Cisco Application Policy Infrastructure Controller Release Notes, Release 6.0(3)

September 30, 2024

In the Virtualization Compatibility Information section, added:

May 24, 2024

Release 6.0(3g) became available there are no changes to this document for this release. See the Cisco Nexus 9000 ACI-Mode Switches Release Notes, Release 16.0(3) for the changes in this release.

May 1, 2024

In the Miscellaneous Compatibility Information section, added:

April 8, 2024

In the Miscellaneous Compatibility Information section, added:

August 28, 2023

Release 6.0(3e) became available; there are no changes to this document for this release. See the Cisco Nexus 9000 ACI-Mode Switches Release Notes, Release 16.0(3) for the changes in this release.

August 9, 2023

Release 6.0(3d) became available.

Base Functionality

Rogue endpoint exception list support for bridge domains and L3Outs

You can create a global rogue/COOP exception list, which excludes a MAC address from rogue endpoint control on all the bridge domains on which the MAC address is discovered, and you can create a rogue/COOP exception list for L3Outs. You can also exclude all MAC addresses for a bridge domain or L3Out. This simplifies creating the exception list when you want to make an exception for every MAC address; you do not need to enter each address individually.

For more information, see the Cisco APIC Basic Configuration Guide, Release 6.0(x).

Reliability

TCP MSS adjustment

You can adjust the transmission control protocol (TCP) maximum segment size (MSS) to avoid packet fragmentation or drops.

For more information, see the Cisco APIC System Management Configuration Guide, Release 6.0(x).

Upgrade/Downgrade

Faster database conversion

The wait time for the database conversion process is shorter when compared to the previous releases.

For more information, see the Cisco APIC Installation and ACI Upgrade and Downgrade Guide.

Memory-based switch image installation

A switch installs either the 32-bit or 64-bit image based on the switch's amount of memory instead of based on a static mapping.

For more information, see the Cisco APIC Installation and ACI Upgrade and Downgrade Guide.

Interoperability

New TLVs for Azure Stack HCI

You can select new Time, Length, and Values (TLVs) for Azure Stack HCI.

For more information, see the Cisco APIC Support for CDP and LLDP document.

Policy mode for Cisco ACI and VMware NSX-T integration

You can now use the NSX-T Policy API mode, which uses the new Segment object.

For more information, see the Cisco ACI and VMware NSX-T Data Center Integration document and the VMware NSX-T Data Center documentation.

VMware vSphere 8.0

VMM domains now support VMware vSphere 8.0.

For more information, see the Cisco ACI vCenter Plug-in chapter in the Cisco ACI Virtualization Guide, 6.0(x) and Cisco ACI Virtual Edge Release Notes, Release 3.2(4).

Cisco ACI VMM Integration with Nutanix AHV

You can now integrate the Nutanix Acropolis Hypervisor (AHV) with Cisco Application Centric Infrastructure (ACI). The Cisco APIC integrates with Nutanix AHV and enhances the network management capabilities. The integration provides virtual and physical network automation and VM endpoints visibility in Cisco ACI.

For more information, see the Cisco ACI and Nutanix AHV Integration document.

Performance and Scalability

Scale enhancements

SR-MPLS

VRFs (Contexts)

◦    Default (Dual Stack) scale profile:

◦    Switches with 32GB of RAM: 2,000

◦    Other switches: 800

◦    High Dual Stack, High LPM, High Policy scale profiles:

◦    LSE2 switches with 32GB of RAM: 2,000

◦    Other switches: 800

◦    Maximum LPM scale profile:

◦    LSE2 switches with 32GB of RAM: 250

◦    Other switches: not supported

◦    Multicast heavy, IPv4 and High IPv4 EP scale:

◦    All switch models: 800

External EPGs

◦    Switches with 32GB of RAM: 2,000

◦    Other switches: 800

Contracts

◦    High LPM scale profile:

◦    LSE2 switches with 32GB of RAM: 32,000

◦    Other switches: 8,000

NetFlow

◦    EX switches: 100

◦    All other models: 350*

◦    EX switches: 100

◦    All other models: 350*

◦    EX switches: 100

◦    All other models: 1,000,000**

* The total NetFlow policies under a bridge domain or L3Out must be less than 350 (100 for EX switches).

