faster with rescue-user access to LLDP neighbor, interface, configuration, and statistics data through the acs lldp show command. Tech-support collections now also include LLDP neighbor information from ND node management and data interfaces, providing more complete evidence for diagnosis.

For more information, refer to the System and connectivity troubleshooting section in the Cisco Nexus Dashboard Troubleshooting article.

Ease of Setup

Delegated device-upgrade administration

Delegate fabric software upgrades without granting broader administrative access. Nexus Dashboard 4.3.1 reintroduces the Device Upgrade Administrator role, previously available as NDFC Device Upgrade Admin, for device-upgrade workflows.

For more information, refer to the Roles and permissions in the unified releases section in the Configuring Users, Roles, and Security article.

Ease of Use

Reliable import of same-name policies in autonomous templates

Import orchestrator related autonomous-template policies with greater confidence when identical object names exist across fabrics. Nexus Dashboard resolves relationship references only within the source fabric, preventing same-name objects in other fabrics from being used incorrectly during import.

For more information, refer to the Schemas and Application Templates for ACI Fabrics article.

Licensing Process

ACI license-tier reporting

Gain more reliable visibility into ACI license consumption. Nexus Dashboard now reports the onboarded switch count and the license tier in use—Essentials, Advantage, or Premier—for APICs that are onboarded on the ND.

For more information, refer to the Support for ACI fabrics section in the Configuring Licensing article. 

Ease of Use

Enterprise proxy authentication with Kerberos

Integrate Nexus Dashboard with enterprise-authenticated proxy environments. Nexus Dashboard can now act as a Kerberos client, obtain tickets from the configured Key Distribution Center (KDC), and authenticate outbound HTTP and HTTPS proxy traffic. The feature title also reflects NTLM-based proxy authentication support documented for this release.

For more information, refer to the Proxy configuration section in the Working with System Settings article.

Ease of Use

Secure AI integration through the Nexus Dashboard MCP server

Connect Nexus Dashboard securely to Cisco Cloud Control and customer-managed large language models through native Model Context Protocol (MCP) server integration. This foundation enables AI-assisted network operations and custom AI workflows while allowing organizations to keep enterprise data and AI models within their own environment.

For more information, refer to the Model Context Protocol (MCP) Server Integration article.

Ease of Use

Flexible first-login password policy

Give super administrators greater control over user onboarding workflows by allowing them to disable the mandatory password change at first login when organizational policy or automated account provisioning requires it.

For more information, refer to the Violation action section in the Configuring Users, Roles, and Security article.

Ease of Use

Unified visibility and troubleshooting across VXLAN–ACI fabric groups

Operate VXLAN and ACI domains as one connected environment. VXLAN–ACI fabric groups now support EPG-to-ESG migration, centralized VXLAN EVPN multi-site peering using route servers, all security-group types, Connectivity Analysis, and Traffic Analytics. Search and Explore is also available across every fabric-group type, making it easier to investigate endpoints, policies, and connectivity across domains.

For more information, refer to these articles:

Ease of Use

Faster multicast source discovery for IP Fabric for Media

Accelerate multicast source discovery in IP Fabric for Media (IPFM) environments with PIM Flooding Mechanism–Source Discovery (PFM-SD). First-hop routers can announce active sources across the fabric without relying on a Rendezvous Point, MSDP, or BSR. Support includes single-site and multi-site deployments, default and non-default VRFs, and inter-fabric boundary control.

For more information, refer to the PIM flooding mechanism for source discovery and PFM-SD policies for non-default VRFs and multi-site deployments sections in Editing IP Fabric for Media (IPFM) Fabric Settings article.

Ease of Use

Support for Smart Switches in VXLAN EVPN fabrics with Hypershield integration

Simplify distributed security for top-of-rack and zone-based segmentation deployments. Nexus Dashboard can onboard the Cisco Hypershield controller to automate security-policy enforcement, zone segmentation, and traffic steering on Cisco N9324C-SE1U and N9348Y2C6D Smart Switches.

For more information, refer to the Hypershield integration section.

Ease of Use

Flexible ACI onboarding across multi-cluster deployments

Onboard and manage ACI fabrics from any Nexus Dashboard cluster of a multi-cluster deployment. This release adds secondary-cluster onboarding and deregistration for APICs in multi-cluster environments. This release adds secondary-cluster onboarding and deregistration for APICs in multi-cluster environments.

For more information, refer to these sections in the Connecting Clusters article:

Ease of Use

Automated remote fabric backups

Protect fabric configurations with scheduled backups to remote storage. Nexus Dashboard can now use configured remote storage locations for switch running-configuration backups, helping teams centralize recovery data and capture fabric state consistently. This functionality is supported in External and Classic LAN fabrics.

For more information, refer to Backing Up and Restoring Your Nexus Dashboard.

Ease of Use

Fabric-agent updates for monitored NX-OS fabrics

Keep Connectivity Analysis ready without moving standalone NX-OS fabrics out of monitor mode. Nexus Dashboard can update fabric-agent packages when the required telemetry, licensing, metadata, and image-management prerequisites are met.

For more information, refer to the Create connectivity analysis section in the Analyzing and Troubleshooting Your Network article.

Ease of Setup

Zero-touch in-band deployment in Campus fabrics with Layer-2 ToR support

VXLAN EVPN Campus fabrics can now be bootstrapped with inband Plug-n-Play (PnP). In addition, bootstrap and manage Catalyst 9200-CX switches as Layer-2 top-of-rack switches in an External fabric using in-band Plug and Play. This extends zero-touch deployment to access switches connected to the Catalyst 9000 leafs of an in-band-managed Campus fabric.

