June 14, 2015

Created the release notes for Release 1.1(1j)

June 15, 2015

Revised downgrading information

June 18, 2015

■        Added CSCuu87980 to Open Caveats

■        Added new support information about the Cisco Nexus 2348UPQ in the Compatibility Information section

■        Updated New Documentation section

June 25, 2015

Added the following:

■        Upgrading from 1.0(3x) to 1.1(1j) is supported

■        Downgrading from 1.1(1j) to 1.0(4o) is supported

July 1, 2015

Fixed descriptions of breakout support and the options for connecting the N2348UPQ to switches in the Compatibility Information section

July 16, 2015

Added the Static VMM Encap Mode feature to the New Software Features section

July 21, 2015

Updated the downgrade information

August 5, 2015

Added CSCut76195 to Resolved Caveats

August 6, 2015

In the Upgrading the APIC Controller section, added the upgrade path from 1.0(1x) to 1.1(1j).

August 18, 2015

In the Upgrading the APIC Controller section, removed the note in the row for upgrading from 1.0(3x) to 1.0(4x).

August 21, 2015

In the Installation Notes section, added that acimodel-1.1_1j-py.egg is also required.

August 28, 2015

Rewrote the procedure in the Downgrading the APIC Controller section to provide more information about stateless downgrades.

October 16, 2015

In the Compatibility Information section, added the supported ASA device package version. Also added information about AVS and DVS support with Layer 4 to Layer 7 service insertion or service chaining.

November 13, 2015

In the Known Behaviors section, added bug CSCuw81638.

December 3, 2015

In the “Installation Notes” section, fixed the .egg file URLs.

December 9, 2015

Fixed incorrect URLs to the documentation on cisco.com.

February 29, 2016

In the Compatibility Information section, added a link to the AVS Release Notes.

March 16, 2016

In the Installation Notes section, added mention that ACI with SCVMM or Windows Azure Pack only supports ASCII characters.

February 28, 2017

In the Usage Guidelines section, added:

If the communication between the APIC and vCenter is impaired, some functionality is adversely affected. The APIC relies on the pulling of inventory information, updating vDS configuration, and receiving event notifications from the vCenter for performing certain operations.

April 17, 2017

Removed deprecated Knowledge Base articles.

May 24, 2018

In the New Software Features section, for the IPv6 Forwarding and Routing feature, added the following limitation:

You cannot configure both IPv4 and IPv6 addresses on singular physical interfaces.

1.0(4x)

1.1(1j)

None

1.     Upgrade the APICs.

2.     After the APICs are upgraded successfully, upgrade the switches using two or more maintenance groups.

1.0(3x)

1.1(1j)

None

1.     Upgrade the APICs.

2.     After the APICs are upgraded successfully, upgrade the switches using two or more maintenance groups.

1.0(3x)

1.0(4x)

None

1.     Upgrade the APICs.

2.     After the APICs are upgraded successfully, upgrade the switches using two or more maintenance groups.

1.0(2x)

1.0(4x)

None

1.     Upgrade the APICs.

2.     After the APICs are upgraded successfully, upgrade the switches using two or more maintenance groups.

1.0(2x)

1.0(3x)

None

1.     Upgrade the APICs.

2.     After the APICs are upgraded successfully, upgrade the switches using two or more maintenance groups.

1.0(1x)

1.1(1j)

Upgrading directly to 1.1(1j) is not supported with a policy upgrade. You must upgrade first to a 1.0(4x) release, and then upgrade to the 1.1(1j) release. If an issue occurs, you might need to run the installer manually on the individual APICs.

1.     Upgrade the APICs to a 1.0(4x) release.

2.     After the APICs are upgraded successfully, upgrade the switches to the equivalent 11.0(4x) release using two or more maintenance groups.

3.     Upgrade the APICs to the 1.1(1j) release.

4.     After the APICs are upgraded successfully, upgrade the switches to the 11.1(1j) release using two or more maintenance groups.