** For more information, see Cisco APIC and NetFlow.

Forwarding Scale Profiles Supported Platforms

◦    N9K-C93180YC-FX with 32GB of RAM

◦    N9K-C93180YC-FX3 with 32GB of RAM

◦    N9K-C93108TC-FX3P with 32GB of RAM

Forwarding Scale Profiles Scalability

◦    VRFs (EX, FX2, FX2-E, and GX2A switches):

◦    GX2A switch models: 2,000

◦    Other switch models: 800

◦    VRFs (FX, FX3, FXP, GX, and GX2B switches):

◦    Switches with 32GB of RAM: 2,000

◦    Other switch models: 800

◦    VRFs (FX, FX3, FXP, GX, and GX2B switches):

◦    Switches with 32GB of RAM: 2,000

◦    Other switch models: 800

◦    Policy (FX, FX3, FXP, GX, and GX2B switches):

◦    Switches with 32GB of RAM: 32,000

◦    Other switches: 8,000

◦    VRFs (FX, FX3, FXP, GX, and GX2B switches):

◦    Switches with 32GB of RAM: 2,000

◦    Other switches: 800

◦    VRFs (FX, FX3, FXP, GX, and GX2B switches):

◦    Switches with 32GB of RAM: 2,000

◦    Other switches: 800

CSCwh68103

The property tDn (Target Dn) of class ID, such as infraRsHPathAtt and fabricRsOosPath, does not have any validation in place. A user can enter by mistake the wrong target Dn, for example because of a typo, and the APIC accepts the configuration without any warnings.

6.0(3e) and later

CSCwh81878

Flow telemetry information is not displayed for some nodes, and telemetry records are getting dropped in the NDI collector because the exporter ID does not match the value for the managed object collector ID.

6.0(3e) and later

CSCwj08006

When running release version 6.0(3e), the policymgr service can crash after pushing an Ansible configuration. Multiple core files get generated on APIC 2, which prevents the deployment any configuration, including a single L3Out push from the GUI. Fault F4367 and 576 configurations transactions get queued in transaction for more than 2 minutes.

Rebooting APIC 2 and APIC 3 results in APIC 1 generating a core 3 times with policymgr as well while APIC 2 is shutdown.

6.0(3e) and later

CSCwj44966

A16GB fixed spine switch has high memory usage and is running 64-bit switch image.

6.0(3e) and later

CSCwj74262

The physical domain is removed from an EPG when the CLI is used to remove all static path configurations from the EPG.

6.0(3e) and later

CSCvg81020

For strict security requirements, customers require custom certificates that have RSA key lengths of 3072 and 4096.

6.0(3d) and later

CSCvm56946

Support for local user (admin) maximum tries and login delay configuration.

6.0(3d) and later

CSCvt99966

A SPAN session with the source type set to "Routed-Outside" goes down. The SPAN configuration is pushed to the anchor or non-anchor nodes, but the interfaces are not pushed due to the following fault: "Failed to configure SPAN with source SpanFL3out due to Source fvIfConn not available".

6.0(3d) and later

CSCvy40511

Traffic from an endpoint under a remote leaf switch to an external node and its attached external networks is dropped. This occurs if the external node is attached to an L3Out with a vPC and there is a redistribution configuration on the L3Out to advertise the reachability of the external nodes as direct-attached hosts.

6.0(3d) and later

CSCwa58709

The GIPo address is only visible on APIC 1 when using the command "cat /data/data_admin/sam_exported.config". The command output from the other APICs outputs do not show the GIPo address.

6.0(3d) and later

CSCwa90084

- Traffic gets disrupted across a vPC pair on a given encapsulation.

OR

- EPG flood in encapsulation gets blackholed on a given encapsulation.

OR

- STP packets received on an encapsulation on a given port are not forwarded on all the leaf switches where the same EPG/same encapsulation is deployed.

6.0(3d) and later

CSCwd26277

When deploying a service graph, the dialog does not list all bridge domains for the provider connector. This issue is observed when you enter or edit the bridge domain name in the consumer connector field. After this, the provider connector will only list the bridge domain that is selected by the consumer connector field.

6.0(3d) and later

CSCwd81562

A Cisco APIC that was previously part of the Cisco APIC cluster will not rejoin the cluster after the reload, decommission, and commission process.

6.0(3d) and later

CSCwe47517

Initially, a switch node upgrade fails with the error "The requested URL returned error: 404 Not Found." After a few minutes, the switch downloads the image from the Cisco APIC.

6.0(3d) and later

CSCwe52465

The NICC app image fails to load.

6.0(3d) and later

CSCwe58398

This is added functionality for upgrade show command.

1. acidiag show postupgrade -service <dme>   -> This gives details for dmes and which shard still have pending postUpgradeCb.

2.acidiag show postupgrade -service <dme> -shard <shard_id> -> This gives the details of log path for the dmes and shard for which postUpgradeCb has been completed.

6.0(3d) and later

CSCwe92155

After configuring syslog using TCP on port 59500, the logit was sent out normally and netstat showed that it was established. However, after aborting the connection from the syslog server side, the TCP connection went from ESTABLISHED to CLOSE_WAIT and disappeared from the APIC side.

6.0(3d) and later

CSCwe93045

There is general slowness when an application contacts the Cisco APIC cluster through the REST API. The same slowness is experienced when accessing using the Cisco APIC GUI.