For more information, refer to the Inband PnP for Catalyst 9200-CX ToR switches section in the Configuring Inband Management and Out-of-Band PnP article.

Ease of Setup

Hardware-accelerated OpenStack networking with the Nexus Dashboard ML2 plugin

Bring cloud orchestration and fabric automation together with enhanced OpenStack ML2 integration.

The new Nexus Dashboard network type enables hardware-accelerated Layer-3 forwarding; Hierarchical Port Binding dynamically allocates VLAN segments; address scopes map to VRFs for granular isolation; and the nd-status extension provides automatic deployment retry and real-time status. Additional controls enable Layer-3 forwarding for VLAN networks and border leaf switches.

For more information, refer to the Cisco OpenStack Integration Installation Guide for Nexus Dashboard.

Ease of Use

Expanded automation and assurance for Cisco Nexus E100 platforms

Manage additional Cisco Nexus E100-based platforms running NX-OS 10.6(4) with support for VLAN mapping on trunk-interface policies and selected Nexus Dashboard Insights capabilities.

For these platforms, Nexus Dashboard supports Port VLAN Translation through VLAN Mapping on trunk interface policies.

Nexus Dashboard Insights supports selected capabilities for these platforms, including topology, route telemetry, interface analytics, resource analytics, and assurance-related workflows. Traffic Analytics is supported only in compact mode on E100 platforms, while Flow Telemetry and Traffic Analytics full mode are not supported.

NOTE: Cisco Nexus E100-based platforms running Cisco NX-OS Release 10.6(3) or earlier do not support QoS in AI fabrics. If one of these platforms is added to an AI fabric, the Recalculate operation fails, and the user sees an error.

Ease of Use

Cisco N9164E-NS4-O support for AI and External fabrics

Deploy the Cisco N9164E-NS4-O running NX-OS 10.6.2(N) in AI Routed, AI VXLAN, and External fabrics. On this platform, Dynamic Load Balancing is supported in per-packet mode only.

Ease of Use

Stronger fabric security and finer protocol control

Strengthen fabric operations with SHA-512 hashing, Type 8 and Type 9 password encryption in switch-user policies, AES-128-CMAC authentication for NTP, routing-protocol keychain management, and expanded OSPF and BFD timer controls.

For more information, refer to the Authentication section in the Editing Data Center VXLAN Fabric Settings article.

Ease of Use

Scalable border connectivity and routing isolation for multi-tier VXLAN

Build larger, more resilient VXLAN fabrics with enhanced border and border-gateway connectivity for three-tier topologies with super spines. New capabilities include unique ASNs on applicable border switches, per-VRF and per-VTEP loopback auto-provisioning, and automatic EVPN overlay peering policies for Data Center and AI VXLAN eBGP fabrics.

For more information, refer to the Fabric Management (for fabrics with eBGP overlay routing protocol) section in the Editing Data Center VXLAN Fabric Settings article.

Ease of Use

Expanded design flexibility for Campus VXLAN EVPN

Design Campus VXLAN EVPN fabrics with greater routing and topology flexibility. Enhancements include 4-byte BGP ASNs, BGP fast convergence, a larger loopback ID range, custom route distinguishers for IP VRFs, SVI-based IOS XE VRF-Lite connectivity, the Border Spine role, and enhanced border connectivity for three-tier topologies with border-gateway super spines.

For more information, refer to the Editing Campus VXLAN Fabric Settings article.

Ease of Use

Fabric-group-wide analytics, advisories, and connectivity visibility

Monitor and troubleshoot connected fabrics from a single fabric-group context. Operators can view analytics and advisories, review connectivity and fabric bugs, launch Connectivity Analysis, explore endpoints across member fabrics, and monitor the health of inter-fabric connections for every supported fabric-group type.

For more information, refer to these articles:

Ease of Setup

Image management in monitor mode

Prepare and manage software images for External and Classic LAN fabrics while they remain in monitor mode, reducing mode changes and operational friction during upgrade planning.

For more information, refer to the Image management in monitor mode section in the Managing Your Fabric Software article.

Ease of Use

Fabric-level NetFlow automation for Nexus H1 and H2 platforms

Extend flow visibility to Nexus H1 and H2 switches with fabric-level NetFlow configuration generation from Nexus Dashboard.

For more information, refer to the Configuring Netflow support section in the Creating Fabrics and Fabric Groups article.

Ease of Use

Co-existence with Catalyst Center Assurance

Nexus Dashboard can be employed to provision VXLAN EVPN configurations on Catalyst 9000 based Campus fabrics while the switches can stream telemetry and assurance data to Catalyst Center. Assurance related configuration policies related to NetFlow and device-tracking can be pushed to the Catalyst 9000 switches from the Catalyst Center in these environments. Nexus Dashboard provides the ability to update the assurance policy related intent so that it remains in sync with the switch running configurations.

This ensures wireless Assurance related features in Catalyst Center continue to co-exist with Nexus Dashboard managing the Campus EVPN fabrics.

For more information, refer to the Edit interfaces section in the Working with Connectivity in Your Nexus Dashboard LAN Fabrics article and the Catalyst Center Assurance interface fields section in the Editing Campus VXLAN Fabric Settings article.

