The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Introduction
The Cisco Application Centric Infrastructure (ACI) is an architecture that allows the application to define the networking requirements in a programmatic way. This architecture simplifies, optimizes, and accelerates the entire application deployment lifecycle. Cisco Application Policy Infrastructure Controller (APIC) is the software, or operating system, that acts as the controller.
This document describes the features, issues, and limitations for the Cisco APIC software. For the features, issues, and limitations for the Cisco NX-OS software for the Cisco Nexus 9000 series switches, see the Cisco Nexus 9000 ACI-Mode Switches Release Notes, Release 15.2(4).
For more information about this product, see "Related Content."
Date |
Description |
May 6, 2024 |
In the Miscellaneous Compatibility Information section, added:
● 4.3.2.240009 CIMC HUU ISO for UCS C220/C240 M5 (APIC-L3/M3)
|
May 1, 2024 |
In the Miscellaneous Compatibility Information section, removed the older CIMC releases to reduce the clutter. |
January 11, 2023 |
In the Hardware Compatibility Information section, removed APIC-M1 and APIC-L1. The last date of support was October 31, 2021. |
November 29, 2022 |
In the Known Issues section, added:
● If you are upgrading to Cisco APIC release 4.2(6o), 4.2(7l), 5.2(1g), or later, ensure that any VLAN encapsulation blocks that you are explicitly using for leaf switch front panel VLAN programming are set as "external (on the wire)." If these VLAN encapsulation blocks are instead set to "internal," the upgrade causes the front panel port VLAN to be removed, which can result in a datapath outage.
|
November 18, 2022 |
In the Open Issues section, added bug CSCwc66053. |
September 27, 2022 |
In the Open Issues section, added bug CSCwc49449. |
August 8, 2022 |
Release 5.2(4f) became available; there are no changes to this document for this release. See the Cisco Nexus 9000 ACI-Mode Switches Release Notes, Release 15.2(4) for the changes in this release. |
August 1, 2022 |
In the Miscellaneous Compatibility Information section, added:
● 4.2(2a) CIMC HUU ISO (recommended) for UCS C220/C240 M5 (APIC-L3/M3)
● 4.1(2k) CIMC HUU ISO (recommended) for UCS C220/C240 M4 (APIC-L2/M2)
|
July 28, 2022 |
In the Open Issues section, added bug CSCvz31425. |
July 1, 2022 |
In the Open Issues section, added bug CSCwb93239. |
June 30, 2022 |
In the section Miscellaneous Compatibility, added information about Cisco Nexus Dashboard Insights creating the cisco_SN_NI user. |
May 6, 2022 |
In the Open Issues section, added bug CSCwb56853. |
April 12, 2022 |
In the Resolved Issues section, added bug CSCvz94062. |
April 4, 2022 |
In the Closed Issues section, added bug CSCvz85579. |
March 21, 2022 |
In the Miscellaneous Compatibility Information section, added:
● 4.1(3f) CIMC HUU ISO (recommended) for UCS C220/C240 M5 (APIC-L3/M3)
|
March 15, 2022 |
Release 5.2(4e) became available. Added the resolved bugs for this release. |
March 4, 2022 |
In the Open Issues section, added bug CSCwb00781. |
February 19, 2022 |
Release 5.2(4d) became available. |
Feature |
Description |
DHCP server preference |
When configuring a DHCP relay policy, you can now use the DHCP Server Preference option to select the administrative preference value for this provider. Using the value in this field, the leaf switch determines whether to route the DHCP relay packets from the client VRF or the server VRF. For more information, see the Cisco APIC Basic Configuration Guide, Release 5.2(x). |
Dynamic L3Out EPG classification |
The dynamic L3Out EPG classification (DEC) feature enables dynamic changes in pcTag with routing changes. For more information, see the Cisco APIC Layer 3 Networking Configuration Guide, Release 5.2(x). |
Fallback route groups |
This feature provides fast convergence for a destination that is reachable using a primary route and fallback route. You can group multiple next-hops of a route into one fallback route group so that if next-hop of the primary route fails, a Cisco ACI leaf switch can replace the failed primary next-hop with all the next-hops of the group in the hardware table before the control plane convergence with the routing protocol happens. This hardware-based convergence can happen within a second compared to multiple seconds or minutes for convergence through the control plane. In addition, next-hop failures can be detected faster through BFD. For more information, see the Configuring Fallback Route Groups document. |
Mis-cabling protocol strict mode |
In strict mode, the mis-cabling protocol (MCP) checks for loops before allowing data traffic. Early loop detection is supported, and data traffic is blocked until the early loop detection process is complete. For more information, see the Cisco Application Centric Infrastructure Fundamentals, Releases 5.2(x). |
Route filtering and aggregation |
