Skip to content

Added validation check for CSCwt58626 #405

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
muthu-ku wants to merge 5 commits into
base: v4.2.0-dev
Choose a base branch
from
+390 −3
Open

Added validation check for CSCwt58626 #405

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8f68a28
Added validation check for CSCwt58626
muthu-ku Jul 2, 2026
8f858b8
updated comments
muthu-ku Jul 3, 2026
cd8d121
resolved merge conflict
muthu-ku Jul 3, 2026
1dad1ef
updated merge conflict
muthu-ku Jul 3, 2026
bb531b5
updated missing import for stale_dbgacEpgSummaryTask_check
muthu-ku Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 62 additions & 2 deletions aci-preupgrade-validation-script.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@
from textwrap import TextWrapper
from getpass import getpass
from collections import defaultdict, OrderedDict
from datetime import datetime
from datetime import datetime, timedelta

@monrog2 monrog2 Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is timedelta used in this check?

from argparse import ArgumentParser
from itertools import chain
import threading
Expand Down Expand Up @@ -6702,6 +6702,65 @@ def stale_dbgacEpgSummaryTask_check(tversion, **kwargs):
return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)


@check_wrapper(check_title="InfraVLAN Overlap in Access Policy VLAN Pools")
def infravlan_overlap_access_policy_check(tversion, **kwargs):
result = PASS
headers = ["InfraVLAN", "VLAN Pool", "Encap Block"]
data = []
recommended_action = "Remove InfraVLAN from VLAN pool block highligted or upgrade to fix version"

doc_url = "https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#infravlan-overlap-access-policy-check"

if not tversion:
return Result(result=MANUAL, msg=TVER_MISSING)

if not (tversion.same_as("6.2(1g)") or (
not tversion.older_than("6.1(3f)") and not tversion.newer_than("6.1(5e)")
)):
return Result(result=NA, msg=VER_NOT_AFFECTED)

infra_vlan = None
lldpInsts = icurl('class', 'lldpInst.json')

@monrog2 monrog2 Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

don't need to query the full class if we only need 1/2 instances of hte object to pull infra vlan. risking scale issues.

Is there any concern with always getting node-1?

apic1:~> icurl 'http://127.0.0.1:7777/api//class/lldpInst.json?query-target-filter=wcard(lldpInst.dn,"node-1")'

{"totalCount":"1","imdata":[{"lldpInst":{"attributes":{...,"dn":"topology/pod-1/node-1/sys/lldp/inst","holdTime":"120","infraVlan":"3967"...}}]}

for lldpInst in lldpInsts:
infra_vlan_id = lldpInst.get('lldpInst', {}).get('attributes', {}).get('infraVlan')
if not infra_vlan_id:
continue
match = re.search(r'\d+', str(infra_vlan_id))
if match:
infra_vlan = int(match.group(0))
break

if infra_vlan is None:
return Result(result=NA, msg="Unable to determine InfraVLAN from lldpInst.")

@monrog2 monrog2 Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is NA the right response result if we fail to pull an object? maybe MANUAL makes more sense, or ERR if inability to pull this object is never expected.


encap_blocks = icurl('class', 'fvnsEncapBlk.json')
dn_pool_re = re.compile(r'vlanns-\[(?P<vlan_pool>[^\]]+)\]')
for obj in encap_blocks:
blk_attr = obj.get('fvnsEncapBlk', {}).get('attributes', {})
dn = blk_attr.get('dn', '')
from_encap = blk_attr.get('from')
to_encap = blk_attr.get('to')
if not dn or not from_encap or not to_encap:
continue

pool_match = dn_pool_re.search(dn)
pool_name = pool_match.group('vlan_pool') if pool_match else '-'

try:
from_vlan = int(str(from_encap).split('-')[-1])
to_vlan = int(str(to_encap).split('-')[-1])
except (ValueError, TypeError):
continue

if min(from_vlan, to_vlan) <= infra_vlan <= max(from_vlan, to_vlan):
data.append([str(infra_vlan), pool_name, "{} to {}".format(from_encap, to_encap)])

if data:
result = FAIL_O

@monrog2 monrog2 Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this cause an outage? it sounds like changes are blocked, but does it prevent programming post-upgrade to an affected version?