Ease of use

Centralized CyberArk credential management for SAN

Extend enterprise credential governance to SAN operations. Nexus Dashboard can retrieve Cisco MDS fabric-discovery and device credentials from CyberArk using credential-store keys, reducing locally stored credentials and simplifying credential rotation for SAN workflows.

For more information, refer to the Edit device credentials for SAN switches section in the Creating and Editing SAN Fabrics  article and the AAA remote authentication passthrough for SAN fabrics section in the Working with System Settings article.

Ease of use

Expanded configuration-drift detection and reconciliation

Configuration drift support for application templates 

Protect application intent across more Orchestrator template properties. Nexus Dashboard now detects and reconciles drift for EPG and bridge-domain subnets, bridge-domain DHCP labels, EPG static ports, contract relationships, and uSeg attributes.

For more information, refer to the Configuration drifts and Reconcile configuration drift in application templates sections in the Templates Overview and Operations for ACI Fabrics article.

Support import and deployment of same name policies and associated policies for autonomous templates

Find the right configuration policy template faster with category-based filtering, then review the resulting intent in a consolidated show running-config-like view. Related parent and child policies are presented together, making generated configuration easier to understand and validate before deployment.

For more information, refer to the Simplified policy template selection and combined configuration view section in the Working with Configuration Policies for Your Nexus Dashboard LAN or IPFM Fabrics article.

Ease of Use

Actionable anomaly suppression and upgrade-aware correlation

Reduce alert fatigue and speed root-cause analysis.

Suppress anomalies that are not relevant to your environment, apply rules across fabrics, and create a rule directly from an anomaly. During ACI software updates, correlation can identify controller or switch update events as the root event for related anomalies.

For more information, refer to the Create an anomaly rule from an anomaly,  Anomaly rules, and Understanding anomaly correlation sections in the Detecting Anomalies in Your Nexus Dashboard article.

Ease of Use

End-to-end multicast path visibility for VXLAN fabrics

Troubleshoot multicast delivery with a complete view from the first-hop router to the last-hop router.

In VXLAN EVPN data center fabrics with Tenant Routed Multicast (TRM), Nexus Dashboard visualizes multicast routes and state from Cisco N9000 switches, provides source and receiver statistics, and identifies the top multicast groups by traffic and receiver count.

For more information, refer to the Multicast traffic monitoring overview section in the Working with Connectivity in Your Nexus Dashboard LAN Fabrics article.

Ease of Use

Live Protect enhancements

See security posture and protection status in one place. The new Overview tab on the Device Security page brings together security advisories, Live Protect deployment status, hit counts, and historical trends so operators can identify exposure, verify protection, and prioritize action faster.

For more information refer to the Overview section in Managing Security Advisories and Protecting Devices Using Nexus Dashboard article.

Ease of Use

Proactive scale-compliance monitoring

Identify capacity risk before it affects operations.

Nexus Dashboard raises an anomaly when fabric telemetry resources approach or exceed the verified limits for the cluster profile and provides the affected resource, current use, verified limit, utilization percentage, impact, and recommended remediation.

For more information, refer to the Scale compliance anomalies section in the Reviewing System Status for Your Nexus Dashboard article.

Ease of Use

End-to-end AI job visibility with server NIC telemetry

Correlate AI workload performance from the GPU and server NIC through the network fabric.

AI job monitoring now supports External AI fabrics and adds server-NIC metrics such as CRC errors, discards, bandwidth, NACKs, CNPs, operational state, and link speed alongside GPU and switch-interface data.

For more information, refer to Understanding enhanced analytics for AI fabrics.

Ease of Use

sFlow support for Traffic Analytics compatibility mode

Use sFlow, in addition to Netflow, when enabling Traffic Analytics compatibility mode on supported platforms, expanding traffic visibility across heterogeneous fabrics.

For more information, refer to Traffic analytics support for Silicon One (S1) platforms.

Ease of Use

Traffic Analytics for Cisco Silicon One platforms

Extend traffic visibility to supported Cisco Silicon One platforms.

Nexus Dashboard supports NetFlow compatibility mode on Silicon One based Cisco N9000 switches running NX-OS 10.6(3) or later and sFlow on Cisco N9000 -C9804, Cisco N9000 -C9808, and G200 switches. Supported mode depends on the switch platform; Cloud Scale-only traditional fabrics continue to use Netflow compatibility mode.

For more information, refer to Traffic analytics support for Silicon One (S1) platforms.

Ease of Use

Accurate Traffic Analytics capability reporting for ACI switches

See the Traffic Analytics mode each ACI switch supports.

The Telemetry status page now distinguishes full-mode-capable hardware from switches that support compatibility mode only, helping operators set correct expectations before enablement.

For more information, refer to the Telemetry section in the Reviewing System Status for Your Nexus Dashboard article.

Hardware support

Cisco N9164E-NS4-O support

Manage the Cisco Nexus N9164E-NS4-O running NX-OS 10.6(2n) release in AI Routed, External, and Classic LAN fabrics.  

Support is limited to Layer-3 operations; SVI, vPC, port channels, multicast, VLAN, PACL, VACL, VXLAN, Connectivity Analysis, NetFlow, sFlow, Traffic Analytics, and Flow Telemetry are not supported on this platform.

SONiC support for Cisco Nexus platforms

Extend Nexus Dashboard operations to Cisco N9164E-NS4-O and Cisco N93108TC-FX3 switches running SONiC. These platforms are supported in Routed, AI Routed, and External fabrics.