ACI Integration with Microsoft Windows Azure Pack 2.0

ACI integrates Microsoft Windows Azure Pack to provide a self-service experience for tenants. ACI resource provider in Windows Azure Pack drives the APIC for network management. Networks are created in System Center Virtual Machine Manager (SCVMM) and are available in Windows Azure Pack for respective tenants.

Windows Azure Pack version UR5 or above is supported.

ACI Integration with Microsoft System Center VMM 2012 R2

ACI fabric and SCVMM integration simplifies the networking aspects of the Virtual Machine management process. APIC and Microsoft SCVMM communicate with each other for network management. EPGs are created in APIC and are created as VM networks in SCVMM. Compute is provisioned in SCVMM and can consume these networks.

A single ACI Virtual Switch can be deployed on a Hyper-V Host.

Atomic Counters Path Mode for Scale Topologies

In scale setups where the number of Tunnel End Points (leafs or VPC leaf pairs) is greater than 64, the atomic counter supports ongoing statistics between the TEP instead of per spine counters.

None

eBGP

The ACI fabric supports the eBGP protocol in Layer 3 outside for both IPv4 and IPv6.

None

EIGRP

The ACI fabric supports the EIGRP protocol in Layer 3 outside for IPv4 only.

None

Gratuitous ARP (GARP) for Endpoint Learning

When a Virtual Machine (VM) moves from one MAC to another behind the same interface, the hardware does not generate a learn notification. This feature enables endpoint learning when a GARP packet is received as a result of a VM move and syncs the move info to the endpoint manager. 

ARP forwarding must be in flood mode for this feature. ARP unicast mode will not work. The feature can be controlled in the bridge domain configuration.

Host vPC FEX

The Cisco ACI fabric supports Cisco Fabric Extender (FEX) server side virtual port channels (VPC), also known as FEX straight-through VPC.

None

IPv6 Forwarding and Routing

The Cisco ACI fabric supports IPv6 for tenant addressing, contracts, shared services, routing, Layer 4 to Layer 7 services, and troubleshooting.

The following features are supported:

■        Atomic Counters - Provides support for IPv6 sources and destinations, but configuring source and destination IP addresses across IPv4 and IPv6 addresses is not allowed.

■        Contract filters based on the IP protocol type applies to both IPv4 and IPv6 end points.  Filters can also be defined for specific ICMPv6 message types.

■        DHCPv6 - Provides support for DHCPv6 relay.

■        Faults and Events.

■        iPing6  - Provides support for ping to IPv6 addresses from the switch CLI.

■        IPv6 support for SVI for bridge domain subnets.

Note: This feature does not provide IPv6 support on ACI fabric management interfaces (in-band and out-of-band) or IPv6 tunnel interfaces, such as ISATAP and 6to4.

■        L2/L3 outside (BGP, OSPFv3, static) - Provides IPv6 support for outside network external interfaces (routed, sub-interface, and SVI) and route (static route, OSPFv3, iBGP, and eBGP).

■        Neighbor Discovery policy – Provides the following:

—      NS/NA parameter configurable per Bridge Domain (BD) basis. Configurable on SVI for BD subnet and external interface (routed, sub-interface, and SVI).

—      RS/RA parameter configurable per Subnet basis. Configurable on SVI for BD subnet.

■        Policy, Shared services - Provides support for contracts between endpoint groups including IPv6 enabled endpoints.

■        SPAN support for IPv6 traffic.

Note: Although SPAN supports IPv6 traffic, the destination IP for the ERSPAN cannot be IPv6.

■        Traceroute - Provides support for traceroute to IPv6 addresses from the switch CLI.

■        Neighbor Discovery (ND) unicast mode is not supported.

■        IPv6 MLD Snooping is not supported.

■        You cannot configure both IPv4 and IPv6 addresses on singular physical interfaces.

Microsegmentation and Distributed Firewall with AVS

■        Microsegmentation with the Cisco Application Virtual Switch (AVS) provides the ability automatically assign endpoints to logical security zones called endpoint groups (EPGs) based on various attributes. Microsegmentation with Cisco AVS is a new feature in Cisco AVS Release 5.2(1)SV3(1.5).

