Cisco Cloud Application Policy Infrastructure Controller Release Notes, Release 5.0(1)

May 14, 2020

Release 5.0(1k) became available.

Support for AWS transit gateways on Cisco Cloud APIC

You can use an Amazon Web Services (AWS) transit gateway with Cisco Cloud APIC to automate connectivity between virtual private clouds.

For more information, see Increasing Bandwidth Between VPCs by Using AWS Transit Gateway.

See the section "AWS Transit Gateway Limitations and Restrictions" in Increasing Bandwidth Between VPCs by Using AWS Transit Gateway.

Support for using filters to see specific information from AWS flow logs

You can use filters to see specific information derived by processing AWS flow logs. You can filter for a combination of source or destination IP address, port and protocol.

For more information, see the section "Cisco Cloud APIC Statistics" in the Cisco Cloud APIC for AWS User Guide 5.0(x).

■      You can define up to eight filters for a given AWS log group at the same time.

■      We recommend that you configure statistics filters using the Cisco Cloud APIC GUI.

Support for statistics collection for AWS transit gateway traffic

You can collect statistics for traffic to and from AWS transit gateways in Cisco Cloud APIC.

For more information, see Increasing Bandwidth Between VPCs by Using AWS Transit Gateway and the statistics chapter of the Cisco Cloud APIC for AWS User Guide 5.0(x).

You must enable collection when you set up Cloud APIC for AWS transit gateway, and you must create flow logs.

CSCvo30542

TACACS monitoring of the destination group is not supported through the GUI.

5.0(1k) and later

CSCvt52797

Some cloud-to-cloud tunnels are operationally down in external-facing CSRs.

5.0(1k) and later

CSCvt62217

A fault is seen in Cisco Cloud APIC after a config import, indicating that the CreateOrUpdate Virtual Network operation is failing with error code 'ReferencedResourceNotProvisioned'.

5.0(1k) and later

CSCvt72525

Upon increasing the scale of Certificate Signing Requests (CSRs), a create subnet request fails and a fault is raised in the Cisco Cloud APIC.

5.0(1k) and later

CSCvt77579

CSRs with unknown status are listed in the Inter-Site Connectivity screen.

5.0(1k) and later

CSCvt82672

A BGP faults show up in the Cloud APIC dashboard for  multiple CSR BGP sessions.

5.0(1k) and later

CSCvt88137

Some of the TGW attachments to non-infra tenant VPCs might be deleted and not get recreated in the case of quickly enabling, disabling, and re-enabling the hub network to the CloudCtxProfile.

5.0(1k) and later

CSCvu02115

If CSRs are undeployed and redeployed in a non-Cloud APIC home region, this results in a delete and re-add of the infra VPC. If there are other CloudContextProfiles (user tenant VRF tables) pointing to the hub network (transit gateway), then when the CSRs are redeployed, traffic from the transit gateway to a CSR may be dropped. In this case, the transit gateway will remain undeleted because the user tenant VPC is still using the transit gateway. The traffic drop might occur because when the infra VPC is redeployed, it might get a different set of CIDRs allocated to it.

5.0(1k) and later

CSCvu06450

In the Cloud APIC home region, if CSRs are undeployed and redeployed, there will be stale entries in the CSR route tables. If you reach the maximum route table entries limit because of these stale entries, any new route table entries will fail to get programmed in the cloud, and a VPN connection related to those entries will remain down.

There will be fault raised for route table entries that failed to get programed in the cloud.

5.0(1k) and later

CSCvu15350

When using shared services with Cisco Intersite, after deleting the remote site VPC's secondary CIDR contract, the contract's entry is retained in the routing table. No change in traffic behavior is expected. The policy will prevent the traffic from flowing.

5.0(1k) and later

CSCvu17097

Inter tenant shared services traffic is impacted after tenant delete and add.

5.0(1k) and later

CSCvo93761

Changing an ExtEPG subnet prefix's mark from A to B will end up messing up BGP's prefixes in the CSR and will cause traffic loss.

5.0(1k)

CSCvp12535

With a larger number of  Cloud APIC tenant EPGs and if the VRF configuration is pushed through the API in a single transaction, sometimes duplicate AWS  resources are created.

5.0(1k)

CSCvp71964

Cannot access the serial console of the CSR virtual machine in Azure.

5.0(1k)

CSCvp92803

AWS EC2 or Azure virtual machines have been assigned secondary IP addresses, but are unreachable from other cloud sites.

5.0(1k)

CSCvp99474

No NSG is assigned when the cloud endpoint should be classified in the EPG.

5.0(1k)

CSCvq73867

A network interface in a Cloud APIC managed region in AWS or Azure matches the EP Selector in a cloud EPG, but the Security Group of that cloud EPG does not get attached to the network interface. Instead, the Security Group of another cloud EPG gets attached to the network interface.

5.0(1k)

CSCvq87116

A network interface in a Cloud APIC-managed AWS region matches the endpoint selector in a cloud EPG, but the security group for the cloud EPG does not get attached to the network interface.

5.0(1k)

CSCvr03104

If you try to deploy Cloud APIC to an unsupported region, then the Azure portal will allow you to select the region and will fail during deployment.

5.0(1k)

CSCvr48636

BGP Peer States on the Cloud APIC dashboard will show the peer states as "up" even while the actual BGP sessions are down, and control or data plane traffic is dropped.

5.0(1k)

CSCvs07094

A blank summary pane is shown after clicking on a filter name.

5.0(1k)

CSCvs20068

Selected filters are not added to the contract after saving.

5.0(1k)

CSCvs49001

The AWS security group rule's description field is empty. This is a cosmetic bug.

5.0(1k)

CSCvt70799

A storage account created by Cisco Cloud APIC in Azure allows HTTP access.

5.0(1k)

CSCvo06626

When a cloudExtEpg matches on a 0/0 network and has a bi-directional contract with two cloud EPGs, such as cloudEpg1 and CloudEpg2, this can result in inadvertent communication between endpoints in cloudEpg1 and cloudEpg2 without a contract between the two EPGs themselves.

5.0(1k) and later

CSCvo55112

Logs are lost upon stopping the Cloud APIC instance.

5.0(1k) and later

CSCvo95998

There is traffic loss after a Cloud APIC upgrade. Traffic will eventually converge, but this could take a few minutes.

5.0(1k) and later

CSCvq11780

Creating VPN connections fail with the "invalidCidr" error in AWS or the "More than one connection having the same BGP setting is not allowed" error in Azure.

5.0(1k) and later

CSCvq76039

When a fault is raised in the Cloud APIC, the fault message will be truncated and will not include the entire cloud message description.

5.0(1k) and later

CSCvr01341

REST API access to the Cloud APIC becomes delayed after deleting a tenant with scaled EPGs and endpoints. The client needs to retry after receiving the error.

5.0(1k) and later