For more information, refer to these articles:

Expanded Catalyst platform support with integrated image management

Extend Campus VXLAN and External fabric operations to Catalyst C9300L-24P-4G, C9300L-48P-4G, C9200CX-12P-2X2G-E switches and Cisco Secure Router 8475-G2 and 8455-G2 platforms. Support includes Software Image Management (SWIM) and all supported Catalyst switch roles.

Cisco Nexus N9348Y12C-SE1 support across LAN fabrics

Deploy and manage the Cisco Nexus N9348Y12C-SE1 running NX-OS 10.6(4) across all Nexus Dashboard LAN fabric types.

For more information, refer to these articles:

System level unified features

Changes to Backup and Restore

Cluster name changed when restoring a backup

API schema validation

Beginning with Nexus Dashboard (ND) release 4.3.1, the system validates all API requests against the published API schema before backend processing. Key changes and requirements include:

Recommended actions: Review your API clients and automation workflows to ensure all requests match the API schema for the target Nexus Dashboard release. You must use only documented fields, provide required attributes, and ensure that values use the expected type and format.

ACI onboarding and visibility support on secondary clusters

Freeform interface configuration is blocked when Change Control is enabled

Changes to LAN fabric templates, validation, and PTP configuration

Switch selection and upgrade group creation in monitor mode

Changes to device upgrade admin role permissions

Tenant-Based RBAC for Orchestration templates

Upgrade support for tenants named “default”

Analyze proxy requires TLS certificate verification

Certificate management requires RBAC permissions

Upgrade validation for SMTP email server host

vND OVF deployment configuration

Automation

Changes to Nexus Dashboard GUI

Fabric-management changes for monitored fabrics

Pre-Change Validation reports and results

Pre-Change Validation (PCV) submissions and results follow more stringent input and result rules resubmitting the request.

OpenShift integration follows OpenShift-specific tooling

Certificate setup generated by the OpenShift integration now follows OpenShift-specific tooling.

Manual time zone selection required before saving User Preferences

The manual-time zone control in User Preferences now blocks saving until a value is selected.

Backup in progress warning to alert users

Configuration attempts made while a backup is active , now triggers a warning banner.

Settings option added to Fabrics > General

A new “Settings” option has been added to the General card for fabrics to display the fabric settings in a drawer.

Fully collapsible breakdown panels for filterable tables

The breakdown panels across all filterable tables with charts will now be fully collapsed and not expandable.

Journey implementation for fabric groups

Default credential error popup

Nexus Data Broker (NDB)

Support for Redirect_all option in Connection creation page

New CDP permit rules introduced on the Input and ISL ports

Change in PTP feature

Support for LAN fabric as Production device in the NDB fabric

Legacy controller APIs no longer support CRUD operations on tenant-associated VXLAN fabrics and fabric groups

Freeform Interface Configuration with Change Control

The behavior for adding interface configurations to freeform policies when Change Control is enabled has changed.

Layer 4 (L4) to Layer 7 (L7) Route peerings after upgrade

L4 to L7 route peering is reorganized during an upgrade when a static route has multiple next hops.

Layer 4 (L4) to Layer 7 (L7) services for default-tenant resources

L4-L7 services can now be configured for default-tenant resources in a tenancy-enabled fabric.

Switch status after Push Config

Push Config no longer refreshes switch configuration status automatically

AI Monitored is available as a fabric type

Border Gateway (BGW) loopback100 description

ACI and NX-OS (Nexus One) Fabric Group

Address, subnet, gateway, and switch-IP formats changed across fabric and network APIs

Fabric subnet, gateway, SVI, and switch-IP fields use revised address formats.

◦        Subnet and gateway IP import accepted /32 and /128 Ips and later on these values were rejected during deploy.

◦        Only two types of port mode are supported, trunk and trunk native.

◦        Tenant name is not used to accurately identify networks.

◦        Subnet and gateway IP import will not accept /32 and /128 Ips and these values are now flagged in a compatibility report.

◦        In addition to trunk and trunk native, a new port mode, “access” is added.

◦        Tenant name is used to accurately identify networks.

Security-group and contract APIs enforce dependency checks and revised request and response rules.

ACI attachment workflows now preserve and expose port mode explicitly

The ACI attachment create, edit, and deploy workflows preserve port mode explicitly.

External fabric selection and host-port resync changes

External-fabric attachment and host port resync now filters switch roles and recovers altered vPC state differently.

External service IP validation and IPv6 pool defaults are changed

Management-pool reachability validation and IPv6 resource-pool sequencing now use stricter defaults.

SNMP validation and default behavior changes

SNMP community and user-template workflows enforce stricter validation and revised privacy defaults.

Telemetry

Change in Default Fabric Setting Parameter: AI QoS & Queueing – RoCEv2

Traffic Analytics compatibility mode now requires NTP

Traffic Analytics compatibility mode time synchronization prerequisite is changed

Changes to Connected TAC

Connected TAC actions now enforce enablement, permissions, and stricter command checks

Connected TAC, callhome, and proxy actions enforce enablement, busy-state, role, command, and credential checks.

Removed or deprecated System anomalies

System anomaly and telemetry platform coverage is reduced.

Traffic Analytics compatibility skips unsupported switches

Unsupported switches no longer make Traffic Analytics compatibility enablement appear failed.

Changes to Bug scan and Log collection on switches impacted by disruptive NX-OS or ACI bugs

Unsupported hardware combinations are now blocked earlier in existing workflows

PTP and device-admission workflows block unsupported hardware and image combinations earlier.