There is now an option to summarize or filter routes that are advertised in a fabric to reduce the scale requirements of the fabric. For more information, see the Cisco APIC Layer 3 Networking Configuration Guide, Release 5.2(x). |
Service EPG selector for endpoint security groups |
The service EPG selector for endpoint security groups (ESGs) is now available. This feature allows you to map a service EPG to an ESG and create a contract with that ESG. Using this feature, even if you have a vzAny-to-vzAny permit contract that is configured, you can add a deny contract between the service ESG and other ESGs to allow specific ESGs to communicate with the service ESG. For more information, see the Cisco APIC Security Configuration Guide, Release 5.2(x). |
SSL option for the transport protocol for syslog messages |
SSL is now an option for the transport protocol for syslog messages. This feature enables a Cisco ACI switch (acting as a client) to make a secure, encrypted outbound connection to remote syslog servers (acting as a server) supporting secure connectivity for logging. With authentication and encryption, this feature allows for a secure communication over an insecure network. For more information, see the Cisco APIC Basic Configuration Guide, Release 5.2(x). |
Support for adding or replacing a Cisco ACI switch that reaches to the Cisco APIC cluster only through an IPN device with Cisco NXOS to Cisco ACI POAP auto-conversion |
With Cisco ACI power-on auto-provisioning (POAP) auto-conversion, you can now add a Cisco NX-OS node as a new remote leaf node, add a Cisco NX-OS node as a first spine node in a new pod, replace a remote leaf node, or replace a spine node in a Cisco ACI Multi-Pod setup with only one spine node in the pod. For more information, see the Cisco APIC Getting Started Guide, Release 5.2(x) |
Support for BFD on secondary IPv4/IPv6 subnets |
Bidirectional Forwarding Detection (BFD) is now supported for static routes that are reachable using secondary IPv4/IPv6 subnets that are configured on routed interfaces. For more information, see the Cisco APIC Layer 3 Networking Configuration Guide, Release 5.2(x). |
Support for DHCPv6 option 79 |
Option 79 is now supported for DHCPv6, which provides the client's link layer address in the DHCPv6 messages that are sent toward the server. When a relay message from the client to the server contains the client identifier DUID and option 79, the server identifies the option 79 present in the solicit packet that is sent to the server for requesting an IP address. The IPv6 allocation is performed based on option 79 and not based on the DUID. For more information, see the Cisco APIC Basic Configuration Guide, Release 5.2(x). |
Support for FIPS 140-2 |
The FIPS cryptographic functions have been updated to be compatible with current FIPS 140-2 requirements. |
Support for Smart License using Policy |
The Cisco ACI Smart Licensing feature has been replaced by the Cisco ACI Smart License using Policy (SLP) feature. SLP is a software management platform that manages all Cisco product licenses. SLP simplifies license management compared to the original Cisco Smart Licensing feature. SLP provides a licensing solution that does not interrupt the operations of your network and enables a compliance relationship that considers the hardware and software licenses you purchase and use. For more information, see the Cisco ACI Smart Licensing using Policy |
Support for the same encapsulation for IPv4 and IPv6 |
You can now use the same encapsulation for IPv4 and IPv6. One port group is created for the IPv4 and IPv6 address families for the same L3Out with a VMM domain. While deploying a floating SVI, if both address families are configured under the L3Out, both floating SVIs for IPv4 and IPv6 are deployed on the leaf nodes. For more information, see the Using Floating L3Out to Simplify Outside Network Connections document. |
Support for vzAny for an Intersite L3Out |
You can now enable vzAny contracts between a consumer VRF instance and L3Out external EPGs that are part of a different provider VRF instance. For more information, see the Cisco Multi-Site Configuration Guide for ACI Fabrics, Release 3.3(x). |
Synchronous Ethernet and PTP Telecom profile (G.8275.1) support on port channels |
Synchronous Ethernet (SyncE) and the PTP Telecom profile (G.8275.1) are now supported on port channels. Cisco APIC System Management Configuration Guide, Release 5.2(x) |
For the new hardware features, see the Cisco Nexus 9000 ACI-Mode Switches Release Notes, Release 15.2(4).
Changes in Behavior
For the changes in behavior, see the Cisco ACI Releases Changes in Behavior document.
Open Issues
Click the bug ID to access the Bug Search tool and see additional information about the bug. The "Exists In" column of the table specifies the 5.2(4) releases in which the bug exists. A bug might also exist in releases other than the 5.2(4) releases.