This feature is available in the Cisco Application Centric Infrastructure (ACI) for Cisco AVS only; it is not available with VMware DVS.

Microsegmentation policies used by the Cisco AVS are centrally managed by the Cisco Application Policy Infrastructure Controller (APIC) and enforced by the fabric.

■        Distributed Firewall is a hardware-assisted firewall that supplements--but does not replace--other security features in the Cisco Application Centric Infrastructure (ACI) fabric such as Cisco Adaptive Security Virtual Appliance (ASAv) or secure zones created by Microsegmentation with the Cisco Application Virtual Switch (AVS).

Part of Cisco AVS, the Distributed Firewall resides in the ESXi (hypervisor) kernel and is in learning mode by default. No additional software is required for the Distributed Firewall to work. However, you must configure policies in the Cisco Application Policy Infrastructure Controller (APIC) to work with the Distributed Firewall.

The Distributed Firewall is supported on all Virtual Ethernet (vEth) ports but is disabled for all system ports (Virtual Extensible LAN [VXLAN] tunnel endpoint [VTEP]) and all vmkernel ports) and for all uplink ports.

Distributed Firewall flows are limited to 10,000 per endpoint and 250,000 per Cisco AVS host.

Distributed Firewall – If you use the configuration wizard to create interface, switch, and vCenter domain profiles when you install Cisco AVS, Cisco APIC automatically configures a firewall policy. You should leave the Firewall checkbox in the wizard unchecked to enable Distributed Firewall. The default mode is Learning, which is used only when installing or upgrading to the new Cisco AVS release. If you did not use the configuration wizard when installing Cisco AVS, you need to create a Distributed Firewall policy.

Miscabling Protocol - MCP

The ACI fabric provides loop detection policies that can detect loops in Layer 2 network segments that are connected to ACI access ports.

None

New EPG Resolution Mode: Pre-provisioned

The EPG resolution mode is used to determine when to download an EPG to the Leaf in ACI fabric. If the EPG resolution mode is set to "pre-provision", the EPG is downloaded to all the Leaf/interfaces associated with the VMM domain at the configuration time itself. It is recommended to use this resolution mode for critical EPGs used to represent port-groups of vmkernel ports.

None

OSPF

The ACI fabric supports NSSA, regular, and backbone for OSPF.

None

Per BD Multicast/Broadcast Packet Behavior Knob

Currently, all broadcast and multicast packets in a BD are flooded within the fabric. Since there is no way to apply contracts to these packets, there is no way to restrict these packets within the same EPG or to drop the packets. To provide more granularity, a new knob has been added for these packet types where you can control the behavior of these packets per BD by configuring one of the three options:

■        bd-flood - Flood packet in the BD (default mode)

■        encap-flood - Flood packet in the encap

■        drop - Drop the packet

None

Per-port VLAN Significance

This feature allows the configuration of the same VLAN ID across different EPGs (on different BDs) on different ports on the same leaf switch. In essence, a user can now configure the same VLAN ID on every port on the same switch. Before this feature, a particular VLAN could only be part of one EPG on a leaf. This feature is enabled by setting the VLAN scope to port local scope in the layer 2 interface profile.

■        ACI cannot flush out the MAC address if there is a topology change with MSTP. 

■        MAC addresses cannot be synced unless the same VLAN encapsulation is used across a vPC pair.

■        Multiple EPGs belonging to same BD cannot use the same VLAN encapsulation.

Route Peering with Service Appliances

Route peering is a special case of the more generic Cisco ACI fabric as a transit use case, in which route peering enables the ACI fabric to serve as a transit domain for Open Shortest Path First (OSPF) or Border Gateway Protocol (BGP) protocols. A common use case for route peering is route health injection, in which the server load balancing virtual IP is advertised over OSPF or internal BGP (iBGP) to clients that are outside of the ACI fabric. You can use route peering to configure OSPF or BGP peering on a service device so that the device can peer and exchange routes with the ACI leaf node to which it is connected.