Legacy Classic LAN fabrics are excluded from policy-cam workflow

Policy-cam eligibility now excludes Legacy Classic LAN fabrics from both manual and scheduled resync.

In AI fabrics, fleet collection script blocks collection if required services are not running

External anomaly events use correct acronym casing

Acronyms in anomaly events exported to external syslog and Kafka now retain correct capitalization.

Topology import and views follow stricter fabric RBAC and updated link handling

Topology import and topology views enforce fabric RBAC and return BGP-focused link data.

EPL snapshot summary count interval changes for endpoints, VRFs, and networks

Orchestration

Tenant creation rejects empty descriptions

The tenant-create request now rejects an explicitly empty description.

Tenant uplift handles tenants named default differently

Uplifting tenant named “default” now assigns separate local and global names.

Fabric-policy template responses no longer expose sensitive keys to users

Observer-visible fabric-policy template GET payloads now exclude NTP, MCP, and MACsec authentication keys.

Scale limits are enforced and scale limit anomalies are now reported

Scale checks now cover policy objects, subnets, EPGs, and IP L3Outs.

Different-site migration now requires source-template deployment first

Target deployment in a different-site migration now depends on prior source-template deployment.

Config drift detection now includes child policies

Configuration-drift monitoring now includes children of Nexus Dashboard owned parent policies.

CSCwt93725

When creating a Configuration Compliance rule using a Template, the preview may fail when attempting the "View Selected Objects" function.

4.3.1.175 and later

Monitoring/Observability

CSCws51848

In Nexus Dashboard GUI for ACI Fabric Inventory, navigating to Fabric Summary > Connectivity > Interfaces > Sub-Interface Interfaces Details > Trends and Statistics > Errors > Errors Details and clicking on Error Details shows no data on the GUI even though errors are present on the main Interface details page.

4.3.1.175 and later

Automation

CSCwu07730

In a Nexus Dashboard VXLAN-ACI Fabric Group deployment, traffic bridged across fabrics via Border Gateways (BGW) may encounter incorrect Security Group Tag (SGT) assignment. This issue occurs specifically when traffic traverses an NX-OS BGW that has the L2VNI-associated SVI in a shutdown state. In this configuration, the source SGT is incorrectly tagged as "0," leading to inconsistent policy enforcement across the stretched network.

4.3.1.175 and later

Automation

CSCwv16926

In a co-located Nexus Dashboard deployment, when Live Protect is enabled, compensating-control policy updates cannot be applied to the affected switches, and the Monitor mode option does not appear in Nexus Dashboard. As a result, policy changes do not take effect, and monitoring cannot be configured or verified from the Nexus Dashboard UI. This issue does not occur in a co-hosted deployment.

4.3.1.175 and later

Monitoring/Observability

CSCwt08695

Slack integration configuration is missing after restoring the Nexus Dashboard (ND) cluster setup.

4.3.1.175 and later

General

CSCwt22977

Incorrect Endpoint Security Group (ESG) names are displayed on the Fabric Telemetry (FT) and Telemetry Analytics (TA) tables for ACI fabrics. This issue occurs when an ACI fabric with ESGs configured is onboarded to Nexus Dashboard (ND) and telemetry is enabled, the following sequence causes issues:

·       The user disables telemetry and then reconfigures Endpoint Groups (EPGs), ESGs, and Layer 3 Outs (L3OUTs).

·       After re-provisioning, the user enables telemetry again.

4.3.1.175 and later

Monitoring/Observability

CSCwt11065

When a user creates a protocol definition in Nexus Dashboard (ND) and pushes it to ACI with some DSCP value, ND pushes the value of DSCP property as “unspecified” by default. This issue requires changes to the model and database so that ND does not push unspecified value for DSCP property.

4.3.1.175 and later

General

CSCwt17198

Tenant deployment appears to progress sequentially across NX1, NX2, and ACI fabrics in the Nexus Dashboard UI. Status bars for each fabric move to completion one after another, rather than concurrently. Users may perceive deployments as taking longer due to the sequential visual feedback, despite backend deployments happening in parallel.

4.3.1.175 and later

Automation

CSCwt33814

Update groups with names longer than 128 characters are permitted when using the attach groups API to support backward compatibility during Nexus Dashboard upgrades. However, a validation is added on the UI to restrict update group names to a maximum of 128 characters during creation or edit.

4.3.1.175 and later

Automation

CSCwt52799

When attempting to perform Software Upgrade Analysis on an ACI fabric, the corresponding fabric shows a lock symbol.  Please refer to Bug Search Tool details for workaround.

4.3.1.175 and later

Fabric Software Upgrades

CSCwt49667

Special characters are not allowed for security group names.

In version 4.2, the system fails to process security group names that include any of the following special characters: !@#$^=+{}. This results in a failure during the update process and displays an error within the user interface.

4.3.1.175 and later

Automation

CSCwq78591

When Traffic Analytics Interface Filter Flow Rules are configured and a backup and restore is attempted, the interface filters are visible in the UI in the fabrics Telemetry settings, but the filter configuration is not pushed to devices after Nexus Dashboard configuration restore.

4.3.1.175 and later

Monitoring/Observability

CSCwt34011

A Kafka consumer can enter a stuck state during a rare Kafka rebalance event. When this occurs, on-demand/triggered Bug Scan requests are not processed, and subsequent requests are blocked. This results in a functional outage of on-demand/triggered workflows until manual recovery is performed.