Bug ID |
Description |
Exists in |
For strict security requirements, customers require custom certificates that have RSA key lengths of 3072 and 4096. |
5.2(4d) and later |
|
Support for local user (admin) maximum tries and login delay configuration. |
5.2(4d) and later |
|
A SPAN session with the source type set to "Routed-Outside" goes down. The SPAN configuration is pushed to the anchor or non-anchor nodes, but the interfaces are not pushed due to the following fault: "Failed to configure SPAN with source SpanFL3out due to Source fvIfConn not available". |
5.2(4d) and later |
|
A breakout parent port shows in the drop-down list for the SPAN source even after the port is broken out. |
5.2(4d) and later |
|
Traffic from an endpoint under a remote leaf switch to an external node and its attached external networks is dropped. This occurs if the external node is attached to an L3Out with a vPC and there is a redistribution configuration on the L3Out to advertise the reachability of the external nodes as direct-attached hosts. |
5.2(4d) and later |
|
A Nexus Insights app sees some extra flows sent from the spine switch when a subnet is added in a VRF instance for flow telemetry and then the subnet is deleted. |
5.2(4d) and later |
|
While performing ID recovery, id-import gets timed out. Due to this, ID recovery fails. |
5.2(4d) and later |
|
For a health record query using the last page and a time range, the GUI displays some health records with a creation time that is beyond the time range (such as 24h). |
5.2(4d) and later |
|
After migrating a VM between two hosts using VMware vMotion, EPG does not get deployed on the target leaf node. When affected, the fvIfConn managed object corresponding to the missing EPG can be seen on APIC, but it would be missing from the target leaf node when queried. |
5.2(4d) and later |
|
When there are more than 40 objects in the tree and you double click on an object in the BGP Peer table, then the tree does not expand because the tree does not have pagination. The APIC tries to load all objects in one query, which is drastically slows the GUI. |
5.2(4d) and later |
|
The GIPo address is only visible on APIC 1 when using the command "cat /data/data_admin/sam_exported.config". The command output from the other APICs outputs do not show the GIPo address. |
5.2(4d) and later |
|
When HBR is enabled on a source EPG's bridge domain and the subnet is configured with the private scope (advertise externally = FALSE), if there is a shared service EPG contract with an L3Out, the L3Out will not publish the subnet or the corresponding /32 host routes because of this private scope. In this scenario, if there is also an explicit ESG leakRoute configured for the same subnet across those VRF instances, the leakRoute is faulted because the route is already shared with an EPG contract, and the leakRoute is installed in the hardware along with a pcTag, then the leakRoute should not be processed and any flags under it should not be considered. But, if this explicit leakRoute has a public scope, the /32 host routes are still published externally out of the L3Out, which should not happen as the leakRoute itself is faulted and bridge domain subnet scope is private. |
5.2(4d) and later |
|
When a VRF-level subnet <fvRtSummSubnet> and instP-level subnet <l3extSubnet> with a summary policy is configured for an overlapping subnet, the routes will get summarized by the configuration that was added first. But, the fault on the configuration that was added last will not be shown in the Cisco APIC GUI. |
5.2(4d) and later |
|
When a VRF-level subnet, fvRtSummSubnet, exists with a summary policy and an instP level subnet, <l3extSubnet>, with the same subnet as the VRF-level subnet is associated with summary policy, then there won't be any fault seen on the Cisco APIC. The summarization will be done according to the VRF-level subnet <fvRtSummSubnet>. |
5.2(4d) and later |
|
VMM domain attachments of floating SVIs configured for dual stack with the same encapsulation and the same VMM domain attachments are not being cleaned up after downgrading from 5.2(4) to an earlier release. |
5.2(4d) and later |
|
Importing the routing table of a remote site carries the wrong autonomous system number (ASN). |
5.2(4d) and later |
|
Spine switches repeatedly reload, many services are tainted, and the stack trace of the kernel contains messages that state "out of memory" and "Page fault." |
5.2(4d) and later |
|
The GUI displays the following error: Failed, Local Upload Failure Msg (Request failed with status code 413). |
5.2(4d) and later |
|
When a maintenance policy has multiple switch nodes, such as vPC pair nodes, an SMU's uninstallation gets stuck in the "queued" state for one of the nodes. |
5.2(4d) and later |
|
Preconfiguration validations for L3Outs that occur whenever a new configuration is pushed to the Cisco APIC might not get triggered. |
5.2(4d) and later |
|
APIC fails to update standalone Layer3 controller subnet on its fabric.The following fault is raised. F609478 - [FSM:FAILED]: Update Standalone Controller Subnet(TASK:ifc:policymgr:FabricCtrlrConfigPUpdatePodConnPDef) |
5.2(4d) and later |
|
The NICC app image fails to load. |
5.2(4d) and later |
|
This is added functionality for upgrade show command. 1. acidiag show postupgrade -service <dme> -> This gives details for dmes and which shard still have pending postUpgradeCb. 2.acidiag show postupgrade -service <dme> -shard <shard_id> -> This gives the details of log path for the dmes and shard for which postUpgradeCb has been completed. |
5.2(4d) and later |
|