6.0(3d) and later

CSCwf16927

The system time does not reflect the daylight saving adjustments done in Egypt for releases prior to 5.3.1 and 6.0.4

6.0(3d) and later

CSCwf20254

There is a delay in the download and programming of policies on a node.

6.0(3d) and later

CSCwf48875

When using two different host profiles (for example UCS C-Series and UCS B-Series) to deploy NSX, the uplink policy will be different for the host profiles. In this case, using one uplink profile with two policies might cause traffic disruption for a non-default teaming policy.

6.0(3d) and later

CSCwf50517

When using the "add controllers" API with 3 or more nodes in the payload, the API can timeout in some cases.

6.0(3d) and later

CSCwf55317

Go to Tenant > Application Profile > Topology.

Drag and drop a contract. Problem 1: No pop up displays.

Drag and drop an EPG icon, then cancel the create view. Problem 2: The pop up remains open.

6.0(3d) and later

CSCwf59938

Fault code F1414 is triggered and cleared manually. After certain time, the fault is triggered again. This issue occurs when using the syslog server FQDN.

6.0(3d) and later

CSCwf92856

During upgrade "deserialization error" is seen on APIC 1 PD.

6.0(3d) and later

CSCwf94095

When attempting to authenticate using the CLI or HTTPS to an APIC running release 6.0(2h), any of the APICs in the cluster will randomly fail authentication one out of three times, and sometimes two out of three times. The CLI or GUI presents an "access denied" error, causing the user to believe a password may have been entered incorrectly. However, when this error occurs, a packet capture reveals that the APIC never sources an authentication request to the TACACS server.

6.0(3d) and later

CSCwf94748

Ingress and egress packet statistics can be viewed for VM and host in a Nutanix domain. For certain time stamps, the "MAX" packet count for the ingress and egress packet is shown incorrectly.

6.0(3d) and later

CSCwf99067

Deleting and re-adding RedirectDest with a different IP address, but the same MAC address, generates the following error: "Same virtual MAC is provided for different RedirectDest".

6.0(3d) and later

CSCwh03912

Disabling resilient hashing removes the backup PBR policy selection drop-down list. Upon clicking the Submit button, the following error displays: "Error: 400 - RsBackupPol can be created only if resilient hash is enabled"

6.0(3d) and later

CSCwh05135

Override vpc interface policy doesnot consistently take precedence over regular vpc interface policy.Upon a leaf reload, its quite random which policy takes precedence, and accordingly the vlans get programmed.If the override or regular AEP is missing the relevant domain association/vlans, then those vlans are not programmed causing outages.

6.0(3d) and later

CSCwh06326

Even after logging out from the Cisco APIC, the JSON Web Token (JWT) remains valid for about 10 minutes.

6.0(3d) and later

CSCwh07037

An outage occurred because traffic coming from the TEPs was dropped by the receiving leaf switches with INFRA_ENCAP_SRC_TEP_MISS.

6.0(3d) and later

CSCwh17898

The "panic: runtime error: invalid memory address or nil pointer dereference." Error occurred and then F1419 (Service kron failed on apic) was raised.

6.0(3d) and later

CSCwh18649

Inter-pod/Inter-site BGP peer is incorrectly marked as "manual,wan" under the BGP for the peer managed object of a spine switch.

6.0(3d) and later

CSCwh19753

SMU switch image download can get stuck.

6.0(3d) and later

CSCwh28834

The "show running config" command does not work in the APIC CLI and generates the following errors:

Error while processing mode: interface

Error while processing mode: leaf

Error while processing mode: configure

Error: ERROR occurred: <class 'xml.etree.ElementTree.ParseError'>, not well-formed (invalid token): line 1, column 51242,   File "/mgmt/opt/controller/yaci/yaci/_cfg.py", line 18, in _execute_func

    subCmd.runningConfig(ctx, **kwargs)

6.0(3d) and later

CSCwh41632

Enhancement - show apic upgrade complete only after postUpgradeCb is done

6.0(3d) and later

CSCwh41865

When upgrading an APIC, the "from" version is displayed as "to" version in the event record.

6.0(3d) and later

CSCwh44987

When a non-default OOB management EPG is configured and a default one is removed from the configuration, the default EPG will be recreated automatically after a fabric upgrade. This is causes fault F0523 "Configuration failed for EPG default due to Not Associated With Management Zone".

6.0(3d) and later

CSCwh47794

The ACI VMM Tags tab returns "the server returned unintelligible response" message even though the tag is retrievable using the CLI.

6.0(3d) and later

CSCwh53706

In scale setups, when there are more than the usual number of objects and if the user tries to load the Capacity Dashboard page, the page times out. A few queries that are hit from the browser and the page become stuck for few seconds.