4.3.1.175 and later

General

CSCwt40431

GPU memory utilization anomaly is showing wrong value for memory usage.

4.3.1.175 and later

General

CSCwt41931

Endpoint table displays internal fabric network links as EP (within the fabric) after restoring/reconfiguring a backup on the cluster or after Telemetry pause/resume.

4.3.1.175 and later

Monitoring/Observability

CSCwt42224

When you perform a clean reboot using “acs reboot clean” on a single node cluster, the node may fail to come back as active, causing the cluster to be broken.

4.3.1.175 and later

General

CSCwt42921

After upgrading from Nexus Dashboard 3.2 to  4.2 the endpoints vCenter enrichment information is not displayed in the Endpoints table.

4.3.1.175 and later

General

CSCwt43518

When VLAN is configured out-of-band on the device with sub- commands, then the VLAN is not included in the VLAN range CLI  in diff view and pending config side-by-side view. It only shows the block for vlan line with sub-cmds but not the list of vlan cli even though it shows up in device show run

4.3.1.175 and later

Automation

CSCwt46057

After upgrading from v3.2x to v4.1 or v4.2, in a Multi Cluster Fabric Group (MCFG) with auto-created multisite underlay links, managed member fabrics on secondary clusters may appear as pending configurations related to BGP Max Paths on the border gateways.

This occurs when the underlay links were not manually updated to use a non-default max path value prior to the upgrade.

4.3.1.175 and later

Automation

CSCwt52763

Switch Config-sync status displays as "Pending" even if the Tenant deploy was successful and there is no pending intent to be deployed.

4.3.1.175 and later

Automation

CSCwt46809

A network is detached from a host interface and the uplink access port-channel on a ToR switch after the ToR switch is added into a VxLAN fabric using brownfield import.

4.3.1.175 and later

Automation

CSCwt49616

If a multi-cluster fabric group had security groups enabled and security groups with network port selectors in ND 4.1 then once primary cluster is upgraded to ND 4.2, the network port selectors will be missing in ND 4.2.

Also, the associated contract count for default security groups will not be populated.

4.3.1.175 and later

Automation

CSCwt51427

Following an upgrade from ND 3.2 or 4.1 to 4.2, associating a Security Group (SG) with a VM via Connectivity > Virtual Infrastructure may cause existing VM-derived selectors in other SGs within the same VRF to be negated during subsequent deployments.

4.3.1.175 and later

Automation

CSCws08868

BGP down anomaly is not generated when underlying VPC is made down.

4.3.1.175 and later

Automation

CSCws90654

Launching Splunk UI with native Splunk on a Nexus Dashboard cluster without IPv4 stack and using IPv6 only for Management and Data network addresses does not work. 

4.3.1.175 and later

General

CSCwt07507

When telemetry is enabled from Nexus Dashboard, sensor path to query nxsecure policy remains present, even if the nxsecure feature is disabled on the switch.

4.3.1.175 and later

Monitoring/Observability

CSCws35228

A Search & Explorer query such as "Can security-group ESG1 talk to ESG2" may indicate that the two ESGs can communicate because they are part of the same preferred group, even if there is actually a direct deny contract between them that is blocking the traffic.

4.3.1.175 and later

Monitoring/Observability

CSCws98701

Tenant policy import from an ACI fabric into a VXLAN-ACI fabric group fails with network creation error.

4.3.1.175 and later

Automation

CSCwt25921

Loopback interface IP addresses are not streamed in telemetry data for Cisco IOS-XE Catalyst devices. As a result, these IPs are not displayed on the Nexus Dashboard.

4.3.1.175 and later

Monitoring/Observability

CSCwt25919

OSPF Router ID is not displayed on Nexus Dashboard for Cisco IOS-XE Catalyst devices.

4.3.1.175 and later

Automation

CSCwt04861

Import fails with the error message "Tenant <ND_TenantName> not found on fabric” when Nexus Dashboard tenant names do not match the corresponding ACI tenant names.

4.3.1.175 and later

Automation

CSCwt11065

When a user creates a protocol definition in Nexus Dashboard (ND) and pushes it to ACI with some DSCP value, ND pushes the value of DSCP property as “unspecified” by default. This issue requires changes to the model and database so that ND does not push unspecified value for DSCP property.

4.3.1.175 and later

General

CSCwt14341

Deployments to ACI sites using the VXLAN-ACI fabric-group are not displayed in the deployment history. Only audit-logs of the deployments are available, but no deployment history is displayed for the ACI deployments.

4.3.1.175 and later

Automation

CSCwt17198

Tenant deployment appears to progress sequentially across NX1, NX2, and ACI fabrics in the Nexus Dashboard UI. Status bars for each fabric move to completion one after another, rather than concurrently. Users may perceive deployments as taking longer due to the sequential visual feedback, despite backend deployments happening in parallel.

4.3.1.175 and later

Automation

CSCws26984

For objects in VXLAN-ACI, the "Config Sync" feature is unavailable for ACI fabrics in Release 4.2, and the status updates are not periodic.

ACI objects transition from N/A (at creation) to PENDING (when attached or detached). To clear the PENDING state and return the status to N/A, a "deploy" action must be performed.

4.3.1.175 and later

Automation

CSCwt33814

Update groups with names longer than 128 characters are permitted when using the attach groups API to support backward compatibility during Nexus Dashboard upgrades. However, a validation is added on the UI to restrict update group names to a maximum of 128 characters during creation or edit.