For a customer using America/Mexico_City time, the DST time change will still happen on APIC in the year 2023. |
5.2(4d) and later |
|
Major fault F3083 ("IP detected on multiple MACs") is raised under a uEPG and ESG when an EPG selector is configured in the ESG. |
5.2(4d) and later |
|
User configuration is missing on APICs and switches following an ungraceful reload or power outage. |
5.2(4d) and later |
|
During upgrade "deserialization error" is seen on APIC 1 PD. |
5.2(4d) and later |
|
Numerous files that are in the deleted state, but are still being used by multiple processes, are not allowing the files to be removed from the file system. This causes the Cisco APIC storage to surpass the 90% threshold of log rotation. |
5.2(4d) and later |
|
When using the OpenStack integration, the Cisco APIC VMM Manager process may consume more memory than is available and then end. |
5.2(4d) and later |
|
When running "show running-config" from API CLI, the command takes several minutes to complete. Several thousand API requests are seen in access.log querying ptpRsProfile on every static path. |
5.2(4d) and later |
|
In the following topology: Tenant 1: VRF 1 > EPG A, EPG B. There is an any-to-any Intra VRF instance contract and EPG A and B are providers for an inter-VRF instance contract. VRF 2 > L3Out or EPG. The VRF instance consumes the inter-VRF instance contract. Traffic will unexpectedly get sent to the wrong rule when inter-VRF instance traffic is flowing. |
5.2(4d) and later |
|
App installation fails on the Cisco APIC with the error "Unable to add elasticsearch credentials". This is seen for any app making use of Elasticsearch, such as Nexus Insight Cloud Connector. |
5.2(4d) and later |
|
In a remote leaf switch, when the initial policy download happens, nginx generates a core. The process recovers by itself after a restart. This issue does not have any major functionality impact. |
5.2(4d) and later |
|
SAML authentication fails when using the HTTPS Proxy 5.2 image. |
5.2(4d) and later |
|
In an OpenShift deployment that is running Cisco ACI CNI, errors similar to the following examples are observed in the aci-containers-controller pod: oc logs -n aci-containers-system aci-containers-controller-5845449f5d-sdkwg | grep "Error while refreshing subscription" time="2022-02-12T15:18:10Z" level=error msg="Error while refreshing subscription" code=0 mod=APICAPI status=400 text="Subscription refresh timeout" url=<...> In an OpenShift deployment that is running the Cisco ACI Neutron plugin, errors similar to the following examples are observed in the aim logs in /var/log/containers/aim/aim-aid.log*: 2022-01-11 10:01:18.696 250002 140706618431232 WARNING root [-] Could not refresh subscription: ... |
5.2(4d) |
Resolved Issues
Bug ID |
Description |
Fixed in |
In an OpenShift deployment that is running Cisco ACI CNI, errors similar to the following examples are observed in the aci-containers-controller pod: oc logs -n aci-containers-system aci-containers-controller-5845449f5d-sdkwg | grep "Error while refreshing subscription" time="2022-02-12T15:18:10Z" level=error msg="Error while refreshing subscription" code=0 mod=APICAPI status=400 text="Subscription refresh timeout" url=<...> In an OpenShift deployment that is running the Cisco ACI Neutron plugin, errors similar to the following examples are observed in the aim logs in /var/log/containers/aim/aim-aid.log*: 2022-01-11 10:01:18.696 250002 140706618431232 WARNING root [-] Could not refresh subscription: ... |
5.2(4e) |
|
The browser hangs when clicking on the alert bell in the header bar. |
5.2(4d) |
|
The remote site unicast DTEP is missing in the route-map. Hence, the route is not getting redistributed into the fabric. |
5.2(4d) |
|
Configuration exports are failing with reason "Backup job has timed out" when two objects with different keys were converted into the same objects during a configuration export, which causes conflicts. |
5.2(4d) |
|
There is a stack trace dump in the DME log due to a CRIT level log message. |
5.2(4d) |
|
A Layer 3 Cisco APIC becomes disconnected from the rest of the fabric. |
5.2(4d) |
|
An SMU's upgrade status shows as "reload pending," but the reload is actually completed and the SMU is activated. |
5.2(4d) |
|
Consider the following scenario: 1. An EPG provider with subnet A defined under an EPG, is a provider for contract in VRF1. 2. Configure an l3out/Ext-EPG in VRF2 as contract consumer 3. Validate that the subnet flags are being used for route advertisement in the L3Out. 4. Now, configure the same subnet A as a route-leak under a VRF instance with route advertisement configured as FALSE. This route-leak policy should trigger a fault, as the EPG contract leak-route takes precedence. In this faulty state, the adv-external property under the VRF instance leakRoute shouldn’t take effect, as this policy is in a faulty state. However, irrespective of the fault , the VRF instance route leak flag takes precedence and routes are advertised out of the L3Out. This is when the provider EPG has a contract with the L3Out, and "Advertise External == False" on the bridge domain. |
5.2(4d) |
|
In an OpenShift on OpenStack setup, after VM migration, and connectivity to the pods inside that VM may be lost when accessed from pods running on other VMs not on that same physical host. |
5.2(4d) |
Known Issues
Click the bug ID to access the Bug Search tool and see additional information about the bug. The "Exists In" column of the table specifies the 5.2(4) releases in which the bug exists. A bug might also exist in releases other than the 5.2(4) releases.
