Skip to content

Commit 93319e0

Browse files
yisyeyisye
committed
CSCwu34390 CX Script: Added new rule to check if Fabric BFD is enabled on ISIS
1 parent 77ee7ae commit 93319e0

7 files changed

Lines changed: 112 additions & 0 deletions

File tree

‎aci-preupgrade-validation-script.py‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3756,6 +3756,25 @@ def isis_redis_metric_mpod_msite_check(**kwargs):
37563756
return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)
37573757

37583758

3759+
@check_wrapper(check_title="Fabric BFD on ISIS")
3760+
def fabric_bfd_isis_check(**kwargs):
3761+
result = PASS
3762+
headers = ["L3 Interface Policy DN"]
3763+
data = []
3764+
recommended_action = 'Prior to upgrade or downgrade, disable Fabric BFD on ISIS.'
3765+
doc_url = 'https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#fabric-bfd-on-isis'
3766+
3767+
l3IfPols = icurl('class', 'l3IfPol.json')
3768+
for pol in l3IfPols:
3769+
if pol['l3IfPol']['attributes'].get('bfdIsis') == 'enabled':
3770+
data.append([pol['l3IfPol']['attributes']['dn']])
3771+
3772+
if data:
3773+
result = FAIL_O
3774+
3775+
return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)
3776+
3777+
37593778
@check_wrapper(check_title="BGP route target type for GOLF over L2EVPN")
37603779
def bgp_golf_route_target_type_check(cversion, tversion, **kwargs):
37613780
result = FAIL_O
@@ -6465,6 +6484,7 @@ class CheckManager:
64656484
l3out_overlapping_loopback_check,
64666485
intersight_upgrade_status_check,
64676486
isis_redis_metric_mpod_msite_check,
6487+
fabric_bfd_isis_check,
64686488
bgp_golf_route_target_type_check,
64696489
docker0_subnet_overlap_check,
64706490
uplink_limit_check,

‎docs/docs/validations.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,7 @@ Items | Defect | This Script
201201
[N9K-C9408 with more than 5 N9K-X9400-16W LEMs][d31] | CSCws82819 | :white_check_mark: | :no_entry_sign:
202202
[Multi-Pod Modular Spine Bootscript File][d32] | CSCwr66848 | :white_check_mark: | :no_entry_sign:
203203
[Inband Management Policy Misconfiguration][d33]| CSCwd40071 | :white_check_mark: | :no_entry_sign:
204+
[Fabric BFD on ISIS][d34] | N/A | :white_check_mark: | :no_entry_sign:
204205

205206
[d1]: #ep-announce-compatibility
206207
[d2]: #eventmgr-db-size-defect-susceptibility
@@ -235,6 +236,7 @@ Items | Defect | This Script
235236
[d31]: #n9k-c9408-with-more-than-5-n9k-x9400-16w-lems
236237
[d32]: #multi-pod-modular-spine-bootscript-file
237238
[d33]: #inband-management-policy-misconfiguration
239+
[d34]: #fabric-bfd-on-isis
238240

239241
## General Check Details
240242

@@ -2701,6 +2703,16 @@ Do not upgrade to any affected ACI software release if this check fails.
27012703
Nexus Dashboard Insights (NDI) integration can cause ACI tech support generation to happen automatically as part of the bug scan feature.
27022704

27032705

2706+
### Fabric BFD on ISIS
2707+
2708+
Enabling Fabric BFD (BFD on ISIS) is not recommended. The operational benefit is minimal to none, while the potential adverse impact is significantly higher:
2709+
2710+
* In a leaf-spine fabric, ISIS peers are directly connected sub-interfaces. If a peer device goes down, the physical link also goes down, which triggers Layer-1 convergence. In such scenarios — the vast majority of failure cases — BFD provides no additional convergence benefit.
2711+
* BFD is susceptible to false flaps when BFD packets do not receive sufficient CPU cycles (for example, during periods of high CPU utilization such as tech-support collections). False BFD flaps directly impact ISIS adjacencies, which can destabilize the entire fabric control plane.
2712+
2713+
This check fails if any `l3IfPol` (Fabric > Fabric Policies > Policies > Interface > L3 Interface) has `bfdIsis` set to `enabled`. Disable Fabric BFD on ISIS before upgrade or downgrade.
2714+
2715+
27042716
### Policydist configpushShardCont crash
27052717

27062718
In ACI, there are internal objects which track the underlying transactions which occur as policies are handled by the Policydist process. One such object is `configpushShardCont` which populates the `headTx` and `tailTx` parameters to mark any potentially stuck transactions.

‎tests/checks/fabric_bfd_isis_check/bfd_isis_disabled.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
[
2+
{
3+
"l3IfPol": {
4+
"attributes": {
5+
"bfdIsis": "disabled",
6+
"dn": "uni/fabric/l3IfP-default"
7+
}
8+
}
9+
}
10+
]

‎tests/checks/fabric_bfd_isis_check/bfd_isis_enabled.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
[
2+
{
3+
"l3IfPol": {
4+
"attributes": {
5+
"bfdIsis": "enabled",
6+
"dn": "uni/fabric/l3IfP-default"
7+
}
8+
}
9+
}
10+
]

‎tests/checks/fabric_bfd_isis_check/bfd_isis_mixed.json‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
[
2+
{
3+
"l3IfPol": {
4+
"attributes": {
5+
"bfdIsis": "disabled",
6+
"dn": "uni/fabric/l3IfP-default"
7+
}
8+
}
9+
},
10+
{
11+
"l3IfPol": {
12+
"attributes": {
13+
"bfdIsis": "enabled",
14+
"dn": "uni/fabric/l3IfP-custom1"
15+
}
16+
}
17+
},
18+
{
19+
"l3IfPol": {
20+
"attributes": {
21+
"bfdIsis": "enabled",
22+
"dn": "uni/fabric/l3IfP-custom2"
23+
}
24+
}
25+
}
26+
]

‎tests/checks/fabric_bfd_isis_check/no_l3IfPol.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
[]

‎tests/checks/fabric_bfd_isis_check/test_fabric_bfd_isis_check.py‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
import os
2+
import pytest
3+
import logging
4+
import importlib
5+
from helpers.utils import read_data
6+
7+
script = importlib.import_module("aci-preupgrade-validation-script")
8+
9+
log = logging.getLogger(__name__)
10+
dir = os.path.dirname(os.path.abspath(__file__))
11+
12+
test_function = "fabric_bfd_isis_check"
13+
14+
# icurl queries
15+
api = 'l3IfPol.json'
16+
17+
18+
@pytest.mark.parametrize(
19+
"icurl_outputs, expected_result",
20+
[
21+
# No l3IfPol MOs returned
22+
({api: read_data(dir, "no_l3IfPol.json")}, script.PASS),
23+
# bfdIsis disabled on the default policy
24+
({api: read_data(dir, "bfd_isis_disabled.json")}, script.PASS),
25+
# bfdIsis enabled on the default policy
26+
({api: read_data(dir, "bfd_isis_enabled.json")}, script.FAIL_O),
27+
# Multiple l3IfPol MOs - some enabled, some disabled
28+
({api: read_data(dir, "bfd_isis_mixed.json")}, script.FAIL_O),
29+
],
30+
)
31+
def test_logic(run_check, mock_icurl, expected_result):
32+
result = run_check()
33+
assert result.result == expected_result

0 commit comments

Comments
 (0)