The following protocols are supported for route peering:

■        iBGPv4

■        iBGPv6

■        OSPF

■        OSPFv3

None

Static VMM Encap Mode

Static VMM encap mode enables you to statically allocate the VLAN encapsulation for a VMM domain EPG.

Using a static VLAN pool or a static VLAN block within an already existing pool is required for the VLANs defined in this feature.

Transit routing

The ACI fabric supports transit routing, including the necessary EIGRP, eBGP, and OSPF protocol support, which enables border routers to perform bi-directional redistribution with other routing domains.

The following protocols are supported:

■        eBGP

■        EIGRP

■        iBGP

■        OSPF

■        Static-Route

■        OSPFv3

■        iBGPv6

■        eBGPv6

None

Troubleshooting Wizard

The Troubleshooting Wizard is a suite of tools added to the APIC to monitor, manage, and troubleshoot layer 1 to layer 7 issues in one pane of glass. Tools included are: 

■        Atomic Counters

■        Audit Logs

■        iTraceroute

■        SPAN

■        Statistics

■        When the topology has a Firewall in the graph, troubleshooting wizard assumes the source end-point or external IP is in the external/client network, and the destination is in the internal/server network.

■        Either the source endpoint or the destination endpoint must be natively learned within a tenant endpoint group.

■        Syslog level must be set to "debugging" for contract deny logs to be shown.

■        Irrespective of the time window, the topology, faults, traceroute, atomic counter, and SPAN reflect the current state of the fabric.

■        All session information including reports and SPAN capture files are deleted when the session is re-moved.

■        Some of the operations may take up to two minutes in large configurations.

■        Endpoints behind layer 2 external network are not supported.

■        External-to-EP traceroute is not supported.

■        IPv6 traceroute only generates internal path results, and its "protocol”/”destination port" configuration options are not effective.

CSCur36058

The switch disappears for several minutes from topology, firmware, and maintenance policies while being upgraded.

CSCuu42733

The APIC appliance sees a crash in the DMEs while getting a replication transaction, or when a configuration is missing on the APIC that was introduced with a different version.

CSCuu49742

In Microsoft SCVMM, if a VM network is already attached and used by virtual machines, and if an admin changes the VLAN number of this VM network on SCVMM, the virtual machine VLAN information is not automatically updated on Hyper-V Host virtual machines.

CSCuu84437

VTEP tunnels for VXLAN load balancing might go missing and lead to traffic drop when OpFlex times out due to the stress load on rebooting a couple of hosts with a few hundred vEths.

CSCuu84497

If a user selects a custom time range while keeping the category field to be "system info" in the GUI for the techsupport policy, the techsupport files are not exported.

CSCuu84967

Expired user authentication certificates cannot be deleted.

CSCuu87980

Only admin users can access the "Visibility Tool” (Troubleshooting Wizard). Role-admin users cannot access the tool.

CSCur79696

When attempting to log into an LDAP provider configured in Strict SSL mode, and the system is not configured with the CA certificate for that LDAP SSL server, the nginx daemon will gracefully restart itself to attempt to work around an openldap library SSL certificate caching bug.

CSCur97373

During a policy upgrade of the APIC controller, some APICs fail to reboot after the upgrade process has completed.

CSCus21730

Policy elements crash on the leaf after deleting an infrastructure configuration such as bundle interface groups, selectors, or VLAN/VXLAN namespaces.

CSCus26627

On large scale setups, some login requests are taking more than 30 seconds.

CSCus38227

When a Layer 2 or Layer 3 external instance profile is specified as a provider to a contract, and a collection of endpoint groups within a context is specified as the consumer, the provider will be skipped. This can result in the graph not getting deployed.

CSCus40477

Fault F0467 is raised due to an invalid VLAN configuration (rule: fv-nw-issues-config-failed).

CSCus63191

There is no infra VLAN connectivity to the leaf in the simulator from the ESX (host) added to the AVS.

CSCus71655

The APIC controller fan stats collection does not display the speed/PWM data regardless of the interval chosen.

CSCus74493

Interface policies are not applied to all ports if the interface policy group is associated with a policy before the policy is created.