Bug ID |
Description |
Exists in |
The "show run leaf|spine <nodeId>" command might produce an error for scaled up configurations. |
5.2(4d) and later |
|
With a uniform distribution of EPs and traffic flows, a fabric module in slot 25 sometimes reports far less than 50% of the traffic compared to the traffic on fabric modules in non-FM25 slots. |
5.2(4d) and later |
|
When you click Restart for the Microsoft System Center Virtual Machine Manager (SCVMM) agent on a scaled-out setup, the service may stop. You can restart the agent by clicking Start. |
5.2(4d) and later |
|
One of the following symptoms occurs: App installation/enable/disable takes a long time and does not complete. Nomad leadership is lost. The output of the acidiag scheduler logs members command contains the following error: Error querying node status: Unexpected response code: 500 (rpc error: No cluster leader) |
5.2(4d) and later |
|
The CRC and stomped CRC error values do not match when seen from the APIC CLI compared to the APIC GUI. This is expected behavior. The GUI values are from the history data, whereas the CLI values are from the current data. |
5.2(4d) and later |
|
Upgrading Cisco APIC from a 3.x release to a 4.x release causes Smart Licensing to lose its registration. Registering Smart Licensing again will clear the fault. |
5.2(4d) and later |
|
In the 4.x and later releases, if a firmware policy is created with different name than the maintenance policy, the firmware policy will be deleted and a new firmware policy gets created with the same name, which causes the upgrade process to fail. |
5.2(4d) and later |
|
svcredirDestmon objects get programmed in all of the leaf switches where the service L3Out is deployed, even though the service node may not be connected to some of the leaf switch. There is no impact to traffic. |
5.2(4d) and later |
|
A remote leaf switch has momentary traffic loss for flushed endpoints as the traffic goes through the tglean path and does not directly go through the spine switch proxy path. |
5.2(4d) and later |
|
xR IP flush for all endpoints under the bridge domain subnets of the EPG being migrated to ESG. This will lead to a temporary traffic loss on remote leaf switch for all EPGs in the bridge domain. Traffic is expected to recover. |
5.2(4d) and later |
|
With the floating L3Out multipath recursive feature, if a static route with multipath is configured, not all paths are installed at the non-border leaf switch/non-anchor nodes. |
5.2(4d) and later |
|
Starting with the 5.2(4) release, the following apps built with the following non-compliant Docker versions cannot be installed nor run: · ConnectivityCompliance 1.2 · SevOneAciMonitor 1.0 |
5.2(4d) and later |
|
The file size mentioned in the status managed object for techsupport "dbgexpTechSupStatus" is wrong if the file size is larger than 4GB. |
5.2(4d) and later |
|
In the "Visibility and Troubleshooting Wizard," ERSPAN support for IPv6 traffic is not available. |
5.2(4d) and later |
|
While navigating to the last records in the various History sub tabs, it is possible to not see any results. The first, previous, next, and last buttons will then stop working too. |
5.2(4d) and later |
|
VMMmgr process experiences a very high load for an extended period of time that impacts other operations that involve it. The process may consume excessive amount of memory and get aborted. This can be confirmed with the command "dmesg -T | grep oom_reaper" if messages such as the following are reported: oom_reaper: reaped process 5578 (svc_ifc_vmmmgr.) |
5.2(4d) and later |
|
When the "BGP" branch is expanded in the Fabric > Inventory > POD 1 > Leaf > Protocols > BGP navigation path, the GUI freezes and you cannot navigate to any other page. This occurs because the APIC gets large set of data in response, which cannot be handled by the browser for parts of the GUI that do not have the pagination. |
5.2(4d) and later |
|
License manager occasionally cores after image upgrade. |
5.2(4d) and later |
|
N/A |
If you are upgrading to Cisco APIC release 4.2(6o), 4.2(7l), 5.2(1g), or later, ensure that any VLAN encapsulation blocks that you are explicitly using for leaf switch front panel VLAN programming are set as "external (on the wire)." If these VLAN encapsulation blocks are instead set to "internal," the upgrade causes the front panel port VLAN to be removed, which can result in a datapath outage. |
5.2(4d) and later |
N/A |
Beginning in Cisco APIC release 4.1(1), the IP SLA monitor policy validates the IP SLA port value. Because of the validation, when TCP is configured as the IP SLA type, Cisco APIC no longer accepts an IP SLA port value of 0, which was allowed in previous releases. An IP SLA monitor policy from a previous release that has an IP SLA port value of 0 becomes invalid if the Cisco APIC is upgraded to release 4.1(1) or later. This results in a failure for the configuration import or snapshot rollback. The workaround is to configure a non-zero IP SLA port value before upgrading the Cisco APIC, and use the snapshot and configuration export that was taken after the IP SLA port change. |