6.0(3d) and later

CSCwh53727

The API call /mqapi2/deployment.query.json?mode=getvmmCapInfo that is done against the Cisco APICs by an external management system takes too long to process.

6.0(3d) and later

CSCwh55113

When viewing a Post Update Delta Analysis, one of the outputs is a searchable Audit Log.  Normally this log should be populated with any user driven adds, changes or delete actions in the time between pre and post analysis.  The audit log is rendered but only shows entries that are used by whatever credentials NDI uses to access a given APIC cluster (i.e those credentials used when you first add a site to NDI and need to authenticate to that site's APIC for the very first time).

6.0(3d) and later

CSCwh56716

When the Cisco APICs use Direct Connect to CSSM, running the "show license usage" command on APIC 1, 2, or 3 shows ACI_LEAF_ESS_10G 6 in use. When APICs 2 and 3 are restarted, this output is unchanged. When APIC 1 is restarted, the output becomes "No Licenses in use" on APICs 1, 2, and 3. The "Registering for Smart Licensing with Direct Connect to CSSM Using the GUI" process has to be done again.This was tested in the lab with Cisco APIC releases 5.2(6g), 5.2(7g), and 6.0(2j)

6.0(3d) and later

CSCwh61315

After issuing the APIC CLI "replace-controller reset x" commands, the failover status of the active controller does not change to default when checking using the 'show controller' commands.

6.0(3d) and later

CSCwh63412

Audit logs under System > History > Audit Logs are limited to the current logged in user. Only the user with the username admin can see the audit logs from all users, but other users despite having admin privileges cannot see the audit logs from other users. The audit logs under Tenants are visible to every user.

6.0(3d) and later

CSCwh67428

The GUI does not display maxSpeed and direction information in the equipment view.

6.0(3d) and later

CSCwh71724

F1419 gets raised for the kron service.

6.0(3d) and later

CSCwh74484

ACI pushes the VLANs from the old VLAN pool after changing the vNIC template in the UCSM

6.0(3d) and later

CSCwh75348

Decommission an APIC causes the message "the node configuration will be wiped out from controller" to display even though the controllers still retain the user configuration.

6.0(3d) and later

CSCwh75539

1. A spine switch consumes a ACI_LEAF_ESS_XF2 license, which results in the user having a negative count. However, a spine switch does not need license if the user bought it before 01/2024.

2. There is a discrepancy in the number of consumed licenses and the actual number of spine switches in a fabric.

6.0(3d) and later

CSCwh76879

Following the RMA workflow for replacing an APIC results in the APIC always having ID 1. A user should instead use the Add node workflow from the existing cluster to add the RMAed node.

6.0(3d) and later

CSCwh76885

If the CIMC is not available, out-of-band management cannot be used for BootX workflows for cluster bringup. The CIMC field should be optional so that if only OOB is configured, cluster bringup will still work.

6.0(3d) and later

CSCwh77285

OpFlex OOM crashes in leaf switches.

6.0(3d) and later

CSCwh78409

The SNMPD service failed on all Cisco APICs after configuring SNMPv3.

6.0(3d) and later

CSCwh81272

The system resets due to a policyelem high availability policy reset.

6.0(3d) and later

CSCwh83273

A Cisco APIC cannot be added to the cluster because the GUI rejects the ID if is not within the range of 1-7. The Initial Setup Configuration states that the fabric ID valid range is 1-128.

6.0(3d) and later

CSCwh84052

When using the OpenStack integration, the Cisco APIC VMM Manager process may consume more memory than is available and then end.

6.0(3d) and later

CSCwh87245

An edmManagedNic or compManagedNic object may be mapped to the wrong server (compHv).

6.0(3d) and later

CSCwh87458

Search Filters in Endpoint - Operational - Client Endpoints do not show up in the endpoint learning filter.

6.0(3d) and later

CSCwh95573

Fault "F4142" is raised when there is inconsistency in FNV and the idmgr database. Even though the addrAssigner in FNV is set to 0 and the corresponding "identContextElement" managed object is missing from the idmgr database, the fault gets raised.

6.0(3d) and later

CSCwh98712

When running "show running-config" from API CLI, the command takes several minutes to complete. Several thousand API requests are seen in access.log querying ptpRsProfile on every static path.

6.0(3d) and later

CSCwi01316

In the following topology:

Tenant 1:

VRF 1 > EPG A, EPG B.  There is an any-to-any Intra VRF instance contract and EPG A and B are providers for an inter-VRF instance contract.

VRF 2 > L3Out or EPG. The VRF instance consumes the inter-VRF instance contract.

Traffic will unexpectedly get sent to the wrong rule when inter-VRF instance traffic is flowing.

6.0(3d) and later

CSCwi03663

Recent upgraded versions of SCP servers do not support some of the old ciphers or host key algorithms causing SCP to/from APIC to break.

