Skip to content

Commit 67dab4b

Browse files
psureshbpsureshb
authored
added validation for CFD CSCwp64296 (#307)
Added rogue ep/coop exception mac check for the CFD CSCwp64296
1 parent d849e8e commit 67dab4b

10 files changed

Lines changed: 359 additions & 2 deletions

‎aci-preupgrade-validation-script.py‎

Lines changed: 56 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6087,6 +6087,61 @@ def auto_firmware_update_on_switch_check(cversion, tversion, **kwargs):
60876087

60886088
return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)
60896089

6090+
6091+
@check_wrapper(check_title='Rogue EP Exception List missing on switches')
6092+
def rogue_ep_coop_exception_mac_check(cversion, tversion, **kwargs):
6093+
result = PASS
6094+
headers = ["Rogue Exception MACs Count", "presListener Count"]
6095+
data = []
6096+
recommended_action = 'Delete the exception lists and create again before upgrading switches. Or contact Cisco TAC to restore the missing presListener objects.'
6097+
recommended_action_pre_apic_upg = 'Change the target version to a fixed version of CSCwp64296.'
6098+
doc_url = 'https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#rogue-ep-exception-list-missing-on-switches'
6099+
6100+
exception_mac_api = 'fvRogueExceptionMac.json?rsp-subtree-include=count'
6101+
presListener_api = 'presListener.json?query-target-filter=and(eq(presListener.lstDn,"exceptcont"))&rsp-subtree-include=count'
6102+
6103+
# Version ranges
6104+
# (unless the patch alphabet is explicitly stated, it means the first version of the train)
6105+
# affected source: 5.2(3) <= version < 6.0(3)
6106+
# affected target: (6.0(3) <= version < 6.0(9e)) or (6.1(1) <= tversion < 6.1(4))
6107+
6108+
def is_affected_source(ver):
6109+
return ver.newer_than("5.2(3a)") and ver.older_than("6.0(3a)")
6110+
6111+
def is_affected_target(ver):
6112+
in_60 = ver.newer_than("6.0(3a)") and ver.older_than("6.0(9e)")
6113+
in_61 = ver.newer_than("6.1(1a)") and ver.older_than("6.1(4h)")
6114+
return in_60 or in_61
6115+
6116+
pre_apic_upg = is_affected_source(cversion) and is_affected_target(tversion) # Before APIC upgrade
6117+
post_apic_upg = is_affected_target(cversion) and is_affected_target(tversion) and cversion.same_as(tversion) # After APIC upgrade (and before switch)
6118+
6119+
if not (pre_apic_upg or post_apic_upg):
6120+
return Result(result=NA, msg=VER_NOT_AFFECTED, doc_url=doc_url)
6121+
6122+
exception_macs = icurl('class', exception_mac_api)
6123+
exception_macs_count = int(exception_macs[0]['moCount']['attributes']['count'])
6124+
# Affected versions but no exception MACs. Not susceptible to the issue.
6125+
if exception_macs_count == 0:
6126+
return Result(result=PASS, doc_url=doc_url)
6127+
6128+
# The issue in presListener has yet to happen before APIC upgrade. You can still avoid hitting the issue itself.
6129+
if pre_apic_upg:
6130+
recommended_action = recommended_action_pre_apic_upg
6131+
data.append([exception_macs_count, "N/A"])
6132+
return Result(result=FAIL_O, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)
6133+
6134+
# Check presListener entries on APIC after APIC upgrade.
6135+
presListener_response = icurl('class', presListener_api)
6136+
presListener_count = int(presListener_response[0]['moCount']['attributes']['count'])
6137+
if presListener_count >= 0 and presListener_count < 32:
6138+
log.info("Insufficient presListener entries ({} found) for {} exception MACs.".format(presListener_count, exception_macs_count))
6139+
result = FAIL_O
6140+
data.append([exception_macs_count, "only {} found out of 32".format(presListener_count)])
6141+
6142+
return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)
6143+
6144+
60906145
# ---- Script Execution ----
60916146

60926147

@@ -6251,7 +6306,7 @@ class CheckManager:
62516306
isis_database_byte_check,
62526307
configpush_shard_check,
62536308
auto_firmware_update_on_switch_check,
6254-
6309+
rogue_ep_coop_exception_mac_check,
62556310
]
62566311
ssh_checks = [
62576312
# General

‎docs/docs/validations.md‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,7 @@ Items | Defect | This Script
194194
[ISIS DTEPs Byte Size][d27] | CSCwp15375 | :white_check_mark: | :no_entry_sign:
195195
[Policydist configpushShardCont Crash][d28] | CSCwp95515 | :white_check_mark: | :no_entry_sign:
196196
[Auto Firmware Update on Switch Discovery][d29] | CSCwe83941 | :white_check_mark: | :no_entry_sign:
197+
[Rogue EP Exception List missing on switches][d30] | CSCwp64296 | :white_check_mark: | :no_entry_sign:
197198

198199
[d1]: #ep-announce-compatibility
199200
[d2]: #eventmgr-db-size-defect-susceptibility
@@ -224,6 +225,8 @@ Items | Defect | This Script
224225
[d27]: #isis-dteps-byte-size
225226
[d28]: #policydist-configpushshardcont-crash
226227
[d29]: #auto-firmware-update-on-switch-discovery
228+
[d30]: #rogue-ep-exception-list-missing-on-switches
229+
227230