5.2(4d) and later |
N/A |
If you use the REST API to upgrade an app, you must create a new firmware.OSource to be able to download a new app image. |
5.2(4d) and later |
N/A |
In a multipod configuration, before you make any changes to a spine switch, ensure that there is at least one operationally "up" external link that is participating in the multipod topology. Failure to do so could bring down the multipod connectivity. For more information about multipod, see the Cisco Application Centric Infrastructure Fundamentals document and the Cisco APIC Getting Started Guide. |
5.2(4d) and later |
N/A |
With a non-english SCVMM 2012 R2 or SCVMM 2016 setup and where the virtual machine names are specified in non-english characters, if the host is removed and re-added to the host group, the GUID for all the virtual machines under that host changes. Therefore, if a user has created a micro segmentation endpoint group using "VM name" attribute specifying the GUID of respective virtual machine, then that micro segmentation endpoint group will not work if the host (hosting the virtual machines) is removed and re-added to the host group, as the GUID for all the virtual machines would have changed. This does not happen if the virtual name has name specified in all english characters. |
5.2(4d) and later |
N/A |
A query of a configurable policy that does not have a subscription goes to the policy distributor. However, a query of a configurable policy that has a subscription goes to the policy manager. As a result, if the policy propagation from the policy distributor to the policy manager takes a prolonged amount of time, then in such cases the query with the subscription might not return the policy simply because it has not reached policy manager yet. |
5.2(4d) and later |
N/A |
When there are silent hosts across sites, ARP glean messages might not be forwarded to remote sites if a leaf switch without -EX or a later designation in the product ID happens to be in the transit path and the VRF is deployed on that leaf switch, the switch does not forward the ARP glean packet back into the fabric to reach the remote site. This issue is specific to transit leaf switches without -EX or a later designation in the product ID and does not affect leaf switches that have -EX or a later designation in the product ID. This issue breaks the capability of discovering silent hosts. |
5.2(4d) and later |
N/A |
Typically, faults are generally raised based on the presence of the BGP route target profile under the VRF table. However, if a BGP route target profile is configured without actual route targets (that is, the profile has empty policies), a fault will not be raised in this situation. |
5.2(4d) and later |
N/A |
MPLS interface statistics shown in a switch's CLI get cleared after an admin or operational down event. |
5.2(4d) and later |
N/A |
MPLS interface statistics in a switch's CLI are reported every 10 seconds. If, for example, an interface goes down 3 seconds after the collection of the statistics, the CLI reports only 3 seconds of the statistics and clears all of the other statistics. |
5.2(4d) and later |
Virtualization Compatibility Information
This section lists virtualization compatibility information for the Cisco APIC software.
· For a table that shows the supported virtualization products, see the ACI Virtualization Compatibility Matrix.
· For information about Cisco APIC compatibility with Cisco UCS Director, see the appropriate Cisco UCS Director Compatibility Matrix document.
· This release supports the following additional virtualization products:
Product |
Supported Release |
Information Location |
Microsoft Hyper-V |
● SCVMM 2019 RTM (Build 10.19.1013.0) or newer
● SCVMM 2016 RTM (Build 4.0.1662.0) or newer
● SCVMM 2012 R2 with Update Rollup 9 (Build 3.2.8145.0) or newer
|
N/A |
VMM Integration and VMware Distributed Virtual Switch (DVS) |
6.5, 6.7, and 7.0 |
Hardware Compatibility Information
This release supports the following Cisco APIC servers:
Product ID |
Description |
APIC-L2 |
Cisco APIC with large CPU, hard drive, and memory configurations (more than 1000 edge ports) |
APIC-L3 |
Cisco APIC with large CPU, hard drive, and memory configurations (more than 1200 edge ports) |
APIC-M2 |
Cisco APIC with medium-size CPU, hard drive, and memory configurations (up to 1000 edge ports) |
APIC-M3 |
Cisco APIC with medium-size CPU, hard drive, and memory configurations (up to 1200 edge ports) |
The following list includes general hardware compatibility information:
· For the supported hardware, see the Cisco Nexus 9000 ACI-Mode Switches Release Notes, Release 15.2(4).