4.3.1.175 and later

Automation

CSCwt52799

When attempting to perform Software Upgrade Analysis on an ACI fabric, the corresponding fabric shows a lock symbol.  Please refer to Bug Search Tool details for workaround.

4.3.1.175 and later

Fabric Software Upgrades

CSCwt49667

Special characters are not allowed for security group names.

In version 4.2, the system fails to process security group names that include any of the following special characters: !@#$^=+{}. This results in a failure during the update process and displays an error within the user interface.

4.3.1.175 and later

Automation

CSCwt29261

In a multi-cluster environment, if any member cluster is still running version 4.1, certain 4.2 features that are not backward-compatible will be unavailable for the Multi-Cluster Fabric Group (MCFG).

The following limitations apply when clusters with mixed versions (4.2 and 4.1) are present:

Network Attachments Performance -Network attachment query and update might exhibit some performance degradation

4.3.1.175 and later

Automation

CSCwr95624

After disassociating an ACI fabric from a tenant, the tenant is not deleted from the remote APIC.

4.3.1.175 and later

General

CSCwq78591

When Traffic Analytics Interface Filter Flow Rules are configured and a backup and restore is attempted, the interface filters are visible in the UI in the fabrics Telemetry settings, but the filter configuration is not pushed to devices after Nexus Dashboard configuration restore.

4.3.1.175 and later

Monitoring/Observability

CSCwt34011

A Kafka consumer can enter a stuck state during a rare Kafka rebalance event. When this occurs, on-demand/triggered Bug Scan requests are not processed, and subsequent requests are blocked. This results in a functional outage of on-demand/triggered workflows until manual recovery is performed.

4.3.1.175 and later

General

CSCwt40431

GPU memory utilization anomaly is showing wrong value for memory usage.

4.3.1.175 and later

General

CSCwt41931

Endpoint table displays internal fabric network links as EP (within the fabric) after restoring/reconfiguring a backup on the cluster or after Telemetry pause/resume.

4.3.1.175 and later

Monitoring/Observability

CSCwt42224

When you perform a clean reboot using “acs reboot clean” on a single node cluster, the node may fail to come back as active, causing the cluster to be broken.

4.3.1.175 and later

General

CSCwt42921

After upgrading from Nexus Dashboard 3.2 to  4.2 the endpoints vCenter enrichment information is not displayed in the Endpoints table.

4.3.1.175 and later

General

CSCwt43518

When VLAN is configured out-of-band on the device with sub- commands, then the VLAN is not included in the VLAN range CLI  in diff view and pending config side-by-side view. It only shows the block for vlan line with sub-cmds but not the list of vlan cli even though it shows up in device show run

4.3.1.175 and later

Automation

CSCwt45228

Re-import of policies from an ACI fabric into an VXLAN-ACI fabric group results in a duplicate interface attachment error in cases where Bridge Domains with the same name are being re-imported in both the user tenant and common tenant.

4.3.1.175 and later

Automation

CSCwt46057

After upgrading from v3.2x to v4.1 or v4.2, in a Multi Cluster Fabric Group (MCFG) with auto-created multisite underlay links, managed member fabrics on secondary clusters may appear as pending configurations related to BGP Max Paths on the border gateways.

This occurs when the underlay links were not manually updated to use a non-default max path value prior to the upgrade.

4.3.1.175 and later

Automation

CSCwt46630

For Colo Fabrics only, VM name and hypervisor redirection do not work from Endpoints table.

·       On NDFC Cluster, clicking the VM name or hypervisor link in the endpoint table for endpoints learned via vCenter integration fails with a 400 error.

·       On NDI Cluster, clicking the hypervisor link in the endpoint table fails with a 400 error when vCenter integration is not configured on the local cluster.

Clicking the VM name in the Endpoint table redirects to a "No Data" page when the vCenter integration is configured on a remote cluster.

4.3.1.175 and later

Monitoring/Observability

CSCwt52763

Switch Config-sync status displays as "Pending" even if the Tenant deploy was successful and there is no pending intent to be deployed.

4.3.1.175 and later

Automation

CSCwt46809

A network is detached from a host interface and the uplink access port-channel on a ToR switch after the ToR switch is added into a VxLAN fabric using brownfield import.

4.3.1.175 and later

Automation

CSCwt49616

If a multi-cluster fabric group had security groups enabled and security groups with network port selectors in ND 4.1 then once primary cluster is upgraded to ND 4.2, the network port selectors will be missing in ND 4.2.

Also, the associated contract count for default security groups will not be populated.

4.3.1.175 and later

Automation

CSCwt51427

Following an upgrade from ND 3.2 or 4.1 to 4.2, associating a Security Group (SG) with a VM via Connectivity > Virtual Infrastructure may cause existing VM-derived selectors in other SGs within the same VRF to be negated during subsequent deployments.

4.3.1.175 and later

Automation

CSCwt53079

Custom network template Issues with reference to L2 network creation and Fabric/Fabric Group addition.

·       In Multi-Cluster Fabric Group (MCFG), when a L2 network is created using a user-defined network template, the API response returns "layer": "layer3" instead of "layer": "layer2".

·       When attempting to add a fabric or fabric group that contains networks of type user defined to an MCFG , the add operation fails and the incoming fabric is rejected.

4.3.1.175 and later

Automation

CSCwt46375

Network creation fails with an error when initiated from the L4-L7 Services workflow. This occurs because the workflow is unable to resolve the target fabric group when its name does not match the parent Multi-Cluster fabric group name.