CSCut10398

The help screen for the endpoint retention policy has incorrect default values. This is cosmetic. The help screen should also note that setting the bounce entry aging interval to a value less than the remote endpoint aging interval will create a traffic loss situation when hosts migrate between leaf switches.

CSCut25587

Under high scale circumstances, a new leaf may not get all contracts downloaded.

CSCut25657

Traffic between application endpoint groups and external Layer 3 networks on different leafs is dropped if multiple external Layer 3 networks are configured in the same context.

CSCut36428

The endpoint attachment notification:

■        Does not always result in an attachment notification

■        Is only sent to a subset of deployed service graph instances

■        Is sent to the incorrect service graph instance

CSCut46796

The zoning-rule is missing after deleting or adding 0/0 and/or a particular subnet present in a Layer 3 external network.

CSCut56623

When a Layer 3 external network is configured with DSCP marking, it is not copied to a filter rule on the node.

CSCut56639

When DSCP marking is configured on an external endpoint group, it is not copied to the filter rule on the node.

CSCut76195

Leaf switches drop Link Layer Discovery Protocol (LLDP) packets that have the unicast destination MAC address.

CSCut80792

WebServer uses ciphers that use SHA1. Web browsers, such as chrome, report a warning indicating that SHA1 is obsolete and that a stronger hashing algorithm should be used. (as shown in the attached enclosure)

CSCut98699

The online help page is blank when the "i" symbol is selected for the subnet entry for the tenant created external instance profile.

CSCuu02614

After an endpoint is learned, and a graph is removed and reattached, the endpoint will not be added to the L4-L7 device configuration.

CSCuu16805

In the 1.0(4h) release, support for filtering techsupport information for a specified time-window and category was added to generate a techsupport file with a reduced size. If the time-window and/or category filters are set in the GUI for an on-demand techsupport policy named tsod-ts_exp_pol, and then if the techsupport collection is triggered through CLI, the filters still get applied although no filters are specified in the CLI command.

CSCuu16881

A fault is raised indicating that an image downloaded into the repository is bad, although the image is actually good.

CSCuu23146

Tech support filtering based on category can miss some files when triggered from the GUI.

CSCuo52668

The APIC does not validate duplicate IPs assigned to two device clusters. The communication to devices or the configuration of service devices might be affected.

CSCuo79243

In some of the 5-minute statistics data, the count of ten-second samples is 29 instead of 30.

CSCuo79250

The node ID policy can be replicated from an old appliance that is decommissioned when it joins a cluster.

CSCup47703

The DSCP value specified on an external endpoint group does not take effect on filter rules on the leaf switch.

CSCup79002

The hostname resolution of the syslog server fails on leaf and spine switches over in-band connectivity.

CSCup94070

After importing an exported configuration, graph instances are not created and L4-L7 packages are missing in the system.

CSCuq21360

Following a FEX or switch reload, configured interface tags are no longer configured correctly.

CSCur39124

Switches could get downgraded to a 1.0(1x) version if the imported configuration consists of a firmware policy with a desired version set to 1.0(1x).

CSCur48950

Some reported client endpoints are not present on the APIC during an upgrade.

CSCur71082

The APIC is rebooted using the CIMC power reboot. On reboot, the system enters into fsck due to a corrupted disk.

CSCus15627

The Cisco APIC Service (ApicVMMService) shows as stopped in the Microsoft Service Manager (services.msc in control panel > admin tools > services) after valid domain credentials are entered during installation or configuration of the service.

CSCut51929

The traffic destined to a shared service provider endpoint group picks an incorrect class Id (PcTag) and gets dropped.

CSCuu09236

Traffic from an external layer 3 network is allowed when configured as part of a vzAny (a collection of endpoint groups within a context) consumer.

CSCuu61998

The microsegment endpoint group is in the incorrect state after downgrading.

CSCuu64219

Downgrading the fabric starting with the leaf will cause faults such as policy-deployment-failed with fault code F1371.

CSCuw81638

The OpenStack metadata feature cannot be used with ACI integration with the Juno release (or earlier) of OpenStack due to limitations with both OpenStack and Cisco’s ML2 driver.