· Contracts using matchDscp filters are only supported on switches with "EX" on the end of the switch name. For example, N9K-93108TC-EX.
· When the fabric node switch (spine or leaf) is out-of-fabric, the environmental sensor values, such as Current Temperature, Power Draw, and Power Consumption, might be reported as "N/A." A status might be reported as "Normal" even when the Current Temperature is "N/A."
· First generation switches (switches without -EX, -FX, -GX, or a later suffix in the product ID) do not support Contract filters with match type "IPv4" or "IPv6." Only match type "IP" is supported. Because of this, a contract will match both IPv4 and IPv6 traffic when the match type of "IP" is used.
The following table provides compatibility information for specific hardware:
Product ID |
Description |
Cisco UCS M4-based Cisco APIC |
The Cisco UCS M4-based Cisco APIC and previous versions support only the 10G interface. Connecting the Cisco APIC to the Cisco ACI fabric requires a same speed interface on the Cisco ACI leaf switch. You cannot connect the Cisco APIC directly to the Cisco N9332PQ ACI leaf switch, unless you use a 40G to 10G converter (part number CVR-QSFP-SFP10G), in which case the port on the Cisco N9332PQ switch auto-negotiates to 10G without requiring any manual configuration. |
Cisco UCS M5-based Cisco APIC |
The Cisco UCS M5-based Cisco APIC supports dual speed 10G and 25G interfaces. Connecting the Cisco APIC to the Cisco ACI fabric requires a same speed interface on the Cisco ACI leaf switch. You cannot connect the Cisco APIC directly to the Cisco N9332PQ ACI leaf switch, unless you use a 40G to 10G converter (part number CVR-QSFP-SFP10G), in which case the port on the Cisco N9332PQ switch auto-negotiates to 10G without requiring any manual configuration. |
N2348UPQ |
To connect the N2348UPQ to Cisco ACI leaf switches, the following options are available: Directly connect the 40G FEX ports on the N2348UPQ to the 40G switch ports on the Cisco ACI leaf switches Break out the 40G FEX ports on the N2348UPQ to 4x10G ports and connect to the 10G ports on all other Cisco ACI leaf switches. Note: A fabric uplink port cannot be used as a FEX fabric port. |
N9K-C9348GC-FXP |
This switch does not read SPROM information if the PSU is in a shut state. You might see an empty string in the Cisco APIC output. |
N9K-C9364C-FX |
Ports 49-64 do not support 1G SFPs with QSA. |
N9K-C9508-FM-E |
The Cisco N9K-C9508-FM-E2 and N9K-C9508-FM-E fabric modules in the mixed mode configuration are not supported on the same spine switch. |
N9K-C9508-FM-E2 |
The Cisco N9K-C9508-FM-E2 and N9K-C9508-FM-E fabric modules in the mixed mode configuration are not supported on the same spine switch. The locator LED enable/disable feature is supported in the GUI and not supported in the Cisco ACI NX-OS switch CLI. |
N9K-C9508-FM-E2 |
This fabric module must be physically removed before downgrading to releases earlier than Cisco APIC 3.0(1). |
N9K-X9736C-FX |
The locator LED enable/disable feature is supported in the GUI and not supported in the Cisco ACI NX-OS Switch CLI. |
N9K-X9736C-FX |
Ports 29 to 36 do not support 1G SFPs with QSA. |
Miscellaneous Compatibility Information
This release supports the following products:
Product |
Supported Release |
Cisco NX-OS |
15.2(4) |
Cisco UCS Manager |
2.2(1c) or later is required for the Cisco UCS Fabric Interconnect and other components, including the BIOS, CIMC, and the adapter. |
CIMC HUU ISO |
● 4.3.2.240009 CIMC HUU ISO (recommended) for UCS C220/C240 M5 (APIC-L3/M3)
● 4.2(3e) CIMC HUU ISO for UCS C220/C240 M5 (APIC-L3/M3)
● 4.2(3b) CIMC HUU ISO for UCS C220/C240 M5 (APIC-L3/M3)
● 4.2(2a) CIMC HUU ISO for UCS C220/C240 M5 (APIC-L3/M3)
● 4.1(3m) CIMC HUU ISO for UCS C220/C240 M5 (APIC-L3/M3)
● 4.1(3f) CIMC HUU ISO for UCS C220/C240 M5 (APIC-L3/M3)
● 4.1(3d) CIMC HUU ISO for UCS C220/C240 M5 (APIC-L3/M3)