6.0(3d) and later

CSCwi06427

Navigating to FABRIC -> Inventory -> Pod1 -> Operational -> Routes -> IPv6 learned routes results in the following error message:Value is not specified for the argument 'undefined'

6.0(3d) and later

CSCwi09894

In a mini ACI fabric, the physical APIC does not join the cluster after power cycling the entire setup.

6.0(3d) and later

CSCwi12992

After upgrade to ACI 5.2(8), the custom SSL certificate is not installed in the Cisco APICs and the default self-signed SSL certificate is used instead.

6.0(3d) and later

CSCwi24526

The Tech Support 2of3 was not getting collected for vAPIC properly which is the reason you see the size difference for 2of3 bw APIC and vAPIC. The other TS 1of3 and 3of3 are properly collected for vAPIC.

6.0(3d) and later

CSCwi27591

The port channel connected to the APIC-hosted ESXi will be in a "FAIL" state, and the cluster will become diverged and the fault F0467 will be raised.

6.0(3d) and later

CSCwi40671

In a remote leaf switch, when the initial policy download happens, nginx generates a core. The process recovers by itself after a restart. This issue does not have any major functionality impact.

6.0(3d) and later

CSCwi52324

The fault F3227 "ACI failed processing an already accepted configuration change" continuously gets raised

6.0(3d) and later

CSCwi66348

A Cisco ACI switch can spend hours to complete the bootstrap process. At the worst, the expected completion time should be about 90 minutes.

6.0(3d) and later

CSCwi78474

An upgraded Cisco APIC may attempt the second upgrade to same version and assume itself as APIC 1, which can cause all Cisco APICs to stop the postUpgradeCb process, which stops the upgrade.

6.0(3d) and later

CSCwi97842

After upgrading, the Cisco APIC cluster is diverged and policymgr is down and repeatedly crashing on one Cisco APIC.

6.0(3d) and later

CSCwi99378

There are packet drops between the pods.

6.0(3d) and later

CSCwj08117

After a reboot is triggered, any of the Cisco APICs take around 1 hour to reach the cluster fully fit status and the affected DME is ifc_observer. During the issue, there is non-optimal leader for some shards for the service ifc_observer, which it clears after 30 minutes.

6.0(3d) and later

CSCwj13396

ACI switches show in maintenance with the CLI command "acidiag fnvread" on Cisco APIC, but they show "normal" in vsh and even top. System also shows In service.

- Switches do not show up in the GUI nor API for configurations, as APIC vectors it as in maintenance. This severely impacts the ability to make changes.

- Switches may continue to work normally even though no new configurations can be made on them.

6.0(3d) and later

CSCwj17966

The Cisco APIC bootmgr or appliance director allows an incorrect attribute/value update to be received in LLDP TLV due to miscabling.

6.0(3d) and later

CSCwj23752

Changing in the name of the remote-destination group stops the sending of syslog messages to the remote destination. Changing the port number or forwarding facility does not affect the sending of the messages. Only when the name is changed does the leaf switch stop sending the syslog messages. Enabling and disabling the policy does not resume the sending of the messages.

6.0(3d) and later

CSCwj32118

Tech support did not include manifest.json. Due to the difference in the name of device as per the "topsystem" and "hostname" commands, the code that is responsible for generating manifest file tracebacked and failed. This is an issue in tech support component.

6.0(3d) and later

CSCwj38953

log_bin_decode crashes on distinguished name decoding failures.

6.0(3d) and later

CSCwj42913

REST API can be used to configure static ports for nodes that are restricted in by a node rule.

6.0(3d) and later

CSCwj43407

Altering the IP SLA policy for an IP SLA track member led to the crashing of switches.

6.0(3d) and later

CSCwj55258

Fault F4144 will not clear from the Cisco APIC even with matching dhcpPool and Fabric Node Vector information.

6.0(3d) and later

CSCwj57993

The F0413 PSU fault is not reported by SMART callhome. The tcpdump command on the leaf switch does not show SMTP messages being sent for this fault for which the PSU was removed.

6.0(3d) and later

CSCwj69046

SAML authentication fails when using the HTTPS Proxy 5.2 image.

6.0(3d) and later

CSCwj74286

The Cisco APIC bootstrap gets stuck on the "A start job is running for oob-network" job startup after configuring the OOB IP address.

6.0(3d) and later

CSCwj88821

Cannot delete a static node's management address.

6.0(3d) and later

CSCwk13546

There are stale hvExtPl objects due to the hvsExtPol managed object not being cleaned up when an EPG is deleted.Fault F1606 is raised, but has no operational impact: desc :Fault delegate: Operational issues detected on portgroup error: Cannot find an EPG policy in the domain for the port group.

6.0(3d) and later

CSCwd82212

There is a login denied error while importing or exporting a configuration.