return Result(result=result, headers=headers, data=data, recommended_action=recommended_action, doc_url=doc_url)


# ---- Script Execution ----


Expand Down Expand Up @@ -6877,7 +6936,8 @@ class CheckManager:
wred_affected_model_check,
n9k_c93180yc_fx3_switch_memory_check,
stale_dbgacEpgSummaryTask_check,

infravlan_overlap_access_policy_check,

]
ssh_checks = [
# General
Expand Down
11 changes: 10 additions & 1 deletion docs/docs/validations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,6 +206,7 @@ Items | Defect | This Script
[WRED with Affected FM Models][d35] | CSCwt50713 | :white_check_mark: | :no_entry_sign:
[N9K-C93180YC-FX3 Switch Memory Less Than 32GB][d36] | CSCwm42741 | :white_check_mark: | :no_entry_sign:
[Stale dbgacEpgSummaryTask Objects][d37] | CSCwt69100 | :white_check_mark: | :no_entry_sign:
[InfraVLAN Overlap in Access Policy VLAN Pools][d38] | CSCwt58626 | :white_check_mark: | :no_entry_sign:

[d1]: #ep-announce-compatibility
[d2]: #eventmgr-db-size-defect-susceptibility
Expand Down Expand Up @@ -244,6 +245,7 @@ Items | Defect | This Script
[d35]: #wred-with-affected-fm-models
[d36]: #n9k-c93180yc-fx3-switch-memory-less-than-32gb
[d37]: #stale-dbgacepgsummarytask-objects
[d38]: #infravlan-overlap-access-policy-check

## General Check Details

Expand Down Expand Up @@ -2846,6 +2848,13 @@ Affected versions: 6.1(5e) and below, or 6.2(1g).
Contact Cisco TAC for next steps. For more details, refer to the workaround in [CSCwt69100][75].


### Infravlan Overlap Access Policy Check

Due to [CSCwt58626][77], when targeting APIC version 6.1(3f) to 6.1(5e) or 6.2(1g) , if the InfraVLAN overlaps with any user-configured VLAN pool range in Access Policies, fault `F4701` is raised for VLAN pools that include the InfraVLAN. After the upgrade, domains linked to those VLAN pools cannot be associated with new EPGs, although existing EPGs continue to function.

To avoid this issue, modify user VLAN pool ranges so that the InfraVLAN does not overlap with any configured block or select target version with fix.

@monrog2 monrog2 Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lovkeshsharma702 include some detail about the planned fix, otherwise this checks details will have to be updated again after release.



[0]: https://github.com/datacenter/ACI-Pre-Upgrade-Validation-Script
[1]: https://www.cisco.com/c/dam/en/us/td/docs/Website/datacenter/apicmatrix/index.html
[2]: https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-release-notes-list.html
Expand Down Expand Up @@ -2923,4 +2932,4 @@ Contact Cisco TAC for next steps. For more details, refer to the workaround in [
[74]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwm42741
[75]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwt69100
[76]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwt38698