● 4.1(3c) CIMC HUU ISO for UCS C220/C240 M5 (APIC-L3/M3)
● 4.1(2m) CIMC HUU ISO (recommended) for UCS C220/C240 M4 (APIC-L2/M2)
● 4.1(2k) CIMC HUU ISO for UCS C220/C240 M4 (APIC-L2/M2)
● 4.1(2g) CIMC HUU ISO for UCS C220/C240 M4 (APIC-L2/M2)
● 4.1(2b) CIMC HUU ISO for UCS C220/C240 M4 (APIC-L2/M2)
● 4.1(1g) CIMC HUU ISO for UCS C220/C240 M4 (APIC-L2/M2) and M5 (APIC-L3/M3)
● 4.1(1f) CIMC HUU ISO for UCS C220 M4 (APIC-L2/M2) (deferred release)
● 4.1(1d) CIMC HUU ISO for UCS C220 M5 (APIC-L3/M3)
● 4.1(1c) CIMC HUU ISO for UCS C220 M4 (APIC-L2/M2)
● 4.0(4e) CIMC HUU ISO for UCS C220 M5 (APIC-L3/M3)
● 4.0(2g) CIMC HUU ISO for UCS C220/C240 M4 and M5 (APIC-L2/M2 and APIC-L3/M3)
● 4.0(1a) CIMC HUU ISO for UCS C220 M5 (APIC-L3/M3)
● 3.0(4d) CIMC HUU ISO for UCS C220/C240 M3 and M4 (APIC-L2/M2)
● 3.0(3f) CIMC HUU ISO for UCS C220/C240 M4 (APIC-L2/M2)
● 2.0(13i) CIMC HUU ISO
● 2.0(9c) CIMC HUU ISO
● 2.0(3i) CIMC HUU ISO
|
Network Insights Base, Network Insights Advisor, and Network Insights for Resources |
For the release information, documentation, and download links, see the Cisco Network Insights for Data Center page. For the supported releases, see the Cisco Data Center Networking Applications Compatibility Matrix. |
· This release supports the partner packages specified in the L4-L7 Compatibility List Solution Overview document.
· A known issue exists with the Safari browser and unsigned certificates, which applies when connecting to the Cisco APIC GUI. For more information, see the Cisco APIC Getting Started Guide, Release 5.2(x).
· For compatibility with Day-2 Operations apps, see the Cisco Data Center Networking Applications Compatibility Matrix.
· Cisco Nexus Dashboard Insights creates a user in Cisco APIC called cisco_SN_NI. This user is used when Nexus Dashboard Insights needs to make any changes or query any information from the Cisco APIC. In the Cisco APIC, navigate to the Audit Logs tab of the System > History page. The cisco_SN_NI user is displayed in the User column.
Related Content
See the Cisco Application Policy Infrastructure Controller (APIC) page for the documentation.
The documentation includes installation, upgrade, configuration, programming, and troubleshooting guides, technical references, release notes, and knowledge base (KB) articles, as well as other documentation. KB articles provide information about a specific use case or a specific topic.
By using the "Choose a topic" and "Choose a document type" fields of the APIC documentation website, you can narrow down the displayed documentation list to make it easier to find the desired document.
You can watch videos that demonstrate how to perform specific tasks in the Cisco APIC on the Cisco Data Center Networking YouTube channel.
Temporary licenses with an expiry date are available for evaluation and lab use purposes. They are strictly not allowed to be used in production. Use a permanent or subscription license that has been purchased through Cisco for production purposes. For more information, go to Cisco Data Center Networking Software Subscriptions.
The following table provides links to the release notes, verified scalability documentation, and new documentation:
Document |
Description |
Cisco Nexus 9000 ACI-Mode Switches Release Notes, Release 15.2(4) |
The release notes for Cisco NX-OS for Cisco Nexus 9000 Series ACI-Mode Switches. |
This guide contains the maximum verified scalability limits for Cisco Application Centric Infrastructure (ACI) parameters for Cisco APIC and Cisco Nexus 9000 Series ACI-Mode Switches. |
Documentation Feedback
To provide technical feedback on this document, or to report an error or omission, send your comments to apic-docfeedback@cisco.com. We appreciate your feedback.
Legal Information
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2022-2024 Cisco Systems, Inc. All rights reserved.