6.0(3d)

CSCwe01680

User is not allowed to configure static route for an inband EPG which is not deployed on the current APIC.

6.0(3d)

CSCwe03646

After moving a port from one selector/profile to another profile in the same transaction (only possible using the REST API), the port might stop working. This is non-deterministic.

6.0(3d)

CSCwe13941

Following are some of the symptoms seen because of this issue :

1. Failure to verify APIC's CIMC credentials.

2. Failure to verify the power status.

3. Failure to verify the serial number of the APIC as seen in CIMC.

These symptoms can be seen during the following workflows:

1. APIC Cluster Initial Bootstrap.

2. Adding a new APIC to the cluster - Expansion.

3. Replacing an APIC in the cluster - RMA operation.

4. Recommission of APIC following a decommission.

6.0(3d)

CSCwe39842

PXE boot for vmedia installation of the Cisco APIC 6.0(3) release does not work on APIC-SERVER-M2/M3/L2/L3.

6.0(3d)

CSCwe41446

When APICs are upgraded to the 6.0(3) release and switches are still on older releases, the upgraded standby Cisco APIC cannot join the cluster.

6.0(3d)

CSCwe46071

A leaf node gets stuck in bootstrap. Although bootstrap eventually gets forced completed, the node might not download the entire expected configuration, resulting in a node that is not fully functional.

6.0(3d)

CSCwe47966

SMU installation fails in the 6.0(3) release due to collecting the techsupport files prior to installing the SMU.

6.0(3d)

CSCwf54771

User configuration is missing on APICs and switches following an ungraceful reload or power outage.

6.0(3d)

CSCwf72015

vAPICs hosted on ESXi hosts directly connected to the fabric must see the leaf switch using LLDP. Hosts cannot be connected by an intermediate switch, including UCS Fabric Interconnects. This applies to vAPIC clusters and vAPICs used in ACI mini deployments.

6.0(3d)

CSCvj26666

The "show run leaf|spine <nodeId>" command might produce an error for scaled up configurations.

6.0(3d) and later

CSCvj90385

With a uniform distribution of EPs and traffic flows, a fabric module in slot 25 sometimes reports far less than 50% of the traffic compared to the traffic on fabric modules in non-FM25 slots.

6.0(3d) and later

CSCvq39764

When you click Restart for the Microsoft System Center Virtual Machine Manager (SCVMM) agent on a scaled-out setup, the service may stop. You can restart the agent by clicking Start.

6.0(3d) and later

CSCvq58953

One of the following symptoms occurs:

App installation/enable/disable takes a long time and does not complete.                                                                         

Nomad leadership is lost. The output of the acidiag scheduler logs members command contains the following error:

Error querying node status: Unexpected response code: 500 (rpc error: No cluster leader)

6.0(3d) and later

CSCvr89603

The CRC and stomped CRC error values do not match when seen from the APIC CLI compared to the APIC GUI. This is expected behavior. The GUI values are from the history data, whereas the CLI values are from the current data.

6.0(3d) and later

CSCvs19322

Upgrading Cisco APIC from a 3.x release to a 4.x release causes Smart Licensing to lose its registration. Registering Smart Licensing again will clear the fault.

6.0(3d) and later

CSCvs77929

In the 4.x and later releases, if a firmware policy is created with different name than the maintenance policy, the firmware policy will be deleted and a new firmware policy gets created with the same name, which causes the upgrade process to fail.

6.0(3d) and later

CSCvx75380

svcredirDestmon objects get programmed in all of the leaf switches where the service L3Out is deployed, even though the service node may not be connected to some of the leaf switch.

There is no impact to traffic.

6.0(3d) and later

CSCvx78018

A remote leaf switch has momentary traffic loss for flushed endpoints as the traffic goes through the tglean path and does not directly go through the spine switch proxy path.

6.0(3d) and later

CSCvy07935

xR IP flush for all endpoints under the bridge domain subnets of the EPG being migrated to ESG. This will lead to a temporary traffic loss on remote leaf switch for all EPGs in the bridge domain. Traffic is expected to recover.

6.0(3d) and later

CSCvy10946

With the floating L3Out multipath recursive feature, if a static route with multipath is configured, not all paths are installed at the non-border leaf switch/non-anchor nodes.

6.0(3d) and later

CSCvy34357

Starting with the 6.0(3) release, the following apps built with the following non-compliant Docker versions cannot be installed nor run:

6.0(3d) and later

CSCvy45358

The file size mentioned in the status managed object for techsupport "dbgexpTechSupStatus" is wrong if the file size is larger than 4GB.

6.0(3d) and later

CSCvz06118

In the "Visibility and Troubleshooting Wizard," ERSPAN support for IPv6 traffic is not available.

6.0(3d) and later

CSCvz84444

While navigating to the last records in the various History sub tabs, it is possible to not see any results. The first, previous, next, and last buttons will then stop working too.