4.3.1.175 and later

Automation

CSCwt47732

When a restore is attempted from a NAS where configured storage quota threshold is exceeded, the Nexus Dashboard restore will be aborted before starting any actual restore.

4.3.1.175 and later

Automation

CSCwv82709

A Catalyst 9000 (Cat9k) switch becomes unreachable when it is provisioned as a Top-of-Rack (TOR) switch during bootstrap in an external fabric with an incorrect password (base64 format).

4.3.1.175 and later

Automation

CSCwv89975

When the number of displayed rows on the Anomalies page is increased from the default (10) to 100, the selection of the rows on the page degrades and it can lag up to 5 seconds. The lag is specifically observed on the Windows Virtual Desktop Infrastructure (VDI) environment.

4.3.1.175 and later

Monitoring/Observability

CSCww00810

After restoring a Nexus Dashboard (co-host or co-located) from a backup, the Live Protect Shield status displays inconsistently across Nexus Dashboard fabrics.

4.3.1.175 and later

General

CSCww05274

After an NX-OS upgrade and subsequent downgrade, the Live Protect shield status displayed in Nexus Dashboard does not match the actual shield mode on the switch. The shield policy is correctly restored on the switch in Monitor mode, but Nexus Dashboard incorrectly displays the advisory/shield status as “Active/Available”.

4.3.1.175 and later

Fabric Software Upgrades

CSCwv75308

When the switch timezone is changed from a non-UTC timezone to UTC while its clock is recovering from a drift greater than 60 seconds, the switch may fail to send the required timezone-change notification. As a result, Nexus Dashboard Insights (NDI) retains the previous clock-offset state and continues to report the PTP clock as “OUT OF SYNC”, even though the switch has returned to synchronization.

4.3.1.175 and later

Monitoring/Observability

CSCww05954

After upgrading from Nexus Dashboard 3.2 to 4.3.1, existing fabrics may not automatically receive the configuration event required to create PolicyCAM schedules. This issue can occur when upgrading from a release without NX-OS PolicyCAM feature to a release with that feature, particularly when the Assurance Analysis settings are enabled before the upgrade.

4.3.1.175 and later

Fabric Software Upgrades

CSCwv73261

After upgrading a SONiC FX3 switch in a Routed fabric from Nexus Dashboard, the upgraded switches run into an “SSH Key Mismatch” error in the Manage > Inventory > Discovery Status column.

4.3.1.175 and later

Fabric Software Upgrades

CSCwv33170

Users with the fabric-admin role and security domain scoped to a specific fabric cannot see the alert rule configurations.

4.3.1.175 and later

Automation

CSCwv25969

Adding switches fails when multiple sessions to add switches are initiated in parallel across different fabrics. If REST API is used to add switches, it incorrectly returns HTTP 200 (Success) even when the switch addition operation fails. 

4.3.1.175 and later

Automation

CSCwv81908

On Nexus Dashboard, saving an interface configuration fails with a generic request validation error when a valid IP address contains a leading or trailing whitespace. The interface is not created or updated, and the error message does not identify which field caused the failure.

4.3.1.175 and later

Automation

CSCww01224

Upgrade to 4.3.1 fails if Telemetry enabled cluster is expanded to add worker nodes after bootstrapping.

4.3.1.175 and later

Fabric Software Upgrades

CSCww14559

In ACI-VXLAN Fabric Groups, route-servers must source the overlay EVPN sessions from Loopback0, no other loopback IDs are supported in this release.

4.3.1.175 and later

Automation

CSCwv20271

In a brownfield fabric, Nexus Dashboard does not allow you to choose devices to deploy security advisories, even when Live Protect or NX-Secure is already enabled on the switches.

This issue occurs when you configure Live Protect, NX-Secure, or the required shields directly on the switches before you onboard the fabric to Nexus Dashboard. Nexus Dashboard does not automatically discover or adopt the existing Live Protect configurations. To deploy security advisories, enable Live Protect or NX-Secure and deploy the required shields through Nexus Dashboard.

4.3.1.175 and later

Automation

CSCwv67802

Max Paths and Max BGP Paths appear as Pending Config after upgrade from 3.2.2m to Nexus Dashboard 4.3.1.

4.3.1.175 and later

Automation

CSCwv47593

25G links between FX3-SONiC and NX-OS devices fail to establish when using default Forward Error Correction (FEC) settings due to incompatibility. The issue occurs because the default FEC modes on SONiC and NX-OS do not match.

4.3.1.175 and later

Automation

CSCwv93995

After upgrading from Nexus Dashboard release 3.2.2m with custom templates in L4-L7 services configuration, any edit operations to the service function may result in an error, "An unexpected error occurred during template execution"

4.3.1.175 and later

Fabric Software Upgrades

CSCwv05468

During Nexus Dashboard upgrade validation, the upgrade may fail in the Validation state with an error similar to: "SMTP email server(s) missing a valid hostname: <server-name>. Please update the configuration before proceeding with the upgrade." This issue occurs when upgrading to Nexus Dashboard 4.3.1 and an SMTP email server is configured with an empty or invalid SMTP host value,

4.3.1.175 and later

Fabric Software Upgrades

Cisco UCS-220-M5 (SE-NODE-G2)

Cisco UCS-225-M6 (ND-NODE-L4)

Cisco UCS-C225-M8 (ND-NODE-G5S)

Cisco UCS-C225-M8 (ND-NODE-G5L)