[77]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwt58626
1 change: 1 addition & 0 deletions tests/checks/infravlan_overlap_access_policy_check/fvnsEncapBlk_empty.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
[]
20 changes: 20 additions & 0 deletions tests/checks/infravlan_overlap_access_policy_check/fvnsEncapBlk_no_overlap.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
[
{
"fvnsEncapBlk": {
"attributes": {
"from": "vlan-200",
"to": "vlan-300",
"dn": "uni/infra/vlanns-[vlan_pool1]-static/from-[vlan-200]-to-[vlan-300]"
}
}
},
{
"fvnsEncapBlk": {
"attributes": {
"from": "vlan-500",
"to": "vlan-1000",
"dn": "uni/infra/vlanns-[vlan_pool2]-static/from-[vlan-500]-to-[vlan-1000]"
}
}
}
]
20 changes: 20 additions & 0 deletions ...checks/infravlan_overlap_access_policy_check/fvnsEncapBlk_overlap_multiple_vlan_pool.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
[
{
"fvnsEncapBlk": {
"attributes": {
"from": "vlan-100",
"to": "vlan-4094",
"dn": "uni/infra/vlanns-[vlan_pool1]-static/from-[vlan-100]-to-[vlan-4094]"
}
}
},
{
"fvnsEncapBlk": {
"attributes": {
"from": "vlan-4000",
"to": "vlan-4094",
"dn": "uni/infra/vlanns-[vlan_pool2]-static/from-[vlan-4000]-to-[vlan-4094]"
}
}
}
]
11 changes: 11 additions & 0 deletions ...s/checks/infravlan_overlap_access_policy_check/fvnsEncapBlk_overlap_single_vlan_pool.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
[
{
"fvnsEncapBlk": {
"attributes": {
"from": "vlan-100",
"to": "vlan-4094",
"dn": "uni/infra/vlanns-[vlan_pool]-static/from-[vlan-100]-to-[vlan-4094]"
}
}
}
]
1 change: 1 addition & 0 deletions tests/checks/infravlan_overlap_access_policy_check/lldpInst_empty.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
[]
102 changes: 102 additions & 0 deletions tests/checks/infravlan_overlap_access_policy_check/lldpInst_infra_vlan_multiple_entry.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,102 @@
[
{
"lldpInst": {
"attributes": {
"adminSt": "enabled",
"dn": "topology/pod-1/node-201/sys/lldp/inst",
"infraVlan": "vlan-4093",
"sysDesc": "topology/pod-1/node-201"
}
}
},
{
"lldpInst": {
"attributes": {
"adminSt": "enabled",
"dn": "topology/pod-1/node-202/sys/lldp/inst",
"infraVlan": "vlan-4093",
"sysDesc": "topology/pod-1/node-202"
}
}
},
{
"lldpInst": {
"attributes": {
"adminSt": "enabled",
"dn": "topology/pod-1/node-203/sys/lldp/inst",
"infraVlan": "vlan-4093",
"sysDesc": "topology/pod-1/node-203"
}
}
},
{
"lldpInst": {
"attributes": {
"adminSt": "enabled",
"dn": "topology/pod-1/node-204/sys/lldp/inst",
"infraVlan": "vlan-4093",
"sysDesc": "topology/pod-1/node-204"
}
}
},
{
"lldpInst": {
"attributes": {
"adminSt": "enabled",
"dn": "topology/pod-1/node-205/sys/lldp/inst",
"infraVlan": "vlan-4093",
"sysDesc": "topology/pod-1/node-205"
}
}
},
{
"lldpInst": {
"attributes": {
"adminSt": "enabled",
"dn": "topology/pod-1/node-206/sys/lldp/inst",
"infraVlan": "vlan-4093",
"sysDesc": "topology/pod-1/node-206"
}
}
},
{
"lldpInst": {
"attributes": {
"adminSt": "enabled",
"dn": "topology/pod-1/node-207/sys/lldp/inst",
"infraVlan": "vlan-4093",
"sysDesc": "topology/pod-1/node-207"
}
}
},
{
"lldpInst": {
"attributes": {
"adminSt": "enabled",
"dn": "topology/pod-1/node-208/sys/lldp/inst",
"infraVlan": "vlan-4093",
"sysDesc": "topology/pod-1/node-208"
}
}
},
{
"lldpInst": {
"attributes": {
"adminSt": "enabled",
"dn": "topology/pod-1/node-209/sys/lldp/inst",
"infraVlan": "vlan-4093",
"sysDesc": "topology/pod-1/node-209"
}
}
},
{
"lldpInst": {
"attributes": {
"adminSt": "enabled",
"dn": "topology/pod-1/node-210/sys/lldp/inst",
"infraVlan": "vlan-4093",
"sysDesc": "topology/pod-1/node-210"
}
}
}
]
12 changes: 12 additions & 0 deletions tests/checks/infravlan_overlap_access_policy_check/lldpInst_infra_vlan_single_entry.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
[
{
"lldpInst": {
"attributes": {
"adminSt": "enabled",
"dn": "topology/pod-1/node-201/sys/lldp/inst",
"infraVlan": "vlan-4093",
"sysDesc": "topology/pod-1/node-201"
}
}
}
]
Loading
Loading