6.0(3d) and later

CSCvz85579

VMMmgr process experiences a very high load for an extended period of time that impacts other operations that involve it.

The process may consume excessive amount of memory and get aborted. This can be confirmed with the command "dmesg -T | grep oom_reaper" if messages such as the following are reported:

         oom_reaper: reaped process 5578 (svc_ifc_vmmmgr.)

6.0(3d) and later

CSCwa78573

When the "BGP" branch is expanded in the Fabric > Inventory > POD 1 > Leaf > Protocols > BGP navigation path, the GUI freezes and you cannot navigate to any other page.

This occurs because the APIC gets large set of data in response, which cannot be handled by the browser for parts of the GUI that do not have the pagination.

6.0(3d) and later

CSCwe18213

The logical switch created for the EPG remains in the NSX-T manager after the EPG is disassociated from the domain, or the logical switch does not get created when the EPG is associated with the domain.

6.0(3d) and later

CSCwf71934

Multiple duplicate subnets are created on Nutanix for the same EPG.

6.0(3d) and later

CSCwh92539

After upgrading a Cisco APIC from a release before 5.2(8) to release 6.0(3) or later, there is a loss of out-of-band management connectivity over IPv6 if the APIC has dual stack out-of-band management. However, IPv4 connectivity remains intact. This issue does not occur if the out-of-band management is only IPv4 or only IPv6.

6.0(3d) and later

CSCwk21572

License manager occasionally cores after image upgrade.

6.0(3d) and later

N/A

Beginning in Cisco APIC release 4.1(1), the IP SLA monitor policy validates the IP SLA port value. Because of the validation, when TCP is configured as the IP SLA type, Cisco APIC no longer accepts an IP SLA port value of 0, which was allowed in previous releases. An IP SLA monitor policy from a previous release that has an IP SLA port value of 0 becomes invalid if the Cisco APIC is upgraded to release 4.1(1) or later. This results in a failure for the configuration import or snapshot rollback.

The workaround is to configure a non-zero IP SLA port value before upgrading the Cisco APIC, and use the snapshot and configuration export that was taken after the IP SLA port change.

6.0(3d) and later

N/A

If you use the REST API to upgrade an app, you must create a new firmware.OSource to be able to download a new app image.

6.0(3d) and later

N/A

In a multipod configuration, before you make any changes to a spine switch, ensure that there is at least one operationally "up" external link that is participating in the multipod topology. Failure to do so could bring down the multipod connectivity. For more information about multipod, see the Cisco Application Centric Infrastructure Fundamentals document and the Cisco APIC Getting Started Guide.

6.0(3d) and later

N/A

With a non-english SCVMM 2012 R2 or SCVMM 2016 setup and where the virtual machine names are specified in non-english characters, if the host is removed and re-added to the host group, the GUID for all the virtual machines under that host changes. Therefore, if a user has created a micro segmentation endpoint group using "VM name" attribute specifying the GUID of respective virtual machine, then that micro segmentation endpoint group will not work if the host (hosting the virtual machines) is removed and re-added to the host group, as the GUID for all the virtual machines would have changed. This does not happen if the virtual name has name specified in all english characters.

6.0(3d) and later

N/A

A query of a configurable policy that does not have a subscription goes to the policy distributor. However, a query of a configurable policy that has a subscription goes to the policy manager. As a result, if the policy propagation from the policy distributor to the policy manager takes a prolonged amount of time, then in such cases the query with the subscription might not return the policy simply because it has not reached policy manager yet.

6.0(3d) and later

N/A

When there are silent hosts across sites, ARP glean messages might not be forwarded to remote sites if a leaf switch without -EX or a later designation in the product ID happens to be in the transit path and the VRF is deployed on that leaf switch, the switch does not forward the ARP glean packet back into the fabric to reach the remote site. This issue is specific to transit leaf switches without -EX or a later designation in the product ID and does not affect leaf switches that have -EX or a later designation in the product ID. This issue breaks the capability of discovering silent hosts.

6.0(3d) and later

N/A

Typically, faults are generally raised based on the presence of the BGP route target profile under the VRF table. However, if a BGP route target profile is configured without actual route targets (that is, the profile has empty policies), a fault will not be raised in this situation.

6.0(3d) and later

N/A

MPLS interface statistics shown in a switch's CLI get cleared after an admin or operational down event.

6.0(3d) and later

N/A

MPLS interface statistics in a switch's CLI are reported every 10 seconds. If, for example, an interface goes down 3 seconds after the collection of the statistics, the CLI reports only 3 seconds of the statistics and clears all of the other statistics.

6.0(3d) and later

Microsoft Hyper-V

N/A

VMM Integration and VMware Distributed Virtual Switch (DVS)

6.5, 6.7, 7.0 and 8.0.