228231
## General Check Details
229232

@@ -2648,6 +2651,7 @@ Due to [CSCwp95515][59], upgrading to an affected version while having any `conf
26482651

26492652
If any instances of `configpushShardCont` are flagged by this script, Cisco TAC must be contacted to identify and resolve the underlying issue before performing the upgrade.
26502653

2654+
26512655
### Auto Firmware Update on Switch Discovery
26522656

26532657
[Auto Firmware Update on Switch Discovery][63] automatically upgrades a new switch to the target firmware version before registering it to the ACI fabric. This feature activates in three scenarios:
@@ -2668,6 +2672,17 @@ To avoid this risk, consider disabling Auto Firmware Update before upgrading to
26682672
This issue occurs because older switch firmware versions are not compatible with switch images 6.0(3) or newer. The APIC version is not a factor.
26692673

26702674

2675+
### Rogue EP Exception List missing on switches
2676+
2677+
The Rogue/COOP Exception List feature, introduced in 5.2(3), allows exclusion of specific MAC addresses from Rogue Endpoint Control and COOP Dampening. Initially, each MAC address had to be configured individually in each bridge domain. In 6.0(3), this feature was enhanced to support fabric-wide exception lists with wildcard options per bridge domain and the ability to exclude MAC addresses in L3Outs.
2678+
2679+
However, due to [CSCwp64296][64], when upgrading spine switches to version 6.0(3)+ from an older version with Rogue/COOP Exception Lists configured, some exception lists may not be pushed to the spine switches. As a result, the feature may stop functioning after the upgrade.
2680+
2681+
The root cause is that internal objects called `presListener` for Rogue/COOP Exception List, which publish the configuration from APICs to switches, may be missing on the APICs after an upgrade.
2682+
2683+
Recommended action: Delete the affected exception list and create it again. If needed, contact Cisco TAC to help recover missing `presListener` objects on APICs.
2684+
2685+
26712686
[0]: https://github.com/datacenter/ACI-Pre-Upgrade-Validation-Script
26722687
[1]: https://www.cisco.com/c/dam/en/us/td/docs/Website/datacenter/apicmatrix/index.html
26732688
[2]: https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-release-notes-list.html
@@ -2731,4 +2746,5 @@ To avoid this risk, consider disabling Auto Firmware Update before upgrading to
27312746
[60]: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-743951.html#Inter
27322747
[61]: https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-743951.html#EnablePolicyCompression
27332748
[62]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwe83941
2734-
[63]: https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/all/apic-installation-aci-upgrade-downgrade/Cisco-APIC-Installation-ACI-Upgrade-Downgrade-Guide/m-auto-firmware-update.html
2749+
[63]: https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/all/apic-installation-aci-upgrade-downgrade/Cisco-APIC-Installation-ACI-Upgrade-Downgrade-Guide/m-auto-firmware-update.html
2750+
[64]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp64296

‎tests/checks/rogue_ep_coop_exception_mac_check/no_rogue_mac_response.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[
2+
{
3+
"moCount": {
4+
"attributes": {
5+
"childAction": "",
6+
"count": "0",
7+
"dn": "",
8+
"status": ""
9+
}
10+
}
11+
}
12+
]

‎tests/checks/rogue_ep_coop_exception_mac_check/presListener_exceptcont.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[
2+
{
3+
"moCount": {
4+
"attributes": {
5+
"childAction": "",
6+
"count": "32",
7+
"dn": "",
8+
"status": ""
9+
}
10+
}
11+
}
12+
]

‎tests/checks/rogue_ep_coop_exception_mac_check/presListener_exceptcont_31_missing.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[
2+
{
3+
"moCount": {
4+
"attributes": {
5+
"childAction": "",
6+
"count": "1",
7+
"dn": "",
8+
"status": ""
9+
}
10+
}
11+
}
12+
]

‎tests/checks/rogue_ep_coop_exception_mac_check/presListener_exceptcont_32_missing.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[
2+
{
3+
"moCount": {
4+
"attributes": {
5+
"childAction": "",
6+
"count": "0",
7+
"dn": "",
8+
"status": ""
9+
}
10+
}
11+
}
12+
]

‎tests/checks/rogue_ep_coop_exception_mac_check/presListener_exceptcont_many_missing.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[
2+
{
3+
"moCount": {
4+
"attributes": {
5+
"childAction": "",
6+
"count": "27",
7+
"dn": "",
8+
"status": ""
9+
}
10+
}
11+
}
12+
]

‎tests/checks/rogue_ep_coop_exception_mac_check/presListener_exceptcont_one_missing.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[
2+
{
3+
"moCount": {
4+
"attributes": {
5+
"childAction": "",
6+
"count": "31",
7+
"dn": "",
8+
"status": ""
9+
}
10+
}
11+
}
12+
]

‎tests/checks/rogue_ep_coop_exception_mac_check/rogue_mac_response.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
[
2+
{
3+
"moCount": {
4+
"attributes": {
5+
"childAction": "",
6+
"count": "5",
7+
"dn": "",
8+
"status": ""
9+
}
10+
}
11+
}
12+
]

0 commit comments

Comments
 (0)