Note: vSphere 8.0 does not support the vCenter Plug-in and Cisco ACI Virtual Edge (AVE). If you need to continue to use the vCenter Plug-in and Cisco AVE, use vSphere 7.0.

Cisco ACI Virtualization Guide, Release 6.0(x)

APIC-L2

Cisco APIC with large CPU, hard drive, and memory configurations (more than 1000 edge ports)

APIC-L3

Cisco APIC with large CPU, hard drive, and memory configurations (more than 1200 edge ports)

APIC-L4

Cisco APIC with large CPU, hard drive, and memory configurations (more than 1200 edge ports)

APIC-M2

Cisco APIC with medium-size CPU, hard drive, and memory configurations (up to 1000 edge ports)

APIC-M3

Cisco APIC with medium-size CPU, hard drive, and memory configurations (up to 1200 edge ports)

APIC-M4

Cisco APIC with medium-size CPU, hard drive, and memory configurations (up to 1200 edge ports)

Cisco UCS M4-based Cisco APIC

The Cisco UCS M4-based Cisco APIC and previous versions support only the 10G interface. Connecting the Cisco APIC to the Cisco ACI fabric requires a same speed interface on the Cisco ACI leaf switch. You cannot connect the Cisco APIC directly to the Cisco N9332PQ ACI leaf switch, unless you use a 40G to 10G converter (part number CVR-QSFP-SFP10G), in which case the port on the Cisco N9332PQ switch auto-negotiates to 10G without requiring any manual configuration.

Cisco UCS M5-based Cisco APIC

The Cisco UCS M5-based Cisco APIC supports dual speed 10G and 25G interfaces. Connecting the Cisco APIC to the Cisco ACI fabric requires a same speed interface on the Cisco ACI leaf switch. You cannot connect the Cisco APIC directly to the Cisco N9332PQ ACI leaf switch, unless you use a 40G to 10G converter (part number CVR-QSFP-SFP10G), in which case the port on the Cisco N9332PQ switch auto-negotiates to 10G without requiring any manual configuration.

N2348UPQ

To connect the N2348UPQ to Cisco ACI leaf switches, the following options are available:

Directly connect the 40G FEX ports on the N2348UPQ to the 40G switch ports on the Cisco ACI leaf switches

Break out the 40G FEX ports on the N2348UPQ to 4x10G ports and connect to the 10G ports on all other Cisco ACI leaf switches.

Note: A fabric uplink port cannot be used as a FEX fabric port.

N9K-C9348GC-FXP

This switch does not read SPROM information if the PSU is in a shut state. You might see an empty string in the Cisco APIC output.

N9K-C9364C-FX

Ports 49-64 do not support 1G SFPs with QSA.

N9K-C9508-FM-E

The Cisco N9K-C9508-FM-E2 and N9K-C9508-FM-E fabric modules in the mixed mode configuration are not supported on the same spine switch.

N9K-C9508-FM-E2

The Cisco N9K-C9508-FM-E2 and N9K-C9508-FM-E fabric modules in the mixed mode configuration are not supported on the same spine switch.

The locator LED enable/disable feature is supported in the GUI and not supported in the Cisco ACI NX-OS switch CLI.

N9K-C9508-FM-E2

This fabric module must be physically removed before downgrading to releases earlier than Cisco APIC 3.0(1).

N9K-X9736C-FX

The locator LED enable/disable feature is supported in the GUI and not supported in the Cisco ACI NX-OS Switch CLI.

N9K-X9736C-FX

Ports 29 to 36 do not support 1G SFPs with QSA.

Cisco NX-OS

16.0(3)

Cisco UCS Manager

2.2(1c) or later is required for the Cisco UCS Fabric Interconnect and other components, including the BIOS, CIMC, and the adapter.

CIMC HUU ISO

Network Insights Base, Network Insights Advisor, and Network Insights for Resources

For the release information, documentation, and download links, see the Cisco Network Insights for Data Center page.

For the supported releases, see the Cisco Data Center Networking Applications Compatibility Matrix.

Cisco Nexus 9000 ACI-Mode Switches Release Notes, Release 16.0(3)

The release notes for Cisco NX-OS for Cisco Nexus 9000 Series ACI-Mode Switches.

Verified Scalability Guide for Cisco APIC, Release 6.0(3) and Cisco Nexus 9000 Series ACI-Mode Switches, Release 16.0(3)

This guide contains the maximum verified scalability limits for Cisco Application Centric Infrastructure (ACI) parameters for Cisco APIC and Cisco Nexus 9000 Series ACI-Mode Switches.

APIC REST API Configuration Procedures

This document resides on developer.cisco.com and provides information about and procedures for using the Cisco APIC REST APIs. The new REST API procedures for this release reside only here and not in the configuration guides. However, older REST API procedures are still in the relevant configuration guides.